ITSecurity Training – Page 2 – Explaining Security

You are Good, But Neighbor is not… Now What?

Let’s set this up…

You have paid attention to some Cyber security efforts, and have a number of defenses, maybe not “all of them” but your risk management matrix has shown you where to focus. What is impact on a device if having Cyber security problems?

Assuming you set up the probability matrix of all of your devices failure impact… Did you think of everything?

What about this:

Internet Storm center has a story “More malspam pushing Lokibot”

The post is about when an email attachment RTF(Rich Text Format) runs and then downloads an exploit for CVE-2017-11882 which installs Loki the information stealer.

Once Loki is on the machine it will contact home base and more.

Loki is an especially bad malware software, as it steals FTP credentials, SMTP credentials, Browser data, database information, and keylogger abilities.

So how do we defend against this malware? we need to deny the entry points. Because if once the malware is in one of your systems or one of your partners then it is a different game.

So what happens when you think the neighbor is infected? The firewall is no longer in play, as all internal machines are now open to attack. All it takes is another payload to be dropped into the infected machine that will take advantage of other machines with weak defenses.

So the problem is that any machine that you allow into your network (with vpn or otherwise) also can make your network systems weaker.

Coming back to our neighbor, if the neighbor does not have the same methods to security as you do, they are now a liability if you do not take the neighbor threat seriously.

I want to give an example in an apartment building that has been setup with a well known ISP internet service. So you get an apartment and the service for internet is built-in to the price of your apartment(or at least is a minor add-on).

The Apartment people tell you to just plug into the wall and voila you have internet service.

So when i plug in, do i get my own router? Or am I connected within a switch with every other apartment first? So now I have to run a discovery scan, and check all other IP addresses first?

This is why one runs a discovery scan, to see all the machines that are on the network and that can see you. This is all part of the risk management of your company.

Smart Cameras have Cybersecurity Problems

Everything has cybersecurity problems if it is not built with some security in mind at least. One should not build security after building the product, it tends to be ad-hoc or kluge.

Tom’s Guide has a good article of several cameras, it happens that AV-TEST evaluated 8 IP(Internet Protocol) cameras.

Only 3 cameras received 3 stars out of 3 (best stat): Logitech Circle, Myfox Security Camera, and the Netgear Arlo. D-Link and Hanhwa Techwin need to get updates. Samsung Smartcam had a new vulnerability that was found in March. And the unknown brands should just be thrown out.

Logitech’s Circle above. (a new one Circle 2 is available now)

Why focus on cameras? because they are easy to set up but not as easy to keep up and secure.

What happens when new firmware is released? How long until you update the camera? the camera requires a password and then upload the file – update, and ‘reboot’.

These new cameras also have cloud accounts or mobile apps, which may need updating too.

MyFox security camera is also a good option. (Made by Somfy protect, here is Somfy tech support page).

The other “top camera” in the review is:

Netgear Arlo has many options in cameras

Security light, Pro2, Pro, regular, Go, Q, Q plus, and baby

So you bought a nice camera, set up the Wifi, and the app on your phone. Now you can keep an eye on a certain area from anywhere you have phone service. Pretty good right?

Now in a year or so, a new vulnerability comes out, and you have to upgrade the firmware. Where was that password again?

this year’s top product become next years liabilities (remember the Intel/AMD security problem in all processors).

So better do some documentation of the camera devices, and keep track of the vulnerabilities just like all the other computer devices on your network.

Why Are we in a Big Cybersecurity Mess?

To answer this question logically and truthfully we have to go back to how computers have evolved and connected to each other.

During WW2 the beginning stages of electronic machines tabulating artillery tables faster and more accurately than humans (Colossus mark 1 and 2)

(public Domain picture)

As the computers evolved more and more effort was put in for how the programming and processing abilities occurred and security was not even a worry, as security was physically done not networking wise.

So when and what was the first networked computer?

The first network was the precursor of the internet as we know it and it was called ARPANET (Advanced research Projects Agency Network): EDN Network article discusses this. On Arpanet in 1969 and shortly thereafter the focus was on making the network operational (it finally was deemed “operational” in 1975 at six years later). The work on this technology is available for everyone to see: TCP Transmission Control Protocol as it was developed in the public domain : The RFC 793 September1981

If you look at the Table of Contents of the TCP RFC (Transmission Control Protocol – Request For Comment) document there is no place for security or encryption. It is up to you to develop security. So that is what we have done. New technologies with SSL(Secure Socket Layer) and TLS(Transport Layer Security) have been built on top of the TCP technology.

As you may know from our past blogpost SSL is no longer PCI compliant

So THIS IS THE PROBLEM !!!

We are developing our current software on an insecure platform.

Until there is a computer built from scratch for security using a network mechanism that is also built with security in mind, we will always be fighting a losing battle.

So we have developed Compliance mechanisms:

PCI – Payment Card Industry (2004 major credit card companies came together)
HIPAA – Health Insurance Portability and Accountability Act of 1996
Other public company compliance regulations (SOX)

The compliance systems are not designed to make you 100%secure, they are designed for you to mitigate security problems. If you follow all the rules for the most part you will keep problems in check and thus business risk is reasonable.

The bottom line is for IT resources to provide business capabilities, in that environment security has to be mitigated. Until someone develops a 100% secure platform this is the life we have. We will have to keep up on patches, and review logs while always looking over our shoulders to see if the criminal hackers have finally come into the environment or not.

Interesting to note, that as more people get connected we stop to think about our security, I mean who thinks about cybersecurity as they get a new phone or tablet/laptop? especially if that is their first foray into smartphones. The new connectee is interested only in how I can connect (usually with free WiFi or an unlimited data plan. The reason we stop to think about security is that we expect security to be there.

The unfortunate aspect of more people connecting is that not all people are knowledgeable about phishing emails and other cyber security problems. It takes time to become knowledgeable in anything, so the overall understanding is pushed down (common denominator).

So my theory is as more people connect the average knowledge about cybersecurity is pushed down. Thus allowing more attacks to be successful by the criminal hackers.

In the following image Cisco predicted IoTs to balloon to 50billion devices by 2020. (this seems correct or low).

So nothing has changed – we are so busy connecting to the Internet we are not focusing on Security. This phenomenon is moving faster towards a larger Chaotic environment.

Protect Privacy of Client Data using New Ways

Do you want to actually improve your level of Cybersecurity?

What will you do differently today or in the next few months better than last year?

As in past post the GDPR has laid out new regulations

that affect an entity that has data of an EU resident with impact on any of the following:

Private and family life, home and communications data
Physical and mental integrity
Personal data
Freedom to work and choose occupation
Freedom of thought , conscience and religion
Freedom of expression

The key in this graph is to be near the Green shaded squares, and not the bright red squares. I.e. having a high probability with a critical impact is bad and requires focus. Whereas an unlikely probability is negligible impact then this is not so important to focus on.

The problem is to find the Critical impact and high probability events in a manner that are easy to see as well.

In the computer world we have focused almost exclusively on personal data (PII – Personal Identifiable Identity).

But there are more difficult to identify privacy concerns such as:

What does it mean to protect freedom of expression?

So if someone has a political cause that they follow, like Greenpeace. If for some reason another non-profit has an interest in getting new donations. Here is a google search that had a “People also search for” area:

So keeping even a log of searches or other information might lessen some freedom.

Freedom to choose an occupation?

How can lack of privacy screw up your freedom to choose an occupation? Besides the pictures on Facebook about your late night parties. What if you say one thing on Facebook, and yet another in interview?

Freedom of thought?

The freedom of thought may be happening already, but that may be “good”. If you are a criminal and try to add illegal items for sale, that may not be possible due to the filters. Although your freedom was curtailed, the overall good of less illegal acts on the Internet may be desirable. Other curtailing of freedom of thought as in my politics is better than yours is quite more complicated to curtail or even attempt to make fair, as it is in the eye of beholder. So politics may not be able to be policed. This subject will depend on the country it is in, as USA has a unique constitution as in freedom of press and speech.

Private and home communications?

Here the nirvana of the advertiser means to learn how you use ‘stuff’ so that they can modify and make you buy their ‘stuff’ instead. So how much of private information should be ‘clouded’? Too bad there are no smoke generators, where one can create a bunch of junk signals that makes the advertiser just confused.

So you can see that Cyber is about People and information, as an interesting Youtube Blackhat keynote said (presented by The Grugq) : Cyber is a new dimension in conflict which is still not fully theorized or conceptualized. Not that it is stopping anybody.

So we have to start focusing on privacy data protection in many new ways (and use the GDPR as a start – only because one can see into the initial bureaucracy mind of regulations of privacy).

Attack Life Cycle Changed By Cloud

Great video from BSides Columbus Ohio 2018 :

“Zero to Owned in 1 Hour”

That is an interesting review of how the new potential weaknesses are in the Cloud itself.

Human Access to the cloud can be a weak point.

AWS (Amazon Web Services)

Does Multi-factor Authentication work with multiple people running things?

Service Provider (cloud company) – has a main login, here is where the hacker can get the keys to the kingdom. what if the hacker can figure out to get the main account login somehow? we are so busy locking down all the desktops and more, it is the easy items that we seem to fall down on.

The comparison with the old life cycle is interesting, as we were so focused on denying system access last year (or pre-cloud).

Today if the main account somehow is taken over the hacker does not need to escalate privileges or keep access in the network since the main control account can do all of that and more.

So due to the big beacon of if you capture this item then you have keys to kingdom, what can we do to prevent this?

You have to review how the system administration and ownership of the cloud account is handled.

How many people are managing the main account
How is the password/authentication performed?
Who is reviewing the security of this important account?

I.e. who should be at fault if there is a security problem? The Cloud company (or service provider) or our own IT people? At first blush, you would think it depends on the problem, but the interesting thing about this is that some cloud companies want to push that responsibility to the client. Check this post by CSOonline.com :

12 top cloud Security threats “Treacherous 12”

Data Breaches
Insufficient Identity, credential and access management
Insecure interfaces and application programming interfaces (APIs)
System vulnerabilities
Account hijacking
Malicious Insiders
Advanced Persistent Threats (APTs)
Data loss
Insufficient Due Diligence
Abuse and nefarious use of cloud services
Denial of Service (DoS)
Shared Technology vulnerabilities

This is a nice list, so which threats could be classified “service provider”, and which would be more the client fault?

All of them could be both or either , except for System vulnerabilities which is just Service provider. Denial of Service ought to be service provider as well.

The problem is that the client can affect almost all of them as the client drives the applications and thus the technological trail. Or the client really controls most of the issue like account hijacking (main account)

As usual someone has to review and check (technical Audit) to make sure that the technology is doing what it is supposed to be doing “securely”.

Contact to discuss