Junaid Islam, Author at CTOvision.com

Internet-connected Product Bans: How Do You Avoid Future Issues?

Junaid Islam March 7, 2018

Recent actions by DHS signal a closer monitoring of technology being purchased by the U.S. government, especially technology created and or controlled by foreign governments. In some cases Internet-connected products controlled by foreign governments have already been banned, and there are indications more may be coming. For cybersecurity personnel the product bans will require a new approach to procurement policies (especially endpoint and BYOD policies).

2018 started with a ban of Kaspersky software and was quickly followed by Senator Rubio calling for a ban on Huawei and ZTE. Given the high political cost of banning a product the US Government typically only takes action if there is overwhelming evidence. Subsequently cybersecurity personnel should take such actions very seriously.

Internet-connected security software and mobile phones are problematic as they upload data as a normal part of their operation. For example, anti-virus programs upload any signature or group of packets they don’t understand to a cloud-based analytics engine. Similarly mobile phones upload usage data to improve coverage. For DHS to ban an Internet-connected product means there is evidence that data uploads go beyond the stated functions. In the case of Kaspersky it seems they were uploading the entire hard drive.

Company-owned computers on which banned security software is installed should be discarded. As security software operates at the kernel level simply de-installing software won’t do anything. Unless you’re an expert in re-flashing hardware don’t take the risk of using a tampered laptop. If you do decide to re-flash a laptop you should label the device so users are aware then you’re re-circulating a tampered system. Unfortunately for banned mobile devices there’s nothing you can do except remove the SIM card and discard the device.

BYOD presents a bigger cybersecurity challenge for enterprises. In many organizations cybersecurity personnel don’t even know what’s on the remote device. Moreover standard countermeasures such as encryption don’t help if the device itself is the attack vector. Thus enterprises will have to take the difficult step of approving BYOD purchases.

What To Do To Avoid Future Bans?

To avoid the cost of discarding a device here are five requirements for Internet-connected products you should consider before purchasing or recommending them:

Data Location Where is the data stored? Additionally are there any remote analytics programs that have access to the data?

Internet Function What is the function of the Internet-connected service? Is the functionality locked down?

Anonymization Process Are Internet-connected services implementing a one-way non-recoverable hash to ensure data is anonymized?

Data Security How is access to the data managed? Additionally how is the network that transports the data protected?

System Verification What is the vendor doing to ensure all the things they promised are really happening.

Don’t wait for DHS to ban a product. Be proactive and avoid disaster.

Are you ready for state-sponsored zombie malware attacks?

Junaid Islam August 21, 2017

On January 4, 2017 CTO Vision published a blog post titled “Are you ready for a state-sponsored cyber attack?” In hindsight, the blog post should have been titled “Are you ready for state-sponsored zombie malware attacks?”

Zombie malware combines the most deadly aspects of malware and zombie computers into one horrible mess. Typically malware gets into a compute device via phishing or email attachment which limits the scale of the attack. In contrast, zombie malware autonomously hunts for vulnerable systems across LAN, WiFi and VPN connections. Once zombie malware finds a system to infect, it utilizes the new host to scan for other systems which can be anywhere on the globe.

Another key aspect of zombie malware is the lack of a control channel to manage its destructive path (unlike zombie computers used in DDoS attack). Subsequently zombie malware just destroys anything it can connect to. For example, the NotPetya started on Ukraine government systems but then quickly spread around the globe.

Given the last three zombie malware attacks were outside the USA on older Windows XP systems one might be led to believe the American companies are safe. Unfortunately the combination of global supply chains and BYOD make American companies highly vulnerable to zombie malware. More important, the posting of CIA’s Vault 7 files on Wikileaks was designed to escalate the number of zombie malware attacks by broadcasting vulnerability information to cyber combatants. In short, America’s enemies are attempting to launch a zombie apocalypse by increasing number and lethality of malware attacks.

Countermeasure against autonomously hunting malware (or how to stop zombie apocalypse)

Building on the five countermeasures from the original January 2017 blog post, here some additional items you should be implementing to avoid the zombie apocalypse.

Deploy endpoint protection. There is a new generation of endpoint protection systems that is not reliant on signatures (and thanks to the Wikileaks the new attacks won’t have any). While you can’t do anything about BYOD or supply chain partners devices, at least the devices that manage your critical assets will be safe.

Lock down LAN, WiFi and VPN networks. A key feature of zombie malware is its lateral movement capability that allows it to autonomously traverse LAN, WiFi and VPN networks. Enabling “port isolation” which is a standard features on enterprise switches is recommended. Additionally VPN connections should be filtered so that only authorized applications can utilize them.

Limit access privileges. If you allow a user access to everything, any zombie malware on their device will also get to everything. Implement role-based access control on your data center and cloud systems. Ensure you have solid east-west partitioning in place.

Allow only application layer access. Only authorized applications from a user’s device should have access to network and application resources. Consider moving away from the older network access VPN model to newer application layer access solutions like software defined perimeter.

Backup data to offline stores. Backing up to the cloud is easy and inexpensive. But as more American assets migrate to the cloud, the bigger the target it becomes for a malware attack. You must have an offline data backup so that you can re-start your organization if there’s a catastrophic failure. And hopefully you’ve remembered to store away a few servers and laptops to do this.

Winter is here.

We Need A National Cybersecurity Strategy That Everyone Can Implement

Junaid Islam November 2, 2016

In a few months we’ll have a new Administration in Washington and a chance to update our national security policies. So it’s good time to reflect on what we might want to do differently for cybersecurity.

A quick search on the Internet will reveal many national cybersecurity initiatives. However given the recent data theft of DNC emails and DDoS attack on Dyn it’s evident that current initiatives aren’t working. The question to ask is why? The quick answer is that we don’t have a national cybersecurity strategy that everyone can implement.

Click on any cybersecurity initiative you desire and you’ll find comprehensive strategies developed by smart security experts. While well intentioned the writers make the common mistake of laying out cybersecurity strategies that are too complex for most organizations. Apart from the top 0.1% of US organizations (financial institutions and intelligence agencies), the 99.9% simply don’t have the resources to implement anything complex.

A workable national cybersecurity strategy needs to be built using simple tasks the 99.9% can implement to mitigate the most common cyber attacks. For those organizations have a higher threat profile, a cybersecurity strategy should also offer a clear path to step-up their security posture when called for. Thus we need a basic requirement that everyone can implement (without exception) plus a step-up path when necessary.

Another challenge in developing a national cybersecurity strategy that uniquely American is that we are an open society where the bulk of IT tasks are outsourced. Thus cyber attackers know exactly what we’re doing. A national cybersecurity strategy must be based on verifiable tasks (not secret activities) that reduce cyber risk.

So here’s three things the nation can do to make it less vulnerable to cyber attacks:

1/ Implement 2-Factor Authentication

Basic: Implementing two-factor authentication is the simplest mitigation against credential theft. The great thing about 2-factor is there are so many free or low cost solutions out there from mobile phone texts messages to soft client tokens to email verification. So there’s really no excuse not to do this!

Step-up: For those organizations desiring to step-up from 2-factor, there are new attribute-based access control solutions like software defined perimeter (SDP) that verify device and user identity as well as check for software tampering.

2/ Encrypt Data Stores

Basic: Application data stores, email servers and collaboration applications should all have their data encrypted. Ideally the private key must be on a different physical server from the storage unit and should only be assessable with 2-factor authentication.

Step-up: The next step up from encrypting data on servers is keeping it encrypted on user’s devices. This requires a bit more work, such as issuing and managing device certificates, but makes it more difficult for cyber attackers to get to data even if they compromise the user’s device.

3/ Lockdown Servers

Basic: Scanning for open server ports is a favorite technique of cyber attackers to gain entry to an organization. Thus closing un-used interfaces is one of the easiest mitigation techniques. This can be done by configuring the internal Firewall on Internet facing application servers.

Step-up: Implement the OWASP Top 10 controls to further insure your Internet facing servers are not vulnerable to front door attacks. Additionally locking down internal servers with host-based Firewalls or software defined network (SDN) is also recommended for those organizations with higher risk profiles.

Looking at the short “short list”, you’ll find the recommended tasks have been around for decades. While not fancy they’re proven to be effective. More important, there’s no excuse for everyone not being able to implement them! One can only speculate that if the DNC had encrypted their email storage system and implemented 2-factor how history would be different? Or if stronger authentication would have lessened the DDoS attack on Dyn?

A national cybersecurity strategy is well within our reach. We just need to align available security tools and techniques against the most common threats. There is no reason why this cannot be done.

A Flicker Of Light: A new security stack points the path to safety

Junaid Islam October 19, 2016

The last few years have been a difficult time for those who protect data. Defense-in-depth, the gold standard in cyber security, has failed. The basis behind defense-in-depth is to deploy redundant layers of security products to defeat every part the cyber kill chain. Unfortunately inside attacks and compromised devices belonging to authorized users operate within the protective bubble making them difficult to stop or even detect. Further complicating matters, the shift from company owned and operated to personal and public compute resources– which increases the attack surface.

In panic, many organizations deployed more security products or utilized capabilities like Virtual Desktop Infrastructure (VDI) to create virtual air gaps. Sadly the short-term fixes often created new vulnerabilities or impeded end-to-end visibility. But now security professionals are testing a new security stack that utilizes a small set of interlocked security controls to stop a wide range of attacks.

The new stack design is very simple – an isolated compute partition on the user’s device is connected to an isolated compute partition in a data center with a single use VPN connection. Before connectivity is provisioned, the hardware identity and software hashes from the user’s device are checked. End-to-end encryption is implemented via tamper resistant memory. Once inside the enclave, authorized users are able to access protected applications as well as encryption and VDI services. Conceptually the new security stack is a hardware-based virtual enclave.

The key design element of this security stack is that at least three controls must simultaneously unlock for enclave access. This is similar to a bank vault with multiple combination locks except for one important difference – the thieves must get everything right on the first attempt. For example, enclave access requires a valid hardware token, certificate exchange and device verification all to be approved in the same connection. If anything fails, an alarm is generated!

Inside attacks are stopped as data can only be viewed on the hardware belonging to the authorized user (and only after they sign-in to their device and enclave). Compromised devices cannot access data as malware isn’t allowed to escape or re-write the micro-VMs that surround every app. Attempts to tamper with device software is either stopped with tamper proof memory or detected with software hashes. Lateral movement in the data center is stopped as partitions are protected with host-based firewalls to ensure only provisioned VPN connections gain access.

Are interlocked security controls the light at the end of the tunnel? It’s still early days but the initial test results have been positive. At least we have a path to go forward with.

Innovative Thinking Is Hurting Security; We Need Disruptive Ideas

Junaid Islam September 13, 2016

Security professionals by their nature are risk averse. Thus it’s no surprise that the security industry is defined by incremental innovation. Start with something that works and make it better. Unfortunately “innovative security” strategy is leading to an increase in cyber security failures.

Increased spending and increased cyber failures now characterize the security industry. Gartner forecasts that security spend will be on the order of $100 Billion for 2016 yet breaches are occurring with greater frequency than ever before. This is occurring because the existing security architectures have reached their performance envelope.

Organizations are more complex than the assumptions that define current security product design. Incremental innovation no longer works and the security industry requires a disruptive shift to keep pace with organizational needs.

The history of the technology business is defined by systems hitting a wall and then being replaced. For example aviation started with lighter-than-air craft (i.e. balloons) that got replaced by propeller planes that in turn got replaced by jets. Like balloons being blown by the wind in the wrong direction, current security solutions just don’t let organizations go where they want.

In a world defined by mobile users, non-employees and diverse infrastructure having twenty to fifty different point products doesn’t work as there is no way to integrate their logic. To protect today’s organization we need a new security architecture based on inter-locking components:

Identity-based access control that protects data center and cloud assets
Policy-based data encryption that is tied to the access control system
Data center and cloud partitioning solutions that create compute containers
Identity services that dynamically determine policy based on location and device
Mobile compute devices supporting partitioned, secure code execution

Each security component is designed to support the other four requiring cyber attackers to break all five to breach an organization. More importantly, as new devices, users or apps go online, the entire system is aware of the changes – making it extremely difficult for cyber attackers to find a weakness in the system.

The strong bias in the security industry against disruptive ideas has become a barrier to move forward. It’s time for security professionals to focus on strategies to reduce cyber risk than solutions that are less risky.

Also see:

Internet-connected Product Bans: How Do You Avoid Future Issues?

Are you ready for state-sponsored zombie malware attacks?

We Need A National Cybersecurity Strategy That Everyone Can Implement

A Flicker Of Light: A new security stack points the path to safety

Innovative Thinking Is Hurting Security; We Need Disruptive Ideas

Cyber War

Optimizing Corporate Intelligence with OODA Loop

The Short Story From Arthur C. Clarke Every Officer in The Military Should Read and Heed

This One Little Configuration Change Will Make It Harder For People To Steal Your Information

SciFi

Science Fiction Gadgets You Can Get Today

Super Bowl Ads Indicate Big Businesses Think You Are Afraid of AI

HBO’s Westworld: The Man In Black is a special kind of Twitter user

Junaid Islam

More Content

Cyber War

SciFi