Tag: cyber security

Posted on

Shadow IT

Have you heard of Shadow IT? Do you worry about it?

Many organisations have a defined IT policy and processes surrounding it. They may outsource provision to a Third Party, or they may have their own IT department, even if that’s just Billy sitting in the corner, who is totally self taught.

The organisation may have a standard build for all their equipment, and may use only one brand of equipment, which should make managing security risks quite well defined and limited.

However, there may be individuals or whole teams that don’t use the company standard. There might be an MD who really wants to do everything on a tablet device, but the company has a strict “no tablet” policy. There might be a team that installs its own network connection “just in case the company one fails”. And then there’s George in Marketing who prefers to use his Mac to the standard Windows machines.

The MD goes ahead and connects her tablet to the corporate network. The team with their own network connection leave it live and accessible 24×7: there’s no firewall and no way of blocking traffic coming in or going out. George brings in his own Mac and plugs it in to the network. None of these involve the IT or security teams, consequently the risk is unknown and therefore not managed.

These are all examples of Shadow IT – the unknown equipment attached to the corporate network which has little or no security controls in place. Many organisations have a problem with the proliferation of Shadow IT devices.

I think that we’re rapidly approaching – or may already have passed – the moment when we have to stop thinking of it as Shadow IT, and makes sure that our controls can take the plethora of unofficial devices and configurations.

For example, it may be prudent to create a kind of “internal guest network”, for non-standard / uncontrolled devices. This could be easy to connect to but provides an additional layer of control. Using some kind of Mobile Device Management (MDM) solution allows you to provide some services to personal mobile devices, while also giving the ability to remotely wipe the data on them if necessary.

I think we need to be having that conversation in the organisations we work in or encounter. Rather than calling it “rogue” or Shadow IT, call it uncontrolled then work out how to control it.

Posted on

V is for …

VPN

A virtual private network (VPN) is a form of network connection between two points which is encrypted. This helps protect the network traffic from being intercepted by others, and helps to keep the message secure.

It’s a really good idea to use a VPN if you’re away from home eg in cafes or using other public WiFi connections. There are quite a few available, for mobile phones as well as for laptops etc, they’re quite easy to find, and there are free as well as paid for versions on the market.

Virus

A computer virus is a form of malware which can carry different payloads. Just like a virus which infects people, a computer virus is designed to infect devices by a number of different methods. Using antivirus software, and keeping the software updated, as well as regularly applying patches, is a good way of reducing the risk of infection.

Vishing

Vishing is a form of phishing which is done over the phone (voice phishing) rather than by email. It’s often used in conjunction with phishing to add credibility to the email which was sent, and to try to improve the chances of the target being successfully socially engineered.

Vulnerabilities

Almost all software has faults in it, which may take some time to discover. These faults are called vulnerabilities, and they are fixed when patches are issued.

Vulnerability scan

A vulnerability scan is similar to a penetration test, but doesn’t go into as much detail. It’s the equivalent of a burglar trying the doors and windows on a house to see if they’re open – and then not going into the house (which would be a penetration test).

All it does is identify how an application, website or other system is vulnerable, but it doesn’t tell you what you could do if you exploited the vulnerability.

Posted on

Social Engineering and Human Nature

I’m often asked, particularly by new entrants into cyber, what books they should read, and what podcasts they should listen to. The list of both is endless, but I thought I’d share some titles with you. Before we start though, a word about my relationship with books…

I’m a passionate reader, and a compulsive purchaser of books. So I have a lot on my shelves that I’ve not yet read, but loads that I have.  I had cause to sit and ponder today and reckon I’ve over 25m of bookshelves at home, which are mostly full – and a pile of books by my bed, and another on my desk.

For some reason, I group my books by subject matter and height order, and have recently moved away from keeping all by the same author together to having them grouped by colour. (My LPs are stored in alphabetical order, by artist then by album title: this is something I’ve done since I was a teenager!)

The picture with this post shows my “social engineering” shelf, which includes titles on microexpressions (Paul Ekman) and the psychology of persuasion (Robert Cialdini). Interestingly, the author of the Cyber Effect, Mary Aiken, was a producer and consultant for the show CSI: Cyber, and was in fact the inspiration for Patricia Arquette’s character in the programme.  (Beware though, once you start watching, you’ll watch the entire series in one sitting!)

It’s not possible to be a good social engineer, to gain people’s trust and ask them to do things to help you, without understanding human psychology. Ditto if you’re carrying out phishing attacks, you need to know what will make people click on links etc.

Microexpressions give away how someone is really feeling, so it’s really important that social engineers understand and recognise these. If you want to know how they can be used, you might want to watch the show Lie To Me. Paul Ekman was a consultant on the show, and his work is explained particularly well in season 1.   (Another binge watch alert here!)

It’s impossible to talk about social engineering without mentioning Kevin Mitnick. Once one of the FBI’s top 10 Most Wanted fugitives, Mitnick is one of the foremost authorities in the world on social engineering. I have already written a post about his book, Ghost in the Wires.

I’ll share information on some of the other books on my shelf another time. These should be a good starter for you if you’re interested in the meantime!

Posted on

Gatwick Continuity Planning

It was reported on the BBC today that flight departure screens had failed at Gatwick airport for much of the day. The airport authorities implemented their contingency plans – whiteboards – and apparently no flights were delayed or cancelled. Some passengers have complained about a lack of information, but I think that the fact no flights had to be cancelled is a real credit to all involved.

This is a great example of good contingency planning in action. The authorities had obviously thought about what they’d do in advance, so when the screens were unavailable they knew what to do. I can’t imagine they had whiteboards and pens etc just sitting waiting to be used, but it’s a really good effort nonetheless.

What can we learn about this from an Information Security perspective? Business Continuity Planning is vital, but it doesn’t always hinge on having spare technology available. Take it back to basics: what is needed to keep the business running? In this case, electronic boards were replaced with whiteboards and marker pens, but what would be your equivalent?

Try to think about what could happen, and what you could do to react if there was a problem.

Posted on

Q is for …

Quantum computing

You probably know by now that typical computers function by using 1s and 0s, using binary maths. The transistors in them are either off (0) or on (1), with data being held as binary digits (bits).

In quantum computing, quantum mechanics form the basis of the machine. Rather than bits and bytes, quantum computers use quantum digits (qubits). I have to confess that I don’t understand the maths involved, but the two things to bear in mind are these:

  • There are more than just 1s and 0s: qubits can be in multiple states at the same time
  • Viewing the state of a qubit changes it
  • What these mean is that quantum computers have the potential to be incredibly fast, but it’s difficult to make use of their multiple states because looking at their state changes them.
  • Some organisations eg IBM have built small prototype quantum computers, but the technology is in its infancy. It will probably be several years before this sort of processing becomes commercially available.
  • When they are finally built, processing speeds will be massively increased, which also means that existing cryptography techniques will be at risk because even brute force attacks will be able to be carried out so much faster. A new form of quantum cryptography will have to be developed and implemented.
    • Posted on

    US names arrested Fin7 cyber-gang suspects

    This story appeared recently on the BBC website.

    Three members of a notorious hacking group, variously called Fin7, Carbanak and JokerStash, have been arrested and named. The three individuals were arrested in Germany, Poland and Spain: one has already been extradited to the US and extradition proceedings have begun against the other two. The hacking group had attacked targets in the US, UK, France and Australia, and is still active today.

    The remarkable thing about these arrests is that law enforcement had to overcome one of the largest obstacles to law enforcement in the digital age: legal jurisdiction.  Where computers are connected to each other globally, with actions being carried out from different countries, often in different continents, it’s hard to know which laws have been broken, and which law enforcement agency takes priority / precedence.

    In this case, those answers appear to have been solved. There has been a lot of collaboration between the various law enforcement agencies in the US and Europe, resulting in these arrests. It is to be hoped that this level of collaboration becomes the norm, and that countries are able to work together to bring criminals to justice, wherever they are active and irrespective of where their targets are.

    Posted on

    Town dusts off typewriters after cyber-attack

    This story appeared on the BBC website the other day. Basically the town’s borough council was hit with ransomware and their systems were brought to their knees.

    It’s not unusual for one or two devices in an organisation to be infected with Ransomware. Typically those devices are isolated from the network and all other machines checked to ensure that patching and antivirus signatures are up to date. In this case, it would appear that the entire network, including servers, has been infected and devices are having to be built from scratch, with alternative technology (typewriters – some younger readers may need to look these up) being used in the meantime.

    This incident immediately raises a number of questions:

    • How did the organisation allow all machines to get infected?
    • Did they have an incident response plan and did it include this scenario?
    • Were there patching and antivirus regimes appropriate, and was there any kind of reporting in place to identify gaps?
    • Does the organisation have a standard build, and were the build states of all 500 devices known?
    • If the ransomware has been dormant since May, does that mean that backups are also infected? How does the organisation know that restoring from backup won’t reinfect their network?
    • What scanning of incoming attachments was carried out?
    • What training have staff had in respect of phishing emails and incident response procedures?

    From those questions, it is relatively easy to identify what good practice would be e.g. document and test your incident response plans, make sure patching is kept up to date, and train your staff.

    Posted on

    P is for …

    Password

    There has been much written about passwords, but for this entry I thought it worth defining what a password actually is. It’s a code, phrase or sequence of letters and numbers which is used to validate that you are who you say you are. It’s often used in conjunction with a username or when you login to a device or system.

    You’re advised to keep your password secret, known only to you, because this helps with non-repudiation.

    Patching

    Pretty much all software has vulnerabilities in it. The more complex the software, the more likely it is to have vulnerabilities. Patches are pieces of code written by software developers to fix those vulnerabilities once the manufacturers become aware of them.

    Patching is the process of applying these bespoke pieces of code. Typically patches are given a severity based on the risk the vulnerability contains. Urgent patches should be applied as soon as possible, whereas low risk patches don’t need to be applied so quickly.

    When applying patches in a work environment, it is advisable to test the patch on several machines first, before applying it to every device, just in case there are any issues or conflicts which the patch causes with existing software.

    Payload

    Viruses often contain malware, some of which contains special code to try to compromise a device. This is typically called a payload. Different viruses carry different payloads, and some carry multiple different payloads.

    An analogy which might explain this is where you have bomber aircraft, the bombs they carry are referred to as the payload.

    Penetration test

    A common way of testing web sites and web applications is to run a penetration test. This is where ethical hackers i.e. people with prior permission from an organisation, run tests to see if they can find vulnerabilities, and find out what would happen if those vulnerabilities are exploited.

    Typically, the testers will provide a report documenting their findings, and the organisation being tested will then fix any issues found by the testers.

    This should be run on a regular basis, because new vulnerabilities, including zero day threats, are constantly being discovered.

    There are also physical penetration tests, where people are hired to try to access a business. This is called a red team test.

    Phishing

    Phishing is a form of attack where the bad guys send email to a list of email addresses (which they’ve often bought on the dark web). The email typically either has an infected attachment or a link to an infected website, or it contains a message asking you to help someone release money from their bank account or some equally ridiculous plea for help.

    These messages are indiscriminate and are not targeted at specific individuals. Those which are specifically targeted are known as spear phishing or whaling.

    Principle of Least Privilege

    A key feature of cyber security is making sure that users only have access to the programs or data they need access to for their job. This is known as the principle of least privilege.

    For example, there’s generally no reason why someone working in the accounts department needs access to personnel records, or someone working in HR probably doesn’t need access to files for a specific project. Access would normally be restricted to help protect data.

    Posted on

    O is for …

    On-premise

    This term is used to describe equipment which is physically located in your offices. The alternative would be a third party hosted service such as those offered by cloud hosting providers.

    Open Source Intelligence

    The internet is full of many sources of information, many of which are free. This is known as Open Source Intelligence (commonly called OSINT).

    The most well known sources of information are social media sites like Facebook, LinkedIn and Twitter. If users do not lock down their accounts, potential attackers can learn a lot about them just by trawling their details. For example, Facebook allows you to list family members, friends, schools, colleges and work places, all of which are invaluable to attackers.

    Operating System

    All computers need code to tell them how to interact with their components eg keyboards, mice, monitors etc. They also need code which tells them what to do when switched on, how to store files and how the file store is structured. All of these services are provided by the Operating System, or OS for short. The most common operating systems for desktop and laptop computers are Microsoft Windows, Mac OS and Linux. Smartphones and tablet devices also have operating systems, the most common being Apple iOS, Android, Blackberry and Windows Mobile.

    Posted on

    N is for …

    Network

    This is an often used phrase, but what exactly is a network? In its simplest form, it is several computers connected to each other. In a single building, these would typically form a Local Area Network (LAN), or if several offices are connected together these would be called a Wide Area Network (WAN).There are several different network components, such as routers, switches and firewalls. These will be explained in the relevant posts on this site.

    Non-repudiation

    Non-repudiation means that an event or action can be attributed to a person or process and cannot be denied.

    This is a cornerstone of information security, but doesn’t attract the same attention as the CIA triad for example. Without it, it would be impossible to prove without doubt who was responsible for something.

    One of the reasons you typically have a unique username and password at work is so that audit logs can show what actions were carried out using your account. If you share your password with others, then it is difficult to prove that you were the only one using your account. This can have negative as well as positive connotations, but we’ll look at them when we talk about passwords.