Tag: cyber security

“Unlocking Leadership Excellence: One Cybersecurity Executive’s Guide to Essential Reads for Aspiring Team Leaders”

“In the pursuit of leadership excellence, the wisdom gleaned from the works of esteemed authors can serve as a guiding beacon, empowering aspiring team leaders to navigate the complexities of the cybersecurity landscape with confidence, agility, and foresight.” – Kevin Lynn McLaughlin, PhD

As a cybersecurity executive, I’m frequently asked what books aspiring team leaders should read to enhance their leadership skills and elevate their teams. In response to these inquiries, I’ve decided to share my thoughts on the most insightful and transformative works in the realm of leadership and management through this blog post. These literary gems, penned by renowned authors such as Blanchard, Covey, Greene, Senn Delaney, Maxwell, Rath, Collins, and others, offer invaluable wisdom that can be applied to hone our leadership abilities and foster high-performing teams in the ever-evolving cybersecurity landscape.

In a time where fast-paced technological advancements and growing competition constantly push organizations to adapt, the pursuit of maintaining high-performing teams has become a crucial mission for leaders at all levels. The wealth of leadership and management wisdom accumulated over the years, such as the works by Blanchard, Covey, Delaney, Greene, Maxwell, Rath, Collins, and others, offers valuable insights that can be utilized to improve our leadership abilities. As cybersecurity executives and experts, it’s essential for us to explore the ideas and principles presented in these books, incorporate the core aspects of leadership, and translate this knowledge into practical strategies that will nurture, empower, and transform our team members into a unified, high-performing group that excels in their mission.


The foundation of effective leadership, as explained in the One Minute Manager series, lies in striking the right balance between clear communication, motivation, and empowerment. Throughout the different iterations of Blanchard’s work, he emphasizes the need for setting expectations, offering timely feedback, fostering autonomy, and acknowledging the impact of praise. Consequently, leaders must be adept at articulating goals and expectations while also cultivating a culture that inspires team members to assume responsibility for their tasks and outcomes. Along with the One Minute Manager Meets the Monkey, another of Blanchard’s books that teaches how to efficiently concentrate on managing your own responsibilities without adopting everyone else’s, these works offer helpful guidance on shaping the ideal culture and behaviors within your team.Covey’s influential book, “The 7 Habits of Highly Effective People”, encourages leaders to develop self-awareness, embrace proactive actions, and search for win-win solutions that benefit everyone involved. Building these habits is essential for creating a high-performing team, as it helps leaders demonstrate behaviors that promote teamwork, creativity, and personal development.


Additionally, the ideas presented in Rath’s How Full is Your Bucket emphasize the significance of positive feedback and appreciation, as they play a crucial role in fostering an environment that supports growth and builds commitment. Greene’s influential book, The 48 Laws of Power, offers a more cunning perspective on leadership. While some may argue that the tactics suggested could create a manipulative atmosphere, others believe that using these strategies wisely and ethically can strengthen one’s influence and inspire the team to achieve shared goals.


Blanchard’s High Five, Whale Done, The Secret, and The 4th Secret of the One Minute Manager all praise the values of empowerment, teamwork, trust, and purpose-driven leadership. These works emphasize the need to create an environment where team members feel encouraged to take risks, learn from mistakes, and aim for excellence. By building a culture of psychological safety, leaders can unlock their teams’ hidden potential and lead them to remarkable success.


The Arbinger Institute’s Leadership and Self-Deception offers a fresh perspective on leadership by revealing the harmful effects of self-deception and the importance of adopting an outward mindset. Combining this approach with the principles found in Maxwell’s 21 Irrefutable Laws of Leadership, Collins’ Good to Great, Johnson’s Who Moved my Cheese, and Farber’s Radical Leap enables leaders to go beyond traditional leadership methods and adopt a transformative approach that fosters growth, adaptability, and resilience.


The insights gained from these literary works provide cybersecurity executives with a comprehensive framework for nurturing high-performing teams. By embracing clear communication, empowerment, collaboration, trust, and growth, leaders can establish a culture that supports talent development, builds loyalty, and achieves success. As leaders in our field, it’s essential for us to continually invest in both our own growth and that of our team members. By applying and adapting the lessons from these leadership books, we can confidently tackle the challenges of the ever-changing cybersecurity landscape with agility and foresight. Additionally, we should recognize the importance of mentorship, as shown in Cottrell’s Monday Morning Mentoring, and commit to fostering a learning environment and ongoing improvement. As each of you progress on your leadership paths, let’s remain dedicated to excellence and draw inspiration from the insights of these esteemed authors to guide our endeavors in building and sustaining high-performing teams. By embracing these principles, we can successfully safeguard the digital realm, gain the confidence of our stakeholders, and leave a legacy within the cybersecurity profession as we foster the growth of exceptional future leaders. So, act now and incorporate these valuable lessons into your leadership practices, and together, we can shape a more secure and promising future for the cybersecurity profession and, more importantly, the talent that works in our profession.

The summary above is from these leadership books:
• The One Minute Manager Blanchard
• The One Minute Manager Meets the Monkey Blanchard
• The On-Time, On-Target Manager Blanchard
• The 48 laws of power Greene
• High Five Blanchard
• Whale Done Blanchard
• How Full is Your Bucket Rath
• 7 Habits of Highly Effective People Covey
• The 4th Secret of the One Minute Manager Blanchard
• 21 Irrefutable Laws of Leadership Maxwell
• Good to Great – * Boring and Dry but Good Collins
• The Secret Blanchard
• Leadership and Self Deception Arbinger Institute
• Great Leaders Grow: Becoming a Leader for Life Blanchard
• Helping People Win at Work Blanchard
• Who Moved my Cheese Johnson
• Self Leadership and the One Minute Manager Blanchard
• Monday Morning Mentoring Cottrell
• Developing the Leader Within You Maxwell
• Radical Leap Farber
• The Human Operating System, Delaney
• The Why Cafe

https://orcid.org/0009-0009-8367-5292

EDPACS _ 2023 _ Kevin Lynn McLaughlin, PhD  & Erik S. A. Elliott

EDPACS _ 2023 _ Kevin Lynn McLaughlin, PhD  & Erik S. A. Elliott

Unleashing the Power of Mobile Threat Hunting Toolkits: Why They Are Crucial in Today’s Cybersecurity Landscape

“Mobile threat hunting toolkits are a crucial component of modern cybersecurity strategies, providing greater efficiency, accuracy, & agility in detecting and mitigating threats.”- Kevin Lynn McLaughlin, PhD

In today’s highly connected world, the cybersecurity landscape has become increasingly complex and challenging, requiring organizations to implement strong and adaptable cybersecurity measures to protect their digital assets and data. The development of advanced technologies, such as artificial intelligence (AI) and machine learning (ML), along with the rise of quantum computing, has made the job of cyber defenders more difficult and complicated. One important strategy for strengthening an organization’s cybersecurity is to deploy specialized teams focused on threat hunting. These skilled professionals, who have extensive knowledge of cybersecurity, work diligently to examine the organization’s infrastructure every day, determining whether any adversaries have breached their systems.(Hermawan, et al, 2021)

The strategic execution of threat hunting responsibilities is facilitated by the utilization of sophisticated threat hunting toolkits, designed to meticulously unearth the presence of bad actors lurking within the organization’s environment. These toolkits empower threat hunting teams to detect abnormal activities early in the cyber kill chain, enabling them to take swift and decisive action to neutralize the impending threat before it can cause harm to the organization. An assortment of diverse threat hunting toolkits is available to assist these teams in their pursuit of cyber adversaries. Each toolkit boasts unique features and capabilities, tailored to identify, and mitigate a variety of cyber threats, and fortify the organization’s defenses against the ever-looming specter of cyber-attacks. These toolkits serve as essential instruments in the hands of adept threat hunters, who wield them with dexterity and finesse to safeguard the organization’s digital landscape, and in so doing, contribute significantly to the preservation of the organization’s integrity and security in this rapidly evolving digital age. (Warner & Johnson, 2016)

Companies such as Gartner, a leading research and advisory firm, recognize the importance of threat hunting toolkits in today’s cybersecurity landscape. According to Gartner, threat hunting toolkits are essential for organizations seeking to proactively detect and respond to potential security threats. Research indicates that the best threat hunting toolkits offer a comprehensive suite of tools for threat detection, investigation, and response and can integrate with a variety of security technologies and data sources. As cybersecurity threats become increasingly complex and sophisticated, organizations must rely on advanced tools and technologies to detect and respond to potential breaches. One of the most promising developments in this field is the use of machine learning algorithms and other forms of automation in threat hunting. By automating the process of threat detection and analysis, organizations can improve the efficiency and accuracy of their cybersecurity efforts. This is particularly important in today’s fast-paced threat landscape, where malicious actors can strike quickly and with devastating consequences. Automation in threat hunting also allows security teams to focus their attention on the most critical threats, minimizing the risk of human error and ensuring that potential breaches are addressed in a timely manner. By using advanced analytics and risk assessment techniques, threat hunting toolkits can provide security teams with a clear understanding of the severity of a given threat and its potential impact on the organization. The importance of automation in threat hunting cannot be overstated. In today’s rapidly evolving threat landscape, cybersecurity teams need to stay ahead of malicious actors to protect their organizations from security breaches. To achieve this, organizations must harness the power of machine learning algorithms and other advanced technologies to proactively detect and mitigate potential threats. (Aldauiji, F., et al, 2021) Leveraging these technologies alone may not be enough. To truly stay ahead of the curve, organizations should also consider integrating cybersecurity SOAR (Security Orchestration, Automation and Response) technologies into their threat hunting and incident response efforts. By integrating SOAR technologies with threat hunting toolkits, organizations can automate the threat hunting process. This reduces response times and minimizes the risk of human error, enabling cybersecurity teams to quickly and effectively respond to security incidents. Cybersecurity SOAR technologies can help organizations establish a standardized incident response framework, allowing for greater consistency and efficiency in incident response efforts. This is particularly important for organizations managing many cybersecurity incidents or having limited resources to dedicate to incident response. While leveraging machine learning algorithms and other advanced technologies is crucial for proactive threat detection, organizations should also consider the benefits of integrating cybersecurity SOAR technologies into their threat hunting toolkit strategies. By doing so, they can streamline their processes, reduce response times, and ensure the ongoing detection of bad actors in their infrastructure.

In the realm of organizational cybersecurity, a particularly intriguing and advantageous option presents itself in the form of the Portable Analysis and Network Threat Hunting and Evaluation Resource, more commonly referred to as the PANTHER. The PANTHER embodies a portable toolkit for threat hunting teams, honing its focus on three pivotal areas that serve as the crux of a threat hunter’s value to an organization’s security posture—areas which have, until now, frequently been the source of stumbling blocks within the security landscape. PANTHER offers a swiftly deployable package, reminiscent of a fly-away kit, that boasts versatility in deployment across a multitude of scenarios. These scenarios encompass not only incident response, but also heightened visibility and security in network segments that are non-compliant due to disparities in technology, an absence of controls, or even during the often-complex Merger and Acquisition (M&A (Mergers & Acquisitions)) process. Additionally, these toolkits can be uniquely tailored to suit non-traditional enterprise systems, such as Operational Technology (OT), Industrial Control Systems (ICS), or other non-IP based communication systems. In the past, enterprise responses have frequently been mired in bureaucratic red tape, processes, and approvals. However, the rapid deployment capability of these kits, which operate outside of the standard “gold image” tools, allows for a significantly reduced response time and a broader range of response locations, unhindered by pre-existing IT (Information Technology) infrastructure constraints. Moreover, the ever-evolving landscape of Advanced Persistent Threats (APTs) and other highly sophisticated actors, who are relentlessly leveraging their resources, skills, and artificial intelligence to bypass security measures, poses an ongoing challenge. During the reconnaissance phase, an organization’s profile, as delineated by its security tools and programs, becomes exposed and subsequently targeted for evasion. The PANTHER toolkit counters this by being deliberately constructed with an alternative compilation of tools, designed to facilitate advanced visualizations, in-depth analysis, and adaptability in data representation. This allows for the detection of even the most intricate behavioral patterns. Mainly employing a passive implementation model, these toolkits are deployed with existing Incident Response (IR) processes or enterprise solutions to undertake actions as required. This approach affords threat hunters the dual advantage of remaining undetected during on-network reconnaissance, while simultaneously gaining a profound internal perspective of the network in question. Although it is unrealistic for any organization to supply every conceivable log and data point a threat hunter might desire, the PANTHER toolkit’s deployment model enables it to be situated in highly sensitive “crown jewel” locations, subsequently amassing a wealth of logs. This, in turn, facilitates a good economic solution that provides high-fidelity protection of an organization’s most precious assets, further cementing the toolkit’s invaluable contribution to the security posture. (Bohme & Schwartz,2016)

There are a lot of great vendor partners that play in the threat hunting space. Gartner’s “Market Guide for Threat Hunting” (Gartner, 2020) provides a detailed overview of the threat hunting toolkit landscape, highlighting key vendors and their respective capabilities. Some, just a small amount from the list, of the vendors mentioned in the report include Elastic, Exabeam, FireEye, Crowdstrike and Splunk. Overall, Gartner’s position on threat hunting toolkits aligns with the view that these tools are crucial for organizations seeking to stay ahead of the evolving threat landscape. By leveraging the capabilities of threat hunting toolkits, security teams can gain greater visibility into potential threats and proactively respond to them, mitigating the impact of security breaches and reducing the risk of data loss. (V. S. Sree, et al 2021)

As the digital world continues to grow and presents new challenges, organizations must adapt and strengthen their cybersecurity measures to protect their assets and data. The integration of advanced technologies like AI, ML, and quantum computing has made cyber defense more complex, and specialized threat hunting teams have become vital to maintaining cybersecurity. (Bhardwaj & Goundar,2019) These teams rely on sophisticated threat hunting toolkits to identify and neutralize threats early in the cyber kill chain. A variety of toolkits are available to suit diverse needs and capabilities, allowing organizations to better defend against cyber-attacks. Automation and machine learning algorithms are critical developments in this field, improving the efficiency and accuracy of cybersecurity efforts. Industry leaders like Gartner emphasize the importance of threat hunting toolkits and the benefits of integrating cybersecurity SOAR technologies into threat hunting strategies. This integration allows organizations to automate their processes, reduce response times, and continuously detect threats within their infrastructure. Options such as PANTHER, a portable threat hunting toolkit, can provide valuable resources for threat hunting teams. Gartner’s “Market Guide for Threat Hunting” highlights key vendors in the space, such as Elastic, Exabeam, FireEye, Crowdstrike, and Splunk, demonstrating the critical role of these toolkits in staying ahead of the evolving threat landscape. Organizations must adopt a proactive approach by leveraging advanced tools, technologies, and strategies to protect their digital landscape and ensure ongoing cybersecurity in this rapidly changing digital age.

References

Bhardwaj, A., & Goundar, S. (2019). A framework for effective threat hunting. Network Security, 2019(6), 15-19.

Böhme, R., & Schwartz, G. (2016). Modeling Cybersecurity Investment in Attack and Defense. In 2016 15th IEEE International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom) (pp. 372-379). IEEE. https://doi.org/10.1109/TrustCom.2016.0083

Hermawan, D., Novianto, N. G., & Octavianto, D. (2021). Development of Open Source-based Threat Hunting Platform. Paper presented at the 2nd International Conference on Artificial Intelligence and Data Sciences (AiDAS), downloaded on April 19, 2023.

Gartner. (2020). Market Guide for Threat Hunting Toolkits. Gartner, Inc. Retrieved from https://www.gartner.com/en/documents/3993665/market-guide-for-threat-hunting-toolkits

N Aldauiji, F., Batarfi, O., & Bayousef, M. (2021). Utilizing Cyber Threat Hunting Techniques to Find Ransomware Attacks: A Survey of the State of the Art. IEEE Access. doi: 10.1109/ACCESS.2021.3064371

V. S. Sree, C. S. Koganti, S. K. Kalyana and P. Anudeep, “Artificial Intelligence Based Predictive Threat Hunting In The Field of Cyber Security,” 2021 2nd Global Conference for Advancement in Technology (GCAT), Bangalore, India, 2021, pp. 1-6, doi: 10.1109/GCAT52182.2021.9587507.

Warner, J., & Johnson, R. (2016). Leveraging Threat Hunting Techniques for Improved Cybersecurity. In 2016 IEEE 2nd International Conference on Cyber Security and Cloud Computing (CSCloud) (pp. 164-169). IEEE. https://doi.org/10.1109/CSCloud.2016.32

https://orcid.org/0009-0009-8367-5292

Sometimes you need a who, A what, no – a who, oh ok 

It always surprises me when I meet a novice or someone who is new to a field or new to a role and they are embarrassed to ask for help. Even worse is when they are afraid that receiving feedback and being less than perfect is a sign of failure or ineptness. I always just want to say, hey let’s go grab a coffee and talk. And in that talk, I would explain to them that when you are new at something it is unrealistic to expect to know how to do the work, the task, etc. without help or in a perfect way and to think otherwise is putting so much pressure on themselves that I can’t understand how they cope.  

When you are first starting an endeavor, you often need a who. No, not a what – a who. As John Strelecky wrote in his book “The Why Café” we often need a Who, a person who already has the skills and knowledge in an area to help us, if we want to become competent in a new endeavor. But here’s the thing, the same person who will get scuba lessons, take pilot lessons, go to a music teacher, etc. Is the same one that will take a new role in their work career and decide that they need to figure it out on their own because if they don’t folks will think they are not capable or that they are a failure.  

So here is my advice. As a novice or someone who is new to a field or a role, it is perfectly normal to not know everything and need help. In fact, it is crucial to seek guidance and feedback, especially at the beginning of a new endeavor. Don’t be afraid to ask for help and seek out a “who” – someone who already has the skills and knowledge in the area that you want to become competent in. It is important to recognize that expecting perfection without guidance is unrealistic and can put an enormous amount of pressure on yourself. You may find yourself struggling to cope with the expectations that you have set for yourself. Just like how you wouldn’t try scuba diving without lessons or attempt to fly a plane without first taking pilot lessons, you should not expect to know everything and be able to succeed in a new role or field without seeking help. It is okay to ask questions and learn from others who have more experience. Remember, asking for help is not a sign of failure or ineptness. In fact, seeking feedback and guidance from those with more experience can help you learn and improve much faster than if you were to go at it alone. Don’t let the fear of appearing incompetent prevent you from seeking the help you need to succeed.  

So, go ahead and ask for that coffee meeting with a more experienced colleague or mentor. You might be surprised at how much you can learn and grow from the experience. #seekcoaching, #becoachable 

Pollyanna Leadership?

“Positive leadership isn’t just about being optimistic, it’s about acknowledging challenges while emphasizing resilience and a can-do attitude. It empowers individuals and inspires teams to take risks, embrace change, learn from mistakes and work together to overcome obstacles. Unlike authoritarian leadership, positive leadership creates a more fulfilling and satisfying work environment while driving success.”- Dr. Kevin Lynn McLaughlin, PhD

Let’s talk about positive leadership and how it doesn’t mean that leaders ignore mistakes and not hold team members responsible. Positive leadership, which creates a supportive and constructive work environment where team members feel valued and respected, is better in the long-term for team morale and retention than authoritarian or command and control leadership. This is because positive leadership fosters trust and transparency, which leads to improved communication and collaboration, increased job satisfaction, and a lower likelihood of turnover.  Authoritarian leadership focuses on control and punishment, which can lead to a negative and demotivating work environment. 

Positive leadership is a critical component of building a strong and successful team, but it is important to understand what it is and what it is not. Positive leadership does not mean that you never hold team members accountable or that you are always behaving in a Pollyanna manner. On the contrary, positive leadership means creating a supportive and constructive work environment where team members are encouraged to learn, grow, and succeed. This includes holding team members accountable, when necessary, but doing so in a way that is respectful, supportive, and focused on growth and improvement. Cybersecurity leadership is about creating a culture of trust and transparency, where everyone feels valued and respected. When your cybersecurity team members trust their leaders and feel valued, they are more likely to be open and honest about their challenges and mistakes, which creates opportunities for growth and improvement. This does not mean ignoring coaching for improvement and learning opportunities nor does it mean you allow them to cover up mistakes. On the contrary, positive leaders must address concerns and mistakes, learn from them, and drive on to be better. This requires leaders to be honest, transparent, and constructive in their approach. Positive leadership is about creating a supportive and constructive work environment that fosters trust, transparency, and growth.Positive leadership is not about ignoring accountability or behaving in a Pollyanna manner, but rather it is about approaching challenges and mistakes with a positive and constructive mindset.  One extremely important concept in all of this is to follow the tenet of praising in public and coaching/mentoring in private.  Public shame and embarrassment seldom lead to high team morale and high team retention rates.

Retaining Cybersecurity Talent

.    

Kevin M’s Tips For Retaining Top Cybersecurity Talent

As the cybersecurity threat landscape continues to evolve, it’s important to have a talented and skilled team in place to protect your organization’s assets and data. However, finding and retaining cybersecurity talent can be a challenge.

The following best practices can help ensure your top performers stay with your organization for the long term:

  • Provide competitive compensation and benefits packages

This includes not only salaries and bonuses, but also benefits like healthcare, retirement plans and paid time off. 

  • Create a supportive and inclusive work environment. 

This can be done by ensuring your team members feel valued and respected. They should be able to see a clear path for professional growth and advancement within the organization. This can be achieved through regular performance evaluation, opportunities for skills development and recognition for a job well done.

  • Offer flexible work arrangements 

This includes hybrid, remote work, and onsite options as well as flexible schedules to meet the needs of your team – which is especially important post-covid.

  • Develop a strong company culture 

This can be done by encouraging open communication, promoting teamwork and collaboration, and fostering a sense of community amongst your team members. This not only helps to create a positive work environment, but it also helps to build strong relationships and a sense of belonging across the team. 

  • Invest in your team’s professional development 

This can be done through a comprehensive and continuous learning program that offers opportunities for your team members to expand their skills, learn about modern technologies and stay up-to-date with the latest industry trends.  Offering a combination of in-person training sessions, online courses, and hands-on experiences with innovative technologies is a great way to implement this program. Providing your team with the resources and support they need to grow and develop professionally can increase job satisfaction and help foster a sense of pride and ownership within your organization. 

Threat actors are working diligently every day to find new ways to compromise sensitive data and assets. Therefore, it is essential to have a strong cybersecurity team in place to protect your organization. Prioritizing the above best-practices is a great way to keep your team members engaged and motivated, which will increase the likelihood of retaining your top cybersecurity talent for the long-term.    

Thank you to my friend and colleague Ibn Akbar at Nice Touch Editing Services for helping me with the edits for this entry.

Small and Medium Size Organizations at Risk

The bad guys are now starting to target mid-tier companies with their hacking activities.  In many cases these companies have not yet come to realize that having a Certified Chief Information Security Officer (C|CISO) or a Virtual Cerified|CISO (vC|CISO) is something that needs to be accepted as a part of doing business.  The recent Presidential report on how Cyber Attacks impact the economy of the U.S.A. makes it clear that the cost of having a security expert on staff or on retainer is well worth it if the smaller company wants to remain in business.  Cyber crime is putting many of these smaller companies out of business simply because they cannot recover from the post breach losses.   At the same time these companies may not have the dollars to pay for a full time C|CISO, so their alternative is to explore the vC|CISO concept.  The vC|CISO model can be leveraged to effectively manage security risk for small to mid-tier companies.

If a company is going to explore the hiring of a vC|CISO they need to make sure to do their due diligence and ask about the certifications (such as the one in the graphic below) and experience of the vC|CISO they are going to have giving them advice.  While there are a lot of good vC|CISO options available there are just as many vendors and security professionals touting themselves as vCISO’s who lack the background or experience to be of much help.  I lack quantifiable data on this point but I would say you should expect to pay between 3 and 400.00 per hour for a vC|CISO, the good news is you can choose what % of their time you want them to work for you (10%, 20%, on retainer, etc.) and then only pay for that portion of time.

Certified CISO

The Office of No, Really?

No  Successful ransomware attacks are at an all time high, we are losing the cyberwar, cyber criminals are making more money than ever before and it is only going to get worse, a cyber attack could be as damaging as a nuclear war – the headlines abound with comments such as this.   Yet, there are still a lot of postings about how information security should not be the office of No.   Really?  Information security is a security function,  as an information security professional are you really going to say – Yes, sure, go ahead and port that un-scanned software code into our production environment?  I would hope you are going to say no you cannot port that un-scanned software code into our production environment.  No is not a bad word, it is one that the job requires us to say.   If you are offended when someone says you are the office of No- don’t be.  To be a security professional no is a good response.  I train my team members to say “yes, but” in order to soften the perceived impression of the word no …..  (here’s a clue – “yes, but”  is still a no – no matter how you spin it).

However,  I have yet to sit in a business meeting and see any of my peers simply say no without being willing to engage in dialogue that would lead to a good and secure solution.   So for those who don’t like to say no then do it this way – yes you can put that server with 2 catastrophic exploitable vulnerabilities into the environment after we help you remediate the vulnerabilities or work on additional adequate controls that will allow us to use the server in a safe and secure manner.    For me, information security professionals can and should say no,  but after doing so we need to be helpful and smart enough to engage in conversations that help the business figure out how to do what they want to do in a way that is cost effective, safe and secure.

In many ways with the types and amount of successful attacks we are experiencing across the U.S. infrastructure being the office of Yes is a far more scary response than saying No to items that put your business at risk.

For Cyber Security the Perimeter Still Exists and Never Went Away

 

One item that really bugs me is to hear IT and Cyber Security professionals espouse that the perimeter is dead and that Cyber Security professionals should stop focusing on tools that protect the non-existing perimeter.   I was at a lunch with a fellow CISO a few months back and he had invited his CIO to lunch with us.   The CIO had recently attended a seminar where they talked about the perimeter no longer existing and he was truly wondering if he could just get rid of his firewalls.  It was a fun conversation but also a bit scary to me that the conversation actually had to take place.  The reality is that while the perimeter has changed we still host most of our systems and data in a data center or in multiple data centers and whether these data centers are on premise or in the cloud they still have a perimeter that needs protected.  Bad actors, both external and internal need to be kept out of areas they have no business being in.  To do that requires a strong perimeter consisting of next-generation firewalls such as the ones Palo Alto  or CISCO provides.  These first line perimeter defense tools should alert into your Security Alert tool (such as QRadar or Splunk) and should also be running Intrusion Prevention and WildFire type of technologies.

The Perimeter exists, heck in most organizations an argument could be made that multiple perimeters exist. Let’s quit saying that there is no Perimeter as the people we are tasked with protecting don’t need to be walking around thinking that they can get rid of their perimeter protection tools.

Why Protect End User Workstations Instead of Servers First?

I have been lucky enough to spend most of my Cyber Security career doing startup operations for large companies.  I thrive on the energy and passion that teams get when they are given the opportunity and support to design and implement security protections for their company.

One of the things that I am often asked is why do I focus some of my first efforts on locking down the end user system before locking down the servers and databases.  This is a great question and one that can spark many hours of debate.  Please don’t send me a lot of comments telling me that Databases and servers are where the information is – of course I know that.

For me, and remember my work has been mostly in very large global enterprises with a mix of blue collar and professional staff, it is a matter of evaluating risk.  In large companies it is often hard to know where all the servers are and who owns them but it is a pretty safe bet that the person running the server is a techie and has been running and protecting these types of systems for a number of years ergo they have much more knowledge of how to protect a system and how not to fall for a bad actors attack than most end users.   I need to consider whether 50,000 or 100,000 attack vectors (i.e. end user systems) , all with email accounts, usually with admin access to their systems and wanting to open attachments and PDFs pose more of a risk than 4-5,000 attack vectors (i.e. servers) that typically don’t surf the web or get email.   My choice in the first 12-18 months is to say that the end user systems pose more overall risk than the servers.  This leads to aggressively putting in controls and protections for those systems first.    Please don’t  take this out of context – of course in parallel I drive initiatives to patch server vulnerabilities, get servers logging into a Security Alerting system, setting up a SOC, etc.  but given choices with limited resources and time I choose to deploy end point encryption, good AV and HIPs, taking away admin rights, software such as Tanium, 2 factor authentication for email, etc. on the end user system first.