Program Maturity - Cyber-security and Operational Risk Maturity

The Balancing Act

In reviewing my LinkedIn notifications I was wonderfully surprised to find  an article written by Gideon T. Rasmussen, VCISO topic: Cyber-Security and Operational Risk Maturity.  As soon as I saw it I was thinking this is center to our consulting business I better pay attention. So here we go.

As Gideon T. Rasmussen comments on leveraging risk I immediately get hooked.  How can you even begin to understand your operational and situational awareness with out at first understanding your risk.  At Integris Security we advise our clients if not done within the past twelve months get a solid risk assessment done ASAP!  This risk assessment can then help you set priorities, establish tactical and strategic budgeting, technology goals and priorities and help you weigh your operational risk.  We at Integris believe this will improve the overall maturity of your cyber and operational approach.  But let's go on and see what else Rasmussen's nicely laid out article reveals.

Rasmussen's talks about U.S. Department of Commerce's,  N.I.S.T. (National Institute for Science and Technology).  For a great many of us in the IT security practice N.I.S.T. for years has been the go to "tool shed" for in-depth building blocks.  Their publications can take you from the very beginning of ....   What should I do? Where do I start? To a polished well informed presentation.   N.I.S.T. has a great many publications and they are 100% free.

The F.F.I.E.C., also provides great free guidance.  The men and women of the Northeast Chapter of the F.F.I.E.C., are your local financial services regulators.  You should get to know them, work with them and understand how they are approaching many of the same issues we all are trying to tackle every day.  Integris Security highly recommends you  review the regulators guidance and find answers to your company's compliance problems. These tools are also 100% free and incredibly useful information.

I do take issue with Rasmussen regarding this statement:

"There are no requirements for disaster recovery or business continuity. The card brands do not care if your business goes under, as long as their payment card data is secure." 

This is a nit, and can also be style but the point has to be made.  Their are literally hundreds of best practices for disaster recovery and business continuity and they should be put to use, despite the lack of attention by card brands to advise this.  Promotion of best practices is something we owe to the industry as a whole in our writings and presentations.  Taking on the Card Brands for lack of attention to Rasmussen's legitimate concerns would do better as a separate article, another a day and time in my eyes. We're talking Cyber-Security and Operational Risk Maturity.  At Integris Security we push all to stay focused.  Good practice is too important to relegate to tomorrow's news.  Let's keep it up front and worthy of continual presence and persuasion in our discussions in how to improve cyber-security and operational risk maturity.

In maturity level II, I love this discussion of controls and it reminds me of C.O.B.I.T., as well as the many information security joint forums held with ISACA in years past and their auditor/members.  You gotta love the structure that these individual professionals have developed and the principles that they follow.  This is a serious group of security professionals and we could all learn allot from them.  Rasmussen then lays out the common controls read: GAP analysis, and Risk based deployment of controls, while not much new here he provides a great review.  All solid material for a CEO and others within the organization to read and understand when weighing decisions on investment in the security program or cutting the fat off an already lean program.  These decisions will not be easy ones for sure.

My own note here:

The Cyber-Security and Operational Risk Maturity discussions can not be left alone to the operational business units, departments or divisions of your company.  These discussions need to expand and involve audit committee's at the board level and become a fluid ongoing discussions lead by the chair of the audit, technology and other important committees as the board and operational personnel try to achieve a balance of risk Vs reward and continue to build market value for the company's shareholders and investors.

 Joseph R. Concannon             

In maturity level III, Risk Management, Rasmussen covers it nicely and I smiled as he stated:

"It is necessary to tailor controls to the organization and to adapt to changes in the threat landscape."

Nicely done Gideon T. Rasmussen, these words couldn't be truer.  It also reminds me to tell our readers to remember that each organization has its own culture.  Some are very risk sensitive and others not so much so.  I often use Johnson and Johnson and Martha Steward Living as examples.  Two great companies but their approach to security was night and day.  Johnson and Johnson a security controls organization (almost war like) and Martha Steward Living a creative design firm.  The cultures were completely different at the time of my interview with security personnel.  Management of your and the company expectations are very important.  Don't get ahead of your skates or you  may get caught off balance.  Knowing the culture of your organization is key and very important.  Now that you have new security and risk management information in hand how do you operationalize it?  The best advice is work with your team and leader and try to introduce incremental improvements to improve your organizations overall security/risk posture.  This will work to your benefit for the short term tactical business operations as well as long term strategic planning for important improvements.

Your threat and vulnerability map will be constantly evolving, as targets and priorities come and go.  The risk assessment report provides you with items for your to-do list.  The report will show best practices and offer a target rich list for you to prioritize.  Rasmussen I believe understands this and covers it nicely and provides some bonus points by laying out some bullets for a prospective slide deck to communicate your findings and setting some future objectives.

The Risk Register is a platform to inform and Rasmussen points this out clearly.  Want to know more about your risk?  The Risk Register is a place you want to go to identify, define, understand impact, respond, prioritize, and take notes.  Its an invaluable tool given to us by the folks from project management.

Maturity level IV, Strong Risk Management, Rasmussen lays out a ten step program.

Rasmussen says:

1. There is appropriate separation of duties in the CISO’s reporting structure, such as reporting to the CEO, Chief Risk Officer or Board of Directors. When the CISO reports to the CIO, it is a conflict of interest  2. Cyber-security metrics, KPIs and KRIs feed into an Enterprise Risk Management program.  3.The CISO provides updates to the Board of Directors or similar executive group.  4.The cyber-security program maintains controls specific to line of business products, services and assets. 5. A process management program is in place, to include policy, an inventory and process risk analysis.  6. A fraud prevention program is in place, to include fraud risk assessments conducted by an independent third party. 7. An operational risk management function maintains a risk scenarios inventory and conducts quantitative risk analysis. 8.The organization leverages the Three Lines of Defense Model, with active support from operational management, risk management and compliance functions and internal audit. 9.  Operational functions and lines of business are required to declare self-identified audit issues, with metrics in place to demonstrate the control environment is improving continuously 10. Incident response and business continuity exercises are conducted annually to include senior executives, lines of business leaders, information technology, legal, public relations and critical suppliers

This information is a like having a great cyber-security road map.  However, just like any road map their are going to be detours, accidents, potholes and your going to need the awareness, patience and skills to work around it all.  If you follow the program laid out by Rasmussen you'll be in a better position to mitigate those great unknowns and navigate your way freely from obstructions.

At Integris Security we say: you make it, we make it secure!  We look forward to having these and many other important discussions with you and really enjoyed our read of Gideon T. Rasmussen's LinkedIn article concerning Program Maturity - Cyber-Security and Operational Risk Maturity and hope that you will too!  Their is much to learn and many experiences to endure before we can truly say we're secure.


#Cyber-Security  #HomelandSecurity  #InfraGard #ISSA #ISACA #FFIEC #NIST

Big Data: Security, Trust and Integrity

In information security the jewel of all certifications is the CISSP (certified information systems security professional).  The certification is your entry key into the top tier cyber security jobs and earned respect of your peers in the industry. 

The group that hosts the coveted CISSP certification is (ISC)2: the world's leading cyber security professional organization.  They actively promote their members and insist you want one our people at the switch if threats of an attack are at your doorstep. 

A great many information security professionals have earned this certification and live up to its standards and for that they are proud card carrying members.  I salute them for their achievement. 

One of the most important aspects of the certification in my eyes is the code of ethics.  The code of ethics tells you something about the individual and the organizations they belong to.  (ISC)2 spares no dime on its code.  The code of ethics is huge and prominent.  Honor and duty are fundamental in any cyber security career.  The group lays it out like this:

• Our code
• Code of ethics preamble
• Code of ethics canons

We again salute (ISC)2 for their outstanding work.  Note well that prominence of the code, its preamble and canons can not replace the responsibility of the issuing organization to aggressively maintain the standards so that they ensure its integrity.  The organization owes it to its members to police itself and has a complaint procedure, ethics committee and international working group.

As data becomes accessed from hundreds and in some cases thousands of sources we reflect on the role of the information security professional has in the work place and what a pivotal role it is.  Untimely and inaccurate intelligence/data can cause food supply shortages, it could run up the price of a barrel of oil and shift geopolitical affairs world wide.  The use of big data and concerns around integrity have never been more critical and important.  

The role of the CISSP member becomes exponentially more important and his/her integrity should not come in question, hence the focus on "Big Data" in this article.  Data can shift global markets, take down thriving economies and strip citizens of their bill of rights so the importance and focus on this topic is both timely with a need to be accurate.  As governments and citizens react to COVID-19 the initial focus was on data driven models which reported that millions were in peril if the US Government did not act quickly.  Today we see state governments restricting the movement of its citizens, baring them from accessing their properties (Michigan), removing business and liquor  licenses from businesses who refused to comply (Maine) and here in NYC the issuance of one thousand dollar fines if you are found in non compliance - wear your mask, don't get closer than six feet or else!  

As time passes we are learning that models are just that models.  Accuracy depends on the information you put into models we have learned and if the data is awful so is the model and its outcome. Thus data its custodians and security personnel take heed. I think I made the case, data its timeliness and accuracy is very, very important.  The integrity of data custodians, security personnel has never been more acute.

 

Cyber Security Month: Looking for Answers Part II?

NEW YORK METRO JOINT CYBER SECURITY CONFERENCE

NY Metro Joint Cyber Security Conference

I recently attended the Third Annual New York Metro Joint Cyber Security Conference (http://nymjcsc.org/), held in mid-town Manhattan.  Security conferences are now a dime-a-dozen, but this event is unique in that it is a collaborative effort developed by a consortium of eight leading security, audit, and risk focused, NY metropolitan area, not-for-profit professional associations. Each organization brings its best to the table, creating a rare combination of expertise and diversity of talent.  

There were many informative sessions – some standing room only – but some of the greatest value was in the interaction with the other professionals.  For example, in sessions, we learned that security professionals must adopt the language of Directors to be understood by a Board.  The Internet Security Alliance is even working on metrics for Boards to use in evaluating security risks and controls.  But, after all the talk of security maturity models, cyber risk management frameworks, and “cyber balance sheets,” CISOs (Chief Information Security Officers) will tell you that Boards still “just don’t get it” and don’t seem to be that interested.  Perhaps CISOs as a group aren’t very good at explaining how greater focus on preventing and mitigating cyber threats is in the self-interests of very diverse sets of Directors.  Maybe, despite approaching the problem with the best of business concepts and lingo, CISOs just don’t have influence with Directors.  (As one CISO put it, “formulas don’t work.  Relationships do.”) Or, perhaps it’s because, as one speaker put it, there is not a single instance of a cyber breach that has been demonstrated to have a material impact on a company.  In the end, the surprising takeaway may not be that CISOs are becoming more adept at speaking the language of the Board, but that some Boards are beginning to listen at all.

This sold-out event offered excellent, high-quality presentations with plenty of actionable content.  If you weren't able to attend, you can still benefit from the recordings of many of the sessions.  They are available at http://livestream.com/internetsociety/nymjcsc/.  Presentation slides may be found at http://tinyurl.com/z3fz44d. I would highly recommend reviewing them.

And, don't forget to sign up early for next year's conference.  It's one of the best values in information security education that you'll find anywhere.  Follow www.nymjcsc.org and @NYMJCSC for details.

Phil Froehlich is Chief Operating Officer of Integris Security and a member (who listens) of the Executive Board of New York Metro InfraGard.

Cyber Security Month: Looking for Answers: Part I?

LONG ISLAND BUSINESS NEWS

Long Island BusinessNews’ second annual Cyber Security event, on October 6th 2016 at the Huntington

LI Business New Cyber Conference

Hilton, was once again informative, invigorating and enrolling. With a number of panelists participating, including both the Integris Security CTO, Blake Cornell, and United States Congressman US District 1, Lee Zeldin, nearly 100 individuals attended the breakfast event.

Topics of interest had included Cyber Terrorism, Business Continuity, Government Legislation, Small Business Best Practices and other wide ranging topics. Some of the information shared, information that attendees can use in their day to day business operations.

A goal of Integris Security CTO, Blake Cornell, was to provide “simple and sound information that is short and sweet” further stating that “if your employees are untrained then no amount of technical information will help them understand. You can’t make them understand but you can help them understand”.

Blake Cornell is the CTO of Integris Security LLC.

Information Security in Corporate Valuation

What do you look at when considering the corporate valuation of a company?  Chief financial officers pour over spreadsheets, public filings and much more to get a temperature so they can inform investors, boards and others in the decision making process.  Where is Information security in this discussion?  Who is the chairman of the board's audit committee and how comprehensive are the details and reports?  How accurate and truthful are these reports and details?  Who is the chairman of the technology committee and are his/her reports accurate, timely and reflective of the needs of the company to support the basic operations of the company.

Whether your a big box company like Target, credit card processor like Hartland Payment Systems or just one of the largest email giants like YAHOO!  these and many other questions have to be answered, accurately, timely and honestly and yes, sometimes even painfully.

We have all read in the news that VERIZON is on the path to make an offer to Yahoo! with finalization next year and this latest exposure is certainly going to figure large into pricing.  Verizon

will pay a competitive price, but will not buy based on a hunch.  They will skillfully look at every single part of the Yahoo! digital empire and figure out just how much work will be needed to mend the broken system.  Information security practice will loom large as the price for Yahoo! could potentially shrink.  Information security is going to have to push its way into the board room and profit center discussions.  If not the corporate valuation is just not honest and leaves a lot to be desired when looking at the totality of the circumstances concerning corporate valuation.  Assessing a computer environment can be a very straight forward business.  But what we're seeing are limitations put on security professionals or very narrow scoping of projects which is shaving away a more wholesome look into the entire computer enterprise.  This is just a delaying tactic which is putting off the unavoidable.  Auditing should be ongoing quarter to quarter, year to year and used in helping to set budgets for the out years.  Audit chairs should be apart of the internal profit center discussions and everyone should be mindful of function over feature creep without warranted information security checks prior to implementation.  The sales guys are going to have to get involved in security the environment which they play a critical role in.

Integris Security is your trusted IT Security team that can help you as we provide tailored, high quality security solutions based on industry best practices and our principals combined experience of more than eighty years.  Call us for an appointment and free consultation.

Ten Mistakes that Boards Make

Too often we are learning of executive level errors or omissions which cause massive breaches to the data or PI of millions of citizens.  Here's the "Ten Mistakes That Board Make".

         1. Not Asking Questions

2. Failing to Understand the Company and the Risks it Faces

3. Failing to Lead on Ethics and Compliance

4. Not Insisting on a Crisis-Management Plan

5. Speaking out in a Crisis Before the Facts are in

6. Relying on the Wrong Outside Counsel

7. Failing to Understand Attorney-Client Privilege

8. Underestimating Regulators

9. Giving too Much Leeway to Rainmakers

10. Getting Caught Up in the dilemma of False Options

Taken from the magazine Corporate Board Members, an article written by Randy Meyers.

Make Integris Security your Chief Risk Officer (CRO) as the independent keeper of oversight in your corporate enterprise.  It is the job/function of the CRO to keep regulator awareness at a high level and to let the business be in charge of risk management.

Integris Security LLC grew from our passion for protecting our nation’s critical infrastructures and years of providing industry professionals with best of breed solutions, proven best practices and top notch security education. We work tirelessly to nurture our clients’ TRUST. We will work equally diligently to EARN your trust.


Reference: http://operationalrisk.blogspot.com/2014/11/top-ten-mistakes-board-of-directors-risk.html

 

Blackshades - an international hazard

It is important to note that as I start this discussion readers are reminded that while malware today is portrayed as dangerous, destructive and part of a criminal enterprise viruses, worms and trojans were and sometimes continue to be little pieces of code which help automate things.

The very first virus written wasn't an assault on a major banking institution, rather is enabled a programer to automate repetitive or tedious tasks.

With that said, The FBI has recently reported in a sterilized press release that International Blackshades - has been taken down.  What we don't read in the release is perhaps as instructive as what is placed on paper.  Thus a good reason to dig a bit deeper and try to wrap a little context around all the fanfare.  This isn't about using limited FBI resources on taking down just any cyber criminals.

For those of you who followed me at InfraGard we produced a weekly IGtv program wherein I spoke with security professionals from the world over.  In this weekly Internet show I interviewed a number of professionals from RSA Security's Israel lab.  During these reports and discussions we learned that the world of malware had developed from a freakish once and while mad scientist type of thing to a very purposeful blackmarket type of business operation.  Blackshade is not some backroom mad scientist, rather they are business people selling software and as we will learn much more.  They are careful to insist that those buying their software signoff on a statement of use and legal disclaimers carefully avoiding international and in country laws.  Because they are in fact a software company and a very good one at that, right?

Blackshades develops many different types of software and one that focuses our attention is RAT (remote application tool).  Their are many variations of the RAT and the focus of our post here is the Blackshades NET.  In reseaching Blackshades we found it useful to also take a look at DarkComet, another RAT with some pretty good potential but not nearly as powerful as Blackshades.  However, DarkComent has a history in international affairs which would be useful in reading as we move forward to learn more about Blackshades.  We can see how the development of software has worked its way into State Sponsored Actors.  Recall how Russia used technology to kill communication lines prior to the invasion of Georgia and now the Ukraine.  DarkComet has played a role in Syria.  So pay close attention when we talk about functionality of Blackshades in comparison to DarkComet, it becomes increasing important why the FBI would get involved and purposefully release a sterile press release on the takedown.

Blackshades is distributed through some common social media channels as well as phishing attacks, P2P channels and much more.  All very common and known to the industry.  Its functionality dwarfs DarkComet in comparasion.  As Malwarebytes states:

"The BlackShades web site mentions a lot of the functionality the RAT is capable of, from various system administration functions to surveillance functions and computer security.  It doesn’t actually mention ALL of its functionality, as we will discuss, and I think that they might have a hard time explaining on their website the purpose of some of the following functions."

This software toolkit is explosive and is used to hijack websites with its Ramsomeware which basically locks you out of your site or maybe encrypts everything (no key provided) until such time as you pay the fee.   Another interesting aspect of Blackshades is the Facebook Controller which basically takes over your account and posts for you.  Remember, it is said that one in fourteen people in the world are on FB.  Most FB users aren't aware that "always on" means that if the software is exposed to you even if you are logged off the web and you're still on FB Blackshades will for sure takeover.  Logging in and out is a pain, but in today security environment is a MUST do.  So when a nation state is acting, it uses many channels to build or tare down a point of view, a surveillance, etc.. This tool has built in DDOS and other attack capabilities as well as java exploits.  But more importantly as Brian Krebbs, reported:

“Blackshades was a tool created and marketed principally for buyers who wouldn’t know how to hack their way out of a paper bag,” wrote Brian Krebs of Krebs on Security. “The product was sold via well-traveled and fairly open hacker forums, and even included an active user forum where customers could get help configuring and wielding the powerful surveillance tool.”

As stated in Symantec, the Blackshades tools (rats) are popular with cyber criminals and state actors like Libya and Syria.  For forty to fifty dollars one can aquire a very effective software product which can be very destructive, but a product which has helped underground elements to extract millions of dollars from companies the world over as well as some governments.

In summary, Blackshades is a more nefarious piece of software then its predecessors that infected over 500,000 computers world wide then anyone is letting on and in hindsight the FBI takedown is a signal to those "business people" lookout we're watching and we're on top of it.  Ninety arrests in 19 different counties is telling about the scope and depth.  Uncertain is whether this is nipping at the edges or taking out the C/C capabilities and principles involved.  Most likely the FBI is both happy for the case and noticeably reluctant to say game-over.  This snake will continue to sliver in and out and pick up again under another name with more willing players looking to strike it rich quick.  Malware is no longer the mad scientist, its hit Main Street and the profit center.  Malware is making millions for some of those willing to take the risk of getting caught.  Malware has also made the center stage as a component of state actors.  International cyberwarfare is our now reality and has been for some time now.  If you weren't aware you'd do well to read up.

LINKS:

http://www.symantec.com/connect/blogs/blackshades-coordinated-takedown-leads-multiple-arrests

http://resources.infosecinstitute.com/darkcomet-analysis-syria/

http://abcnews.go.com/Technology/fed-cyber-sleuths-stop-gameover-zeus-cryptolocker-crime/story?id=23964827

http://www.washingtonpost.com/news/morning-mix/wp/2014/05/20/5-scary-things-about-blackshades-malware/?tid=pm_national_pop

More Info:

In the Bureau's custom of sharing the most accurate, vetted information, they updated others today with the latest figures:

Arrests: 103

Searches: 375

Interviews: 163

18 countries involved

Approximate victim computers globally: 700,000

Uncertainty, risky first half of 2014...the year of the hack?

Pushing the buttons of millions of individual Americans is the fact that their accounts have been hacked according to Larry Ponemon at the Ponemon Institute in a study conducted for CNN Money.  Ponemon's study gaged that 47% of adults had their accounts hacked during 2014, which may soon become known as "the year of the hack".  That's just about half of all adults in the United States.

The facinating numbers come at the heals of the Target breach which we have been discussing on this blog and doesn't include the millions in the latest eBay Breach.  Its raining on the American Public as millions of  (PII) records are exposed.  Here are the facts and figures Ponemon and Jose Pagliery of CNN have dug up for CNN Money:

"Cyber attacks are growing so numerous that we're becoming numb to them. Researchers at IT company Unisys (UIS) say we're now experiencing "data-breach fatigue." Even the most recent numbers make for a dizzying list:

• 70 million Target customers' personal information, plus 40 million credit and debit cards
• 33 million Adobe user credentials, plus 3.2 million stolen credit and debit cards
• 4.6 million Snapchat users' account data
• 3 million payment cards used at Michaels
• 1.1 million cards from Neiman Marcus
• "A significant number" of AOL's 120 million account holders
• Potentially all of eBay's 148 million customers' credentials"

More numbing then the facts and figures presented by Ponemon Institute for CNN MONEY is the fact that the industry has not adopted better and well known security practices as a whole.  Need I go on?  For ten years industry has been digging a hole deep in the sand and sticking their preverbal heads in the hole.  See my blog post on accountability.

Let's not blame it on companies looking at profits after all isn't that why companies are in business to begin with.  However we too pause, when companies select tactical gains to satisfy quarterly earnings statements and maybe making themselves look good as opposed to the overall strategic growth and health of a company or corporation.  Read responsibility to share holders, and company employees. To some extent the risk Vs reward discussion will come up and when presented executives will nervously select profits.  Until boards reflect the knowledge, skills and abilities necessary to make both tactical and strategic management decisions we will continue to see the deep decline and clearly the never ending "year of the breach".  Operational executives will respond in kind when Boards of Directors begin to ask the thorny questions which should focus on the strategic growth of the company.  Employees will then be motivated and hear the clarion call from mount high when the CEO comes back from the board meeting and says they want more security and assurance before we can bring that function on board, who certified that code, who tested it and who is taken ownership of the relationship with the software team?

Here's hoping that the second half of 2014 is the year of Board of Directors active and attuned to what is going on not only in the front office but every office.  That function continues to thrive and work closely if not right next to the security team.  That multi-factor authentication is used not just for outsiders, but insiders as well.  That outside relationships are clearly defined and SLA's (service level agreements) are scoped out to protect both the vendor and the company.  That data which can be held in a planet sized computer terminal or a tiny smart phone is protected and preserved because we should all enjoy a level of privacy.   That when we buy the state of the art upstream gadget that detects attacks and when alarms go off and people start screaming at the top of their lungs someone will listen and will have been properly trained on the use of the gadget and that it is properly configured. All very hopeful that the year end will be better than the start.  The future is now before us.  Let's see how we do!

Good luck everyone!

LINKS:

The Cyber Crime Economy

Study: 432 million accounts hacked

Lessons from the U.S. Veterans Administration

Government run healthcare is suffering from the stiff stench of reality this week as the Veterans Administration emplodes in a wide scale corruption probe in over 46 different facilities - defining systematic corruption which has infected the entire bureaucracy.  What can we learn?

Audits tell part of the story and so does strong management which not only holds those accountable but is in fact in trenches leadership.  Take a hard look at, "Undercover Boss" and ask yourself if the leadership of the VA had been in the trenches could things have been any different.  Clearly the Administrator of the VA was fighting an uphill battle of liars, cheats, and more.  But "Undercover Boss" makes the point: get out of the office and get into the trenches for a reality check.  Now let's see if our USDOJ follows the Veterans Administration IG's report and starts the most necessary criminal investigations to clean the VA once and for all so that our war heros finally get what they deserve - the best health care known to man.

We talk much in this blog about management and boards of directors.  As we should.  Organizations depend on these fine men and women to do the impossible, to be supermen and women.  But the days of hands off management are long gone.  Whether you are in government or the private sector if you haven't gotten that message its high time you did.  Get out of the office and learn the reality of what is going on in the workplace.

We heard much this week about out dated technology and "scheduling".   We worry, is this a sign of times to come in government run healthcare?  Well, those of us in technology know all too well that technology does a backflip and ten steps forward about every 60-90 days.  So if you're thinking of saving money and leveraging your entire corporation and/or government run agency on shoestring that has a one time techology budget - in the immortal words from Brooklyn, NY - forget about it.

Technology is in the worst case an infant, with an appetite that rivals most young U.S. Marines in boot camp.  Belly up to the table because this infant is going to need your undying attention, your understanding and your coddling every single day of the week.  Budgeting and planning for the unexpected are just another great aspect which many who are so quick to adopt technology and outsourcing with an expectation of saving millions may want to slow down and take a deep breath.  Technology implementations are expensive and those seeking to cut to shortcuts are only doing a royal disservice to their companies and agencies and fooling themselves.  While the passing of timely and accurate information is exciting and used correctly can help you turn on a dime....it comes with a fairly large investment and huge reality check on expectations - but not on the information delivered, but on the intense care and ongoing maintainence to systems, controls and people.

Take a hard look at the Veterans Administration of today and ask yourself Mr/Mrs CEO or Agency head...could this be me?  Do I even have a clue?  We hope this as in any number of cases we bring to your attention help you focus not just on security but the fundermentals of leadership and management.

If you need a trusted source and friendly but well grounded reality check give us a call.  We would like your business, but we're not willing to suffer our reputation just to make a buck.

Trust is at the core of Integris Security. We can be counted upon to provide you with the services and intelligence to keep your information, systems and institution secure. Call us and let's get to work on improving your security/risk posture.

The Russians Are Here...

The Russians Are Here

Estonia, Georgia and now Ukraine...

The Russian are coming, the Russians are coming!  As a modern day Paul Revere we're shouting at the tops of our lungs the Russians are coming!  But what does all this portend for those in the security and cyber security space?

In the sixties, seventies and so forth we were warned and taught in schools that the Communist were going to take over the world.  We were told they would do it without firing one single shot.  Given our current technology revolution has this become a more resolute reality?  Are we feeding our own eventual demise by participating in this ever interconnected world via the web?      

Well, if we look at Estonia, Georgia and now the Ukraine cyber invasions are most definitely front and center of every single world power and nation-state.  We invite your comments and observations as Russia leverages Crimean networks, telecom, communications capabilities and the gas pipeline infrastructure which feeds most of Europe and is most undoubtedly connected to SCADA systems.

Those of us in the security space would do well to pay close attention to methods of operation and techniques employed for both offense and defense whether as old as the hills or on the new frontier called the bleeding edge.  The global economy is not going away any day soon and we need to understand the threats-scape, our own infrastructure limits and wherein possible the bolstering of defenses to counter those threats as it may lead directly to our bottom line.  Testing to acceptable baseline defenses and offenses will only get you so far...conducting exercises for real resilience in the face of a MOST determined adversary is as they say, a horse of a different color.

We at Integris Security are here to help you prepare, test and evaluate your enterprise operations with an eye on: Can you survive in this global economy if your adversary has your company in their crosshairs?  Is your staff security aware?  Would you know an attack if it started?  Are your employees asleep at the switch, anchored in a serpentine bureaucracy or are they war-fighters listening, looking and revealing, reporting and proactively taking action?

Lastly, if sixty thousand security related alarms went off at your company would you roll over and go to sleep or more appropriately "RESPOND", "INVESTIGATE" and "REPORT"?

Here are a few links:

http://www.computerweekly.com/news/2240215674/Ukraine-and-Russia-locked-in-a-cyber-stand-off

http://defensetech.org/2008/08/13/cyber-war-2-0-russia-v-georgia/

http://www.computerweekly.com/news/2240215674/Ukraine-and-Russia-locked-in-a-cyber-stand-off

http://www.bbc.com/news/technology-26447200

http://www.huffingtonpost.com/2014/03/04/ukraine-cyberattack-mobile-phones-russia-parliament-security_n_4895287.html

http://www.stratfor.com/weekly/ukraine-and-little-cold-war?utm_source=freelist-f&utm_medium=email&utm_campaign=20140304&utm_term=Gweekly&utm_content=re

Target Confirms Unauthorized Access...

ANALYSIS:

In recent days we have heard quite a bit about the 2014 Target Breach.  Additionally we have heard about the Neiman-Marcus breach which is said to be independent of the Target event but reports are that the malware used is similar.  Target is now investing billions of dollars to repair both its image and capabilities.  We have been discussing the Target breach and are trying to learn from each aspect of the incident as it becomes public.  The rationale has been to better our own security posture and help improve the overall security posture of the industry as a whole.  This breach investigation will evolve and we at Integris Security will evolve with it and learn as information becomes reliable and forthcoming.

Everything known at this point is speculation and inconclusive until the Target Corporation steps up to the microphone and gives a full autopsy. Not likely to happen any day soon as legal process is just now gathering information.

Law Enforcement (U.S. Secret Service or FBI) is typically very tight lipped about the circumstances and causes (operational details) leading up to such an event like this since they are in various stages of presenting materials to grand juries, attending to hearings, participating in a prosecution, etc..  Normally afterwards which could be a year or better after suspects are declared innocent or a conviction the details slowly pour out and begin to be known.

We are providing here some links which were discussed on weekly conference calls and provided to us by a number of different sources. Target is known as having very strong internal security procedures, posture and no one should take this post to mean target is not helping its own cause.  Previously we have spoken to Target personnel and know full well something seriously went awry. 

We have a deep sense of intrigue which is only natural and want to learn every single detail about this serious beach.  However as security practitioners we must be responsible and utilize some common sense and respect for the internal practitioners with the Security Teams at Target.  The security teams, their tasks, workload, etc these days must be daunting (incident response, business continuity programs and disaster recovery plans will receive plenty of scrutiny this time around).

We are posting from Neiman-Marcus as well even through the two cases have not been connected.

http://www.zdnet.com/neiman-marcus-1-1-million-cards-compromised-7000025513/
http://www.nytimes.com/2014/01/24/business/neiman-marcus-breach-affected-1-1-million-cards.htmlhttp://www.neimanmarcus.com/NM/Security-Info/cat49570732/c.cat?icid=topPromo_hmpg_ticker_SecurityInfo_0114

http://m.computerworld.com/s/article/9245877/Target_says_attackers_stole_vendor_credentials?source=CTWNLE_nlt_security_2014-01-30
http://krebsonsecurity.com/
http://krebsonsecurity.com/2014/01/a-first-look-at-the-target-intrusion-malware/
http://www.cnbc.com/id/101329300
http://www.reuters.com/article/2014/01/12/us-target-databreach-retailers-idUSBREA0B01720140112
http://www.us-cert.gov/ncas/alerts/TA14-002A
http://krebsonsecurity.com/2013/12/sources-target-investigating-data-breach/
http://pressroom.target.com/news/target-confirms-unauthorized-access-to-payment-card-data-in-u-s-stores

This listing is a short list but can lead to many solid sources.  We would also like to acknowledge the SANS organization that provides all of us some well thought out background discussion on this topic in its newsbites publication.  

CONCLUSION: 

Integris Security would be falling short not to mention to our clients and prospects that security awareness starts before a breach, before an employee is let go, before the budget cycle crows no more.  Simple security awareness proves to be an effective first step in a series of steps required to withstand the hailstorm which now befalls Target and others.   Security is not something JUST for those high tech guys and gals to mull over and talk about.  The security discussion from the smallest to the largest corporation starts with the CEO and is a culture he/she causes to infect every single part of the corporation.   This is a difficult thing for some when nothing seems to be happening.  Like fire drills being prepared with worth billions as we now see Target is prepared to spend.  


UPDATE:  3/10/2014

Thanks to our members.  The truth about the Target Breach is getting out.  Here is the latest:

"Troy Leach, the lead security standards architect for the PCI Council, testified March 5 that the vulnerabilities of magnetic-stripe card transactions have to be addressed. But he stressed that a migration to more secure chip card technology that conforms to the Europay, MasterCard, Visa standard would not, by itself, eliminate all security risks. In fact, he contended that the use of chip cards would not have prevented the exposure of card data caused by the malware attacks against Target and Neiman Marcus."

http://www.bankinfosecurity.com/target-hearings-emv-enough-a-6607


UPDATED: 3/13/2014

http://www.businessweek.com/articles/2014-03-13/target-missed-alarms-in-epic-hack-of-credit-card-data

Business week outlines the missed opportunities that TARGET had to stop the bad guys at the front door.  Some generalization about what happened overseas as well as adding to "Who" dropped the ball.  We may live in a global society but what part of the "global" isn't getting the "Security" message - this is not clear.  Assertions have been made that if kept inside the U.S., this security failure would not have happened, but that is easier said then done.  It is to be seen if analyst have the time....with all the blown data breaches if "OUTSOURCING" is in fact a savings or part of the overall cost house.  In this case it would appear as though TARGET may have save some cash by keeping things in the U.S., but all of this is very much UNPROVEN at the time of this post.

Fact was that Target was one of the big box companies at the vanguard of security.  Perhaps in hindsight they have realized that the security staff in place was not as "state of the art" or as "progressive" as one needs to be given the size and complexity of a major corporation.  Then one needs to ponder is this a problem of a CIO, CTO, CISO or other security persons?  Or is this a total miscalculation of the CEO, COO, CFO and do shareholders derserve a say in whether these individuals have earned a long term seat at TARGET?  Truly a let down, a major disappointment of a highly successful retailer here in the U.S.

UPDATED: 3/17/2014
http://www.computerworld.com/s/article/9246942/Major_companies_like_Target_often_fail_to_act_on_malware_alerts

The blog is updated with this article to highlight the fact that technology alone will not solve the IT security issues.  Ongoing professional development, exercises that test the effectiveness of staff with combined with indepth knowledge, skills and abilities about onboarding specific security tools is not cheap, but is the likely candidate for success of any security team.  Combining human resources and effective tools such as Fire Eye is a receipe for success.  Not cheap, but for certain an investment worthy of a healthy report card for any major corporation.

Joseph Concannon