In the last 24 months, the Cloud Security Alliance (CSA)has made great strides in enhancing theirCSA Security, Trust and Assurance Registry (STAR) Program. In brief, the STAR Program is a publicly available registry designed to recognize assurance requirements and maturity levels of cloud service providers (CSPs). Prior to issuing the guidance for STAR Certification and STAR Attestation, a CSP could only perform a self-assessment, which meant completing the Consensus Assessments Initiative questionnaire (CAIQ) and making the responses publicly available on the CSA Register. The CAIQ was completed in several different ways and the content varied from short answers to full-page responses. It was relevant information but not independently validated. This created a path for the STAR Certification and STAR Attestation Programs.
Join Schellman during a complimentary webinar titled “CSA STAR Program: Attestation and Certification”. The webinar will be held on May 13th from 12:00pm EST to 1:00pm EST and will provide one (1) hour of CPE. Debbie Zaller, Schellman Principal, and Ryan Mackie, Practice Leader, STAR Program, will provide an in-depth discussion on the opportunities to undergo third party assessments, through the CSA STAR Programs, to validate maturity level or control activities.
Organizations, specifically cloud service providers, are continuously working to provide confidence to their customers regarding the security and operating effectiveness of their controls supporting the cloud and the STAR Certification and STAR Attestation options provided by the CSA allow for these organizations to further establish confidence in the market,” said Ryan Mackie. “This webinar is a practical introduction to the STAR Level 2 offerings, outlining their benefits, requirements, and process, and how these types of third party validation can clearly compliment a cloud provider’s governance and risk management system.”
This informative webinar will provide:
An overview and journey of the CSA STAR Programs
A definition of the CCM framework
An overview of the Certification and Attestation purpose and scope
The process and preparations
A discussion of the common challenges and benefits
For more information and to register for the webinar, click here . The event will also be recorded and available for on-demand viewing,. Click for more information.
ABOUT THE SPEAKERS Debbie Zaller leads Schellman’s CSA STAR Attestation and SOC 2 services practice where she is responsible for internal training, methodology creation, and quality reporting. Debbie has performed over 150 SOC 2 assessments and Debbie also holds a Certificate of Cloud Security Knowledge (CCSK).
Ryan Mackie leads Schellman’s CSA STAR Certification and ISO 27001 certification services practice where he is an integral part of the methodology creation and the planning and execution of assessments. Ryan has performed over 100 ISO 27001 assessments and is a certified ISO 27001 Lead Auditor trainer.
The outdated Electronic Communications Privacy Act (ECPA) may finally get a much-needed upgrade, but the reform can’t come soon enough for Microsoft, other cloud providers and privacy advocates. Here’s what you need to know:
The issues:
The ECPA was enacted in 1986, as electronic communication started to become more prevalent. The intent was to extend federal restrictions on government wiretaps from telephones to computer communications. But as we created other electronic communication devices and moved content to the cloud, the Act became outdated. The primary gripes are that it:
Allows government agencies to request emails more than 180 days old with just an administrative subpoena, which the agency itself can issue, vs. having to get a warrant from a judge.
Doesn’t require notifying affected customers when their data is being requested, giving them a chance to challenge the data demand. In fact, the Act includes a non-disclosure provision that can specifically prohibit providers from notifying customers.
The lobbying and lawsuits:
Plenty of wide-ranging groups have been advocating for ECPA reform, including the American Civil Liberties Union, the Center for Democracy & Technology, the Electronic Frontier Foundation, the Digital Due Process Coalition, the Direct Marketing Association and even the White House, in its 2014 Big Data Report.
On April 14, Microsoft added a little more weight to its argument. The company filed a lawsuit against the U.S. Justice Department, suing for the right to tell its customers when a federal agency is looking at their email. The lawsuit points out that the government’s non-disclosure secrecy requests have become the rule vs. the exception. In 18 months, Microsoft was required to maintain secrecy in 2,576 legal demands for customer data. Even more surprising, the company said, was that 68 percent of those requests had no fixed end date—meaning the company is effectively prohibited forever from telling its customers that the government has obtained their data.
The reform:
Two weeks after Microsoft filed its suit, the U.S. House voted 419-0 in favor of the Email Privacy Act, which would update the ECPA in these key ways:
Require government representatives to get a warrant to access messages older than 180 days from email and cloud providers.
Allows providers to notify affected customers when their data is being requested, unless the court grants a gag order.
The last step in the process is for the Senate to turn to the reform bill into law. While no timeline has been given, the Senate is getting a lot of pressure to act quickly.
Today in Amsterdam, Palo Alto Networks joined more than two dozen other companies and organizations in signing a “Coordinated Vulnerability Disclosure Manifesto.” The Manifesto is a declaration signaling that cooperation between organizations and the cybersecurity community can be helpful in finding and fixing ICT vulnerabilities. In coordinated vulnerability disclosure, vulnerabilities are reported to the owner of the information system, affording the organization the opportunity to diagnose and remedy the vulnerability before detailed information is disclosed to third parties or the public. This helps to minimize opportunities for cyber criminals to exploit these vulnerabilities.
Palo Alto Networks is joining this Manifesto because we think it is the right approach on two levels. First, we believe this type of coordination is simply good for cybersecurity. As the complexity of, and dependency on, ICT products and services is increasing, and cyber criminals continue to become more sophisticated, vulnerabilities are also increasing. Cooperation between those who might find a vulnerability and those who can fix it is invaluable—and all societies reap the benefits of a more secure digital infrastructure.
Second, on a broader level, this Manifesto concretely demonstrates proactive industry leadership to improve cybersecurity. As cyber challenges become more complex, effective responses require both industry and government actions. As industry, we can and should spearhead initiatives to improve the ecosystem both individually, as companies, and together—that is simply good corporate citizenship. This cooperative approach is part of the DNA of Palo Alto Networks and why we co-founded the Cyber Threat Alliance, a group of cybersecurity practitioners from organizations that have chosen to work together in good faith to share threat information for the purpose of improving defenses against advanced cyber adversaries across member organizations and their customers.
The Manifesto was released as part of a high-level meeting on cybersecurity, hosted by the Dutch Ministry of Security and Justice, May 12–13, titled “Enabling Partnerships for a Digitally Secure Future for the EU.” The meeting brings together more than 200 senior European Union (EU) and other government officials responsible for cybersecurity, CEOs and board members of security and ICT-related organizations and critical infrastructure, and international organizations. I am pleased to personally be part of the two-day conversation. As its title suggests, the meeting aims to push attendees not only to acknowledge the challenges of cybersecurity but also to look ahead, better understand the developments and difficulties we face, and act accordingly.
The time is right for this push. The EU is announcing and executing on a range of initiatives and proposals regarding cybersecurity and other digital issues. Implemented well, these initiatives have tremendous potential to drive the digitization of Europe’s economy, help European companies become more globally competitive, and contribute to better cybersecurity and resilience both in the EU and globally. These include the Network and Information Security (NIS) Directive, which is expected to go into effect shortly and will be implemented over the subsequent 21 months, and the Digital Single Market’s “Public Private Partnership on Cybersecurity,” which aims to boost the European cybersecurity industry. Strong cybersecurity is the fabric needed to help make successful all of the proposals in the EU’s Digitizing European Industry Package that was just released April 19, including enabling the Internet of Things (IoT) in Europe; building a world-class public cloud and data infrastructure for research, science, and engineering; and increasing cross-Member State e-government services.
The Manifesto and the May 12–13 high-level meeting continue the Netherlands’ leadership in cybersecurity matters, which Palo Alto Networks profiled in our April 2016 blog. We commend Rabobank and CIO Platform Nederland for initiating this Manifesto, for so many organizations signing it, and for the Dutch National Cyber Security Center (NCSC) for strongly encouraging it. Both the meeting and the Manifesto are a testament to Dutch leadership; however, they have impacts far beyond the Netherlands. Their message stressing public-private partnerships as the path to more effective cybersecurity is also certainly applicable worldwide. On July 1, Slovakia assumes the EU presidency. Palo Alto Networks looks forward to supporting their forthcoming efforts, and the efforts of all EU policymakers, to improve cybersecurity throughout the EU for the benefit of the global digital infrastructure.
With ransomware on the rise, executives have many questions on their minds. What do I need to know about ransomware? To what extent is ransomware covered by cyber insurance? And most importantly, what can be done to prevent these attacks from happening in the first place?
At Ignite Conference 2016, Gus Coldebella of Fish & Richardson, Erin Nealy Cox of Stroz Friedberg and Sean Duca of Palo Alto Networks provided a C-level view of the latest attack vectors. Watch what this panel of experts had to say about the rise of ransomware in this short video now on Security Roundtable:
Unfortunately, this seemingly positive trend does not reflect the actual threat landscape in the healthcare industry. Healthcare organizations subject to HIPAA only need to report breaches to HHS if 500 or more patient records are exposed. Many types of cyberattacks on hospitals, like ransomware, impact systems and possibly patient care, but do not result in breached records and hence are not reported to HHS (although there are currently opposing views on whether a ransomware attack should be reportable under HIPAA).
Ransomware is a type of malware that restricts access to files or systems with encryption until the victim (the hospital) pays the ransom for the key to unlock them. In a previous post I outlinedhow hospitals can track down the infected PC when an infected PC somewhere on the network encrypts the contents of an entire department shared drive.
As a former security operations lead for a hospital network, I responded to numerous ransomware infections firsthand as a result of targeted phishing campaigns against the hospital. The incident response team followed the same procedure for each incident: isolate the infected PC and restore the corrupted (encrypted) files on the department shared drive from backup. In such isolated instances, there was no impact to clinical operations and patient care. However, the story would have been different in the case of widespread infection on the network.
Several healthcare providers in Washington, California and Kentucky were publically impacted in 2016 by what appears to be widespread ransomware infection across many different devices in a short amount of time.
Prevent and Minimize the Impact of Ransomware
There are many things that your healthcare organization should be doing to minimize the impact of successful ransomware attacks. Here are a few tips to get you started:
Effectiveness
Mitigation Type
Activity
High
Minimize Impact
Develop and execute a plan for an end user awareness program
Yes, I know it’s difficult to get approval to send regular hospital-wide security advisories, but smarter end users will surely result in fewer ransomware incidents.
High
Minimize Impact
Review / Validate Server Backup Processes
Some organizations don’t realize their backups are compromised or were configured improperly until it’s too late. You may need them to restore service.
Start with your File Servers that host network shares for critical hospital departments
Ensure you have backups that are not accessible by end users – ideally off-site. Backup administrator roles should be assigned sparingly, used sparingly and regularly audited.
Test your backups regularly to validate they can be restored properly.
Medium
Minimize Impact
Review network drive permissions to minimize the impact that a single user can haveEnd User Privilege Reviews
Assign a project manager to organize an effort to evaluate permissions that users have on mapped network drives. Implement the principle of least privilege to minimize the impact that any single user can have on the organization’s network shared drives.
This process could turn into a large, complex effort, so start with network drive locations used by critical departments (Emergency, Organ Transplant etc).
Administrator User Privilege Reviews
Audit privileged roles used by the Server, Backup & Network Teams to validate appropriate access.
Ensure administrators are assigned normal restricted accounts, separate from their highly privileged accounts.
Require administrators to only use their highly privileged accounts when they need them.
Remove automatic network drive mappings from administrative accounts, where possible.
Restrict administrative accounts from receiving email.
High
Prevention
Disable macro scripts from MS Office files using AD Group Policy
Office macros are usually not required for the majority of PCs used in healthcare environments. Enable macros for exceptions or certain departments only.
High
Prevention
Review your monthly patch management processes
Many hospitals struggle to patch their systems within 30 days of Microsoft’s “Patch Tuesday” monthly patch release.
Review your patching processes and look for opportunities to remove roadblocks.
Consider deploying an advanced endpoint product that prevents exploits due to missing patches and malware.
Medium
Prevention
Evaluate your inbound spam / malware protection
Ensure you are configured to block inbound mail as per recommendations from your email server vendor (i.e. block executables in attachments etc)
High
Prevention
Deploy a next-generation firewall to protect the hospital network
Ensure your firewall automatically blocks known threats based on a threat feed that constantly updates.
Ensure your firewall provides sandboxing capabilities so you can stop unknown threats (URLs and executables) before they reach the endpoint. Sandboxing is the best way to detect new variants of ransomware that constantly appearing in the wild.
Configure your firewall/proxy to require user interaction for hospital end users communicating with websites uncategorized by the network proxy or firewall (i.e. click a “proceed” button). Many uncategorized websites are used in targeted phishing campaigns to distribute malware.
High
Prevention
Deploy advanced endpoint protection to protect the endpoint
Traditional antivirus is not effective anymore against advanced malware like ransomware which continuously changes to avoid detection. Your endpoints need advanced protection capable of stopping processes that exhibit malicious behavior, rather than checking for individual known bad files.
Whitelisting can work for some organizations but most hospitals need to permit hundreds of applications across their departments so it is often difficult for IT to manage the list.Behavior-based malware detection tends to be very effective, and also lightweight on the endpoint.
These suggestions range from low-tech to high-tech and vary in cost, but all contribute to create a hospital environment that is highly resistant to ransomware with the least amount of manual management. Decide for yourself which combination of mitigating activities is best for your environment.
If you want to read more about the history of ransomware – take a look at The Rise of Ransomware, a recent paper from our threat intelligence team, Unit 42.
