Category Archives: Information Security Training

What to Expect During a Tabletop Exercise with MicroSolved, Inc.

Posted on by
Reply

 

When it comes to organizational resilience, preparedness is everything. At MicroSolved, Inc., we specialize in helping organizations refine their incident response capabilities through tailored tabletop exercises. These sessions are designed not just to test your response to potential threats but to actively improve your readiness, team cohesion, and ability to adapt to evolving risks. In this blog, we’ll walk through what you can expect during one of our tabletop engagements and why they’re a critical component of any security strategy.

Tabletop3

Purpose of a Tabletop Exercise

Tabletop exercises are immersive, scenario-driven simulations designed to prepare organizations for real-world incidents such as cyberattacks, data breaches, or disasters. Conducted in a safe, non-disruptive environment, these sessions serve multiple purposes:

  • Gap Identification: Uncover weaknesses in policies, procedures, and team readiness that could hinder your response during an actual incident.
  • Real-World Preparation: Test your team’s ability to make decisions under pressure in a controlled, simulated crisis.
  • Collaboration and Alignment: Strengthen coordination between departments, clarify roles and responsibilities, and align processes with industry best practices.

By the end of the exercise, participants gain greater confidence in their ability to navigate crises while leadership obtains actionable insights to strengthen their organizational defenses.

Pre-Engagement Preparation

A successful tabletop exercise begins long before the scenario unfolds. At MicroSolved, we follow a detailed pre-engagement process to ensure the exercise is meaningful and effective:

  1. Scoping: Every organization faces unique risks. That’s why we work closely with our clients to define the scope of the exercise and identify realistic scenarios tailored to their industry, threat landscape, and goals.
  2. Document Review: Our experts analyze existing policies, procedures, and technical systems to ensure the exercise reflects your organization’s current capabilities and areas for growth.
  3. Scenario Design: We take a collaborative approach to crafting scenarios. With client input, we develop challenges that are practical, relevant, and aligned with real-world threats. Our goal is to create an experience that is engaging and impactful for participants while addressing critical areas of concern.

This meticulous preparation ensures that your tabletop exercise delivers maximum value.

During the Exercise

When it’s time to step into the exercise, our team facilitates an interactive, thought-provoking simulation designed to engage and challenge your organization. Here’s what you can expect during the session:

  • Moderated Simulation: One of our experienced facilitators will guide participants through the scenario, posing dynamic challenges and ensuring the exercise stays focused and productive.
  • Role Assignments: Key personnel take on roles relevant to the exercise, such as members of the incident response, legal, communications, or executive teams. This approach reinforces accountability and helps participants better understand their responsibilities in a real crisis.
  • Injects: To keep participants on their toes, we introduce “injects” — unexpected developments such as new threat intelligence or complications. These injects test your team’s ability to adapt and make decisions as the situation evolves.

Our facilitation style encourages active participation, collaboration, and critical thinking, making the exercise both realistic and engaging.

Post-Exercise Debrief

The learning doesn’t stop when the scenario ends. In fact, the post-exercise debrief is where much of the value is realized. After the simulation, we guide participants through a structured review process that includes:

  1. Immediate Feedback: Moderators and observers provide initial insights into the team’s performance, highlighting strengths and areas for improvement.
  2. Gap Analysis: We identify specific gaps in your processes, tools, or training that may hinder your incident response capabilities.
  3. Deliverables: MicroSolved provides a comprehensive report summarizing observations, findings, and actionable recommendations. This deliverable serves as a roadmap for improving your organization’s readiness and resilience.

Benefits to Your Organization

Tabletop exercises are more than just training sessions — they are investments in your organization’s security posture and resilience. By working with MicroSolved, your organization can expect the following benefits:

  • Improved Incident Response: Develop confidence and competence in responding to a variety of incidents, from cyberattacks to natural disasters.
  • Clarity of Roles and Responsibilities: Ensure that every team member understands their role during a crisis, reducing confusion and delays.
  • Alignment with Best Practices: Strengthen alignment with industry standards, regulatory requirements, and proven best practices.
  • Enhanced Resilience: Build your organization’s capacity to adapt, respond, and recover from incidents with minimal disruption.

Why Choose MicroSolved?

At MicroSolved, we bring decades of experience and a deep understanding of the evolving threat landscape to every engagement. Our proprietary tools and methodologies ensure that each tabletop exercise is tailored to your organization’s unique needs, providing insights and recommendations that are both actionable and practical. We pride ourselves on our collaborative approach, ensuring that your team feels supported and empowered throughout the process.

Ready to Get Started?

A well-executed tabletop exercise can make the difference between a chaotic crisis response and a confident, coordinated recovery. If you’re ready to strengthen your organization’s readiness and resilience, contact MicroSolved today to schedule a tabletop engagement.

Learn More About MicroSolved’s Approach

Let’s build resilience, one scenario at a time.

 

 

* AI tools were used as a research assistant for this content.

The Value Proposition of MSI Tabletop Exercises for Management

Posted on by
Reply

When it comes to cybersecurity, incident response, and business continuity planning, preparedness is key. In today’s environment, where breaches and disruptions are inevitable, organizations cannot afford to operate with untested protocols or vague plans. This is where tabletop exercises come in—providing a structured, scenario-based approach to testing and refining an organization’s readiness for real-world crises.

Tabletop

What Are Tabletop Exercises and Why Do They Matter?

Tabletop exercises are facilitated discussions that simulate various incident scenarios—such as cyberattacks, natural disasters, or compliance failures. These exercises aren’t just theoretical; they are practical, interactive, and designed to uncover critical weaknesses in processes and decision-making.

  • Testing Readiness: Evaluate whether your incident response policies and protocols stand up under stress.
  • Identifying Gaps: Highlight vulnerabilities in coordination, communication, or technical measures.
  • Enhancing Team Skills: Empower teams to handle crises with confidence and clarity.
  • Supporting Compliance: Meet regulatory requirements and best practices, reducing audit-related headaches.

What Sets MSI’s Tabletop Exercises Apart?

MSI has been at the forefront of cybersecurity and risk management for decades. Its proprietary approach to tabletop exercises goes beyond generic templates, ensuring real value for your organization.

Why MSI?

  • Customization: MSI doesn’t believe in one-size-fits-all. Each exercise is meticulously tailored to your organization’s unique risk profile, environment, and industry challenges.
  • Expert Facilitation: Exercises are led by cybersecurity professionals with decades of experience in managing incidents across industries.
  • Comprehensive Analysis: Immediate feedback during the exercise, coupled with detailed post-event reports, ensures that you walk away with actionable insights.
  • Collaborative Approach: MSI partners with your team at every step—from scoping and design to execution and review—ensuring the exercise aligns with your strategic goals.

How Do Tabletop Exercises Benefit Management?

While tabletop exercises are valuable for all participants, they provide specific and strategic benefits to management teams:

  1. Preparedness: Demonstrate to boards, stakeholders, and customers that your organization is ready to handle crises effectively.
  2. Strategic Alignment: Ensure that incident response strategies support overarching business goals.
  3. Resource Prioritization: Identify areas requiring immediate investment, whether in tools, policies, or training.
  4. Decision-Making Practice: Equip executives to make informed, timely decisions under high-pressure conditions.

What Scenarios Can MSI Simulate?

MSI’s exercises are designed to address a wide array of potential threats, including but not limited to:

  • Cyberattacks: Ransomware, phishing, or data breach scenarios.
  • Business Continuity Disruptions: Power outages, supply chain failures, or natural disasters.
  • Compliance Failures: Simulated regulatory audits or legal challenges.
  • Insider Threats: Scenarios involving social engineering, sabotage, or employee-related risks.

Turning Lessons into Action

The value of a tabletop exercise lies in its outcomes, and MSI ensures that every exercise delivers actionable results.

  1. Real-Time Reviews: MSI conducts immediate debriefs to capture insights from participants.
  2. Gap Analysis: A detailed review identifies weaknesses and opportunities for improvement.
  3. Actionable Deliverables: You receive a written report outlining findings, recommended mitigations, and next steps to bolster resilience.

The ROI of Tabletop Exercises

While the upfront investment in tabletop exercises may seem daunting, the return on investment (ROI) is significant:

  • Faster Incident Response: Reduce the time it takes to contain and recover from an incident, minimizing financial and reputational losses.
  • Regulatory Compliance: Avoid costly fines by demonstrating proactive governance and compliance readiness.
  • Improved Collaboration: Strengthen team cohesion and reduce errors during real-world incidents.

Ultimately, these exercises save your organization time, money, and stress—while enhancing its overall resilience.

Take Action: Build Resilience Today

Preparedness isn’t just a buzzword—it’s a competitive advantage. MSI’s tabletop exercises are designed to give your organization the tools, confidence, and insights needed to face any challenge.

Don’t wait for a crisis to test your readiness. Contact MSI today at info@microsolved.com or visit microsolved.com to learn more about how tabletop exercises can transform your incident response strategy.

Let’s build resilience together.

 

* AI tools were used as a research assistant for this content.

 

Integrating Llama 2 AI Models into Daily Cybersecurity Operations

Posted on by
Reply

Integrating state-of-the-art Llama 2 AI models into daily cybersecurity operations can significantly enhance various aspects of security engineering. By deploying these models locally using tools like LM Studio and Ollama, organizations can ensure data privacy while customizing AI functionalities to meet specific needs.

Prompting

Below is an outline detailing potential applications, along with enhanced sample prompts for each use case:

1. Threat Detection and Analysis

Anomaly Detection

Utilize Llama 2 AI to identify unusual patterns in network traffic that may indicate security breaches.

Sample Prompt:

"Analyze the following network traffic logs for anomalies or patterns that could signify potential security threats, such as unauthorized access attempts, data exfiltration, or distributed denial-of-service (DDoS) activities."

Malware Identification

Employ the model to recognize and classify malware based on code signatures and behaviors.

Sample Prompt:

"Examine the provided code snippet to identify any characteristics of known malware, including malicious patterns, obfuscated code, or suspicious API calls. Provide a detailed analysis of your findings."

2. Incident Response

Automated Triage

Leverage Llama 2 AI to prioritize security incidents by assessing severity and potential impact.

Sample Prompt:

"Given the following incident report, assess the severity level and potential impact on our organization. Recommend immediate actions and prioritize the incident accordingly."

Root Cause Analysis

Use the model to analyze logs and system data to determine the origin of security incidents.

Sample Prompt:

"Analyze the attached system logs to identify the root cause of the security breach that occurred on [specific date]. Provide a step-by-step breakdown of how the breach happened and suggest mitigation strategies."

3. Vulnerability Management

Code Review Assistance

Apply Llama 2 AI to evaluate codebases for security vulnerabilities and suggest remediation strategies.

Sample Prompt:

"Review the following codebase for potential security vulnerabilities such as SQL injection, cross-site scripting, or insecure authentication mechanisms. Suggest remediation steps for any issues found."

Patch Management

Utilize the model to identify critical patches and predict potential exploitation risks.

Sample Prompt:

"From the latest software updates, identify critical patches relevant to our systems. Evaluate the risk of exploitation if these patches are not applied promptly and recommend a patch deployment schedule."

4. Security Policy Development

Policy Generation

Use Llama 2 AI to draft security policies by analyzing industry standards and organizational requirements.

Sample Prompt:

"Draft a comprehensive security policy for data encryption at rest and in transit, ensuring compliance with industry standards like ISO 27001 and specific organizational needs."

Compliance Monitoring

Employ the model to ensure adherence to regulatory standards and internal policies.

Sample Prompt:

"Evaluate our current data handling and storage practices to ensure compliance with GDPR regulations. Highlight any areas of non-compliance and recommend corrective actions."

5. User Behavior Analytics

Insider Threat Detection

Monitor user activities to identify behaviors indicative of insider threats.

Sample Prompt:

"Analyze the following user activity logs to detect any behaviors that may indicate potential insider threats, such as unauthorized data access, unusual file transfers, or irregular working hours."

Access Anomalies

Detect unusual access patterns that may signify compromised accounts.

Sample Prompt:

"Identify any unusual access patterns in the system logs, such as logins from unfamiliar IP addresses or devices, that could suggest compromised user accounts."

6. Security Awareness Training

Content Creation

Generate training materials tailored to emerging threats and organizational needs.

Sample Prompt:

"Develop engaging training materials focused on the latest phishing techniques, including real-world examples and interactive elements to educate employees on recognition and prevention."

Phishing Simulation

Develop realistic phishing scenarios to educate employees on recognizing and avoiding such attacks.

Sample Prompt:

"Create a realistic phishing email scenario that mimics current attacker strategies to test and train employees on identifying and reporting phishing attempts."

7. Automated Reporting

Incident Summarization

Automatically generate concise reports on security incidents for stakeholders.

Sample Prompt:

"Generate a concise report summarizing the key details, impact, and resolution steps of the recent security incident for presentation to the executive team."

Trend Analysis

Analyze security data over time to identify trends and inform strategic decisions.

Sample Prompt:

"Analyze security incident data from the past year to identify emerging threats and patterns. Provide insights to inform our cybersecurity strategy moving forward."

8. Integration with Security Tools

SIEM Enhancement

Incorporate Llama 2 AI into Security Information and Event Management (SIEM) systems to improve threat detection capabilities.

Sample Prompt:

"Enhance our SIEM system by integrating AI-driven analysis to improve threat detection accuracy and reduce false positives."

Endpoint Protection

Enhance endpoint security solutions by integrating AI-driven analysis for real-time threat prevention.

Sample Prompt:

"Implement AI-driven analysis into our endpoint security solutions to provide real-time detection and prevention of advanced threats and zero-day exploits."

Deploying Llama 2 AI Locally

To effectively utilize Llama 2 AI models, security engineers can deploy them locally using tools like LM Studio and Ollama.

LM Studio

This platform allows users to discover, download, and run local large language models (LLMs) on their computers. It supports architectures such as Llama 2, Mistral 7B, and others. LM Studio operates entirely offline, ensuring data privacy, and offers an in-app chat interface along with an OpenAI-compatible local server. Users can download compatible model files from Hugging Face repositories and explore new models through the app’s Discover page. Minimum requirements include an M1/M2 Mac or a Windows/Linux PC with a processor supporting AVX2.

Ollama

Ollama enables users to run models like Llama 2 and Mistral 7B locally. It offers customization options and the ability to create personalized models. Ollama is available for macOS, Linux, and Windows platforms.

By deploying Llama 2 AI models locally, security engineers can maintain control over their data and tailor AI functionalities to meet specific organizational needs.

Need Help or More Information?

For organizations seeking to enhance their cybersecurity strategies and effectively implement AI-driven solutions, partnering with experienced consultants is crucial. MicroSolved, Inc. offers over 30 years of expertise in defending digital assets and providing rational cybersecurity solutions. Their services include security initiative planning, leadership, oversight, coaching, mentoring, and board-level education.

To explore how MicroSolved, Inc. can help your organization leverage AI technologies like Llama 2 to strengthen your cybersecurity posture, contact them today at info@microsolved.com or visit their website at www.microsolved.com.

 

 

* AI tools were used as a research assistant for this content.

Brent’s Interview About His Most Recent Book

Posted on by
Reply

 

Introduction

In today’s digital age, the importance of cyber-security cannot be overstated. With threats evolving at an unprecedented rate, organizations need to be proactive in their approach to safeguarding their assets. “We Need To Talk: 52 Weeks To Better Cyber-Security” by L. Brent Huston offers a comprehensive guide to navigating the complex world of cyber-security. We sat down with the author to delve deeper into the inspiration, content, and significance of this book.

Interview

Q1: What inspired you to write “We Need To Talk: 52 Weeks To Better Cyber-Security”?

A1: As a virtual CISO and 30+ year security practitioner, I know how important it is to keep the security team engaged with one another, encourage open discussions, and do continual learning. I wrote the book to give security teams a good basis for these discussions every week for a year. Covering the basics and letting the team discuss sticking points and areas for improvement has led my clients to identify some interesting trends and rapidly mature their security programs. I think, literally, “We Need To Talk”. We need it as practitioners, individuals, teams, and organizations. This is a stressful, detail-oriented, rapid-change business, and talking helps nearly everyone involved.

Q2: Why did you feel it was essential to provide such a comprehensive view of cyber-security?

A2: So much of what we do is complex and touches multiple areas of our organization that we must bring the basics to each. I picked the topics for discussion in the book to address the high-level, technical, and procedural controls that almost every organization needs. I threw in some of the more tenacious topics I’ve encountered in my career and a few curve balls that have bitten us over the years. Information security and risk management are broad-spectrum careers, and we need a broad spectrum of topics to help security teams be successful.

Q3: Can you elaborate on how the structure of the book facilitates this year-long journey?

A3: This is a great question. The book idealizes a weekly security team meeting where the team discusses one of the topics and why it is relevant and then works through a series of questions to help them hone and refine their security program. The book includes a topic for each week, appropriate background information about that topic, and a set of questions for discussion by the team. As I piloted the book with my clients, it became clear that these were ultra-powerful discussions and led to some amazing insights. I knew then that I had to write and put the book out there to benefit security teams and practitioners.

Q4: How did leveraging AI tools shape the content and structure of the book?

A4: I used several AI tools to help generate the content of the book. It was written programmatically, in that I wrote some programming to leverage an AI backend to generate the questions and background information for each topic. I then adjusted the code and moderated the output until I got the book I wanted. It took a while, but it was fantastic when completed. I wanted to experiment with writing with AI tools, and since I knew the book I wanted to create had a specific format and content, it seemed like a good experiment. Ultimately, I learned much about working with AI and using Grammarly for editing and self-publishing. I have been absolutely thrilled with the response to the book and how the experiment turned out. In fact, it gave birth to another project that I am just beginning and will pave the way for some exciting new breakthroughs in how to work with AI tools in the coming years.

Q5: What is the one core message or lesson from your book that you’d like security teams to take away?

A5: The one takeaway I would have them consider is that discussion among the security team can really help a lot of the team members and the organization at large. We need to talk more about the work we do, both inside our teams and to the other teams we work with across the enterprise. The more we discuss, the more likely we can support each other and find the best solutions to our common problems and issues. Implementing the strategies, tactics, and insights we discover along the way might just be the change we need to make information security more effective, easier to manage, and even more fun!

Summary

L. Brent Huston’s “We Need To Talk: 52 Weeks To Better Cyber-Security” is more than just a book; it’s a roadmap for security teams to navigate the intricate maze of cyber-security. Through structured discussions, the book aims to foster collaboration, understanding, and growth among security professionals. With the unique blend of AI-generated content and Huston’s vast experience, this book promises to be an invaluable resource for those in the field.

 

* Just to let you know, we used some AI tools to gather the information for this article, and we polished it up with Grammarly to make sure it reads just right!

 

Saved By Ransomware Presentation Now Available

Posted on by
Reply

I recently spoke at ISSA Charlotte, and had a great crowd via Zoom. 

Here is the presentation deck and MP3 of the event. In it, I shared a story about an incident I worked around the start of Covid, where a client was literally saved from significant data breach and lateral spread from a simple compromise. What saved them, you might ask? Ransomware. 

That’s right. In this case, ransomware rescued the customer organization from significant damage and a potential loss of human life. 

Check out the story. I think you’ll find it very interesting. 

Let me know if you have questions – hit me up the social networks as @lbhuston.

Thanks for reading and listening! 

Deck: https://media.microsolved.com/SavedByRansomware.pdf

MP3: https://media.microsolved.com/SavedByRansomware.mp3

PS – I miss telling you folks stories, in person, so I hope you enjoy this virtual format as much as I did creating it! 

Utility Tabletop Cybersecurity Exercises

Posted on by
Reply

Recently, a group of federal partners, comprised of the Federal Energy Regulatory Commission (FERC), North American Reliability Corporation (NERC) and it’s regional entities released their Cyber Planning for Response and Recovery Study (CYPRES). The report was based on a review and analysis of the incident response and recovery capabilities of a set of their member’s cyber security units, and is a great example of some of the information sharing that is increasing in the industry. The report included reviews of eight utility companies’ incident response plans for critical infrastructure environments, and the programs reviewed varied in their size, complexity and maturity, though all were public utilities.

Though the specific tactics suggested in the report’s findings have come under fire and criticism, a few items emerged that were of broad agreement. The first is that most successful programs are based on NIST 800-61, which is a fantastic framework for incident response plans. Secondly, the report discusses how useful tabletop exercises are for practicing responses to cybersecurity threats and re-enforcing the lessons learned feedback loop to improve capabilities. As a result, each public utility should strongly consider implementing periodic tabletop exercises as a part of their cyber security and risk management programs.

Tabletop Exercises from MSI

At MicroSolved, we have been running cyber security tabletop exercises for our clients for more than a decade. We have a proprietary methodology for building out the role playing scenarios and using real-world threat intelligence and results from the client’s vulnerability management tools in the simulation. Our scenarios are developed into simulation modules, pre-approved by the client, and also include a variety of randomized events and nuances to more precisely simulate real life. During the tabletop exercise, we also leverage a custom written gaming management system to handle all event details, track game time and handle the randomization nuances.

Our tabletop exercise process is performed by two MSI team members. The first acts as the simulation moderator and “game master”, presenting the scenarios and tracking the various open threads as the simulation progresses. The second team member is an “observer” and they are skilled risk management team members who pre-review your incident response policies, procedures and documentation so that they can then prepare a gap analysis after the simulation. The gap analysis compares your performance during the game to the process and procedure requirements described and notes any differences, weaknesses or suggestions for improvement.

Target scenarios can be created to test any division of the organization, wide scale attacks or deeply nuanced compromises of specific lines of business. Various utility systems can be impacted in the simulation, including business networks, payment processing, EDI/supply chain, metering/AMI/smart grid, ICS/SCADA or other mission critical systems.Combination and cascading failures, disaster recovery and business continuity can also be modeled. In short, just about any cyber risks can be a part of the exercise.

Tabletop Exercise Outcomes and Deliverables

Our tabletop exercises result in a variety of detailed reports and a knowledge transfer session, if desired. The reports include the results of the policy/procedure review and gap analysis, a description of the simulated incident and an action plan for future improvements. If desired, a board level executive summary can also be included, suitable for presentation to boards, management teams, direct oversight groups, Public Utility Commission and Homeland Security auditors as well.

These reports will discuss the security measures tested, and provide advice on proactive controls that can be implemented, enhanced, matured or practiced in order to display capabilities in future incidents that reflect the ability to perform more rapid and efficient recovery.

The knowledge transfer session is your team’s chance to ask questions about the process, learn more about the gaps observed in their performance and discuss the lessons learned, suggestions and controls that call for improvement. Of course the session can include discussions of related initiatives and provide for contact information exchange with our team members, in the event that they can assist your team in the future. The knowledge transfer session can also be performed after your team has a chance to perform a major review of the reports and findings.

How to Get Started on Tabletop Exercises from MSI

Tabletop exercises are available from our team for cyber security incidents, disaster preparedness and response or business continuity functions. Exercises are available on an ad-hoc, 1 year, 2 year or 3 year subscription packages with frequencies ranging from quarterly to twice per year or yearly. Our team’s experience is applicable to all utility cyber programs and can include any required government partners, government agencies or regulators as appropriate.

Our team can help develop the scope of threats, cyber attacks or emergency events to be simulated. Common current examples include ransomware, phishing-based account compromises, cyber attacks that coincide with catastrophic events or service disruptions, physical attacks against substations or natural gas pipelines, data breach and compromise of various parts of the ICS/SCADA infrastructure. Our team will work with you to ensure that the scenario meets all of your important points and concerns.

Once the scenario is approved, we will schedule the simulation (which can be easily performed via web-conference to reduce travel costs and facilitate easy team attendance) and build the nuances to create the effects of a real event. Once completed, the reporting and knowledge transfer sessions can follow each instance.

Tabletop exercises can go a long way to increasing cybersecurity preparedness and re-enforcing the cybersecurity mindset of your team. It can also be a great opportunity for increasing IT/OT cooperation and strengthening relationships between those team members.

To get started, simply contact us via this web form or give us a call at (614) 351-1237. We would love to discuss tabletop exercises with you and help you leverage them to increase your security posture.

 

State of Security Podcast Episode 17 is Out!

Posted on by
Reply

In this episode (~45 minutes), I answer questions from the audience around blockchain and smart contract security considerations. I cover some of the reasons why I think these technologies are important, what their potential impacts are likely to be and how information security teams should prepare. Some of the questions drift into changes around store of value, investment insights and other closely related topics.

This episode is sponsored by MachineTruth™ – a new passive, analytics-based solution for network inventory, traffic analysis and security baselining. Learn more at  http://www.machinetruth.net.

 

They Price It Right! Come on down…

Posted on by

Healthcare from United States, come on down! Welcome to “They Price It Right!” There goes the industry, high-fiving all the other industries in the studio as it rushes towards Drew Carrey and the stage. And pays the ransom.

In 2017, healthcare organizations accounted for 15% of all security incidents and data breaches, second only to financial institutions (from Verizon’s 2017 DBIR). 66% of malware was installed through either email links or attachments. The healthcare industry has also been hard hit with ransomware in recent years.

* The above images captured from Verizon’s 2017 Data Breach Investigations Report

The last several years have seen a dramatic increase in ransomware within healthcare. To quote the CEO of an organization that DID pay out the ransom demand, “These folks have an interesting business model. They make it just easy enough. They price it right.” Symantec’s ISTR on Ransomware 2017 reports the average ransom demand “appears to have stabilized at US$544 indicating attackers may have found their sweet spot.” Ahhh…can just picture the blackmailer getting a notification that their target had succumbed and paid up…that hit the sweet spot.

However, a reminder; a $500 ransom may not seem much to an organization with millions or billions in revenue, but that’s per infection (sorry, pun not intended as we’re discussing the healthcare industry). Dozens or hundreds of infection can easily tally up the ransom to total in the tens or hundreds of thousands.

Furthermore, paying the sweet spot ransom does not guarantee even a bittersweet outcome. SentinelOne’s 2018 Ransomware Study shows 42% of ransom payments did not result in data recovery. 58% demanded a second payment.

* The above image captured from SentinelOne’s Global Ransomware Study 2018

Most ransomware is delivered through email. Phishing. Spearphishing. Targeted targets. Email addresses for an organization can easily be harvested using readily available open source tools. 15 minutes to create a phishing campaign with the newly found targets with a link or malicious attachment. The context of the email can be social media related, user needs to reset their password, they have a package that was undelivered, the CEO has attached a memo addressed to all staff. The recent Russian indictments – regardless of the reader’s political leanings – are proof that PHISHING WORKS! (Also blogged here in stateofsecurity.com)

Technology has come a long way – email filters, domain verification, Sender Policy Framework, malware and link scanners – plus many more help in filtering out the 50-70% of the email traffic that is spam. But they still get through. I know for one my Inbox is not spam-free or devoid of any phishing messages.

Since technology is not at the point where it’s able to stop all phishing email, it is up to the user to NOT click on that link or attachment. Sure, there are technologies that prevent bad things from happening if a user DOES click on a phishing link or malicious attachment. But then again, technology is not at the point where they are 100% effective.

Businesses with big budgets buy all kinds of hardware and software solutions to try to counter phishing. But they ignore a big piece of the phishing attack model, and that is the end user. And here, education and training is imperative.

Repeating phishing exercises should be conducted on all or selected groups of employees. These campaigns should be at not-too-regular intervals, so as not to evoke an anticipation from the employees – alright, here come some vaguely suspicious email on the first day of each quarter; I’ll just delete them. Then the rest of the year, they blatantly open, view and click on any and all email links. The simulated campaigns should be randomized and as unexpected as possible.

These campaigns should also be followed up with some education, either some static web pages, training video or live in person session. Phishers are always coming up with new tricks and methods. As a result, end users should be brought up to speed with their new tricks. A couple academic research papers on the efficacy of phishing training demonstrate that EDUCATION WORKS! (links under Resources below)

Then there needs to be a culture of non-retribution. Phishing exercises should be conducted with learning as the objective. Employees should come away with a heightened awareness of phishing and the social engineering tricks used by phishers that make you just want to click that link/attachment.

Employees should be encouraged to report any suspicious email so that word gets around. Homeland Security’s “See something, say something” campaign applies here too; someone is perhaps targeting your firm, alert your fellow colleagues.

Resources:

https://www.verizonenterprise.com/resources/reports/2017_dbir_en_xg.pdf

https://go.sentinelone.com/rs/327-MNM-087/images/Ransomware%20Research%20Data%20Summary%202018.pdf

https://www.healthcaredive.com/news/must-know-healthcare-cybersecurity-statistics/435983/

https://www.symantec.com/content/dam/symantec/docs/security-center/white-papers/istr-ransomware-2017-en.pdf

https://blog.barkly.com/phishing-statistics-2016

http://www.cs.cmu.edu/~jasonh/publications/apwg-ecrime2007-johnny.pdf

https://www.usenix.org/system/files/conference/soups2017/soups2017-lastdrager.pdf

https://www.dhs.gov/see-something-say-something/about-campaign

If you would like to know more about MicroSolved or its services please send an e-mail to info@microsolved.com or visit microsolved.com.

Privacy Concerns With Facebook’s iPhone App

Posted on by
3

I just wanted to give everyone a quick example of why you should always exercise caution when modifying an application’s privacy settings.

Facebook is rolling out a feature in the US that allows people to automatically identify and share things they’re listening to or watching. It’s important to keep in mind that this leveraging this feature requires that you grant Facebook access to your iPhone’s microphone. This means that Facebook will turn on your microphone every time you write a status update. It is worth considering the sacrifice in privacy compared to the convenience that you gain by leveraging this feature. Is it really worth allowing an organization to hear your conversations just so you can gain the ability to easily share what TV show you’re watching?

Facebook has stated that they do not record or archive these transmissions. However, using this feature requires that you trust that a 3rd-party (Facebook) will handle your data appropriately. Do you really need to provide them with this data? Does it really save you that much time to have your background noise automatically analyzed? These are questions you should ask yourself prior to providing Facebook with this level of access.

Privacy vs. Convenience

Posted on by
Reply

I’ve lost track of how many useful cloud-based services I have signed up for within the last few years. I can’t picture my life without products like Uber, FancyHands and Gmail. It often surprises people to find out that these products are free or very inexpensive. If they’re giving the service away for free or at a very low cost, how can the companies make money?

Typically, a service provider is able to gain a substantial profit based on the fact that they are able to harvest your data. Imagine what an advertiser could gain just by learning information about your latest Uber ride. When using a service provider, it’s important to ask yourself, is the convenience worth the sacrifice of your privacy? While it’s possible that not all of these service providers are harvesting or selling your data, it’s worthwhile to at least consider your loss of control.

Personally, I have found that there are circumstances in which I am willing to sacrifice my privacy for a cheaper and more effective product. I feel that the convenience of being able to order a cab with the touch of a button on my phone is worth the risk of another corporation learning details about my trip. Another circumstance in which I am willing to forgo a bit of my privacy to gain a convenience would be my use of a “savings card” at my local grocery store. I have no doubt that they are tracking and analyzing my purchases. However, I have always felt that it is worthwhile to share my purchase history with the grocery store due to the discounts that they provide for using the “savings card”.

Despite the fact that I am often willing to forgo my privacy in an attempt to gain access to a service offering, there are products that I do not feel that the offered convenience warrants the loss of control over my personal information. For example, I recently looked into leveraging a service that could automatically unsubscribe me from a number of subscription emails. As annoying as those emails can be, I didn’t feel that the convenience of this service was worth letting a 3rd party parse through all of my emails.

Each time my personally identifiable information (PII) is exposed to attackers as a part of a data breach, I become more likely to voluntarily share my personal information with a 3rd party in an effort to gain a convenience. Next time you prepare to sign up for a free or discounted service, be sure to take a few extra moments to decide whether or not you are willing to expose your private information to gain access to the service. After all, there’s no such thing as a free lunch.