CTOvision.com

Context for the CTO, CIO, CISO and Data Scientist

You are here: Home / Archives for Cyber War / Cyber Security

Cybersecurity Is Not Just About The Tech

Cybersecurity may well be the most important function in the modern world. Without it, nothing else can be trusted, in any sector of the economy.
hacking-detected-shutterstock_188832089Cyber Security is far more than just protecting data. Security is about protecting the functionality of IT. It involves confidentiality, availability and integrity of resources. This higher order approach to cyber security requires vision, leadership, and actions in dimensions of people, process and technology.
 We also need to draw your attention to the higher order concept of Cyber War. This is, unfortunately, something all technologists should be familiar with now. The most critical piece to read on that topic now is Now That You Are A Soldier In The Cyber War You Must Know Your Cognitive Biases followed by: Main Street Cybersecurity: Can Email Be Safe? and Time for Transformational Cybersecurity!

Stay In The Loop: Sign Up To The CTOvision Daily

When it it time to research the great providers of Cybersecurity Solutions, kick off  your search in the CTOvision Disruptive Technology Finder. Pay particular attention to the sections on Cybersecurity, CASB, Cyber Threat Intelligence, and VPN.

For help putting all this information into context for your business, consider tapping into Crucial Point's CTO-as-a-Service or Technology Due Diligence offerings, both are ways to quickly leverage the technical talents of experienced enterprise technology professionals.

The Bill Codifying The New Cybersecurity and Infrastructure Security Agency Is Short and Sweet

The nation has a new federal agency. The Cybersecurity and Infrastructure Security Agency (CISA) was created out of several existing organizations within the DHS. The CISA was codified by a law signed by the President on 16 November 2018.

I read what DHS said about CISA (see more here). Then thought I should spend a little time digging deeper into the actual text of the legislation to see more. When I did I was pleasantly surprised! The text of the law is really short and sweet. It is so short I pasted all of it here:

Cybersecurity and Infrastructure Security Agency Act of 2017

(Sec. 2) This bill amends the Homeland Security Act of 2002 to redesignate the Department of Homeland Security’s (DHS) National Protection and Programs Directorate as the Cybersecurity and Infrastructure Security Agency (CISA).

CISA shall be headed by the Director of National Cybersecurity and Infrastructure Security, and CISA’s responsibilities include: leading cybersecurity and critical infrastructure security programs, operations, and associated policy; coordinating with non-federal and federal entities; and carrying out DHS’s responsibilities concerning chemical facility antiterrorism standards.

CISA shall be composed of DHS components reorganized as: (1) the Cybersecurity Division, (2) the Infrastructure Security Division, and (3) the Emergency Communications Division (currently the Office of Emergency Communications). The agency must have a privacy officer to ensure compliance with federal laws.

(Sec. 3) The bill transfers within DHS the Office of Biometric Identity Management to the Directorate for Management, and it authorizes the transfer of the Federal Protective Service to any DHS component, directorate, or other office that DHS deems appropriate.

(Sec. 5) No additional funds are authorized to carry out this bill’s requirements.

Coincidently I was just talking to my friend Paul Becker about how short and sweet is usually the best communication. He had just shared a post on Twitter about Lincoln’s Gettysburg Address, which was given on Nov 19, 1863 (I forgot to ask Paul if he was there to hear it!).  The entire address was only 272 words. Short and sweet!

To the drafters of the CISA legislation, thank you for setting a good example. Would love it if the rest of Congress follows your lead and returns to the short and sweet model of legislation.

To DHS: Best of luck to you all in the standup of this new organization, all of us here at CTOvision are pulling for you and look forward to you making a difference in cyberspace.

More on Cyberwar and Cybersecurity:

SciFi:

Robots:

 

FingBox Gives You Network Superpowers: Network security that contributes to physical security

FingBox is a fantastic device that I recommend everyone put in their home. It is also perfect for small businesses. Features of the FingBox help you track the status of your network and the many devices connected to it. It also enables you to set alerts and receive notifications when device status changes. You can also see who is coming and going by seeing which devices are nearby. The FingBox digital fence detects any device near your home, even it if it not connected to your WiFi network.

You control the device with an application that runs on your cell phone or tablet. The application is easy to configure and lets you check your network from anywhere in the globe.

Use cases:

  • KNOW WHO’S HOME: See family members and visitors at your home and keep a tab on who’s coming and going and when.
  • KNOW WHO IS AROUND: Detects any device around your Fingbox even if not connected to your WiFi. See who is nearby your home like dog walkers, babysitters, cleaning, or delivery persons.
  • SET PARENTAL CONTROLS: Detect, manage and control your kids internet access and activity time by device.
  • CATCH INTRUDERS & HACKERS!: Fingbox protects your home network seeing and controlling all devices connected or nearby — stop network phishing, snooping, and spying.
  • STOP BANDWIDTH HOGGING!: Check bandwidth usage and set limits for devices — control time-in and time-out!
  • DETECT THREATS & VULNERABILITIES: Get advance warnings on weaknesses and openings in your network — fix with 1 touch.

For more and to order see: FingBox

Other topics of note:

Bob Gourley Interviews Cyber Tech Titan Richard Bejtlich On Enterprise Cybersecurity Lessons Learned

Carahsoft and Corelight are sponsoring a webinar 13 December 2018 at 1pm Eastern which features an interview of Cybersecurity Pioneer Richard Bejtlich by CTOvision publisher Bob Gourley.

For more and to register see: Lessons Learned from a Tech Titan.

Few defenders have seen as much action in cyberspace as Richard Bejtlich. His career in network security started in the early days of the Internet, as the Air Force recognized the need for enhanced focus in this critical mission domain (he served at the Air Force Information Warfare Center, AFIWC), and continued service with commercial firm responsible for removing intruders from government and industry customers. Bejtlich is Principal Security Strategist at Corelight, the firm that’s making open source Zeek network monitoring tools enterprise ready.
Bob Gourley was the first Director of Intelligence for the Department of Defense’s first joint cyber conflict organization, the Joint Task Force for Computer Network Defense, and is a pioneer in the new discipline of cyber threat intelligence. He is also the publisher of CTOvision, the blog for enterprise technologists.
Join us and participate  directly as Gourley interviews Bejtlich with a focus on lessons learned for enterprise-grade cyber defense. Topics covered will include:
  • The most critical factors in attracting and retaining technical talent (hint: it’s not just about pay, leadership is required)
  • The importance of repeatable processes that can be taught, managed, and measured
  • How cyber threat intelligence has helped defenders collaborate and coordinate in defense against nation-state adversaries
  • How to efficiently leverage technology, especially open source technology, in defense of networks

Register at: Lessons Learned from a Tech Titan.

Working in Cybersecurity: Life on the front lines, in the C-suite, and everywhere in-between

I am excited to announce a new book by Michael Tanji titled “Working in Cybersecurity” (and very happy to be among those profiled in the book).

Michael has been a pioneer in modern cyber security and digital risk mitigation. He is a former soldier and intelligence officer who at one point managed the how the entire department of defense intelligence enterprise (under the Defense Intelligence Agency) managed indications and warning for cyber threats.  As a practitioner he  has spent years starting and running various cybersecurity start-ups. He is also an accomplished author (publishing many places including here at CTOvision).

His latest book is an oral history of an interesting spectrum of people who have spent years in the cybersecurity domain.

From the book write up:

Inspired by the book Working by Studs Terkel,Working in Cybersecurity looks at both the day-to-day activities of those working in myriad roles in cybersecurity – technical, operational, and policy – as well as the mental, social, and emotional impact associated with working in one of the most in-demand and important fields of the information age.

Everyone likes hearing about significant events of the past; no one likes ‘history’ because their only exposure to it is colored by years of having to memorize dates, often about topics of nominal personal interest. An oral history of cybersecurity is different. For starters, we’re talking about something you’re interested in. Secondly, there is a pretty decent chance we’re going to talk to someone you admire and uncover something you didn’t know about them. Third, there is an equally good chance we’re going to talk to someone you’ve never heard of before, but whose story will fascinate you.

Finally, you’re going to hear about events from the people who were there, elbow deep into what was going on at the time. History by those who helped make it. What is working in the field really like? How did some of the field’s top experts acquire their skills? What was it like working on major cyber crime or digital espionage cases – or being the subject of those investigations? What was it like working with the pioneers in the field? What is it like building a cybersecurity company, and succeeding in one of the most challenging markets What makes a cybersecurity expert tick and how can you use that knowledge to help build and retain people with such rare skills? Working in Cybersecurity is both a series of compelling personal stories, as well as a resource for those who interact with cybersecurity professionals of all types. We hope that it will be an informative and engaging way to learn meaningful lessons about our past, appreciate the work that previous generations have put in, and to serve as a guide future generations so that their energies are not wasted.Proceeds from the sale of Working in Cybersecurity will be used to help aspirants to the field pay for or off-set the costs of education and training.

 

Other topics of interest:

 

You have always known there is a threat of hardware attacks: Get ugly details here

It is important to remember the threat of hardware based attacks. They have always been a threat vector, but hardly ever in the news.

Now that part has changed. Bloomberg Businessweek has just run a well researched story into a hardware attack that is incredible in scope. The overall theme of the attack will not be a surprise to anyone in our field. But the details are amazing, making the full article a must-read for anyone who wants to weigh in on how to mitigate cyber threats.

Our view: Insider threats are tough to beat, but insider threats run by a hostile nation are an even more serious threat. Insider threats run by a hostile nation that are automated because of implants in your servers are at the top of the scale of potential risk to your business and to the nation overall. Mitigating these threats will take a team effort where businesses collaborate together to reduce the chance of this happening and where we citizens and businesses force our governments to take action to do what we cannot do.

The report comes with great graphics that make the attack easier to visualize.

For the full report see:
The Big Hack: How China Used a Tiny Chip to Infiltrate U.S. Companies

 

An interview with Robert Fink, Architect of Foundry, Palantir’s open data platform Part Three: Open Development Environments

Editor’s note: This post is the third of a series of three capturing the result of recent interview/discussions I had with Robert Fink of Palantir. The conversation was wide ranging, hitting on topics of design, development environments and a bit on the philosophy of enterprise tech. Several common themes emerged in those topic areas, including ways that Palantir has been leveraging open approaches to data architectures, system design and even developer environments. The first post focused on open data architectures. The second post continues the discussion of open approaches including open source software. This third post gets into the meat of modern, open development environments .– bg

 

BG: The third broad topic I want to ask you about is open-source for development environments. How does this relate to open-source software and open data architectures?

RF: Once again these are in theory separate concerns, but related by mindset. Hypothetically, you could imagine a development environment based on closed, proprietary tools that produces an open data system, but in reality I have never seen that done. The most powerful and flexible development environments today are based on collections of open-source tools that have been designed from the ground up to produce highly functional, well documented, sharable code. Modern languages like Typescript are entirely open-source, including the compiler, the build system, and the IDE. Contrast that to the early days of C++, where the best compilers and IDEs were closed-source and very, very expensive.

Palantir’s developers are addicted to a large amount of open-source developer tooling. For example, all of our Java developers build their projects with Gradle, and all of our frontend developers code in Typescript. We have made a number of our internal productivity tools available as open-source. For Gradle, examples include plugins for coding standards, container-based integration testing, or for building Docker images. For the frontend community, we maintain the standard linter for Typescript.

BG: On one hand, Palantir is a commercial software company, on the other hand, you give away some of your code as open-source. How do you balance these concerns, how do you decide which part of your software you publish?

RF: In the case of developer-tooling the answer is straightforward: I feel morally obliged to maintain our tools in the open-source domain because it incurs no overhead for us and because we would gain no competitive advantage from keeping it closed-source. A second key advantage of open-source tooling: it makes it much easier for our customers to interact programmatically with our open data platform.

BG: Can you give me an example of that?

RF: Since our data platform is focused on serving customer needs for data integration and analysis, we support standard formats and APIs with built-in interoperability, for example SQL, Hadoop, Parquet, as well as downstream analysis applications like Tableau or PowerBI. But we also provide ways for customers to extend the platform with bespoke functionality in the form of plugins and applications. We try to make this easy by providing building blocks for application development. In many cases we have turned these building blocks into open-source projects themselves so anyone can contribute to and use these capabilities. For example, Blueprint and Plottable are Javascript libraries that both we and our customers employ to develop rich Web-based frontend applications with consistent look and feel. We are in the process of open-sourcing our RPC framework, Conjure. Conjure is built on industry standards like HTTP and JSON and makes is very easy to interact with our platform APIs from a variety of programming languages.

BG: I noticed from your GitHub page that you remain personally involved in the open-source community. Can you tell us some of your favorite Palantir projects?

RF: On the top of my list is probably AtlasDB. AtlasDB is a distributed transactional key-value store built on top of Cassandra. Inspired by research papers on MVCC databases, we began internal development of AtlasDB around 2012 and decided to contribute the codebase to the open-source community in 2014. Today, AtlasDB is the database backend for all of our products. Specifically for Palantir Gotham, AtlasDB has enabled our customers to migrate from Oracle to open-source databases.

As a second example, we partnered with Pepperdata, Red Hat, Bloomberg, and Google to design and implement a Kubernetes backend for Spark. After a number of iterations, the main components developed as part of this collaboration were merged into mainline Spark. Both Spark and Kubernetes are industry-changing software ecosystems and I am really happy to see that their “marriage” is now available to the wider Spark community. Palantir continues to be an active participant in the vision and implementation of the project.

BG: Can you elaborate a little on legal concerns with open-source software, and maybe also on security concerns?

RF: Both are non-trivial subjects, in particular when organizations or individuals “go rogue” and blindly download and deploy open-source components. A big advantage of commercially supported open-source software is that the providers take care of the issues of indemnification and compliance which organizations would have otherwise have to solve themselves.

Open-source components, including code libraries, graphics and fonts, and entire applications are subject to a license grant. Different license grants impose different constraints on how the licensed component and the resulting software can be used. For example, the MIT license allows for permissive use of the covered components, including modifications and redistribution under commercial terms, whereas the GPL license is far more restrictive in how one can package and distribute a combination of the open-source component and proprietary code. We monitor our external dependencies to ensure that our use of open-source components is compatible with their licenses.

The same dependency monitoring is useful in the security context. Like any software, open-source software can be susceptible to malicious and unintentional bugs and security problems. Fortunately, the developer community and security experts around the world continually scan source code for vulnerabilities and maintain lists of known “bad” libraries. We use our dependency monitoring tools to identify and remove such code from our systems. A small amount of common sense also helps in this context: we try to avoid dependencies on code produced by small or obscure development teams, as well as code that is no longer actively maintained.

BG: Thanks, Robert!

RF: My pleasure!

 

This concludes our series based on our interviews of Robert Fink. Find all three of the series at:

 

Track the most disruptive technologies by diving into our categorized index:

Artificial Intelligence Companies – A fast overview of Artificial Intelligence companies we believe are poised to cause the most positive disruption in the enterprise.

Big Data Companies – Reference to the greatest, most disruptive Big Data companies in the tech ecosystem.

Business Intelligence Companies – We assess these to be the Business Intelligence Companies most impactful for delivering real decision advantage.

Cybersecurity Companies – We apply our deep expertise in cybersecurity to assessing the best across multiple categories including:

Cloud Computing Companies – We include both platform and software as a service providers, capturing only the most innovative and disruptive.

Collaborative Tool Companies – These are the firms that help humans connect to humans to create, manage and lead.

Infrastructure Companies – Critical enterprise foundations for business agility.

IoT Companies – Internet of Things and Industrial Internet of Things are here. How do you manage them?

Mobile Companies – Help manage, configure, secure and optimize these very powerful capabilities.

Robotics Companies – Including innovations in Robotic Process Automation, Drones, and industrial robotics.

Services Companies – We only track a few, the ones we really know well.

Tech Titans – These are the big players. We track the tech titans closely since their capabilities change continuously.

VC, PE and Finance Companies – Keeping an eye on the investors can give indications of coming developments.

You can also use our topical pages to get up to speed quickly on the current status of the major megatrends. See our pages on Cloud Computing, Artificial Intelligence, Mobility, Big Data, Robotics, Internet of Things, Cybersecurity and Blockchain and Cryptocurrencies.

We also provide special pages focused on high interest topics, including Science Fiction, Entertainment, Cyber War, Tech Careers, Training and Education and Tech Tips.

Smart Cities Cybersecurity Challenge

Smart Cities will become a full-scale cyber war battleground unless Congress mandates cybersecurity.

The biggest danger in Smart Cities is the assumption that IoT sensors communicating over a 5G fabric to Machine Learning and Blockchain systems will be safe from cyberattacks. To the contrary Smart Cities suffer from all the cyber vulnerabilities we have today (like phishing password attacks, server exploitation and self-propagating malware (especially ransomware)) plus a new generation of attack vectors due to the hyper-connected state of everything.

State-Sponsored Infiltration: We haven’t even built our first Smart City but we’ve already had our first geo-political incident. DHS recently banned Huawei’s 5G equipment when it was discovered that the Chinese government could remotely listen to any communication in the USA. The loss of domestic American telecom manufacturing makes Smart Cities vulnerable to equipment imported from hostile states. In addition to direct infiltration, the global supply chain provides ample opportunity to modify software and slip in via domestic suppliers.

Personal Targeting: Currently there are no guidelines to limit what IoT sensors can see inside your home or on the street. Self-driving cars see and hear everything while moving (even at high speed). Facial recognition software can track you as well as determine your social connections (people you talk and who they talk to). The vast amount of personal data makes personal targeting a reality. Take for example ransom (not ransomware but real ransom) from being locked in your self-driving car or smart elevator until you make a big crypto-currency payment.

Market Theft: One of the highly promoted aspects of a Smart City is a Blockchain-based market to buy and sell items like energy. While Blockchain provides a tamper proof record of a transaction it doesn’t guarantee the input data is valid. For example, one could trick Smart air conditioners that it’s very hot and have them buy expensive power from a high priced supplier. The ability to hijack a market creates many new opportunities to steal money. Subsequently all the business logic and financial systems in a Blockchain-based market require significant protections against tampering.

The Proposal: Smart City Cybersecurity Framework

To address Smart Cities cyber risks we require a new framework to mitigate state-sponsored infiltration, protect personal privacy and enable an efficient market. However Smart Cities are so complex that the conventional compliance model isn’t going to work.  We need a new approach that defines clear roles and responsibilities for every vendor and service provider.  To start the process, it’s useful to divide a Smart City into the First Mile, Management and Market sections. We can then look at each section to explore their cybersecurity responsibilities.

First Mile: The First Mile is plagued with IoT and 5G vulnerabilities. IoT sensors are extremely vulnerable to tampering leading to DDoS and malware attacks on management systems. Additionally the lack of trusted 5G infrastructure opens the door to foreign surveillance. A solution to both problems is to build an IoT overlay network using a Zero Trust Network (ZTN). ZTN’s validate the identity and software of IoT devices before provisioning connectivity.  Moreover connectivity would not rely on the 5G network for encryption as the ZTN would utilize its own certificates to establish a mutual TLS VPN.

Privacy Gateway: The First Mile is that is where Smart City citizens are the most vulnerable to personal data mining. Subsequently a Privacy Gateway that strips away Personally Identifiable Information (PII) before data is sent to Management systems is critical. A Privacy Gateway is similar to a GDPR database except that is reads the contents of packet streams and removes facial details (from HD cameras) and human speech (from home appliances) in real time.

Management: Given the mission critical nature of guiding vehicles and power generation systems Management systems should run on a Trusted Computing platform. Software processes like machine learning and administrative control should all run in their own Secure Enclave to mitigate self-propagating malware and inside attacks.  Another issue with machine learning systems is their ability to determine data which has been purposely remove. For example traffic systems could easily determine who the owner of a vehicle is and their travel patterns even after the Privacy Gateway removed the driver’s image and license plate from the HD camera feed.  Thus all analytics will need to be stored in a separate Secure Enclave the PII stripped off (again).

Data Validation: To ensure that corrupted data does not makes its way into a Blockchain market a Data Validation Gateway is required. This would be similar to the monitoring system stock markets now use to detect unusual trading activity however their logic would have to be expanded to handle the wide array of products and services in a Smart City exchange. Thus homes with Smart Appliances that like to buy expensive services will need to have their activity monitored by a Data Validation Gateway.

Market: Bitcoin made it’s mark as an anonymous cryptocurrency. Unfortunately anonymous trading is not what we want when it comes to managing energy and transportation trading. Thus secure digital wallets with strong authentication (ideally implemented in a Trusted Computing platform) combined with authorized trading limits will be critical for efficient market operation.

Whether we utilize a framework like the one presented or develop a new one, a comprehensive cybersecurity strategy is critical. Congress must mandate a minimum cybersecurity standards for Smart Cities before large scale deployment happens.

Additional Resources:

What You Need To Know About Bitcoin: Including potential new business models to consider

OODAloop nails it again with reporting on Bitcoin price manipulation

From Crowdsourced Militias to Dread Bitcoin Pirates

Today Every Company Buys Electricity, Tomorrow Every Company Will Buy Ethereum

Smart Cities Cybersecurity Challenge

Blockchain Templates: Amazon Making Technology Mainstream

How Cryptocurrencies will go from The Technologically Savvy, into the Everyday Transactions of Consumers

What Executives Should Know About Ethereum

What Should Executives Know About How Blockchain, Smart Contracts and Cryptocurrencies Are Disrupting Business?

Cryptocurrencies and their promise for enterprise technology professionals

Inform Your Cybersecurity Strategy With Lessons From July 1861

When I was the Director of Intelligence for DoD’s first joint cyber defense organization (JTF-CND) our Commander (At the time, Army Major General Dave Bryan) and our J5 (Marine LTC Mike Davis) organized a visit for the senior staff to the Manassas Battlefield Park of Virginia. The purpose was not just team building, but to consider how enduring lessons of war applied to the new domain of cyberspace.

I recall Mike doing an excellent job, like only a Marine could do, in explaining the terrain of the battlefield, the disposition of forces, the moves and counter moves, and, perhaps most importantly, the surprises the battle would have for both the combatants and the locals. Was a good trip for the staff. We had been up and running as a team for a couple years but it was a fantastic way to keep us thinking about the dynamic adversaries we faced in cyber conflict.

Background of the Battle: 

In July 1861 many citizens of Northern Virginia were very excited to learn that war was about to start right in their own neighborhood. Many followed the newly formed troops of General McDowell’s army to watch. Many citizens of Manassas spread blankets out and had festive picnics as they prepared to watch the Union do away with the rebels and end the insurrection of the south.

As you can probably imagine, the horribly bloody carnage was not what they expected to see. And the horrors of war would go on for four more years.

Lessons:

  • Never wish for war, it will never go as well as you think.
  • Never think war will end quickly. They end when they end.
  • And a lesson from almost every other battle in every other war, never underestimate your enemy. It results in failure every time.

All three of these lessons are relevant to cyber conflict. But the last lesson is especially important in the context of cybersecurity and cyberwar. Never get complacent or arrogant and think that your opponent is not a thinking, creating, dynamic adversary. Do whatever you can to raise your defenses and study your adversaries, but be prepared to be surprised.

There is another lesson that I never thought of till today. The people of 1861 Manassas were not prepared at all for having war come to their city. No civilian ever is, but as a citizen of Manassas today I have to wonder if our city is ready for modern conflict. How would Manassas do in cyber war?  And what about the many other cities, counties and states of the nation, most of which hold critical information on citizens and businesses. There is no way we are ready for what is in store.

On top of that, the smart cities movement and massive deployment of IoT is now an unstoppable force. And there are no indications of any preparations for cyber conflict being made in smart cities.

Maybe it would help us prepare for the future if we spend a little time reflecting on our past.  My recommendation: Read more about the Battle of First Manassas here. And book some time soon to walk the battlefield yourself. As you do, reflect on what it means for the smart cities of tomorrow.

And a concluding recommendation. Consider this hypothetical question: Is enjoying the excitement about smart cities like having a picnic before the Battle of Manassas?

More CTOvision Reporting:

For more on these topics see the CTOvision Guide to National Security Technology and

More Content

Cyber War

SciFi

Super Bowl Ads Indicate Big Businesses Think You Are Afraid of AI

Tom Loftus provided an insightful review of some of Super Bowl ads in the 4 Feb 2019 Wall Street Journal. Like AI parody in SNL, these ads really poked fun at computers: Seriously, did anyone catch the commercials? If the Super Bowl is the zeitgeist, then it is safe to say that America is not […]

HBO’s Westworld: The Man In Black is a special kind of Twitter user

HBO’s Westworld is a modern take on the Michael Crichton SciFi tale of a robotic amusement park. The HBO version has a new twist. The creators/writers were all exposed to years of Twitter, which has influenced every episode and the entire arch of two seasons of the show. Now that season two is wrapping up, […]