Blog

Posted on

The Cybersecurity Canon: Dragnet Nation

We modeled the Cybersecurity Canon after the Baseball or Rock & Roll Hall-of-Fame, except for cybersecurity books. We have more than 25 books on the initial candidate list, but we are soliciting help from the cybersecurity community to increase the number to be much more than that. Please write a review and nominate your favorite. 

The Cybersecurity Canon is a real thing for our community. We have designed it so that you can directly participate in the process. Please do so!

Book Review by Cybersecurity Canon Committee Member, Hannah Kuchler: Dragnet Nation (2014) by Julia Angwin

Executive Summary

Two tectonic shifts that helped create the data-rich Dragnet Nation where we live today both date back to 2001, argues Julia Angwin in her powerful treatise on privacy.

The U.S. government began its mass data collection efforts in earnest after the terrorist attacks of September 11, 2001, when traditional surveillance methods failed. Meanwhile, technology companies, reeling from the dotcom crash, turned to data as their hope for more sustainable revenue and profits.

In Dragnet Nation, the author, an award-winning investigative journalist, tackles both government and corporate mass surveillance, stressing that they are “deeply intertwined”. “Government data are the lifeblood of commercial data brokers. And government dragnets rely on obtaining information from the private sector,” she writes.

Review

Fifteen years on, we now live in a world where billions of dollars are made off the back of data collected from sites and apps where we read, chat and shop online, and hundreds of thousands of jobs depend on it. What would once have horrified – a newspaper filled with gay interest ads delivered only to a homosexual reader – is now expected on sites such as Google and Facebook.

Angwin excels at putting this new race for data dominance in historical context. She shows how even the most benign data collection tools, such as the census, were used for ill during both world wars, tracing draft violators and tracking down Japanese Americans.

She travels to Berlin to examine the records of the world’s most pervasive secret police, who had 1 in 4 East Germans working as informants for them. While there, she shows an administrator in the Stasi archives how easy it is to build a picture of an individual’s social connections using sites such as LinkedIn – far easier than it was for the Stasi.

The bulk of the book is a tale of Angwin’s journey to reduce her online footprints, to escape the dragnet by minimising tracking of her location, her contacts, and her shopping habits. She meets characters and companies trying to create technologies that could help her and others evade the data trawl of corporations and the government.

For a reader with little knowledge of the privacy tools she describes, the book could almost function as a how-to guide. In particular, the chapter where she finally manages to peak her children’s interest in privacy would be engaging for many parents struggling to make keeping safe online as fun as sharing everything with friends on social networks.

But this is a guide accompanied with heavy doses of disappointment as Angwin finds even experts struggle to create effective technologies and make them usable.

This is a New York Times bestseller aimed at making privacy accessible, not providing in-depth knowledge for cybersecurity professionals. Angwin’s descriptions of her debates about using PGP and other encryption types may not be particularly relevant within the industry.

However, for those wishing to better understand the behaviour of people who profess to care deeply about privacy but struggle to act, Angwin is bracingly honest. She explains how frustration led her to bad passwords, her struggle to balance disconnecting with having to be available for work and childcare emergencies, and how she felt she lost more than she gained when she took herself off major social networks, even having to cancel a birthday party when few bothered to decrypt her invite.

Dragnet Nation is also worth reading for its conclusion. After a year investigating how to keep away from ever-watching eyes as an individual, Angwin concludes that collective action is necessary to rewrite the rules of the digital data game.

She believes that mass efforts to evade surveillance could spark a conversation and a campaign akin to the protests that helped lead to a reduction in pollution in the U.S. Comparing better rights to privacy to improved air and water quality, she tries to give hope that using the Internet will not always have to mean giving up the right to a private life.

Angwin points to the idea of “sousveillance”, or surveilling the surveillors, as one nascent movement that has changed the balance of power in some situations, for example, with more police violence caught on video by cell phones.

Conclusion

Dragnet Nation is a fair and even-handed look at the problems of living in a state and a market where data has become the primary currency. Angwin does not even completely dismiss the idea that mass surveillance can sometimes be necessary; instead she encourages readers to question each “dragnet” they encounter, asking questions such as, “Can it withstand public scrutiny?” and “Are the operators held accountable for the way it is used?”

I would recommend Dragnet Nation for the Canon as an early stop on the journey for any cybersecurity professional to understand the challenges posed by mass data collection.

[Palo Alto Networks Blog]

Posted on

Security Breach Management: Handling The Storm With Aplomb

2015 was marked by far too many digital security breaches, a trend that every company hopes to see reversed in the coming year. Unfortunately, as industry expert Leo Scanlon notes, it is unlikely that we’ll be able to stop them all. In this digital era, security breaches are part of the new normal.

So, what should you do when facing a security breach? The most important thing that you can do is stay calm. If you keep your wits about you, you will be better able to approach the problem and implement a solution to protect your clients and your company. Here is how to move forward in the face of a digital security breach.

Plan Ahead
While you may not be able to plan for the exact details of a security breach – if you could, then you could prevent it from happening – what you can do is prepare a preliminary plan of action for any future breach. Write out a general timeline for what actions need to take place and in what order. This way, when something does happen, you do not lose any time giving direction. All you need to do is to fill in the specifics of the event.

Communicate Clearly and Calmly
When a breach does occur, it is important to prioritize communication with your team and with your clients. Start with your team. Describe the event, review the plan of action, and make sure that everyone is clear on his or her role.

It can be worth it to sit everyone down to discuss the breach rather than send emails about the issue. This allows people to ask questions in real time rather than sending lots of follow-up messages. You might even consider serving everyone a cup of tea. Green tea reduces stress and can calm down anxious team members in a visceral way, moving them from high anxiety to centered focus.

After you have alerted your team, everyone can split off to appropriate tasks ranging from developing a patch to prevent system attacks to calling high profile clients. You will also need to contact a range of other people, including a lawyer and police.

Additionally, make sure your public relations department is ready to issue a statement and field phone calls. Give them a quick FAQ sheet and a directory of who to call about which issues. By preparing public relations as well as you can, you avoid clogging up other employees’ lines with client issues.

Talk and Train
While a security breach tests training effectiveness on the ground, this is also a good opportunity to schedule follow-up training. Then, while working to resolve this breach, note the areas in which employees struggle. These should be central to your next training session.

You should also contact some of your industry peers to find out what they do to prevent security breaches. This does not mean that you need to mimic their strategies, but if you know that someone is using a different approach, you should document clearly why you are doing something else. That way, if you do suffer a breach, you have demonstrated a well-thought-out strategy rather than an arbitrarily chosen system.

Big Fixes, Small Details
Ultimately, when you suffer a data breach, it is important to focus your attention on two issues: the big problems that need to be remedied immediately and the small problems that contributed to the breach but were overlooked during earlier development phases. Start big, and then shift to the small to protect yourself now and down the road.

For the sake of companies and clients alike, hopefully 2016 holds fewer security breaches. But, to make this dream a reality, every company will need to assess regularly its security systems and breach preparation. Failure to plan is planning to fail, so put that plan in place now.

Larry Alton
Writer
[ISACA Now Blog]
Posted on

The Cybersecurity Canon: Cyberdeterrence and Cyberwar

We modeled the Cybersecurity Canon after the Baseball or Rock & Roll Hall-of-Fame, except for cybersecurity books. We have more than 25 books on the initial candidate list, but we are soliciting help from the cybersecurity community to increase the number to be much more than that. Please write a review and nominate your favorite. 

The Cybersecurity Canon is a real thing for our community. We have designed it so that you can directly participate in the process. Please do so!

Book Review by Canon Committee Member, Brian Kelly: Cyberdeterrence and Cyberwar (2009) by Martin C. Libicki

Executive Summary

My interest in the Cybersecurity Canon project and appreciation for a common body of knowledge shared amongst professionals can be traced back to my time as an Officer in the Air National Guard.

Each year the Air Force Chief of Staff would issue a “reading list”; in 2010 Cyberdeterrence and Cyberwar by Martin C. Libicki was on the list under Mission, Doctrine and Profession. Back in 2008 Lt. Gen. Robert Elder, Jr., then Commander of Eight Air Force (8AF/CC), sponsored the study “Defining and Implementing Cyber Command and Cyber Warfare.” This book represents the results of that study. The reading list and, more specifically, this book were meant to inform senior Air Force leaders and decision-makers. The basic message of Cyberdeterrence and Cyberwar is: Cyberspace is its own medium with its own rules; thus, deterrence and warfighting tenets established in other media do not necessarily translate reliably into cyberspace.

Review

On June 23, 2009, the Secretary of Defense directed the Commander of U.S. Strategic Command to establish a sub-unified command. The United States Cyber Command (USCYBERCOM), as we know it today, is located at Fort Meade, Maryland. The establishment of U.S. Cyber Command marked the ascent of cyberspace as a military domain. This book focuses on policy dimensions of cyberspace and cyberwar: what it means, what it entails, and what threats can defend or deter it.

Libicki’s background is non-cyber national security history and policy, and that knowledge and background will benefit readers unfamiliar with Cold War era concepts as they relate to cyber.

Cyberdeterrence and Cyberwar is divided into nine chapters. Chapter One covers the introduction and purpose of the book, which clearly is to focus on military policy as it relates to cyberwar. Chapter Two introduces readers to a conceptual framework for cyberdeterrence and cyberwar. It explains external and internal threats and defines cyberattack and cyberdeterrence. Cyberattack is the deliberate disruption or corruption by one state of a system of interest to another, and cyberdeterrence is the capability in cyberspace to do unto others as they would do unto us. Chapter Three asks, “why is cyberdeterrence different?” and focuses on analogies to game theory and nuclear deterrence. Foundationally knowing “who did it” is critical; today we think of it terms of attribution. All decisions, policy or operational, are based on attribution. Chapter Four considers cyberattack and the purpose of the attack. Potential purposes range from “oops” to rogue operators and the implications of each. Chapter Five offers a primer for a strategy of response. This chapter has relevance today as the idea of “hacking back” or “active defense” has become a popular concept in the strategy of response. Chapters Six and Seven outline “strategic” and “operational” cyberwar and offer conclusions on both. Chapter Eight is dedicated to cyberdefense and concludes that deterrence in cyber terms may be too problematic to offer much surcease from cyberattacks. It outlines the goal of cyberdefense to include architecture, strategy and policy. Chapter Nine is simply titled “Tricky Terrain” and offers the defend, disarm or deter triangle as an illustration of approaching a threat that cannot be denied. We know now that cyberattacks are a threat that cannot be denied.

Conclusion

Much has changed since this monograph was published back in 2009; and, while some cybersecurity experts may not agree with Libicki’s conclusions, we can’t argue the significance this work has as a historical text in the cybersecurity professional’s education. I would recommend Cyberdeterrence and Cyberwar for the Cybersecurity Canon. Reading this book in 2016 allows the reader to both compare and contrast Libicki’s conclusions against the backdrop of cyber events that have occurred over the last decade.

[Palo Alto Networks Blog]

Posted on

The Best of Both Worlds: Building a Secure Hybrid Data Center with AWS

If you’re looking for a new car, you may be considering a hybrid – one that combines electric power for efficiency and mileage with traditional internal combustion to recharge the engine and extend the travel range. For many buyers, it is the best of both worlds, providing greater flexibility to extend your trip as needed. The same concept applies to a hybrid data center – one that combines your own, dedicated on-premises resources with the scalability and agility of on-demand compute, networking and storage resources such as those from Amazon Web Services (AWS).

As the insatiable appetite for compute and storage resources to support the business continues unabated, customers are using the public cloud as a way to augment their data centers more quickly and more efficiently than in the past. Initially, a hybrid approach was viewed as a step toward migrating all applications and data to the public cloud. In reality, many customers are settling on a hybrid approach as their new data center architecture.

In a recent conversation I had with a customer, two new physical data centers had just come online, and they were already over-subscribed. They were looking to AWS as a way to extend the life of their data center using a hybrid approach. When you think about it, a hybrid approach makes the most sense. First off, it allows you to start small and establish some guidelines around which applications and data should reside in the cloud. There will be legacy applications that cannot or should not be migrated. There will be data that, after careful internal analysis, does not belong in the public cloud. For new applications, you might look at adopting a simple cloud-first mentality that says: for new applications, look to the cloud as the deployment location. A more advanced cloud-first approach entails changing your application development methodology to one that is componentized, makes heavy use of APIs, can be updated rapidly, and can be deployed globally – in the cloud first.

From a security architecture perspective, a hybrid data center is an extension of your data center and therefore should be treated no differently than your physical data. This means that you should:

  • Know exactly which applications are running in the cloud and whitelist them to ensure they are the only ones allowed in the cloud
  • Segment the applications to control which can talk to which and limit lateral movement
  • Enable applications based on the user credentials and the business need
  • Apply threat prevention to block threats from accessing your cloud applications and data while also blocking them from moving laterally

When deployed in AWS, the Palo Alto Networks VM-Series can securely enable your hybrid data center, acting as an IPSec VPN termination point and as a virtualized next-generation firewall, protecting your AWS deployment with application control and advanced threat prevention. More advanced use cases include segmentation for added security and compliance purposes through VPC to VPC and subnet to subnet policies. In effect, you can mimic your physical data center security in AWS.

To learn more about how a hybrid data center with AWS might benefit your organization, check out these resources:

 
[Palo Alto Networks Blog]
Posted on

The Growing Role of Cyber Insurance

The cynical would suggest that cyber insurance is growing as some look for a cheaper route to manage risk. However many see the cyber insurance industry as potentially the new enforcer of good security practices.

Over the last decade, we have seen regulation being applied, be it by nations or industry groups, and most have faced the same challenge; that is, regulation moves at a snail’s pace compared to the rocket ship that is the evolution in IT and cybersecurity. There is a clash between dynamic, evolving cybersecurity in which the bar of what is state-of-the-art continuously evolves, be it from new IT technology use cases, changing threats, or new practices to mitigate these risks.

The impending EU regulations, the Network Information Security Directive and the Data Protection Regulation Reform, both leverage the term and concept of state-of-the-art, suggesting that, in the latter, business should have regard for this cybersecurity capability relevant to the risk and, in the former, businesses should have at least state-of-the-art security technology.

Could the cyber insurance industry, in effect, become the dynamic new regulator of this in the future as cyber insurance adoption grows? Businesses will be eager to prove they are applying such state-of-the-art practices to reduce their premiums, and insurers will be looking to validate if a business can be insured and just what level of premium they should be offered based on the business’ capabilities.

As the cyber insurance market grows, it will surely become more competitive, and so, such analysis would seem key to being able to offer better premiums where the risk posture allows. An example of this is IASME (a UK consortium for small- to mid-sized businesses) tying cyber liability insurance coverage for small businesses to the UK Cyber Essentials program certification that aims to assure a basic level of cybersecurity. They are 1 of 4 accreditation bodies for Cyber Essentials certification in the UK.

The question all this raises is whether those in the insurance industry will have to become cybersecurity experts, and the likely reality is not, as there is already a skills’ shortage in the cyber market. What seems more likely is partnerships will be formed with the security industry so they can gather better intelligence on both the current threat landscape and capabilities, looking to validate their real-world effectiveness and identify best practices.

Much as home insurance is linked to where you live, cyber insurance will be linked to the industry you are in, and where you do business, to better identify the likelihood and scope of claims. Today some cybersecurity vendors, including Palo Alto Networks, already track such data and, with the Cyber Threat Alliance, can track and advise on advance threats.

As cyber insurance evolves, it will require a tripartite relationship amongst knowledge of the risk, relevant state-of-the-art capabilities to prevent the impact, and the skills to validate the ongoing application. It will be interesting to see if, in the longer term, insurers will build out their own list of approved requirements and capabilities. However, unlike most insurance services, which have been built from decades of knowledge to generate the actuarial data that balances premiums against claims, cyber insurance is still relatively nascent. I would challenge there are probably very few insurance markets that are as dynamic as cybersecurity. Only time will tell if the potential benefits for all, with insurers growing involvement in the cybersecurity space, come to fruition.

[Palo Alto Networks Blog]

English
English
Exit mobile version