CTOvision.com

Context for the CTO, CIO, CISO and Data Scientist

You are here: Home / Archives for Cyber War / Cyber Security

Cybersecurity Is Not Just About The Tech

Cybersecurity may well be the most important function in the modern world. Without it, nothing else can be trusted, in any sector of the economy.
hacking-detected-shutterstock_188832089Cyber Security is far more than just protecting data. Security is about protecting the functionality of IT. It involves confidentiality, availability and integrity of resources. This higher order approach to cyber security requires vision, leadership, and actions in dimensions of people, process and technology.
 We also need to draw your attention to the higher order concept of Cyber War. This is, unfortunately, something all technologists should be familiar with now. The most critical piece to read on that topic now is Now That You Are A Soldier In The Cyber War You Must Know Your Cognitive Biases followed by: Main Street Cybersecurity: Can Email Be Safe? and Time for Transformational Cybersecurity!

Stay In The Loop: Sign Up To The CTOvision Daily

When it it time to research the great providers of Cybersecurity Solutions, kick off  your search in the CTOvision Disruptive Technology Finder. Pay particular attention to the sections on Cybersecurity, CASB, Cyber Threat Intelligence, and VPN.

For help putting all this information into context for your business, consider tapping into Crucial Point's CTO-as-a-Service or Technology Due Diligence offerings, both are ways to quickly leverage the technical talents of experienced enterprise technology professionals.

The Perfect Weapon: War, Sabotage, and Fear in the Cyber Age

David Sanger has established himself as on of the top cyber journalists in the nation. His latest work, The Perfect Weapon: War, Sabotage, and Fear in the Cyber Age, provides a critically important update on the rapid progress of cyber war and belongs on the bookshelf of every cyber defender.

Readers of CTOvision know the day to day back and forth of cyber war. But it really helps when a researcher like David Sanger can give us insights from his perspective. This book is great context.

From the book description:

The Perfect Weapon is the startling inside story of how the rise of cyberweapons transformed geopolitics like nothing since the invention of the atomic bomb. Cheap to acquire, easy to deny, and usable for a variety of malicious purposes—from crippling infrastructure to sowing discord and doubt—cyber is now the weapon of choice for democracies, dictators, and terrorists. Two presidents—Bush and Obama—drew first blood with Operation Olympic Games, which used malicious code to blow up Iran’s nuclear centrifuges, and yet America proved remarkably unprepared when its own weapons were stolen from its arsenal and, during President Trump’s first year, turned back on the US and its allies. The government was often paralyzed, unable to threaten the use of cyberweapons because America was so vulnerable to crippling attacks on its own networks of banks, utilities, and government agencies.

Moving from the White House Situation Room to the dens of Chinese government hackers to the boardrooms of Silicon Valley, New York Times national security correspondent David Sanger—who broke the story of Olympic Games in his previous book—reveals a world coming face-to-face with the perils of technological revolution. The Perfect Weapon is the dramatic story of how great and small powers alike slipped into a new era of constant sabotage, misinformation, and fear, in which everyone is a target.

For more see The Perfect Weapon  Kindle   Hardcover  Paperback

For more on these topics see the CTOvision Guide to National Security Technology and

Additional Reading:

The Air Traffic Control System: We all assumed it was vulnerable, but now we know

If You Drive A Car, Or Know Someone Who Does, You Must Read This…

Pulitzer Prize-Winning Fred Kaplan Explores The Secret History of Cyber War

What You Need To Know About The Administration’s Cybersecurity National Action Plan

Like Kip in Napoleon Dynamite, We love Technology

Breakthrough In Energy We Should All Track: New green technology generates electricity ‘out of thin air’

Future Crimes: Everything Is Connected, Everyone Is Vulnerable and What We Can Do About It

The Security Yearbook by Richard Stiennon

I Thought I Had Seen Some Crazy Things In The Intelligence Community, But Nothing Like Nuking The Moon

Chinese Intelligence Operations In America

In part 2 of our Cyberwar series we’ll take a look at how the Chinese government utilizes the US’s open business environment to stage intelligence operations on American soil.

Reconnaissance: While there has been a lot of recent press on Cambridge Analytica, the reality is there’s a giant industry that sells information on individuals who play a role in national security. Everything from the identities of active duty military personnel and defense contractors to intelligence officials is for sale. By buying data from LinkedIn, advertising firms, conference organizers and trade associations, Chinese intelligence is able to get detailed personal information on every American citizen. As Bob Gourley wrote on CTO Vision, America’s enemies don’t need to hack Equifax to get data on Americans, they can just buy it.

Engagement: Nearly everyday there is an event in Silicon Valley where developers meet to discuss topics such as cybersecurity, machine learning, block chain, high-speed wireless and a host of other new technologies. And at every event you’ll always find someone representing Chinese investors. Similar interactions occur at technical conferences, trade shows and even university campuses around the country.  Such events allow Chinese intelligence operatives to gain critical knowledge on emerging technology.

Infiltration: Once Chinese operatives have identified technology of interest they gain quick access by offering companies access to the Chinese market as well as investment funds. Unaware of the fact that they are interacting with a Chinese intelligence operative, most companies willingly disclose their trade secrets.  In some critical areas like machine learning, Chinese intelligence operatives have infiltrated almost every start up – a topic now getting attention from Committee on Foreign Investment in the United States (CFIUS).

To stop the flow of sensitive information to China will require classifying all information on individuals, companies and strategic technologies under the International Traffic in Arms Regulations (ITAR). Currently ITAR is focused on regulating the export of military technologies however Chinese intelligence operates inside America. By classifying all information under ITAR transfer of data to non-US citizens is deemed an export even if it happens in America.  Thus Chinese intelligence operatives would not be able to buy identities of government personnel nor attend cybersecurity conferences without State Department approval.

The more difficult task for the US Government will be to reverse the investments China has made in technology start ups. Currently any company that has a Chinese investment is viewed as a national security risk by the US Intelligence Community (even though they let foreign operatives into the country). The consequences of being defined a risk are very serious from no access to US Government contracts to not being able to get security clearance.

To reverse Chinese investments in strategic companies Congress would have to to pass a Bill that voids all transactions. Thus any start up that got an investment from a person who was a known by the US Intelligence Community as a foreign operative would be allowed to legally reverse the transaction and clear their name.   As start ups will not have the money to pay back Chinese investors an alternative mechanism such as a note without a date or interest rate will also have to be created.

As with all national security initiatives, shutting down Chinese intelligence operations on American soil will take many years. In the meantime the burden of protecting oneself falls upon individual citizens.

Stay up on these and other related issues at the CTOvision Cybersecurity and Cyberwar Portal.

Also see the CTOvision Guide to National Security Technology and

Track the most disruptive technologies by diving into our categorized index:

Artificial Intelligence Companies – A fast overview of Artificial Intelligence companies we believe are poised to cause the most positive disruption in the enterprise.

Big Data Companies – Reference to the greatest, most disruptive Big Data companies in the tech ecosystem.

Business Intelligence Companies – We assess these to be the Business Intelligence Companies most impactful for delivering real decision advantage.

Cybersecurity Companies – We apply our deep expertise in cybersecurity to assessing the best across multiple categories including:

Cloud Computing Companies – We include both platform and software as a service providers, capturing only the most innovative and disruptive.

Collaborative Tool Companies – These are the firms that help humans connect to humans to create, manage and lead.

Infrastructure Companies – Critical enterprise foundations for business agility.

IoT Companies – Internet of Things and Industrial Internet of Things are here. How do you manage them?

Mobile Companies – Help manage, configure, secure and optimize these very powerful capabilities.

Robotics Companies – Including innovations in Robotic Process Automation, Drones, and industrial robotics.

Services Companies – We only track a few, the ones we really know well.

Tech Titans – These are the big players. We track the tech titans closely since their capabilities change continuously.

VC, PE and Finance Companies – Keeping an eye on the investors can give indications of coming developments.

You can also use our topical pages to get up to speed quickly on the current status of the major megatrends. See our pages on Cloud Computing, Artificial Intelligence, Mobility, Big Data, Robotics, Internet of Things, Cybersecurity and Blockchain and Cryptocurrencies.

We also provide special pages focused on high interest topics, including Science Fiction, Entertainment, Cyber War, Tech Careers, Training and Education and Tech Tips.

Iran’s Hacker Hierarchy Exposed: The Islamic Republic of Iran Makes Maximum Use of Contractors and Universities to Conduct Cyber Operations

On 9 May Levi Gundert, Sanil Chohan, and Greg Lesnewich of Recorded Future provided a detailed assessment on the nature of the cyber threat from Iran titled: Iran’s Hacker Hierarchy Exposed. This report was widely cited in the press and immediately raised the bar for quality in strategic cyber threat intelligence (I saw several other reports from other sources but none held a candle to this one).

You should review the report so you can judge the quality yourself, but here are a few reasons I liked it:

  1. It was not based on a single source (I hate it when analysts try to assess something based only on what is seen in forensic data). This report was based on multiple relevant sources that went far beyond just technical data. Sources also included interviews with trusted people with unique access.
  2. The report provided historical context. History does not always predict the future, but it is important context. Previous research by other firms in the ecosystem, as well as the FBI, is also cited.
  3. It is informed by cultural dynamics best provided by experienced analysts who know their material.
  4. The report provides actionable warnings with justification for the warnings.

Some of the key insights:

  1. There have been times when Iran has abandoned caution. We may be in a similar situation now.
  2. In the past this has resulted in problems controlling the scope and scale of destructive attacks.
  3. There are over 50 estimated contractors vying for Iranian government offensive cyber projects.
  4. Targets in the U.S. may include a wide range of organizations, including banks, financial services, government departments, critical infrastructure providers and oil and energy.

That is just a brief summary. I most strongly encourage you to read the entire report at: Iran’s Hacker Hierarchy Exposed.

Now, what do you do about this threat?

You need to understand that no one is coming to save you. You need to take steps to raise your defenses now, at work and at home. There are things you can do to make it much harder for adversaries to have their way with you. Every company is different, but we have a list of best practices in cybersecurity that we most strongly recommend you review. There is almost certainly some low cost configuration changes you can put in place right now to improve your defenses.

For more on these topics see the CTOvision Guide to National Security Technology and

Cyberwar Is Now A 3-Way Cage Fight

The past few weeks has seen aggressive action by the White House against Russia and China.  Cyberwar has become a 3-way cage fight.  Here’s a quick review of the fight and tactics to improve.

cyber war is a cage fight

US Strategy Not Working: Hit Me, I Can Take It

Data exfiltration by Kaspersky and Huawei have been known for years among US cybersecurity researchers. However US government took the position that they are in control and not to worry. Regrettably the US is taking action against Russia and China AFTER the terabytes of data have been stolen. Lesson: Don’t get hit.

Deploy Countermeasures To Block Attacks

Current US national security strategy is based on a peacetime compliance model not cyberwar. Multi-factor authentication to stop credential theft, application layer access to stop self-propagating malware, encrypted offline data back to stop ransomware and partitioned compute to stop lateral attacks must become national standards.

Be Careful If The Other 2 Team Against You

In a 3-way fight the worse thing that can happen is that the other two fighters gang up on you. Luckily for now that isn’t happening. Russia lost trust in China after they reverse engineered their Su-27 fighter (on top of years of other efforts like that). China in turn doesn’t care for the anti-Asian rhetoric coming out of Moscow. So for now it’s fight among 3 but we need to prepare just in case they gang up on us.

Having A Great Team Makes A Difference

While this is a 3-way fight having a great support team makes a big difference (especially if the other 2 decide to work together). The Five Eyes (FVEY) intelligence consortium (Australia, Canada, New Zealand, UK and USA) should act as a block when any of the partners are attacked. Their surveillance systems are fully integrated facilitating joint action. “Use your mobile phone to steal data from one country and we’ll ban you from all 5.”

No One Said We Can’t Add To Team America

The wild card in the global cyberwar is India. With its vast pool of software developers and access to every compute system in the planet India is a cyber superpower. Traditionally India has been non-aligned but recent tussles with China have them looking to build a military partnership with Russia. The US government should get India onto Team America before its too late.

America will win in the end.  The big issue is how many broken bones we’ll have.

Government Matters TV Explores Email Security Standards, DoD IT and Cloud Security with Bob Gourley

The Global Cyber Alliance continues to coordinate smart guidance, tips and approaches for improving security posture. They are an international, cross-sector organization designed to confront, address, and prevent malicious cyber activity (it is led by the gracious and sociable cyber champion Phil Reitinger).

Their most recent report is titled “Top Federal IT Contractors Leave Emails Vulnerable to Phishing, Spoofing.” It is the result of a study of the use of a special email protocol called DMARC by the top federal contractors (DMARC stands for Domain-based Message Authentication, Reporting and Conformance). Basically this is a widely accepted set of configurations and protocols that can help organizations make sure their domains are not being spoofed by bad guys. Setting up DMARC is pretty easy, and once it is put in place it is harder to have your domain used for phishing attacks against others, and is a little easier to protect your own employees from some kinds of tricks.

With the release of their new report, I was asked by Government Matters TV to provide some context on the report.

Before doing so I did a bit of my own research using the simple to use tool at https://dmarcguide.globalcyberalliance.org/#/

I typed in the domains of every major defense contractor myself. Like the Global Cyber Alliance I found only one of the top 50 was in compliance. I was so excited to find it was the team at Carahsoft who had put this in place. I had the pleasure of telling that to Craig Abod of Carahsoft in person today. Craig knows the importance of this to keeping trust with partners and customers in the ecosystem. I know others in the community also aspire to be as trusted as Carahsoft and imagine we will see many others follow suit soon. I would also recommend that anyone in the federal ecosystem, in or out of government, that wants tips on how to implement DMARC should reach out to Carahsoft. They have the experience to get you started on that right away and can also recommend software tools to help make it iron clad.

I was asked to provide context on this for GovMattersTV. For more see the video at this link and below:

The video also provides some context on suggestions of a consolidation of DoD IT and on lessons from the RSA conference, and mentions the Cloud Security Alliance.

 

Global Cyber Alliance Release: Perhaps the most important of the 2018 RSA Conference Season

Every year the RSA conference brings together members of the cybersecurity community for a week of presentations, discussions, tech demos and socials. Concurrent with the event there is always a flurry of press releases. Many are designed to highlight a company’s product or service. Many, like the announcement of the new Microsoft led coalition of tech firms, might be well intentioned but highlight something that will have zero impact. But there are always a few releases that are worth focusing on.

Which leads us to the Global Cyber Alliance. The Global Cyber Alliance is an international, cross-sector effort designed to confront, address, and prevent malicious cyber activity. It is led by an icon of the cybersecurity community, Phil Reitinger, and Phil is a guy known for focusing on action that can be measured (the motto of the alliance is “Do something. Measure it”.

While any organization under Phil will make a difference, this one is unique in that it spans across borders, sectors, and industries. Like the Internet, it is not bound by geography.

The press release that caught my attention pasted below. This is clear evidence that the Global Cyber Alliance is making a difference.

Review it and then please realize now it is your turn for action. Use the tools and information provided by the Alliance to improve your own email security and better defend your part of cyberspace, and also use their tools to help your business partners and supply chain better defend their part of cyberspace.

GLOBAL CYBER ALLIANCE LAUNCHES FREE TOOLS TO SECURE WEBSITES AND EVALUATE RISK FROM PARTNER EMAIL

From: GlobalCyberAlliance.com

SAN FRANCISCO, CA, April 17, 2018 – The Global Cyber Alliance today released two new free, open-source tools to enable organizations to reduce cybersecurity risks associated with website and email born cyberattacks.

GCA McScrapy enables organizations to lock down their website to remove potential security issues from third-party services and other unnecessary functionality. In addition, a new email security tool – the GCA DMARC Risk Scanner – allows organizations to determine if the organizations on which they depend, such as their trading partners and supply chain, are protecting their email domains from being spoofed or phished.

“Reducing risk is the best cyber defense,” said Philip Reitinger, president and CEO of the Global Cyber Alliance. “Among the most popular open doors that cyber criminals exploit are phishing attacks and compromise of an organization’s website. The tools we released today are designed to help stop these attacks and prevent loss to businesses.”

GCA McScrapy: Locking Down Websites

While GCA McScrapy can be used on websites developed with any content management system, nearly 60 percent of websites are designed using the WordPress platform. While WordPress is a popular platform, by its nature, its functions raise the risk of potential compromise. WordPress dynamically composes web pages using PHP and JavaScript and thus carries with it a risk for bugs and security vulnerabilities that serve as an attack vector. According to a WP WhiteSecurity October 2017 report on WordPress vulnerabilities, there are 2407 known vulnerabilities, more than half those vulnerabilities (54%) are from WordPress plugins and 31.5% are core WordPress vulnerabilities. The two most prevalent vulnerabilities are cross-site scripting and SQL injection.

GCA McScrapy converts a website into a set of static files, removing unnecessary functionality. Using a static website nullifies many concerns of cross-site scripting and SQL injection since there is no communication with the website’s content management system for dynamic content. The tool evaluates every part of a website and renders it into simple form, keeping as much functionality as possible, while removing potential security issues such as third-party services.  Not all functionality can be maintained, however, and updating websites takes extra steps, making GCA McScrapy best for websites for which security is very important.  GCA McScrapy is also highly configurable and can be adjusted to reduce scan times and scrape mobile sites. GCA McScrapy is free for anyone to use. Learn more about GCA McScrapy at github.com/GlobalCyberAlliance/.

GCA DMARC Risk Scanner: Holding Partners Accountable

 The Domain-based Message Authentication, Reporting & Conformance (DMARC) security protocol enables organizations to protect their email domains from being used by spammers and phishers to trick employees, customers and trading partners.

The GCA DMARC Risk Scanner can be used to scan hundreds of domains at one time to determine the level of DMARC and Sender Policy Framework (SPF) protections used by an organization’s partners, including the third parties with whom it works, its supply chain, and its trading partners.  This enables an organization to better understand, and act upon, the risk imposed on it by its partners who have not employed DMARC.

Without DMARC implemented, scammers and criminals can easily “spoof” an email domain to steal money, trade secrets or even jeopardize national security. DMARC weeds out fake emails (known as direct domain spoofing) deployed by spammers and phishers targeting the inboxes of workers in all sectors of society.  According to the 2017 Symantec ISTR report, 1 in 131 emails contained malware, the highest rate in 5 years.

Like all GCA tools, the GCA DMARC Risk Scanner is freely available at github.com/GlobalCyberAlliance/. Learn more about DMARC at dmarc.globalcyberalliance.org.

About the Global Cyber Alliance

The Global Cyber Alliance (GCA) is an international, cross-sector effort dedicated to eradicating cyber risk and improving our connected world. We achieve our mission by uniting global communities, implementing concrete solutions, and measuring the effect. GCA, a 501(c)3, was founded in September 2015 by the Manhattan District Attorney’s Office, the City of London Police and the Center for Internet Security. Learn more at www.globalcyberalliance.org.

Secure Enclaves: Foundation For The Cloud-Based Enterprise

This is the first in a series of blog posts examining a cloud-based enterprise. In this post we’ll introduce how a Secure Enclave can help enterprises migrate to a cloud-based model.

The two dominant themes in enterprise architecture today is the desire to save money by utilizing cloud services and threat of state-sponsored cyberattacks. The goal of a Secure Enclave is to help enterprises meet both objectives by implementing a trusted access control solution in the cloud.

All IaaS and SaaS providers utilize a shared security model in which they take responsibility for the data inside their boundary but expect the enterprise to be responsible for everything outside their perimeter. For example, enterprises are responsible for all damage due to stolen passwords or unauthorized access to compute instances. Thus the security challenge for cloud-based enterprises to how to enable perimeter security when all they have is the cloud?

A Secure Enclave utilizes a Software Defined Perimeter (SDP) security model to create a protected IaaS instance inside which role-based access control,  trust assessment, certificate management and addressing functions can be deployed. Additionally a Secure Enclave can also protect IaaS and SaaS applications from network-based cyberattacks including self-propagating malware.

Looking at the high level architecture below we see Secure Enclaves supporting trusted access control functions for IaaS and SaaS applications.

Secure Enclave Vidder Junaid Islam

 

The first task of a Secure Enclave is to implement trusted access control to IaaS and SaaS applications. Trusted access control combines role-based access control with device trust assessment. Trust assessment allows enterprises to conduct a remote posture check on user devices before granting access to cloud services. For example, enterprises can verify if a device has updated software and is running endpoint protection. If the device is acceptable then one or more SAML assertions are generated based on the role of the individual.

Secure Enclaves can also be used protect IaaS instances from network-based cyberattacks. Only authorized users and their devices are granted TCP connectivity to IaaS compute instances.  Moreover to block the new generation of self-propagating malware, only application layer connectivity is granted to authorized devices.

One of the unique features of a Secure Enclave is how it protects SaaS applications from stolen passwords. Enterprises can utilize the federation capabilities to SaaS apps to re-direct sign-in requests to their SAML IdP. However only users who have access to the protected IdP can get the SAML assertion. Thus Secure Enclaves can be used to provide transparent multi-factor authentication to SaaS.

In the next post we’ll take a deeper look at the trusted access control functions of the Secure Enclave.

Maximize The Value Of Your 2018 RSA Show Visit

Planning, deploying and operating a cybersecurity architecture is difficult because it requires understanding of different disciplines. The key to having a functional security architecture is integrating identity, access control, endpoint protection and file encryption systems together (across data center and cloud environments). The importance of getting everything right is even more critical with the growing threat of state-sponsored cyberattacks.

Fortunately the RSA show is one of the few events with technical personnel in attendance. The key to getting full value from your trip is fighting the urge to look at flashy displays and instead interacting with subject matter experts. Here is a simple 5-step process you should consider to maximize the value of your 2018 RSA show visit:

1 Know your cybersecurity priorities. The first step to a successful visit is having a clear understanding of your cybersecurity priorities. Create a list that groups priorities into compliance, transformational and countermeasure categories. Send an email to yourself so that you don’t miss any important details when talking to people.

2 Take time to talk to experts once you’ve found one. Once you’ve identified a person with the expertise you seek, share your priority list with them. Take the time to understand their approach to solving your problems. Ask to walk thru the software architecture of their solution to ensure you’ve not missed any important details.

3 How well does the product integrate with your environment. Cybersecurity products that don’t integrate with others are useless. Now that you’ve found a valuable product and a person who is knowledgeable, work out an integration strategy with the solution being offered and others in your environment.

4 What is the user experience and benefit. New cybersecurity products have to provide a tangible benefit to users or there will be resistance. Identify a win for the user to make the new product more appealing. Request a demo from the end user’s perspective and try it yourself.

5 Does the product protect against state-sponsored cyberattacks. Russian self-propagating malware and Chinese data exfiltration represent the biggest cybersecurity threat facing America today. Thus ask how their product helps your company protect against state-sponsored cyberattacks.

Even if you find only 2 or 3 subject matter experts to review your priority list, the trip will pay for itself. If you run out of time at the show offer to buy them dinner in exchange for their expertise – it’ll be way cheaper than hiring a consultant.

Related Reading

Like Kip in Napoleon Dynamite, We love Technology

How Far? The Line Between Compassionate Care and Ruthless Efficiency

Bryson Bort of Scythe Discusses IoT Vulnerabilities and Threat Trends To Date

Transition for One of The Nation’s Greatest Enterprise CTOs: Dave Mihelcic Retires From DISA

Miracle on Ice: Business, Technology and National Security Leadership Lessons from the 1980 Olympics USA Hockey Team

Happy New Year: Here Are Five Suggestions To Reduce Your Digital Risk

The First Quantum Revolution: Foundational information for the enterprise CTO

More Content

Cyber War

SciFi

Super Bowl Ads Indicate Big Businesses Think You Are Afraid of AI

Tom Loftus provided an insightful review of some of Super Bowl ads in the 4 Feb 2019 Wall Street Journal. Like AI parody in SNL, these ads really poked fun at computers: Seriously, did anyone catch the commercials? If the Super Bowl is the zeitgeist, then it is safe to say that America is not […]

HBO’s Westworld: The Man In Black is a special kind of Twitter user

HBO’s Westworld is a modern take on the Michael Crichton SciFi tale of a robotic amusement park. The HBO version has a new twist. The creators/writers were all exposed to years of Twitter, which has influenced every episode and the entire arch of two seasons of the show. Now that season two is wrapping up, […]