Blog

Cloud computing technologies have revolutionized the way organizations manage and store their information.  Where companies used to house and maintain their own data, a host of organizations have now made the switch to a cloud-based model due to the ease of use and cost-saving benefits promised by the cloud.

But what is a cloud without a little rain?  The benefits of cloud technologies have not come without their costs.

Within the world of cloud computing, there have been three persistent concerns:

1. Security
2. Security
3. Security

A quick search for the pitfalls and concerns organizations face with cloud computing yields a recurring motif.  Every company looking to incorporate a cloud-based service has to weigh the benefits that a cloud environment affords against the risks associated with entrusting an organization with its sensitive data.  This data tends to include personally identifiable information (henceforth referred to as PII), which is generally the most scrutinized category of data and is subject to some of the strictest legal and regulatory requirements.

Customers of cloud service providers want to rest assured that the PII they have entrusted a cloud service provider with is maintained and held to at least the same level of security standards that they would have placed if the data had remained within their control.  For some organizations, the stakes are even higher as this is mandated by certain legal and regulatory requirements such as the Health Insurance Portability and Accountability Act (HIPAA) for electronic personal health information and the Graham-Leach-Bliley Act (GLBA) for sensitive financial information.

Many cloud service providers maintain that they are ignorant to the data ingested on behalf of their customers.  However, in the event of a security breach involving either personal health information or sensitive financial data, significant fines and reputational damage can be incurred by the cloud service provider if appropriate security and privacy measures are not in place.  This is where an effective information security management system, with specific control considerations tailored to cloud security and privacy surrounding PII, can prove invaluable to a cloud service provider.

You may have questions regarding what an information security management system is.  To define an information security management system, it may be easier to first understand what it is not.  An information security management system is not referring to an actual “system”, “application”, or “tool” that performs information security functions.

A broader definition is as follows: an information security management system represents the organization’s holistic approach to addressing information security concerns.  This includes top management’s buy-in to addressing these risks which can be demonstrated in its actions by performing the following:

• Fostering a top-down approach to information security that encourages personnel throughout the organization to be aware of information security best practices
• Performing risk assessments that are tailored to its organization’s unique threats and vulnerabilities
• Proactively searching for issues and concerns through the use and selection of internal auditors
• Monitoring and measuring the performance and effectiveness of the information security management system
• Establishing a commitment to continually improving the information security management system
• Ensuring that security controls are implemented and applicable to its organization’s goals and purpose

The standard most commonly used to demonstrate an organization’s effective implementation of an information security management system is the ISO 27001 standard.  The ISO 27001 standard serves as a baseline framework which virtually all service providers, cloud-based or otherwise, can work toward implementing.  It is worth noting that ISO 27001 provides a multitude of benefits to organizations that implement an effective information security management system, but two are perhaps the most pertinent and deserve to be mentioned:

• An effective information security management system demonstrates to prospective and current customers that the service organization means business about protecting the data that it is entrusted with and responsible for.
• An effective information security management system assists organizations with establishing a forward-thinking, proactive approach to addressing information security concerns as opposed to enabling a backward-looking mindset which is generally fostered by audit culture, which typically focuses on historical information.

The above-mentioned points may be enough for any service organization to consider implementing an information security management system.  The reputational benefit that an organization can enjoy by demonstrating to its customers that it takes its handling of information seriously is difficult to measure.  The cost-savings that an organization can enjoy by implementing effective response procedures in the event of a security incident are also incalculable – just ask United Airlines.  Sure, maybe that was a different kind of incident, but the age-old adage remains: failing to prepare is preparing to fail – this is the essence of ISO.

However, the buck does not stop at ISO 27001, especially for cloud service providers who by virtue of their trade must take information security more seriously.  This is where organizations can implement, in addition to the requirements held forth by the ISO 27001 standard, a slew of measures to increase the security and privacy measures in place when handling sensitive data, such as PII.  This standard is referred to as ISO 27018, which can be achieved in tandem with an effective information security management system in accordance with the ISO 27001 standard.

ISO 27018, otherwise referred to as ISO/IEC 27018:2014, builds upon an organization’s information security management system by establishing a group of privacy-based controls that are dedicated to protecting PII in public clouds that act as PII processors, with an emphasis on protecting PII in the cloud.  ISO 27018 provides a new subset of controls dedicated to the protection of sensitive personal data.

A high-level overview of some of the ISO 27018 requirements are included below:

• Providing cloud customers with the ability to access, correct, and erase their own PII
• Ensuring that data is processed according to its intended purpose and not taken out of context
• Procedures for the deletion of temporary files
• Implementing defined disclosure procedures
• Providing open, transparent notice in the event that sub-contractors are utilized
• Encouraging accountability on behalf of the cloud service provider through the implementation of breach notification procedures
• More stringent information security requirements on the part of the cloud service provider

Hopefully after considering the above, it is more clear that implementing an information security system aligned with ISO 27001 is tremendous for a service organization, but for cloud service providers hoping to assuage any security and privacy concerns for their customers, aligning these controls with ISO 27018 may be the organization’s best option.

As the technologies around us evolve, so do their underlying threats and vulnerabilities.  An effective information security management system affords an organization a proactive, forward-thinking approach to information security.  This is all the more important given that cloud computing technologies have been plagued with security and privacy concerns since their inception; the risks will only continue to increase.

If you represent a cloud service provider, it may be time to consider how your organization can benefit from the implementation of an information security management system that aligns its 27001 controls with the ISO 27018 objectives.

For more information on ISO 27018, you can view our webinar on-demand: Privacy in the Cloud – an introduction to ISO 27018

[Cloud Security Alliance Blog]

Ransomware attacks are not new. In fact, ISACA has been sounding the alarm on the increasing spate of ransomware for quite a while. Unfortunately, it takes a massive-scale cyber attack like the recent WannaCry incident for such cyber crimes to gain national and international notoriety. In fact, another recent ransomware attack that caught the public’s attention in the U.S. came when San Francisco’s transportation department was hit last November, impacting the city’s light rail transit system.

There is a reason why ransomware attacks are becoming popular: For the bad guys, it simplifies the crime and the process of monetization.

Think about it. Earlier, even a simple computer crime involved two steps to get to monetization. First, the criminals have to break in and steal personal information like credit card details, and then secondly, sell it on the dark web, often to organized crime groups, in order to get paid. The buyers in turn use the credit card or other information to commit fraudulent transactions.

With ransomware, crime has become an easy, one-step monetization process. Attackers break in to a computer system, install ransomware and get the payment directly from the person or organization impacted. It’s a one-to-one interaction, and payment is easily received. While accepting ransomware payment in bitcoins may seem a bit more challenging than accepting a credit card payment, anonymity is crucial to cybercriminals, making it well worth the modest additional effort.

But even with increased awareness on cyber attacks and the heightened need for cyber security, the question remains: why are organizations still so vulnerable? And what can they do about it?

• Whitelisting: Sometimes a ransomware attack can start off with a phishing episode where someone within an organization downloads and runs a malicious executable. Once that happens, the company’s end-point security products (typically an antivirus software solution) is often not enough to detect the attack. That’s why organizations like ISACA, US-CERT and the National Association of Corporate Directors (NACD) also recommend implementing whitelisting or application control – a process by which an organization runs only “known good applications.”

In the past, whitelisting has been hard to manage and maintain. For example, when a company implements the whitelisting approach, every person and device in the company will run only known good code. But the problems arose in keeping the lists up to date, such as when an executive had to run an application like WebEx or GotoMeeting. When the application ran and automatically installed a new version of the solution, the executive would be prevented from launching it, until it was entered into the whitelist. The lack of productivity with old versions of whitelisting solutions spelled doom for that approach.

However, in the last year or so, the next generation of whitelisting solutions have hit the market, and they are far superior to the old ones. Newer solutions can trust entire families of software and pull the latest whitelists, making the process of managing “known good software” more intuitive and convenient for IT departments. So, it’s critical for organizations that earlier discarded the whitelisting approach to revisit that consideration again, especially in the face of increasing ransomware attacks.

• Patching: Keeping systems patched and up to date is important, but it is not a panacea since spear phishing attacks can still trick victims into installing ransomware.

• Backups: Maintaining a good backup helps organizations navigate the waters of a ransomware attack far more deftly. For example, when San Francisco’s transportation system was hit last fall, the city refused to pay hackers the $70,000 ransom that was being demanded. Instead, it took a few days to painstakingly restore backups and during that time, the city let the residents ride in the transit system for free.

Interestingly, we are also seeing the emergence of quirky trends among ransomware criminals. These hackers are increasingly adopting best practices to close ransom transactions quickly, as the ransom demands are often not too high compared to the time and effort it would take to restore the backup.

So, to motivate the victim to pay the ransom, ransomware attackers are:

• Offering discounts if the ransom is paid within a set number of days
• Adopting a “try before you buy” approach, where the affected party can ask for a specific file to verify the veracity of the hacker’s claims
• Offering technical “chat” support after the ransom has been paid to assist the victim in recovering files

But despite these best practice claims by cybercriminals, organizations that have become victim to ransomware attacks need to make sure a thorough cleanup process is executed as part of the incident response – perhaps even scrubbing and restoring the entire system and network – to make sure the attackers are no longer there.

Rob Clyde, CISM, Board Director, ISACA, Executive Chair of the Board of Directors at White Cloud Security

[ISACA Now Blog]

Kazuar, Windows Defender and Worst-Case Scenarios

The WannaCry Ransomware attack continues to dominate the news cycle, and we’re sure you’re closely watching developments and taking appropriate US-CERT precautions.

But from Microsoft issuing an emergency patch for Windows Defender to the NSA director sharing his cyber fears to Gizmodo phishing for Trump administration officials, last week didn’t disappoint in delivering a rich trove of other security news. In case you missed it, here are some other stories that got our attention.

 

Meet Kazuar

From the pages of “Oh great, they’re doing that now?” comes an analysis of the cyber-espionage malware dubbed Kazuar that incorporates an API to reverse C&C communications flow. Detailed over at BleeptingComputer – crediting research from Fox-IT and Palo Alto Networks – the highlights are:

… the most notable and original feature is in Kazuar’s C&C server communications… Kazuar has the ability to reverse the flow of normal C&C server communications. Instead of infected hosts pinging the C&C server for new commands, an attacker can ping the victim whenever he wants and send new instructions.

 

Patch Windows Defender… Like Right Now!

Google’s Project Zero discovered a vulnerability in the malware protection engines of Windows 7, 8, 8.1, 10 and Server 2016. Microsoft quickly responded by issuing an emergency patch. According to Ars Technica:

The exploit (officially dubbed CVE-2017-0290) allows a remote attacker to take over a system without any interaction from the system owner: it’s simply enough for the attacker to send an e-mail or instant message that is scanned by Windows Defender. Likewise, anything else that is automatically scanned by Microsoft’s malware protection engine—websites, file shares—could be used as an attack vector.

 

Government Cyber attacks Double, Trump Signs New Order

As reported by GCN, Dimension Data research found that cyber attacks on government agencies – as a proportion of total attacks – doubled from 7% in 2015 to 14% in 2016, ranking the government sector as a #1 target alongside the financial services industry.

According to GCN:

Government agencies were increasingly hit with ransomware attacks, coming in at 19% of attacks. (Business and professional services sustained 28% of all ransomware attacks.) Phishing and social engineering schemes, which delivered 73% of malware, were less likely to target governments, going after the manufacturing industry primarily.

On a related note, U.S. President Trump signed an executive order on cybersecurity. Subtitled “Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure,” the order covers a wide array of security policies, issues, risk management and cyber initiatives. Paul Rosenzweig, breaks down the EO for Fifth Domain.

According to reporting by Bloomberg:

The order seeks to improve the often-maligned network security of U.S. government agencies, from which foreign governments and other hackers have pilfered millions of personal records and other forms of sensitive data in recent years.

 

You’d Better Listen to This Guy

The Washington Times reported on recent cybersecurity remarks from NSA Director Adm. Mike Rogers to the Senate Armed Services Committee.

…Adm. Rogers also raised eyebrows by discussing a “worst-case scenario” cyberattack on critical infrastructure that instead of revealing data – such as a WikiLeaks hack – would entail the manipulation of vital national data on a “massive scale.”

“Advanced states continue to demonstrate the ability to combine cyber effects, intelligence, and asymmetric warfare to maintain the initiative just short of war, challenging our ability to react and respond…”

From the Washington Post:

http://www.washingtonpost.com/video/c/embed/1b81037a-34c8-11e7-ab03-aa29f656f13e

 

Ethical Questions Emerge When Journalists Turn Pen Testers

Steve Ragan’s column at CSO raises some interesting ethical questions about Gizmodo’s effort to see if they could get Trump administration officials to click on phishing emails. The article Here’s How Easy It Is to Get Trump Officials to Click on a Fake Link in Email can fill you. Using tactics similar to those that compromised the Democratic National Committee, Gizmodo manufactured a phishing campaign targeting Trump advisors and administration officials and advisors, including then FBI Directory James Comey, Rudy Giuliani and Newt Gingrich, to see how many recipients they could get a click on a fraudulent link. About of half the links sent were clicked.

Ragan’s column asks, “does it cross a line when a news organization creates a Phishing simulation in order to develop news?” His analysis and consideration is worth checking out here.

 

No Basic Training for Military Cyber Operators

As we have noted often, the cyber skills gap continues to accelerate across all sectors, including the military. Ars Technica recently reported on a Senate Armed Services Committee hearing during which the Department of Defense discussed broadening its thinking when it comes to quickly onboarding and retaining cyber talent:

One of the possible solutions that the DOD has looked at is bringing people with experience and skills essential to offensive and defensive cyber operations into the service “laterally.” That means giving them ranks (and pay grades) commensurate to their skills and entirely bypassing the normal recruitment and advancement process.

 

…And What Else?

Naked Security shared details on how to hack a Jeep Cherokee.

Schneier on Security discussed Securing Elections.

BleepingComputer reported using digitally created fingerprints to unlock smartphones.

[(ISC)² Blog]