Decoding the Digital Dilemma: Is a vCISO the Right Move for Your Business?

Posted on January 22, 2024 by Brent Huston

In today’s fast-paced digital environment, ensuring robust cybersecurity is crucial for every business. A virtual Chief Information Security Officer (vCISO) may be the strategic addition your company needs. Let’s delve into why a vCISO could be a vital component in strengthening your business’s cyber defenses.

Responding to Increasing Cyber Threats: If your business is witnessing an increase in cyber attacks, both in frequency and complexity, it’s a clear sign that the strategic insight of a vCISO is needed. They bring the necessary expertise to enhance your cybersecurity measures.
Filling the Cybersecurity Expertise Gap: For businesses lacking in-house cybersecurity skills, a vCISO acts as an expert ally. They provide essential knowledge and guidance to strengthen your cyber defenses.
Meeting Compliance and Regulatory Demands: Adhering to industry compliance standards and regulations is critical. A vCISO ensures that your business not only meets these requirements but does so efficiently, avoiding potential legal and financial repercussions.
Economical Cybersecurity Leadership and Flexible Budgeting: If hiring a full-time CISO is not financially viable, a vCISO is a cost-effective solution. They offer top-level cybersecurity leadership and support tailored to your budget. This scalable model means you get expert cybersecurity services without the financial burden of a permanent executive role.
Foundational Cybersecurity Development: A vCISO is key in establishing a solid cybersecurity framework. They are adept at creating policies and strategies customized to your organization’s specific needs, ensuring a robust cybersecurity infrastructure.
Enhancing IT Team Capabilities: A vCISO brings strategic direction to your IT team, providing leadership, training, and mentorship. This enhances their capabilities in managing cyber threats and aligns their efforts with broader business objectives.
Expertise for Specialized Requirements: In scenarios like mergers and acquisitions, a vCISO with specialized experience is invaluable. They skillfully manage the integration of diverse cybersecurity processes, ensuring a unified and secure organizational framework.
Expert Assistance in Cybersecurity Compliance: Our services extend to comprehensive cybersecurity compliance support. With expertise in various industry regulations, we ensure your business adheres to necessary standards, safeguarding against emerging threats and regulatory changes.
MicroSolved vCISO Services – Customized for Your Business: MicroSolved’s vCISO services are designed for Small and Midsized Businesses (SMBs), providing expert cybersecurity guidance. Our team offers effective, cost-efficient solutions, eliminating the need for a full-time CISO.

Given the dynamic nature of cyber threats today, having a vCISO can be a strategic move for your business. To learn more about how MicroSolved’s vCISO services can enhance your cybersecurity posture, we invite you to contact us for a detailed consultation (info@microsolved.com) or by phone (614.351.1237).

* Just to let you know, we used AI tools to gather the information for this article.

Managing Risks Associated with Model Manipulation and Attacks in Generative AI Tools

Posted on August 3, 2023 by Brent Huston

In the rapidly evolving landscape of artificial intelligence (AI), one area that has garnered significant attention is the security risks associated with model manipulation and attacks. As organizations increasingly adopt generative AI tools, understanding and mitigating these risks becomes paramount.

1. Adversarial Attacks:

Example: Consider a facial recognition system. An attacker can subtly alter an image, making it unrecognizable to the AI model but still recognizable to the human eye. This can lead to unauthorized access or false rejections.

Mitigation Strategies:

Robust Model Training: Incorporate adversarial examples in the training data to make the model more resilient.
Real-time Monitoring: Implement continuous monitoring to detect and respond to unusual patterns.

2. Model Stealing:

Example: A competitor might create queries to a proprietary model hosted online and use the responses to recreate a similar model, bypassing intellectual property rights.

Mitigation Strategies:

Rate Limiting: Implement restrictions on the number of queries from a single source.
Query Obfuscation: Randomize responses slightly to make it harder to reverse-engineer the model.

Policies and Processes to Manage Risks:

1. Security Policy Framework:

Define: Clearly outline the acceptable use of AI models and the responsibilities of various stakeholders.
Implement: Enforce security controls through technical measures and regular audits.

2. Incident Response Plan:

Prepare: Develop a comprehensive plan to respond to potential attacks, including reporting mechanisms and escalation procedures.
Test: Regularly test the plan through simulated exercises to ensure effectiveness.

3. Regular Training and Awareness:

Educate: Conduct regular training sessions for staff to understand the risks and their role in mitigating them.
Update: Keep abreast of the latest threats and countermeasures through continuous learning.

4. Collaboration with Industry and Regulators:

Engage: Collaborate with industry peers, academia, and regulators to share knowledge and best practices.
Comply: Ensure alignment with legal and regulatory requirements related to AI and cybersecurity.

Conclusion:

Model manipulation and attacks in generative AI tools present real and evolving challenges. Organizations must adopt a proactive and layered approach, combining technical measures with robust policies and continuous education. By fostering a culture of security and collaboration, we can navigate the complexities of this dynamic field and harness the power of AI responsibly and securely.

* Just to let you know, we used some AI tools to gather the information for this article, and we polished it up with Grammarly to make sure it reads just right!

High-Level FAQ on Attack Surface Mapping

Posted on March 2, 2023 by Brent Huston

Q:What is attack surface mapping?

A: Attack surface mapping is a technique used to identify and assess potential attack vectors on a system or network. It involves identifying and analyzing the various components, data flows, and security controls of a system to identify potential vulnerabilities.

Q:What are the benefits of attack surface mapping?

A:Attack surface mapping helps organizations to better understand their security posture, identify weaknesses, and deploy appropriate controls. It can also help reduce risk by providing visibility into the system’s attack surface, allowing organizations to better prepare for potential threats.

Q:What are the components involved in attack surface mapping?

A: Attack surface mapping involves examining the various components of a system or network, including hardware, software, infrastructure, data flows, and security controls. It also includes evaluating the system’s current security posture, identifying potential attack vectors, and deploying appropriate controls.

Q:What techniques are used in attack surface mapping?

A: Attack surface mapping typically involves using visual representations such as mind-maps, heat maps, and photos to illustrate the various components and data flows of a system. In addition, it may involve using video demonstrations to show how potential vulnerabilities can be exploited.

How Information Security and Risk Management Teams Can Support FinOps

Posted on February 27, 2023 by Brent Huston

As organizations continue to move their operations to cloud services, it is becoming increasingly important for information security and risk management teams to understand how they can support financial operations (FinOps). FinOps is a management practice that promotes shared responsibility for an organization’s cloud computing infrastructure and cloud cost management. In this post, we will explore some ways in which the information security and risk management team can support FinOps initiatives.

1. Establishing Governance: Information security and risk management teams can play a vital role in helping FinOps teams establish effective governance. This includes creating a framework for budget management, setting up policies and procedures for cloud resource usage, and ensuring that all cloud infrastructure is secure and meets compliance requirements.

2. Security Awareness Training: Information security and risk management teams can provide security awareness training to ensure that all cloud practitioners are aware of the importance of secure cloud computing practices. This includes data protection, authentication protocols, encryption standards, and other security measures.

3. Cloud Rate Optimization: Information security and risk management teams can help FinOps teams identify areas of cost optimization. This includes analyzing cloud usage data to identify opportunities for cost savings, recommending risk-based ways to optimize server utilization, and helping determine the most appropriate pricing model for specific services or applications.

4. Sharing Incident Response, Disaster Recovery, and Business Continuity Insights: Information security and risk management teams can help FinOps teams respond to cloud environment incidents quickly and effectively by providing technical support in the event of a breach or outage. This includes helping to diagnose the issue, developing mitigations or workarounds, and providing guidance on how to prevent similar incidents in the future. The data from the DR/BC plans are also highly relevant to the FinOps team mission and can be used as a roadmap for asset prioritization, process relationships, and data flows.

5. Compliance Management: Information security and risk management teams can help FinOps teams stay compliant with relevant regulations by managing audits and reporting requirements, ensuring that all relevant security controls are in place, auditing existing procedures, developing policies for data protection, and providing guidance on how to ensure compliance with applicable laws.

The bottom line is this: By leveraging the shared data and experience of the risk management and information security teams, FinOps teams can ensure their operations are secure, efficient, and completely aligned with the organization’s overall risk and security posture. This adds value to the work of all three teams in the triad. By working together, the teams can significantly enhance the maturity around technology business management functions. All-in-all, by working together, the teams can create significantly better business outcomes.

FAQ for Enterprise Authentication Inventory

Posted on February 10, 2023 by Brent Huston

Q: What is authentication inventory?

A: Authentication inventory is the process of identifying and documenting all of the systems and applications that require remote access within an organization, as well as the types of authentication used for each system and any additional security measures or policies related to remote access.

Q: Why is authentication inventory important?

A: Authentication inventory is important because it helps organizations protect themselves from credential stuffing and phishing attacks. By having a complete and accurate inventory of all points of authentication, organizations can ensure that the right security protocols are in place and that any suspicious activity related to authentication can be quickly identified and addressed.

Q: What steps should I take to properly inventory and secure my authentication points?

A: To properly inventory and secure your authentication points, you should: 1) Identify the different types of authentication used by the organization for remote access; 2) List all of the systems and applications that require remote access; 3) Document the type of authentication used for each system/application and any additional security measures or policies related to remote access; 4) Check with user groups to ensure that they use secure authentication methods and follow security policies when accessing systems/applications remotely; 5) Monitor access logs for signs of unauthorized access attempts or suspicious activity related to remote access authentication; 6) Regularly review and update existing remote access authentication processes as necessary to ensure accurate data.

Seek Out and Remove End-Of-Life Components

Posted on December 5, 2022 by Brent Huston

Just a quick reminder, at some point during each quarter, it is a good idea to enact a process to seek out and remove any end-of-life products in your environment. This is not only a best practice but a significant risk reduction measure as well. Make it an ongoing periodic process, and you’ve got a powerful weapon against threats and emerging issues stemming from end-of-life hardware, firmware, and software in your networks.

How to Search for End-Of-Life Products In Your Environment

The first step is to identify the devices, applications, and firmware that are no longer supported by their vendors. You can do this manually or with a tool. The next step is to determine which of those devices have been deployed in your network. Once you know where they are, you need to find them. There are several ways to search for these devices:

Use Network Inventory Tools

Network inventory tools such as Nmap and Nessus will allow you to scan your entire network to locate all of the devices on your network. These tools will also tell you what operating systems and versions of software/firmware are running on the device. If you’re using a vendor-specific tool, you’ll be able to see if there are any known vulnerabilities associated with the product in many cases.

Talk to Device and Application Owners

If you don’t already have a relationship with the owners of the devices and applications, then you should start building one now. It’s important to get to know the people who own the devices and applications so that you can ask questions about how they use the devices and applications. You may even want to consider getting an end-of-life security policy together for the organization so that you can make sure everyone understands the risks of end-of-life components.

Once you have discussed the issues with the owner, remove the component if possible. Otherwise, add it to a list of components to look for workarounds or replacements. Many organizations that can’t manage to replace an end-of-life component either place it in a low trust network zone, front-end it with firewalls or ACLs, and increase monitoring and detection of the assets involved. Of course, the component should be reviewed quarterly until it can be removed from service.

Doing this process every quarter will increase your networks’ overall stability and trust worthiness, plus reduce risk and management headaches. It’s well worth your time and an effective part of an overall risk management strategy.

Supply Chain Security Insights

Posted on September 2, 2022 by Brent Huston

Supply chain attacks are one of the most common cyber threats faced by organizations. They are costly and disruptive, often resulting in lost revenue and customer trust.

In this article, we’ll discuss five insights about supply chain attacks that all supply chain management and information security teams should be aware of.

#1. Supply Chains Can Be Vulnerable

Supply chains are complex networks of companies, suppliers, customers, and partners that provide goods and services to each other.

They include manufacturers, distributors, retailers, service providers, logistics providers, and others.

These entities may interact directly or indirectly via intermediaries such as banks, insurance companies, payment processors, freight forwarders, customs brokers, etc.

Supply chains are vulnerable to attack because they involve multiple parties and interactions between them. Each organization in the chain will have its own risk profile, security posture, and business model. This creates a complex environment for security risks. Attackers can target any part of the supply chain, and often focus on the weakest link, including manufacturing facilities, distribution centers, warehouses, transportation hubs, retail stores, etc.

Attackers can disrupt operations, steal intellectual property, damage reputation, and cause losses in revenue and profits.

#2. Supply Chain Security Must Include All Stakeholders

Supply chain security involves protecting against threats across the entire value stream. This means securing data, processes, systems, physical assets, personnel, and technology.

It also requires integrating security practices and technologies across the entire organization.

This includes ensuring that information sharing occurs among stakeholders, that employees understand their roles and responsibilities, and that policies and procedures are followed.

Security professionals should collaborate closely with executives, managers, and staff members to ensure that everyone understands the importance of security and has ownership over its implementation.

#3. Supply Chain Security Requires Ongoing Monitoring and Maintenance

Supply chain security requires ongoing monitoring and maintenance.

An effective approach is to continuously monitor the status of key indicators, assess risks, identify vulnerabilities, and implement countermeasures.

For example, an attacker could attempt to compromise sensitive data stored in databases, websites, mobile apps, and other locations.

To prevent these incidents, security teams should regularly review logs, audit reports, and other intelligence sources to detect suspicious activity.

They should also perform penetration tests, vulnerability scans, and other assessments to uncover potential weaknesses.

#4. Supply Chain Security Requires Collaboration Across Organizations

A single department cannot manage supply chain security within an organization.

Instead, it requires collaboration across departments and functional areas, including IT, finance, procurement, human resources, legal, marketing, sales, and others.

Each stakeholder must be responsible for maintaining security, understanding what constitutes acceptable behavior, and implementing appropriate controls.

Collaborating across organizational boundaries helps avoid silos of knowledge and expertise that can lead to gaps in security awareness and training.

#5. Supply Chain Security Is Critical to Organizational Success

Organizations that fail to protect their supply chains face significant financial penalties.

A recent study found that supply chain breaches cost United States businesses $6 trillion annually.

That’s equivalent to nearly 10% of the annual global GDP.

Supply chain attacks can result in lost revenues, damaged reputations, and increased costs.

Companies that invest in supply chain security can significantly improve operational efficiency, productivity, profitability, and brand image.

How Do I Know If My Company Needs a Risk Management Policy?

Posted on May 16, 2022 by Brent Huston

Risk management policies protect companies against financial losses due to various risks. These risks include legal issues, employee misconduct, environmental hazards, etc.

A company may implement a risk management policy to minimize these risks. However, several questions should be asked before implementing such a policy.

What Are the Risks That Could Lead to Financial Losses?

Many types of risks can lead to financial losses. Some examples include:

• Legal issues

• Employee misconduct

• Environmental hazards

• Product liability

• Cybersecurity threats

• Data breaches

• Other

It is important to understand what type of risk your company faces. For example, if your company sells products online, you will face cyber security risks.

Are There Any Existing Policies?

Before deciding whether or not to adopt a risk management policy, it is important to determine whether any existing policies cover the risks your company faces.

For example, if your company has an insurance policy, then you may not need to implement a separate risk management policy.

However, if your company does not have an insurance policy, then it is necessary to consider implementing a risk management policy.

Is Implementing a New Policy Worth It?

Once you know what type of risks your company faces, it is time to decide whether or not to implement a risk management plan.

Some companies feel that they do not need a risk management plan because their current policies already address their risks. However, this decision should be made carefully.

If your company does not have a formal risk management policy, then it is possible that some of the risks your company faces could go unaddressed. This means that the risks could become more significant problems down the line.

In addition, if your company decides to implement a risk management program, it is crucial to ensure that the program covers all the risks your company faces, including those currently unaddressed.

Do Your Employees Understand What Is Being Done?

When implementing a risk management plan, it is vital to ensure employees understand what is being done.

This includes explaining why the risk management plan was implemented, how the plan works, and what steps must be taken to comply.

The goal here is to ensure that employees understand your company’s risks and how the risk management plan helps mitigate them.

Will the Plan Be Cost-Effective?

Finally, it is essential to evaluate whether or not the risk management plan will be cost-effective.

Cost-effectiveness refers to the amount of money saved compared to the costs incurred.

For example, suppose your company spends $1 million per year to insure its assets. In addition, suppose that the risk management plan saves $500,000 per year. Then, the risk management plan would be considered cost-effective if it saves $500,000 annually.

In this case, the risk management plan is cost-effective because it saves $500,00 annually.

However, if the risk management plan only saves $100,000 per year, then the plan is not cost-effective.

In Conclusion

As discussed above, there are many reasons to implement a risk management strategy.

These strategies can help your company avoid potential financial losses caused by certain risks.

In addition, implementing a risk management plan can make your company more efficient and productive.

A Cynefin Risk Management Use Case

Posted on March 30, 2022 by Brent Huston

Lately, I have been working on using the Cynefin framework to help a client with supply chain risk management. I’m not going to dig into the specifics here, but I wanted to share a quick workflow that we used during this process that has been very useful for us.

Risk Matrix

First, we built a risk matrix for supply chain risk. Basically, there are a number of these available via the various search engines. We took some of the most common ones and tore them down to commonalities, then built them into our matrix. We turned this into a simple spreadsheet.

Heat Mapping

Next, once we had our risk matrix, we did an exercise where we heat mapped the various risks, scoring them high/medium/low subjectively. This gave us an excellent tool to monitor our situation and communicate it with our stakeholders.

Applying Cynefin

Next, we mapped all of the high risks into the cynefin framework by researching the present state of each, whether best practices were available and relevant, being developed, or still in the experimental stage. This gave us a good idea of which problems we could simply focus on using known techniques and skills against, which ones we needed to take existing decent practices and optimize them, and which problems we needed to experiment with solutions for.

Sharing and Feedback

Overall, the exercise took around an hour to complete once we compiled the basic templates and completed the risk matrix research. For those of you facing complex risk management problems, this workflow might assist. Let me know on social media (@lbhuston) if it provides any help or if you have suggestions and feedback. Thanks for reading!

3 Steps To Increase Cyber Security At Your Dealership

Posted on October 12, 2020 by Brent Huston

Car dealerships and automotive groups are juicy targets for cybercriminals with their wealth of identity and financial information. Cyber security in many dealerships is lax, and many don’t even have full time IT teams, with even fewer having cybersecurity risk management skills in house. While this is changing, for the better, as dealerships become more data-centric and more automated, many are moving to become more proactive against cybersecurity threats.

In addition to organized criminals seeking to capture and sell personal information, global threats stemming from phishing, malware, ransomware and social engineering also plague dealerships. Phishing and ransomware are among the leading causes of financial losses tied to cybersecurity in the dealership space. Even as the federal regulators refine their focus on dealerships as financial institutions, more and more attackers have shifted some of their attention in the automotive sales direction.

Additionally, a short walk through social media doesn’t require much effort to identify dealerships as a common target for consumer anger, frustration and threats. Some of the anger shown toward car dealerships has proven to turn into physical security concerns, while it is almost assured that some of the industry’s network breaches and data breaches can also be tied back to this form of “hacktivism”. In fact, spend some time on Twitter or chat rooms, and you can find conversations and a variety of information of hacking dealership wireless networks and WiFi cameras. These types of cybersecurity incidents are proving to be more and more popular.

With all of this cybersecurity attention to dealerships, are there any quick wins to be had? We asked our MSI team and the folks we work with at the SecureDrive Alliance that very question. Here’s the best 3 tips they could put forth:

1) Perform a yearly cybersecurity risk assessment – this should be a comprehensive view of your network architecture, security posture, defenses, detection tools, incident response plans and disaster recovery/business continuity plan capabilities. It should include a complete inventory of all PII and threats that your dealership faces. Usually this is combined with penetration testing and vulnerability assessment of your information systems to measure network security and computer security, as well as address issues with applications and social engineering.

2) Ensure that all customer wireless networks and physical security systems are logically and physically segmented from operations networks – all networks should be hardened in accordance with information security best practices and separated from the networks used for normal operations, especially finance and other PII related processes. Network traffic from the customer wireless networks should only be allowed to traverse the firewall to the Internet, and may even have its own Internet connection such as a cable modem or the like. Cameras and physical security systems should be hardened against attacks and all common credentials and default passwords should be changed. Software updates for all systems should be applied on a regular basis.

3) Train your staff to recognize phishing, eliminate password re-use among systems and applications and reportcybersecurity attacks to the proper team members – your staff is your single best means of detecting cyber threats. The more you train them to identify and resist dangerous behaviors, the stronger your cybersecurity maturity will be. Training staff members to recognize, handle, report and resist cyber risks is one of the strongest value propositions in information security today. The more your team members know about your dealership’s security protocols, service providers and threats, the more effective they can be at protecting the company and themselves. Buidling a training resource center, and setting up a single point of contact for reporting issues, along with sending out email blasts about the latest threats are all great ways to keep your team on top of the issues.

There you have it, three quick and easy wins to help your dealership do the due diligence of keeping things cyber secure. These three basic steps will go a long way to protecting the business, meeting the requirements of your regulatory authority and reduce the chances of substantial harm from cyber attacks. As always, remaining vigilant and attentive can turn the tide.

If you need any assistance with cybersecurity, risk management, penetration testing or training, MicroSolved and the SecureDrive Alliance are here to help. No matter if you’re a small business or a large auto group, our risk management and information security processes based on the cybersecurity framework from the National Institute of Standards and Technology (NIST) will get you on the road to effective data security. Simply contact MSI via this web form, or the SecureDrive Alliance via our site, and we will be happy to have a no cost, no hassle discussion to see how we can assist you.