Category: #IT/CYBER/TECHNOLOGY

Posted on

Cloud Services Adoption: Rates, Reasons & Security Fears

Concern over data breaches and privacy are two reasons enterprises in the European Union didn’t increase their use of cloud services in 2014, according to the EU’s recent Eurostat report.

“Heaven’s not beyond the clouds, it’s just beyond the fear.” – Garth Brooks

A lot of Europeans believe that the European Union is really an employment scheme for bureaucrats who want to live in Brussels — which is, admittedly, a nice place to live. But for those of us in the analyst business, the EU is one of our best sources of the data we need to advise people on their technology needs.

I firmly believe that cloud services are no longer optional. Any business, large or small, needs cloud services to both remain competitive as well as to get better control over its bottom line. So I eagerly looked forward to the release last month of the EU’s Eurostat report on “Cloud computing – statistics on the use by enterprises,” which was broken out by country.

It wasn’t really a surprise that Finland led the way, nor that Hungary, Bulgaria, Greece, Poland, Latvia, and Romania were the trailers among the 28 member states. What was surprising, though, was the low percentages of adoption. Finland, the leader, barely passed 50% when counting those enterprises that used at least some cloud services. Those listed above as “trailers” were all under 10%. And the seemingly “advanced” countries of France, Austria, and Germany barely reached above the trailers, coming in at 11 to 12%.

When broken out by sector, information and communication were, not surprisingly, the leaders at 45%, followed by professional, scientific, and technical activities at 27%. Enterprises reported that they relied on the cloud mainly for their email services (66%) and, in second place, for file storage (53%).

Those organizations already using cloud services viewed the fear of security breaches as the main reason they hadn’t increased their use. In light of the spectacular breaches (such as Sony’s) revealed recently, that’s not an unwarranted fear. Well, until you realize that it was datacenter — and not cloud — resources that were stolen in the Sony incident.

Another fear is the proliferation of data privacy issues among the various member countries of the EU. That, and the various spying revelations that have come from the Snowden incident, have made a number of enterprises wary of putting personal and privileged information into the cloud. It was hoped that a new EU Data Protection Regulation would clear up the privacy issues when it was promulgated this year, but there are now fears that serious differences remaining between the European Parliament and the 28 member states will push the regulation into 2016, further clouding (pun intended) the issue for commercial organizations.

But by far the biggest surprise, to me, in the Eurostat survey was the reason given by those enterprises that have yet to use any cloud services as to why that is so; for the 81% of European enterprises not using the cloud, the main stumbling block was insufficient knowledge of cloud computing! In fact, though, while there are many good reasons for adopting cloud services, there is little guidance for planning it. The first step is for companies to take a strategic approach to cloud migration rather than a tactical response to business unit demands.

Once the strategy is in place, a clear definition of the business objectives of cloud-based services can be developed, the attendant risks can be quantified, the necessary policies for operating in the cloud can be documented, and board-level direction of cloud adoption can occur. Then the pitfalls can be avoided.

You need to know that with cloud services, as with most things in your corporate life, ignorance can be fatal.

Dave Kearns is a senior analyst for Kuppinger-Cole, Europe’s leading analyst company for identity-focused information security and networking. His columns and books have provided a thorough grounding in the basic philosophies of directory technology, networking, and identity management to a generation of technologists.

[DarkReading]

Posted on

Implementing Cybersecurity with NIST Cybersecurity Framework and COBIT 5

Cybersecurity risks, like financial and reputational risks, are business risks. The NIST Cybersecurity Framework (CSF) focuses on the use of business factors that guide the activities to respond to cybersecurity risks as an integral part of the organizational risk management processes.

The framework consists of three parts:

  • The framework core
  • A framework profile
  • Framework implementation tiers

The Framework Core
The framework core is a set of cybersecurity activities, desired outcomes and references that are common to all critical infrastructure sectors. It provides detailed guidelines for the development of individual organizational profiles.

A Framework Profile
Through the use of profiles, the framework will help the organization align cybersecurity activities with business requirements, risk tolerance and resources.

Framework Implementation Tiers
Framework implementation tiers provide a mechanism for organizations to observe and understand the cybersecurity risk and the processes in place to manage that risk.

Since the framework refers to recognized global standards for cybersecurity, it can be used by any organization and can serve as a model for international cooperation in strengthening cybersecurity for critical infrastructures.

Organizations have unique risks, different threats, different vulnerabilities and varied risk tolerances, all of which will influence how the practices of the framework are implemented.

Definition of Critical Infrastructure
Critical infrastructure can be defined as systems and assets so vital that the incapacity or destruction of such systems and assets would have a critical impact on national economic security or public health or safety, or any combination of those matters.

The CSF offers a risk-based approach that uses metrics to continuously improve cybersecurity. Though it was originally intended to support critical infrastructure providers, it is applicable to any organization wishing to manage and reduce the risk of cybersecurity. The CSF helps improve risk management of each organization and ultimately reduce the risk of cybersecurity worldwide.

As part of its Cybersecurity Nexus (CSX) program, ISACA offers a step-by-step guide for the implementation of NIST CSF. The activities and processes that are proposed can help to determine what to do in each phase, but are not prescriptive and should be adapted to meet individual organizational goals:

  • CSF Step 1: Prioritize and Scope: COBIT Phase 1: What are the drivers?
  • CSF Step 2: Orient
  • CSF Step 3: Create a Current Profile: COBIT Phase 2: Where are we now?
  • CSF Step 4: Conduct a Risk Assessment
  • CSF Step 5: Create a Target Profile: COBIT Phase 3: Where do we want to be?
  • CSF Step 6: Determine, Analyze and Prioritize Gaps: COBIT Phase 4: What needs to be done?
  • CSF Step 7: Implement Action Plan: COBIT Phase 5: How do we get there?
  • CSF Action Plan Review: COBIT Phase 6: Did we get there?
  • CSF Lifecycle Management: COBIT Phase 7: How do we keep the momentum going?

The challenges and opportunities lead to risk assessments and priorities, and foster organizational commitment and ownership. Thus, successful governance and management processes are institutionalized in the organizational culture.

Juan Carlos Morales, CISA, CISM, CGEIT, CRISC
IT governance and risk management consultant and trainer
COBIT 5 accredited trainer

[ISACA]

Posted on

Cybersecurity Canon: Your Vote Counts

The Cybersecurity Canon is official, and you can see our website here. We modeled it after the Baseball or Rock & Roll Hall-of-Fame, except for cybersecurity books. We have 25 books on the candidate list and we are soliciting help from the cybersecurity community to increase the number to be much more than that. Please write a review and nominate your favorite – we’re actively soliciting your feedback!

Coming soon: You will get the chance to vote on which books you want to see join Parmy Olson’s We Are Anonymous in the Cybersecurity Canon.

Public Internet voting opens on February 1, so watch this space to find out how to vote for your favorite cybersecurity book. Winners will be inducted into the Canon at the Awards Ceremony during the Ignite Conference in Las Vegas on April 1, 2015.

Don’t see your favorite cybersecurity book on the candidate list? You should submit it for consideration.

[Palo Alto Networks Blog]

Posted on

New (ISC)² Executive Director Introduction: Building on Our Successes & Striving for Excellence

I’m pleased to start off 2015 as the new (ISC)² executive director. As someone who has been entrusted with information security responsibilities throughout my career, I welcome the opportunity to speak out about the challenges we face on behalf of those working to keep our cyber world safe.

During my past two years as COO at (ISC)², I’ve seen the organization make positive strides toward establishing a member focus; however, this is a sustained commitment with more work to be done. I want to build on the momentum of our successes while continuing to evaluate areas that we need to improve so that we’re continually striving for excellence in everything we do.

As the new (ISC)2 executive director, I want to continue on the path of success we’ve achieved under the leadership of Hord Tipton, whose boundless energy and enthusiasm for all things information security and (ISC)2 are unrivaled in the industry. I understand that I have big shoes to fill.

My own background includes 14 years working with the U.S. Coast Guard before moving to the U.S. Department of Interior, where I ultimately served as deputy CIO. At both organizations, I was fortunate to work with some true visionaries who understood the role IT could play in these large, disbursed organizations with diverse missions. The last ten years of my government career, I served at the senior executive level before joining (ISC)2 in 2012. My full bio can be found on the (ISC)2website at https://www.isc2.org/management-team.aspx.

Having worked in the profession and having dealt with the challenges of managing large infrastructure as well as the challenges associated with information security, I come into this role with passion and sincerity to advocate for the profession. I also have a sense for the hard work that goes into this across the board – not just the security roles, but IT professionals that may monitor and manage infrastructure that hosts or provides access to enterprise information assets.

I think there are some parallels between public service and a not-for-profit that’s membership oriented. We’re here on behalf of you – the global membership. The investments and decisions we make should stand up to the questions and transparency we need to demonstrate to our members and always need to deliver value.

I take my new responsibility of being the leader and public face of this organization very seriously. My first order of business will be to continue to advance our global partnerships to ensure a smooth transition and to continue building rapport with the lifeblood of our organization – the global (ISC)² membership. There’s certainly more work to be done on behalf of the membership to advance our mission globally, and I plan to roll my sleeves up to further that cause.

We have a broad range of initiatives underway, so I will ensure those projects come to fruition. It’s not always about adding new ideas to the pipeline. I’ve always respected people and organizations that demonstrate the ability to make great ideas a reality. During my tenure as executive director, I plan to advance the goals and objectives that our Board of Directors has put forth for the organization and its 100,000-plus global membership.

I look forward to this exciting new challenge of becoming the leader of (ISC)². Let’s make 2015 a prosperous and progressive year!

[(ISC)² Blog]

Posted on

A Different View: Understand and Prevent Encrypting Ransomware

Ransomware

In recent years, the cybersecurity world has observed various changing trends in the malware landscape. From plain viruses and worms through DDoS botnets and banking Trojans, criminal organizations and malware authors are always trying to ramp up their attack abilities to adapt to the advancing security market and stay ahead of detection and prevention technology.

One of the most recent evolutions of this cat and mouse game is encrypting ransomware, which has lately become very popular with cyber criminals. The figure below shows the number of encrypting ransomware variants that have been spotted in attacks around the world, according to the date they were spotted on:

An encrypting ransomware is a malicious piece of software that infects a computer and encrypts all of its valuable files. The ransomware reaches the computer by way of exploiting a vulnerability (typically in a browser or a document reader), or via a downloaded executable run by an unsuspecting user. The malicious payload then encrypts valuable files on the machine (e.g. documents, images, certificates, etc.), requesting payment for their decryption within a certain time-frame.

The key needed for decryption is uploaded to a remote C&C server and is not stored on the local machine, making remediation very difficult. Removing the malware is not enough, since the bulk of the user’s files are encrypted and cannot be recovered without the key. Thus, if the victim chooses not to oblige within the given time-frame, the files remain encrypted with very little hope of recovery.

The effectiveness of this threat has contributed to its popularity among cyber criminals, which use it to infect individuals and organizations alike.

Looking at Things Differently

Most of the publications on encrypting ransomware focus on the infection methods, the encryption algorithm, or the C&C server communication. In this post, we look at ransomware from another angle, by analyzing the file operations they perform on the files they encrypt. A high-level overview using simple methods can provide significant insight into malware behaviors — insight that might otherwise go unnoticed when delving into the little details.

We can divide encrypting ransomware into three categories, based on the way they access and modify files:

  1. Write-in-place
  2. Rename-and-encrypt
  3. Create-encrypt-and-delete

As part of our ongoing research into battling these pieces of ransomware, we analyzed many samples and variants, coming from different origins. We present a summarized study of some of the samples we analyzed, one for each of the aforementioned techniques.

Write-in-place

The ransomware in this category operate in the following manner:

  1. Create a temporary file
  2. Read the original file
  3. Encrypt the data and write it to the temporary file
  4. Read the encrypted data from the temporary file
  5. Write the data back to the original file
  6. Delete the temporary file

Ransomware of this type includes CryptoLocker, CryptoWall, CryptoDefence and DirCrypt.

Note that process memory can be used as the temporary storage area instead of a temporary file, and the malware still belongs to this category.

As an example, let us analyze a sample of the DirCrypt ransomware (md5:0e5e8f6edd2c1496614bb6a71ba3f256), which uses the process’s memory as its temporary workspace, as depicted below:

  1. Open the file using CreateFile
  2. Get the file size and data length using GetFileInformationByHandle
  3. Read the file’s data (piece by piece), encrypt the data in memory, and write it back to the same file
  4. Finally, close the file, as shown below

Upon opening the encrypted file, the user is faced with this message:

Rename-and-encrypt

Ransomware belonging to this category operate as follows:

  1. Rename the original file.
  2. Read the renamed file.
  3. Encrypt the data and write it back to the renamed file.
  4. Rename the file again to the original name (+ some extension).

Ransomware such as Onion/CBT/Critroni exhibit this method of operation.

This type of sequence is more complex than the first technique presented, since the file is renamed before the encryption. The defender might therefore need to keep track of all the different names a file may have.

An analysis of an Onion ransomware sample (md5: 10a472ec4a6687f1c432c639effbae00) shows the following actions being performed on the files to be encrypted:

  1. Open the file using CreateFile
  2. Rename the file using SetFileInformationByHandle to a file in a Temp directory, named 0.tmp
  3. Get the file size, and data length using GetFileInformationByHandle
  4. Read the renamed temp file, encrypt the read data, and write it back to the same file
  5. Set a new file size with SetFileInformationByHandle
  6. Rename the file again, this time to the original name, in the original path, with “.ctb2″ extension with SetFileInformationByHandle

Note that the malware uses GetFileInformationByHandle and SetFileInformationByHandle to preserve the original timing attributes of the file.

After all files of interest had been encrypted, the following message appears:

Create-encrypt-and-delete

The operations performed by malware in this category are:

  1. Create a new file
  2. Write the encrypted data to the new file
  3. Delete the original file

Ransomware such as ZeroLocker and TorrentLocker use this method when encrypting files.

This technique is the hardest to identify as a malicious activity, since the API calls by themselves can’t associate the events of creation, writing and deletion together and show that they correspond to the same files. Furthermore, legitimate operations, such as moving files between different hard drives, might produce similar logs.

Analysis of a sample of the ZeroLocker ransomware variant (md5:3772a3deeb781803a907ed36ee10681d) shows that for each of the files in a set of predetermined directories, the following actions are performed:

  1. Open the file using CreateFile
  2. Create a new file in the same location, with the same name and an additional “.encrypt” extension
  3. Get the file size and data length using GetFileInformationByHandle
  4. Read the original file, encrypt it, and write it to the newly created file
  5. Delete the original file using SetFileInformationByHandle

At the end of this procedure, the ransomware creates a directory named “ZeroLocker” with two files. One of the files contains the following message:

Conclusions

In this post we examined the methods of operation for several common ransomware samples. The first method, write-in-place, is the most simplistic method in terms of file operations. The second method, rename-and-encrypt, is very similar to the first method, but adds the complexity of tracking all the different names a file may possess.

The last method, create-encrypt-and-delete, is the file operation method, used by ransomware, that is the most challenging to identify. This stems from the fact that the file operations involved can be seen in everyday use-cases, and it is hard to relate them to malicious activity that aims to encrypt files on the machine.

Palo Alto Networks has been researching a solution in Advanced Endpoint Protection that, based on our lab tests, would have blocked the ransomware families mentioned above and prevented malicious activity. We hope to share more details of this solution in the coming months.

[Palo Alto Networks Blog]

English
English
Exit mobile version