Blog

Posted on

2017 Cybersecurity Predictions: The Year We Get Serious About IoT Security

This post is part of an ongoing blog series examining “Sure Things” (predictions that are almost guaranteed to happen) and “Long Shots” (predictions that are less likely to happen) in cybersecurity in 2017. 

Throughout 2016, cybersecurity moved more into the public eye than ever before. Hacks into the Democratic National Committee, BitFinex, Yahoo, Dropbox, LinkedIn, and Verizon were just a few of the high-profile security breaches that grabbed headlines this year.

With 2017 fast approaching, we expect that we’ll continue to see breaches in the news. Let’s look at some predictions for the new year around network security:

Sure Things

Phishing attacks will continue to increase…and be effective

While phishing has been around for a long time, it continues to be a very successful method of attack for hackers. The 2016 Verizon Data Breach Investigations Report cites 30 percent of phishing messages were opened by the target, with a median time of the first click on a malicious attachment being within the first three minutes and 45 seconds. It’s effective, and it works. In their Q2 2016 Phishing Activity Trends Report, Anti-Phishing Working Group (APWG) observed 466,065 unique phishing sites in Q2 CY2016 – up 61 percent from the previous quarter’s record in Q1 CY2016. Seagate Technology, Snapchat, and Polycom are just a few examples where spear phishing attacks compromised employee payroll information in 2016. With attackers creating ever-more-realistic-looking emails and landing pages, we’re only going to see more of this in 2017.

Security organizations will begin to move away from security sprawl and towards true automation

To counter the malicious activities coming at them, security operations teams need to be more agile than ever – that means more visibility into what’s coming at them, a reduction of noise, and automating for faster response.

Traditionally, security teams have bolted on additional security solutions to address new threats. This has led to management frustration – coordinating security resources (oftentimes manually) from a variety of security solutions and vendors where the components don’t talk to each other or share knowledge. Security organizations will start to migrate toward solutions that are more contextually aware and security platforms that can share information across the attack surface, utilizing analytics for automated detection and response.

Internet of Things (IoT) attacks become a thing

Experts have been sounding warnings about IoT security vulnerabilities for a few years now, and while hacks have been demonstrated, until recently we hadn’t seen a lot of widely reported malicious activity. That changed in a big way towards the end of 2016. We saw the largest DDoS attack ever delivered by a botnet made up of IoT devices and a major attack on Dyn just a month later led to a massive internet outage across the U.S. and parts of Western Europe.

Gartner estimates that there are 6.4 billion connected things worldwide in use this year, a number expected to reach 20.8 billion by 2020. That’s a lot of targets.

Ease of use will be key to the success of IoT devices, but requiring individual users to constantly update their security wrinkles the user experience. Will “Uncle Joe” really go through the process of updating the default password on his new connected thermostat? Probably not – and that leaves a gaping hole for breaches depending on other connections in his network. I expect we’ll look back and view 2017 as the year IoT attacks really started – and also when we got serious as an industry about preventing them.

Long Shot

Ransomware encroaches on IoT devices

DDoS attacks are one thing, but what about ransomware on IoT devices? Ransomware has traditionally been used to hold an organization’s valuable data hostage by locking down the computers that store that data. Attacks often come into an organization through things like Adobe Flash or executable files.

IoT devices don’t generally store sensitive data and often don’t have the interfaces to deliver ransom notes. Malicious actors of course tend to be motivated by profits and it’s still easier, more efficient, and more profitable today to go after data where it resides. But the vulnerabilities in IOT devices will eventually lend themselves to ransomware that threatens immediate damage – shutting down a power grid or production line, for example.

As we start to see connected devices exploited more often for DDoS attacks, additional kinds of exploits are sure to follow – the question is whether it will become a profitable enough endeavor for bad actors to take mainstream in the next year.

What are your cybersecurity predictions around network security? Share your thoughts in the comments and be sure to stay tuned for the next post in this series where we’ll share predictions for endpoint security.

and

[Palo Alto Networks Research Center]

Posted on

2017 Cybersecurity Predictions: New Norms Expected in Threat Landscape

This post is part of an ongoing blog series examining “Sure Things” (predictions that are almost guaranteed to happen) and “Long Shots” (predictions that are less likely to happen) in cybersecurity in 2017.

Here’s what we see coming on the threat landscape in 2017:

Sure Things

The ransomware business model moves to new platforms

As we highlighted in our May report, ransomware is not a malware problem, it’s a criminal business model. Malware is typically the mechanism by which attackers hold systems for ransom, but it is simply a means to an end. As noted in our report, the ransomware business model requires an attacker to successfully perform five tasks:

  1. Take control of a system or device. This may be a single computer, mobile phone, or any other system capable of running software.
  2. Prevent the owner from accessing it. This may happen through encryption, lockout screens, or even simple scare tactics, as described later in this report.
  3. Alert the owner that the device has been held for ransom, indicating the method and amount to be paid. While this step may appear obvious, one must remember that the attackers and the victims often speak different languages, live in different parts of the world, and have very different technical capabilities.
  4. Accept payment from the device owner. If the attacker cannot receive a payment, and, most importantly, receive the payment without becoming a target for law enforcement, the first three steps are wasted.
  5. Return full access to the device owner after payment has been received. While an attacker may have short-lived success with accepting payments and not returning access to devices, in time this will destroy the effectiveness of the scheme. Nobody pays a ransom when they don’t believe their valuables will be returned.

The ransomware business model can target any device, system, or data, where someone can perform all five of these tasks. At DEFCON 24 in August 2016, researchers from Pen Test Partners demonstrated taking over an internet-connected thermostat and locking its controls before displaying a ransom note (Figure 1) demanding one Bitcoin in payment.

Figure 1: Ransom note displayed on internet-connected thermostat at DEFCON 24

While this was not a live attack, a similar screen is sure to appear on an internet-connected device in 2017. For a cybercriminal, making money is the name of the game. If they can capture control of a device, it’s only truly valuable if they can monetize that control. If they take control of an internet-connected refrigerator, they will probably struggle to find data they can sell or otherwise turn into cash, but holding the refrigerator for a small ransom could be very profitable. The same is true for nearly any internet-connected device, as long as they can complete all five tasks outlined above. It would be hard to communicate a ransom note via an internet-connected lightbulb, unless the victim is fairly conversant in Morse code.

Political Leaks are the New Normal

Looking back on the headlines of 2016, it’s apparent that data leaks of a political nature had a significant impact in the United States. While the election may be over, I predict that these types of breaches will continue well into the future, and throughout the world.

Some features of politically focused data leaks are both desirable to government actors and dangerous for an electorate. Consider the following:

  1. Years of releases from WikiLeaks and others have conditioned the public to assume that leaked information is true by default. While previously released data may be authentic, this assumption could be easily exploited by a leaker interested in influencing voters.
  2. If leaked data has been altered, the breached party may have no reasonable way to disprove the alteration. A digital signature on a document could prove its authenticity, but the lack of a digital signature does not prove it to be inauthentic.
  3. A government (or government-sponsored) organization can release information gained through espionage under the guise of a hacktivist, absolving him or her of negative political impact. Even in cases where strong evidence suggests a government was behind the intrusion that revealed the leaked data, plausible deniability exists.

Consider a case where there are private documents describing a trade negotiation between Nation A and Nation B, which Nation C does not favor. If Nation C obtains a legitimate document describing the details of the negotiation and releases an altered version, which drastically favors Nation A; the voters in Nation C may be outraged, causing the negotiations to fail. To disprove the leak, Nations A and B would have to release the actual documents, which could also cause problems for the negotiation.

No matter your political persuasion or opinion on government transparency, it’s important to understand how certain parties can abuse the current environment. Political leaks are a form of information operations that can be conducted with great effectiveness and little chance of retribution. What we have seen in 2016 will be the new normal.

Long Shots

Secure Messaging Apps Gain Widespread Adoption in Response to Massive E-mail Leaks

If people take nothing else away from the leaks of 2016, it should probably be this:

Don’t put in an e-mail what you wouldn’t want to see on the front page of the newspaper.

This is a hard lesson to internalize, as e-mail has become asynchronous communication for most of the world (and certainly people reading these words). But it’s one we should take to heart.

There are many problems with using e-mail to transmit messages that are only intended for a specific audience. The messages often sit unencrypted once they reach their destinations. Even if they are encrypted, the sender typically doesn’t have control over the security of the recipient’s system; the recipient could decrypt the e-mail and store it in plain text or mismanage their encryption keys. In most cases, the messages are sorted, cataloged, and indexed automatically, allowing an individual with just temporary access to drudge up secrets by keyword and forward them to parts unknown.

If you are wondering if you should return to simply making phone calls when you want to share a private message, that’s not a bad idea, but take a look at any teenager’s phone when considering a technology solution. Snapchat’s killer feature is messages that automatically delete themselves after the recipient reads them. This allows users to send messages with less concern about them being shared with others. There are now many security-focused messaging systems, including Telegram, Wickr, Signal and Allo, which feature end-to-end encryption and self-deleting messages. While it’s still possible for someone to grab a screenshot of one of these messages, they are often much safer than e-mail.

Widespread adoption of these services in 2017 is still a long shot, as many users may not be comfortable making the transition from e-mail. However, those who’ve learned from widespread leaks will look for alternative ways to share their private thoughts with others.

What are your cybersecurity predictions around our threat landscape? Share your thoughts in the comments and be sure to stay tuned for the next post in this series where we’ll share predictions for network security.

[Palo Alto Networks Research Center]

Posted on

Suggested Tips Auditors Need to Know About Cyber Security

We live in an age when social media, mobile devices and the Internet of things (IoT) dictate how we access, manage and communicate information. This technology is constantly changing and relatively complex in nature. Thus, it is essential that enterprises have a fully functional and effective information security program.

The responsibility to ensure such a program is properly implemented resides with senior management. The main objectives of such a program are to ensure the confidentiality, integrity and availability of the information assets and associated resources.

These overall objectives should be supported by safeguards known as controls, which are put in place to mitigate the risks associated with the use of the technology. If the controls are operating effectively and efficiently, the potential for loss and harm to enterprises assets should be reduced to an acceptable level. The question is who and/or what makes the determination of the effectiveness and efficiency of the controls.

This is where auditors come in. Their role is to review and perform tests to ultimately provide a level of assurance to management and the board of directors that the controls in place are appropriate, are in fact operating and are meeting the intended objectives. In many cases, this job function is relatively straightforward. However, many would argue that when it comes to cyber security technology, although the auditor’s role doesn’t change, the complexity of the audit does.

Auditors have an obligation to educate themselves on this powerful and evolving technology, and there is much to learn. Below are 10 things an auditor needs to know about cyber security. This list is not all-encompassing, nor is it ranked in any order.

  1. Everything is connected to everything. The primary function and objective of any cyber device is connectivity. Devices are like climbers roped together on the side of a mountain – if one falls, it can bring down anything connected to it. The Target hack (through an HVAC supplier connection) clearly demonstrates the need for a holistic cyber security view. With the arrival of the Internet of Things, it’s imperative that auditors understand and address the bigger picture.
  2. All risks are subjective. To qualify as a “risk,” a threat needs to be associated with a vulnerability that – if exploited – could negatively impact an information asset. If it does not, it is not a threat. Too many auditors worry about threats and vulnerabilities that pose no actual risk to an asset, prioritizing compliance over risk and wasting precious time and resources.
  3. Users are (and will always be) the biggest security risk. Our industry is led by vendors, and we continue to seek security through products (firewalls, IDS/IPS, DLP, etc.). We invest in product before people while real and measurable results can be achieved by investing in information security awareness. To contribute tangible results, auditors should prioritize people over product. Cyber security education is the silver bullet.
  4. Leverage existing frameworks/guidelines. Auditors should consider mapping of the NIST “Framework for Improving Critical Infrastructure Cybersecurity” to ISO 27001:2013 controls and COBIT 5 to reduce the scope of the audit, making the audit more manageable.
  5. Consider forthcoming legislation. Auditors should study how forthcoming and existing legislation like General Data Protection Regulation (GDPR) and Payment Card Industry Data Security Standard (PCI-DSS) could potentially be incorporated into cyber security programs. Also, auditors need to understand the global regulatory environment and the differences that can exist between different geographic regions.
  6. Basic information security controls still hold true. As part of overall security (including cyber security), these controls provide a valid baseline of security controls that help create in-depth security, such as physical and logical access controls and application of “principle of least privilege.”
  7. Utilize a cyber incident response policy and plan that is fully tested. Auditors need to assess whether a proper crisis management and communication plan is in place, clearly communicated and tested as appropriate. This should enable sufficient business continuity in the event of a cyber security breach. Crisis management should include incident response and forensics, where warranted. Proactive monitoring and detection (with automated tools) should be in place.
  8. Cyber security strategy needs to be agile – the landscape is “mutating.” Strategy needs to be adaptable and scalable to handle new attack methods, such as ransomware and cloud-related risks. Auditors need to be aware that this is an area that is constantly changing and must not assume that what currently keeps your IT environment secure will continue to remain secure indefinitely.
  9. Cyber security awareness depends on the right training. Employees need sufficient and timely education and training to help combat ever-changing cyber security threat. Security needs to be interwoven into the fabric on an organization.  One-off, box-checking exercises are not sufficient. For example:
    • Do employees understand the implications of a cyber security breach?
    • Has any thought been given to insider threats from a cyber security perspective?
    • Is there clear guidance on the use of social media/shadow IT solutions/BYOD/how to respond to a phishing or ransomware attack?
    • Are employees rewarded/praised for promoting security in an organization? Are they incentivized?
  10. Be aware of credential theft techniques. Auditors should have knowledge of credential theft attack techniques. Typically, the Pass-the-Hash (PtH) attack and other credential theft attacks utilize an iterative, two-stage process. First, an attacker captures account logon credentials on one computer, and then uses those captured credentials to authenticate to other computers over the network.

Editor’s note: To learn more, register for ISACA’s 6 December webinar, “Suggested Tips Auditors Need to Know About Cyber Security.” Click on the link below to register:
www.isaca.org/Education/Online-Learning/Pages/Webinar-Suggested-Tips-Auditors-Need-to-Know-about-Cyber-Security.aspx

ISACA also is offering a one-day workshop entitled “Cyber Security for Auditors” immediately following the 2017 North America CACS conference in Las Vegas, Nevada. For more information and to register, click on the link below:
www.isaca.org/Education/Conferences/Pages/North-America-CACS-Presentations-and-Descriptions.aspx#ws7

Paul Phillips, Technical Research Manager, ISACA

[ISACA Now Blog]

Posted on

Will Your Business Be Competitive in 10 Years?

For a moment think about these statements:

  • Technology has evolved and is evolving faster than ever before.
  • My enterprise is facing unknown competitive threats.

After considering these statements, how would you answer the question of whether your business will be competitive in 10 years?

With the countless factors that exist across every sector, the question is very difficult to answer. The pace of positive, negative and unclassified technological advancements is exponentially greater than ever before. How will your enterprise and IT governance structure survive these exciting times?

Consider Your Enterprise’s Risk Appetite
Information technology is now a core component in achieving business objectives. So if we look at it from a business growth point of view while anticipating current trends, your strategy may have to shift to focus on digital channels. What this means for your business is that you need a digital footprint that is both secure and user-friendly. With every new strategy you may have new risks, so your company’s risk appetite has to be considered.

What type of IT service and infrastructure would you need to deal with multiple types of digital connections that deliver standard functionality across these channels? How would this impact your resources and IT management options? Do you need to move to the cloud? Broadening the enterprise’s digital footprint can create the possibility of multiple connections to your services via numerous known hardware (e.g., tablet, watches, laptops, cell phones), along with anything that can be digitized. Your traditional business structures are now expanded with newer delivery options, so supporting demand now requires a rethinking of traditional network structure to handle the new scales. This can become an issue for many enterprises.

The security aspect of the future cannot be overlooked because you now have a wider attack surface and crippling ransomware to deal with. If your security fails, this affects customer perception, and you will not be able to honor the confidentiality and integrity of the user experience. Ransomware is quite destructive because not only does it affect the availability of the infected data, you also have to pay hefty sums to get back access to your data if there is no mitigation plan in place. Can your enterprise continue to meet the current industry regulations and maintain a secure infrastructure into the future?

GEIT Can Get You There
Within the next 10 years your enterprise will face the growing Internet of Things (IoT) landscape, with faster, more convenient delivery methods, harboring both increased risk and lucrative opportunities.

With a flexible governance of enterprise IT (GEIT) model, you could construct a relevant framework that looks at how the enterprise’s strategic plans and IT work together. You could look at continuous improvement actions and keep this alive within the enterprise. You could ensure IT risk management is aligned with the enterprise’s risk appetite and that security is considered at all points. You could consider various means to optimize your IT resources and capabilities required, as all these are key to helping your enterprise adapt and remain relevant in the future landscape.

Ammett Williams CCIE, CGEIT, Telecommunication Team Leader – First Citizens, TT

[ISACA Now Blog]

Posted on

Tech Certifications Are Earning Cash Premiums, and Info/Cyber Security Certs Are the Hottest

Why would an employer pay its tech workers extra cash for a skill or certification if they’re already getting a salary and annual bonus?

There are a dozen good reasons why, and they all share one thing in common: None would be necessary if the company’s compensation structure and pay practices were agile enough to successfully compete for talent in volatile labor markets. The nature of the tech labor marketplace is exactly that, where the market value of a job or skill can move like a roller coaster depending on what’s hot and what’s not at any given moment. If your employer doesn’t have built-in flexibility to react quickly and correctly, it will struggle to find and keep people to execute tech-enabled business strategies.

Who Needs Skills Pay and Why
How do you know if your employer is a victim? Say, for instance, your company doesn’t normally have trouble retaining tech talent and suddenly the best people start walking out the door. Most likely your company wasn’t able to match competing salary offers. Then to make matters worse, it’s soon discovered that the competing offers were actually realistic average local market salaries for these positions – so your employer was underpaying these people from the start. It’s called ‘salary compression,’ when market-driven pay for talent is growing at a faster rate than the annual salary increases employers are able to offer their workers.

Compression is a widespread systemic reality that tends to be much worse in the tech workforce because of the rapid evolution of technology, skills and jobs. Every employer must decide whether to fix it permanently (very difficult) or patch it occasionally (less difficult and more practical).

If there is little leeway in the incumbent’s salary range to sweeten the pot on a counter-offer, and a promotion is not a viable option, paying workers extra cash for critical skills and certifications can be the perfect solution. That is especially true when workers possess the very hot certified or noncertified tech skills that other employers are aggressively targeting. The trick is to tie this extra cash directly to current market value for the hot skill or certification and guarantee that premium for some period of time, usually one year or more. When time’s up, the employer can check whether market value has changed and decide if it makes sense to continue to pay the skills premium and how much to pay, or to switch it out for another hot skill that has become more valuable to the organization.

What is the current cash market value for certifications?
Extra pay awarded to 69,900 U.S. and Canadian IT professionals for 880 certified and noncertified IT and business skills – also known as skills pay premiums – has been tracked and updated quarterly since 1999 in the IT Skills and Certifications Pay Index™(ITSCPI). About 3,000 private and public sector employers currently provide this data to Foote Partners, covering a total of 255,600 IT professionals at these companies.

ISACA certifications are doing extremely well. As a group they’ve gained 15.3 percent in cash market value in the last six months compared to nearly 8 percent growth in pay across all 80 security-related certifications in the ITSCPI. The Certified in Risk and Information Systems Control (CRISC) and Certified in the Governance of Enterprise IT (CGEIT) are the top gainers. The CSX Practitioner (CSXP) certification appeared for the first time in the latest ITSCPI, earning an average pay premium equivalent to 12 percent of base salary – a very strong number for a new certification.

The following security certifications are earning the highest pay premiums right now. They’re paying median cash premiums equivalent to 13 percent to 19 percent of base salary, typically paid out each pay period as a cash bonus in addition to salary, and are shown below in descending rank order of market value including ties, arranged alphabetically within each rank.

  1. Certified Cyber Forensics Professional
  2. (Tie) Certified Forensic Computer Examiner
    CyberSecurity Forensic Analyst
    GIAC Reverse Engineering Malware
  3. (Tie) EC-Council Certified Incident Handler
    EC-Council Computer Hacking Forensic Investigator
    GIAC Certified Forensics Examiner
    GIAC Certified Forensics Analyst
    GIAC Exploit Researcher and Advanced Penetration Tester
    GIAC Web Application Penetration Tester
  4. (Tie) GIAC Enterprise Defender
    GIAC Secure Software Programmer–Java
    InfoSys Security Architecture Professional (ISSAP/CISSP)
  5. (Tie) Certified Information Security Manager (CISM)
    Certified Information Systems Security Professional
    Certified in Risk and Information Systems Control (CRISC)
    EC-Council Licensed Penetration Tester
    InfoSys Security Engineering Professional (ISSEP/CISSP)

Market values for 412 tech certifications in the most recent ITSCPI data update are averaging the equivalent of a 7.7 percent of base salary and as a group recorded gains in 14 consecutive calendar quarters, unprecedented in the 18 years Foote Partners has been tracking and reporting compensation for certifications. Figuring prominently in this growth has been info/cyber security certifications.

Market values for 80 info/cyber security certifications have been on a slow and steady upward path for four years, up 10.7 percent in average cash value as a group in just the past 12 months and 15 percent during the past two years – the largest gain among all certification categories reported. Strong performing security certifications so far in 2016 cut a wide swath: cybersecurity, forensics, penetration testing, perimeter protection and enterprise defense, security analysis, risk and security software programming.

Editor’s note: Registration is open for the first testing window of 2017 for ISACA’s core certifications.

Exams for CISA, CISM, CGEIT and CRISC will be offered in 2017 at PSI testing locations worldwide during three, eight-week testing windows. The first testing window will be 1 May-30 June, with 28 February marking the early registration deadline. Exam registration via the ISACA website is available at www.isaca.org/examreg.

David Foote, Chief Analyst and co-founder, Foote Partners, LLC

[ISACA Now Blog]

English
English
Exit mobile version