Blog

Posted on

2016 Prediction #11: Looking Ahead to Cybersecurity in 2016

This is the eleventh in our series of cybersecurity predictions for 2016. Stay tuned for more through the end of the year.

Cybersecurity has become a mission-critical function for businesses over the years, and the need for comprehensive defences against cyberattacks will only increase as we move forward. Given some of the events over the last year, I’m sharing what I anticipate will develop over the next year in the cybersecurity space.

1. Security strategy shifts in the EU

As cyberthreats increasingly impact society and economies, government regulation is evolving to reflect the risk and drive confidence in digital space. Initiatives like the Network Information Security Directive and General Data Protection Regulation Reform will have significant influence on cybersecurity policies in 2016. In the wake of these regulations, businesses will have to grapple with new requirements to align with these mandates.

2. Cybercriminals focus in on mobile payments

The payments landscape is in the midst of a huge shift with the advent of Apple Pay, Google Wallet and other eWallet services, and there’s no doubt that cybercriminals will follow the money. As a result, 2016 will see an increased focus from businesses and mobile providers on preventing cyberattacks on mobile devices.

3. Security of European supply chains is scrutinized

It is commonly said about supply chains that we are only as strong as the weakest link. This proves true with cybersecurity across supply chains worldwide, as we’ve observed in a number of high-profile breaches over the last year. In Europe, supply chains often cross borders, and companies grapple with different levels of cybersecurity awareness or regulation, resulting in complex networks of potential entry points for cyberthreats. Over the next year, we can expect to see increased scrutiny of cybersecurity policies across all parts of the supply chain and the bolstering of weak points as they are identified.

4. CSO evolution

Historically the CSO reported in to the CIO, but we have seen this shift as cybersecurity becomes a bigger issue for businesses. Our recent report, “Governance of Cybersecurity 2015,”highlights that Europe is the only region to show a sizable shift from CISO/CSOs reporting to the CIO, moving from 50 percent in 2012 down to 33 percent in 2015.  We will see the role of the CSO continue to evolve over the next 12 months.

5. Reduction of traditional business networks

As 2015 comes to a close, we’re seeing over a zettabyte of data crossing global networks and three times as many IP-enabled devices as people. As data grows, businesses are opting to outsource, cloudsource and consumerise their IT systems rather than invest in big, complex systems themselves. This adoption of SaaS technology, along with the rise of BYOD, the IoT and wearables, is shifting how businesses are thinking about shadow IT. Over the next 12 months, we expect to see shadow IT become a business priority.

6. Blurring boundaries of attacks

APT and nation-state attacks have been a key focus over the past few years; however, more common attacks are incorporating advanced concepts, such as multiple components to avoid detection, taken from the APT attack lifecycle, and focusing in on more implicit targets. As nation-states look to cybercriminals for knowledge sharing and new tactics, and as these boundaries blur, we need to use solutions that work cohesively to prevent blended approaches.

No one truly knows what the future holds, but we have a pretty good idea of what we should anticipate in the cybersecurity world moving forward. The key for businesses is to identify their weak spots and ensure they have the right stronghold of policies and technology in place to prevent breaches and keep businesses up and running. And when we know what to look out for, we can bolster our businesses against the threats of tomorrow.

Want to explore more of our top 2016 cybersecurity predictions? Register now for Ignite 2016.

 

[Palo Alto Networks Blog]

Posted on

The Cybersecurity Canon: Lights Out: A Cyberattack, A Nation Unprepared, Surviving the Aftermath

We modeled the Cybersecurity Canon after the Baseball or Rock & Roll Hall-of-Fame, except for cybersecurity books. We have more than 25 books on the initial candidate list, but we are soliciting help from the cybersecurity community to increase the number to be much more than that. Please write a review and nominate your favorite. 

The Cybersecurity Canon is a real thing for our community. We have designed it so that you can directly participate in the process. Please do so!

Book Review by Canon Committee Member, Ben Rothke: Lights Out: A Cyberattack, A Nation Unprepared, Surviving the Aftermath (2015) by Ted Koppel

Executive Summary

One of the most successful television commercials in history was for the financial firm E. F. Hutton, based around the catchphrase, “When E. F. Hutton talks, people listen.”

In the world of broadcast journalism, when Ted Koppel speaks, people listen. And when he writes, people read. And read indeed, as his new book Lights Out: A Cyberattack, A Nation Unprepared, Surviving the Aftermath is in the Amazon top 200.

Yet, with his over 50 years of journalistic experience, this book shows that, just because you are a world-renowned reporter, that doesn’t mean you always get the story right.

Review

In the superb, Canon-worthy book Threat Modeling: Designing for Security, author Adam Shostack shows how to use threat modeling to enhance software security. By applying threat modeling, information security can be enhanced. Shostack’s book offers a structured, methodical framework, and a model for determining a threat and its entire lifecycle, such that each of the key elements are identified and adequately assessed.

The problem with Koppel’s book is that his approach to the topic is anything but structured and methodical. He sets up a straw man question, never fully identifies the threats facing the power grid, and never gives specific weights to those threats, such that the reader is left with Chicken Little meets the power grid. The book’s premise is that a major and devastating cyberattack on America’s power grid is imminent. While it’s a disturbing hypothesis, never once does Koppel detail how such an attack would actually take place.

Throughout the book, Koppel sets up his straw man and uses terms such as imagine, may, could and similar, tenuous phrases. While these doomsday and worst-case scenarios are indeed terrifying, never does the book detail the specific how. Much of the book contains details of Koppel’s travels and narratives of the people he meets. From preppers in Montana, to leaders of the Mormon Church, whose doctrines include planning for cataclysmic events, and more. This is a detail of Ted’s great adventure.

One of the more disturbing interviews is with Jeh Johnson, Secretary of the Department of Homeland Security. Johnson comes across somewhat clueless of the energy sector cyberthreat, about which Koppel noted that, while Johnson’s answer to Koppel’s question lasted 13 minutes, he never addressed the question, and it was an area in which Johnson conceded that he had little expertise.

Koppel admits that he is not proficient in the complicated energy sector. To help him navigate through the arcane world of grid reliance standards and the evolving relationship between power industry groups and federal regulators, Koppel engaged the services of Dr. Ryan Ellis of the Cyber Security Project at Harvard University. Koppel notes that he sent transcripts of key interviews and rough drafts of relevant chapters to Dr. Ellis for his review and comments. Incredulously and disconcertingly, Koppel states that he didn’t always follow the advice of Dr. Ellis.

What Koppel did is speak to a lot of very senior people and put what he gleaned into writing. What’s conspicuously missing is his speaking to any cybersecurity expert with experience in SCADA, malware or related areas. In an interview for CSO Online, Koppel was asked if he interviewed penetration testers who have experience in the electric generation and transmission sector. Incredulously, he said “no.” I don’t think Koppel understands the significance of that exclusion, and therein is the fundamental problem with this book.

There are indeed threats to the power grid. But, if you want to know about those – the real threats and how they can be dealt with – this is not your book.

[Palo Alto Networks Blog]

Posted on

Examining E-Commerce, Governance and Applied Certifications

ISACA hosted a free live webinar on how certifications and education get applied to real world e-commerce and governance cybersecurity issues titled “Cybersecurity: e-Commerce, Governance and Applied Certifications” on Tuesday,15 December 2015. We recently spoke with presenters Michelle Mikka-Van Der Stuyf, president and CEO of BizStrat Technology Corporation, Sally Smoczynski, CISSP, managing partner of Radian Compliance, and Diana Salazar, CISM, CISA,CRISC,CGEIT, executive security advisor (ESA) of Magellan Group, about cybersecurity: e-commerce, governance and applied certifications. Read the interview below.

Q: These are some big topics. How are they impacting organizations today, and what do companies need to know?

Michelle Mikka-Van Der Stuyf (MMV):  We shared real-experience information on how we practically apply cybersecurity solutions in business and government. To help attendees focus, we started off with some shocking cybersecurity stats. We also provided insight into just how encompassing cybersecurity is, how you can get a more strategic view of your greatest risks, and where companies should apply their security resources.

Sally Smoczynski (SS):  I reviewed the root causes of cybersecurity incidents—why did they happen and what could have been done to prevent or mitigate the impact? I’ll explore why information security governance outside of IT is essential for strong policy and procedures management. I also discussed making sense of regulatory frameworks. Which ones do you use, and how can they be better managed? Finally I discussed the value of a management system.

Diana Salazar (DS):  Regulations may fall behind as people continue toward bring your own devices (BYOD) and bring your own cloud (BYOC); therefore, organizations need to use a continuous assessment process of controls and a framework for information sharing, data movement and greater interoperability among legal and privacy bodies. They should review technology challenges (application, profiling, digital education and web tracking), remove data for right to be forgotten requirements, and increase transparency on the data organizations are collecting and required controls using comprehensive frameworks.

Q: How do you apply those points to your organization?

MMV:  Cybersecurity is as much about practice as it is solutions. Our business/technology solutions always integrate risk and risk mitigation to deliver a sound, safe and secure result. Often companies want to push security to the side to save time or cost, but we believe security is a must-have and won’t break those standards to deliver a solution that is not in the best interest of our client or their industry.

Education and certifications are keys to maintaining cybersecurity. Cybersecurity information is constantly changing, so it’s critical to stay current with industry news by following breach intelligence, attending conferences and other industry events, and collaborating with CISOs and other security professionals. We apply certifications and education in every solution. By being educated on risks and solutions, including practices that give you a leg up against the inevitable breech, you’ll be serving your customers’ cybersecurity needs well.

SS:  You have to practice what you preach. In Radian’s case we’re applying a strong security awareness program and practicing good data protection habits. We are an implementer of ISO 27001 so we focus on best practices and relevant risk mitigation to support our clients’ programs. We perform internal audits to many ISO standards and identify areas of improvements to reduce the threat of cybersecurity incidents and information security incidents.

Internally, we strengthened our security posture based on what we learn in the field. Organizations need to take a holistic governance structure to protect their information assets. Tools can help detect incoming threats, but people are the biggest threat, including their social media habits.

Information security governance outside of IT is essential for strong management of policy and procedures. Governance needs to include HR, physical security, training, marketing, legal and other departments. IT plays a very important role, but not the core.

DS:  Using a continuous assessment process organizations enable defensibility and resilience. Generally review controls fit into three categories: protective/preventative which enforces acceptable behaviors, detective/audit controls which perform a monitoring activity, and reactive controls which respond to a detective control providing an alert or corrects an unacceptable situation. When there is a breach one of these simple categories, preventative, detective or reactive control is missing. Applying these categories with a framework enables an organization to reduce an adversary’s ability to do harm. Frameworks provide the ability to determine which controls apply to the organization.

[ISACA Now Blog]

Posted on

Palo Alto Networks Honors Our Wounded Warriors at Army-Navy Football Game

The Wounded Warrior Project’s purpose is to “raise awareness and enlist the public’s aid for the needs of injured service members” in our country. This past weekend, the nation watched the 116th edition of the massive football rivalry between the Cadets of the United States Military Academy and the Midshipmen of the United States Naval Academy. To celebrate that, and to support the Wounded Warrior Project, Palo Alto Networks hosted several injured veterans, and their families, in a luxury suite at the game.

Our Federal Chief Security Officer, U.S. Army Major General John Davis (Retired), and I had the opportunity to thank the brave men and women before the game; and host these Wounded Warriors, their families, and, yes, one good-looking support dog in the suite for the day. We were honored, but humbled, to have the chance to support the Wounded Warrior Project’s critical mission and ongoing work.

These injured veterans and their families have borne the burden of our past wars. They have stood up to fight for the things they believe. Army Chaplain Matthew Pawlikowski, in his opening prayer before the game, said it best:

“Gathered on this gridiron, we are grateful for such rough and rugged souls as these cadets and midshipmen, strong in spirit and in sinew. We are especially mindful of our first-class cadets and midshipmen, bristling on the brink of becoming soldiers, sailors, marines, ready today to happily visit violence on each other, and if need be, some day, sometime soon, on the enemies of the world, so that our citizens, our ally citizens, indeed the same citizens of all countries, can sleep safe and sound in peace.

For those of us who have fought, who can fight, who will fight, our country’s wars pray for peace more than those who have never served can ever know, for we willingly face the horrors from which others are thankfully spared.

But if peace on earth be not granted us in this season of our lives,
then we pray, almighty god, that on these fields of friendly strife,
be sown the seeds that on other fields on other days will bear the fruits of victory.  

Amen.”

Our injured veterans know this story all too well. You can support them and the Wounded Warrior Project by getting involved. Learn how by visiting the Wounded Warrior Project website.

[Palo Alto Networks Blog]

Posted on

2016 Prediction #10: Cyberthreat Intelligence Sharing Goes Mainstream

This is the tenth in our series of cybersecurity predictions for 2016. Stay tuned for more through the end of the year.

There are few areas of cybersecurity that present more promise than the concept of sharing threat intelligence to make online communities, and the Internet as a whole, a safer place.

No single organization is capable of achieving complete visibility into the threat landscape. But by joining together and sharing threat intelligence across the industry, we can enhance our collective immune system. The challenge, as is often the case, has been around putting that into practice.

There have been pockets of innovation, such as the Information Sharing and Analysis Centers (ISACs) or security vendors sharing intelligence between their customers. But as attackers continue to conduct successful cyberattacks around the world, this is clearly not enough. Current efforts provide value, but they are often cumbersome and only accessible to larger and more sophisticated security operations teams. There is essentially a high “barrier to entry,” with manual analysis required to consume, verify, analyze and implement any changes to an organization’s policy, even with adequately shared intelligence.

This requirement has limited the number of organizations who share intelligence, meaning we have less of it available than we should. Now, imagine a world where every security team can turn their network into a sensor and automatically implement protections for new attacks as they happen. This puts malicious actors at a disadvantage, requiring them to spend immense resources to discover new exploits, construct new malware, and employ new techniques.

The past year has shown us early indicators that 2016 will be the year organizations truly embrace – and reap the benefits of – shared threat intelligence. We will see this change the way both security vendors and the security community at large operate. I anticipate three specific changes:

1. Threat intelligence is not intellectual property

Organizations have historically been hesitant to share data on threats. From a security vendor side, this stems from a common belief that their product differentiation is dependent on keeping this intelligence a closely guarded secret.

From a user perspective, many organizations have also operated under the assumption that sharing intelligence with their competitors could expose sensitive information or put them at a competitive disadvantage. But, in 2016, we will see more vendors come to the realization that their users, and the community, have come to expect more from them. In order to offer the best protections possible, vendors will begin to share intelligence with each other on a wider scale.

2. Public and private data sharing

There has never been more focus from the United States government on the sharing of threat intelligence, with President Obama directing the Department of Homeland Security (DHS) to lead the charge to enable public and private entities to share intelligence with each other inExecutive Order 13691.

This coming year will see the result of these efforts formalized and put into practice, withInformation Sharing and Analysis Organizations (ISAOs) being established and intelligence shared across private, non-profit and government agencies. Spurred by this innovation, we will see governments beyond the U.S. adopt similar policies.

3. Campaigns, not samples

We will see an evolution in what is being shared, with a move toward more adversary- and campaign-oriented intelligence. Traditional efforts have been focused on indicators such as hash values, which provide minimal actionable value to the organizations receiving them. Instead, we will see more effort around malware family and adversary attribution, which provide the context needed to understand the threat and develop relevant protections against them. Simply sharing data will no longer be good enough; we have to share the right intelligence, with actionable recommendations.

The coming year represents the fruition of the great promise in threat intelligence sharing. The world is changing, and both vendors and users must adopt a more proactive stance to sharing, lest they risk being left in the dust by those who do.

We have a responsibility as a security community to do everything in our power to prevent cyberattacks, which includes sharing as much intelligence as possible. While there is a great deal of momentum in 2016, we can do more to reap the benefits of this trend. Ask yourself how your organization can integrate and contribute to keeping our community safe online.

Want to explore more of our top 2016 cybersecurity predictions? Register now for Ignite 2016.

 

[Palo Alto Networks Blog]

English
English
Exit mobile version