CTOvision.com

Context for the CTO, CIO, CISO and Data Scientist

You are here: Home / Archives for Bob Gourley

Bob Gourley

CISO-as-a-Service: When your enterprise needs cybersecurity expertise on demand

Your business operates in a world where there is an incredibly high demand for cybersecurity talent. Now with unemployment at a 50 year low there are no indications that anything can be done to dramatically increase the pool of cybersecurity talent.

Enterprise grade cybersecurity requires enterprise grade experience.

How do you get that in today’s business environment?

For many the answer is to leverage CISO-as-a-Service. By tapping into the expert talent of professionals at OODA LLC, you can put our team of experts on your side and take immediate advantage of our decades of experience in mitigating risks and meeting corporate objectives in security and compliance. Our experts come with deep experience in rightsizing security programs and reviewing security spend as well.

For more see: OODA LLC Security Services

A Common Language for Computer Security Incidents: The Cyber Defense Taxonomy That Started Them All

Cyberspace is our interconnected information technology. And since everything either is or is becoming connected, one of the defining characteristics of cyberspace is its complexity. This adds burden to cyber defenders. Defense teams require experience, education, training and a mindset that lets them continually learn. They also must forge broad teams across multiple subject and functional areas. An ability to rapidly collaborate and exchange data while in a fight is a must.

For years computer security professionals have sought the best ways to dialog on incidents, and some great foundational work has been done in this area.  This post reviews a work found to be of special relevance to today’s cyber defenders, a 1998 publication titled “A Common Language for Computer Security Incidents.”  This foundational work is important since it is a bit of a stage setter relevant to all the current work I see on standards for information exchange and even human dialog/discussion.

What is a taxonomy?

A taxonomy is a set of related terms. It is a classification scheme. How do you judge a good taxonomy?  It should meet several criteria, including being:

  1. Mutually exclusive – classifying in one category excludes all others because categories do not overlap,
  2. Exhaustive – taken together, the categories include all possibilities,
  3. Unambiguous – clear and precise so that classification is not uncertain, regardless of who is classifying,
  4. Repeatable – repeated applications result in the same classification, regardless of who is classifying,
  5. Accepted – logical and intuitive so that categories could become generally approved,
  6. Useful – could be used to gain insight into the field of inquiry

Caution: there is probably no such thing as a perfect taxonomy. They are all approximations of reality and therefore you will never have one that meets every criteria perfectly. But the characteristics above are good goals to judge the taxonomy by.

When it comes to cyberspace activity, the taxonomy presented by John Howard and Thomas Longstaff comes pretty close to meeting those goals which is why it is still so relevant today.

They define a taxonomy of terms in a way that can be logically and graphically expressed.

See, for example, the picture below:

incidenttaxonomy

This is from their report and it lets you related terms in a way that can help in dialog between humans and also help in automating information exchange.

The top line of words can be easily thought of as a sentence. Attackers use Tools against Vulnerabilities to cause an Action against a Target to achieve an Unauthorized Result to meet an Objective.

The details of their work spell out with clarify what the individual terms are and that is also a huge help to dialog. Over time there has been a little modification by operational users on some of the terms, and the adversaries in cyberspace have continued to change their craft and a few more terms have entered the lexicon.  But overall the framework is sound.

Since this first ground-breaking work the community has continued to improve on this notion, converting concepts into processes and standards and influencing the technology used in cyber defense. Some of the greatest work in this domain is coordinated by MITRE. I’ll make that a topic for future posts, but for an overview of their current work see: MITRE Cybersecurity Standards and especially the MITRE ATT&CK Framework. Modern defenders benefit greatly from these approaches. As you dive deeper into modern standards and frameworks for cybersecurity, keep in mind how it all began, with a great taxonomy from John Howard and Thomas Longstaff published in 1998.

More Reading:

For more on these topics see the CTOvision Guide to National Security Technology and

CTO Guide To The Business of Cloud Computing

This is the CTOvision guide on the megatrend of Cloud Computing. This report gives a high level overview of the most important factors of the trend, gives updated insights into the activities of the major Cloud Computing companies, and succinct descriptions of Cloud tech. It also points to key CTOvision reporting to help readers dive deeper into the topic.

What Is Cloud Computing?

We succinctly describe Cloud Computing as the scalable delivery of computational resources. Models of cloud compute include public clouds, private clouds and blends in between. Architectures are in place now that leverage tiers of clouds that can exist in multiple sizes and locations, including homes, businesses and datacenters.

Key Observations:

  • Although it can cost additional resources to embark on a cloud transition effort, in most cases after initial outlays there are significant cost savings. Commercial Cloud Computing providers are know widely known for their revising costs down and we see that trend continuing.
  • A new consensus is forming regarding security and cloud capabilities. Well engineered clouds can be far more secure than the typical Internet connected enterprise. A favored technique for enhancing enterprise security in a way that supports cloud computing models is a Software Defined Perimeter (SDP).
  • Agility of the Cloud Computing model is helping innovators innovate and developers develop, and in many cases this is the greatest benefit of the approach. Agility in service to mission and business needs is far more important than cost savings.
  • New forms of Cloud Computing include ultra-small data centers which can function as internal clouds. Versatile small form-factor data centers can be bought in containers and put anywhere.
  • Cloud plus IoT = Fog Computing, an architecture of multiple collaborative end compute devices. The term Fog Computing might never take off the way Cloud Computing will, but consider the new model regardless of what you call it.
  • Interesting observation: Over the last decade it seems the edge was moving to the datacenter then the cloud. Now the cloud is moving to the edge. It is doing so by devices like Amazon’s Snowball Edge, which brings the power of EC2 compute to remote locations.
  • Amazon can be rightly credited with kicking off the current wave of business focused cloud computing with Jeff Bezo’s Risky Bet.

Open questions decision-makers should track include:

  • Will the big cloud providers be monopolies?
  • Will the future Internet be “walled gardens?
  • How will nations settle data retention disputes?
  • How do we move compute across tiers?
  • How do we transition from legacy compute to new cloud models?
  • How can we reduce the ability of adversaries to use cloud computing capabilities?

Due Diligence Assessments and Cloud Computing

The trend of Cloud Computing is an increasingly important element of corporate Due Diligence since it is so disruptive business models.

  • On the sell side: Firms should ensure their use of cloud services is done securely and that mitigation strategies are in place for issues. Doing this before sale can make a big difference in how well a firm will be valued.
  • On the buy side: Buyers should pay particular attention to the use of cloud services to ensure a well thought out architecture that mitigates risks. External and independent verification and validation of security policies and practices should include a review of the cloud architecture, as well as the degree that the target is complying with appropriate compliance regimes.

Strategically, the acquisition of technology firms is an art requiring assessment of how unique the capability is and how much in demand it will be in the market. We provide due diligence consulting via our parent company, OODA LLC.

And additional resources:

Cloud Computing Companies in the CTOvision Disruptive Technologies Directory

[wp_show_posts id=”108722″]

There are seven key megatrends driving the future of enterprise IT. You can remember them all with the mnemonic acronym CAMBRIC, which stands for Cloud Computing, Artificial Intelligence, Mobility, Big Data, Robotics, Internet of Things, CyberSecurity.

Recorded Future Posts Assessment on Geopolitical and Supply Chain Risks From the Huawei Monoculture

I’ve been reading cyber threat intelligence assessments since the beginnings of the digital age. Not sure if I’ve seen a million of them but it sure seems like I have. I feel like the one I just read by Priscilla Moriuchi at Recorded Future is one of the best and I would like to endorse it to you for your review.

You really need to read the full report so I will not really summarize it here. But I will provide a couple of anecdotes on why it is so important.

The subject is Huawei. More specifically, the report deals with the supply chain risks posed to nations, companies and individuals who use Huawei products and services. Huawei is widely known in the tech community for years of aggressive unfair competition in pursuit of networking contracts around the globe. They moved from networking equipment into many other fields including production of smartphones and other mobile devices. They are a major builder of next-generation cellular networks (5G).

Many national security professionals or technologists point out the security issues with Huawei. The fact that they are influenced by a country where the rule of law is subservient to the Chinese Communist Party (CCP) means they should be treated with suspicion. Globally, governments have hinted that there are many other risks and there have been public releases of some of their rationale there, but given that citizens of open societies don’t always trust their own governments the information being released by governments is not always treated as valid.

One highly respected enterprise technologist recently asked me: “Are you really afraid of Huawei?” I replied: “I am not afraid but the fact is they are under the influence of a Communist party that does not have our interests in mind.”  I can’t say I was able to change the mind of my friend, but might have, if I had been armed with the insights provided by Recorded Future.

During a recent visit to Japan I was placed in the uncomfortable position of having to tell many senior executives about the risks they are taking by working with many CCP controlled firms, including Huawei. Agreements with telecom companies and vendors are giving Huawei smart phones premium placement in most consumer facing stores, for example. The risks Japan is taking will be hard to mitigate and the relationships being established will be hard to reverse. But, if they are informed by facts they can make better decisions. This is another reason I was glad to see this report.

With that said, I would recommend you take time to read the entire report. I’ve decided to read it enough times to commit it to memory. Find it at:

https://www.recordedfuture.com/huawei-technology-risks/

We track Recorded Future in the CTOvision Guide to Technology as a Cybersecurity Firm with a focus on Cyber Threat Intelligence

Video overview of how robots and automation are changing the workforce

We found this video to be an interesting overview of how robots and automation may be changing the workforce:

Robots are already changing jobs as an endless array of robots enter our everyday lives. From trucking to service work to high-end jobs like doctors and lawyers, this documentary explores how robotics and artificial intelligence are changing the workplace.

AJ+’s documentary series on automation explores how advancements in artificial intelligence, robotics, machine learning and automated vehicles will affect jobs, cities and inequality. From trucking to radiology, new technology is already changing white collar and blue collar occupations, reshaping cities and concentrating wealth in the hands of the few. Robots are taking over the world as companies like Tesla, Amazon, Uber and Google are using robots to automate.

 

Could This Be The Real Reason to be Afraid of Artificial Intelligence?

A robotics researcher afraid of robots, Peter Haas, invites us into his world of understand where the threats of robots and artificial intelligence really are.

In his view, we really need to worry about the bias and ethical issues around AI.

And he worries even more that we humans don’t understand how these algorithms work.

Peter is the Associate Director of the Brown University Humanity Centered Robotics Initiative.

 

 

Quantum Computing for Everyone

We have been tracking quantum computing for decades now. But seems like the more we study the behinder we get!

Quantum computing is a beautiful fusion of quantum physics and computer science, incorporating some of the most stunning ideas from twentieth-century physics into an entirely new way of thinking about computation.  In Quantum Computing for Everyone, Chris Bernhardt offers an introduction to quantum computing that is accessible to anyone who is comfortable with high school mathematics. He explains qubits, entanglement, quantum teleportation, quantum algorithms, and other quantum-related topics as clearly as possible for the general reader. Bernhardt, a mathematician himself, simplifies the mathematics as much as he can and provides elementary examples that illustrate both how the math works and what it means.

Bernhardt introduces the basic unit of quantum computing, the qubit, and explains how the qubit can be measured; discusses entanglement—which, he says, is easier to describe mathematically than verbally—and what it means when two qubits are entangled (citing Einstein’s characterization of what happens when the measurement of one entangled qubit affects the second as “spooky action at a distance”); and introduces quantum cryptography. He recaps standard topics in classical computing—bits, gates, and logic—and describes Edward Fredkin’s ingenious billiard ball computer. He defines quantum gates, considers the speed of quantum algorithms, and describes the building of quantum computers. By the end of the book, readers understand that quantum computing and classical computing are not two distinct disciplines, and that quantum computing is the fundamental form of computing. The basic unit of computation is the qubit, not the bit.

For more and to order see: Quantum Computing for Everyone

 

Succinct Update on Quantum Computing

The video below is a very succinct, easy to understand explanation of quantum computing by physicist Shohina Ghose:

We really liked her clear articulation of what is different about quantum computing.

A quantum computer isn’t just a more powerful version of the computers we use today; it’s something else entirely, based on emerging scientific understanding — and more than a bit of uncertainty. Enter the quantum wonderland with Shohini Ghose and learn how this technology holds the potential to transform medicine, create unbreakable encryption and even teleport information.

 

 

More Content

Cyber War

SciFi

Super Bowl Ads Indicate Big Businesses Think You Are Afraid of AI

Tom Loftus provided an insightful review of some of Super Bowl ads in the 4 Feb 2019 Wall Street Journal. Like AI parody in SNL, these ads really poked fun at computers: Seriously, did anyone catch the commercials? If the Super Bowl is the zeitgeist, then it is safe to say that America is not […]

HBO’s Westworld: The Man In Black is a special kind of Twitter user

HBO’s Westworld is a modern take on the Michael Crichton SciFi tale of a robotic amusement park. The HBO version has a new twist. The creators/writers were all exposed to years of Twitter, which has influenced every episode and the entire arch of two seasons of the show. Now that season two is wrapping up, […]