Posted on

Lokke Moerel: Digital Sovereignty and the Changing Landscape of AI & Privacy Laws

As we enter the second half of 2021, it’s becoming evident that societies worldwide embrace digital transformation as part of their everyday lives. This is backed by the fact that half of the world now uses social media and at least 4.66 billion people around the world now use the internet.

However, as societies become more digitized, the vulnerabilities that come with it also increase. From malware attacks that rose by 358% to a significant increase in risk of successful ransomware attacks due to remote working during Covid-19, to difficult-to-combat online conspiracy theories of the anti-vax and anti-5G movements, stimulated by Russian infiltration.

Lokke Moerel, professor of Global ICT Law at Tilburg University and member of the Dutch Cyber Security Council, shares her insights into the need for digital sovereignty within the EU and how AI and privacy laws are changing rapidly due to digitization.

 

Accelerating Digital Sovereignty across Europe

 

In today’s increasingly digitalized landscape, more and more users feel the need to keep their data safe and are willing to leave popular platforms, such as Whatsapp, based on a change of privacy terms.

With 92% of Western data being kept in the US, EU nations have realized the need to adopt a joint strategy on how data is controlled and shared. While fostering the Digital Single Market is needed for innovation to thrive, effective safeguards must be placed to protect users in a data-driven world.

Lokke goes into detail about how the current situation has exacerbated the need for digital sovereignty in the EU, particularly for the Netherlands as advised by the Dutch Cyber Security Council.

 

Europe has been focusing on digital sovereignty and recently, the Dutch Cyber Security Council issued public advice that the digital sovereignty of the Netherlands is under pressure. What does digital sovereignty mean?

 

We are one of the most digitalized societies and this has been accelerated by the Corona crisis. Within no time, people worked from home, and children were schooled online. It was amazing to see how quickly we were up and running again. However, every upside has downsides and we saw new vulnerabilities and dependencies. 

  • A tremendous increase in the activities of cyber criminals abusing the vulnerabilities due to remote access to systems when people worked from home.
  • Foreign states stealing COVID-19 research
  • Flaws in privacy and security of video tooling.
  • More data on children are in the clouds of non-EU providers due to the increased use of digital teaching tools.
  • The dependency of the Netherlands on social media platforms for combating misinformation and the lack of control from the government to combat it.

The core message of the public advice of the Council is that our digital dependencies are now so great that the digital sovereignty of the Netherlands is under pressure. This goes further than guaranteeing the cybersecurity of our critical IT systems and the data generated with these systems. We also need to maintain control over our essential economic ecosystems and democratic processes in the digital world.

 

Can you give us examples of how digital sovereignty (or lack of it) can affect the economic ecosystems and democratic processes?

 

Examples of essential eco-systems:

Lack of control over critical technologies will result in new dependencies. For example, without proper encryption, we will not be able to protect the valuable and sensitive information of our governments, companies, and citizens. Current encryption will not hold against the computing power of future quantum computers.

We will therefore have to innovate now to protect our critical information also in the future. This is not only relevant for future information, but also current information. Do not forget that foreign states systematically intercept and preserve encrypted communications in anticipation that these may be decrypted at a later stage. 

To be able to make large-scale use of data analysis using AI, enormous computing power is required (which requires cloud computing) as well as access to large quantities of data, which will require combining data in specific industry sectors (such as health), which is currently difficult.

Efficient access to harmonized data and computing infrastructure will become the foundation for the Dutch and European innovation and knowledge infrastructure. Maintaining control over this is an essential part of our strategic autonomy.

Examples of democratic processes: When the state is not in control over the election process, due to targeted misinformation and systematic infiltration of social media by foreign states to influence citizens, our digital sovereignty is at stake.

We see that digital sovereignty is very high on the EU’s agenda. For our neighbor Germany, for example, it is Chefsache. In the Netherlands, however, we mainly respond to cyber threats in a technical and reactive manner. We respond in crisis mode. 

The council thinks it is high time for a more coordinated and proactive approach, starting with ensuring three basis facilities: sovereignty-respecting cloud for secure data storage and data analysis, secure digital communication networks, and post-quantum cryptography.

 
Want more insights on cybersecurity? Join industry leaders and C-suites from top 500 companies and gain exclusive insider knowledge at Management Events’ 600Minutes Cyber Security in Belgium.
 

CISO and Their Roles in Digital Sovereignty

 

At the core of digital sovereignty issues is the need to safeguard information assets for European countries.

As the Netherlands continues to build upon its Dutch Digitalisation Strategy 2.0 and integrate more cloud-based technologies within its economic ecosystems and democratic processes, it is up to chief information security officers (CISO) to be aware of what it all means for an organization and how it affects its cloud strategies.

 

What does digital sovereignty mean for the CISO?

 

Most governments and companies will have a corporate cloud policy. I see that these policies really try to address the direct requirements of a specific cloud project. 

When deciding whether to bring services to the cloud, the company will weigh up the benefits of public cloud (better security, better functionalities) on a project-by-project basis against the specific dependencies and security issues in the project in question.

However, considerations of loss of sovereignty are not taken into account. As a result, for each project, the decision can be justified, but ultimately these decisions together do threaten our sovereignty, where in the future you want to be able to process data across cloud solutions for example (an example of The Tragedy of the Commons).

I think it is important for CISOs to be aware of all the EU initiatives to increase our digital sovereignty.

 

What should they be aware of in terms of initiatives?

 

GAIA-X: many people think that the GAIA-X project, is about setting up a European cloud infrastructure. GAIA-X is, however, not about creating Europe’s own vertical cloud hyperscalers. It is also not about keeping the non-EU cloud services providers out or keeping all data within the EU. It is about achieving interoperability between cloud offerings by setting common technical standards and legal frameworks for cloud infrastructure and services. 

This form of interoperability goes beyond the portability of data and applications from one vendor to another to prevent vendor lock-in; it really concerns the creation of open APIs, interoperability of key management for encryption, unambiguous identity, and access management, full control over storage and access to data, etc.

Worth keeping track of I would say.

European Data Spaces: data spaces intended to unlock the value of European data for innovation. 

The aim is to create common data spaces for certain sectors with common interests (e.g., for health data and governments) so that the scale of data required for innovation for this group can be achieved.

 

Looking Into AI and Its Purpose in Cyber Security

 

As remote working conditions and digital processes continue to become the norm for users and organizations, cyber attacks are becoming increasingly prevalent. 95% of cybersecurity breaches are a result of human error and as the information security market is expected to reach $170 billion in 2022, the cost of digital attacks can be enormous.

AI has always been seen as a silver bullet for organizations to combat cyber-attacks and increase resilience in areas where a majority of human error lies. However, Lokke describes the potential and possibilities of AI as both good and bad, depending on how it is utilized.

 

What scares you the most regarding the seemingly endless possibilities of AI?

 

Like all technology: AI is not good, it is not bad, but it is also not neutral. 

To start with, AI is as good as the purpose for which it is used. In the cyber context, this means that we really should keep ahead of the bad guys. 

New technologies play an increasingly crucial role in cyber resilience. If we are not on top of new technologies like AI and encryption, this will result in new vulnerabilities and dependencies. An example here is that with AI, bad actors can detect and exploit vulnerabilities automatically and on a large scale.

However, AI is also expected to make it possible to automatically detect and patch vulnerabilities. I am currently involved in a research project, to investigate what options there are to facilitate real-time security patching by suppliers.

 

Privacy Laws in The EU and Its Future

 

With digital sovereignty being top-of-mind for EU nations and the increased awareness of data privacy among the public, governments and regulators understand that there is a need for comprehensive privacy laws that protect both users and businesses.

From California Privacy Rights Act to the ever-evolving GDPR, more and more data protection acts are being introduced and implemented across the globe. Moerel shares her views on how privacy laws will continue to shift and change to adapt to the new digital landscape and what global privacy laws mean for an organization.

 

In what ways do you see privacy laws changing in the future?

 

Every week there is a new privacy law being adopted somewhere in the world. By now there are about 130 countries with omnibus ‘GDPR style’ privacy laws. Everybody heard about the Californian Privacy Rights Act, but less well known is that by now, 20 other U.S. states have introduced privacy bills. 

In the EU we now have the draft proposal of the European Commission for an AI regulation and it is not a risky prediction to say that – like what happened with GDPR – other countries will also look at this draft and start preparing their own legislative proposals.

The way to deal with a myriad of global rules is to implement a very robust company-wide security and privacy protection program. After all, compliance with the law is a baseline where you cannot go under. Do a proper job and you do not have to worry about compliance. 

In the end, it is about trust more than compliance. 

Posted on

Monica Verma, CISO of Helsedirektoratet: The Necessity of Resilience and How to Embed it in Your Organization

The rising number of cyber attacks has caused IT leaders across industries to take cybersecurity measures more seriously than ever before. This is reflected in our interviews with CIOs on cybersecurity investments who revealed cloud security and cybersecurity strategies as top priorities. A number of industries have also adopted digital twins to protect their digital assets, allowing cyber security platforms to perform at higher efficiency and accuracy.  

However, CIOs and CISOs face continuous challenges with implementing high-level cybersecurity due to limited budget and online security obstacles in a hybrid workforce.  

Monica Verma, CISO of Helsedirektoratet, podcast host of We Talk Cyber, and blogger on MonicaTalksCyber.com, shares valuable insights on operational and cyber resilience, effective cybersecurity programs for critical infrastructure, the evolution of the CISO role, and more.  

 

What are your top cybersecurity lessons learnt from the pandemic?  

There’s no absolute security. Things can and will go wrong. That’s true for both a pandemic and a cybersecurity crisis. The pandemic has shown us an increasing need for adaptive security as a part of building resilience and crisis management.  

Operational resilience is as much dependent on the human and communications aspect as the technical capabilities in place. It’s not a matter of “if”. It’s no longer even a matter of “when”. It’s a matter of: 

  • How long ago did attackers infiltrate? 
  • How quickly can/did we detect it? 
  • How quickly and effectively can we respond? 
  • How do we handle the unknowns? 
  • How do we adapt and continue critical services? 

Preventive controls are not enough. Effective crisis management requires planning for both the known-unknowns and the unknown-unknowns. 

 

How do you think the role of CIO/CISO has evolved in terms of ensuring the security of their organization?

Traditionally, the CISO role started as a technical role — a younger sibling or a distant cousin of the C-Suite. It’s mostly a title associated with a lack of budget, mandate, or even a seat at the grown-ups’ table. 
 
However, an effective CISO role is that of a business leader itself, an advisor to the board, top management, and the rest of the business. The role has evolved from a “glorified” security engineer to a business and organizational advisor. As data breaches and ransomware attacks have skyrocketed recently, particularly during the pandemic, more organizations look up to the CISO to help them identify, understand and manage their threats and risks better.  

Today, many organizations understand that a CISO’s job is not just to build an information security management system (ISMS) with a bunch of policies and other governing documents. Organizations are beginning to employ a CISO/CIO to rather effectively invest in security with timely risk management and provide sound advice tailored to the stakeholders.  

As a result of this evolution, there’s also been a shift in the skills required to be an effective CISO: 

  • Professional skills such as risk advisory and business understanding, which span very well outside the technical realm, and; 
  • Soft skills such as concise, clear, and effective communication, are a driving force behind the vision and strategy of an effective leader. 

There are many organizations that still see and employ a CISO role as a technical role, but we are seeing a shift in terms of budget, investments, and better mandate — transforming the CISO into a cross-functional advisory role worthy of an actual seat at the table. 

 

Today’s organizations have a higher risk of exposure due to a more complex and global digital footprint. What strategies can organizations implement to better prepare for cyber attacks?  

There are three critical aspects that need to be addressed in order to better manage the ever-increasing risk exposure and ever-complex digital footprint: 
 
a. Always have a holistic view of both the current state within the organization and its supply chain as a fundamental input to your cybersecurity strategy. You are as strong as your weakest link. It’s not your employees. It’s the weakest link in your entire supply chain. You need to be aware of the weakest link in your supply chain, in order to be better prepared for cyberattacks. 
 
b. Always have a risk-based approach when developing your strategy, operationalizing your cybersecurity plan, and investing in security controls (people, process, and technology). Your organization’s risk profile is affected by other risk profiles in your entire supply chain. A risk-based supplier management is as important as a risk-based security governance within your organization. Additionally, an effective risk-based approach will also take into account the threat landscape. 
 
c. Balance your security investment effectively between preventive controls, predictive controls, and adaptive and other response controls, based on your risk exposure. The more critical data, services, and infrastructure you have, the higher your exposure in case of a cyberattack. It’s the difference between an e-commerce website going down for weeks vs. critical data or service not available for even a few hours or days. Preventive controls and cyber hygiene are a must. But as there is no 100% security, these will fail. Your cybersecurity strategy must take into account effective crisis management and building operational resilience over time. 

 

Based on your cybersecurity adoption lifecycle model, how can an organization build cyber and operational resilience? 

Building cyber and operational resilience requires effective planning and response to manage both the known-unknowns and the unknown-unknowns. Additionally, this takes into account people, processes, and technical aspects. Here are the key things organizations can do to build resilience over time: 
 
a. Building resilience requires a clearly defined accountability at the top level as well as a resilient, collaborative, and prepared workforce. Accountability and awareness are key. Train your employees and train them regularly. It’s vital that the board and top-level management understand their accountability, as well as that every employee understands their role and responsibilities both during normal operations and an ongoing crisis. Test your preparedness and crisis management plans. Make sure your crisis management team works like a well-oiled machine. Run table-top exercises, learn and repeat. 
 
b. Map, understand, and have a comprehensive overview of the dependencies that your critical services have on the underlying assets within your entire supply chain. Do your homework to have effective planning and preparedness in place. Build your crisis management and preparedness plans based on disruption scenarios for your business and critical services towards society, dependencies within your organization and on your third parties, your risk exposure, and your risk tolerance. Your crisis management plan should also take into account the steps you execute in case an unknown scenario occurs.   
 
c. Invest in adaptive response management. As there are always unknown factors in play, an effective response management will include adaptive mechanisms, in addition to preventive controls. For example, can we activate certain policies in real-time as certain events or anomalies are detected? How can we fail-safe both within our IT and particularly our OT environments, while keeping critical services up and running? How do we adapt the use of our people, processes, and environment in real-time to reduce the impact? How quickly can we segment (parts of) our infrastructure, in order to contain the spread? How quickly do we predict a threat or detect an attack before it becomes a crisis? How do we reduce recovery time?   

 

What are some of the technological disruptors to cybersecurity?  

In my opinion, the top three technological disruptors to cybersecurity are: 

 
a. Cloud 
Cloud is no longer a new technology. However, the skyrocketed migration to cloud in recent years demands an urgent shift in mindset, especially when it comes to cybersecurity and privacy. Moving to the cloud is no longer just a lift and shift operation, even if that’s what you may be doing with some of your services and data. To effectively utilize the benefits of cloud computing, in a secure and privacy-friendly manner, a shift in the mindset is required right from the very beginning, integrated right from the planning stages of a migration, through operating in the cloud and all the way to the exit stage. 
 
b. Convergence of physical, biological, and digital worlds 
With the adoption of Internet of Things (IoT) and other emerging technologies, there is an even stronger convergence of the physical, biological, and digital worlds in progress. However, there is a big gap in understanding what risks this entails and the lack of management of these risks as a part of a cybersecurity strategy. As we go forward, there is a stronger need to address these issues at a strategy and business level to ensure that security, safety, and privacy continue to be a top priority. 
 
c. Machine Learning and Artificial Intelligence 
Machine learning and the emerging applications of artificial intelligence are some of the key technological disruptors, as ethics, safety, and other risks emerge along with it. We are already seeing Proof of Concept (PoC) cyberattacks enhanced by machine learning. As we go forward, these emerging technologies will be abused by cyber criminals and other threat attackers in various ways, including but not limited to, increased scale and effectiveness of cyberattacks, discovering new unknown vulnerabilities and exploits faster, bias, discrimination, and other ethical, security and privacy violations. As the threat landscape evolves, the use of machine learning and artificial intelligence within cybersecurity will be critical. 

 

What are the elements of an effective cybersecurity program for critical infrastructure?

Due to the ongoing convergence between Information Technology (IT) and Operational Technology (OT) environments including Industrial IoT (IIoT), along with accelerated digitalization as a result of the pandemic, we have seen a massive rise in cyberattacks, particularly ransomware, against critical infrastructure. The key with critical infrastructure is operational resilience both during normal operations and under crisis. An effective cybersecurity program for critical infrastructure addresses three key areas: 
 
a. Legacy systems within the OT environment 
As the threat landscape and attack vectors have evolved, the convergence has left the legacy OT systems even more vulnerable to cyberattacks. Additionally, the lack of visibility and the difficulty of maintenance pose an even bigger threat as both old and new vulnerabilities and attack vectors are discovered. The basic cybersecurity hygiene e.g. patching, awareness and other preventive controls are even more important in the OT environment, as these systems get connected to emerging technologies. Hence, the basics is still one of the key aspects.  
 
b. Over-increasing complexity and attack surface 
Due to technological disruptions and ever-increasing convergence, both the complexity and the attack surface of OT environments including the critical infrastructure are increasing drastically. This increases the likelihood of a successful cyberattack, as the threat actors now have a much larger attack surface to begin with. Going back to the point, it’s not if or even when you’ll get hacked, but rather how quickly we detect, adapt, and respond to an attack. Hence, building operational resilience is a critical aspect to be addressed in an effective cybersecurity program. 
 
c. Managing the consequences and risks to life, safety, and society 
As with every cyberattack, a key aspect is to understand and contain the impact, as early and efficiently as possible. To do that, it is vital to have a comprehensive overview of what risks are associated with critical infrastructure, along with how it impacts the business, the organization, and society at large. As we move from traditional IT to OT environments, we switch from just talking about downtime or data breaches to risks to life, safety, and functions with society as a whole. A good security investment is always risk-based. This is even more vital for critical services, as the impact can be tremendous. 

 

What are some of the key challenges with regards to diversity, inclusion, and equity within the cybersecurity industry and how can we address them?

We have seen an increasing awareness of diversity, inclusion, and equal rights over the last decades, both within society in general and in the cybersecurity industry. However, we still face massive challenges when it comes to pay grade, job requirements and hiring, reasons and motivations behind diversity and inclusion, as well as a lack of understanding of equity and the role it plays.
 
On one hand, we need to have continued conversations and take further actions for better representation within the cybersecurity industry. On the other hand, we need to do that while breaking down the labels and stereotypes. I am a CISO. Not a female CISO. My professional experience and contributions are independent of my gender, background, and other labels. 
 
That means, while on one hand, we need definitive actions to reduce the pay gap, include diversified talent, and ensure effective and streamlined hiring processes including neutrally worded job positions with realistic requirements, on the other hand, we need to break down the barriers to bring in a diversified workforce independent of their labels. That includes diversity in both what we see and what we hear,  i.e. diversity and inclusion of opinions.  
 
Equity is yet another term that is highly misunderstood. Equity is not the same as equality. While equality is important and talks about equal opportunities and resources, e.g. equal pay grade, equity is about fairness, i.e. giving people what they need in order to make things fair and level the playing field. Due to stereotypes and lack of a balanced representation over decades, there is a need for equity to ensure we can reach equality. Equality is the end goal, but equity is the means to reach it. Equity is not about giving too little to people who need it or too much to those who don’t, but rather to provide fairness in order to reduce the differences of inequalities and pave the way to a more equal society and cybersecurity industry. 

Posted on

Clubhouse Concerns: Privacy And Security Issues

As entrepreneurs, influencers, and c-level executives (CXO) flock to Clubhouse in a bid to harness the app, the security and privacy shortcomings are becoming evident, forcing businesses to re-evaluate their approach to the social media platform.

The app’s fast rise to fame also came with a price as security issues within the platform came to light, posing the question of whether users’ data are fully protected.

In this article, we take a quick look at the recent data breach that Clubhouse experienced and what concerns it raises.

 

Data Spillage and Security Leaks

 

Stanford University Internet Observatory first raised concerns about a Shanghai-based start-up that supplies Clubhouse’s back-end infrastructure and that they would have access to “users raw audio, potentially providing access to the Chinese government.”

Another report by McAfee’s Advanced Threat Research team also highlighted similar security issues in both hardware and software due to Clubhouse’s reliance on the Shanghai tech company.

Both reports seem to indicate that the platform was working on an infrastructure that was poised to be hacked or breached.

In February, Clubhouse confirmed that chats were breached from the invite-only app. The company claimed that an unidentified user was able to stream Clubhouse audio feeds from “multiple rooms” and streamed it on their own third-party website.

A spokesperson for the company has stated that the user was permanently banned and that new safeguards were being installed, which pushes the app a step towards securing and protecting user data even more.

 
Next-level Insights: Gain exclusives insights on industry trends from experts at Management Events’ Clubhouse (@Managementev) sessions.
 

Differing Impacts of security issues

 

Responses from cybersecurity experts on whether Clubhouse is safe for users varied widely with some claiming it should be a serious concern for anyone who uses the app for sensitive conversations.

On the other side of the coin, experts highlighted that the security issues raised by the reports were hypothetical and that the risks were mainly concerned with users in China, where the app is already banned.

Nevertheless, certain parts of the world are taking a serious look at Clubhouse’s shortcomings when it comes to data protection and consumer law with countries such as Germany taking court action against the app due to its failure to meet GDPR requirements.

Whether or not Clubhouse security measures are compliant with data and privacy acts, it’s important for businesses and CXOs to be aware of the potential security risks involved with the platform.

 

Prioritizing Cybersecurity Investments 

 

Despite Clubhouse’s meteoric rise to unicorn status with a reported valuation of $1 billion, for them to remain as a viable platform for businesses and industry leaders, the company must invest in and strengthen its cybersecurity measures immediately.

Given the vast increase in digital communications due to work-from-home initiatives and our own report on cybersecurity trends among CXOs and businesses, the onus lies on Clubhouse to ensure that their users’ data are protected.

While the recent security issues do not pose any serious threats or risks, for now, they still serve as a reminder that users need to be vigilant when using the app and that Clubhouse needs to improve its security measures sooner than later.

Posted on

SASE – Netzwerksicherheit Neu Gedacht

Das Secure Access Service Edge (SASE)-Rahmenwerk wurde von Gartner aufbauend auf den neuen Anforderungen an den modernen Geschäftsalltag entwickelt. Im Zeitalter des „Work from Anywhere“ gilt es, User, Geräte und Anwendungen sicher miteinander zu verbinden – ohne dabei auf das klassische Netzwerk zurückzugreifen. Die Sicherheit muss dazu aus dem Netzwerk ans Edge und damit zum einzelnen Mitarbeiter hin verlagert werden. Die Zscaler Zero Trust Exchange hilft dabei.

Heute werden Anwendungen neben Rechenzentren zunehmend in Multicloud-Umgebungen vorgehalten und die Anwender arbeiten in hybriden Arbeitsplatzmodellen. Der Büroschreibtisch wechselt sich dabei mit dem Home Office oder shared Office-Umgebungen ab. Da Anwender und viele Anwendungen das Netzwerk verlassen haben greift die herkömmliche Sicherheit am Unternehmensperimeter nicht mehr.

Die Gartner-Analysten stellen mit ihrem SASE-Konzept den traditionellen Ansatz auf den Kopf. Das Rahmenwerk geht davon aus, dass nicht mehr das Netzwerk in den Mittelpunkt der Sicherheitsbestrebungen gestellt werden muss, sondern die Absicherung des Datenverkehrs zum Anwender. Der Kerngedanke lautet, dass Sicherheit für das Zeitalter des „Working from Anywhere“ ebenfalls über die Cloud bereitgestellt werden sollte. So kann der Datenverkehr während des gesamten Weges vom User zu seiner Applikation geschützt werden, ohne dass der Standort des Anwenders oder der Applikation eine Rolle spielt. Der herkömmliche, netzwerkbasierte Sicherheitsansatz wird durch ein Anwender-zentriertes Modell abgelöst.

Ausschlaggebend beim Secure Access Service Edge-Rahmenwerk ist das „Edge“. Dieser Begriff dient nicht dazu, den Standort des Users zu beschreiben, sondern worauf er zugreifen möchte, denn. die Applikationen können bei unterschiedlichen Cloud-Providern liegen. Trotz der damit einhergehenden Komplexität von Mulicloud-Infrastrukturen hat der Anwender die Erwartungshaltung, mit der größtmöglichen User-Experience auf seine benötigten Anwendungen zugreifen zu können. Im Idealfall bemerkt er gar nicht mehr, wo die Applikationen vorgehalten werden, wenn der Zugriff reibungslos stattfindet.

Das SASE-Rahmenwerk bezieht für die direkt Anbindung ans Internet von jeder Niederlassung deshalb weitere Komponenten für die Konnektivität, wie z.B SD-WAN-Lösungen, mit ein.  Direktes Ausbrechen von jedem Unternehmens- oder sogar Mitarbeiterstandort spart Umwege und profitiert wiederum von einem Cloud-basierten Sicherheitskonzept. Um niedrige Latenzzeiten zu gewährleisten und den Anwender auf dem direkten Weg mit seiner Anwendung zu verbinden können außerdem Peering-Points zwischen Cloud-Anbietern und Cloud Service Providern beitragen.

 

Damit nun die Sicherheit bei einem solchen Rahmenwerk gewährleistet wird, kommt Zero Trust ins Spiel. Zero Trust Network Access (ZTNA) bietet den sicheren Zugriff für autorisierte Anwender auf ihre Applikationen, ohne die Infrastruktur des Netzwerks zu exponieren. Ein Zero Trust-basiertes Modell agiert auf Basis der User-Identität und ermöglicht granulare Segmentierung, wer auf welche Anwendungen Zugriff erhält. Dies bedeutet das Ende von geteilten Netzwerkressourcen, da jeder Zugriff auf Applikationsebene vor der Freigabe validiert wird. Dem User werden nur die Anwendungen freigegeben, die er für seine Arbeit benötigt und für deren Zugriff er berechtigt ist. Dadurch hat der Anwender nie Einblick in die gesamte Applikationslandschaft im Netzwerk und kann sich auch nicht mit Services verbinden, für die er keine Befugnis hat.

Dadurch werden solche Risiken ausgeschaltet, die Unternehmen derzeit über all die Schwachstellen in der Netzwerkinfrastruktur angreifbar machen. Wenn die Infrastruktur nicht mehr offen im Internet dargelegt wird, besteht keine Angriffsfläche für Hacker. So eliminieren Unternehmen die Möglichkeit, ihre Infrastruktur im Internet zu exponieren und nehmen Angreifern die Möglichkeit, sich ins Netzwerk zu hacken.

Die Migration der geschäftskritischen Systeme in die Cloud erzwingt ein Umdenken, wie Mitarbeiter auf die Services zugreifen können. Angesichts der Allgegenwart günstiger Internetverbindung ändert sich die Erwartungshaltung der Mitarbeiter an die Zugriffsgeschwindigkeit und auch an den Komfort des grenzenlosen Zugangs zu Anwendungen. Die größte Umstellung für die IT-Sicherheit ist die durch die Transformation einhergehende Umstellung von der Kontrollinstanz hin zur Risikominimierung. In der Cloud-basierten Welt muss anstelle der separat betrachteten Netzwerke und Sicherheit ein übergreifendes Gefüge aus Netzwerk, Sicherheit und Connectivity treten, das den einfachen, reibungslosen und komfortablen Zugriff auf Anwendungen ermöglicht, unabhängig davon, wo diese vorgehalten werden. Denn dem Anwender ist nicht vermittelbar, dass die Zugriffsgeschwindigkeit durch die Cloud leidet.

Die Zscaler Zero Trust Exchange basiert auf dem SASE-Modell und hilft bei der Bewältigung der Herausforderungen des New-Work-Modells und der sich wandelnden Arbeitswelt. Neben einer schnelleren Bereitstellung und besseren Nutzung von Cloud-Diensten profitieren Unternehmen durch die hochintegrierte Security-Plattform von höherer IT-Sicherheit bei reduzierten Kosten, weniger Komplexität, geringerem Verwaltungsaufwand und zentraler Durchsetzung neuer Richtlinien auf allen Systemen. Die IT-Abteilung kann damit nicht nur ein sicheres und schnelles Anwendererlebnis anbieten, sie erhält über eine Cloud-Plattform auch wieder den Einblick in alle Datenströme zurück und kann damit das Internet als neues Unternehmensnetz kontrollieren, auch wenn die Mitarbeiter mobil arbeiten.

Posted on

Digital Twins for Cyber Security: Strengthening Cyber Resilience

Mimecast_Building_a_human_firewall

Imagine having a virtual replica of your IT network, where you are able to pinpoint security vulnerabilities, develop attack simulations, and deter expensive breaches, all before your system is even implemented.

For some business leaders, this is no longer a fantasy, but a reality with digital twins.

 

Embracing Digital Twins

 

While the digital twin concept was initially applied in manufacturing, many industries have seen beneficial uses of having a digital replica of their assets, operations, and more recently, their cyber security systems.

It’s a known fact that the number of cyberattacks rose at an alarming rate during the outbreak, with many even naming it as a ‘cyber pandemic’. 

As more organizations move their digital assets to the cloud combined with the increased use of Internet of Things (IoT), the immense data proves attractive to cyber attackers looking to profit from unsecured endpoints, networks, and databases.

With cyber criminals becoming increasingly advanced, simply defending the systems and reacting to real-time attacks are no longer sufficient, and businesses have to take a more proactive and predictive approach.

Simulating, Monitoring, and Protecting Physical Assets

A digital twin refers to a virtual replica or representation of a physical device, system, or network. It is a concept borrowed from the Internet of Things (IoT) domain, where physical objects are connected and controlled through digital representations.

In the realm of cyber security, digital twins are used to simulate and monitor the behavior of real-world assets or systems in a controlled and secure environment. By creating a virtual replica of a physical entity, organizations can gain valuable insights into its vulnerabilities, potential attack vectors, and overall security posture.

Digital twins enable cyber security professionals to conduct various activities, including:

Risk Assessment: Digital twins allow for the identification and analysis of potential risks and vulnerabilities associated with a physical asset or system. By simulating attacks and interactions within the digital twin, cyber security experts can evaluate the effectiveness of security controls and make informed decisions to mitigate risks.

Threat Detection: By monitoring the digital twin’s behavior, anomalies and suspicious activities can be detected, which may indicate potential cyber threats or attacks on the corresponding physical entity. This allows for early detection and response to security incidents.

Security Testing and Validation: Digital twins provide a controlled environment for testing security measures and evaluating the effectiveness of security solutions. They allow for the simulation of various attack scenarios to assess the resilience and response capabilities of the corresponding physical assets.

Predictive Analysis: By analyzing data gathered from the digital twin, cyber security professionals can make predictions about potential security breaches or vulnerabilities in the physical system. This helps in proactively addressing security weaknesses and implementing preventive measures.

It’s important to note that while digital twins can assist in enhancing cyber security, they should also be protected themselves. The security of the digital twin environment, including access controls, encryption, and monitoring, is crucial to ensure its integrity and prevent unauthorized access or manipulation that could impact the corresponding physical asset or system.



Use Cases of Digital Twins for Cyber Security

 

While there are few industries that have implemented digital twins to safeguard their digital assets, some companies have taken the leap to bring their cyber security to the next level with faster speed and precision to prevent and combat potential threats.

 

IN AEROSPACE AND DEFENSE

 

The concept of digital twin has actually been around since the 1960s, when it was developed by NASA for the Apollo space programs, and then applied to avert disaster during the Apollo 13 mission in 1970.

While NASA has re-embraced the twinning approach for virtual equipment building and testing, the U.S. Air Force is using the technology to create “a digital replica of a GPS IIR satellite to detect any cyber security issues” as part of a congressional mandate to test its system.

 

“GPS systems are used for geo-location and timing for virtually every aspect of U.S. military operations [and the] potential for signals to be jammed, spoofed or interfered raises serious security concerns.”

– Digital Twins Proliferate as Smart Way to Test Tech
Air Force Magazine

 

A digital model of the satellite was built while it was in orbit, and penetration testing and vulnerability scans were held across the entire GPS system to identify weaknesses and ascertain that all the components operate as intended if any issue arises.

 

AUTOMOTIVE

The automotive industry is smarter than ever before with rising trends in shared mobility, connected and electric vehicles, and autonomous driving. However, the much-awaited digitization and connectivity of modern car systems point to a plethora of information that is tempting targets for cybercriminals.

Cybellum, a computer and network security company, foresaw the need to protect automotive software from cyberthreats, and presented a novel approach to combat online risks through digital twinning.

Called Cybersecurity Digital Twin, Cybellum constructs a virtualized identical version of the in-vehicle components and simulates the electronic control units (ECU) firmware. The twin is then used as the basis for extensive cyber risk analyses and scans to continuously monitor both on-the-road and in-development vehicles for vulnerabilities and threat exposures.

With current car systems implementing over-the-air (OTA) software updates and the new United Nations Economic Commission for Europe (UNECE) cyber security regulations, the digital twin technology additionally helps to perform risk assessments and ensure secure updates.

 

“For an efficient software update management system, a digital twin of the vehicle is almost a must.”

– Digital Twin for Maximum Cyber Security
NTT DATA

 

PRODUCTION AND MANUFACTURING

 

Ian Elsby, the Head of Chemical Industry GB&I at Siemens, wrote about the use of digital twins to deter cyber breaches in the chemical industry.

As production plants and manufacturing factories integrate Industrial Internet of Things (IIoT) into their systems, it brings forth the challenges of cyber attacks and hacking through digital networks. This is where the twinning technology can be utilized to ensure cyber security.

“Just as processes are simulated and data gathered to detect non-performance of assets, a simulated cyber attack can also be detected by the digital twin,” explained Elsby.

He proposed using the virtual database to capture information and testing activities, which will then allow the digital twin to form cyber security protection algorithms to defend the production plant’s data against malicious viruses.

Elsby further emphasized that digital twins are able to make the process of conducting security gap analysis and pinpointing the plant’s security requirements easier and more achievable.



The Security Value of Digital Twins

 

Organizations that have faced cyberattacks know that such breaches are costly, from repairing network vulnerabilities and regaining data control to recovering reputational damages and financial impacts. In fact, the average cost of a breach to a publicly traded company is estimated to be $116 million.

The digital twin technology aids in preventing expensive attacks through its capability to make faster and more efficient decisions as more penetration data and tests are fed to the twin simulation of a system.

 

“[By] executing enough tests and brainstorming all possible scenarios of how a hacker might try to breach into a valuable online resource, the digital twin interface will be capable of reacting with extreme speed and precision by making calculated decisions by itself.”

– Incorporating Digital Twin into Internet Cyber Security – Creating a Safer Future
Challenge Advisory

 

Developing a virtual replica also means the company safeguards its systems and assets from third-party and outsourced vendors, which are often hired to test breaches and build defenses, but which are also susceptible to attacks.

Instead, in-house developers can create different viruses and attack scenarios in the simulation’s interface, thereby improving anti-virus software, pre-programming reactive and counter strikes against cyber attacks, and updating their safeguards in real time.

 

What the Future Holds for Digital Twins

 

In a recent interview with Michael Grieves, who popularized the digital twin concept in 2002, he believes that the world is still in the “conceptual stage of digital twins.” 

“We have this information that we can bring together to create this virtual version of real-world environments based on models and behavioral aspects and modeling and simulation,” Grieves shared. “The next step is to have all this information be pulled together automatically and intelligently.”

With data analytics, artificial intelligence, and digital capabilities increasing as the years pass, digital twins will no doubt play a key part in creating the ideal enterprise security. As seen in available use cases, some organizations are already a few steps ahead of their counterparts in developing tighter and stronger cyber protection.

As online attacks become more refined and sophisticated, so too must the approach that the business world takes to improve the digital safety of their assets, processes, and people.

Posted on

Secure Remote Work – sicher arbeiten im “neuen Normal”

Das “neue Normal” hat die Digitalisierung unserer Arbeitswelt noch einmal rapide beschleunigt und Remote Work bzw. Homeoffice sind fester Bestandteil unseres Lebens geworden. In Sachen Sicherheit zeigt sich aber auch, wo die Achillesfersen der neuen Konstrukte liegen: Nicht genügend Laptops im Haushalt, unsichere Zugänge oder geteilte Passwörter. Dazu arbeiten die neuen Heimarbeiter oft mit sogenannter “Schatten IT“, indem sie eigene Anwendungen und Apps nutzen (sei es aus Gewohnheit oder weil sie die unternehmenseigenen Angebote zu kompliziert finden). Das alles bietet neue Angriffsflächen für Hacker.

IT-Sicherheit: vor allem auch Bewusstseinsbildung

Deshalb muss zuerst bei allen Beteiligten ein echtes Bewusstsein geschaffen werden, sich auch zu Hause „cybersmart“ zu verhalten. Hier sollten Unternehmen ernsthaft Sorge dafür tragen, dass sie ihre Mitarbeiter mit dieser Botschaft auch erreichen – etwa mit einer Informationsseite oder einem ständigen Kommunikationskanal für solche Belange; am besten aber beides.

Die Fakten sprechen eine deutliche Sprache: Laut Studien lassen sich 80% aller Datenlecks auf schwache, wiederverwendete oder gestohlene Passwörter zurückführen. Es gibt also gute Gründe, hier rechtzeitig zu handeln.

Die neuen Gegebenheiten als Chance für die IT-Sicherheit begreifen

 

Die neuen Anforderungen und Gegebenheiten sind eine einmalige Chance für Unternehmen, ihre Verteidigung aus der Implementierungs- und Sicherheitsperspektive zu schärfen: Vor allem mit Security-as-a-Service und starken Passwörtern, die Mitarbeiter und Business gut absichern. Das sind die Basics gegen Viren und andere Malware. Und sie helfen der Homeoffice Workforce und den Unternehmen tatsächlich cybersicher zu sein.

Der Mensch als schwächstes Glied in der Sicherheitskette

 

Oft ist schlichtweg der Mensch selbst das schwächste Glied in der Sicherheitskette: Mitarbeiter, die keine Passwörter ändern oder dieselben Passwörter über viele Nutzerkonten hinweg benutzen. Das gilt besonders, wenn diesbezüglich keine Aufklärung betrieben oder kein Bewusstsein geschaffen wird. Eine solide IT-Sicherheitsbereitschaft und -kultur zu schaffen – das braucht in der Tat Zeit und viel Schulung. Dennoch müssen wir derzeit alle schnell reagieren.

Beim Zugangsmanagement sollte jeder begreifen, dass schlechte Passwort-Hygiene (Default-Passwörter nicht ändern, Passwort Wiederbenutzung oder schwache Passwörter) die Chance erhöht, Opfer eines Hackers zu werden.

 

Cybersecurity-Tipps für Homeoffice-Arbeiter

Heimarbeit bedeutet für die meisten Menschen, dass Dokumente und Gespräche offener für andere zugänglich sind, sei es auch nur die Familie. Deshalb ist es noch wichtiger als zuvor, dass alle Programme lange, zufallsgenerierte Passwörter besitzen. Mit einem Passwort-Manager schlägt man hier zwei Fliegen mit einer Klappe, indem man einzigartige Passwörter für jeden Login generiert und speichert. Username und Passwörter werden dann in einem “Safe” gespeichert, wo sie verschlüsselt und organisiert werden. Die Produkte sind höchst kosteneffektiv, um die Cybersecurity von Heimarbeitern zu verbessern. (Übrigens auch sehr für die private Nutzung empfohlen!)

Ein Passwort-Manager kann schnell, nahtlos und einfach in den Workflow integriert werden. Sie verwenden auch oft Multifaktor-Authentifizierung, die zusätzliche Sicherheit bringt, gerade wenn Mitarbeiter sich von unterschiedlichen Standorten aus einloggen

Mehr Tipps im eBook

 

Die Cybersecurity Experten von LastPass haben dazu ein interessantes eBook erstellt, dass die Eckpfeiler von “Secure Remote Work” skizziert. Sie können es hier downloaden.

Posted on

Internet of Things: Imperfectly Smart Devices

internet of things

Smart technology or IoT continues to shape both consumer and industrial domains. Achievable through the convergence of multiple technologies, which include machine learning, real-time analytics, commodity sensors, and embedded systems. Companies who miss an opportunity and or fail to innovate alongside IoT face the genuine possibility of being overtaken and fail over time.

 

IoT’s most significant trend in recent years is the explosive increase in connected devices, controllable over the internet. According to Fortune Business Insights, the global IoT market size stood at $250.72 billion in 2019. Projections indicate this number will reach $1.46319 trillion by 2027, exhibiting a Compound Annual Growth Rate (CAGR) of 24.9% during this forecast period. 2020 saw a rise in the following components of the IoT model; Networks and Communication, Sensors, Data Analytics (Cloud), and Applications, with different degrees of impact.

 

IoT brings a lot of benefits and new opportunities to businesses all over the world. Environmental sensors, machine learning capabilities, and artificial intelligence platforms provide various operational services for organizations across different industries. Although there are fundamental characteristics shared by most devices, the wide range of applications for IoT technology also means that the particulars can be entirely dissimilar from one device to the next.

 

Due to the large amount and variety of connected devices, IoT continues to implant itself deeper in our lives and society, making it another prime target for cyber-attacks. According to the IBM X-Force Threat Intelligence Index 2020, Financial services remain the topmost attacked industry, closely followed by the Retail sector. Ransomware and Magecart attacks were the most prominent attacks observed against retail and impacted at least 80 reported e-commerce websites in the summer of 2019 alone. Operational Technology (OT) targeting also increased by 2000% from 2018, with more attacks on Industrial Control Systems (ICS) and OT infrastructure than in the past three years.

Operational-Technology-Attack-Trends-2020-IBM-X-Force-Threat-Intelligence-Index-Report-1

Cyber-attacks are not new to IoT; the most common breaches are spyware, malware, and human errors. The latter is critical due to the increase in phishing tactics through email. Attackers have been impersonating consumer tech brands with tempting links to trick users into clicking malicious links. Consumer Technology giants such as Google & YouTube (60%), Apple (15%), and Amazon (12%), made up the bulk of targeted spoofed domains, where attackers hit due to the monetizable data they hold.

 

An innocuous IoT device should not be run unsecured. Therefore, both users and manufacturers need to accentuate and take cyber defense seriously. Thus, resulting in the real need to systematically understand the threats and attacks on IoT infrastructure to secure IoT devices against attackers. This article attempts to identify threat types, analyze, and describe intruders and attacks facing IoT devices and services.

 

Brute-forcing and Poor Passwords

IoT devices often require passwords for users to access and or control the device. According to Cybernews, the most common passwords worldwide are “123456”, “123456789”, “qwerty”, and the word “password” itself.  Weak passwords place your most sensitive information at risk and are similar to not using any password in the first place.

Weak Passwords

Manufacturers typically provide IoT devices with preset login credentials, making setup easier and consumer-friendly. These preset credentials are often openly available from a single web search and easily broken during brute-force attacks. Thus, IT administrators must replace the preset login credentials with significantly stronger credentials. The recommended way to go about this is to create quality passwords unique to the organization or the device and utilizing password managers.

An additional step would be to enable or implement two-factor authentication (2FA). Doing this instantly increases the security level by creating an additional lock that an attacker is less likely to access.

 

Improper Data Transfer and Management

IoT devices make automated decisions and carry out actions without requiring human-to-human or human-to-computer interaction. Thus, it is vital to the integrity of IoT applications that the source(s), data being fed, and produced are protected and verifiable at both ends. To achieve this, data must be encrypted from creation to consumption. However, this typically requires a higher level of encryption, cryptology, and intelligence than is easily achievable by the conventional one-way Transport Layer Security (TLS) encryption.

 

Furthermore, dynamic keys should be employed that ensure each data payload is encrypted with single-use keys that are not stored on the device itself or shared over the network, particularly over an insecure network.

 

Insecure Network

IoT devices require an active network connection to allow endpoints to communicate with each other over the internet. As a result, one of the initial and simplest attack methods a malicious attacker can deploy is to seek out weaknesses in running network services and the network communication model of connected devices.
training & skills acquisition
Attackers attempt to manipulate several vulnerabilities to obtain login credentials, communication tokens, and other identifiers that the Service Ecosystem uses to identify various endpoints. It is crucial to secure endpoints with industry best practices to protect data integrity, privacy, and Man-In-The-Middle attacks (MITM). One method involves encrypting device authentication data at the data-level paired to the public key. Consequently, any captured data should remain unreadable without the equivalent private key.

 

Unsecure Update Process

Firmware and other software patches are often required to be pushed out to IoT devices to prevent them from being compromised or left in a vulnerable state. Organizations have to upload these updates securely to each endpoint as soon as they are made available. Failure to secure access to the update, verify the sources, and integrity can have physical consequences, resulting in data loss and corrode brand reputation, introducing legal liability.

 

Even if vulnerabilities and loopholes are identified, not all IoT devices can be updated securely, and this may be due to the following reasons.

  • Wrongful or no firmware validation.
  • Updates are delivered in plain text or without encryption.
  • No anti-rollback measures
  • Users are not notified of available updates. This is a fairly common occurrence.

 

Implementing anti-rollback update mechanisms can prevent attackers from downgrading a device to an older software version with a known security vulnerability that the attacker can exploit.

 

Inadequate Privacy Protection

IoT devices, by design, collect and store a significant amount of users’ personal information. Unfortunately, not all manufacturers implement strong privacy or data management and protection policies. Those that do tend to begin by encrypting and implementing various layers of distinct checks and balances, providing data security between endpoints. When these security and privacy protection models are absent, improperly installed, or set up, glaring issues crop up.

 

One such example of improperly set privacy controls by the manufacturer was the TRENDnet Webcam Hack. TRENDnet marketed their SecurView cameras for various uses ranging from home security to baby monitoring and claimed they were secure, the FTC said.
Data Protection=However, they had faulty software that let anyone who obtained a camera’s IP address look through it — and sometimes listen as well. Thus for at least two years (2010 – 2012), the SecurView webcams allowed the transmission of user login credentials in clear, readable text over the internet! It did not just end there. Even their proprietary mobile app for the cameras stored users’ login credentials in clear, readable text, right on their mobile devices allowing anyone who obtained a camera’s IP address to look and sometimes listen through it as well.

 

Insecure Ecosystem Interfaces

The IoT ecosystem comprises all the components that allow consumers, governments, and businesses to network between their IoT devices. Some of these include networks, data storage, remotes, security, dashboards, and data analytics. Interfaces like a backend API that devices use to connect to a larger network ecosystem can also be compromised. A significant security concern to network operators and manufacturers is 5G network technology, which is expected to shoulder the connectivity load of IoT devices.

 

IoT devices, when integrated with centralized management platforms and legacy systems, are at high risk of being compromised by users who unknowingly introduce security vulnerabilities at the application layer. When such interfaces are compromised, it is often due to the previously mentioned reasons and improper traffic filtering.

 

Conclusion

Should an IoT vendor build its device or devices with insecure software libraries or other elements that are from an insecure source, then the device(s) will logically be insecure. Other means include using third-party software and hardware from a compromised supply chain or the insecure customization of Operating System (OS) platforms.

 

Manufacturers must comprehend that as more IoT ecosystems are being built, it is equally imperative to build security in, right from the very start. From sourcing components to firmware writing, initial installs, and throughout a device’s lifecycle. Thus, as more and more IoT connected devices come online, these and other yet undiscovered vulnerabilities need to take center stage.

 

Alongside poor management practices, targeted malware, and weak IoT architecture, IoT devices and technology can also be exploited through hard to detect zero-day vulnerabilities. Attackers continue to modify their malicious code to obfuscate better and spread within networks faster. Some of the better practices that should be applied to IoT technology include not over connecting your systems, not trusting a compromised device, particularly if it was compromised locally, and for vendors, frequently subjecting your code and hardware to third-party penetration testing (Black & White Box variants).

Consumer vs Enterprise IoT Attacks

In the future, a significant feature of IoT devices will be the ability to rapidly modify device configurations through remote tools and deliver innovative applications and capabilities. Additionally, all control updates, and packages, will include increased security and encryption to block attacks while driving more automated deployments.

 

The goal remains to enable a user at a local site with little to no background or understanding of IoT and IoT edge devices to connect a power cord, network cable(s), and walk away. Allowing the device to carry out self-provisioning and authentication automatically. Likewise, should a need to move the device occur, it can self-provision itself to its new location’s conditions and obligations.

 

Posted on

Trend Micro: Securing The Pandemic-Disrupted Workplace

cyber security

The coronavirus is notably the singular cause behind many changes that have affected companies and sectors worldwide. And one area in particular that organizations are facing challenges in is cyber security.

Cyber crimes increased substantially amid the pandemic, with cyber criminals taking advantage of the crisis to attack businesses with malware, ransomware, and phishing emails. Due to the threats, business leaders are racing to patch recently uncovered vulnerabilities.

Trend Micro, a multinational cyber security software company, shares with Management Events how businesses can secure their systems in the current precarious landscape.

 

A Snippet of Trend Micro

Trend Micro was founded in 1988 developing antivirus software, but has evolved into a market leader in hybrid cloud security, network defense, endpoint security, and more.

Trusted by 45 of the top 50 global corporations and with over 500,000 businesses using their software, the Trend Micro Smart Protection Network is one of the most advanced threat intelligence networks in the world.

 

PRESSING SECURITY CONCERNS FOR ORGANIZATIONS

 

In the Trend Micro Security Predictions report for 2020, we tried to predict the changes that would shape the cyber security industry as we entered a new decade.

What we could not have anticipated was how the “new normal” — which would arise due to the COVID-19 pandemic — would affect the way we interact with the world.

For many people, working from home became not just an option, but a necessity as the pandemic forced organizations around the world to reconsider how and where they work. Unfortunately, the speed and urgency of the changes caught many businesses unprepared, leading to security gaps in both the home and the physical workplace.

Malicious actors took advantage of the situation by launching a slew of COVID-19-themed attacks using a diverse array of lures across a wide range of platforms, including emails, social media, malicious websites, and fake mobile apps. 

Video conferencing apps became a favorite target for cyber criminals as the need for effective communication led to increased usage. These attacks ranged from pranks such as Zoombombing to full-fledged campaigns involving malware bundled with app installers.

Threat actor groups relentlessly continued their campaigns. Some groups chose to expand their operations to new platforms and operating systems, while others built campaigns around seemingly outdated techniques or made use of malware types often thought to be harmless

Ransomware continued to be highly targeted in nature, with one high-profile group deciding to drop its public operations to concentrate on private campaigns. Some ransomware operators have also threatened to expose the data they stole from their victims to the public.

Microsoft ended its support for Windows 7 early in the year, while at the same time devoted more resources to fixing vulnerabilities. The company patched a record number of bugs in the first half of 2020, which also included a number of significant vulnerabilities such as CurveBall.

Several industrial internet of things (IIoT) vulnerabilities that exist in decades-old third party software components proved that there is a lack of standardization and safe coding guidelines when it comes to IIoT systems. Due to the large number and interconnectedness of the potentially impacted devices, it will be difficult to determine the impact of these bugs for the foreseeable future.

2020 has proven in many ways that the cyber security industry does not exist in a static bubble, but shifts and changes in accordance with and in response to the events of the world around it. In a year that has dramatically impacted most of our lives, we take a look at the most significant stories and trends to determine what has changed and what we can expect from the new normal.

Read the full report to get deeper insights into cyber threats and issues for the first half of 2020.

Posted on

Endpoint Security and the Future of the Cyber Security Landscape

Establishing the Zero-Trust Cybersecurity Framework

In recent years, Cybersecurity has repeatedly been one of the leading anxieties for enterprises worldwide, and in 2020, that trend intensifies. Traditionally, it is easy to shirk the organization’s IT responsibilities and point fingers towards CIOs, CISOs, and the CTO. However, it would be imprudent not to acknowledge that most cybersecurity incidents have arisen due to employee negligence. As such, the culture of taking proactive security measures should be borne by the entire organization.

 

“Today, the only way to be sure your system is good enough from a security point of view is for the whole IT team to design everything with security in mind,” says Grossi. “It’s no longer okay to be only mobile first or cloud first; it’s got to be security first.”

– Piergiorgio Grossi (Former Chief Information (CIO) and Digital Transformation Officer at Italian motorcycle-maker Ducati)

 

A glance at today’s cybersecurity landscape

Cyber attacks alongside Deepfakes continue to increase year over year. According to the ISACA’s Global State of Cyber Security Survey—a survey of more than 2,000 information security professionals from more than 17 industries—looks at the threat landscape, the measures security professionals employ to keep their organizations safe, and key trends and themes in the practice of security.

The cybersecurity landscape presents a positive and negative outlook. On the positive side, at least 50% of fully or appropriately staffed teams are more confident in their abilities to respond to cyber threats. While on the negative side, 62% of survey participants agree that cybercrimes are severely under-reported, and 52% believe that it is very likely their enterprise will experience a cyber attack in the next 12 months. Nevertheless, Information security professionals still believe that real progress is being made against common threats.

The most common threat actors being Cyber Criminals (22%), Hackers (19%), Malicious Insiders (11%), Non-Malicious Insiders (10%), Nation-State Attackers (9%), and Hacktivists (8%). The most frequent attack methods being Social Engineering (15%), Advanced Persistent Threat (10%), Ransomware (9%), and Unpatched systems (9%). Other noteworthy methods are Distributed Denial of Service (DDoS) and Mobile Malware, especially via android.

Fortunately, Google is making more headway with its latest privacy-focused features and increased efforts toward security updates. Android 10 (Pie) introduced granular controls over app permissions, while the upcoming Android 11 (currently available as a developer preview) further conveys their commitment to improvements in security with the implementation of temporary one-time access, allowing an app to use, for example, your phone’s location or camera. Android 11 continues this security-focused expansion and uses biometrics (Face, Iris, and Fingerprint data) to authenticate apps and services. Android 11 will also support digital driver licenses and other identification documents.

The ISACA survey also shows that organizations that take longer to fill in their cybersecurity and related positions report an increase in cyber attacks. Enterprises that took less than 2 weeks experienced 26% more cyber-attacks this year. Those who took around three months experienced 35% more attacks this year. Those who took six months or more experienced 38% more attacks. While those who were or still finding it hard to fill the positions experienced 42% more cyber-attacks this year.

 

Why Endpoint Attacks Occur

There used to be a distinct difference between the inside and outside of an organization, with infrastructures possessing clearly defined roles and boundaries. Organizations would have offices with computers and servers running on-site, creating a physical firewall, and ensuring that data often never leaves the company.

However, with the rise in telecommuting, more employees were asked or forced to work from home where there is no apparent, easily guarded line that can keep all the data in and attackers out of the system.

Worse is that some organizations still have a legacy viewpoint of the boundaries. Combine that with the BYOD trend, and all these lead to an increasingly expanding frontline. Causing security personnel to deal with relatively easy to hack employee-owned devices. This is further compounded by the fact that most employees expect convenience—many opting to use free and popular services to bring their data outside the company and with them. The majority of these services are infamously insecure, as have been pointed out by several hacks lately.

One such cyber attack is the recent discovery of an additional six malicious Android apps (11 similarly malicious apps were discovered in July) that slipped through the Google Play Store’s safety net to plant malware on Android devices. Another phishing attack targeted government and security organizations, using a legitimate Box page with Microsoft 365 branding to trick the victims.

The attackers were careful to appear quite convincing. Botnets facilitated spam and malicious emails with sender names and domains from a legitimate third-party vendor, asking readers to view a sensitive financial document. Viewers who clicked the link were led through a series of pages till they landed on a phishing page, built to resemble the Office 365 login portal, where they were asked to log in with their corporate credentials.

According to the cybersecurity awareness and data analysis firm, CybSafe and data from the UK Information Commissioner’s Office (ICO), 90% of the 2376 cyber breaches reported to the ICO in 2019 were attributed to end-users’ errors. This was a significant increase from the years prior, with 61% in 2017 and 87% in 2018. The cybersecurity company reported phishing accounted for 45% of all reported cases, making them the primary cause in 2019 in the UK.

There is a general lack of public understanding around basic secure behavior, such as spotting fraudulent links and phishing emails, sending the wrong document to the wrong person, leaving a computer unlocked, or plugging in unidentified USB sticks. However, there are two sides to this human error issue.

  1. Passive Attacking: End-users and endpoints have become the primary targets for cyber attacks. This is because their behaviors and powerful devices are relatively easier to exploit, making them attractive targets. Security to most end-users is an untaught concept, and one they typically leave to the “experts.” Yet said experts are rarely the most communicative or most persuasive of tutors and thus, fail to communicate the pitfalls of not being security first effectively. Additionally, BYODs rarely include superior security, such as multifactor authentication (MFA), a system that can prevent the vast majority of data breaches by stopping unauthorized clients from accessing a corporate device. This all leads to the end-user becoming the weakest link, triggering a Supply Chain Attack.
  2. Increased IT Infrastructure Complexity: This second aspect encompasses the increasing complexity and distinctiveness of security tools. From intrusion detection, network monitoring, and encryption to security information and event management tools (SIEMs). Typically, more robust options are welcome; the issue is that all of these disparate tools need to be integrated effectively and correctly aligned to provide adequate and effective security. This also means that security teams have to know each tool, their uses, thresholds, and experience to create appropriate baselines. Unfortunately, teams are not trained well enough in the real world and most likely implement the tools with their default configurations. Doing this allows for an easier rollout but a risky and unsecured move, nonetheless. Such settings were predetermined by the manufacturer and basically put usability before all else.
 

“Though shocking, these statistics shouldn’t provoke a negative reaction. Employees of course pose a certain level of cyber risks to their employers, as seen in our findings thus far. Nevertheless, people also have an important role to play in helping to protect the companies they work for, and human cyber risk can almost always be significantly reduced by encouraging changes in staff cyber awareness, behavior, and culture.”

– Oz Alashe – (CEO and Founder at CybSafe)

 

Undoubtedly, cybersecurity has dramatically changed, and cybersecurity teams’ capabilities are being stretched past their limits. Fundamentally brought on by a ballooning attack surface blended with ill-informed and inappropriate consequential end-user behavior floated by some organizations that refuse to take security seriously.

 

Endpoint cybersecurity threats

Endpoint security is a critical aspect of the cybersecurity landscape, and it’s becoming increasingly important as the nature of work evolves. With more devices connecting to networks than ever before, from laptops and smartphones to IoT devices, the number of potential entry points for endpoint cyber security threats has multiplied. This makes endpoint cyber security a vital component of any comprehensive security strategy.

Endpoint cyber security threats are diverse and constantly evolving. They include malware, ransomware, phishing attacks, and zero-day exploits, among others. These threats can compromise individual devices, and from there, gain access to the broader network, leading to data breaches or system disruptions.

Malware and Ransomware: Malware is a broad term that encompasses various types of malicious software, including viruses, worms, and Trojans. Ransomware, a type of malware, encrypts a victim’s files and demands a ransom to restore access. These threats can infiltrate endpoints through malicious email attachments, infected software downloads, or malicious websites.

Phishing Attacks: Phishing attacks often come in the form of deceptive emails that trick users into revealing sensitive information, such as passwords or credit card numbers. They can also involve convincing users to click on a link or download an attachment that installs malware on their device.

Zero-Day Exploits: These are attacks that take advantage of software vulnerabilities that are unknown to the software vendor. Because these vulnerabilities haven’t been patched, they provide an open door for hackers to infiltrate systems and networks.

Advanced Persistent Threats (APTs): APTs are complex, stealthy threats in which an unauthorized user gains access to a network and remains undetected for a prolonged period. These threats are often state-sponsored and aim to steal information or disrupt operations.

To combat these threats, organizations need to adopt a multi-layered approach to endpoint security. This includes the use of antivirus and anti-malware solutions, firewalls, intrusion prevention systems, and endpoint detection and response (EDR) technologies. Additionally, organizations should regularly patch and update software to fix known vulnerabilities, and educate employees about safe online practices to prevent phishing and other user-targeted attacks.

 

The Future of the Cyber Security Landscape

The evolution of large-scale breaches symbolizes a growing trend of security violations both in numbers and their gravity. Data breaches recurrently expose sensitive information that often leaves users at risk for identity theft, ruin businesses’ reputations, and leave businesses liable for compliance violations. Cyber Observer, holistic cybersecurity management, and awareness solutions predict that damages from cyber crimes are projected to reach $6 trillion annually by 2021.

In other words, as enterprises gradually emerge from the current pandemic, we expect to see a surge in new demands. Reacting to these will require CIOs to formulate strategies based on two structural principles; understanding what customers need in a transforming landscape and leveraging technology to respond to these challenges in ways that acknowledge scope, cost, and scale objectives.

It is virtually impossible to write about the cybersecurity landscape’s future without citing Artificial intelligence (AI) and its role in securing endpoints. AI has existed for quite some time, and its use in our daily lives has become so common that we hardly ever stop to really think about it. From “Weak” AI programs such as “AlphaGo” developed by Goggle DeepMind that combined advanced search tree with deep neural networks, to Strong AI and machine learning systems used in flying Drones, Google Nest, and Tesla’s Autopilot. CIOs will carry on utilizing AI in various fields within cybersecurity. If anything, but to combat the numbers of attackers misusing AI and machine learning.

Looking to the future, the potential for new threat classes remains; ubiquitous and non-discriminatory in nature and to which there are currently no known catch-all countermeasures. Intrinsically, meticulous observations on malware features, abnormal acts, attackers’ attributes, and machine learning-based AI algorithms empower the defenders to deal with cyber threats, and in some cases, actually, go on offense. Regrettably, such observations also provide the attackers’ chances to invent novel attack techniques. Particularly as the risk of inputting false data and many other unsolved errors are relatively high in AI, defenders must always stay alert.

 

10 Simple Steps to Protect Your Business

Today, homeowners go beyond the typical door locks and automatic lights to a fully integrated security system that can prevent attacks and detect and respond to an intrusion and even accidents like a fire. Similarly, a business should deploy a multilayered cybersecurity strategy, one that includes.

Prevention: Firewalls, Anti-virus, Anti-malware, Password Management, Cybersecurity Awareness Training

Detection: SIEM, IDS, Threat Intelligence, and Log Monitoring

Response: 24/7 SOC Monitoring Response, Automated Threat Remediation, and Forensic Investigation.

These are all great tools, but in reality, not all businesses can afford top of the line and often proprietary security suites. Fortunately, you or businesses do not need to invest endlessly in new security tools to improve and elevate your current Cybersecurity posture and awareness for the reason that 80% of data breaches can be prevented with the following basic actions.

  1. Patching
  2. Regular vulnerability assessments
  3. Institute end-user security awareness
  4. Ensuring third-party vendor compliance
  5. Endpoint Detection and Response (EDR)
  6. Limiting access to your most valuable data
  7. Securing mobile devices and BYOD devices
  8. Proper device and or software configurations
  9. Conduct employee security awareness training
  10. Develop cyber breach prevention, detection, and response plan
 

Final Thoughts

Improving endpoint cyber security needs to be a top priority in 2020 and the foreseeable future. The border-less and seemingly non-discriminatory nature of cyber-attacks means it is of imperative importance that the cybersecurity industry shares their insights and work together to protect themselves and the wider population.

In today’s connected world, a breach of one organization can compromise an entire supply chain. Spelling disaster for businesses, eroding public trust and opinions, whilst leaving them in financial collapse, particularly with the General Data Protection Regulation (GDPR) in the EU. It is up to the legitimate security community to learn from each other, sharing what works and what does not. Most importantly, we all need to identify where to improve and ensure we leave no one behind.

Posted on

Aki Levänen: Is A SIEM Necessary?

From time to time, you hear comments in security discussions that “Security Information & Event Management (SIEM) is dead” or that it does not provide sufficient benefit in terms of input to detect and handle security incidents. The advocate may have his own agenda behind his opening: replacing SIEM with another product or experience in his own operating environment where there has been no need for SIEM or has been perceived as useless.

 

However, without taking an immediate opinion on the necessity or unnecessariness of SIEM, the matter can be considered from a few angles. After reflection, based on these thoughts, the reader can think for themselves whether SIEM is necessary and what it might offer me. What does SIEM actually offer and for what purpose? Where is SIEM good and for what purpose and need may better tools be offered? Whose need is being talked about in any context: the organization itself, the Security Operation Center (SOC), or someone else?

 

Investing in collecting logs

 

This blog post focuses more on observation, for example, the National Institute of Standards and Technology, the NIST cybersecurity framework Detect section, and what SIEM as a tool in that context can provide. It is true that from the point of view of collecting logs for the SIEM implementation, you have to invest in it and the workload can be big. The starting point for planning is to know the requirements for the operation and to think about the log policy, which creates the basis for technical supervision. Based on this, one can make an architecture as well as think about what is collected, from where and how. After all, it is not necessary to gather everything in one place, but you can even utilize the analytics in the cloud and pass the events to the person handling them, e.g. SOC, instead of building them yourself in SIEM. In reality, some sort of SIEM or data lake in the cloud is in the background.

 

User accounts and workstations are most often invaded in organizations

 

The most common way is to email the user with an attachment or link to access the workstation or email account, often O365. From the point of view of implementing the observation, I would take advantage of the security features of Microsoft’s O365 e-mail service, for example, instead of collecting data in my own SIEM and building alerts. At the workstations, this is partly the same, but can we investigate what has happened in more detail if necessary? Many security systems do not provide sufficiently detailed information about events and these could be supplemented, for example, by using the Windows system monitor (Sysmon) to collect more detailed information. This data can and should be collected in SIEM to support the analysis. Of course, newer Endpoint Detection and Response (EDR) tools collect information and logs from the vendor’s cloud services that can be alerted.

 

For whom is snapshot information most useful?

 

The word snapshot comes across in every security conversation with organizations. What it is and what it contains varies almost every time. It is often discussed that one should have access to SIEM and get different views and snapshots of technical events. Now, the essential question is, to whom is this level of information relevant? For SOC, yes, definitely support analysis and for the organization’s technical staff to understand events and even provide information for proactive action. The security manager can look at the situation, but often the discussion is in the direction of management, for which SIEM does not provide direct support. At the management level, that information is already much less useful, as the discussion often revolves around risks and events. Yes, these can be formed on the basis of SIEM data by analyzing and making security deviations and describing what should be able to be developed from the point of view of detection capability. This view is more understandable to management and can be discussed, remembering that observation is only one aspect of the whole.

 

Security event management is a necessary extension to observation and a requirement in all frameworks

 

SIEM elevates the events that are collected in the event management system. These are analyzed and security breaches are created, often in a separate ticketing system. These are used to communicate with the various parties involved and to record the measures taken, in which case the activities must also be documented at the same time. The ticketing system usually has built-in integration between actors or portal views. Naturally, various means of communication between the people handling the event are used as support. SIEM does not offer such, although some kind of event flow has been modeled for them as well.

 

The latest in this entity is the SOAR (Security Orchestration, Analysis and Response) system. SOAR acts as a collection system, collecting alerts, ticketing, portals, and also automating SOC operations through use cases. SIEM is not directly replaced by SOAR, but analysis and data collection must take place somewhere in the background of SOAR. Automation sounds appealing to many, but already requires moderately good maturity in handling and responding to security incidents.

 

Log collection and monitoring requirements are included in every information security framework

 

From a compliance point of view, the EU-GDPR has been the most recently highlighted, where the processing of personal data must be traceable from a control point of view. Log collection and monitoring requirements are included in every information security framework. In this way, these control requirements must be able to be solved in IT environments and also in production environments (OT / ICS). Especially in multi-vendor environments, IT vendors do take care of management compliance, but does it meet all the requirements for the organization itself? Most likely, these do not monitor the use of the organization’s own services or do not react to anomalies in the use of the service, but a separate security service, the SOC service, must be purchased. In this context, it may be quite justified to build SIEM itself and to establish controls for both management and operation of all relevant information systems.

 

SIEM is not dead

 

In practice, control solutions as current implementations are a kind of Hybrid implementations instead of a fully centralized SIEM. SIEM is not dead, and it is a very key component in information security control. How control solutions start to evolve is largely dependent on the current state of the organization, operational requirements and development investments. As with navigation, you must first know where it is so that you can move on to the next tick or, in organizational terms, to develop information security. Systems are needed to support analysis to produce information. Based on this information, it is possible to react automatically or by people according to pre-agreed or applied measures and to ensure the continuity of the organization’s activities in information security events.