CTOvision.com

Context for the CTO, CIO, CISO and Data Scientist

You are here: Home / Archives for Cyber War / Cyber Security

Cybersecurity Is Not Just About The Tech

Cybersecurity may well be the most important function in the modern world. Without it, nothing else can be trusted, in any sector of the economy.
hacking-detected-shutterstock_188832089Cyber Security is far more than just protecting data. Security is about protecting the functionality of IT. It involves confidentiality, availability and integrity of resources. This higher order approach to cyber security requires vision, leadership, and actions in dimensions of people, process and technology.
 We also need to draw your attention to the higher order concept of Cyber War. This is, unfortunately, something all technologists should be familiar with now. The most critical piece to read on that topic now is Now That You Are A Soldier In The Cyber War You Must Know Your Cognitive Biases followed by: Main Street Cybersecurity: Can Email Be Safe? and Time for Transformational Cybersecurity!

Stay In The Loop: Sign Up To The CTOvision Daily

When it it time to research the great providers of Cybersecurity Solutions, kick off  your search in the CTOvision Disruptive Technology Finder. Pay particular attention to the sections on Cybersecurity, CASB, Cyber Threat Intelligence, and VPN.

For help putting all this information into context for your business, consider tapping into Crucial Point's CTO-as-a-Service or Technology Due Diligence offerings, both are ways to quickly leverage the technical talents of experienced enterprise technology professionals.

100 Percent Of Small Businesses Go Out Of Business One Nanosecond After the Simplest of Cyberattacks

I just read another scary marketing email. This one from one of my favorite firms. I love Cisco. They have done a great deal for America and our way of life and I really appreciate them. They are creators and innovators and I am honored to have interacted with Cisco through the years.

But their marketing team has fallen for the trap so many other marketing firms have. They are spreading mis-truths, probably because they want to believe that what they heard somewhere is true.

A recent note from them tells me that:

“In fact, more than four out of 10 cyberattacks target small businesses, and 60% go out of business within six months of an attack. “

Wow, this is a pretty serious fact.

Sounds an awful lot like a fact many of us in the community recognized as bullshit when we first heard it back in 2011. Can you imagine if 60% of businesses that had a cyber attack went out of business? Given that we are all pretty much under attack all the time, we would not have any businesses left would we?

So I went to Google and did a bit of searching to see if I could back up Cisco’s claim.

Best overview I saw spelling out how specious their statement is is at a BankInfoSecurity article from May 2017. The statistic seems to have no basis in fact. But some people said it. That is all.

For marketing teams everywhere, try this one on:

100 percent of small businesses go out of business one nanosecond after the simplest of cyberattacks.

I happen to know that one is B.S. because I just made it up. But from now on whenever I see a marketer use that tired old made up statistic about 60% of businesses I am going to try correcting them with my new statistic and see if they will use my number instead of theirs. Or maybe it will cause them to think a bit more before spreading their own specious content.

OK enough poking fun at marketing departments around the world. I actually feel for them, they have a really hard job. They need to find ways to stand out in an environment where 1,000’s of firms are competing for the attention of every decision-maker in the enterprise. It is a tough job. I would just encourage all in the marketing department to stay grounded in reality by being sure to check facts, and, whenever possible, run your marketing copy by the business side of your organization to get their inputs.

There Are Ways To Improve The Security of Your Artificial Intelligence Solutions

Security of the data and algorithms and results of artificial intelligence takes new methods. At OODAloop.com Matt Devost provides a framework for improving the security and reducing the risk of problems from your AI deployment in a post titled:

Securing AI – Four Areas to Focus on Right Now

His approach: Build a strategy informed by four key components:

  1. Secure your AI infrastructure
  2. Secure the algorithms
  3. Security the training data
  4. ID and manage external risks and dependencies

His recommendations also underscore the importance of a strategy to drive results in each of these areas.

This premium OODAloop content was unlocked by Cooley LLP.

The Internet Has A New Problem: Repeating Random Numbers!

Digital Certificates are a foundational building block of the Internet. They are used to verify the identity of e-commerce sites, the authenticity of software and encrypt data. Not surprisingly, cyberattackers try to create fake Certificates or get the Private Keys for real ones to steal data or intercept communications. No one really worried about the Certificates themselves – until now. It seems the random numbers used to generate Certificates sometimes are the same.

To understand the problem it’s useful to take a 30 second tutorial on Digital Certificates. For those of you who might have managed to stay awake during math class you’ll remember that Asymmetric Cryptography utilizes 2 prime numbers to create a Public and Private Key for a Digital Certificate. The Public Key maps an input (that you want to keep secret) to a large number field while the Private Key reverses the transaction. The theory goes that since there’s an infinite set of prime numbers, there’s an infinite set of Public/Private key combinations. To make sure the prime numbers are different a Random Number Generator (RNG) is used. Sounds pretty secure. Infinite is a big number. What could go wrong?

Well the real world is a bit different than math class. It seems the random number generators (RNG) on computer devices really don’t generate an infinite set of primes but rather a bounded set that in turn generates a set of Public/Private Key combinations. This new analysis is a result of the dramatic cost reduction in high performance computing that now enables the simulation of a chip’s RNG function and the Certificates they generate.

From an Internet security perspective, the ability of a cyberattacker to know an organization’s Private Key has huge implications. Attackers can potentially impersonate web sites, intercept secure connections or decrypt any piece of data just by looking at the Public Key. Examples of this attack are not just seen in labs. In one case, for instance, on January 7 2019 the University of California Davis sent an advisory of all students visiting China that their “secure” What’sApp messages were being monitored.

For enterprises that rely on Digital Certificates for their security, which is nearly everyone, it’s important to deploy countermeasure to RNG-based Certificates attacks:

Upgrade Your RNG: Many PKI systems have the ability to connect to an external Random Number Generator or utilize an entropy pool to ensure randomness. If your HSM/Root CA has this capability, it is highly advisable you turn it on. Next you’ll want to purge your network of old Certificates.

Switch to a Virtual HSM: If your existing PKI can’t work with an external RNG or entropy pool then you might consider one of the many cloud-based and software-based HSM solutions. All of the newer software-based PKI solutions support external RNG or entropy inputs. If shopping around, also look for a solution that makes it easy to create and propagate new Certificates – it’ll make your life easier.

Isolate Mission Critical Apps: In addition to upgrading your Certificates another important countermeasure is isolating high value or mission critical applications from the Internet. Software Defined Perimeter (SDP) is an ideal countermeasure to Certificate attacks as no one except authorized users will even know about the application. SDP can also be used to continuously propagate new Certificates to user devices.

With RSA around the corner, security professionals have a great opportunity for FREE consulting. Ask Certificate and encryption vendors for their countermeasures to existing and emerging Certificate attacks. When visiting a cloud-based SaaS, ask them what countermeasures they have implemented to ensure their Certificates don’t get attacked. Be aware; be proactive as this threat is real.

Related Posts:

The Problem With PEAP

An Introduction to Risk Analysis

Connected Devices, Remote Security: Data Encryption and Security in the Cloud

Naturally Better Security: Leveraging the power of nature to enhance Internet security

 

What the New U.S. Intelligence Strategy Says About Cyber Threats

The United States intelligence strategy for 2019 has been released, covering seven specific themes.  Here’s how the United States Intelligence Community will deal with cyber threats:

“Despite growing awareness of cyber threats and improving cyber defenses, nearly all information, communication networks, and systems will be at risk for years to come. Our adversaries are becoming more adept at using cyberspace capabilities to threaten our interests and advance their own strategic and economic objectives. Cyber threats will pose an increasing risk to public health, safety, and prosperity as information technologies are integrated into critical infrastructure, vital national networks, and consumer devices. The IC must continue to grow its intelligence capabilities to meet these evolving cyber threats as a part of a comprehensive cyber posture positioning the Nation for strategic and tactical response.”

For more on the new strategy and to download a copy see: OODAloop.com

 

More Reading:

For more on these topics see the CTOvision Guide to National Security Technology and

Super Bowl Ads Indicate Big Businesses Think You Are Afraid of AI

Tom Loftus provided an insightful review of some of Super Bowl ads in the 4 Feb 2019 Wall Street Journal. Like AI parody in SNL, these ads really poked fun at computers:

Seriously, did anyone catch the commercials? If the Super Bowl is the zeitgeist, then it is safe to say that America is not feeling the AI-vibe. Consider the following commercials.

Guy creates robot ‘child’ who wants to be a CPA. Alas the ‘RoboChild’ doesn’t have the emotional intelligence for a job at TurboTax. Humans win, but we are all nevertheless creeped out by the child’s laugh.

Alexa-like device talks to dudes. The poor bot can’t enjoy Pringles and she wants the two humans to know it. They shut her up by telling her to play “Funkytown.” Humans win (again), but they will go to bed aware that the bot is always listening.

Safe from technology. Home security firm SimpliSafe runs through the gamut of tech-enabled nightmares: drones, robots taking jobs, and too-smart-for-their-own good devices. So what is the solution? More technology, to guard the home. At least the devices emit a soft blue light.

I’m not sure we should read too much into this. These big businesses want to sell product and know technology is on our mind. In the cases of these three commercial’s they decided to make us laugh. I thought they were funny and hope you enjoy them too.

Here they are:

https://www.youtube.com/watch?v=JIRX3yWhgZI

https://www.youtube.com/watch?v=_rnrEQBieIQ

For what we really think about advanced technology see:

 

 

Picking The Best Password Managers: Advice meant to share with friends and family

This post provides information on password managers for personal and small business use. Please share with any business associates, friends or family you think can benefit from these tips.

Password managers automatically remember and fill in passwords for you. And they do that with an architecture designed to deliver this convenience with more security.

You probably already know the basic benefit of password managers. They are the only way we can deal with the overwhelming number of passwords we are all expected to use. Password managers mean you only have to remember one login.

The best password managers come with many other features. For example, most will help you automatically generate very secure passwords for each site you visit. So now you will never need to reuse a password. Since you are not reusing passwords,if a site you use gets breached and a password stolen by bad guys they will not be able to use that on other sites you use. Good password managers will also give you a head’s up if they find out a site you use gets breached. And the best of them can also help you automatically update passwords used on sites.

Password managers can also make it easier and more secure for you to use credit cards online. With a good password manager, you can store the credit card info in your password manager instead of the ecommerce site you want to do business with. This is more secure and easier too.

You have to pick a password manager with a well designed architecture, one that will make it harder for bad guys to compromise all your passwords at once (the nightmare scenario). Also, if you run a business, you will want one that gives you enterprise features but also allows your employees to leverage the password manager at home. Good password managers have options like this since they know that keeping employees secure at home is good for everyone.

Three that we believe fit the criteria of secure architectures and options good for both home users and small businesses include:  Dashlane, LastPass and 1Password.

Since these systems are all adding new features and improving, they are growing similar feature sets. It is hard offering a methodology for selecting one of these top three. We have the most experience with Dashane and have no problem recommending it to any small business or home user. But the others are very good as well. One suggestion would be to ask friends, family and co-workers which password managers they use and why. Get into a discussion on how easy the password manager is to use since that is important.

A final note: Keep in mind that password managers can really really help, but there are no silver bullets in security. You still need to keep your systems patched and will still need two factor authentication and need to track the many other cybersecurity best practices and lessons learned you know you should be watching. But a good password manager will make a positive difference. Consider it a “must-do” in the modern world.

Historical Breach Reporting

We try to stay strategic when reporting on breaches, there are so many other sites that give a blow by blow on what is known of hacks big and small. When we report on breaches we aim to give you more of the “so what” of the attack, including, when possible, actionable info you can use to reduce your own risk.

Here are some of the top breach posts based on traffic:

 

A New AWS Snowball Edge Provides The Power Of The Cloud In Disconnected Environments

For the last decade enterprise architects have all known the importance of engineering continuous connectivity to cloud services. If you want to use the cloud you have to have a path to it.

For parts of the enterprise who may operate at the edge, where connectivity can be an issue, it has been hard to design solutions leveraging public clouds. Depending on the organization, edge users might have some mix of public cloud, private cloud, datacenter access and local compute, all complex and hardly optimized at all.

The continuously evolving capabilities of Amazon’s Snowball devices are changing these old approaches. Initially the Snowball was a great way to move data from enterprises to the Amazon cloud. Load the data on the device and ship it. This is still a key use case. But newer versions of the device (the Snowball Edge) included enough processing power to do compute on the edge, meaning many analytics could be done on data before moving it to the cloud. The device soon evolved to be a mini-Amazon instance that can be used in disconnected locations.  Now Amazon has just announced a new version of AWS Snowball Edge. The features of this device are giving enterprise architects much more flexibility in meeting the needs of users for high end processing anywhere the data is.

(A picture of the Snowball at the DoDIIS conference is below)

 

 

 

 

A key thing that enterprises can do with this new version: The extra CPUs and GPUs now enable on site, local Machine Learning (ML) and local analytics. Yep, these things are AI in a box. And this includes very high end advanced analytics like image processing and full motion video analysis.

Here are the details from Amazon:

Soon, you will be able to use AWS Snowball Edge Compute Optimized for edge processing use cases that require additional computing power in remote, disconnected or austere environments. The new configuration comes with 52 vCPUs and an optional GPU so you can perform real-time full-motion video analysis and advanced analytics before transferring the data back to Amazon S3.

Snowball Edge Compute Optimized features more powerful Amazon EC2 instances and 7.68 TB of NVMe SSD to run powerful applications in locations with little or no connectivity. It also provides storage capacity of 42 TB to transfer the processed data into AWS for further analysis or archival. With today’s announcement, customers can choose between a storage optimized and a compute optimized option to process and transfer any sized data volumes into AWS. You can also now cluster the Storage Optimized and Compute Optimized Snowball Edge together to have durable storage for data collection along with powerful compute and high-speed storage for processing in edge locations.

Just to make sure you caught that, you can do full motion video analysis with these things… as well as most any other analytical workload… on the edge. Pretty cool.

Also see:

More Content

Cyber War

SciFi

HBO’s Westworld: The Man In Black is a special kind of Twitter user

HBO’s Westworld is a modern take on the Michael Crichton SciFi tale of a robotic amusement park. The HBO version has a new twist. The creators/writers were all exposed to years of Twitter, which has influenced every episode and the entire arch of two seasons of the show. Now that season two is wrapping up, […]