Real computer information security is highly dependent on the awareness and concern of individual computer device users. But people don’t view the security of their computers, pads and smart phones the same way they view the security of their cars, or houses or kids. On the whole, we are apathetic about the subject.
I have often tried to figure out why this is true, and I’ve heard several reasons such as: “Computers and technology are just too complicated and technical. I feel inadequate to the task.” Or “I have too many things to worry about already. I don’t need anything else to take a bite out of my quality time.” Or “So what if I get hacked!? The worst that can happen is that I’ll be embarrassed a bit or lose some of my money – I’ll still have my health, my family and my life!” Of all these mistaken ideas I think the last one is the most dangerous; not believing that anything really bad will happen to me and mine because of a hack.
For years my compatriots and I have discussed the idea that what will truly shock society awake is a hacking incident so severe that nobody can just ignore the subject anymore; a kind of cyber-Pearl Harbor. But none of us actually want to see “the big one” occur. We are hoping that smaller but still significant incidents will get the ball rolling.
The Ashley Madison hack is a small step in this direction that I hope people will embrace and learn from, because the consequences of this hack are a cut above what has been experienced by the everyday user in the past. Think of the marital unrest this has caused – think of the divorces, the tears, the kids that no longer feel safe and secure. Then there are the legal entanglements and lost jobs (both present and future) to consider. Awful!
But the biggest consequence of all is the loss of human life that has (and will in my opinion) come about because of this exposure. There have been a number of suicides already that are directly attributable to the Ashley Madison debacle, and I would be amazed if there weren’t some murders to accompany them as well. Is it worth human lives to be apathetic and unaware!? Let’s hope that folks decide it isn’t and take steps to protect themselves.

MSI seems to be growing every day. As we bring on new staff, we are working hard to make sure that we maintain our existing corporate culture. It can be difficult to identify whether or not an individual has the necessary traits to be a successful employee. However, it’s important to think of the hiring process as an opportunity rather than a challenge.

The first thing I look for in a new employee is curiosity. To me, this is far more important than intelligence. An employee can always learn about how to support a specific system or perform a process. I think it’s much more important to find an individual that wants to understand WHY we use a specific process or HOW a system works. This is a trait that can’t be taught.

The next thing I look for is the ability to adapt. The Information Technology field changes rapidly. The latest and greatest piece of technology seems to be obsolete soon after it is published. It’s worthwhile to identify an individual that can handle these changes well.

IT professionals typically have to wear many hats. In my short career, I’ve served as an Information Security Officer, Help Desk Manager, Systems Administrator, Penetration Tester, Security Consultant, Infrastructure Manager, Intelligence Engineer and Pre-Sales Engineer. Typically those roles weren’t assigned until after I accepted a position. Due to the frequent shift in responsibilities, an IT professional must be flexible.

You may be wondering how you can spot these traits in an during an interview or by viewing the individual’s resume and LinkedIn profile. To discover a potential employee that is curious, look to see if they list diverse interests. If you’re attempting to identify an employee who has the ability to adapt to changes and remain flexible, look and see if they’ve supported a wide variety of systems and processes during their career.

Finally, it’s important to consider whether or not you enjoy spending time with this person. In some cases, you’ll spend more time with them than your own family. You could discover an employee with all the right traits and skills but will be in a difficult situation if your personalities clash. In short, take some extra time to look past someone’s employment history and discover whether or not they have the skills that can’t be taught.

• Discover and document – You can’t protect a system if you don’t know it exists. Take some time to identify and document all of the legacy and unsupported operating systems in your network.
• Isolate – Segmenting the ICS system will reduce the risk of it being compromised by an attacker. Take some time to verify that it is inaccessible from any unnecessary business/ user networks.
• Update and secure – Install all available patches and updates. Be sure that you are notified of any updates to the operating system, firmware and any installed applications.
• Perform thorough log analysis – Implement some sort of centralized logging platform to ensure you have the ability to detect any anomalies that occur within these systems.
• Leverage the use of an ICS honeypot – Creating a HoneyPot ICS device will help you discover suspicious activity within your network before it affects a production system.

As many of you may have heard, businesses throughout the world have seen an increase in ransomware being used against them. What should businesses do to help prevent these sort of extortions from happening to them? This is what we will attempt to answer with this posting.

We have all heard the old adage “an ounce of prevention is worth a pound of cure”, nothing could be truer, especially for this particular situation! So lets go over some of the preventative steps that your organization may follow before you become infected with ransomware:

• User education and training! Start off with end-user education, you know the people who are actually going to see these sort of attacks. Lets not focus on just select few like your sys-admins, but rather the entire organization. Everyone has a part in keeping your business secure and education is the key.

• As part of the education of the end-users, let them know who to contact if they see something suspicious, whether that is your help desk or someone who is designated for your organization to help guide them through the process of what to do. The end-users have to be able recognize that something has occurred in order for them to report it in the first place.

• Organizations should enforce the least privileged methodology. This is a way to grant the minimum amount of access to files as the person needs to perform their job-related duties. If a person does not need read/write access to certain files don’t grant it. This will help keep the ransomware from doing the same since they work based on the privileges of the person who is logged in at the time and encrypt files that the person has read/ write access to.

• Most organizations now configure their email servers to prohibit them from sending or receiving executable files. Make sure yours does too. The real issue here are macros that are enabled when sent with a document. As this is a potential attack vector for this and other types of malware.

• Patch your software to the most current version. By not doing so you may be leaving the door open for a variety of malware to take advantage of your company. The malware will exploit flaws in the older versions of software that your company uses. We have seen time and time again where businesses aren’t aggressively keeping their software updated to the latest version and they are targeted by threat actors as a result.

• If possible restrict the execution of programs from temp folders in a user’s profile. For example, “c:\users\<username>\folder\temp”. What do I mean by this? If a virus or ransomware in this case, were to attempt to use a temp folder as the first execution point it would be blocked from being allowed to do so by Group Policy Objects. So you effectively nix the ransomware before it has had a chance to infect your computer!

• Organizations should consider implementing some sort of web filtering such as keeping track of blacklisted IP addresses or domains.

• Whatever antivirus solution your company employs please ensure that they are updated with the latest virus definitions to increase their effectiveness. A company could even consider having different antivirus products for different purposes, such as having one product for desktops and another for email. That way the company is ensuring that there is some degree of overlap in their antivirus coverage!

• Adobe’s Flash should be disabled at this point, as it really has been a very popular infection vector for ransomware. Disabling it would greatly reduce the amount of infection vectors available to would-be attackers.

• Lastly, backups are really the only way to restore functionality to the affected systems once they have been compromised, providing a backup process already exists in your organization and that the backups are checked for completeness. This way if you do need to use your backups, they will get you back on your feet as soon as possible with the least amount of downtime.

As always the education of all of your employees is key to this or any other sort of security related incident before it happens. As is effective communication both before a security incident starts and during the response/ recovery process.

The number of people in the United States has been increasing heavily over time and we are currently the third most populace country on the planet. In the last century, the population has more than tripled here, and it is estimated that we will add more than 100,000,000 to the current total by 2050. One of the things that help us cope with such huge numbers is taking advantage of economies of scale.
For example, we build truly giant ships to carry our oil and cargo because the bigger the ship is the more hydrodynamic advantage there is and the less cost there is per ton for transportation. Similarly, we build enormous power plants and network them into grids because it is more efficient and cheaper per kilowatt hour to do so. There are many more examples of this trend all across American commerce. While this practice indeed does work and enables us in many ways, it comes with a variety of costs; one of which is increased risk.
We stand to lose a lot of oil and cause major environmental catastrophes if someone starts sinking major super tankers, for example. And if an enemy starts destroying our large power plants (or critical nodes in the infrastructure connecting them), the impact could be very much worse than that.
I mention all of this, because now we are seeing the trend toward economies of scale coming into the information processing world, mainly in the form of cloud computing. This trend is inevitable because it truly is more efficient, cheaper and improves peoples’ lives in many ways. But it must be realized that this centralization of data processing and storage brings with it the same increase in impact if a major compromise occurs – and the greater the impact, the greater the risk.
What this means in the information security world is that we need to have more security assurance built into these large cloud systems. It should be stated like a natural law: the bigger the system, the more effective the security controls need to be. So before you put all of your valuables into the cloud, keep the risks inherent in economies of scale in mind and vet your cloud provider’s security measures. Make sure that they have all the technical, operational, physical and management controls in place. Ensure that their information security program is transparent and reactive to realistic criticism. And ensure that your own organization realizes the risks inherent in the cloud and plans accordingly as well. Remember, it is your own organization that is ultimately responsible for the security of their data no matter where it is stored or processed.

Drafting an Incident Response Policy can seem overwhelming. At the beginning, it doesn’t seem feasible that a single document can help you maintain order during a breach. You may ask yourself if it’s even possible to prepare your team for responding to all of the latest Tactics, Techniques and Procedures (TTP) that attackers are leveraging. It’s not possible to craft a document that addresses every possible threat individually. However, you can create an effective policy that covers each major threat category as opposed to each individual attack.

If you’re not sure which categories to focus on, I recommend taking a look at Microsoft’s STRIDE Threat Model. STRIDE stands for Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege. By leveraging the STRIDE model (or any other threat model), you can create a policy that will be relevant for years to come. This “one size fits all” approach will not only make your policy more efficient, it will be much more effective.

After you’ve crafted your policy, be sure to take the time to walk through a few scenarios. It’s even worthwhile to bring in a 3rd party to help you simulate a computer security incident on a regular basis. This exercise can help you identify any gaps that exist within your policies and procedures. It will also demonstrate how a simple policy will help your company respond to the even the most complicated security issues.