Category Archives: Next Generation Security

My Top 5 Predictions for 2015

Posted on by
Reply

Predicting the future is almost impossible especially with such a fast evolving topic like cybersecurity. Nevertheless I’ll give it a try and share some of my thoughts with you.

I had a lot of chats with CIOs, CEOs and COOs as well as journalists talking about what we all see what our biggest fears are and what they and I expect to see in the near future.

Here are my thoughts about theTop 5 challenges our world will face in 2015. Just in case you would like to add something feel free to drop me a line and I will add your thoughts / comments promptly.

Top 1: Rent-A-Botnet
As we all saw in the past that botnets seem easy to rent (1.000 for some 100 USD down to 10 USD for an hour accesstime) the service quality is dramatically increasing while prices are decreasing. The service quality is key to the evolution of this market. When selling services to the “normal” world credentials are important. Selling services on the dark side means that delivering cybercrime services is only possible when having top credentials and a hard proof of delivery and 100% reliability. These requirements drive service quality enhancements that even lead to service desk support with your rented bot net, customization support and other services most people can hardly imagine when talking about a crime scene. We even see that targeted attacks lead to new customer creation efforts. An example is that DDoS targets sometimes receive blackmail eMails with 3 key messages:


1.      Pay the fee to avoid DDoS attacks leading to unavailability of your services

2.      Do not contact any cybersecurity specialist to defend your services because this will lead to a dramatical increase in bots attacking you

3.      Order your own botnet attack against attackers and you will receive a discount of 20-40%

Top 2: Industry 4.0
Industry 4.0 discussions very often end up in security concerns. On one hand companies fear that SCADA systems, PLCs and Industry devices could come under fire. This is a serious concern and it is very realistic when considering that a lot of industry devices are not hardened but connected to office networks having no virus scanners and very often being protected by firewalls having more communication exceptions than limitations.

Imagine that in combination with IP V6 internet structures become more stable and reliable and your refrigerator, lightbulb or industry roboter is infected and becomes part of a botnet or is in other ways involved in cybercriminal activities.

Top 3: Data Destruction
2014 ended up with a huge security incident at Sony pictures. We saw problems at Sony companies before like the PSN hack. Nevertheless the hack shows a new quality in cyberattacks. It became very common to hack companies and to leak information as a “proof of hack” to make the cybercriminal business plan work. During this hack we saw that users couldn’t use their workstations any more and data destruction seemed to be part of the game. Also in other security incidents we became aware of the fact that data loss is common but data manipulation and data destruction become even more serious and are on the rise.

Top 4: Supply Chain Security
In the past we already recognized the supply chain security seems to be important but the headlines have not been filled with stories about companies being attacked using supply chain connections. One of the most remarkable stories has been the virus problem on Predator and Reaper drones in 2011. Other hacks we saw in 2014 demonstrated that very often companies rely on their security measures like firewalls, awareness trainings, encryption and so forth. But as we all know is the strength of a chain determined by the weakest link which is very often a supplier. A “good” example is the “Target” breach where Fazio Mechanical, an air condition and heating maintenance company, was compromised. As we all know for various investigation reports on Targets incident the attack on their supplier seemed to be high sophisticated.

With research on this topic we see this threat on the rise and being more and more successful.

Top 5: Mobile Device Exploit Kits 
Years ago mobile devices have been pretty safe. But with the trend showing that mobile devices may replace notebooks and “thick clients” in general Exploit kit developers seem to start focussing on mobile device exploit kits. The mobile world seems to know several Operating Systems but in the end these are only 3 (IOS, Windows and Android). At least IOS shows only few variants – users keep their IOS up to date so that creating one exploit kit has a huge impact in the user community. Also with spyware for smartphones increasingly being thrown on the market a baseline software repository to duplicate calls, copy WhatsApp conversations as well as SMS messages is available. The step from “legal spyware” (in Germany it is not legal but in other jurisdictions its use is pretty common) to an exploit kit is pretty small.

Right now effective antivirus and other prevention software is hard to find and only few users even care about this problem leads to millions of vulnerable devices being in the focus of cybercriminals.

Security – A Misleading Concept?

Posted on by
Reply

Currently I am creating a presentation on cyber security as a competitive advantage. It looked like a simple task, but ….

When building a presentation I feel that the content should be meaningful. Starting to think about a good starting point, the fundamentals I need/want to transport and a good starting point i thought it would be a good idea to start with a definition of cyber security.

Defining both words, Cyber and Security I found a definition which is a little bit strange but it was taken from William Gibson’s Novel 1984:

„Cyberspace. A consensual hallucination experienced daily by billions of legitimate operators, in every nation, by children being taught mathematical concepts… A graphic representation of data abstracted from the banks of every computer in the human system. Unthinkable complexity. Lines of light ranged in the nonspace of the mind, clusters and constellations of data. Like city lights, receding.“ 

Source for the artwork: http://hqwide.com/wallpapers/l/1920×1080/61/artwork_neuromancer_william_gibson_1920x1080_60671.jpg

Another one I found good and better suitable for business purposes was given by the university of maryland

The interdependent network of information technology infrastructures, that includes the Internet, telecommunications networks, computer systems and embedded processors and controllers.

Source: http://www.umuc.edu/cybersecurity/about/cybersecurity-basics.cfm

I believe this one has a better fit for purpose. Nevertheless it gives a limited view on security issues. Cyberspace is meant to be digitally. But what does that mean related to intellectual property that people have. Information written or printed on paper. Proof of concepts doming from a machine and so on. Short story: What is the representation of non digital Information? From what I found non digital information is not covered by the term “cyber”!

What is the better term to provide a holistic view on security?

To be honest: I didn’t find one. Information is written on paper, stored in brains, computers. Sometimes it is tangible, sometimes not. Sometimes it is related to buildings and other forms that might represent information or a value. The next question deriving from these thoughts:

Is there anything of value that is not related to information?

If you find something please tell me!

Security in general is meant to be a concept that implies protection from harm to any asset.

That is also the reason why we find numerous security functions in enterprises:

  • Corporate security
  • Facility security
  • Information security
  • IT security
  • Cyber Security
  • Data protection

When talking to clients about their security functions I very often hear that there is a wish to add new skills to the organization to cover new threats! When doing this organizations tend to look for reasonable compromises which are more likely to be trade offs. Usually existing structures are maintained (e.g. the IT Security Officer) and new functions like a Cyber Security Department is added to the organization with newly defined responsibilities and different reporting lines.

Looking at the cyber definition again the conflict is obvious! IT security deals with infrastructures. The information protection officer deals with information stored anywhere and the Cyber Security Defense Service feels extremely hip because it is something new, really important having excellent budget and sits on the territory of the CISO, IT SecOfficer and others.

I started to write down where security applies and found numbers of issues and security functions. Most of them have an overlap which I feel that it is ok.

Detection is the new Prevention

In another article I already presented my view on Detection versus Prevention. I believe Detection is key! A huge misunderstanding is that looking at the concept of security the spotlight is on prevention. This might be true but detection is the new prevention. In order to avoid harm to your organization you need to know your enemy and be prepared against almost everything that can happen. You will have to accept hackers to jump into your networks and you will need to be prepared to detect them and fix the damage asap.

What happens here: It is RESILIENCE!

Organizations need to be better prepared to fix security incidents no matter if they are related to buildings, employes, VIPs, IT infrastructure, paper based information etc.

When I came to this conclusion I felt that any security function in an organization is an important feature. It is preventive feature. It helps to detect issues. But recovery from incidents will be more important than we have ever believed.

I feel that a Business Resilience Function in any organization is the key to eliminate conflicts between different security functions and helps to align them to a powerful organization helping with prevention, detection and recovery!

What do you think? I do not know if I am right or wrong! I am really interested to read your views on this! Please share your thoughts with me and the rest of the community!

The link Between a Company’s Supervisory Board and its Security Strategy

Posted on by
Reply

Companies Need New Security Strategies

With regard to cloud computing, Bring Your Own Device (BYOD) or Social Networks companies have to think about their security strategy. Whereas the principle of prevention was effective for a long time it is not effective any more. Having a huge number of mobile devices in place, using various storage systems within the enterprise or outside and the demand for flexible and fast collaboration with clients, partners and suppliers nobody is able to predict where a certain piece of data is right now, how often it has been copied or will be tomorrow.
It is just a fact that business critical information does not reside within the perimeters of the enterprise any more.
Given this fact a company can protect its perimeters with huge efforts and be almost save, a weak system outside the enterprise like a social network or a pubic cloud system destroys all efforts of protecting the assets by preventing intrusion in the own infrastructure. The enterprises are simply not in control of prevention system any more.
Another challenge is the complexity of of attacks against enterprise infrastructures. Nowadays more often zero day exploits and strongly customized malicious code is being used, applying advanced persistent threat techniques which leads to the situation that most of the high sophisticated attacks are not recognized by any prevention system like antivirus, intrusion detection / prevention system or firewalls.
These attacks are simply below the radar screen of the traditional security systems.

What are the new Security Strategies to be applied better today than tomorrow?

The prevention of the future is detection! What does that mean? This means that enterprises have to improve their ability to register anomalies in the data flows leading to a more reliable and faster detection of security incidents. There are two main areas of improvement:

  1. Time to detect a security incident caused by APTs or other high sophisticated techniques
  2. Time to fix the issue

Especially the time to detects requires companies to have intense monitoring capabilities in place to ensure reliable detection. By building these capabilities not only the requirements of companies are in scope but also the personal rights of employees are affected. A company going this way will need to have trust within their working councils and from my perspective it is even better to integrate the employees to build trust that these facilities are not only a requirement to secure the enterprise but also the individual.

Any requirement for the supervisory board?

With respect to the supervisory boards requirements to monitor and give advise to C-Levels, a few questions have to be clarified:

  1. Does the internal control system of the enterprise reduce the risk of exposure of employees and management against threats from the outside (e.G. Use of eMail, websites, unknown documents)?
  2. Is a reporting system in place to to indicate potential threats and suspicious activities?
  3. Does the enterprise have a stable detection system in place to uncover security incidents?
  4. Did the company test the effectiveness of detection techniques and includes the results in a continuous improvement process?
  5. Are security incidents adequately reflected in the board of management’s report on the business situation of the company?

Conclusion

In the end this means that companies have numerous options in place to improve security, deal with liabilities of board members and the supervisory board and drive efficient security measures.

I would suggest to keep an eye on two work streams:

  1. Switch of non effective security measures that simply address prevention – Just talk to me and I will assist you to go this way based on a success fee.
  2. Establish a process too ensure that materiality and severity of security incidents becomes transparent to board members and their supervisory boards to ensure conformity to financial reporting standards.

Just in case that you do not believe that security is to be reflected in the financial reporting you should read the Corporate Finance Disclosure Guidance No. 2: Cybersecurity issued by the SEC. You might also want to use Google to find out who was already addressed by the Regulators of the US to have not properly addressed this issue!

What is the bigger threat? Employees or hackers?

Posted on by
Reply

Years ago I read an FBI survey on security incidents and a root cause analysis. I didn’t find it again (if you have it – please send it to me) but I can still remember that it said something like almost 70% of security incidents have been caused by employees.

The last survey I found from the United States Secret Service named “2013 US State of Cybercrime Survey” says that only 21% of cybersecurity incidents have been caused by current and former employees (There is a summary availabe from PwC in the US that helps you to avoid reading all this stuff).

Nevertheless I found it really difficult to qualify these information and have a more solid foundation of sources that helps me to better understand and to better argue with my peers.

But as time went by and big data is not just a buzzword but real applications are available I found a website I desperately want to share with you. They analyzed hacks and other security incidents and built categories to classify these hacks.

The result is a really meaning- and beautiful visualization of security breaches and their sources. What strikes me is the possibility to slice and dice industries sources and size of the incident and get a visual presentation.

Bild

I believe that this is one of the most advanced ways to present these figures without leaving room for arguing if the numbers are correct or not. They are simply based on press releases!

My suggestion: Read it and play with it! Click on the graphics and you are forwarded to the website. Enjoy it!

Btw: They also disclose the source of information that leads to this fantastic visualization: Click me!

The “traditional” Software Industry is loosing their key to the Internet

Posted on by
Reply

Those of you who already read one of my articles might have already realized that I am looking at the pain points of our environments with a focus on security. One thing that is driving me crazy is what is happening in the internet with regard to its usability and convenience having an impact on our social structures, society and industry in terms of authentication.

In my articles “Next Generation Security” and “Theorie about securing passwords” I have written about social networks being the authentication provider of the future. I still believe in this statement and I am even more convinced that there is a remarkable development when considering the impact on the software industry.

I believe that authentication is the key for the use of the internet. Everybody is talking about  personalized content, user generated content, tagging and much more. All these mechanisms need to rely on a good and strong user authentication. Facebook, Twitter, linkedin and all the other usual suspects are there to offer their services.

I don’t exactly know the numbers of managed user accounts by traditional IAM (Identity and Access Management) suites but when it comes to the use of the public authentication providers I believe there are more users on the internet managed by Facebook & Co. than in private environments.

It is absolutely surprising that all the big names in the IAM market have failed to develop services delivering a strong and reliable authentication to internet users. They failed to realize that consumerization of IT increases the demand to also deliver authentication services to end users. If you want you may name it Infrastructure or Software as a Service. Very quickly we realize that we are talking about cloud computing services. Almost every bign(and traditional) IAM provider has also a cloud service offering which could have been a key to those customers that now need to rely on Facebook & Co.

If you may follow my line of argumentation you will agree that the key to internet applications is already in the hand of the big social networks.

Let’s try to anticipate what happens if nation states succeed to establish authentication services for the Internet Protocol stack. This means building global authentication systems for each and every device with access to the internet.

What would this mean to private in-house authentication systems? Right now I can’t imagine who might be able to deliver these services which I would name “Key to the Internet“. Right now the traditional software industry has not even tried to get this key into their fingers.

But stop – that’s not correct. Microsoft tried to established an authentication service – and failed due to the lack of value added services.

Collateral Damage of Cyberwarfare is Unpredictable – Security 2.0

Posted on by
Reply

During the last quarter of this year I had a lot of talks with CISOs and CIOs from major European companies about the impact of cyber warfare on their organizations.

Most of them refused even thinking about the impact of cyber warfare, which I can absolutely understand since most of them are not working in the defense industry and thinking about warfare is nothing we like to do. Nevertheless I feel that everybody should be encouraged to think about this topic and what it means to civil organizations in general.

Remember the latest press releases about Stuxnet, Duqu and Flame. What was / is the difference between cyber warfare and traditional war concepts.

 

Artwork found on jewlicious

The main difference – and that is what makes it so important to me – is that collateral damages can never be linked directly to the armed conflict. In traditional warfare concepts you will always be able to see the collateral damage caused by a bomb. You will see it on TV. You will see it in the press. You will hear it on the radio.

With cyber arms no one really knows who fired the gun – remember distributed attacks – and who is the target. Companies or organizations experience that they are hit by a serious attack but never know if they have been really the target. They just feel like it.

But what does that mean to civil organizations and companies?The situation regarding cyber attacks is heating up. We increasingly see serious attacks which are linked to those three “governmental” viruses (Stuxnet, Doqu, Flame) or experience malicious code like the trojan code built by the German government, called the “Staatstrojaner”. After Stuxnet we saw a huge number of organizations that had security incidents linked to Stuxnet which underpins the opinion that the company might experience a collateral damage without even knowing that it is the result of a (cyber) armed conflict. One nationstate might attack the other using cyber arms turning off the light in small and medium businesses in other, not in this conflict involved, countries, disturb operations in hospitals and so forth.

In the future companies need to built their own “cyber shield” to protect themselves against this kind of “advanced persistent threat”. In case of Stuxnet, Duqu and others we can learn that these intelligent pieces of code have been distributed in a way where traditional concepts like IDSes, IPSes and firewalls have been useless. Distribution was done using eMails, USB sticks, removable media and other very simple vehicles. They did not cross traditional company borders.

The conclusion is: Perimeter security does not work anymore and companies need to rely on safeguards they will have to put around individual assets. We arrived at the absolute need to create asset based security mechanisms instead of big walls! This is another reason why I believe: We reached security 2.0! We need to change the way we are doing security. I absolutely know that I do not meet everyone’s opinion of this serious topic but nevertheless I encourage you to discuss it with me and discuss what you feel what security should look like in the future. Maybe I am wrong. Convince me if I am wrong!

Some words about Security in the Cloud

Posted on by
2

The security of cloud services has been the subject of heated debate and neither side is giving an inch.

One side claims cloud computing harbours uncontrollable risks and warns that we may well lose control of our own data; to them, every new security incident is grist to the mill.

The other side sees cloud computing as the way to higher security through the increasing industrialisation of IT services.

Both lines of argument have their merits. We can naturally expect a greater aggregation of data at certain providers as IT continues to industrialise. If a security incident were to occur in this situation, the assumption is that larger masses of data and even more enterprises could be affected as well. Inasmuch, the damage caused by a security incident at such a provider would be greater than the damage ensuing in the individual operations of an enterprise that has outsourced its data and services to that provider.  And there is another factor that makes the impact look even worse. While in-house security incidents are almost never reported (unless required by law), not so for the processes that many enterprises have contracted out to this provider. There will be no mantle of silence to cover up a security incident that affects so many enterprises and causes so much damage.

Deciding which side is right will depend on business indicators which we simply do not have at this time because they do not have to be reported in today’s regulatory climate.

Yet one thing is clear: the need to establish a systematic approach to secure our own data and processes.

That makes it indispensable to learn how to integrate our technical and business situation with cloud computing. As part of the big picture, (Cf. Chapter 3.3.1) cloud computing can be seen in the context of other hot topics.

The basic tendency is to try to prevent security incidents. That goes not only for cloud computing but also general business practice. To achieve that goal, we must clarify and understand the risks associated with cloud computing. That is the only way to do justice to the idea of Prevention.

Significant risk management parameters are ‘impact’ and ‘probability’. As the probability may be low, but not ‘nil’, an effective process must be established comprising two component to deal with actual risks:

  1. Detection
  2. Reaction

Detection is the process of flagging security incidents. Various studies show that only about 50% of all security incidents are detected within a week, while the rest are only discovered much later. Cloud computing complicates matters further.

Detection of a security incident must trigger a suitable reaction. Given the changing architectures in cloud computing, the procedures for obtaining legal evidence of security incidents are subject to change, and  both enterprises and the courts have yet to follow suit.

Look at the big picture and understand that the management of identities and authentication for a user’s cloud ecosystem is a not-to-be-underestimated strategic factor.

Next Generation Security – See how Facebook, Cloud Computing and Tablets change our lives!

Posted on by
1

The use of IT has gone through radical change in recent years and will see increasingly radical change in the future. More and more enterprises are getting involved in the opportunities and risks of cloud computing in all its different forms. This would therefore be a good place to clarify what other hot topics would be wise to consider in the context of cloud computing and what this will all mean for information security in particular.

For instance, seeing cloud computing in connection with Bring Your Own Device (BYOD) and social networks – two of the latest IT hypes –can be particularly exciting as this raises new information security issues.

The first question is why there has been so much hype around BYOD and how it relates to cloud computing.

Given the demographic shift, the related lack of qualified experts and the resultant general employee situation among today’s enterprises – a veritable job-seeker’s market – it is now more important than ever before for enterprises to take the needs of their employees to heart so as not to lose sight of the target markets. New employees are attracted to enterprises that have their individual, personal needs in mind, while long-time employees expect their employers to offer an evolving personal working environment that keeps pace with the times.

By now, the use of consumer devices has grown to become part and parcel of an attractive working environment. An IDC study from 2010 shows that about 95% of all employees also use consumer devices. So it is only logical for them to want those devices to be more integrated into the business structure. That integration is increasingly made possible by web based services, which are provided as cloud services.

One good example is the provision of storage capacity, which can be accessed through enterprise devices, consumer devices or a range of general device types. Cloud services make it possible to use to these consumer devices all at one and the same work location. This is also evident from the number of cloud users: since the launch of Android-based consumer devices in 2008, public cloud computing services have grown. While this trend might not be directly attributable to the new generation of devices, the statistics show a define connection.

By analysing different studies on cloud computing (e.g. Cloud Monitor 2012 – http://bit.ly/CloudMonitor2012) one can conclude that public and private cloud services, in spite of the difference in popularity between the two cloud types at present, will converge in the future. The hybrid cloud will therefore be the de-facto cloud model of the future.

The proliferation of social networks can be seen as another phenomenon. While we see different social networks, whose business model is based on actual ‘networking’, the ‘main players’ in this industry see the network as a means to an end to generate large numbers of users. These are then marketed (e.g. advertising) as the actual value added. In particular, some networks have specialised in reusing the identities in their database for authentication services. Facebook, Twitter, Google Yahoo and LinkedIn can be cited as the main examples. Who the market leader is depends on the field of use (http://info.gigya.com/identity.html). Facebook and Twitter almost always range among the top three.

Banks, mobile telephone providers or government agencies would be more likely candidates for B2B authentication systems given the confidentiality issues. And yet, Facebook has grown to become the leading provider of authentication systems (Facebook: 39% market share followed by Google with 19%, source: Gigya, 14 July 2012). In the first year of Facebook Connect alone, Facebook had signed up 80,000 websites and continues to sign up about 100,000 website a year. That social networks have become the dominant public authentication providers is something we simply cannot ignore.

So what do BYOD and social networks mean for cloud computing? Assuming that the proliferation of mobile consumer devices will promote the growth of hybrid clouds, it will likewise be necessary to use authentication providers that support authentication across the widest range of different platforms, both public and private. That is exactly what the social networks are pushing for here.

If we follow this logic, we also see a change in the need for information security.

Neither social networks nor public clouds can be swayed by enterprise security measures. Security in the sense of conventional border defences is only effective to a limited extent. That makes it increasing important to protect enterprise value while being able to react effectively to security incidents in cloud environments once they are detected. In the end, the data – whether stored on mobile consumer devices, social networks or in a cloud – are owned by company management. They remain responsible!

This results in three main aspects, which are dealt with below:

  1. Prevention of security incidents through risk-oriented measures
  2. Detection of security incidents
  3. Effective incident reaction