About Brent Huston

I am the CEO of MicroSolved, Inc. and a security evangelist. I have spent the last 20+ years working to make the Internet safer for everyone on a global scale. I believe the Internet has the capability to contribute to the next great leap for mankind, and I want to help make that happen!

How to Rotate Your SSH Keys

Posted on April 19, 2022 by Brent Huston

SSH keys are used to secure access to and authenticate authorized users to remote servers. They are stored locally on the client machine and are encrypted using public-key cryptography. These keys are used to encrypt communications between the client and server and provide secure remote access.

When you log into a remote machine, you must provide a valid private key to decrypt the traffic. As long as the private key remains secret, only you can access the server. However, if someone obtains your private key, they can impersonate you on the network.

SSH key rotation helps prevent this type of unauthorized access. It reduces the risk that someone has access to your private key, and helps prevent malicious users from being able to impersonate you on your network.

Most security policies and best practices call for rotating your key files on a periodic basis, ranging from yearly to quarterly, depending on the sensitivity of the data on the system. Such policies go a long way to ensuring the security of authentication credentials and the authentication process for sensitive machines.

There are two ways to rotate your keys: manually, and automatically.

Manually

To manually perform key rotation, you need to generate a new pair of keys. Each time you do this, you create a new key pair. You then upload the public key file to the server you wish to connect to. Once uploaded, the server uses the public key to verify that you are who you say you are.

Automatically

An alternative approach is to use automatic key rotation. With automatic rotation, you don’t need to generate a new key pair each time you change your password. Instead, you simply update the permissions on your existing key file.

The following steps show how to configure automatic rotation.

1. Generate a new keypair

2. Upload the public key to the remote server

3. Configure the remote server to use the new keypair

4. Update the permissions on the old keypair file

5. Delete the old keypair

6. Logout from the remote server

More Information

On Linux systems, use the “man” command to learn more about the following:

- ssh-keygen command
- ssh-public-key command
- upload-ssh-public-key command

The examples should provide options for command parameters and sample command output for your operating system.

For more information about the SSH protocol, you can review the Wikipedia article here.

Four Uses for the Raspberry Pi in Small Business Security

Posted on April 18, 2022 by Brent Huston

With Raspberry Pi systems now available fully decked out for under $100, there are many uses that small business security teams can find for these versatile devices. Here are four of our favorites for using them in security roles.

1. Honeypot for Detecting Attackers on Your Network

Our HoneyPoint™ Agent runs on the Pi. It allows you to monitor for potential network compromises and attempts to breach your network by offering a fake system for attackers to target. Since the system has no real use, any interaction with it is suspicious at best, and malicious at worst. This allows for an easy-to-manage detection tool for your business.

2. Nessus Scanning Engine for Vulnerability Management

Nessus now supports running on the Pi 4 with 8 Gigs of RAM. Nessus is a very popular and powerful vulnerability scanner. With it, you can scan your network for vulnerabilities and find out what software needs updating.

3. Run Pi-Hole for Content Filtering

Pi-Hole is one of the best open-source security tools on the Internet. It provides enterprise-quality content filtering for free. Drop this on your network and implement it following the online instructions, and you’ve got affordable protection against malicious advertising, bad content, and many types of malware that inject via the browser.

4. Build a Cheap VPN Server

PiVPN makes setting a VPN for your small business needs incredibly simple. You can use this feature to access systems while you’re away or just to stay safer on public wireless networks. Most folks can deploy this in under an hour, and it can save you an immense amount of risk.

Using a Pi for some other risk management or security purpose? We’d love to hear about it. Drop me a line on Twitter (@lbhuston) and let me know what you’re up to. We’ll feature any ground breaking ideas in future posts.

A Cynefin Risk Management Use Case

Posted on March 30, 2022 by Brent Huston

Lately, I have been working on using the Cynefin framework to help a client with supply chain risk management. I’m not going to dig into the specifics here, but I wanted to share a quick workflow that we used during this process that has been very useful for us.

Risk Matrix

First, we built a risk matrix for supply chain risk. Basically, there are a number of these available via the various search engines. We took some of the most common ones and tore them down to commonalities, then built them into our matrix. We turned this into a simple spreadsheet.

Heat Mapping

Next, once we had our risk matrix, we did an exercise where we heat mapped the various risks, scoring them high/medium/low subjectively. This gave us an excellent tool to monitor our situation and communicate it with our stakeholders.

Applying Cynefin

Next, we mapped all of the high risks into the cynefin framework by researching the present state of each, whether best practices were available and relevant, being developed, or still in the experimental stage. This gave us a good idea of which problems we could simply focus on using known techniques and skills against, which ones we needed to take existing decent practices and optimize them, and which problems we needed to experiment with solutions for.

Sharing and Feedback

Overall, the exercise took around an hour to complete once we compiled the basic templates and completed the risk matrix research. For those of you facing complex risk management problems, this workflow might assist. Let me know on social media (@lbhuston) if it provides any help or if you have suggestions and feedback. Thanks for reading!

3 Common Challenges Implementing Multi-Factor Authentication

Posted on January 26, 2022 by Brent Huston

Multi-factor authentication is becoming increasingly popular among businesses and consumers alike.

However, many organizations struggle to implement the technology successfully.

Here are three challenges organizations face when implementing multi-factor authentication.

1. Lack of Awareness

Many organizations don’t understand what multi-factor authentication is or why they should use it.

They think it’s too complicated, expensive, or unnecessary.

This misconception leads to a lack of awareness about the security risks posed by weak passwords and phishing attacks.

2. Security Concerns

Some organizations believe that multi-factor authentication adds complexity and cost to their IT infrastructure.

But, in reality, multi-factor authentication doesn’t add much overhead.

Instead, it provides additional layers of protection against cyberattacks.

3. Complexity

Organizations sometimes find it difficult to integrate multi-factor authentication into their existing systems.

For example, they might have to replace old software or change user interfaces.

Some Potential Solution Ideas

If you’re struggling to implement multi-factor authentication, here are some tips to help you overcome these challenges.

1. Educate Employees About Multi-Factor Authentication

Educating employees about multi-factor authentication helps them understand its importance.

Make sure employees know that using multi-factor authentication reduces the likelihood of fraud and improves overall security.

2. Use Technology That Works For You

Multi-factor authentication tools are becoming more popular by the day. Many low-cost, or even free, solutions exist from vendors like Microsoft, DUOand others.

Look for solutions that have easy integration with your existing business infrastructure and systems.

3. Work With A Partner

A partner who has experience implementing multi-factor authentication can be helpful.

An experienced partner can provide guidance and support throughout the implementation process.

4. Make Sure The Solution Is Right For You

Before choosing a solution, make sure it meets your organization’s needs.

As always, if we can be of assistance, drop us a line to info@microsolved.com. We’d be happy to help!

3 Essential Raspberry Pi Hardening Steps

Posted on January 24, 2022 by Brent Huston

Raspberry Pi hardening is essential for securing your device against attacks.

Here are three essential Raspberry Pi hardening steps:

1. Disable SSH If You Don’t Need It

Disable SSH access to your Raspberry Pi using the following command:

sudo raspi-config

Choose “Advanced Options” and then choose “No ssh”.

2. Change Your Password

Change your password to something secure. You can use the following command:

passwd

3. Update Raspbian

Update your Raspberry Pi’s operating system to the latest version available. This ensures that your device is up to date with security patches and bug fixes.

To update your Raspberry Pi, follow these instructions:

sudo apt-get update

sudo apt-get upgrade

In summary, hardening your device by following these steps will help you protect your Pi from attacks. Making these three basic steps a part of every Pi install you do will go a long way to giving you a safer, more dependable, and more private experience.

Why Emulate a PLC with a Raspberry Pi

Posted on January 22, 2022 by Brent Huston

One of the most powerful uses of emulating a PLC (Programmable Logic Controller) field device with a Raspberry Pi is that it provides an affordable and easily obtained platform for prototyping, performing ladder logic testing, and researching various industrial control systems and cybersecurity concepts.

Raspberry Pis are Affordable

Raspberry Pi models 3 and 4 are significantly more affordable than real PLCs. A typical PLC can cost hundreds or thousands of dollars.

The Raspberry Pi costs around $35-50 depending on your model choice. This makes them very accessible to hobbyists, students, researchers, developers, and anyone else who wants to work with the basics of industrial control systems. The low cost makes them ideal candidates to emulate a PLC in many scenarios.

Raspberry Pis are Easily Obtainable

PLCs can be quite difficult to come by, especially if you want one without any pre-existing software installed. Many manufacturers will not sell their products to third parties unless they have some kind of existing relationship. If you don’t already know someone at the manufacturer then you may need to pay a hefty upcharge. Additionally, purchasing the addons for power supplies, specific programming software, and such can quickly turn into a slog of paperwork and supporting tasks. The lead time and delivery times can take weeks to months.

The Raspberry Pi, on the other hand, can be purchased at many big-box electronics or computer stores, directly from many providers, or even delivered to your door from Amazon and other online sources. It uses a common USB power supply and can be configured and programmed using open source tools available online. Lead time is a couple of days to a few hours, letting you stay focused on your work.

The OpenPLC Project

The OpenPLC Project is a stable, well-documented toolkit for emulating basic PLC operations on the Pi. It has been used successfully to simulate a variety of different types of PLCs and includes support for ladder logic and other common PLC functions. You can find the programming reference and review the available capabilities here.

You can get OpenPLC up and running on a Pi in less than 30 minutes. In our testing, we were able to begin using the emulated PLC in our lab within an hour!

Going The Extra Mile With SCADABR

SCADABR is an open-source supervisory control and data acquisition software package designed to allow you to create interactive screens or human-machine interfaces (HMI) for your automation projects. It provides tools for creating graphical user interface widgets, event handlers, timers, and dialogs. With its ability to communicate with multiple controllers (including OpenPLC), ScadaBR is an ideal companion for the OpenPLC Runtime and Editor.

Using a Pi, OpenPLC, and SCADABR together, can get you a very powerful and useful PLC platform up and running for under $100 and in less than a few hours. Once implemented, you can use the platform to learn about industrial controls systems, ladder logic, PLC programming, and operations. You can also do basic ladder logic research and testing, and even prototyping for future real-world PLC deployments. Cybersecurity folks also have a very capable platform for learning about industrial control security requirements, performing vulnerability research, reverse engineering, or practicing their assessment skills in a safe environment.

While you might not get the full power of a true PLC (there are some limitations to Pi’s capabilities), you will likely get more than you expect. If you have an interest in or a need for some basic industrial control systems capabilities, this is a great place to start.

What Is The Danger of Leaked Source Code?

Posted on January 12, 2022 by Brent Huston

Source code leaks are one of the biggest risks facing software developers today. It exposes sensitive business secrets, intellectual property, and trade secrets. It also puts the source code itself at risk of being used maliciously.

When source code leaks, it can lead to a number of issues. For instance, it could allow hackers to steal valuable IP. It could expose sensitive customer information. It could put employees at risk of having their identities stolen. And it could cause legal problems for companies.

In fact, according to a recent study conducted by KPMG, nearly half of respondents said that they had experienced a leak of confidential or proprietary information. Of those, almost two-thirds said that the leak was due to a developer leaving the company.

To learn more about our solution to helping customers detect and respond to source code leaks (along with other forms of critical data), check out our ClawBack™ product. The page contains several videos, pricing, and use cases. Give us a call at 1-614-351-1237 or drop us a line at info@microsolved.com to learn more or discuss how ClawBack can go to work for you!

The Biggest Challenges to Firms using Cyber Threat Intelligence

Posted on January 10, 2022 by Brent Huston

Cyber threat intelligence is one of the hottest topics in cybersecurity today. Many firms are investing heavily in developing and deploying solutions to identify and respond to cyber threats. But despite the hype surrounding cyber threat intelligence, many firms still struggle to make sense of the data they collect.

Why are firms struggling to make sense of their data, and how they can overcome this challenge? We asked around. It looks like three key challenges emerged, and here they are:

1. Data quality – How do we know if our data is accurate?

2. Data volume – How much data do we need to store?

3. Data integration – How do we combine multiple sources of data?

We’re working on ideas around these 3 most common problems. We’re working with firms of all sizes to help solve them. When we get to firm, across-the-board answers, we’ll post them. In the meantime, knowing the most common issues firms are facing in the threat intelligence arena gives us all a good place to start.

Got workarounds or solutions to these issues? Drop me a line on Twitter (@lbhuston) and let me know how you’re doing it. We’ll share the great ideas as they are proven out.

How Does an IT Audit Differ from a Security Assessment?

Posted on January 4, 2022 by Brent Huston

One of the most common questions that I get asked is about the differences between an IT Audit and a Security Assessment. Hopefully, this quick overview helps to remove some of the confusion around these terms, which should not be used interchangeably.

What Is A Security Assessment?

A Security Assessment is a focused, proactive evaluation of an organization’s cybersecurity landscape that identifies potential risks and opportunities for improvement. The objective of conducting a Security Assessment is to provide an overview of an organization’s current state in terms of its cybersecurity posture. To do this, the currently implemented controls and systems are tested for resilience against common vulnerabilities and forms of attack.

Security assessments may, or may not, include penetration tests. However, they should always check for potential vulnerabilities. These reviews are best conducted by an independent third party.

What Is an IT Audit?

An IT Audit is a comprehensive review of your organization’s information technology (IT) infrastructure. It provides a detailed analysis of how well you are managing your IT resources, including hardware, software, networks, applications, policies, procedures, and controls.

It compares your current state of operations against a prescribed set of standards, controls, or requirements. These types of reviews are often conducted by an internal audit or an internal team, though many smaller firms use external consultants to complete them, as well.

What’s the Difference?

The difference between an IT Audit and a Security Assessment is one of scope. An IT Audit will typically focus on a single area or set of areas while a Security Assessment may cover multiple areas. For example, an IT Audit may include an examination of the organization’s capabilities to comply with a specific standard, for example, HIPAA, while a security assessment would test the cyber-security controls’ around your HIPAA data for effectiveness against common forms of attack.

In the end, an IT Audit is useful for getting a high-level overview of the gap between a required set of controls or standards, while a Security Assessment provides specific insights into how well the controls you have in place are protecting you and your assets.

What to Do with the Data

Once you have the insights provided by these engagements, you can easily use the data to update your security policies, implement additional internal controls to create an acceptable level of risks, revise your standard operating procedures or increase your network security and application-level protection.

Often, how the results of these engagements are used can be a major difference between the maturity level of your cybersecurity program. These processes should be used on at least a yearly basis for small firms, and on an ongoing basis for larger, more mature firms. Doing so will greatly improve your organizational security posture over time.

For more information on these types of engagements, or to discuss either an IT Audit or a Security Assessment, please get in touch with MicroSolved (info@microsolved.com or 614-351-1237). We would love to put our nearly 30 years of experience to work for you!

How To Handle Leaked Credentials

Posted on January 3, 2022 by Brent Huston

OK, so you used ClawBack™ or some other tool and found leaked credentials linked to one of your employees on the web. Now, what do you do?

First, don’t panic. Leaked credentials happen all of the time. On average, it was discovered that employee email credentials from 10% of all Fortune 500 companies have been leaked in some form of data breach. (blog.finjan.com) Another report published recently suggests that the web currently hosts leaked credentials of employees for 97% of the top 1,000 global companies – many stemming from third-party data breaches. (blog.finjan.com)

Once you come to terms with your find, it’s time to get down to business researching the issue. The first step is to determine what kind of data you have identified. Usually, leaked credentials come with a user ID like an email, system login name, or the like. Presumably, this is how you found the credentials in the first place. Next, determine if you have a password and/or hash for that user that was contained in the leak. If you found only a list of emails or names, there is not much actionable intelligence there, beyond maybe letting those users know that they are at increased risk for phishing and reminding them to be vigilant.

If, however, you have a password or hash tied to one of your user names in the leak, a few more steps are involved. If you have a password, the first step is to determine if that password meets whatever password policies you have defined across the organization. This is a key leverage point for identifying potential leaks – many, if not most, leaked passwords come from third-party systems and websites that are compromised by attackers but are only used by the firm’s employees. It’s pervasive for industry sites, or shopping sites to be linked to your employee’s identity – it could be as simple as your employee signed up for the site with their work email, and that site got breached. If that is the case, then as long as your employee doesn’t use that password at work (or similar passwords: eg: Summer12 and Summer13, etc.) there is little risk to the firm. If the password would not meet your password policy for your domain, webmail, and other applications, then this is likely the case. If that happens, simply contact the employee, advise them of the leaked credential, and make sure that they understand to change their passwords anywhere they used that password in their online life.

But, what if the password could be one of your domain or webmail accounts? If the password would meet your policies, then immediately force a password change on all systems for that user. If possible, you should also terminate any open sessions and force the user to change their credentials. While a determined attacker may exploit this process to reset the password themselves if they have the ability, it prevents any non-resourced attackers from exploiting the credentials. The worst case is that an employee loses a current session and has to reset their passwords to continue working.

However, don’t stop there – contact the user and advise them of the leaked credential. Ask them if it was used on any work-related systems or applications, and if so, immediately begin an investigation on those systems looking for signs of illicit access. This should be performed using intensive log reviews and should go back to the date of the user’s previous password change whenever possible. Do not depend on the leak date, if shown, as the boundary for the incident. Attackers may have had knowledge and access prior to making the leak public. Often, attackers use compromised accounts for some time, getting what they want from the victim, and then release the stolen credentials to other attackers via a sale, or to the public, in the hopes that the additional attacker traffic will hide the original compromise.

Lastly, if you only have a hash of a potential password, I would still follow the process above. Most hashes can be broken given enough resources. Thus, it is erring on the side of caution to follow the above process, and accept the hash as a credential that could be in use in your environment.

Got other workarounds for leaked credentials? I’d love to hear them. Drop me a line on Twitter, and let me know (@lbhuston). I’ll share any insights in future posts.

If you’d like to learn more about ClawBack – check out our solution for hunting down leaked credentials, source code, and configuration data. Get in touch with us for a discussion, or check out the videos on our website for a walkthrough.