100% Cybersecurity is Impossible

Do you want to use the Internet? Computers? Tablets? Cellphones?

There is no device created that is 100% secure with no risk.

So now what?

Risk management – is what we are supposed to do, where the risk of using something is lower than the value of using it. For example: using a computer for business reasons is worthwhile when the cost to keep it safe is relatively low (own a firewall, anti-virus software and more)

Let’s use a different example. what about if a business has highly confidential banking transactions to perform that are worth hundreds of thousands of dollars?  Now the risk of using the computer and getting infected by malware or other viruses even if low likelihood the impact would be high.  Since Likelihood*Impact = Risk

Low*High= higher risk than

Low * Low = Low  or

Low* Med =Medium-Low

 

If Likelihood is High then a small impact is bad too.

High*Low =  High risk

For High likelihood and medium or high impact it is lights out for many organizations.

High*High = Bad … very bad

This Risk matrix has to be set up to analyze the Risk management of your business.

Paul Holland also discusses this in Bsides London “Understanding your business risks are key”

Paul also discusses ‘Things to consider when making decisions on risk appetite’

  1. What kind of loss would you deem materially damaging (impact)?
  2. What can you live without and for how long(impact)?
  3. What information must not fall into the wrong hands(impact)?
  4. How do you protect your information?

So if you are a business owner or CEO, CFO, CIO then you have to answer the subjective risk questions honestly.

So if you are spending 10% on security and you have millions of dollars in risk impact,  should you spend 11% on security?  This is a difficult question to answer. Since we  cannot be 100% secure. Where do we spend money to improve security? Because of the law of diminishing returns works on everything. Sometimes more money spent is not going to be a major change, just an incremental one.

The above image is useful in letting us know when we should re-evaluate our risk profile. External changes or internal changes should cause you to re-do your matrix.

Internal:

  1. Changing markets
  2. New business areas
  3. New Leadership
  4. Change in risk appetite
  5. Cloud adoption (major technical changes)
  6. Supply chain risks

External

  1. New vulnerabilities
  2. Political changes (local, state, national, international)
  3. Regulatory changes
  4. New technology (quantum breaks encryption — AI makes attacks more sophisticated)

We all know attacks are more sophisticated, since the criminals want to attack more people with new methods to make more money every year.

Talking to an expert to navigate this huge moving target is a good idea:

Contact Us to discuss

Why Is It Cybersecurity Pros Make It Complicated?

We say things like: DO NOT CLICK ON Phishing emails!!

But then Equifax creates www.experianidentityservice.co.uk ???  or creditexpert.co.uk/login/login

Bsides in London earlier this year had a presentation by Meadow Ellis (@notameadow).

Meadow makes a good point, as we as Cybersecurity professionals ask users to be careful what you click, and then  somebody in the company makes a difficult to read domain name, since the easy ones are taken.

So if a user can at times be duped and then clicks on malware (let’s face it users will  never be 100% accurate) then we must assume that the hackers can go into one of our systems inside the firewall.

So this scenario describes why we need to have zero-trust network architecture, and in a zero-trust network, we assume the bad guys are everywhere, so it requires identity management to be hardened.

Assume that phishing will work eventually in your environment

Here is where tyhe phishing domains are actually coming from(Paloaltonetworks.com post):

You see the problem is all the hosting companies are in the USA  so as I mentioned all the attackers are already in our midst.

Your risk management and Cybersecurity plans need to reflect that.

Your marketing efforts should reflect a simple domain structure that makes sense so that when the phishing people try to scam your customers, they will hopefully see through the bad domains.

As per Isaca presentation: “State of Cybersecurity”  90% of all federal (US) breaches are started with a phishing email.

 

Contact us to discuss your cybersecurity risk management profile.

 

SAML Attacks can break down Single Sign-On(SSO)

Area41 Defconswitzerland had an interesting video about attacking Single Sign-on technology SAML – Security Assertion Markup Language  (basic tutorial on SAML)

There are a few ways an attack can happen, while the initial connections are made (and all certificate info is exchanged or other info needed.

Or after the initial connection was made and now the single sign on conditions are set. I.e. the auth server will store cookies, and redirects on next ask for access.

The image above is from auth0.com

So when the attacker tries to inject an attack they are mimicking the tokens. or the XML .

check out the following from the defconswitzerland video:

SAML Attacks Certificate Tampering

  • Clones a certificate, generate a new key material
  • Use a certificate signed by other official CA

SAML Attacks XML

  • signature Exclusion(simply delete Signature)
  • XML signature Wrapping
    • Paper on breaking SAML(Be whoever you want to be 2012)

SSO is supposed to be a technology which makes accessing multiple network systems easier and safer. So if there is a way to attack it and have access then it defeats the purpose of all this defense.

 

Contact Us to discuss auditing your network environment

You are Good, But Neighbor is not… Now What?

Let’s set this up…

You have paid attention to some Cyber security efforts, and have a number of defenses, maybe not “all of them” but your risk management matrix has shown you where to focus. What is impact on a device if having Cyber security problems?

Assuming you set up the probability matrix of all of your devices failure impact… Did you think of everything?

What about this:

Internet Storm center has  a story “More malspam pushing Lokibot”  

The post is about when an email attachment RTF(Rich Text Format) runs and then downloads an exploit for CVE-2017-11882 which installs Loki the information stealer.

Once Loki is on the machine it will contact home base and more.

Loki is an especially bad malware software, as it steals FTP credentials, SMTP credentials, Browser data, database information, and keylogger abilities.

So how do we defend against this malware? we need to deny the entry points. Because if once the malware is in one of your systems or one of your partners then it is a different game.

 

So what happens when  you think the neighbor is infected?  The firewall is no longer in play, as all internal machines are now open to attack. All it takes is another payload to be dropped into the infected machine that will take advantage of other machines with weak defenses.

So the problem is that any machine that you allow into your network (with vpn or otherwise) also can make your network systems weaker.

Coming back to our neighbor, if the neighbor does not have the same methods to security as you do, they are now a liability if you do not take the neighbor threat seriously.

I want to give an example in an apartment building that has been setup with a well known ISP internet service. So you get an apartment  and the service for internet is built-in to the price of your apartment(or at least is a minor add-on).

The Apartment people tell you to just plug into the wall and voila you have internet service.

So when i plug in, do i get my own router? Or am I connected within a switch with every other apartment first? So now I have to run a discovery scan, and check all other IP addresses first?

This is why one runs a discovery scan, to see all the machines that are on the network and that can see you. This is all part of the risk management of your company.

 

Contact Us to discuss Risk management and more.

Smart Cameras have Cybersecurity Problems

Everything has cybersecurity problems if it is not built with some security in mind at least. One should not build security after building the product, it tends to be ad-hoc or kluge.

Tom’s Guide has a good article of several cameras, it happens that AV-TEST evaluated 8 IP(Internet Protocol) cameras.

Only 3 cameras received 3 stars out of 3 (best stat): Logitech Circle, Myfox Security Camera, and the Netgear Arlo.  D-Link and Hanhwa Techwin need to get updates. Samsung Smartcam had  a new vulnerability that was found in March. And the unknown brands should just be thrown out.

 Logitech’s Circle above.  (a new one Circle 2 is available now)

Why focus on cameras? because they are easy to set up but not as easy to keep up and secure.

What happens when new firmware is released? How long until you update the camera? the camera requires a password and then upload the file – update, and ‘reboot’.

These new cameras also have cloud accounts or mobile apps, which may need updating too.

MyFox security camera is also a good option. (Made by Somfy protect, here is Somfy tech support page).

The other “top camera” in the review is:

Netgear Arlo has many options in cameras

Security light, Pro2, Pro, regular, Go, Q, Q plus, and baby

So you bought a nice camera, set up the Wifi, and the app on your phone.  Now you can keep an eye on a certain area from anywhere you have phone service. Pretty good right?

Now in a year or so, a new vulnerability comes out, and you have to upgrade the firmware. Where was that password again?

this year’s top product become next years liabilities (remember the Intel/AMD security problem in all processors).

So better do some documentation of the camera devices, and keep track of the vulnerabilities just like all the other computer devices on your network.

 

Contact Us to discuss your security policy needs.