The Old FUD – Fear Uncertainty Doubt

The FUD techniques are certain to come up again and again as they are effective (to a degree).

FUD is a marketing technique to sow fear into cost conscious customers that are thinking of going to a competitor. Pushing safety in numbers and other uncertainty creates FUD in the mind of potential customers. Thus it is not so easy to go with a competitor unless one is armed with knowledge.

the first FUD campaign happened when IBM mainframes finally receive some competition with Amdahl mainframe company.

Above picture is an Amdahl mainframe (with red-hued panels instead of the familiar IBM blue). Newcastle university in picture)

So obviously Newcastle University did not pay attention to FUD by IBM

Why do I mention this FUD business? Because it is an old tactic and is being used by competitor Firewalls in the security firewall market space.  Palo Alto is muscling into a larger marketshare (due to developing and running a good firewall operation)

So the competitors have developed a youtube video 

First one selects an exploit 

Then configure the test environment which means setting up what kind of attack will be ‘tested’.

then conveniently one can Run the attack.

So the competitor ran the Evader software with specific evasion techniques to see if they can evade the Palo Alto firewall they have set up so they can evade it.

 

This is exactly why FUD works, make future Palo Alto customers(or current ones) see that they can have a firewall that is not bullet proof.

Yes we know that – no firewall is bulletproof no matter how well you configure it, there is always one item that is missed over the days and years. Since we are assaulted day after day and all the hackers have to do is get one attack to work. We have to be cognizant to not be complacent and invincible (it will not happen to me attitude).

It is true we have better firewalls and the only thing to combat FUD no matter your industry is massive amounts of information, thus knowing what you have backwards and forwards.

Contact us to review your environment so that you don’t worry about FUD.

To Measure Risk, Measure Impact : Major Threats and Effects

To Measure Risk means to measure impact and threats(likelihood)

(R=L*I) Risk = Likelihood * Impact

 

So what does that mean? What are the threats and their effects to your environment? Answering this will give the true impact of the problem figuring out what risk one really has.

(Above image was copied from @ipfconline1 twitter images)

So let’s assume these are the major threats and Major concerns (from image)

  • Unauthorized Access  53%
  • Hijacking Accounts  44%
  • Insecure interfaces / APIs  39%
  • External sharing of data

Major Concerns

  • Data Loss/leakage  49%
  • Data Privacy  46%
  • Confidentiality  42%
  • Legal and regulatory compliance   39%

The threat is one portion of risk, the impact is another.

The idea is to view all of the threats coming at you and review where you should spend your time.

The problem with this methodology is one has to have a decent understanding of the impact and likelihood of various threats. Some of these items need to be also taken into context.

If you have 100 computers and they are all running Windows Operating systems (different versions 7,8,Server, 10) then a threat to your Windows base for MS17-10 is not as dangerous for all computers.

But what if a virus/trojan attacked and affected 20 computers?  Now the impact would be higher. So the Risk to your organization is higher from a relatively minor Microsoft vulnerability.

So one thing you will find is that even minor vulnerabilities can grow into major problems. So the potential effect of an exploited vulnerability  is the issue. Every month new patches are released and at the same time criminal hackers are trying to exploit the patch exploitability.

Unfortunately every vulnerability has an attack timeline.

Here is the crux of the issue, what is the impact for each separate vulnerability to your environment? As criminals develop better attacks you have to keep the threats in mind and do proper patching so as to defend your network.


By performing an audit of your environment and  reviewing impacts and likelihood you will hopefully be able to evaluate your risk properly.

Contact Us to help you with this process.

What is Real Story on Default Passwords?

Is it really as bad as some say? People are not changing default passwords and thus hackers control their machines if remote access is enabled in some way.

i think it is VERY BAD – as people are really looking for ways to make bad decisions:

https://superuser.com/questions/106917/remote-desktop-without-a-password

\

My apologies to this person who maybe innocently was trying to make some administration easier for him, but the lack of security knowledge is apparent. One should NOT even think of creating a scenario where there is a blank password on a machine (ever – even worse for remote access).

If this machine was connected to a Credit Card Machine now you are in PCI compliance violation.

Ok, we know not to have default or blank passwords…

Or is it that people don’t need to change the default password as the system is not remote accessible?

Even then the default password should be changed, because physical access needs to thought of, and is not 100% foolproof.

Or is it that people think the system is not remote accessible but it really is in some way?

The last scenario may be likely if the level of sophistication is not good.

And the hackers are looking for these machines as a post from last year notes the Verizon data breach Investigations Report  http://oversitesentry.com/why-are-there-cyber-security-issues/

Mentions that Remote Command Execution was found on scanned machines more than at other times.

Human error is one of the main reasons for security failures. in 2014 IBM ‘s Cyber Security Intelligence index notes “95% of all security incidents involve human error”

 

So how does a stakeholder (the board, CEO, exec team) make sure that human error is minimized (as it will likely never be 100% gone). It is to obvious to most: Bring in outside help to get a second or third opinion, and perform tests to see where human error can be minimized.  The CISA (Certified Information Systems auditor) would review the potential risks and set up  an audit to methodically find security issues.

Contact us to discuss

Email at Yahoo? You were hacked! Will be Phished!!

Yes we know yahoo had millions of email addresses hacked or rather the email address password database was stolen by an ingenious hacker.

 

Also according to this story(TechCrunch) the full disclosure over several years is 1 Billion email addresses and passwords were stolen

Updated 3/14  later in day:  also keep in mind if you have an ATT email account that is tied into Yahoo due to a connection the two companies made – aand that includes Verizon. CNET news story “Yahoo hack: It’s not just verizon. AT&T should be worried too”

So we know of about a million email addresses being sold on the Dark Web, and this is just the first 100k being sold on a dark web interface:

Image from hackread.com

In this ad for 10.75$ you can obtain 100k  email addresses and the decrypted password.

 

 

So your Yahoo email and password is in many places now, Where did you use the Yahoo email to login? Banks, credit card.

The hackers are not just buying emails and passwords to check your email. First they will check your email and then see what bank and other accounts they can take over.

Or they can use this information to create more focused phishing campaigns. I.e.  the information in emails within all the yahoo emails can be used to create targeted phishing campaigns (also called spear phishing)

So what should you do?

Get rid of your Yahoo email address ASAP, should you require all employees to remove any vestiges of Yahoo emails in their lives?

How can you make this claim? Because the longer they keep the Yahoo email account the more likely the criminal hacker will access the email account and steal information to phish more effectively, especially into a company account.

 

Have you ever sent something from work email to the Yahoo email? If this is a Yes  now the hacker knows your work email. and can create highly sophisticated phishing attacks with malware that may have an adverse affect on your company.

So owning a personal Yahoo Account may enable criminal hackers to get access to your company in the months ahead as the criminals are just now digesting  how the new information and are setting their attack plans in place.

Remember this OODA Loop image.. from my post a few days ago(Feb 28 Post “What Cybersecurity Methods to Use”).

Right now both the criminals(Attackers in red) and you have been given information what is more likely the attacker will Observe, Orient, Decide and Act first or you will process the OODA loop and ultimately ACT!

In the past it has been the aggressive criminals making moves and getting the into company networks.

What will be your move?

Contact Us to discuss.

 

Planning Security? You must know TTP

 

 

 

 

 

 

Planning Security? You must know TTP

In this new year of 2017 it is good to know your past so as not create the same situation in the future.

But what is TTP you say?

TTP – Tactics, Techniques, and Procedures.

By that I mean the tactics and procedures of you and your IT team of course.

Some call this acronym Tools, Techniques, and Procedures. Which is very close if not the same thing, as your IT team must have some tools to use within their tactics of defending the network and computer devices.

Interesting to note that TTP is not just in Cybersecurity, but also Terrorist security as well:

Oodaloop discusses a form of TTP,

OODA stands for Observe, Orient, Decide, and Act and this was originally developed by Col Boyd during the Korean war for use in Air-to-Air combat.

Image above from hroarr.com webpage

The OODA loop can apply to Cybersecurity with a small amount of tweaking.

The above image equates Observe with looking at network traffic and logs on the firewall and computer systems.

Orient is  where we analyze the logs and network traffic with a certain time delay, as it takes time and manpower to review these items. (this is also a place to do pentest or vulnerability analysis)

Decide is next where we have to decide what to do with the data we are analyzing. Of course Analyzing and deciding what to do can take time especially in large environments.

The final point in the process is to Act – Test, patch, and reconfigure .

As this video from Derbycon last year mentions we have to find ways to reduce our time to detection – use new methods, learn new methods.

As Marines say – Adapt, Overcome, Improvise, and get the job done.

So we need to continue to learn new methods of detecting threats into our environments.

 

The devil is in the details… as we have to find actual new threats to detect.  Testing those threats is a good idea and time is actually on the attackers side. As they only have to get in once and then the game changes. Once attackers are in your network now it is harder to deny more information and access to the data we are defending.

TTP is Tactics, Techniques and Procedure, and if the IT department is not aware of the new attacks the bad guys are coming in with, then the current actions are not good enough.  Knowing your TTP means understanding the OODA loop and it’s weaknesses.  Knowing your weaknesses should also allow you to review the areas where we need to review the most.

Notice the time delay in Boyd’s rule OODA and how I specifically added it in my drawing to signify our lack of forthright ability sometimes and general malaise. Especially when we don’t know the baseline for example (what is good and bad traffic?).

Is it enough to go about your day to entrust your network to a blue team (a blue team is the combined efforts to defend your network)

If we knew all the exact ways the attackers would attack we would never be breached. But we have to find new ways to find the new attacks that we don’t know about yet.

Remember more military axioms:

  1. Your best plans will change contact with the enemy
  2. What you really need to worry about is the unknown unknown… i.e. the breach that you cant see in any logs.

 

You don’t want to see your company in lights, in the papers, the online journals that explain how companies get breached.

Contact Us to help you with the process of improving detection of attackers, and improving your security policy.