CTOvision.com

Context for the CTO, CIO, CISO and Data Scientist

You are here: Home / Archives for Cyber War / Cyber Security

Cybersecurity Is Not Just About The Tech

Cybersecurity may well be the most important function in the modern world. Without it, nothing else can be trusted, in any sector of the economy.
hacking-detected-shutterstock_188832089Cyber Security is far more than just protecting data. Security is about protecting the functionality of IT. It involves confidentiality, availability and integrity of resources. This higher order approach to cyber security requires vision, leadership, and actions in dimensions of people, process and technology.
 We also need to draw your attention to the higher order concept of Cyber War. This is, unfortunately, something all technologists should be familiar with now. The most critical piece to read on that topic now is Now That You Are A Soldier In The Cyber War You Must Know Your Cognitive Biases followed by: Main Street Cybersecurity: Can Email Be Safe? and Time for Transformational Cybersecurity!

Stay In The Loop: Sign Up To The CTOvision Daily

When it it time to research the great providers of Cybersecurity Solutions, kick off  your search in the CTOvision Disruptive Technology Finder. Pay particular attention to the sections on Cybersecurity, CASB, Cyber Threat Intelligence, and VPN.

For help putting all this information into context for your business, consider tapping into Crucial Point's CTO-as-a-Service or Technology Due Diligence offerings, both are ways to quickly leverage the technical talents of experienced enterprise technology professionals.

What Local, State, Federal Governments Should Do To Mitigate DDoS Threats

Governments have special roles in helping prevent DDoS attacks. Governments at Local, State and Federal Levels have massive infrastructures that should be protected to help prevent DDoS on others and they have important citizen-facing missions that need protection themselves. Governments can also help us all take collective action.

We have all been tracking the the threats of DDoS evolve to the point where we all need to take collective action to prevent attack. This post provides some of our suggestions on what governments can do in this regard:

  • Legislatures should consider how to encourage network operators to operate in secure ways. One concept would be to grade network providers like healthcare providers are graded and do so in a way that provides the public with results.
  • Law enforcement should avail themselves of the powerful research tools used in the cybersecurity community. One critical source is Passive Total. This comprehensive data collection makes it easy to search, correlate and analyze adversary infrastructures. Network defenders can use this to take defensive action, but law enforcement can use it to take legal action and help shut down the bad actors.
  • Local law enforcement is a tremendous resource for scaling information to every citizen. Local law enforcement should continue to evolve to helping citizens prevent and deter crime by helping inform the public on cyber threats through all available media channels (to be effective at this, law enforcement should study the cyber threat as well).
  • Governments and agencies at Local, State and Federal levels should all ensure DNS firewalls are in place. We recommend Verisign’s DNS Firewall. It provides cloud-based network security based on is built on Verisign’s global recursive DNS platform.
  • Ensure your workforce is tracking the cyber threat by signing up for the OODA Daily Pulse.  This will provide strategic warning of threats and info on mitigation strategies.
  • Government employee training is also key. One way to raise awareness is through our book, The Cyber Threat. This succinct overview articulates the threat in ways that inform and lead to collective action.

We also provide insights and tips aimed at the Businesses and for Home Users. Please review and help get those tips into the right hands.

What Business Users Should Do To Mitigate DDoS Threats

Businesses have long known of the threats of DDoS to their operation, and the security community has been watching this threat evolve to the point where we all need to take collective action to prevent attack.

  • Businesses of every size need to know what devices you have and what you have them for. This gets hard but must be done if you are to optimize your IT. If you don’t understand what you have got you will never be able to keep systems patched and will have a hard time changing default passwords.
  • We are strong believers in using software defined perimeter approaches to understand who is who and what is what and only allowing authorized actions in your network.
  • Use a DNS firewall to reduce two major issues: 1) users visiting sites known to have malicious code that threatens your enterprise and 2) malicious code inside your enterprise that seeks to beacon out to its controller. We recommend Verisign’s DNS Firewall. It provides cloud-based network security based on is built on Verisign’s global recursive DNS platform.
  • Managed DNS is important as well. Make sure your provider of managed DNS services has a track record of reliability.
  • Also ensure your networking team understands the details of BCP38 on Network Ingress Filtering. This will defeat DDoS attacks that employ IP source address spoofing.
  • Ensure your workforce is tracking the cyber threat by signing up for the OODA Daily Pulse.  This will provide strategic warning of threats and info on mitigation strategies.
  • Your network defenders should avail themselves of the powerful research tools of Passive Total. This will help keep them aware of threats in ways that will help them adjust defenses. A key benefit is tracking risks that exist totally out of your control.
  • Consider training your extended team on the cyber threat. One way to raise awareness is through our book, The Cyber Threat. This succinct overview articulates the threat in ways that inform and lead to collective action.
  • Have a backup communications plan. If your network is down and that same network carries all your data, video and voice, how will you get the word out to employees, suppliers, customers?

We also provide insights and tips aimed at the Home User and for Governments at Local, State and Federal levels. Please review and help get those tips into the right hands.

What Home Users Should Do to Mitigate DDoS Threats

We have all been watching Distributed Denial of Service (DDoS) attacks evolve and the bad news is that your home may very well have been involved in recent attacks. Bad guys use automated tools to scan and probe for devices they can take over and they don’t care anything about your desires in the matter. You should do what you can to push them out and prevent them from using you.

Here are some tips at how to do this:

  • Most recent large-scale DDoS attacks are coming from botnets that compromise IoT devices like connected cameras. So one thing to do is to think about whether or not you really want a connected device. If you do, do you understand how to change the default password of the device?
  • You can use the free Internet tool called the IoT Scanner to do a quick check for devices you have connected that are visible on the Internet. This is a great way to check for misconfigured devices or a poor network configuration.
  • Future attacks will evolve and exploit other vulnerabilities. So prepare to be attacked in new ways. You will need to understand how to patch and update your devices.
  • You can also strengthen your network to reduce the chances of infection and also reduce the ability of malicious code to communicate out from your home by strengthening your home network and firewall.
  • Consider using a paid service for your DNS to enable a DNS firewall. This can prevent malicious code from communicating out from your home. In the event of a massive attack from your home to others it can enable you to stop the attack quicker.

We also provide insights and tips aimed at the workplace and for Governments at Local, State and Federal levels. Please review and help get those tips into the right hands.

A Flicker Of Light: A new security stack points the path to safety

The last few years have been a difficult time for those who protect data. Defense-in-depth, the gold standard in cyber security, has failed. The basis behind defense-in-depth is to deploy redundant layers of security products to defeat every part the cyber kill chain. Unfortunately inside attacks and compromised devices belonging to authorized users operate within the protective bubble making them difficult to stop or even detect. Further complicating matters, the shift from company owned and operated to personal and public compute resources– which increases the attack surface.

In panic, many organizations deployed more security products or utilized capabilities like Virtual Desktop Infrastructure (VDI) to create virtual air gaps. Sadly the short-term fixes often created new vulnerabilities or impeded end-to-end visibility. But now security professionals are testing a new security stack that utilizes a small set of interlocked security controls to stop a wide range of attacks.

new-security-stack

The new stack design is very simple – an isolated compute partition on the user’s device is connected to an isolated compute partition in a data center with a single use VPN connection. Before connectivity is provisioned, the hardware identity and software hashes from the user’s device are checked. End-to-end encryption is implemented via tamper resistant memory. Once inside the enclave, authorized users are able to access protected applications as well as encryption and VDI services. Conceptually the new security stack is a hardware-based virtual enclave.

The key design element of this security stack is that at least three controls must simultaneously unlock for enclave access. This is similar to a bank vault with multiple combination locks except for one important difference – the thieves must get everything right on the first attempt. For example, enclave access requires a valid hardware token, certificate exchange and device verification all to be approved in the same connection. If anything fails, an alarm is generated!

Inside attacks are stopped as data can only be viewed on the hardware belonging to the authorized user (and only after they sign-in to their device and enclave). Compromised devices cannot access data as malware isn’t allowed to escape or re-write the micro-VMs that surround every app. Attempts to tamper with device software is either stopped with tamper proof memory or detected with software hashes. Lateral movement in the data center is stopped as partitions are protected with host-based firewalls to ensure only provisioned VPN connections gain access.

Are interlocked security controls the light at the end of the tunnel? It’s still early days but the initial test results have been positive. At least we have a path to go forward with.

Snakes in the Satellites: PassiveTotal provides an update on a massive adversary infrastructure

sat-1

For the last year Passive Total has been providing open analysis on an interesting piece of adversary infrastructure and in doing so are shedding informative light not just on that particular adversary activity but on how multiple sources of information can be pulled together to form a more complete picture of what is going on. For example, by understanding the relationships between datasets including open source intelligence, historical DNS records, known malicious domains, historical SSL certificates and numerous facets within those and other datasets, a more comprehensive understanding of an adversaries attack infrastructure can be built out.  PassiveTotal is a clear master of this approach to “Infrastructure Chaining” for analysis.

In February PassiveTotal provided an update on research into a known adversary campaign that has been reported by Kaspersky as APT Command and Control in the Sky. Commonality with other intrusion sets resulted in this being associated with a group many analysts believe is Russian, but as you can imagine it is hard to find the smoking gun. One of the more interesting elements of this set the way malicious code command and control is being conducted via compromised satellites. Sounds expensive doesn’t it? Well it is not expensive. Attack probably cost the adversaries about $1000.00 in hardware plus engineering time.

In the February update, PassiveTotal showed how they could kick off an analysis armed just with Kaspersky’s open source intelligence report, then dive deep into their datasets on known adversary infrastructure, historical DNS records and current and historical security certificates, and then combine that to produce new knowledge and insights. Their reporting make it clear that this adversary had been operating in this way since at least 2013, and was also penetrating many other adjacent targets. Turla could be shown to have compromised an extensive  network of satellite providers and was leveraging a large network of command and control servers as part of this operation.

Perhaps more interesting was an update in August 2016 where PassiveTotal revealed that before publishing their report they set up alerts in their datasets to see if their report would cause any action by the adversary. Smooth move there PassiveTotal, that is great tradecraft. It was interesting to see that yes the adversary did adapt and could be traced as they did. PassiveTotal could watch as an entirely new infrastructure was brought online. They then manually followed and assessed compromised IP addresses and continued to correlate and link across multiple datasets to flesh out what the new adversary infrastructure looked like.

For more see: Snakes in the Satellites: On-going Turla Infrastructure

 

screen-shot-2016-08-17-at-12-45-57-pm

For more see:

Innovative Thinking Is Hurting Security; We Need Disruptive Ideas

Security professionals by their nature are risk averse.  Thus it’s no surprise that the security industry is defined by incremental innovation.  Start with something that works and make it better. Unfortunately “innovative security” strategy is leading to an increase in cyber security failures.

Increased spending and increased cyber failures now characterize the security industry. Gartner forecasts that security spend will be on the order of $100 Billion for 2016 yet breaches are occurring with greater frequency than ever before. This is occurring because the existing security architectures have reached their performance envelope.

Organizations are more complex than the assumptions that define current security product design. Incremental innovation no longer works and the security industry requires a disruptive shift to keep pace with organizational needs.

disruptive-concepts
The history of the technology business is defined by systems hitting a wall and then being replaced.  For example aviation started with lighter-than-air craft (i.e. balloons) that got replaced by propeller planes that in turn got replaced by jets.  Like balloons being blown by the wind in the wrong direction, current security solutions just don’t let organizations go where they want.

In a world defined by mobile users, non-employees and diverse infrastructure having twenty to fifty different point products doesn’t work as there is no way to integrate their logic. To protect today’s organization we need a new security architecture based on inter-locking components:

  • Identity-based access control that protects data center and cloud assets
  • Policy-based data encryption that is tied to the access control system
  • Data center and cloud partitioning solutions that create compute containers
  • Identity services that dynamically determine policy based on location and device
  • Mobile compute devices supporting partitioned, secure code execution

Each security component is designed to support the other four requiring cyber attackers to break all five to breach an organization.  More importantly, as new devices, users or apps go online, the entire system is aware of the changes – making it extremely difficult for cyber attackers to find a weakness in the system.

The strong bias in the security industry against disruptive ideas has become a barrier to move forward. It’s time for security professionals to focus on strategies to reduce cyber risk than solutions that are less risky.

Also see:

Want The Government To Do Something About Cybersecurity or AI? Advocate Congress establish a permanent joint committee on information technology

The United States Congress Permanent Joint Committee on Information Technology does not exist, yet.

But with attack after attack against our nation’s IT systems the time has come to consider the idea.

First, some background on what a Joint Committee of Congress can be. Congress has great leeway in how it executes its constitutionally mandated responsibilities to legislate and fund. On some particularly thorny issues, joint committees which include members of both the House and Senate can be formed. Once in history, Congress decided there was an issue of such significant national importance that they passed a law establishing a permanent joint committee with legislative authority. This was the United States Congress Joint Committee on Atomic Energy (JCAE).

This joint committee was formed in response to both a dramatic threat and an incredible opportunity. The threat was the potential of nuclear war. The opportunity was the potential to use nuclear science to generate electricity to power cities as well as naval vessels, as well as opportunities to use nuclear science in medicine and industry. It was clear to congress at the time that success in response to the threat and success in gaining national benefit from nuclear energy would require a different way of doing things.

So, the response was the United States Atomic Energy Act of 1946.

For over 30 years the Joint Committee this act set up provided bi-partisan solutions broadly supported and widely credited with bringing unity of effort to many multiple complex activities.

We are in need of such dramatic progress in how the nation leverages Information Technology that a similar approach may be required today. Consider, for example, some of the capabilities and powers of the Joint Committee on Atomic Energy (JCAE). The JCAE oversaw 100% of the executive branch’s involvement in atomic energy and nuclear weapons, and provided the legislative framework governing research into nuclear science throughout the country. Here is some additional important/relevant context to consider (from Wikipedia):

The Joint Committee on Atomic Energy (JCAE) was a United States congressional committee that was tasked with exclusive jurisdiction over “all bills, resolutions, and other matters” related to civilian and military aspects of nuclear power from 1946 through 1977. It was established by the United States Atomic Energy Act of 1946, and was the overseer of the United States Atomic Energy Commission. For its broad powers, it is described as one of the most powerful congressional committees in U.S. history. It was the only permanent joint committee in modern times to have legislative authority.

The panel coupled these legislative powers with exclusive access to the information upon which its highly secretive deliberations were based. The joint committee was also entitled by statute to be kept “fully and currently informed” of all commission activities and vigorously exercised that statutory right, demanding information and attention from the executive branch in a fashion that arguably has no equivalent today.

One major power wielded by the JCAE was the “Legislative Veto.” This unique power enabled the JCAE to influence policy decisions while matters were pending. This enabled the JCAE to act as a co-decision maker with the executive branch rather than only providing congressional oversight of actions that had already occurred. The legislative veto power was later found to be unconstitutional by the United States Supreme Court in 1983.

During the 1970s, the committee’s role in shaping nuclear policy began to diminish after the Nuclear Regulatory Commission was created to replace the Atomic EnergyCommission. Congress soon transferred the bulk of the joint committee’s jurisdiction over civilian nuclear power to other standing congressional committees in the House and Senate. The joint committee was finally abolished on August 5, 1977.

I’m hoping you find that information important background as you think through the right structures our nation should put into place to help us deal with the modern world of interconnected Information Technology.

So lets continue with the analogy for a moment.

Like in the early days of the nuclear age, today we face both a challenge and an opportunity.

The challenge is one most today call the cyber threat, which is huge, and growing, and hard for humans to realize and mentally deal with (see this on Cyber Threat Amnesia). The opportunity is one many today call the IT revolution, but others call web2.0, gov2.0, or just the optimized benefits of the information age. This IT revolution includes the wave of capabilities under the broad umbrella of Artificial Intelligence, something the nation really needs to get right.

In both response to the threat and the ability to reap the benefits of IT we are lacking as a nation. Regarding the threat: Criminals violate the personal privacy of our citizens through cyber snooping and attacks, organizations steal corporate intellectual property (which hurts in our ability to create jobs and value), terrorists gain advantage through use of IT, and nation states conduct espionage stealing our secrets. Cyber crime costs billions of dollars, perhaps trillions. And every logical strategy, technology and technique tried by the executive branch and smart industry leaders has fallen short. Something else must be done to address the cyber threat.

Our IT infrastructures and capabilities are known to produce benefits for our economy, but clearly we are sub optimized in our current approach. Our schools still teach the old way with almost no benefits from new technology. Most students have no more than a working knowledge of computers. And we turn out too few who can master IT. Economically, we have great unrealized potential in using IT to enable job growth and economic benefits while reducing cost of healthcare, cost of living and cost of education. Smart IT can also reduce cost of business and reduce the cost of goods to consumers. In the federal government, IT helps serve citizens but CIOs and CTOs struggle agency by agency to deliver value. Trends in “Big Data” and AI approaches to making sense over data hold great promise, but there are not coherent government-wide policies that can optimize these sensemaking activities. And multiple committees in both houses of congress try to exercise oversight over agencies and programs, but the federal enterprises have a mixed record of being able to deliver on the promise of IT. Meanwhile China seems to be way ahead of us in key infrastructure areas like roll-out of IPv6 and 5G. And although there are great areas of progress being made in domains like commercial Internet from space, much of that seems

But if we keep doing things the same old way, we are going to get the same old results, don’t you think?

Maybe what we need is a better framework of laws, a smarter ability to learn from and interact with our nation’s IT industry, and a smarter way to learn from and respond to our citizens. And maybe what we need is a smarter way to interact with nation’s globally. And maybe what we need is a better way to enable protection for our citizens, enhance training for our students, and enable all elements of our economy to achieve more through more powerful IT.

So, one option, by analogy:

United States Congress Permanent Joint Committee on Information Technology.

The basic concept is that Congress must do something dramatically different if it is to expect different results.  So must the executive branch.

Is a permanent joint committee on IT the right answer?  At this point it is hard to imagine that it could hurt.

Any thoughts about this recommendation?

 

Other related topics:

Risk IQ Launches Groundbreaking Security Intelligence Services Product That Enables Automated Defenses

28 July  2016–SAN FRANCISCO–(BUSINESS WIRE)–RiskIQ, the leader in external threat management, today announced general availability for its Security Intelligence Services, a ground-breaking new product that uses the Internet itself as a detection system to automatically defend a network from cyber attacks. Attackers use automation and can launch sophisticated attacks at very low cost by rotating and reusing undetected infrastructure. RiskIQ has provided defenders with access to Internet datasets, advanced analytics and machine learning to stay one step ahead. With Security Intelligence Services, RiskIQ now detects unknown threats at the source and tracks how attacks change and spread—in real-time.

“The security team’s visibility is mostly based on what they see on the corporate network but once they detect a threat locally, the attacker has already moved —this fact limits defenders’ efficacy—they are always playing catch up,” said Arian Evans, VP of Product Strategy at RiskIQ. “Using the Internet as a replacement for the corporate network, we provide real-time information on the attacker as soon as their attack goes live or moves.”

With thousands of customers and processing petabytes of Internet datasets daily, RiskIQ is a pioneer in expanding the reach of the security program to prevent attacks. The comprehensive service includes:

Passive DNS (PDNS) data, a system of record that stores DNS resolution for a given domain or IP address, provides security analysts with insight into how a particular domain name or IP address changes over time. RiskIQ’s implementation of PDNS enables programmatic links between related domains/IP addresses and, when researching an event, can provide context to an attack or additional malicious domains/IP addresses. PDNS helps identify the indicator of compromise through correlation of historical resolution lookups, time-based analysis, and fully qualified domain name lookups.

WHOIS data, an internet database of ownership information about a domain, IP address or subnet, can give an organization insight into those behind an attack campaign. WHOIS data helps determine the maliciousness of a given domain or IP address based on ownership records. Using domain registration information, an organization can unmask an attacker’s infrastructure by linking a suspicious domain to other domains registered using the same or similar information.

RiskIQ Attack Analytics, a proprietary RiskIQ dataset, is based on malicious observations inside of real-time Internet datasets. As attacks evolve and propagate outside of your network, RiskIQ behavioral analytics identifies cyber threats and provides customers with filtered lists of known bad hosts, domains, IPs and URLs. These feeds allow any enterprise security organization to leverage RiskIQ’s vast Internet datasets and expertise to proactively defend their environment’s networks or endpoints from threats.

Newly Observed Domains, the first of our attack analytics feeds, is a proprietary enriched RiskIQ dataset containing newly resolving domains. Threat actors often programmatically use different domains for their attack campaigns, therefore newly active domains can serve as a guide to whether a domain is legitimate or not. RiskIQ’s continually updated Newly Observed Domains provides customers with near real-time intelligence of domains seen for the first time. Organizations can proactively defend against new domains that could be hosting phishing sites, distributing or operating malware or posing other cyber threats by blocking newly observed domains for a specified time period based on policy and risk tolerance.

“To solve this incredibly difficult problem, RiskIQ has assembled the only complete source of real-time Internet datasets combined with the machine learning and analytics capable of generating truly predictive results,” continued Arian Evans, VP of Product Strategy at RiskIQ.

“Security Intelligence Services is a major innovation for threat detection—finding threats first using the Internet as a sensor and then using automation to inform the corporate network to block, thereby freeing up resources and increasing the cost to attackers to launch further attacks—in this current state of rapidly morphing threats.”

Customers can access RiskIQ Security Intelligence Services through a sandbox to test data structures and explore information via a user-friendly interactive application programming interface (API) and documentation. Data from RiskIQ Security Intelligence Services can then be easily integrated with commonly used security platforms to investigate and protect against threats such as:

Advanced persistent threats (APT)/Malware hosting and distribution
Phishing, spear phishing and whaling
Domain name abuse/Copycat domains
Email abuse
Watering holes
Malvertising
For pricing inquiries, please contact sales at RiskIQ. Security Intelligence Services is available on the RiskIQ website at

http://www.riskiq.com/products/security-intelligence-services.

About RiskIQ

RiskIQ is a cybersecurity company that helps organizations discover and protect their external facing known, unknown and third-party web, mobile and social digital assets. The company’s External Threat Management platform combines a worldwide proxy and sensor network with synthetic clients that emulate users to monitor, detect and take actions against threats. RiskIQ is being used by thousands of companies including F500s and leading financial institutions to protect their web assets and users from external security threats. It is headquartered in San Francisco and backed by growth equity firms Summit Partners and Battery Ventures.

To learn more about RiskIQ, visit www.riskiq.com.

To learn more see the CTOvision Solutions Directory: RiskIQ

More Content

Cyber War

SciFi

Super Bowl Ads Indicate Big Businesses Think You Are Afraid of AI

Tom Loftus provided an insightful review of some of Super Bowl ads in the 4 Feb 2019 Wall Street Journal. Like AI parody in SNL, these ads really poked fun at computers: Seriously, did anyone catch the commercials? If the Super Bowl is the zeitgeist, then it is safe to say that America is not […]

HBO’s Westworld: The Man In Black is a special kind of Twitter user

HBO’s Westworld is a modern take on the Michael Crichton SciFi tale of a robotic amusement park. The HBO version has a new twist. The creators/writers were all exposed to years of Twitter, which has influenced every episode and the entire arch of two seasons of the show. Now that season two is wrapping up, […]