Day: February 15, 2017

Most organisations, after being impacted by a cyber-attack, began looking at the design of their Security Operations Center (SOC) operating model – their existing engagement with the managed service provider or their in-house SOC program – to identify the missing link because business challenged their effectiveness. This is a reality.

Here is my perspective on how your SOC program can establish this effectiveness proactively and bring value to the business through a couple of measures, though these are not the only measures to strengthen the governance of your SOC program.

Under a well-defined structure, SOC gets initial visibility on the threats from the business, risk management and intelligence function. These (top) threats get translated to specific use cases. These specific use cases will map to business systems – both critical and non-critical relevant data sources.

Now let’s look at two different types of the threats to get a practical view, one of which dictates the availability of the system (DDoS attack), and the other that steals the sensitive information (malware/APT attack).

When the SOC monitors the threats, they should map these threats and their monitoring to kill chain, where these threats are intercepted using a specific KPI – stage of threats intercepted on kill chain. The outcome of this mapping helps SOC advise IT/security/business whether the preventive control in place is effective or not. For example, a malware caused by a spear phishing attack through a zero day exploit on the user browser, operating on a business critical system within retail banking, is passed through on stage 1 of kill chain. This scenario clearly indicates that either the advanced malware protection control on the end user machine did not detect it, or the local event manager did not raise an alert within Security Information and Event Management (SIEM), and hence these controls are not effective.

This type of advisory augments the role of SOC beyond just monitoring the security incidents. Also, the SOC teams have the knowledge of the underlying impacted systems. To that end, the SOC can provide a full visibility on threats, from use case scenario to kill chain stage to the underlying business system that is under attack.

Another KPI is linked to response time to threat incidents. By conjugating these two KPIs, business gets visibility on how SOC is able to protect business systems, which is a primary goal of SOC program by intercepting the threat early and responding to the incident in an agreed time frame (KPI on response time will indicate if time to respond was more than the agreed timeframe). Finally, SOC should provide the estimated value of impact that was safeguarded by the SOC, taking into account the underlying asset value, though this exercise involves a bit subjectivity.

Sometimes business leaders demand that the SOC team should tell them the downtime of critical business systems during an attack, especially in the situations when the organization experiences DDoS attacks. This is a reason some SOC structures have allocated dedicated team to DDoS monitoring. Apart from the above approach, the SOC will use an established process which checks the heartbeat of the underlying data source/asset, which is mapped to the use case(s) in this category. In case of DDoS, when a critical business system is not available, an alert is generated based on this event. When a report is generated from the SOC, business gets visibility on the downtime of the system due to a DDoS type of attack. This report can be compared with one from the IT/business continuity function, which generates a report on non-availability of the system.

In summary, SOC programs are maturing to augment their role beyond serving just as an operational entity to bring in value to the business by implementing business KPIs and SOC processes. Mapping the use-case scenarios to kill chain is a crucial step in building this value by increasing the possibility of intercepting threats at an early stage.

Manohar Ganshani, Associate Partner, IBM Security

[ISACA Now Blog]

More than four in five global IT professionals (82 percent) see vulnerabilities in Internet of Things (IoT) devices as significant security concerns for organizations.

Those concerns, highlighted in ISACA’s annual IT Risk/Reward Barometer, are reflective of insufficient security measures by IoT device manufacturers.

One of the main culprits is IoT devices running old versions of Linux – sometimes as much as 10 years old. This happens for a variety of reasons, such as the version becoming outdated while the device is in development, or manufacturers building on top of existing devices and sticking with the old software to speed up development time. The result is devices hitting the market with easily anticipated vulnerabilities.

IoT manufacturers also need to make sure their devices have the capability to automatically and reliably run security updates. This should be considered a must-have feature by consumers and businesses when making their purchases. If the devices are able to be updated, without it being a time-intensive process for users, security threats can be addressed much more quickly and effectively.

Making some of these adjustments will be critical, or trust in IoT devices’ security among professionals and consumers will be further damaged, given the threat landscape in 2017 and beyond. The proliferation of IoT devices will result in escalating instances of DDoS attacks this year, according to Deloitte – potentially along the lines of the massive Mirai DDoS attack that used infected IoT devices to cause widespread disruption in October.

That attack, while certainly a wakeup call to some device manufacturers, might not have resonated with many consumers, who did not see a direct impact on their lives, even if their own device was infected and part of the attack. But there is little doubt more and more individuals will be affected by IoT security shortcomings as the devices – and the related threats – grow at a staggering rate.

That could include the emergence of IoT ransomware threats. Ransomware exploded on PCs in 2016, resulting in estimates of about US $1 billion in payments. Given how lucrative the attacks have proven to be, it’s not much of a stretch to anticipate that criminals will explore how they can target IoT devices in their ransomware schemes. For example, imagine a smart lock on your home or car that won’t open until you pay a small ransom. From a criminal perspective, ransomware attacks on IoT devices could make for an efficient strike, with the possibility of holding customers’ device or data hostage and extracting money from the same individual or organization in a single step.

As attacks on IoT devices continue to evolve, none of us will be able to say we didn’t see them coming – 80 percent of professional respondents in the Risk-Reward Barometer survey expressed a high or medium belief in the likelihood of an organization being breached through an IoT device. Enterprises can use network segmentation to isolate IoT devices from their production network. Consumers also recognize the security threats; more than 75 percent of consumer respondents in each of five regions surveyed – Australia, India, Singapore, the US and the UK – expressed concern that augmented reality enhancements could make their IoT devices more vulnerable to a breach. Home IoT network security devices like Dojo by BullGuard, CUJU, and BitDefender BOX can help consumers protect their IoT devices from cyber attacks – some even have enterprise-like network segmentation capability.

Connected devices are becoming increasingly prominent in our daily lives. It is up to consumers and organizations to send the message to device manufacturers that insufficient security design will be a deal-breaker when it is time to consider a purchase.

Rob Clyde, CISM, Board Director of ISACA and Executive Advisor at BullGuard Software

[ISACA Now Blog]

Worldwide, organizations are concerned about cybercrime – but not necessarily for the reasons most would think. While many organizations worry about the technical issues that are posed by a cybercrime attack, such as ransomware locking up entire swaths of servers – bringing business operations to its knees – most are even more concerned about their public perception and loss of clientele.

In fact, while an attack or exploitation by a cybercriminal may be technically damaging to an organization, the fallout over the attack’s handling may be even worse, revealing some of the companies’ true fears.

Understanding the technical implications of an attack are incredibly important. That’s why many organizations employ incident response teams. Analysis of an attack and restoring business operations is key to ensuring that organizations do not fall prey to the same attack or, ideally, the same attacker.  However, with a proper incident response and disaster recovery element, technically recovering from an attack simply becomes a matter of restoring services and implementing the appropriate cybersecurity controls to protect an exploited organization.

What takes much longer to restore is public brand perception and customer retention. Companies have shown their fear of customer loss in the past by implementing rather dramatic controls in an effort to keep their customers. For example, after Yahoo revealed its most recent breach in 2016, it immediately disabled the automatic email forwarding feature.¹ While this was a small change on the behalf of Yahoo, it was a huge change for its customers, who may have wanted to change their email provider to another service while ensuring that they did not miss anything pivotal sent to their old address. Thus, users had a much harder time making the switch over to another email provider out of fear of potentially missing an important email. It goes without saying that users, and the media, reacted adversely.

In comparison to Yahoo, the University of Maryland, which suffered from the theft of student personally identifiable information (PII) in 2013, pivoted dramatically by announcing the attack and its response in the same week. Each student with compromised information was provided five years of credit monitoring. Additionally, public presentations were made that explained the attack as well as the types of controls placed to deter future attacks. Thus, the situation was quickly relegated to memory and barely discussed beyond the ensuing weeks.

The Yahoo and University of Maryland examples are just two that illustrate the real damage that can occur from cybercrime attacks, reputational damage and loss of consumer confidence. Those working in cyber security should keep this in mind during an incident response or disaster recovery – though the technical impact to an organization may be damaging, the reputational damage could be leagues worse.

Editor’s note: Through its Cybersecurity Nexus (CSX), ISACA has issued new guidance providing insights on some of the top emerging cyberthreats and the methods through which enterprises can defend themselves.

¹ https://techcrunch.com/2016/10/10/yahoo-makes-it-difficult-to-leave-its-service-by-disabling-email-forwarding

Frank Downs, Senior Manager, Cyber/Information Security, ISACA

[ISACA Now Blog]

As increasing numbers of enterprises begin the move to the cloud in earnest, there has simultaneously developed a host of third-party consultancy firms, offering guidance on cloud technology best practices and implementation. Recognizing that there is a genuine need for a trusted network, where organizations and professionals can be relied on to provide high-quality cloud security consultancy services based on CSA best practices, we are launching a new initiative–the CSA Consultancy Program (CSA-CP) that will go live in mid-2017 with Optiv as the first certified provider.

The overreaching goal of the CSA-CP is to support organizations looking to improve their cloud security posture and implement high standards of compliance and assurance. This new program will provide a registry–the CSA Consultancy Services Registry (CSA-CSR)–a web repository similar to the CSA STAR Registry and in doing so will simplify the research for trusted consultancy services and speed the adoption of effective, secure cloud implementations.

Grounded with CSA’s best practices, the program will be offered from a highly-vetted, trusted network of organizations and professionals, and we couldn’t be more pleased to count Optiv as our first provider.

“As a long-time supporter of CSA’s best practices, certifications and guidance, we look forward to helping organizations better understand how to implement an effective cloud security posture and ensure compliance and assurance standards are met,” said JD Sherry, Vice President, GM, Cloud Security & Strategy, Optiv, Inc. “The consultancy program will serve an excellent purpose in this regard and we are proud that Optiv is part of what we expect to be a valuable program in the future.”

The qualifications that must be met are rigorous. In order to be listed as a CSA Qualified Consultancy Service Provider, organizations must demonstrate they have completed and passed the:

• Certificate of Cloud Security Knowledge (CCSK) examination,
• CSA CCM training course,
• CSA STAR Certification Qualified Auditor designation and/or Consultant designation, and
• Certified Cloud Security Professional (CCSP) current year exam completion.

With the widespread adoption of CSA best practices, we see an opportunity and need for a repository of qualified and trusted cloud security experts. Securing the cloud continues to be our top priority, and the CSA-CP will help achieve this.

Daniele Catteddu, Chief Technology Officer, CSA

[Cloud Security Alliance Blog]

On behalf of the Cloud Security Alliance, I’m pleased to announce the publication of our newest security research from the Software Defined Perimeter (SDP) Working Group, exploring how the SDP can be applied to Infrastructure-as-a-Service environments. Thanks to all the people who commented and contributed to this research over the past 10 months, especially Puneet Thapliyal from Trusted Passage.

Cloud adoption has soared over the past few years, and yet recent surveys indicate that security is still a concern. In one Cloud Security Alliance survey, over 67% of respondents indicated that an inability to enforce corporate security standards represents a barrier to cloud adoption, while 61% noted that compliance concerns pose a barrier.

It’s quickly becoming widely understood that SDP is the preferred new way to securely deploy services. Leading analyst firms are recommending that public-facing services be protected with a new security approach, and are talking about SDP as a strong alternative to traditional network security solutions.

Enterprises have recognized that SDP can address their concerns about adopting cloud, but the Software-Defined Perimeter approach is still relatively unknown to many (here is a quick primer on SDP if you need a refresh). Security architects and IT leaders are eager to learn more about how to best design and deploy SDP-based systems.

As a vendor that offers an SDP solution, and as a leader of the SDP Working Group, we’re happy to share our knowledge and experience. This is why we’ve spent the time and effort, in partnership with other SDP practitioners, to create this new security research outlining how Software-Defined Perimeter applies to IaaS environments.

Security for IaaS is particularly interesting, because it’s a responsibility that’s shared between enterprises and cloud providers, and because IaaS has different (and in some ways more challenging) user access and security requirements than traditional on-premises systems. Our new research focuses on how SDP can be applied to Infrastructure-as-a-Service environments, and explores the following use cases:

• Secure Access by Developers into IaaS Environment
• Secure Business User Access to Internal Corporate Application Services
• Secure Admin Access To Public Facing Services
• Updating User Access When New Server Instances Are Created
• Hardware Management Plane Access for Service Provider
• Controlling Access Across Multiple Enterprise Accounts

This research is now available here – and we look forward to getting your feedback. Please join the SDP Working Group to collaborate.

Finally, now that this research has been published, we’re just beginning work to outline more architectures and new applications of the protocol in version 2 of the SDP specification. Please join us if you’re interesting in contributing or learning more about that project as well.

Jason Garbis, Vice President of Products, Cryptzone

[Cloud Security Alliance Blog]