Author: Dr. Philip Cao

Dr. Philip Cao (aka #DrPC), EDBA, MSCS, ZTX-I, CCISO, CISM, CMSC, CCSP, CCSK, CASP, GICSP, PCSPI is a Strategist, Advisor, Educator, Contributor and Motivator. He’s also a Cyber | Zero Trust Strategist & Evangelist and Chief Trust Officer. He has 24 years’ experience in IT/Cybersecurity industry in various sectors & positions.
Posted on

Four PAN-OS 7.1 Capabilities That Offer New Opportunities for MSSPs

PAN-OS 7.1, which we officially announced this week, offers new ways for Managed Security Service Providers (MSSPs) to differentiate and strengthen their offerings without adding complexity or new resources. Below are a few highlights that Palo Alto Networks MSSP customers will be particularly interested in:

1. Identifying and neutralizing zero-day threats in five minutes or less

For MSSPs, preventing cyberattacks from impacting customers is job No. 1. MSSPs are successfully using Palo Alto Networks Next-Generation Firewall to proactively protect customers against known threats. Now there are more reasons to layer WildFire advanced threat analysis on a next-generation firewall for protection against unknown threats. With PAN-OS 7.1, we’ve cut the global window of zero-day attack opportunity down to just five minutes.New machine-learning algorithms, and the largest community of shared threat intelligence on unknown attacks, allow WildFire to identify and automatically neutralize attacks in minutes for all subscribers globally. Together, MSSPs and Palo Alto Networks can automatically stop advanced attacks from spreading and causing harm.

2. Speeding analysis, forensics, and action against targeted attacks without additional resources

Every organization struggles to separate truly targeted attacks from the more commoditized, everyday threats. AutoFocus cloud-based threat intelligence service was built for fast searching, data analysis, and correlation over large data sets. AutoFocus organizes and presents the largest collection of unknown malware data in the world. Customers use it to identify targeted attacks on their organization and view how their data compares to others in the same industry or the world at large. Now AutoFocus brings advanced threat context to every SOC team member. New integration with PAN-OS and Panorama accelerates analysis and response by letting security administrators easily determine if suspicious domains, IP addresses or ULRs have been identified as key threats. AutoFocus also adds the ability to bring threat intelligence into your existing security operations workflow with an improved API and support for the STIX information-sharing standard.

3. Securing private, public and hybrid clouds as part of on-premise services

With the latest updates to our Next-Generation Security Platform, it’s easier for MSSPs to secure both on-premise and cloud environments. PAN-OS 7.1 extends the security platform to all major virtualization environments, including Microsoft Azure and Hyper-V. This release also contains enhancements that automate scaling and deployment, and it improves availability in virtual environments. With the same PAN-OS in physical and virtual security platforms, MSSPs can offer the same consistent, up-to-date security posture for their customers no matter where their applications and data reside.

4. Providing visibility and enabling safe usage of Office 365

SaaS has often been a security blind spot. With updates to Aperture and PAN-OS 7.1, we’ve added to our extensive SaaS security capabilities. App-ID can now identify Microsoft Office 365 applications and how they are being used, even if they are encrypted. It also can decrypt Office 365 flows and inspect the files being exchanged to look for threats. Aperture protects data from exposure and threats in the Office 365 cloud itself, stopping those threats at the source before they have a chance to move to the network or mobile devices.

With this release, we further enhances SaaS security with the ability to tag SaaS applications as sanctioned, or unsanctioned, and generate a detailed, SaaS-specific report on applications, users and usage. MSSPs and their customers gain greater visibility and control of SaaS applications, with no extra hardware, network changes or client software required.

For more information on PAN-OS 7.1 features, you can read the product announcement, visit our resources page, or review the Technical Documentation below.

[Palo Alto Networks Research Center]

Posted on

ISACA Now Chats with EuroCACS 2016 Keynote Speaker Mark Stevenson

ISACA Now recently spoke with Mark Stevenson, the closing keynote address for EuroCACS in Dublin 30 May-June 1 2016. Stevenson is the founder of We Do Things Differently, and the author of An Optimist’s Tour of the Future and the upcoming We Do Things Differently. He is also an advisor to the Virgin Earth Challenge, Atlas of the Future, Comic Relief and Institution of Mechanical Engineers.

ISACA Now:  In Principle 7 of your 8 Principles for Thinking About the Future, you discuss how pragmatic optimists will experience significant rejection and ridicule when starting new endeavors. What practical advice do you have for getting through all that rejection without becoming defeated and cynical?
Stevenson:  By understanding that you will lose more often than you will win until half way through the game—and that’s OK. Persistence (driven by the optimism that a better future is possible) is the secret sauce of success. Cynicism by contrast is just a recipe for laziness dressed up as wisdom. Every great leader you can think of is an optimist. As the saying goes, “The road to success is littered with corpses, but they’re all suicides.” Also remember that that rejection is often a sign you’re on the right track. As the computer scientist Howard Aitken sagely remarked: “Don’t worry about people stealing your ideas. If your ideas are any good, you’ll have to ram them down people’s throats.”

ISACA Now:  For many, cynicism is deeply embedded. How is it possible for those long-term cynics to kick out their cynicism?
Stevenson:  By looking in the mirror and asking themselves if they want to continue being unhappy. Cynicism is obedience. As the author Richard Bach put it, “Shop for security over happiness and you buy it, at that price.” Cynics reinforce the status quo they complain about by refusing to imagine it can be different. But the antidote is doing something bigger than you for which the dividends emotionally (and often financially) are handsome. It’s a choice. Comfortable miserable cynicism, or uncomfortable happy optimism? It’s your life.

ISACA Now:  Your pragmatic optimist’s view of the future should come in handy for cybersecurity professionals as they work to address the avalanche of cybercrimes and criminals. What is your advice for those who may be growing weary of the world’s seeming inability to overcome cybercrime? What historic parallels can you draw from this?
Stevenson:  The question is what are we protecting? One has to ask what the roots of crime are, and they are based in scarcity and distrust. In a world of abundance and transparency, crime and war are far less likely (indeed history teaches us this time and time again). The cybersecurity profession has to ask itself whether it is on the side of people, or Mossack Fonseca (the Panamanian law firm that recently had 11.5 million confidential documents leaked) and its clients. Who are you paymasters and what are their morals? We overcome violence and addiction by being more connected, not less so. We will overcome cybercrime most effectively by working to reduce inequality. So, the question is, what are you doing about that and whose side are you on?

ISACA Now:  You will be speaking at the EuroCACS conference 30 May-1 June 2016 in Dublin. Give us a brief preview of what you’ll discuss and what attendees will take away.
Stevenson:  I’ll be explaining why all bets are off, how the next 30 years will be some of the most turbulent in history and how to navigate that in the service of making the world better for your children.

[ISACA Now Blog]

Posted on

(ISC)² to Host International Standards Organisation Meeting

Many of you will know that (ISC)² is hosting a major event this month – in downtown Tampa, Florida – and I’m sure that you’ve also heard the phrases ISO and SC27. But what does this all mean?

ISO is the International Standards Organisation, set up in 1947, which oversees the creation, publication and maintenance of standards covering everything from acid-free paper to quality management systems, smart cities to information, and cybersecurity. ISO has committees of experts – drawn from around the world – who volunteer their time and share their knowledge to create and maintain standards. Each committee has a particular subject area or topic it specialises in and JTC1/SC27 (or SC27) is the committee that specialises in information security. Standards help set the bar for organisations by defining good practice and setting targets to be met.

Many cybersecurity professionals have used, or at least are familiar with, ISO standards produced by SC27 (for example, ISO/IEC 27001) and (ISC)²’s CBKs reference standards as part of the knowledge required by a security professional. But we don’t just passively write about ISO standards in our textbooks. (ISC)² is a ‘category A liaison organisation,’ which carries significant influence and allows us to propose new standards, provide comments, draft text for inclusion in standards and suggest changes to existing standards. (ISC)² staff regularly attend ISO meetings and we invite our members to the same meetings; as a result, we actively share knowledge and expertise to ensure these standards reflect good practices. Our contributions help form the basis of these standards; build processes and frameworks using real world experience; and assist with the writing of text to help individuals implement the standards. So our contributions – in person or in written submissions – help form the foundations on which information security can be built. Our work with ISO shows our commitment to a safe and secure cyber world.

The creation and maintenance of new standards follows a set pattern, in which face-to-face meetings are held twice a year. These meetings – such as the one (ISC)² is hosting– bring together experts from around the globe who collaborate, share insights and experience, codify good practices and draft the text that will become part of a new standard, or modify and enhance an existing one. In the time between the face-to-face meetings, experts are invited to comment on the outputs of the meeting and prepare for the next meeting. ISO experts are drawn from industry, academia and from other standards organisations (such as NIST or BSI). ISO experts can also be appointed as ‘editors’ for an international standard. This role is fundamental to the standards process and editors are ultimately responsible for project managing, writing, collaborating and delivering the international standard. Being an editor is a voluntary role and requires tact, diplomacy and the ability to synthesise agreement from varying opinions. An editor also has to be able to write using the, sometimes arcane, language of international standards.

So, what are the meetings like? They can be great fun, insightful, difficult and procedural in turn or at the same time. They are a great forum to learn, share and network as these meetings draw around 400 experts together for a week.

It’s worth remembering that much of the discussions this month will eventually find their way into information security practice, how we deploy information security in our own offices, our members’ work and (ISC)² educational materials. — Dr. Adrian Davis, CISSP, Managing Director, EMEA, (ISC)²

[(ISC)² Blog]

Posted on

How the New PAN-OS 7.1 Release Empowers Industrial Control and SCADA Systems

Being the ever-vigilant security practitioner for ICS and SCADA, you’ve probably noticed, we recently announced the release of our newest operating system, PAN-OS 7.1. For ICS and SCADA customers, I want to share some ideas about how this new platform could be leveraged in the plant production environment.

Deploy Two-Factor Authentication with GlobalProtect

The need for real-time data to remain competitive is a major element that has ushered in the need for connectivity between ICS environments and the enterprise. This need for connectivity, if not done correctly, could truly come at a premium. Even though most ICS environments have little or no access to the Internet, the established connectivity back to the enterprise places these systems at extreme risk. Oftentimes, lacking segmentation, the systems are easily seen and easily accessible by those who have no reason to access them. Due to the age and nature of these systems, access control is difficult to implement and sustain; therefore, special care and consideration must be taken to ensure access for the mobile workforces that support them. By using the Palo Alto Networks Next-Generation Security Platform and leveraging the extensibility we can provide to end-user devices, we can help ensure that the only people accessing the systems are the ones who need to. Most importantly, we can ensure that their systems are free of infections that could compromise them.

With the release of PAN-OS 7.1, we can secure access to these remote plants and field devices that have simple or weak passwords and non-existent authentication capabilities with GlobalProtect™, which can implement two- factor authentication to the zone where they are located.

As security practitioners, we know that the use of Active Directory (AD), usernames and passwords are not sufficient for allowing remote access to these devices, as they can be compromised by phishing attacks. We also know attackers can use stolen credentials to gain access to these resources and put the control systems at risk. Most organizations mandate two-factor authentication, or 2FA for VPN authentication to safeguard against stolen credentials, and the same should apply to ICS and SCADA PCN.

Common and acceptable options for 2FA are the use of a unique client certificate per client device, in addition to the AD credentials or a one-time password (OTP) with RSA-secure ID.

In PAN-OS 7.1, the GlobalProtect portal can now interface with the enterprise public key infrastructure as a Simple Certificate Enrollment Protocol, or SCEP, client and facilitate secure distribution of unique client certificates. GlobalProtect now has enhancements to cache the result of a successful OTP authentication for subsequent authentications. This will significantly reduce the number of times a user must input the OTP to stay connected to GlobalProtect.

And don’t worry too much about that automation tech who lost their ruggedized device. To mitigate the risk of lost or stolen equipment, just revoke the client certificate or the cached cookie.

Bootstrapping Device Deployment

 For owners and/or operators of ICS and SCADA systems in remote locations where there is no personnel with the necessary skills set to configure and deploy equipment or where a third-party provider is needed for the physical deployment of equipment, the new bootstrapping capability of Palo Alto Networks next-generation firewalls will simplify the process of configuration and deployment.

In remote environments, physical firewalls generally require trained personnel to perform the sequence of manual configuration before the firewall is ready for operation. At the very least, a field technician who has a wireless modem connected to a laptop is needed. The laptop must be configured to allow a remote desktop session so that someone at a corporate office can work through that machine. Our new bootstrapping feature helps simplify and automate the process of deployment, whether it’s to replace or upgrade an existing unit or to undergo a completely new installation.

With PAN-OS 7.1, when a firewall is first deployed or has been factory reset, it will look for a configuration package (located on a USB flash drive). Once found, it will automatically load it as part of the boot-up process. Our bootstrapping process is incredibly flexible. The configuration can be as simple as a basic network configuration and a Panorama™ IP address to the latest software versions, content updates, policies and licenses. This new feature will reduce the time required to get remote sites with new deployments live or back online due to site mishaps. Additionally, it can reduce the level of frustration during the deployment or recovery process.

With this new feature, your deployment abilities in remote, disconnected environments could be improved by delivering all the required configurations through the bootstrapping package without the aid of the Internet. When you call the field and request a pair of hands to do the deployment you truly mean just a pair of hands.

Bidirectional Forwarding Detection

It is not uncommon for operators of ICS and SCADA systems to use the dynamic routing capabilities of the Next-Generation Firewall to meet their Layer 3 connectivity needs, especially in situations where space and power are at a premium and network downtime must be kept at a minimum. The need for fast, reliable network convergence in these environments is essential to ensuring the safe operation of these real-time systems. Bidirectional Forwarding Detection, or BFD, in PAN-OS 7.1 allows sub-second failure detection, immediately triggering convergence in routing protocols, such as Open Shortest Path First (OSPF) and Border Gateway Protocol (BGP) to re-establish viable paths in traffic flow across the firewall. This helps reduce production network outages. Just think: The device that gets blamed the most for causing communication disruptions is now the device that’s keeping the communication going.

Want to learn more?

Details about what’s new in this release can be found on our PAN-OS 7.1 Technical Documentation page with additional resources available below.

[Palo Alto Networks Research Center]

Posted on

How to Get C-suite Support for Insider Threat Prevention

If you’re not getting support and adequate funding from the C-suite to address insider threats, a recent report highlights a powerful persuasive tool you may have overlooked: money—as in fines (cha-ching), lawsuits (cha-ching) and credit monitoring services (cha-ching) you’ll have to pay as the result of a data breach.

The IDC report, “Endpoint Data Protection for Extensible DLP Strategies,” cites two health-care groups that paid six figures each in fines for data breaches as a result of improper employee behaviors. Here are even more powerful examples of the price your organization could pay for not addressing insider data security threats:

Target insider breach costs could reach $1 billion
Target may have skirted an SEC fine, but the retailer is still paying a hefty price because cyber thieves were able to access customer credit card data via a subcontractor’s systems. Breach costs included $10 million to settle a class action lawsuit, $39 million to financial institutions that had to reimburse customers who lost money, and $67 million to Visa for charges it incurred reissuing compromised cards. For 2014, Target had $191 million in breach costs on its books; estimated totals could reach $1 billion after everything shakes out.

AT&T fined $25 million for employee breach
In 2015, AT&T paid a $25 million fine to the Federal Communications Commission after three call center employees sold information about 68,000 customers to a third party. The cyber thieves used the information to unlock customers’ AT&T phones.

On top of the fine, AT&T was required to do things it should have done in the first place:

  • Appoint a senior compliance manager who is a certified privacy professional.
  • Conduct a privacy risk assessment.
  • Implement an information security program.
  • Create a compliance manual and regularly train employees.
  • File regular compliance reports with the FCC.

AvMed paid $3 million in settlement
While the health plan company avoided a HIPAA fine, it paid $3 million in settlements to 460,000 customers whose personal information was on two stolen, unencrypted laptops. On top of that were costs to reimburse customers’ actual monetary losses.

In addition, the company had to:

  • Provide mandatory security awareness and training programs for all company employees.
  • Provide mandatory training on appropriate laptop use and security.
  • Upgrade all company laptops with additional security mechanisms, including GPS tracking technology.
  • Add new password protocols and full-disk encryption technology on all company desktops and laptops so that electronic data stored on the devices would be encrypted at rest.
  • Upgrade physical security to further safeguard workstations from theft.
  • Review and revise written policies and procedures to enhance information security.

The lesson here should be obvious. It’s far cheaper to act now—by implementing available endpoint protection technology and instituting a security-aware culture—than to wait for a breach that forces you into action.

As security expert Philip Lieberman noted in the AT&T case, the penalty cost AT&T much more than the steps it should have taken to prevent the insider breach: “The C-level staff will have to explain this to the board as to why they did not implement a control when the cost would be trivial.”

To learn more about “Endpoint Data Protection for Extensible DLP Strategies” get the IDC analyst report.

By Susan Richardson, Manager/Content Strategy, Code42

[Cloud Security Alliance Blog]

English
English
Exit mobile version