NIST SP 800-53 Revision Five is Coming

The draft publication of the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53, Security and Privacy Controls for Systems and Organizations, is on the street. 

This exciting publication, at least for us policy-geeks, makes changes to the structure of the controls to allow them to be adaptable to a wide range of missions; for example, mission and business focused enterprises, engineering organizations, those engaged in infrastructure design and their partners. There really is something for everyone.

The major changes to the SP 800-53 Rev 5 include fully integrating security and privacy controls by making them outcome based. Revision 5 clarifies the relationship between security and privacy to address all associated privacy risks. Controls have been consolidated and cross-mapped in tables to create a unified set of controls for easy reference between security and privacy.

Another major undertaking has been to separate the process from the actual controls, which allows organizations to easily adapt a control set to their mission. It comes in handy when engineers need to use a control differently than, say, a software developer, or business owner.

The SP 800-53 Rev 5 now makes it easier to integrate with other risk management and cybersecurity approaches i.e. ISO, ISACA, DOD, and NSS/IC. The various RMF’s are becoming more and more alike, which takes the strain off the beleaguered staff implementing them in complex environments.  

Other exciting revisions of the revision include incorporating new ‘state-of-the-practice” controls based on threat intelligence and empirical attack data, controls to strengthen privacy governance and accountability, new guidance on cloud, the Internet of Things, and booting the academic advice and tailoring guidance to other publications in the 800 series. This makes for a leaner, more impactful document.

Acronym-Slaw: GDPR and DPOs

The General Data Protection Regulation (GDPR), the European Union’s answer to strengthening privacy protections across its member states, is set to go into effect on 25 May 2018. As companies across the world doing business in or with EU organizations prepare to adhere to the tenants of the law, there are some controversial portions of the legislation that merit closer inspection. One of the acronyms that will be bouncing around the IT world in the ramp-up to implementation is that of the Data Protection Officer (DPO).

Who is required to have a DPO? If your business has more than 250 staff, you will be required to have one of these in place. Additionally, organizations that have ‘core functions’ of information processing that need consistent monitoring will be required to employ a DPO. 

This could be a boon for hiring, adding to the 3 million unfulfilled cybersecurity positions that will exist by 2021. In the immediate future, the GDPR will require about 75,000 DPOs, per the International Association of Privacy Professionals (IAPP). More likely, however, as the industry is constantly minding the bottom-line, this will be added to the many hats security managers already wear.

What are the knowledge, skills, and abilities your DPO will be required to have? He or she must be proficient in managing their employer’s compliance with the rules of the GDPR, train staff in GDPR provisions, as well as work with regulators regarding breaches, organizational performance with respect to risk management frameworks, and data protection measures. The DPO can be internal or external, but must be able to work and report independently to regulators. A DPO is appointed for a period of two years, which ensures job security.  

Want to become a DPO? You’ll need to have a strong background knowledge in privacy protection, as well as a certification that meets GDPR specifications, such as IAPPs Certified Information Privacy Professional (CIPP). The CIPP is broken down by region (Asia, Canada, EU, US Gov’t, US Private Sector) and the test to become certified will be updated in August. Information regarding the CIPP is available here:

https://iapp.org/certify/cipp/

Want to take the GDPR for a deep dive? It’s located here:

http://www.eugdpr.org/eugdpr.org.html

2017 Cybersecurity Vulnerability Trends

Looking at the state of Cybersecurity by news headlines, one would logically assume that ransomware is all security professionals must worry about in their day-to-day operations. The nemesis of the moment is Petya. Petya is a ransomware variant that is built on the chassis of a leaked National Security Agency exploit called Eternal Blue. The ransomware looks for unpatched Windows machines of all flavors running SMB 1.0.SMB stands for Server Message Block It’s an outmoded application layer file-sharing protocol that has been superseded by Active Directory and later versions of SMB. Petya encrypts your Master Boot Record, so that you can’t do anything while it works to encrypt the rest of your files. The result? You can either pay $300 in Bitcoin to some shadowy Russian hacking group and maybe get a decryption key for your files, or turn off SMB 1.0. To turn off SMB, you’ll need to navigate to your windows features setting, uncheck the offending service, and reboot.  

​But Ransomware isn’t the nightmare that should keep security professionals up at night. Indeed, a good backup policy mitigates any lapses in patch management. What should keep us up at night is our own state of being human. As humans, we are imperfect creatures. As much as we strive for greatness, there is always that one thing we might not have accomplished while juggling the many tasks of our daily rituals. Statistically, the vulnerabilities we see reflect the state of our profession.  

​Per the National Institute of Standards and Technology (NIST) National Vulnerability Database (NVD), the greatest threat of 2017 isn’t Ransomware, it’s buffer-errors, followed by improper access controls, information leaks / disclosure, cross-site scripting, and permission, privileges and access control weaknesses.

​Buffer-overflows? Okay, I get it. The development world is complex, and errors are going to happen. One of the beauties of our human condition is that we can always find better ways to do things, or, on the malevolent side, ways to exploit things. Luckily, protections against buffer-overflows are evolving using safe libraries, stack and executable containment strategies.

Cross-site scripting (XSS) has been on the security radar for a while now, yet it has declined from its height of 14.3% of all vulnerabilities in 2009, to its current 9.2%. XSS is a legitimate attack vector, and its decline in prevalence shows that developers and admins have been waging an effective battle against the threat. The industry focus on web threats has led to some interesting countermeasures, including containerization (essentially running a browser in its own virtual machine), JavaScript sandboxing, and Content Security Policies (CSP); all leading to effective mitigation of the threat.

​What should give security folks pause, is the rise in threats that stab at the very heart of our job description. Ensuring the confidentiality, integrity, and availability of information resources is what we do for a living. On a personal level, each of us should take offense that vulnerabilities exploiting access controls, permissions, and privileges even exist, let alone rank among the top threats to our networks. To be sure, buffer-overflows can lead to escalation of privilege, but we must not assume that security faults in controls and privileges are solely the result of software weaknesses. Certainly, NIST doesn’t take this approach as they have made buffer-overflows its own category, separate from access and privilege threats.

​So, what do we do? First and foremost, we should let go of our ego. Don’t assume that every security detail has been taken care of. Get in the habit of double-checking yourself, make sure those privileges and controls are properly set, and most important, still relevant. If security needs are not being met, double-down on ensuring your settings are up to date. Use those checklists, validate your templates, and adopt habits that put security first.

​Let’s make it a community goal to not see security essentials on the NVD vulnerability trends for 2018. 

What Hackers Really Want

By Rob Medley

19 June 2016

You’ve spent thousands of dollars on that new Intrusion Detection System, upgraded your firewalls and endpoint security.  You kick back, sip your latte and marvel at this titan of security that lies before you.  You’re confident that there is absolutely no way to break into the system; let them try.

Two months later, you’re standing in front of the CEO explaining the breach; the CISO sitting glum in a chair, having incurred the boss’s wrath prior to your arrival.  “How did the breach occur?”, the boss asks. “It’s not clear”, you say, “but it appears to be a privilege escalation that happened after a third party contractor fell victim to a phishing attack.”  A heavy silence falls on the room as the boss studies you, shredding any confidence you had left in getting that raise; you briefly wonder how many boxes you’ll need to clean out your desk.

This scenario plays itself out far too often across corporate America.  With the high profile attacks on LinkedIn, MySpace, iMesh, Tumblr, & GitHub, to name a few, it’s hard not to become jaded.  In fact, the ease with which hackers are able to penetrate networks and  steal passwords is becoming laughable.  Just this month it was reported that 45 million passwords were stolen from over 1,100 mainstream websites^[1].  In May, a Russian hacker was selling over a billion, with a ‘B’, passwords from major email providers^[2].  To be fair, it should be mentioned that there were only 272 million unique passwords.

With firms dumping serious cash into network defense, to the tune of 2.3 billion in 2015^[3], one must wonder why events such as those mentioned above come to fruition.  According to a recent Ponemon study, the average cost of cleaning up a data breach is $4 Million; that’s almost a third more than it was in 2013^[4].  Breaking that down further, network downtime is costing firms an average of $300,000 an hour due to incidents^[5].  In comparison, hackers are selling compromised servers for less than $10 dollars^[6].  That’s right, your multimillion dollar security scheme is worth less than the average trip to Starbucks.

If hackers are investing the time to break into systems, then selling the sensitive data therein for the price of a Whopper and fries, one has to wonder, “What do hackers really want?”  We all know that the motivation to break into networks and systems is as varied as there are people in the world; but network penetration can generally be grouped into financial motivation, curiosity, or hacktivism.  Regardless of the motivation, the psychological underpinning of any action is that the hacker wants a challenge.

Hackers tend to look at accessing resources as a game (Chess, not Call of Duty).  The psychological high that comes from winning is the reason most get into the intrusion game in the first place.  At the same time, hackers tend to view easy opponents with disdain, feeling that the ‘n00b’ who can’t defend his or her network gets everything they deserve, like publishing their entire user database online.  Yet in the hacker heart, they want us to not suck at network defense.  They hope defeating us will be more difficult than playing Mortal Combat with their three year old brother.

We defenders must do our part in this virtual chess game!  In addition to properly securing those new-fangled firewalls with more features/bling than Kim Kardashians closet, we have (as in really, people) to get our act together with regards to basic security hygiene.  Bling is fine after you learn the basics.  Let me ask, how long ago did your office update your network security policies?  Do you even have them?  One in four businesses do not have a basic security policy^[7].  Are you in the same boat as the Federal Government, with languishing policies as old as 2006? Just remember that in 2006 Facebook was new, flip-phones were cool, the iPod (with the wheel) was at its height, & IOS, Android, and Windows Vista were not part of our vocabulary yet.

In addition to updating policies for the present, your organization should stand up a risk management program.  The costs of one or two employees (better are consultants – I know one 🙂  to conduct audits of policy controls, NIST, ISO, or whichever framework you use, can save you hundreds of thousands of dollars in downtime.  These risk management professionals can also provide staff training to lock down the human aspect of hacking – social engineering (phishing, and whaling).  The end goal of all of this is not to suck at network defense.

Let’s face it; all of the technology in the world will not do any good if there are not sound security controls behind it.  Things like enforcing mandatory password lengths, expiry dates, lockouts – e.g. the basics of security, which seem to be at the root of these huge breaches, are what is needed.  By doing due diligence on these basic things, we make hackers happy.  It’s now harder for them to gain access into a system.  They are forced to spend more time trying to gain the prize and, conversely, we can spend more time playing with the technology toys that make us happy.  Not only will practicing basic security give the cybersecurity chess game renewed vigor; it will give us the respect of hackers.  If you haven’t got the respect of your opponent, what’s the point?

^[1] Nicks, D. (2016, June 14). Hackers Steal 45 Million Passwords From Over 1,100 Websites. Retrieved June 18, 2016, from http://time.com/money/4369098/hackers-steal-45-million-passwords/?utm_content=buffere9699

^[2] Wei, W. (2016, May 04). Hacker is Selling 272 Million Email Passwords for Just $1. Retrieved June 18, 2016, from http://thehackernews.com/2016/05/hacked-email-accounts.html

^[3] Reuters. (2015, September 22). Cyber security investing grows, resilient to market turmoil. Retrieved June 19, 2016, from http://fortune.com/2015/09/23/cyber-security-investing/

^[4] Olenick, D. (2016, June 15). Ponemon puts a $4 million price tag placed on mitigating data breaches. Retrieved June 18, 2016, from http://www.scmagazine.com/ponemon-puts-a-4-million-price-tag-placed-on-mitigating-data-breaches/article/503392/

^[5] Firewall Migrations: Five Ways To Maximise Security Resilience & Availability – Information Security Buzz. (2016, June 09). Retrieved June 18, 2016, from http://www.informationsecuritybuzz.com/articles/firewall-migrations-five-ways-maximise-security-resilience-availability/

^[6]Auchard, E. (2016, June 14). Cybercrime market sells servers for as little as $6 to launch attacks. Retrieved June 18, 2016, from http://www.stltoday.com/business/local/cybercrime-market-sells-servers-for-as-little-as-to-launch/article_fd775f99-3a04-5133-921b-feffeebc7f11.html

^[7] Hoffman, S. (2008, October 28). Corporate Security Policies Found Ineffective. Retrieved June 19, 2016, from http://www.crn.com/news/security/211601180/corporate-security-policies-found-ineffective.htm

The Power of Two-Factor Authentication

By Rob Medley
June 11, 2016

With the news of numerous hacks in the last few weeks, it’s not far-fetched to propose that people are worried.  Not only is the individual user concerned about theft of personal information and password databases from the likes of Myspace, LinkedIn, Twitter, and the Office of Personnel Management, but business owners, particularly small business owners, are increasingly becoming the victims of hackers.

While it’s become a joke for large corporations to apologize to consumers, hand out 12 months of nearly worthless identity theft protection, then hide behind a phalanx of lawyers, small business owners do not have that luxury.  In a recent survey, the Federation of Small Businesses (FSB) reported that 93% of small business owners have some type of cybersecurity initiatives in place[i].  93% is a good start.  Where it becomes troublesome is that two-thirds of these same businesses surveyed have been victims of cyber-crime in the last two years. Two-thirds! Adding the seven percent that is blissfully unaware of the dangerous online environment surrounding them, that’s seven out of every ten business owners being victimized; the rest are just lucky.

At the heart of what we are talking about is basic security hygiene.  There are plenty of simple things netizens and businesses can do, yet choose not to, because they are focused on other things, such as meeting production, revenue and other business goals.  The security world is still dealing with easily guessed passwords after 30+ years of telling people not to use them.  If you look at the news surrounding the LinkedIn and Twitter hacks, the same supremely weak passwords are still showing up, ‘123456’, ‘password’, ‘Redskins’, etc.  Some think they are being smarter than the hacker by using number substitution, e.g. ‘10v3’ instead of ‘Love’.  Believe me when I say these are just as weak; common automated hacking programs run these variations by default.  Indeed there is no truly secure password, but by combining random alphanumeric and special characters, you’ll increase the time to hack the password – meaning you are no longer the low-hanging fruit.  The problem?  These complex passwords are no longer easy to remember, so they are written down; totally defeating the purpose of the endeavor.

Enter password managers and two-factor authentication.  This rock-star duo can make your life much less complicated.   By using a password manager such as Last Pass or Dashlane, you can store and sync all of your passwords online.  Highly dangerous you say?  Dashlane for example prompts you to create a master password, one that if you forget it, you’ll lose access to your account.  Since the company uses very strong encryption, and doesn’t have access to your information, neither do hackers.  Why?  Often the weak point of business architecture is some procedural vulnerability that allows the hacker to access your hashed or (God forbid) data stored in the clear on the company servers.  You can also enable text message authentication via mobile phone or access via a smart key, such as Yubi-key.  These secondary authentication measures prove much more difficult to circumvent as you are combining something you know with something you have.

A cautionary note on using your mobile number as a second factor of authentication, please log in or call your service provider and add a pin requirement or text message notification of any attempts to change that account information.  If you leave it at just a password, a hacker can gain access to your privacy data (name, date of birth, address, social security number, etc.) from other sources, e.g. LinkedIn, Twitter, Facebook, and hijack your phone number.  If successful, a hacker can work around the cell phone as a second form of identity verification.

Hackers are very smart people.  I respect their knowledge and dedication.  However, they are often able to achieve success because of a lapse in policy, procedure, or basic security hygiene principle on the part of the individual or business.  While large corporations can absorb the damage and loss of reputation from a breach, the small business and individual cannot.  Paying attention to topics such as governance and policy can help save the business heartache down the road.  As a business or even an individual, if you are too busy to focus on these areas, people like me are at your disposal.  Reaching out to a consultant that can help you overcome these obstacles can save time, money, and reputation down the road.

 

Rob Medley operates Policy Assured, LLC – a veteran-owned information assurance company.

[i] Small businesses bearing the brunt of cyber-crime. (2016, June 10). Retrieved June 11, 2016, from http://www.fsb.org.uk/media-centre/latest-news/2016/06/10/small-businesses-bearing-the-brunt-of-cyber-crime

That Was Refreshing! – A New Spin on Cybersecurity Training

By Rob Medley
June 6, 2016

Mention deadlines for completing yearly security awareness Computer Based Training (CBT) and you will undoubtedly get the eye-roll from staff.  “It’s boring”, “it’s the same thing every year”, “employees have more important things to do”, and “how about those deadlines” are the excuses you will encounter in attempting to teach security to your organization.  Worse, you may run into the invariable excuse that it’s not their job to practice security; rather, it’s your job to protect them.  This attitude often leads to an adversarial relationship between IT staff and operations; impacts security, unit cohesiveness and the bottom line.

In 2015, Kaspersky Labs, an antivirus solution vendor, detected 121,262,075[i] malicious threats, e.g. viruses, scripts, exploits, etc.  The number in itself, 121 million, is staggering, but let’s put it into perspective – that’s one antivirus vendor.  I can think of at least six others off the top of my head, and conducting more research would triple that figure; adjusting for overlapping discoveries by the different vendors.  A vast majority of these threats come from phishing and emailed malware (links, documents, or programs).  What’s the common thread here?  That’s right – people.

So what can we, as IT managers, do to increase success outcomes of our yearly training? How do we prevent the very things that operational staff seems hell-bent on doing? Or are we doomed to failure?  Fortunately, there are things that we can do in order to spice up our programs and on-board the requisite knowledge to reluctant learners.  Heck, if we do it right we can even make security awareness training fun!

Don’t Throw Out the Bath Water – Add More Bubbles!

First and foremost, our CBT’s can’t be boring or tedious.  Ask staff why they roll their eyes at you when you ask if they’ve completed the training, and they’ll say it’s too academic or robotic.  If you must use CBT’s, some things you can do to mitigate this apathy are to change the content each year.  Don’t have a voice-over, which you can’t disable, reading a slide saying the same thing.  Through reading, the brain can process this information much faster.  A better choice would be to have that voice-over giving information that is not on the slide.  This technique increases the complexity of the teaching, and engages the learner’s multi-tasking capabilities.  After all, we’re not first-graders.  Next, challenge the learner’s ego by giving them a test-out option at the beginning of each module.  Let them know that if they’ve got a firm grasp on the information, they can bypass the module, thereby completing the training faster, and being able to get back to making that sale; or surfing the Net.  As a rule, however, make the test-out option hard; you must make sure they really know the information.

Moving beyond the CBT, there is a world of creative ways to excite employees to practice better security hygiene.

Storm the Bastille – Replace the CBT

                Have you thought about replacing the CBT altogether?  One way of doing this is to have brown bag lunches, out of office lunches and / or coffee dates with groups of employees.  This requires the IT training team to become effective facilitators and storytellers.  Step one in this approach is to use a scaffolding technique[ii] wherein the facilitator holds an informal talk highlighting the security issues that most impact the organization.  He or she then gradually facilitates the other members of the group to share their experiences within the context of the discussion; thereby reinforcing the information, using their experience as a basis to teach[iii], and showing them the respect they deserve as adult learners.

Don’t Be the Boring IT Guy

People hate things that aren’t exciting, and people too.  They’ll tune out and move on in their head as to what they’ll eat for lunch or who they’ll meet for Happy Hour.  A way to not be boring is to tell stories.  Storytelling techniques[iv] are the most effective teaching and learning strategy a person will encounter.  Effective storytelling will help your audience categorize and retain the information you are providing, as well as incite them to action.  Using humor along with storytelling techniques can help a person retain that information for even longer.  Literally, it’s the difference between watching an ‘Austin Powers’ movie and ‘C-Span’.

Here’s a Mountain – Compliments of Management

A powerful motivation tool is to give someone something.  If you stimulate their natural competitiveness and desire for free stuff, you can motivate them to learn.  A cheap way an organization can do this is by holding monthly security trivia contests – with prizes, such as free movie tickets or a dinner for two.  “What?” you say, “Give them something for something they should be doing already?”  Sure. If you publish the security topics you wish to stress each month in trivia form, thereby making security an ongoing, relevant topic; and make it worth their while by moving the mountain to them, employees will respond positively to the initiative.  In fact, they will look forward to the next month’s topic, maybe even engaging in research on their own, to win those prizes.  At the least, $360 a year in free stuff is better than a $60,000 dollar incident clean-up.

No, Really It’s Your Job – How Security Affects Them

                You will always have the intractable staff-member who believes it really isn’t in their job description to practice security hygiene.  To break through to this employee, it is essential to relate to them how their behavior impacts their performance, their reputation, and the company bottom line.  It’s necessary to do this in a way that won’t alienate the employee – as we’ll talk about in the next section – but to appeal to their need to do a good job.  Everyone wants to be good at what they do, right? It’s a basic tenet of Maslow’s Hierarchy of Needs[v].  By engaging in security best practices, they fulfill their basic need for a job (proving shelter, food, and stability), their need for belonging to something (the group, their team-mates & co-workers), as well as esteem and self-actualization needs (doing a great job, not costing the company tons of money to fix an incident).

On Trust and Alliances – and Burning Tires

A critical step in the process is to eliminate the perception that non-IT staff are threats, and telegraph that to them.  By patronizing staff and reprimanding them when they click on that link or do something otherwise regrettable, we IT staffers must make it known that there won’t be reprisals.  The worst thing one can do is to establish a culture of fear in the organization.  By doing this, employees will be more reluctant to mention that they made a mistake, or that they noticed something weird when they opened that PDF or Word document.  By embracing a forgiving policy, employees are no longer considered part of the threat environment; rather, they are a layer of defense.  Of course this attitude requires your IT staff to be on top of their game, which they already should be, in order to investigate and mitigate any reported activity that bears out an actual threat.  Think of your security environment like it’s Mogadishu in the early 1990’s, when the Somali warlords used a network of spies to let them know when the Americans were coming to the Bakara Market district[vi] – your users are your spies burning tires in the streets to alert you to malware intrusions.

What have you done besides gaining an ally when you treat users with respect and tolerance?  You get employees curious.  Curious employees ask questions, asking questions sparks the fires of learning, resulting in deeper engagement[vii].  When you give constructive feedback to a user that fell victim to the phishing email or clicked on that link, you get them asking the questions:

“Why did I make this mistake?”

“What is working well in training and what could be better?”

“What can I do better in the future?”

“How does this mistake impact the team?”

Parting Thoughts

As an IT manager and training staffer, you have to think out of the box.  Traditional techniques of conveying security awareness are faltering in the face of increasing malicious activity on the triple ‘W’.  Keeping your non-IT staff engaged, proactive, and learning about emerging exploitative techniques and their countermeasures, you directly impact the bottom line of your organization.  By selling the C-Suite and investors on your efforts and results, you also improve your rock-star image in the enterprise.

[i] Namestnikov, Y., Ivanov, A., Makrushin, D., Van Der Wiel, J., & Garnaeva, M. (2015, December 15). Kaspersky Security Bulletin 2015. Overall statistics for 2015. Retrieved June 06, 2016, from https://securelist.com/analysis/kaspersky-security-bulletin/73038/kaspersky-security-bulletin-2015-overall-statistics-for-2015/

[ii] Successful Strategies for Teaching Students with Learning Disabilities. (2013, October 14). Retrieved June 06, 2016, from http://ldaamerica.org/successful-strategies-for-teaching-students-with-learning-disabilities/

[iii] Strang, T. (2014, August 20). Teaching Techniques that Motivate Adult Learners. Retrieved June 06, 2016, from http://blog.cengage.com/teaching-techniques-motivate-adult-learners/

[iv] Franconeri, S., Choy, E., & Buck, M. (2015, October 12). Podcast: The Power of Persuasive Storytelling. Retrieved June 06, 2016, from http://insight.kellogg.northwestern.edu/article/the-power-of-persuasive-storytelling/?utm_source=lal

[v] McLeod, S. (2014). Maslow’s Hierarchy of Needs. Retrieved June 06, 2016, from http://www.simplypsychology.org/maslow.html

[vi] Alexander, P. (2013, October 3). Fallout from Somalia still haunts US policy 20 years later. Retrieved June 06, 2016, from http://www.stripes.com/news/fallout-from-somalia-still-haunts-us-policy-20-years-later-1.244957

[vii] Rose, C. (n.d.). 10 habits of successful learners. Retrieved June 06, 2016, from http://acceleratedlearning.com/ali/10-habits-of-successful-learners/

This Isn’t Your Daddy’s Malware

How do you feel about paying up to $50 dollars a year to an antivirus vendor in order to protect your computer, network and other IT assets in your home?  Do you grumble that it’s a necessary bill? Or do you think that it’s the best thing since sliced bread?  Turns out, your antivirus is likely akin to one of those old guards you see in the movies, physically there, but sound asleep when the intruders come for the bonds in the Nakatomi vault.

A couple years back, executives at Symantec declared the end of the age of the antivirus[i].  The security industry laughed and said, “You think?”  But the average home user has been unaware of the advancements in malware construction that led to the death of this noble service; being left to put blind trust in products that do little more than to act as doorman to the threats from outside.

One of the biggest advances in malware manufacturing was the creation of the ‘crypting’ cottage industry.  What is crypting?  It’s a service provided to malware producers on the back-channels of the Internet; wherein the creator of the malware will send his code to a third-party.  The third-party will take the code and run it against all the established anti-virus manufacturers’ products.  If a particular product detects the code a malicious, the third party will write encryption to render the code undetectable to the product.  It’s much like the antithesis of virus submission to antivirus vendors.  The process is called FUD, or ‘fully undetectable’; and also goes under the acronym CAV, or ‘Counter-Antivirus.[ii]’

Have no doubt that these crypting services are big business, with enterprise setups in the deep, dark-web that rival some legitimate corporations.  With appropriate encryption retained, the malware can have features included in the design such as sandboxing, virtual machine checks, creation of auto-run executables, among other things[iii]

Truly, the age of cyber-crime as a service has arrived.  Malware writers these days can even legitimize their malware, e.g. have it digitally signed, through the creation of forged certificates from seemingly legitimate sources.  The additions of these forged certificates allow the malware to operate within the affected network environment for longer periods of time prior to detection[iv].

So now that the boogey man is out of the closet, so to speak. Do you, as a consumer, need to pay for an antivirus solution? The answer is ‘no[v].’  It’s nice to look at the box in the toolbar and see that icon, but honestly, if a hacker is going to target your system, they are going to use something new, or turn a detectable threat into a FUD threat.  You can stop wasting your money and just use the free alternatives provided with your Windows platform, and free services can be obtained for other platforms.

The better way to protect your network rests not with your antivirus, but within you.  Your parents always warned you not to take candy from strangers, and it still applies today.  Don’t open suspicious or ‘too good to be true’ emails; watch were you dangle your line in the dark waters of the Internet; check certificates, and have a healthy suspicion of activities on your system.  Learn to spot out of the ordinary occurrences, network slow-down, resource hogging, funny command windows popping up on your screen, and quirky processes in your task manager.  All of these options will lead to a decreased attack surface on your system or home network.  You also have a few extra bucks in your pocket.
Rob Medley – 6.3.16

[i] Krebs, B. Q. (14, May 14). Antivirus is Dead: Long Live Antivirus! Retrieved June 03, 2016, from http://krebsonsecurity.com/2014/05/antivirus-is-dead-long-live-antivirus/

[ii] Digital Shadows. (2015, December 18). Retrieved June 03, 2016, from https://www.digitalshadows.com/blog-and-research/criminal-services-crypting/

[iii] Kharouni, L. (2015, October 12). Ties Between Corebot and Darknet Crypt Service. Retrieved June 03, 2016, from https://www.damballa.com/corebot-and-darknet/

[iv] Kharouni, L. (2015, September 21). The Darknet is Thriving & Diversifying with Cybercrime-as-a-Service. Retrieved June 03, 2016, from https://www.damballa.com/the-darknet-is-thriving/

[v] McMillan, R. (2012, March 2). Is Antivirus Software a Waste of Money? Retrieved June 03, 2016, from http://www.wired.com/2012/03/antivirus/

The Cybersecurity Expert You Won’t Hire… But Should

According to Forbes magazine, spending on Cybersecurity reached $75 billion in 2015, and is expected to reach $170 billion by 2020[i].  Expected growth areas include security analytics and threat intelligence, each expected to grow 10 percent; governance, risk and compliance by 14%; mobile security by 18 percent, and cloud security by a whopping 50%.

As the world moves increasingly online, cybersecurity can only be expected to continue this growth pattern well beyond 2020.  Evolutions in cyber-attacks have driven the expansion of these technology sectors.  For example, in 2014, businesses reported 42.8 million detected attacks world-wide[ii].  The United States Government has responded to the rise in computer attacks by establishing programs to create cyber-warriors, such as CyberCorps®, policy initiatives such as the National Cybersecurity Framework, and huge investments in security research and development via the Office of Science and Technology Policy (OSTP)[iii].

And yet, the United States remains behind the eight-ball with regards to security of our networks and critical data.  China, with its corps of 100,000 dedicated hackers[iv] , repeatedly out maneuvers the U.S. on the cyber-playfield.  According to Michael McConnell, former Director of National Intelligence under President Bush, the Chinese “have penetrated every major corporation of any consequence in the United States and taken information. We’ve never, ever found Chinese malware.”  Considering the opposition we are up against as a nation – China, Russia, Iran with extensive cyber-programs; allies who sweet talk us but are digging in our cyber-trash at the same time, terrorists bent on our destruction, for profit hackers, and joy-riding script-kiddies – we need every cyber-warrior we can get our hands on.

So how is America doing in increasing our IT forces?  Honestly, not so well.  CyberCorps®, the national program to increase our cadre of professionals, has only produced 1, 500 graduates.  That’s a paltry number considering that China has penetrated and downloaded “the entire contents of the Pentagon’s mainframe computers at least seven times,” and an NSA review of CIA computers revealed approximately 1,500 pieces of installed malware; at least according to a source that may or may not be Gen. Keith B. Alexander, most recently head of U.S. Cyber Command[v].

This is not to say that we as a nation are not trying, we are, but we can be doing a lot more.  Aside from increasing throughput in cyber-programs at American universities, boosting Science, Technology, and Math (STEM) programs, and throwing more money in general at the problem, business and government leaders can utilize the resources right under their noses – those cyber-warriors suffering from mental health disabilities.

We all know that there is racial, gender and sexual discrimination in all aspects of society, the news outlets can’t stop reporting on these.  Yet, there is another group that suffers discrimination as much, if not more than others – those with mental illness.  You may be tempted to say, “Ridiculous, there is no discrimination like that!”  I’m here to change your mind.  I’m one of the depressed masses.

Before I tell you my experience of being a jobless cyber-knowledgeable, degreed and superfluously certified professional, allow me to regale you of the population in general.  People with mental illness account for about six percent of the total population, and among this monolithic group are subsets of bi-polar, schizophrenic, and just plain depressed people.  We don’t like to be grouped together, and are kind of at odds with each other as far as the direction of our awareness cause.  The schizophrenics always want to count all of their personalities, while the manic-depressives think big, but are gone when we make up the flyers.  It ends up being something like a Monty Python sketch.

Despite of this, mental illness awareness is starting to gain traction nationally; we even have our own month now!  Although response is growing, people with the disease still face more discrimination than the LGBTQ community.  After all, if someone is ‘mentally ill’, they have to be a loner, packing stacks of firearms in their basements, waiting for the right moment to explode – it’s the same subconscious narrative people get when someone of Muslim origin gets on a train and is sporting a backpack.  Both stereotypes could not be further from the truth, but in an age of people getting their news from social media, and establishment journalism itself languishing in a perpetual funk, the narrative is hard to change.

Indeed, people with mental illness, such as major depression, are five times as likely to be unemployed[vi] verses their ‘normal’ counterparts.  As of 2006, that translates to 60% of working age adults with mental health disabilities likely to be out of work, verses 20% in the non-disabled population.  One in three job applicants with mental health disorders reported being turned down for a job outright or being downsized once their mental health history was known.  Of course, the government has programs in place to prevent discrimination, such as the Americans with Disabilities Act, and ‘Schedule A’ employment opportunities, but they do not work once human bias enters the equation.  There is always something that an employer can use to disqualify an applicant; lack of experience, closing the position, etc.

In my own case, I have applied for approximately 500 jobs since I left the Navy in 2014; after 22 years of service.  I suffer from major depression.  I’ve been in regular treatment since 2012 but have been on and off through the system since about 2002. I’m highly skilled, have an impressive work history, speak a few languages, have advanced degrees in Cybersecurity and Strategic Intelligence, as well as the obligatory technical certifications.  Looking at me, you wouldn’t guess I have major depression, because I’m at my most vulnerable when I’m alone with my mental merry-go-round of a subconscious narrative.  I smile, I laugh, and I’m an outstanding leader (if you ask people who have worked for me) – so why is it so difficult to get a job?  Moreover, why is it so hard to get a job in a critical sector?  After all, I have a TS clearance that’s valid – there is absolutely no reason for me to not be working.

If you surf the government clearing house for jobs (USA Jobs), you’ll see tons of jobs for cyber, but it’s to the point now where I don’t cry (figuratively) anymore when I get the ‘lacking requisite experience’ rejection for the job that describes me to a ‘T’.  Why? I realize my error. I tell people up front I suffer from major depression.  Honesty, it’s a weakness….  I guess doing that makes the life of the HR guy easier – you’re welcome, but you’re doing a disservice to your organization and your country.

Exclusion from the work force does a lot of damage to both the person with mental health disabilities and the economic fabric of the country.  Exclusion “creates material deprivation, erodes self-confidence, creates a sense of isolation and marginalization and is a key risk factor for mental disability.”[vii]  In short, employer bias is making us crazier, forcing us onto Social Security and other programs (full disclosure, I’m on neither) when they could attempt to see past the narrative and employ cyber-professionals that want to work, want to be a contributing member of society, and could be that person who stops the eight full download of Pentagon computers by the Chinese military.

Maybe tomorrow when you get to work, go through those applications you’ve rejected due to bias.  You’ll be doing your part to make the world a better place, decrease homelessness and public assistance, reduce your taxes (got your attention, right?), and most important, you’ll be getting an employee that will work harder than your normal ones.

Rob Medley is a starving artist and cybersecurity expert writing blogs after midnight to pass the time.

[i] Morgan, S. (2015, December 20). Cybersecurity Market Reaches $75 Billion In 2015; Expected To Reach $170 Billion By 2020. Retrieved June 02, 2016, from http://www.forbes.com/sites/stevemorgan/2015/12/20/cybersecurity-market-reaches-75-billion-in-2015-expected-to-reach-170-billion-by-2020/#17b09c962191

[ii] Lingenheld, M. (2015, April 27). The Unfortunate Growth Sector: Cybersecurity. Retrieved June 02, 2016, from http://www.forbes.com/sites/michaellingenheld/2015/04/27/the-unfortunate-growth-sector-cybersecurity/#7080e9205a7e

[iii] Presidential Policy Directive — Critical Infrastructure Security and Resilience. (2013, February 12). Retrieved June 02, 2016, from https://www.whitehouse.gov/the-press-office/2013/02/12/presidential-policy-directive-critical-infrastructure-security-and-resil

[iv] Lingenheld, M. (2015, April 27). The Unfortunate Growth Sector: Cybersecurity. Retrieved June 02, 2016, from http://www.forbes.com/sites/michaellingenheld/2015/04/27/the-unfortunate-growth-sector-cybersecurity/#7080e9205a7e

[v] Thomas, J. (2016, June 02). The 10 Baggers In Cybersecurity. Retrieved June 02, 2016, from http://seekingalpha.com/article/3979451-10-baggers-cybersecurity

[vi] Stuart, H. (2006). Mental Illness and Employment Discrimination. Retrieved June 03, 2016, from http://www.medscape.com/viewarticle/542517_2

[vii] Stuart, H. (2006). Mental Illness and Employment Discrimination. Retrieved June 03, 2016, from http://www.medscape.com/viewarticle/542517_2

 

LinkedIn bested by MySpace, but not In a good way

By Rob Medley
31 May 2016

Did you think the LinkedIn password hack of 2012 was bad? Apparently, MySpace has called up Guinness to claim they have beaten the record 6.5 million password leak… 65 times over.

That’s right, in an effort to cut down on sodium, like their competitive brethren, MySpace has allowed access to an amazing 427 million passwords. The unsalted hashes of passwords stored on their servers now rest in the hands of unknown nefarious forces.

It seems basic security and common sense would prevail in #network #security, but often it does not. It’s actually easier to offer 12 months of credit monitoring than to do the right thing.  But why pay for credit monitoring in the aftermath of a breach, when you can protect your passwords with simple #encryption to begin with?

It may be time for all IT staff, even the ones doing an outstanding job (this is not aimed at you), to pull down the NIST 800 series and review #controls. At the minimum, pull out the CISSP, Security+, CEH and other material you’ve got sitting on your shelf from when you took the exam(s) and just read. Heck, make it a group thing and have a book club party, like in the old days – except with beer and nachos.