Category Archives: MicroSolved’s Strategies & Tactics Talks

Bridging the Divide: Innovative Strategies to Conquer the Cybersecurity Talent Shortage

Posted on by
Reply

The digital realm has become the bedrock of modern society, yet its security is increasingly jeopardized by a critical and growing challenge: the cybersecurity talent deficit. The demand for skilled cybersecurity professionals has never been higher, but organizations globally are struggling to find and retain the expertise needed to defend against evolving and sophisticated cyber threats. This shortage not only hinders innovation but also leaves organizations vulnerable to costly breaches and attacks. Addressing this pressing issue requires a paradigm shift in how we approach recruitment, development, and retention of cybersecurity professionals. This post delves into innovative strategies and actionable tactics that firms can implement to bridge this critical divide and build resilient security teams.

ExecMeeting

Understanding the Gravity of the Cybersecurity Talent Deficit

The cybersecurity talent deficit is not a theoretical problem; it’s a tangible threat with significant repercussions. The global gap is estimated at millions of unfilled positions, and in the United States alone, the shortage reaches hundreds of thousands. Alarmingly, the global cybersecurity workforce growth has even stalled recently. This scarcity of talent leads to numerous challenges for organizations:

  • Increased Vulnerability: Unfilled security roles leave systems and data exposed, making organizations prime targets for cyberattacks.
  • Overburdened Security Teams: Existing teams face increased workloads, stress, and a higher risk of burnout, leading to decreased effectiveness and higher turnover.
  • Hinderance to Innovation: The lack of skilled professionals can stifle an organization’s ability to adopt new technologies and innovate securely.
  • Rising Costs: Fierce competition for limited talent drives up salaries and recruitment costs.
  • Disrupted Security Initiatives: Frequent job-hopping among cybersecurity professionals disrupts ongoing security projects and initiatives.

The roots of this deficit are multifaceted, stemming from the rapid evolution of the threat landscape, the specialized skill requirements within the field, insufficient training and education, and high burnout rates. Moreover, economic constraints are increasingly impacting organizations’ ability to build robust security teams.

Innovative Recruitment Strategies: Expanding the Talent Horizon

Traditional recruitment methods are often insufficient in today’s competitive landscape. Organizations need to adopt creative and forward-thinking strategies to attract a wider range of potential candidates.

Strategies:

  • Leveraging Technology for Streamlined Sourcing: Employing AI-powered tools for candidate sourcing and screening can significantly enhance the efficiency of the recruitment process.
  • Embracing Diversity and Inclusion: Actively seeking out and recruiting individuals from diverse backgrounds, including women and underrepresented groups, broadens the talent pool and brings fresh perspectives. Engaging with DEI-focused groups and ensuring inclusive hiring practices are crucial.
  • Flexible Hiring Criteria: Shifting the focus from rigid credentials and years of experience to potential, aptitude, and transferable skills can unlock a wealth of talent from non-traditional backgrounds and career changers. Consider self-taught individuals and those with experience in related fields.
  • Tapping into Global Talent Pools: Expanding recruitment efforts beyond local geographical boundaries allows organizations to access specialized expertise and potentially manage workforce costs more effectively. Implementing a global resourcing strategy can strengthen security defenses.
  • Strategic Team Augmentation: Utilizing contractors and consultants for specific projects or to fill temporary gaps can provide crucial expertise without the long-term commitment of permanent hires.
  • Building Strategic Partnerships: Collaborating with educational institutions (universities, colleges, minority-serving institutions), industry and professional organizations, and even high schools can create a sustainable talent pipeline. Offering internships and student ambassador programs can cultivate interest in cybersecurity careers early on.
  • Enhancing Employer Branding and Outreach: Showcasing company culture, values, growth opportunities, and career advancement potential can attract cybersecurity professionals. Leveraging social media platforms and participating in career fairs and industry events are effective outreach tactics.

Tactics:

  • Craft compelling job descriptions that focus on the impact of the role and required skills rather than just certifications.
  • Implement skills-based assessments and challenges instead of solely relying on resume screening.
  • Offer flexible work options such as remote work and adjustable schedules to attract a wider candidate pool.
  • Utilize platforms like Cyber Range and Capture The Flag (CTF) competitions as recruitment tools to identify individuals with practical skills.
  • Develop employee referral programs to leverage the networks of existing cybersecurity staff.
  • Actively participate in online cybersecurity communities and forums to engage with potential candidates.

Investing in Internal Talent Development: Cultivating a Robust Workforce

Relying solely on external hiring is unsustainable. Organizations must prioritize the development of their existing workforce through continuous education, upskilling, and reskilling initiatives.

Strategies:

  • Continuous Education and Upskilling: Providing structured learning paths, training programs, and opportunities for professional development ensures that cybersecurity professionals stay ahead of evolving threats and technologies. Investing in employee education also boosts retention rates.
  • Building Strong In-House Training Programs: Developing internal training hubs with comprehensive syllabi and tailored resources allows employees to enhance their skills within the company’s specific context.
  • Prioritizing Mentorship and Coaching: Pairing junior staff and new hires with experienced professionals provides invaluable guidance, hones skills, and fosters a vibrant talent pool within the organization.
  • Covering Costs for Training and Certifications: Investing in vendor-specific and industry-recognized certifications like CompTIA Security+ and CISSP demonstrates a commitment to professional growth and makes the organization more attractive to potential and current employees.
  • Upskilling and Reskilling IT Professionals: Allowing IT professionals with existing knowledge of company infrastructure to transition into cybersecurity roles can effectively address the talent shortage.
  • Implementing Continuous Learning Platforms: Utilizing platforms that offer tailored training for specific areas like cloud security and AI ensures professionals can adapt to new technologies.

Tactics:

  • Develop internal training modules focused on key cybersecurity domains.
  • Establish internal academic hubs with dedicated resources for skill development.
  • Implement formal mentorship programs with clear guidelines and expectations.
  • Offer tuition reimbursement and cover the costs of relevant certifications.
  • Organize regular workshops, webinars, and hands-on labs to facilitate skill development.
  • Provide access to online learning platforms and industry-recognized training resources.
  • Integrate advanced simulation training using platforms like Cyber Range and CTF exercises to provide realistic hands-on experience.

Leveraging Technology: Amplifying Human Capabilities

Technology can play a crucial role in bridging the cybersecurity talent gap by automating routine tasks and augmenting the capabilities of existing security personnel.

Strategies:

  • Utilizing AI-Driven Security Operations: Implementing AI-powered tools can automate the processing of large data volumes, enabling faster detection and prediction of cyber threats, allowing security teams to focus on complex challenges.
  • Automating Routine Security Tasks: Automating tasks such as updating threat databases, quarantining threats, and conducting compliance audits reduces manual workloads and lessens the need for a large security headcount. This also captures team knowledge and reduces the impact of staff turnover.
  • Implementing Advanced Simulation Training: Utilizing platforms like Cyber Range and virtual reality environments provides immersive and realistic training experiences, allowing cybersecurity professionals to practice responding to real-world scenarios and develop critical skills.
  • Adopting SOAR (Security Orchestration, Automation and Response) Platforms: These platforms help automate incident response workflows, improving efficiency and reducing the burden on security analysts.
  • Employing AI-Enhanced Tools for Skill Development: AI-powered systems can provide real-time analysis and learning support, acting as digital assistants to cybersecurity teams.

Tactics:

  • Invest in AI-powered security information and event management (SIEM) systems for enhanced threat detection and analysis.
  • Deploy robotic process automation (RPA) for repetitive security tasks.
  • Integrate SOAR platforms to automate incident response and security workflows.
  • Utilize virtual reality training modules for immersive learning experiences.
  • Implement AI-powered threat intelligence platforms for proactive threat identification.

Addressing High Burnout Rates: Fostering a Sustainable Workforce

High burnout rates are a significant contributor to the cybersecurity talent shortage. Creating a supportive and balanced work environment is crucial for retaining cybersecurity professionals.

Strategies:

  • Promoting Work-Life Balance: Encouraging flexible work arrangements, such as remote work and adjustable hours, and ensuring manageable workloads are essential for employee well-being and retention.
  • Enhancing Employee Support Systems: Providing proactive mental health support programs and fostering open communication can create a psychologically safe environment.
  • Distributing Cybersecurity Responsibility: Spreading security responsibilities across the organization can reduce the burden on dedicated cybersecurity teams.
  • Recognizing and Rewarding Contributions: Publicly acknowledging the efforts and successes of cybersecurity professionals can boost morale and job satisfaction.
  • Developing Emotional Intelligence in Leadership: Equipping leaders to recognize early signs of burnout within their teams is crucial for proactive intervention.

Tactics:

  • Offer flexible work arrangements and generous paid time off.
  • Implement mental health support programs such as employee assistance programs (EAPs).
  • Conduct regular team satisfaction surveys to identify potential issues.
  • Ensure reasonable on-call rotations and workload distribution.
  • Provide opportunities for professional development and attending conferences to prevent stagnation.
  • Foster a culture of open communication and psychological safety where employees feel comfortable raising concerns.

Holistic Approaches to Talent Development: Cultivating a Security-First Culture

Addressing the cybersecurity talent shortage requires a holistic and long-term perspective that integrates various strategies and fosters a culture of continuous learning and security awareness across the entire organization.

Strategies:

  • Strategic Resourcing and Workforce Planning: Developing a comprehensive understanding of the organization’s cybersecurity needs and proactively planning for future talent requirements is essential.
  • Cultural Shifts Towards Ongoing Learning: Embedding a culture that values and encourages continuous learning ensures the workforce remains adaptable to the evolving threat landscape. Initiatives like internal CTF competitions and structured learning paths can foster this culture.
  • Skill-Based Hiring Over Degree-Focused Approaches: Prioritizing demonstrable skills and practical experience over traditional academic qualifications can broaden the talent pool.
  • Collaboration with Third-Party Providers: Strategically partnering with MSSPs and security consultants can provide access to specialized skills and support during periods of talent shortage.

Tactics:

  • Conduct regular workforce planning exercises to identify future cybersecurity skill needs.
  • Integrate cybersecurity awareness training for all employees to foster a security-conscious culture.
  • Create internal knowledge-sharing platforms to facilitate peer-to-peer learning.
  • Establish clear career development pathways with defined progression opportunities.
  • Track key metrics such as time-to-fill, retention rates, and employee satisfaction to evaluate the effectiveness of talent strategies.

Conclusion: A Multifaceted Approach to Building Cyber Resilience

The cybersecurity talent shortage is a complex challenge that demands innovative and multifaceted solutions. There is no single silver bullet. Organizations that proactively adopt creative recruitment strategies, invest in internal talent development, leverage technology effectively, prioritize employee well-being, and foster a culture of continuous learning will be best positioned to build and maintain resilient cybersecurity teams. By shifting from traditional approaches to embracing these innovative strategies and tactics, organizations can begin to bridge the divide and secure their digital future. The time to act is now, to cultivate the cybersecurity workforce of tomorrow and safeguard our increasingly interconnected world.

More Information and Assistance from MicroSolved, Inc.

At MicroSolved, Inc., we understand the challenges organizations face in hiring and retaining top-tier cybersecurity talent. The ever-evolving threat landscape and increasing compliance demands require organizations to be agile and forward-thinking in their approach to cybersecurity. That’s where we come in, offering tailored solutions to meet your unique needs.

vCISO Services

Our Virtual Chief Information Officer (vCISO) services are designed to provide you with expert guidance without the need for an in-house CISO. Our vCISOs bring a wealth of experience and knowledge, offering strategic insights to align your cybersecurity posture with your business objectives. They work closely with your team to:

  • Explain complex cybersecurity concepts in understandable terms, facilitating better decision-making.
  • Ensure your organization meets compliance requirements and stays ahead of regulatory changes.
  • Position your organization strategically in the ever-changing cybersecurity landscape.
  • Build and maintain long-term relationships to support ongoing security improvement and innovation.

Mentoring Services

At MicroSolved, Inc., we believe that mentorship is vital for fostering growth and ensuring the success of your cybersecurity team. Our mentoring services focus on developing your talent, from the most senior professionals to your newest hires. We provide:

  • Personalized coaching to help team members understand the “why” behind security protocols and strategies.
  • Guidance to help professionals stay current with the latest cybersecurity trends and technologies.
  • Support for continuous skill development, addressing any challenges your team may face with new skills or technologies.

Additional Resources

In addition to our vCISO and mentoring services, we offer a range of resources to enhance your cybersecurity strategy:

  • Incident Readiness and Response: Preparedness planning and support to minimize the impact of security breaches.
  • Threat Modeling: In-depth analysis of incidents and proactive threat identification.

By choosing MicroSolved, Inc., you’re not just partnering with a service provider; you’re aligning with a team dedicated to empowering your organization through expert guidance, strategic insights, and continuous support.

For more information on how we can assist with your cybersecurity needs, contact us today. Let us help you build a resilient cybersecurity culture that keeps your organization secure and competitive.

 

 

 

* AI tools were used as a research assistant for this content, but human moderation and writing are also included. The included images are AI-generated.

Using TigerTrax to Analyze Device Configurations & Discover Networks

Posted on by
Reply

One of the biggest challenges that our M&A clients face is discovering what networks look like, how they are interconnected and what assets are priorities in their newly acquired environments. Sure, you bought the company and the ink is drying on the contracts — but now you have to fold their network into yours, make sure they meet your security standards and double check to make sure you know what’s out there.

That’s where the trouble begins. Because, in many cases, the result is “ask the IT folks”. You know, the already overworked, newly acquired, untrusted and now very nervous IT staff of the company you just bought. Even if they are honest and expedient, they often forget some parts of the environment or don’t know themselves that parts exist…

Thus, we get brought in, as a part of our Information Security Mergers & Acquisitions practice. Our job is usually to discover assets, map the networks and perform security assessments to identify gaps that don’t meet the acquiring company’s policies. Given that we have had to do this so often, we have designed a great new technique for performing these type of mapping and asset identification engagements. For us, instead of asking the humans, we simply ask the machines. We accumulate the router, switch, firewall and other device configurations and then leverage TigerTrax’s unique analytics capabilities to quickly establish network instances, interconnections, prioritized network hosts & segments, common configuration mistakes, etc. “en masse”. TigerTrax  then outputs that data for the MSI analysts, who can quickly perform their assessments, device reviews and inventories — armed with real-world data about the environment!

This approach has been winning us client kudos again and again!

Want to discuss our M&A practice and the unique ways that TigerTrax and MSI can help you before, during and after a merger or acquisition? Give us a call at (614) 351-1237 or drop us a line at info (at) microsolved /dot/ com. We’d be happy to schedule a FREE, no commitment & no pressure call with our Customer Champions & our security engineers.

The Big Three Part 2: Incident Detection

Posted on by
5

Did you know that less than one out of five security incidents are detected by the organization being affected? Most organizations only find out they’ve experienced an information security incident when law enforcement comes knocking on their door, if they find out about it at all, that is. And what is more, security compromises often go undetected for months and months before they are finally discovered. This gives attackers plenty of time to get the most profit possible out of your stolen information, not to mention increasing their opportunities for further compromising your systems and the third party systems they are connected to.

Of the Big Three strategies for fighting modern cyber-crime, (incident detection, incident response and user education and awareness), incident detection is by far the hardest one to do well. This is because information security incident detection is not a simple process. No one software package or technique, no matter how expensive and sophisticated, is going to detect all security events (or even most of them to be completely honest). To be just adequate to the task, incident detection requires a lot of input from a lot of systems, it requires knowledge of what’s supposed to be on your network and how it works, it requires different types of security incident detection software packages working together harmoniously and, most importantly, it requires human attention and analysis.

First of all, you need complete sources of information. Even though it can seem to be overwhelming, it behooves us to turn on logging for everything on the network that is capable of it. Many organizations don’t log at the workstation level for example. And you can see their point; most of the action happens at the server and database level. But the unfortunate reality is that serious security compromises very often begin with simple hacks of user machines and applications.

Next, you need to be aware of all the software, firmware and hardware that are on your network at any given time. It is very difficult to monitor and detect security incidents against network resources that you aren’t even aware exist. In fact, I’ll go a step further and state that you can improve your chances of detection significantly by removing as much network clutter as possible. Only allow the devices, applications and services that are absolutely necessary for business purposes to exist on your network. The less “stuff” you have, the fewer the attack surfaces cyber-criminals have to work with and the easier it is to detect security anomalies.

The third thing that helps make information security incident detection more manageable is tuning and synchronizing the security software applications and hardware in your environment. We often see organizations that have a number of security tools in place on their networks, but we seldom see one in which all of the output and capabilities of these tools have been explored and made to work together. It is an unfortunate fact that organizations generally buy tools or subscribe to services to address particular problems that have been brought to their attention by auditors or regulators. But then the situation changes and those tools languish on the network without anyone paying much attention to them or exploring their full capabilities. Which brings to the most important factor in security incident detection: human attention and analysis.

No tool or set of tools can equal the organizational skills and anomaly detection capabilities of the human brain. That is why it is so important to have humans involved with and truly interested in information security matters. It takes human involvement to ensure that the security tools that are available are adequate to the task and are configured correctly. It takes human involvement to monitor and interpret the various outputs of those tools. And it takes human involvement to coordinate information security efforts among the other personnel employed by the organization. So if it comes down to spending money on the latest security package or on a trained infosec professional, I suggest hiring the human every time! 

—Thanks to John Davis for this post!

Monitoring: an Absolute Necessity (but a Dirty Word Nonetheless)

Posted on by
3

There is no easier way to shut down the interest of a network security or IT administrator than to say the word “monitoring”. You can just mention the word and their faces fall as if a rancid odor had suddenly entered the room! And I can’t say that I blame them. Most organizations do not recognize the true necessity of monitoring, and so do not provide proper budgeting and staffing for the function. As a result, already fully tasked (and often times inadequately prepared) IT or security personnel are tasked with the job. This not only leads to resentment, but also virtually guarantees that the job is will not be performed effectively.

And when I say human monitoring is necessary if you want to achieve any type of real information security, I mean it is NECESSARY! You can have network security appliances, third party firewall monitoring, anti-virus packages, email security software, and a host of other network security mechanisms in place and it will all be for naught if real (and properly trained) human beings are not monitoring the output. Why waste all the time, money and effort you have put into your information security program by not going that last step? It’s like building a high and impenetrable wall around a fortress but leaving the last ten percent of it unbuilt because it was just too much trouble! Here are a few tips for effective security monitoring:

  • Properly illustrate the necessity for human monitoring to management, business and IT personnel; make them understand the urgency of the need. Make a logical case for the function. Tell them real-world stories about other organizations that have failed to monitor and the consequences that they suffered as a result. If you can’t accomplish this step, the rest will never fall in line.
  • Ensure that personnel assigned to monitoring tasks of all kinds are properly trained in the function; make sure they know what to look for and how to deal with what they find.
  • Automate the logging and monitoring function as much as possible. The process is difficult enough without having to perform tedious tasks that a machine or application can easily do.
  • Ensure that you have log aggregation in place, and also ensure that other network security tool output is centralized and combined with logging data. Real world cyber-attacks are often very hard to spot. Correlating events from different tools and processes can make these attacks much more apparent. 
  • Ensure that all personnel associated with information security communicate with each other. It’s difficult to effectively detect and stop attacks if the right hand doesn’t know what the left hand is doing.
  • Ensure that logging is turned on for everything on the network that is capable of it. Attacks often start on client side machines.
  • Don’t just monitor technical outputs from machines and programs, monitor access rights and the overall security program as well:
  • Monitor access accounts of all kinds on a regular basis (at least every 90 days is recommended). Ensure that user accounts are current and that users are only allocated access rights on the system that they need to perform their jobs. Ensure that you monitor third party access to the system to this same level.
  • Pay special attention to administrative level accounts. Restrict administrative access to as few personnel as possible. Configure the system to notify proper security and IT personnel when a new administrative account is added to the network. This could be a sign that a hack is in progress.
  • Regularly monitor policies and procedures to ensure that they are effective and meet the security goals of the organization. This should be a regular part of business continuity testing and review.
Thanks to John Davis for writing this post.

HoneyPoint IP Protection Methodology

Posted on by
5

Here’s another use case scenario for HoneyPoint Security Server. This time, we show the methodology we use to scope a HoneyPoint implementation around protecting a specific set of Intellectual Property (IP). 

If you would like an in-depth discussion of our process or our capability, please feel free to reach out to us and schedule a call with our team. No commitment and no hard sale, guaranteed.

If the graphic below is blurry on your device, you can download a PDF version here.

HP_IPProtection

HoneyPoint Trojans Overview

Posted on by
4

Here’s another quick overview graphic of how HoneyPoint Trojans work. We have been using these techniques since around 2008 and they are very powerful. 

We have incorporated them into phishing exercises, piracy studies, incident response, intrusion detection, intelligence gathering, marketing analysis and even privacy research. To hear more about HoneyPoint Trojans, give us a call.

If the graphic below is blurry on your device, you can download a PDF version here.

HPTrojanOverview

HoneyPoint in a Point of Sale Network

Posted on by
7

We have been getting a LOT of questions lately about how HoneyPoint Security Server (HPSS) fits into a Point of Sale (POS) network.

To make it pretty easy and as a high level overview, below is a use case diagram we use to discuss the solution. If you would like a walkthrough of our technology, or to discuss how it might fit into your specific use cases, please let us know.

As always, thanks for reading and for partnering with MicroSolved, Inc.

PS – If the graphic below is difficult to read on your device, you can grab a PDF version here.

HP POSNetworks

New Podcast: Threats from the Net – Starring Jim Klun

Posted on by
2

You can find the newest podcast for public consumption, MicroSolved’s Threats from the Net online now. The new podcast will be a monthly release and stars Jim Klun as the host. 

Tune in often and check it out. The Kluniac has some elder geek insights to share, and it is ALWAYS informative and entertaining!

You can grab this month’s edition by clicking here. 

Business Impact Analysis: A Good Way to Jumpstart an Information Security Program

Posted on by
13

Is your organization’s information security program stuck in the era of perimeter firewalls and anti-virus software? Are you a Chief Information Security Officer or IT Manager stuck with the unenviable task of bringing your information security program into the 21st Century? Why not start the ball rolling with a business impact analysis (BIA)? It will provide you with a wealth of useful information, and it takes some of the weight from your shoulders by involving every business department in the organization.

BIA is traditionally seen as part of the business continuity process. It helps organizations recognize and prioritize which information, hardware and personnel assets are crucial to the business so that proper planning for contingency situations can be undertaken. This is very useful in and of itself, and is indeed crucial for proper business continuity and disaster recovery planning. But what other information security tasks can it help you with?

When MSI does a BIA, the first thing we do in issue a questionnaire to every business department and management function in the organization. These questionnaires are completed by the “power users” of the organization who are typically the most experienced and knowledgeable personnel in the business. This means that not only do you get the most reliable information possible, but that one person or one small group is not burdened with doing all of the information gathering. Typical responses include (but are not limited to):

  • A list of every business function each department undertakes
  • All of the hardware assets needed to perform each business function
  • All of the software assets needed to perform each business function
  • Inputs needed to perform each business function and where they come from
  • Outputs of each business function and where they are sent
  • Personnel needed to perform each business function
  • Knowledge and skills needed to perform each business function

So how does this knowledge help jumpstart your information security program as a whole? First, in order to properly protect information assets, you must know what you have and how it moves. In the Top 20 Critical Controls for Effective Cyber Defense, the first control is an inventory of devices and the second control is an inventory of software. The BIA lists all of the hardware and software assets needed to perform each business function. So in effect you have your starting inventories. This not only tells you what you need, but is useful in exposing assets wasting time and effort on your network that are not necessary; if it’s not on the critical lists, you probably don’t need it. 

In MSI’s own 80/20 Rule of Information Security, the first requirement is not only producing inventories of software and hardware assets, but mapping of data flows and trust relationships. The inputs and outputs listed by each business department include these data flows and trust relationships. All you have to do is compile them and put them into a graphical map. And I can tell you from experience; this is a great savings in time and effort. If you have ever tried to map data flows and trust relationships as a stand-alone task, you know what I mean!

Another security control a BIA can help you implement is network segmentation and enclaving. The MSI 80/20 Rule has network enclaving as their #6 control and the Top 20 controls include secure network engineering as their #19 control. The information from a good BIA makes it easy to see how assets are naturally grouped, and therefore the best places to segment the network.

How about egress filtering? Egress filtering is widely recognized as one of the most effect security controls in preventing large scale data loss, and the most effective type of egress filtering employs white listing. White listing is typically much harder to tune and implement than black listing, but is very much more effective. With the information a BIA provides you, it is much easier to construct a useful white list; you have what each department needs to perform each business function at your fingertips.

Then there is skill and security training. The BIA tells you what information users need to know to perform their jobs, so that helps you make sure that personnel are trained correctly and in enough depth to deal with contingency situations. Also, knowing where all your critical assets lie and how they move helps you make sure you provide the right people with the right kind of security training.

And there are other crucial information security mechanisms that a BIA can help you with. What about access control? Wouldn’t knowing the relative importance of assets and their nexus points help you structure AD more effectively? And there is physical security. Knowing where the most crucial information lies and what departments process it would help you set up internal secure areas, wouldn’t it? What other information useful to setting up an effective information security program can you think of that is included in a proper BIA?

Thanks to John Davis for writing this post.

The First Five Quick Wins

Posted on by
10

The Top 20 Critical Controls for Effective Cyber Defense have been around for half a decade now, and are constantly gaining more praise and acceptance among information security groups and government organizations across the globe. One of the main reasons for this is that all of these controls have been shown to stop or mitigate known, real-world attacks. Another reason for their success is that they are constantly being updated and adjusted to fit the changing threat picture as it emerges. 

One of these recent updates is the delineation of the “First Five” from the other “Quick Wins” category of sub-controls included in the guidance (Quick Wins security controls are those that provide solid risk reduction without major procedural, architectural or technical changes to an environment, or that provide substantial and immediate risk reduction against very common attacks – in other words, these are the controls that give you the most bang for the buck). The First Five Quick Wins controls are those that have been shown to be the most effective means yet to stop the targeted intrusions that are doing the greatest damage to many organizations. They include:

  1. Application white listing: Application white listing technology only allows systems to run software applications that are included in the white list. This control prevents both external and internal attackers from implementing malicious and unwanted applications on the system. One caveat that should be kept in mind is that the organization must strictly control access to and modifications of the white list itself. New software applications should be approved by a change control committee and access/changes to the white list should be strictly monitored.
  2. Secure standard images: Organizations should employ secure standard images for configuring their systems. These standard images should utilize hardened versions of underlying operating systems and applications. It is important to keep in mind that these standard images need to be updated and validated on a regular basis in order to meet the changing threat picture.
  3. Automated patching tools and processes: Automated patching tools, along with appropriate policies and procedures, allow organizations to close vulnerabilities in their systems in a timely manner. The standard for this control is patching of both application and operating system software within 48 hours of release.
  4. Removal or replacement of outdated software applications: Many computer networks we test have outdated or legacy software applications present on the system. Dated software applications may have both known and previously undiscovered vulnerabilities associated with them, and are consequently very useful to cyber attackers. Organizations should have mechanisms in place to identify then remove or replace such vulnerable applications in a timely manner just as is done with the patching process above.
  5. Control of administrative privileges and accounts: One of the most useful mechanisms employed by cyber attackers is elevation of privileges. Attackers can turn simple compromise of one client machine to full domain compromise by this means, simply because administrative access is not well controlled. To thwart this, administrative access should be given to as few users as possible, and administrative privileged functions should be monitored for anomalous behavior. MSI also recommends that administrators use separate credentials for simple network access and administrative access to the system. In addition, multi-part authentication for administrative access should be considered. Attackers can’t do that much damage if they are limited to isolated client machines!

Certainly, the controls detailed above are not the only security controls that organizations should implement to protect their information assets. However, these are the controls that are currently being implemented first by the most security-aware and skilled organizations out there. Perhaps your organization can also benefit from the lessons they have learned.

Thanks to John Davis for writing this post.