CTOvision.com

Context for the CTO, CIO, CISO and Data Scientist

You are here: Home / Archives for Cyber War / Cyber Security

Cybersecurity Is Not Just About The Tech

Cybersecurity may well be the most important function in the modern world. Without it, nothing else can be trusted, in any sector of the economy.
hacking-detected-shutterstock_188832089Cyber Security is far more than just protecting data. Security is about protecting the functionality of IT. It involves confidentiality, availability and integrity of resources. This higher order approach to cyber security requires vision, leadership, and actions in dimensions of people, process and technology.
 We also need to draw your attention to the higher order concept of Cyber War. This is, unfortunately, something all technologists should be familiar with now. The most critical piece to read on that topic now is Now That You Are A Soldier In The Cyber War You Must Know Your Cognitive Biases followed by: Main Street Cybersecurity: Can Email Be Safe? and Time for Transformational Cybersecurity!

Stay In The Loop: Sign Up To The CTOvision Daily

When it it time to research the great providers of Cybersecurity Solutions, kick off  your search in the CTOvision Disruptive Technology Finder. Pay particular attention to the sections on Cybersecurity, CASB, Cyber Threat Intelligence, and VPN.

For help putting all this information into context for your business, consider tapping into Crucial Point's CTO-as-a-Service or Technology Due Diligence offerings, both are ways to quickly leverage the technical talents of experienced enterprise technology professionals.

Now That You Are A Soldier In The Cyber War You Must Know Your Cognitive Biases

None of us wanted this cyber war. But now that it is here all of us are targets.

Even before the cyber war we were being overwhelmed with data. The average citizen is surrounded with information from TV, radio, entertainment, the Internet, social media, co-workers, neighbors, family, schools, the government as well as old sources like books, magazines, newsletters and newspaper. This overwhelming deluge of information is a mix of reporting that includes both valid insights and specious reporting meant to appear to be valid. Yes, some of what we are being subjected to is total baloney!

But now on top of that we are being actively attacked by both cyber attacks and deceptive propoganda from hostile foreign powers. So, like it or not you are a soldier in this fight. In fact, you are the first line of defense. Your weapon in this war, your brain, is our greatest sense of hope. Your brain is what can keep you from getting deceived and what can help you configure your systems at home and work to thwart cyber attacks. It is also the only real way to make sense in this world of information overload and hostile foreign power deceptive operations.

Like any other soldier, you will be more effective if you train with your weapon and learn to operated it with military discipline. And, like any other soldier, if you fail to operate your weapon the right way you may cause more harm than good. If we are to win at cyberwar we all need to train our brains.

All of this means it is more important than every to understand the nature of cognitive bias. If we were in a state of cyber peace, studying cognitive biases would be a nice to have tactic that could help you succeed in life and business. But now that we are in cyber war it is critical that we all study these with the objective of enhancing our mental acuity.

Be a better soldier in the cyberwar. Study this video of the 12 Cognitive Biases:

Biases covered include:

  1. Anchoring Bias
  2. Availability Heuristic Bias
  3. Bandwagon Bias
  4. Choice Supportive Bias
  5. Confirmation Bias
  6. Ostrich Bias
  7. Outcome Bias
  8. Overconfidence Bias
  9. Placebo Bias
  10. Survivorship Bias
  11. Selective Perception Bias
  12. Blind Spot Bias

Learning these biases can help you keep your wits about you in this age of interconnected computers and global cyber war. You see, the bad guys also study human nature, and they try all they can think of to trick you into giving them access to your systems, information, money, or in manipulating your thoughts into believing their propaganda.

For more on why this is so very important, read our expert commentary at our Cyber War site.

More CTOvision Reporting:

For more on these topics see:

DataTribe Launches Inaugural Cyber Funding Competition: The DataTribe Cyber Crucible (putting up $Millions in funding)

One of the most virtuous activities in the American economy is the smart deployment of investment money on disruptive technologies. When done right, this can be a win for so many stakeholders, including businesses, governments and the general public. The team at DataTribe has already been taking virtuous, company building action that is creating value for multiple stakeholders, and is now establishing a new competition to identify high technology startups who could benefit from startup funding.

We encourage all to view the press release DataTribe released and broadly share it, this is a tremendous opportunity for innovators with an already developed concept to bring attention to their work and potentially gain the attention needed to transform their product and vision into a viable company.

For more see the DataTribe press release below:

Startup Studio DataTribe Launches Inaugural Cyber Funding Competition – the DataTribe Cyber Crucible

PR Newswire 

Winners Will Be Eligible For Up To $2 Million in Seed Financing, Potentially Millions More in Series A Venture Capital

Three Finalists Will Also Share $20,000 in Prize Money

FULTON, Md., Feb. 5, 2018 /PRNewswire/ — DataTribe, a cybersecurity startup studio, announced today that it is launching the DataTribe Cyber Crucible, a competition to identify high-technology startups with a vision to disrupt cybersecurity and data science.

The three finalists will split $20,000 in prize money, and one may receive up to $2 millionin seed capital from DataTribe. This could be followed by up to $6.5 million in Series A venture funding from DataTribe and AllegisCyber, a Silicon Valley-based cybersecurity venture capital firm. Startups with less than $1.2 million in seed financing are eligible to apply.

DataTribe’s Next Big Investment Opportunity

“This is an excellent opportunity for early-stage, elite cybersecurity and data science startups to develop further traction and move into the mainstream of the venture capital funding process,” said Mike Janke, a DataTribe co-founder. “This experience will provide them with a roadmap for the initial stages of launching a cyber startup with a commercial product.”

“For DataTribe itself, this is an opportunity to identify our next big thing,” added Bob Ackerman, Founder and Managing Director of AllegisCyber Venture Firm and co-founder of DataTribe.

DataTribe has already built a unique reputation as a partner with elite engineering teams at the cutting edge of innovation, typically leveraging their experience at national security agencies or government labs. DataTribe’s mission is to advance the state of the art in cybersecurity and data science.

Competition Guidelines

All contestants must have already developed a robust concept or initiated development of a minimal viable product (MVP) – i.e., a product developed with sufficient features to entice early adopters.

Preference will be given to early-stage startups based in a Five Eyes nation (Australia, Canada, New Zealand, the United Kingdom and the United States) and with experience working in national security, defense, national laboratories, or at cybersecurity and data science R&D organizations. Contestants with appropriate commercial experience will also be given extra consideration, but commercial experience is not required.

Contestants have until March 23 to apply at www.datatribe.com/go/cybercrucible/. DataTribe will review submissions for technical merit, market potential, and readiness of the team. On April 2, DataTribe will announce up to three finalists. These teams will then have three weeks to refine their pitch and prepare for final judging, with assistance from the DataTribe’s team of startup veterans. Finalists will present a pitch and answer questions from judges on April 25 at DataTribe Headquarters in Fulton, MD.

The judging panel includes Mike Aiello, Google’s Product Manager for Privacy and Data Protection; Tony Cole, global Government CTO at FireEye; John N Stewart, Chief Security and Trust Officer at CISCO; Daniel Weinand, co-founder of Shopify, the large publicly-traded provider of ecommerce solutions; Mike Janke, co-founder of DataTribe and six-time company founder; Bob Ackerman, founder and managing director of AllegisCyber; and Steven Witt, co-founder of DataTribe and past CEO of Onyara.

Finalists will share a prize pool of $20,000, and will be considered by DataTribe for up to $2 million in seed funding, and approximately another $1 million in in-kind support services.

Several DataTribe-backed companies have gathered media headlines recently, such as Dragos, the industrial cyber security company, which made headlines over CRASHOVERRIDE and TRISIS. Other DataTribe portfolio companies, include: Enveil; which was the runner-up at last year’s RSA Innovation Sandbox competition and, ReFirm Labs; recently featured on Fox News, Washington Post and Fortune for Firmware vulnerability disclosures.

About DataTribe

DataTribe was launched in 2015 with the vision of empowering technologists in the Washington, D.C. region to build and grow successful cybersecurity companies. Founded by leading investors, startup veterans and alumni of the U.S. intelligence community, DataTribe commits capital, in-kind business services and decades of professional expertise to co-build the next generation of cybersecurity, big data and analytics companies. DataTribe is headquartered in Fulton, MD, with offices in San Francisco, CA.For more information, visit https://datatribe.com.

Thought Leaders In Direct Contact With Adversaries Provide Insights Into New Cyber Attack Techniques

One of the greatest things about the annual RSA Conference is the open sharing of lessons learned between cybersecurity practitioners. One of the sessions I found most rewarding and insightful focused on new cyber attack techniques. This session, moderated by the SANS Institute’s Founder and Research Director Alan Paller, included insights from Ed Skoudis, Michael Assante and Johannes Ullrich. Ed Skoudis leads pen testing and hacker exploits immersion training programs at SANS and conducts forensic assessments/diagnoses of major attacks and in doing so maintains continuous awareness of the state of attacks. Michael Assante is highly regarded for his deep knowledge of industrial control systems and is a champion of the emerging discipline of ICS security. Johannes Ullrich is the director of the SANS Internet Storm Center, the early warning system for the Internet.

These great leaders are all known for their ability to convey information succinctly and in ways that stick and this session provided an overview that brought out the best of their knowledge. They structured the discussion around seven new attack techniques.

The session is now available online:

Key takeaways:

  • Expect ransomware to continue to evolve: 150 different families of crypto ransomware today.
  • IoT attacks will continue to evolve: Already used for DDoS. Soon for data extraction.
  • Ransomware and IoT will collide: What if your IoT is shut down till you pay.
  • ICS systems will come under attack, including systems controlling manufacturing plants and buildings
  • Weak random numbers causing a growing concern: Need random numbers of greater entropy.
  • Reliance on web services as software components introduces new threats: Everyone dependent.
  • Threats against new databases (NoSQL) growing: Placing large data at risk.

There are things that can be done to mitigate all these threats. But stopping them starts with awareness.

If you are looking for insights into ways to beat these threats contact us today for more information.

Other Reading:

OODAloop Network Benefit: Direct participation with other members in monthly research meetings(Opens in a new browser tab)

White House Takes Action Against Chinese Intellectual Property Theft(Opens in a new browser tab)

Big Data Project Management: Data Must Flow!(Opens in a new browser tab)

Quick Look On Report of the President’s Commission on Cybersecurity

The report of the President’s Commission on Enhancing Cybersecurity has just been posted to the White House Website. You can download the report here).

My quick thoughts:

  • If you are a technologist or a security expert or have been tracking security issues, you can skip the first 10 pages. You know the state of things. This section is not meant for you.

  • The recommendations of the report are well thought out and worth you slowing down and reading carefully.

  • Most all of the recommendations require action by the new administration. But those of us in industry and academia can help here too. So can Congress.

I’ve reviewed all the recommendations and can see the wisdom of what is being suggeted here. I would like to have seen one other recommendation, a meta-recommendation, that makes it clear that the most important thing any of us can do to enhance security is to take responsibility for our own IT. Maybe that was implied here. But I would have liked to see that hit head on.  But still, call me a supporter of the report and its recommendations.

Digital Risk Management Leader RiskIQ Raises New Funding To Expand Platform Ecosystem, Sales and Digital Risk Applications

Editor’s note: When I read of a great firm like RiskIQ investing to expand their platform I immediately think of the positive impact to current and future customers. But strategically this also means that large teams of investors believe strongly in the powerful capabilities and strong future of this company. With that in mind we share a RiskIQ press release below -bg

Digital Risk Management Leader RiskIQ Attracts $30.5 Million in Series C Funding

New Capital Infusion to Expand Platform Ecosystem, Sales and Digital Risk Applications

SAN FRANCISCO – November 10, 2016 — RiskIQ, the leader in digital risk management, today announced that it closed $30.5 million in Series C funding led by Georgian Partners. Existing investors Summit Partners, Battery Ventures, and MassMutual Ventures also participated in the round, further validating the company’s leadership position and market opportunity. This financing will enable the company to expand its ecosystem, global sales, and platform applications within the disruptive Digital Risk Management market.

Threats outside the firewall are vast and dynamic. RiskIQ provides organizations access to the widest range of security intelligence and applications necessary to understand exposures and take action – all without leaving the platform. Similar to Google, RiskIQ applies machine learning and data science to continuously improve platform intelligence and broaden functionality by leveraging big data, customer usage and attack activity. With RiskIQ, enterprises can efficiently defend their digital attack surface, pinpoint exposures across their business, and dynamically mitigate cyber threats across web, mobile, and social.

Since 2009, RiskIQ has enabled security staff to reduce the time needed to understand new threats, speed up investigations, and more effectively prevent and remediate incidents. The company helps protect some of largest and most trusted names in financial services, technology, retail, government, healthcare, media and manufacturing around the world, including Facebook, DocuSign, UnderArmour, Lagardere, and Publishers Clearing House. RiskIQ was recently named a leader for Digital Risk Monitoring and received the highest score for the current offering category in The Forrester Wave™: Digital Risk Monitoring, Q3 2016. In the first half of 2016, the company reported year-over-year bookings growth of 80 percent, growing bookings and new customer acquisition for every product in its platform. Through RiskIQ’s revamped channel program, the company has successfully penetrated European and Asian markets. Today, RiskIQ has more than 200 enterprise customers, over 13,000 security analysts using the RiskIQ platform, and hundreds of users subscribing to the RiskIQ PassiveTotal digital threat investigation tool each week.

“We are pleased to have Georgian Partners as part of our strong investment and advisory team. Georgian, like RiskIQ, was founded by entrepreneurs. We share similar business values and philosophies,” said Lou Manousos, CEO and co-founder of RiskIQ. “They know what it takes to develop a business into a customer-focused, long-lasting, and profitable company – values that our entire board of directors shares.”

“RiskIQ has already designed the platform to dominate the Digital Risk Management market, and we are excited to contribute to their success,” said Steve Leightell of Georgian Partners, who will join the Board as part of the transaction. “Our team of experts in applied analytics, applied artificial intelligence and security first could not be better suited to partner with RiskIQ on their next phase of growth,” said Justin LaFayette, managing director at Georgian Partners.

Greg Goldfarb, managing director at Summit Partners, added: “The future of security is connecting the inside and the outside of the enterprise boundary. Threats start outside the firewall, move inside, and exfiltrate data back outside – and all the while malicious actors can compromise a company’s digital assets, vendors, and customers across web, mobile, and social environments. RiskIQ lights up the entire digital world outside of the controlled perimeter and connects that activity to a company’s internal security regime for 360-degree security.”

Michael Brown, general partner at Battery Ventures, added: “You only need to read the headlines to see that cyberattacks are taking their toll on organizations who fail to extend security controls beyond the firewall. While the majority of data breaches are from external sources, addressing the problem with traditional security tools is inefficient. RiskIQ has built the right commercial platform to manage a broad range of digital threats in an agile way that can address future attack vectors.  We believe the company is well positioned to capitalize on this tremendous market opportunity.”

About RiskIQ

RiskIQ is a cybersecurity company that helps organizations discover and protect their external-facing known, unknown, and third-party web, mobile, and social assets. The company’s External Threat Management platform combines a worldwide proxy and sensor network with synthetic clients that emulate users to monitor, detect, and take actions against threats. RiskIQ is used by thousands of security analysts including many from the Fortune 500 and leading financial institutions to protect their digital assets, users, and customers from external security threats. The company is headquartered in San Francisco, California, and backed by Summit Partners, Battery Ventures, Georgian Partners and MassMutual Ventures. Information security professionals can sign up for a fully functioning trial version of PassiveTotal for free by visiting www.riskiq.com/whats-new-passivetotal.

To learn more see the CTOvision Solutions Directory: RiskIQ

We Need A National Cybersecurity Strategy That Everyone Can Implement

In a few months we’ll have a new Administration in Washington and a chance to update our national security policies.  So it’s good time to reflect on what we might want to do differently for cybersecurity.

A quick search on the Internet will reveal many national cybersecurity initiatives. However given the recent data theft of DNC emails and DDoS attack on Dyn it’s evident that current initiatives aren’t working. The question to ask is why?  The quick answer is that we don’t have a national cybersecurity strategy that everyone can implement.

Click on any cybersecurity initiative you desire and you’ll find comprehensive strategies developed by smart security experts.  While well intentioned the writers make the common mistake of laying out cybersecurity strategies that are too complex for most organizations.  Apart from the top 0.1% of US organizations (financial institutions and intelligence agencies), the 99.9% simply don’t have the resources to implement anything complex.

A workable national cybersecurity strategy needs to be built using simple tasks the 99.9% can implement to mitigate the most common cyber attacks. For those organizations have a higher threat profile, a cybersecurity strategy should also offer a clear path to step-up their security posture when called for. Thus we need a basic requirement that everyone can implement (without exception) plus a step-up path when necessary.

Another challenge in developing a national cybersecurity strategy that uniquely American is that we are an open society where the bulk of IT tasks are outsourced.  Thus cyber attackers know exactly what we’re doing.  A national cybersecurity strategy must be based on verifiable tasks (not secret activities) that reduce cyber risk.

So here’s three things the nation can do to make it less vulnerable to cyber attacks:

1/ Implement 2-Factor Authentication

Basic: Implementing two-factor authentication is the simplest mitigation against credential theft.  The great thing about 2-factor is there are so many free or low cost solutions out there from mobile phone texts messages to soft client tokens to email verification. So there’s really no excuse not to do this!

Step-up: For those organizations desiring to step-up from 2-factor, there are new attribute-based access control solutions like software defined perimeter (SDP) that verify device and user identity as well as check for software tampering.

2/ Encrypt Data Stores  

Basic: Application data stores, email servers and collaboration applications should all have their data encrypted.  Ideally the private key must be on a different physical server from the storage unit and should only be assessable with 2-factor authentication.

Step-up: The next step up from encrypting data on servers is keeping it encrypted on user’s devices.  This requires a bit more work, such as issuing and managing device certificates, but makes it more difficult for cyber attackers to get to data even if they compromise the user’s device.

3/ Lockdown Servers

Basic: Scanning for open server ports is a favorite technique of cyber attackers to gain entry to an organization.  Thus closing un-used interfaces is one of the easiest mitigation techniques. This can be done by configuring the internal Firewall on Internet facing application servers.

Step-up: Implement the OWASP Top 10 controls to further insure your Internet facing servers are not vulnerable to front door attacks.  Additionally locking down internal servers with host-based Firewalls or software defined network (SDN) is also recommended for those organizations with higher risk profiles.

 

Looking at the short “short list”, you’ll find the recommended tasks have been around for decades.  While not fancy they’re proven to be effective.  More important, there’s no excuse for everyone not being able to implement them!  One can only speculate that if the DNC had encrypted their email storage system and implemented 2-factor how history would be different? Or if stronger authentication would have lessened the DDoS attack on Dyn?

A national cybersecurity strategy is well within our reach.  We just need to align available security tools and techniques against the most common threats. There is no reason why this cannot be done.

The Shifting Cyber Attack Target Set And Why It Matters To The Mid-Sized Business

For years now the firms with the most to lose by cyber crime have been investing in cyber defense technologies, techniques and procedures designed to mitigate threats. Motivation do enhance defenses has largely been directly correlated to the potential for loss. Resources put on cybersecurity and threat mitigation has been correlated to size of a business. If a firm has a lot to lose and a lot to invest, like one of the top ten banks, for example, very well developed cyber security programs can be expected.

The largest firms are mounting such a significant defense that attackers are shifting their focus. It can be far more lucrative to target a mid-sized business.

Cybercriminals view the mid-sized business as right in a sweet spot of having resources to target but not enough defenses.

Our reporting on OODAloop.com has shown indications of this shift. Although the big attacks (Target, HomeDepot, OPM, Anthem, NSA etc) get lots of media attention, most attacks are on smaller firms.  Statistically 95% of attacks are against mid-sized or small businesses. 50% of attacks are against firms with less than 250 employees.

What is troubling about this is that smaller firms have a much harder time recovering from attack. Breach requires cleanup, forensics, notification of employees, customers, clients, causes costly damage to brand, may diminish goodwill, and can result in direct financial loss. A smaller firm can have a very hard time recovering.

Digital life is unfair. The big guys like Target, Home Depot, eBay all recovered from massive cyber attacks with no noticeable impact on share price a year after their attacks. But mid-sized businesses may well be driven to bankruptcy.

Yep, life is unfair. So if you are a mid-sized business, get over how unfair it is and think through what to do about it. Some questions to consider:

  • Do you know what data is most important to you and your business? What would cause a potential extension event if it were compromised or corrupted? How are you protecting that data? Is it encrypted? Who manages the encryption? How do you do identity management and access management/control over access to that data?
  • Do you have a process in place to learn from others? No matter what your industry is there are places to learn best practices and procedures to improve your security. One place to start is the National Cyber Security Alliance, but most businesses will also be able to tap into organizations focused on your sector.
  • Do you have external advice and assistance from professionals who know cybersecurity, the cyber threat and cyber risk mitigation strategies? No one can do this alone. We would love to help. Get in touch at: OODA LLC.
  • Are you tracking the strategic cyber threat? We provide a free daily newsletter called The OODA Daily Pulse which provides succinct context that can inform your cybersecurity strategy and help you optimize your cyber defenses.

Life is tough for the small to midsized business. Our view is it should not be any tougher than it needs to be.

Track the most disruptive technologies by diving into our categorized index:

Artificial Intelligence Companies | Big Data Companies | Business Intelligence Companies | Cybersecurity Companies | Cloud Computing Companies | Collaborative Tool Companies | Infrastructure Companies | IoT Companies | Mobile Companies | Robotics Companies | Services Companies | Tech Titans | VC, PE and Finance Companies

For more see:

DDoS Attacks: What Happened And What We Should Do About It

The security community has been watching the DDoS threat grow to incredible levels. DDoS attacks are up 75% over last year. Over 30% of attacks reach sustained peaks of over 10 Gbps, an amount that will swamp most every business user. Some very large attacks have gone as high as 600 Gbps, a size that is overwhelming to the largest infrastructure providers.

On 21 October 2016 one of these very large attacks occurred against Internet infrastructure provider Dyn. This resulted in outages of many highly popular sites, disrupting access to Amazon, Twitter, Reddit, Airbnb, New York times, Spotfiy, Netflix and many others. Dyn provides many advanced services to these providers including managing their DNS. Since DNS is critical to how computers find other computers, traffic to these major sites was impacted because of the Dyn DDoS attack.

The probable attack vector was compromised IoT devices controlled by malicious code called “Mirai”.  This software scans the Internet for devices that still use default passwords, and then uses common protocols like telnet to log into those devices. After doing that it is in control of the device. The code actually hardens the devices a little bit to prevent other attacks against it. From that point on the device can be used as a node in a DDoS attack.

What can be done to prevent this attack or mitigate the impact of similar attacks when they occur? We provide our thoughts here, segmented into recommendations for Home Users, Business Users and Local, State, Federal Governments.

More Content

Cyber War

SciFi

Super Bowl Ads Indicate Big Businesses Think You Are Afraid of AI

Tom Loftus provided an insightful review of some of Super Bowl ads in the 4 Feb 2019 Wall Street Journal. Like AI parody in SNL, these ads really poked fun at computers: Seriously, did anyone catch the commercials? If the Super Bowl is the zeitgeist, then it is safe to say that America is not […]

HBO’s Westworld: The Man In Black is a special kind of Twitter user

HBO’s Westworld is a modern take on the Michael Crichton SciFi tale of a robotic amusement park. The HBO version has a new twist. The creators/writers were all exposed to years of Twitter, which has influenced every episode and the entire arch of two seasons of the show. Now that season two is wrapping up, […]