Information Security Policy – Page 3 – Kevin L. McLaughlin, PhD

“Mastering the Interplay: The Role and Culture of a Cyber Physical Security (CPS) Professional in Global Cybersecurity Teams”

“In the intricate world of Cyber-Physical Systems, the role of a CPS professional is marked by a unique blend of courage and intelligence. Navigating through the complexities, they stand resilient against challenges, armed with intellectual prowess, and fortified by a collaborative and learning-driven culture. As we venture further into this dynamic field, it is the courage to protect and our collective intelligence that fuels our success.” – Dr. Kevin Lynn McLaughlin, PhD

Abstract
Cyber-Physical Systems (CPS) are complex systems that are the foundation of technological applications such as autonomous vehicles, smart grids, medical monitoring systems, and industrial automation. Dedicated CPS teams are tasked with safeguarding the computing and networking components as well as the physical components under their purview. The task of securing a CPS is far from straightforward, presenting a unique set of challenges that demand astute attention. This article explores the role of the CPS professional. The importance of continuous learning and training is increasingly apparent, and it is important to invest in educational courses to fortify your expertise and navigate the ever-evolving landscape of Cyber-Physical Systems.

As the digital age unfolds, the confluence of the physical and cyber realms is becoming increasingly pronounced, giving rise to complex systems known as Cyber-Physical Systems (CPS). These intricate amalgamations of computation, networking, and physical processes underpin a myriad of today’s technological applications, ranging from autonomous vehicles and smart grids to medical monitoring systems and industrial automation. While CPS have unlocked new horizons in technological innovation, they also bring to light a new set of challenges in terms of cybersecurity. The task of protecting these systems from both digital and physical threats is paramount. This is where dedicated CPS professionals (CPSP), operating as part of a broader global cybersecurity structure, come into play. These specialized teams are tasked with safeguarding the computing and networking components — the ‘cyber’ part — as well as the physical components under their purview, such as Supervisory Control and Data Acquisition (SCADA) systems. With the stakes being high, CPSP’ role involves not just securing data but also averting potential physical harm that could result from a security breach. In this article, we will explore the dynamic world of CPSPs within global cybersecurity frameworks. We will delve into their pivotal role, responsibilities, and the unique challenges they face. Further, we will investigate how these teams function as part of a larger cybersecurity strategy, contributing to the robustness and resilience of modern technological infrastructure. Items such as unified system models and the compositional framework of CPS will be tangentially discussed (Bakirtzis et al., 2021). Whether you are a cybersecurity professional, a stakeholder in the manufacturing industry, or simply a technology enthusiast, this insight into CPS teams will shed light on a critical component of global cybersecurity efforts.

In a global cybersecurity team for a manufacturing company, a CPSP will have a variety of roles and responsibilities, some of which include:

CPS Security Analyst: This professional is responsible for monitoring and analyzing the company’s CPS for any signs of security breaches or vulnerabilities. They also develop and implement measures to secure the company’s CPS.

CPS Security Engineer: This role involves designing and implementing secure CPS. They work with other engineers to ensure that security is considered in all aspects of the CPS design and operation.

CPS Security Architect: These professionals design the overall security architecture of the CPS. They ensure that all components of the system are designed and configured to operate securely together.

ICS/SCADA Security Specialist: Industrial Control Systems (ICS) and Supervisory Control and Data Acquisition (SCADA) systems are specific types of CPS used in manufacturing. Specialists in these systems focus on securing these systems from cyber threats.

CPS Risk Manager: This role involves identifying, assessing, and mitigating risks associated with the company’s CPS. This includes both cybersecurity risks and physical risks to the system.

CPS Security Compliance Officer: This professional ensures that the company’s CPS complies with all relevant security regulations and standards. They may also work on certification processes related to CPS security.

CPS Incident Responder: This professional responds to security incidents affecting the CPS. They work to contain and eliminate threats, and then recover systems to normal operation. They also conduct post-incident analysis to learn from the event and prevent future incidents.

CPS Security Researcher: In larger organizations or those with a more advanced security posture, there may be roles focused on researching new threats to CPS and developing new techniques for defending against these threats.

CPS Security Consultant: This role involves advising the organization on best practices for CPS security. They may also be involved in training other staff in CPS security.

CPS Security Manager/Director: This is a leadership role that involves overseeing the company’s CPS security strategy and managing the CPS security team.

These roles require a combination of skills in cybersecurity, systems engineering, and understanding of the physical processes being controlled by the CPS. It’s also important to understand the manufacturing environment and the specific requirements and challenges it presents for CPS security.

In the realm of technological integration, the concept of CPS emerges as a significant milestone. These systems represent an impressive fusion of computational capabilities, networking prowess, and the governance of physical processes. At their core, CPS employ embedded computers and interconnected networks that diligently oversee and manage physical operations. A noteworthy attribute of these systems is the existence of feedback loops, wherein the physical processes and computations influence one another reciprocally. A myriad of contemporary applications leverages the power of CPS, a testament to their versatility and ubiquity. The spectrum of these applications is broad, ranging from the smart grid systems that stand as the backbone of modern infrastructure, to the autonomous automobile systems that epitomize the forefront of transportation technology. Similarly, the medical sector relies heavily on CPS for patient monitoring, while the industrial realm uses these systems for effective control and management. Robotics and automatic pilot avionics also employ the robust capabilities of CPS, further demonstrating their wide applicability. Given their extensive integration and critical functionalities, the security of these CPS is of paramount importance. This domain, aptly termed Cyber-Physical System Security (CPSS), focuses on safeguarding these systems from both digital and physical threats. This protective realm encompasses not just the computing and networking components, often referred to as the ‘cyber’ part of the CPS, but also extends to the physical components under their control. The task of securing a CPS is far from straightforward, presenting a unique set of challenges that demand astute attention. CPSP professionals need to work closely with the organizations Blue Teams, Red Teams and Threat Intelligence Center (TIC) to be able to effectively do their job. CPSPs need to consider items such as how to leverage virtual and hardware-based testbeds which enable a multitude of choices for threat representation. They need to work with automated scripts that pretend to be hackers or red team members so that they can see how the manufacturing systems respond to and look like when under a cyberattack (Thorpe et al., 2022).

The stakes are high since a successful cyber-attack could lead to more than just data compromise; it could also inflict tangible physical harm. To put this into perspective, an assault on a CPS governing a power grid could precipitate a widespread power outage, causing significant disruption. Equally concerning is a potential attack on a CPS steering a self-driving car, which could result in a collision. Addressing these threats necessitates an integrated approach to CPS security, encapsulating various facets. Paramount among these is secure communication, which entails ensuring the integrity and confidentiality of the data exchanged between different components of the CPS, rendering it immune to interception or unauthorized modification. Linked to this is the aspect of authentication, which revolves around the verification of the identities of devices and users interfacing with the system, thereby forestalling unauthorized access. Of equal importance is data integrity, a fundamental pillar of CPS security. This aspect emphasizes the need for data to be accurate, dependable, and immune to unauthorized tampering. Complementing this is the resilience of the system, its ability to endure attacks or system failures, and either continue functioning correctly or swiftly recover to its operational state. CPS security also demands a focus on the physical security of the system, protecting the physical components from potential tampering, damage, or unauthorized access.

It is also crucial to respect and protect the privacy of individuals, particularly when their data is processed or impacted by the CPS. This privacy protection forms another essential element of a comprehensive security approach. The security of the software or firmware running on the system’s devices cannot be overlooked. These need to be secure, free from vulnerabilities that could potentially be exploited by malicious actors. Considering the intertwined nature of physical and cyber components in a CPS, securing them requires a multidisciplinary approach. This typically involves the amalgamation of computer science, engineering, and systems theory, highlighting the complexity and the broad scope of the field. Given this complexity, the task of ensuring CPS security demands not only technical expertise but also a deep understanding of the interactions between the cyber and physical worlds.

In the context of CPS, creating a team and leadership culture that promotes human-centered values is paramount. Drawing from the ideas presented in influential works such as “How Full Is Your Bucket?” by Tom Rath and Donald O. Clifton, “The Energy Bus” by Jon Gordon, “Servant Leadership” by Robert K. Greenleaf, and “The Radical Leap” by Steve Farber, the core themes of positive reinforcement, energy and enthusiasm, service to others, and cultivating love, audacity, and proof in leadership can be applied to foster an effective and cohesive CPS team (Farber, 2004; Gordon, 2007; Greenleaf, 1977; Rath, 2004). One of the foundational principles of a strong team culture is the concept of positive reinforcement, inspired by “How Full Is Your Bucket?”. It emphasizes the importance of mutual appreciation and recognition within the team. CPS professionals operate in an intricate, multidisciplinary field and the work can often be challenging. Positively recognizing each team member’s contributions can fill their ‘buckets’, increasing positivity, productivity, and overall satisfaction in the workplace. Drawing from “The Energy Bus,” the team culture should also be infused with positivity, enthusiasm, and shared vision. The journey of CPS professionals can be likened to a ride on an energy bus, where everyone shares the drive towards a common destination: effective and secure cyber-physical systems. Leaders can foster an ‘energy bus culture’ by encouraging a positive mindset, promoting enthusiasm for shared goals, and helping team members overcome obstacles with optimism and resilience. The principles of “Servant Leadership” can also be integrated into the team and leadership culture. In this model, leaders prioritize the growth and well-being of their team members, fostering an environment of trust and mutual respect. Servant leaders in the CPS realm are those who listen to their team’s ideas, encourage their professional development, and empower them to take ownership of their roles. This kind of leadership fosters a sense of community and shared responsibility, which is crucial when dealing with the complexities of CPS. Finally, “The Radical Leap” presents a framework that encapsulates Love, Energy, Audacity, and Proof (LEAP). Applied to CPS teams, ‘Love’ is about cultivating a deep passion for the CPS work and genuine care for each other. ‘Energy’ ties back to the principles from “The Energy Bus,” emphasizing positivity and forward momentum. ‘Audacity’ encourages CPS professionals to think boldly and innovatively, which is critical in a field that is at the forefront of technological advancements. And ‘Proof’ refers to demonstrating these values through actions, ensuring that the team’s work effectively meets the security and functionality demands of CPS. A successful team and leadership culture for CPS professionals is one that encourages positive reinforcement, harnesses collective energy, emphasizes servant leadership, and embodies the principles of LEAP. It is a culture that places people at its core, recognizing that the strength of a team lies not just in their technical skills, but also in their shared values, mutual respect, and collective drive towards a common goal.

As we delve deeper into the world of CPS, the importance of continuous learning and training becomes increasingly apparent. Whether you are a seasoned CPSP looking to stay abreast of the latest advancements or a novice aiming to break into the field, investing in educational courses is a critical step. These courses not only equip CPSP’ with the knowledge and skills to tackle real-world challenges but also set them apart in a competitive job market. The rich tapestry of CPS and its security spans a multitude of areas, including secure communication, authentication, data integrity, resilience, physical security, privacy, and secure software or firmware. As such, the choice of training courses should reflect these diverse facets, offering a balanced blend of theoretical knowledge and practical application. Moreover, given the multidisciplinary nature of CPS, a professional in this field benefits immensely from a wide range of courses. These courses may touch upon areas such as computer science, engineering, systems theory, and cybersecurity, all of which are integral to the field of CPS. With these considerations in mind, let us explore some of the training courses that a CPSP should consider taking to fortify their expertise and navigate the ever-evolving landscape of CPS.

Coursera: They offer numerous courses on cybersecurity and some specific ones on IoT security, which can be relevant to CPS. Some universities, like the University of Colorado Boulder, offer specializations like “Hardware Security” which covers security aspects of embedded systems, a core component of CPS (Wade et al., 2015).

edX: edX also has a wide variety of courses on cybersecurity. The University of Maryland, for instance, offers a professional certificate in cybersecurity.

Udemy: There are courses related to Industrial Control System (ICS) and SCADA Security, which are a critical subset of CPS.

ISA Global Cybersecurity Alliance: ISA offers training and certificate programs focused on industrial cybersecurity.

SANS Institute: They offer a range of cybersecurity courses, including ICS and SCADA security training.

CyberSecurity Academy: They offer a variety of courses, including ones that focus on IoT Security.

Professional Certifications: You may also consider professional certifications such as Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM), Certified Ethical Hacker (CEH), and others that can provide a foundation of cybersecurity knowledge that can be applied to CPS.

Remember that the field of CPS security is multidisciplinary and constantly evolving. CPSPs should keep abreast of the latest research and development in this field, and the courses and certifications can help provide the necessary foundational and advanced knowledge.

Effective collaboration between a CPSP and plant manufacturing support and system engineering teams calls for an intricate blend of technical proficiency, clear communication, mutual respect, and a shared vision. An initial step towards achieving this harmony lies in fostering clear and consistent communication. CPSPs often grapple with complex concepts that may seem overwhelming to those outside their field. Therefore, it becomes incumbent on them to distill these intricate ideas into digestible information that resonates with the manufacturing and engineering teams. This is not just about simplifying jargon or technical terms but involves conveying ideas with clarity and precision. CPSPs need to realize that communication is not a one-way street, it is equally important for practitioners to actively listen and comprehend the insights, ideas, and concerns of the manufacturing and engineering teams. This reciprocation of understanding not only facilitates smoother execution of defensive items but also nurtures a culture of mutual respect. Mutual respect forms the bedrock of successful cross-functional collaboration. By acknowledging and valuing the expertise that the manufacturing and system engineering teams bring to the table, CPSPs can foster a relationship of trust and cooperation. This respect must also extend to the work processes and protocols of the other teams, encouraging a cooperative integration of workflows and assistance. Having a shared vision is a potent tool for aligning the efforts of CPSP and manufacturing teams. This involves defining common goals, aligning on expectations, and jointly strategizing paths forward. By actively cultivating a shared understanding of what needs to be achieved, the teams work in unison towards a common goal, navigating challenges together and celebrating shared successes. Another effective technique lies in promoting a problem-solving mindset across all teams. When issues arise, instead of resorting to blame, it is crucial to jointly focus on identifying the root cause and devising solutions. A CPSP can take the lead in fostering this mindset, promoting constructive discussion and mutual learning. CPS teams should try to understand the manufacturing process and system engineering principles in-depth which will enable them to design and implement more effective CPS and foster a deeper connection with the manufacturing and engineering teams. The path to effective collaboration with plant manufacturing support and system engineering teams involves clear and reciprocal communication, near real-time system monitoring, mutual respect, shared vision, a problem-solving mindset, and a deep understanding of manufacturing and engineering principles (Khanna et al., 2023). By incorporating these techniques, a CPS professional can contribute to a collaborative, efficient, and innovative work environment.

The realm of CPS presents a thrilling landscape where the digital and physical realms intertwine. As we have explored throughout this article, CPSPs play a vital role in shaping the future of technology by integrating computation, networking, and physical processes. They navigate the complexities of CPS with a multidisciplinary approach, leveraging their technical expertise, effective communication, and collaboration skills to bridge the gaps between various teams and disciplines. The core of CPS lies not only in technological advancements but also in the people who drive them. The team and leadership culture within the CPS domain must embody values such as clear communication, mutual respect, continuous learning, and a strong focus on security. Drawing inspiration from renowned works like “How Full Is Your Bucket?” and “Servant Leadership,” CPS professionals are empowered to create an environment that fosters positive reinforcement, energy, audacity, and a commitment to service. Working seamlessly with plant manufacturing support and system engineering teams requires a delicate balance of technical proficiency, clear communication, mutual respect, and shared vision. By embracing techniques such as effective communication, fostering mutual respect, promoting a problem-solving mindset, and gaining a deep understanding of the manufacturing process, CPS professionals can establish strong collaborative partnerships that pave the way for successful integration of CPS into manufacturing environments. The journey of a CPSP is one of resilience, innovation, and the audacity to push the boundaries of what is possible. It is a journey fueled by a passion for technological advancement, a commitment to security, and a deep appreciation for the transformative impact CPS can have on society. As we move forward into an era where CPS continues to evolve and shape the world around us, let us embrace the challenges, seize the opportunities, and cultivate a culture that empowers CPS professionals to drive innovation, collaborate across disciplines, and safeguard the future of technology. Working together, we can create a world where the seamless integration of the digital and physical realms enhances our lives, propels industries forward, and paves the way for a brighter and more connected future.

Bakirtzis, G., Fleming, C. H., & Vasilakopoulou, C. (2021). Categorical Semantics of Cyber-Physical Systems Theory. ACM Trans. Cyber-Phys. Syst., 5(3). https://doi.org/10.1145/3461669

Farber, S. (2004). The Radical Leap. Wiley.

Gordon, J. (2007). The Energy Bus. Wiley.

Greenleaf, R. K. (1977). Servant Leadership. Paulist Press.

Khanna, K., Ravikumar, G., & Govindarasu, M. (2023). Defense-in-Depth Framework for Power Transmission System against Cyber-Induced Substation Outages Texas Power and Energy Conference (TPEC), Texas.

Rath, T. (2004). How Full is Your Bucket. Gallup Press.

Thorpe, J., Fasano, R., Galiardi Sahakian, M., Gonzales, A., Hahn, A., Morris, J., Ortiz, T., Reinbolt, H., & Vugrin, E. D. (2022). A Cyber-Physical Experimentation Platform for Resilience Analysis Proceedings of the 2022 ACM Workshop on Secure and Trustworthy Cyber-Physical Systems, https://doi.org/10.1145/3510547.3517916

Wade, J., Cohen, R., Blackburn, M., Hole, E., & Bowen, N. (2015). Systems Engineering of Cyber-Physical Systems Education Program Proceedings of the WESE’15: Workshop on Embedded and Cyber-Physical Systems Education , articleno = 7 , numpages = 8, https://doi.org/10.1145/2832920.2832927

“Harmonizing the Digital Symphony: The Essential Role of Cybersecurity Detection Engineers in Safeguarding Cyber Landscapes”

“Cybersecurity Detection Engineers play a crucial role as frontline experts, identifying threats and facilitating rapid responses. These professionals are a vital part of the blue team, and their expertise in detection capabilities significantly enhances defenses and reduces the noise floor. Their role is simply indispensable,” – Kevin Lynn McLaughlin, PhD.

In the digital age, cybersecurity is not important – it is critical. Among the many roles in cybersecurity teams, there is one that really caught my eye – the Cybersecurity Detection Engineer (CDE). These folks are experts in sniffing out potential threats to networks. They are the ones on the front line, identifying security breaches and making sure cybersecurity teams respond quickly to minimize damage. The value of CDEs cannot be overstated. They are our early warning system, keeping an eye on network traffic, spotting anything unusual, and isolating potential threats. It’s like having your very own digital security guard, keeping watch over your online assets. Deception engineers are not working in a vacuum. They are part of a larger team, working alongside our Cybersecurity SOC – the Security Operations Center. This is where real-time threat management happens, and it’s a high-stakes environment. In the SOC, every bit of information counts, and that is where a CDE really shines. They provide timely, accurate info on potential threats, helping SOC analysts to prioritize and respond more effectively. Deception Engineering is not just about people – automation plays a crucial role in cybersecurity too. That is where SOAR (Security Orchestration, Automation, and Response) solutions come in. These tools are all about streamlining and automating threat response, and CDE are crucial to making them work effectively. They feed in the data that drives these automated responses, helping to lighten the load for our SOC team and freeing them up to tackle more complex threats.

In the dynamic and ever-evolving world of cybersecurity, the role of CDE is of paramount importance. CDEs are the bastions standing at the frontlines of the digital world, tirelessly working to protect our data and infrastructure from potential cyber threats. Their tasks are complex and multifaceted, and as such, they require a diverse set of sophisticated tools to perform their duties effectively. This, therefore, calls for a deep understanding of the tools that are available to them, their functions, their strengths, and their limitations. One of the most indispensable tools in the arsenal of a CDE is the Intrusion Detection System, or IDS. An IDS is akin to a digital watchtower, constantly monitoring the network traffic for any signs of suspicious or malicious activities. It scrutinizes the data packets flowing through the network, looking for patterns or signatures that may indicate a cyberattack. However, an IDS is not a silver bullet and cannot function in a vacuum. It needs to be complemented with other tools for comprehensive security coverage. Alongside an IDS, a Security Information and Event Management system, or SIEM, provides invaluable service. A SIEM system is a data aggregator and analyzer. It collects security logs and events from various sources across the network, amalgamates the data, and processes it to provide insightful information about the security status of the system. By doing so, a SIEM system helps CDEs to recognize patterns that may not be immediately apparent, and to identify any potential security incidents in a timely manner. Firewalls, too, play a critical role in the cybersecurity landscape. They serve as the initial line of defense, acting as gatekeepers to the network by controlling the inbound and outbound traffic based on pre-established security rules. Firewalls are adept at blocking known threats and limiting access to the network, thereby reducing the attack surface that a potential adversary can exploit. Despite the formidable defense provided by IDS, SIEM, and firewalls, the proactive nature of cybersecurity demands more. This is where penetration testing tools step in. Tools like Metasploit and Wireshark are designed to simulate cyberattacks and analyze network communication, respectively. By using these tools, CDEs can take on the role of an attacker and probe their own systems for vulnerabilities. This proactive approach helps in identifying and patching security loopholes before malicious actors can exploit them. In the realm of digital forensics, tools such as FTK, Encase and Autopsy are pivotal. These tools allow CDEs to dig deep into digital data to uncover the tell-tale signs of a cyberattack. They can be used to recover lost data, investigate security incidents, and gather evidence for legal proceedings. In addition to these, CDEs also need to use threat intelligence platforms. These platforms provide real-time information about the latest cyber threats and vulnerabilities. They assist in staying ahead of the curve by providing actionable insights about emerging threats and the tactics, techniques, and procedures (TTPs) that cybercriminals are using. CDEs need to use sophisticated Endpoint Detection and Response (EDR) tools. These tools monitor endpoint and network events and record the information in a central database where further analysis can be carried out. They can detect malicious activities, provide contextual information, and automate response actions to contain the threat quickly. Incorporating network detection response (NDR) into the cybersecurity toolkit takes the defense strategy a step further. NDR tools continuously analyze network traffic, using machine learning and artificial intelligence algorithms to identify patterns and behaviors indicative of a security breach. These tools are particularly useful in detecting advanced threats that may slip past traditional defense mechanisms, offering an additional layer of protection to the digital infrastructure. Furthermore, the inclusion of tools like ORCA and Qualys add a significant boost to the cybersecurity framework. ORCA, a cloud security innovation, enables the CDE to visualize and prioritize cloud security risks. It integrates seamlessly with various cloud platforms and provides a holistic overview of the potential vulnerabilities, thereby helping the engineers to mitigate the risks effectively. Qualys, on the other hand, is a pioneer in the field of vulnerability management. It offers a cloud-based solution for identifying, tracking, and managing vulnerabilities across the network. By using Qualys, CDEs can discover network devices, catalog them, and continuously monitor them for any security gaps. The tool also assists in compliance reporting, making it a multifaceted resource for the cybersecurity team. In combination with the tools discussed CDEs need to leverage machine learning (ML) and modern cyberattack predictive modeling if they want to be successful in defending against modern cyberattacks (Ben Fredj et al., 2021).

However, it is important to remember that these tools are merely instruments. They are only as good as the individuals wielding them. Indeed, the skill, knowledge, and experience of the Cybersecurity Detection Engineer remain the most critical components of any security operation. CDEs are even exploring and deploying blockchain defensive technologies to improve their detection capabilities (Kumar, 2023). The tools, while advanced and powerful, require the discerning eye of an expert to interpret their outputs and make informed decisions.

IDS is leveraged by CDEs as a virtual lookout, constantly scrutinizing network traffic for any abnormalities that may indicate malicious activity. This involves configuring the IDS with the latest threat signatures and monitoring its output continuously for any alerts. It’s like a burglar alarm for the network, sounding the alert when any unwelcome activity is detected.
Supplementing the IDS is the SIEM. The SIEM acts as the central nervous system of the cybersecurity infrastructure, gathering log data from multiple sources and consolidating it into a single, manageable interface. CDEs use this tool to monitor security events in real-time, conduct forensic analysis on security incidents, and create comprehensive reports that aid in compliance with various security standards.
Firewalls, the digital equivalent of a castle’s battlements, act as the first line of defense against external threats. Engineers configure and manage these firewalls, deciding which traffic can pass through and which should be blocked. Effective CDEs update firewall rules regularly to respond to changing threat landscapes and monitor firewall logs to identify any signs of attempted breaches.

Penetration testing tools, such as Metasploit and Wireshark, offer a proactive approach to cyber defense. CDEs use these tools to simulate cyberattacks on their own systems, identifying vulnerabilities before malicious actors can exploit them. It’s akin to a fire drill, preparing for the worst-case scenario to ensure the system can withstand a real attack.
Digital forensic tools like Encase and Autopsy enable engineers to delve into the aftermath of a cyberattack, much like a detective arriving at a crime scene. They use these tools to recover lost data, investigate the cause of security breaches, and gather evidence that could be used in a court of law.
Threat intelligence platforms act as a sort of early warning system, providing real-time information about new threats and vulnerabilities. Engineers use these platforms to stay one step ahead of cybercriminals, understanding the latest tactics and techniques they employ and using this knowledge to bolster their own defenses.
EDR tools are used by engineers to continuously monitor endpoint and network events. They act as a CCTV for the network, recording everything that happens for later analysis. Engineers use these tools to detect any signs of malicious activity, respond to any detected threats, and ensure that the impact of any security incidents is minimized.
NDR tools operate in the background, analyzing network traffic and using machine learning and artificial intelligence to detect any abnormal behavior that could indicate a security breach. Engineers use NDR tools to identify and respond to advanced threats that may bypass traditional security defenses.

ORCA, a cloud security tool, gives engineers a bird’s eye view of their cloud security landscape. They use it to identify and prioritize potential vulnerabilities in their cloud infrastructure, ensuring that all cloud-based resources are adequately protected.
Qualys, a vulnerability management tool, is used by engineers to identify, track, and manage vulnerabilities across the network. They use it to discover network devices, catalog them, and monitor them for any security gaps. It also assists in compliance reporting, making it a useful tool for maintaining adherence to various security standards.
Meta-IDS (Meta-Intrusion Detection System): A proposed meta-model of detection systems in the Cloud environment, which is aimed at consolidating solutions and saving time in design and implementation. Supporting the security community in the Cloud: Meta-IDS provides access to solution approaches, aiding in decision-making for accurate detection and delivering high-level results. Description language for detection system design: Focuses on integrating existing detection system frameworks and promoting cooperation between techniques for effective decision-making in detection processes (Amine et al., 2019).

Each of the aforementioned tools, while distinct in its function and capabilities, forms an essential part of the cyber defense ecosystem. It is through the judicious use of these tools that CDEs can guard our digital world against an ever-evolving array of threats. Successful CDEs also think about attack detection that common tools may miss, such as steganographic transmissions (Koziak et al., 2021) and they adjust their defensive mind-set and posture accordingly.

The path to becoming a proficient CDE is an ongoing journey, an endless pursuit of knowledge and skills refinement. This journey, like the profession itself, is both challenging and exciting, requiring an unyielding commitment to continuous learning and adaptation. One of the primary aspects of their training involves gaining a strong foundational understanding of computer science and information technology. They need to thoroughly understand the intricate workings of computer systems, networks, and software. This includes knowledge of programming languages, database systems, network protocols, and operating systems. This foundational knowledge acts as the bedrock upon which all other cybersecurity-specific knowledge and skills are built. Beyond this foundation, the next layer of training involves an in-depth understanding of cybersecurity principles and concepts. This includes learning about different types of cyber threats, attack vectors, and threat actors. They need to understand how malware works, how network attacks are carried out, and how systems can be exploited. They also need to learn about various security protocols, encryption techniques, and authentication mechanisms. Hands-on experience is a significant part of a CDE’s training. Practical, real-world experience reinforces theoretical learning and helps to develop the skills needed to respond to real cybersecurity incidents. This could involve internships, work placements, or practical projects where they get to apply what they’ve learned in a controlled environment. It also includes using the tools of the trade, as we discussed earlier – IDS, SIEM, firewalls, penetration testing tools, digital forensic tools, threat intelligence platforms, and so on. Becoming adept at using these tools requires hands-on training and practice. Another critical aspect of their training involves staying current with the latest trends and developments in the cybersecurity landscape. Cyber threats are continually evolving, and new vulnerabilities are discovered every day. Therefore, continuous learning and professional development are essential. This could involve attending cybersecurity conferences, webinars, workshops, or training programs. It could also involve reading industry publications, research papers, and cybersecurity blogs. Some engineers may also choose to pursue advanced certifications, like the Certified Information Systems Security Professional (CISSP) or the Certified Ethical Hacker (CEH), which require a commitment to ongoing education.

A CDE needs to cultivate a specific set of soft skills. They need to develop strong problem-solving skills, as they will often be required to think like hackers to anticipate and prevent security breaches. They also need to have excellent attention to detail, as even a small oversight can have significant security implications. Communication skills are also essential, as they will need to explain complex technical issues to non-technical colleagues or stakeholders. The training and learning for a CDE is a multifaceted process. It involves gaining a solid foundation in computer science and IT, learning about cybersecurity principles and threats, gaining hands-on experience, staying current with the latest developments, and cultivating important soft skills. It is a demanding but rewarding journey, requiring a commitment to lifelong learning and continuous improvement. The environment in which CDEs operate is one of high stakes and often of extreme pressure. In such a setting, a supportive and collaborative team culture, coupled with effective and empathetic leadership (Ioannou et al., 2019), plays a pivotal role in ensuring the success of the team and the broader organization. At the heart of a well-functioning team of CDEs lies a culture of open communication. Given the nature of their work, it is crucial for every team member to feel comfortable sharing insights, concerns, and even admitting mistakes without fear of retribution. This openness fosters trust among team members, expedites problem-solving, and ensures that vital information is not held back due to apprehensions. A sense of shared responsibility is another cornerstone of a successful CDE team. Cyber threats do not follow a nine-to-five schedule; they can strike at any time. Hence, a culture where each team member feels equally accountable for the organization’s cybersecurity posture is essential. This shared responsibility ensures that each member is committed to the cause and is willing to put in the necessary effort to keep the digital fort secure. A culture of continuous learning and curiosity is indispensable in this fast-paced field. Cyber threats and the technologies used to combat them evolve at a breakneck pace. A team that encourages continuous learning, provides opportunities for professional development, and values curiosity will be better equipped to stay ahead of this curve. Resilience is another key cultural trait for a team of CDEs. They operate in an environment where the threat of cyberattacks is relentless and can often feel like an uphill battle. A team culture that promotes resilience can help team members navigate these challenges, learn from failures, and bounce back stronger.

On the leadership front, leaders of CDE need to embody a blend of technical expertise and emotional intelligence. Given the technical nature of the work, leaders who understand the intricacies of the field and can make informed decisions are invaluable. However, technical skills alone are not sufficient. Leaders also need to be empathetic and understanding. They need to recognize the stress their team operates under and provide the necessary support. This might mean offering flexible work arrangements, ensuring the team is not overworked, or providing support resources when needed. Effective leaders foster a sense of unity and purpose within the team. They clearly communicate the team’s goals and how each member’s work contributes to these goals. They also recognize and reward effort and success, thereby boosting team morale. Leaders in this field need to be proactive and forward-thinking. They should be able to anticipate future threats, recognize emerging trends in cybersecurity, and guide the team in adapting to these changes. The optimal culture for a Cybersecurity CDE team is one that encourages open communication, shared responsibility, continuous learning, and resilience. The leaders that guide these teams should embody a blend of technical knowledge, emotional intelligence, and forward-thinking. This combination can help such a team navigate the complex and high-pressure landscape of cybersecurity effectively.

In the vast and intricate realm of cybersecurity, the role of the CDE is pivotal. Armed with an array of sophisticated tools and backed by a strong foundational understanding of computer science and cybersecurity principles, these engineers stand on the front lines of the digital battlefield, protecting our invaluable data and infrastructure from relentless cyber threats. However, the tools and technical knowledge, while vital, form only part of the equation. The human element of team culture and leadership style play a significant role in the CDE’s team success. A culture that promotes open communication, shared responsibility, continuous learning, and resilience, coupled with a leadership style that blends technical expertise with emotional intelligence and forward-thinking, is critical in ensuring a highly effective team of CDEs. Training and continuous learning form the bedrock of their professional journey. The cybersecurity landscape is ever evolving, and staying ahead of the curve is a constant challenge. As such, a commitment to lifelong learning, continuous improvement, and skill enhancement is an essential trait of a CDE. The role of a Cybersecurity Detection Engineer is multifaceted and challenging, requiring a blend of technical skills, soft skills, continuous learning, and a supportive work environment. As cyber threats continue to evolve, so must our approach to combating them. The journey is undoubtedly demanding, but with the right tools, training, culture, and leadership, these digital sentinels are well-equipped to safeguard our interconnected world.

Amine, D. M., Youcef, D., & Kadda, M. (2019). IDS-DL: A Description Language for Detection System in Cloud Computing Proceedings of the 12th International Conference on Security of Information and Networks , articleno = 12 , numpages = 8, https://doi.org/10.1145/3357613.3357626

Ben Fredj, O., Mihoub, A., Krichen, M., Cheikhrouhou, O., & Derhab, A. (2021). CyberSecurity Attack Prediction: A Deep Learning Approach 13th International Conference on Security of Information and Networks , articleno = 5 , numpages = 6, https://doi.org/10.1145/3433174.3433614

Ioannou, M., Stavrou, E., & Bada, M. (2019). Cybersecurity Culture in Computer Security Incident Response Teams: Investigating difficulties in communication and coordination

Koziak, T., Wasielewska, K., & Janicki, A. (2021). How to Make an Intrusion Detection SystemAware of Steganographic Transmission European Interdisciplinary Cybersecurity Conference, https://doi.org/10.1145/3487405.3487421

Kumar, K. D. a. J. M. A. a. S. M. a. P. D. B. (2023). Cybersecurity Threats, Detection Methods, and Prevention Strategies in Smart Grid: Review

Offense for Defense: The Art and Science of Cybersecurity Red Teaming

“Embracing the principles of Cybersecurity Red Teaming not only fortifies an organization’s digital defenses but fosters a proactive mindset that is essential for thriving in the ever-evolving cyber threat landscape. It is through this strategic fusion of innovation, collaboration, and offense-for-defense tactics that we can truly safeguard our critical assets and ensure a more secure digital future.” – Dr. Kevin Lynn McLaughlin, PhD

Abstract:

The article delves into the methodologies, tools, techniques, and strategies employed in Red Teaming, as well as the planning practices that underpin successful engagements. The success of Red Teaming engagements depends on the expertise of the Red Teamers, who possess a comprehensive understanding of cybersecurity principles, technologies, and best practices. Furthermore, the article highlights the strategic application of cyber deception techniques, such as honeypots, honeynets, and decoy systems, to enhance an organization’s ability to identify and respond to emerging threats. The article also emphasizes the importance of the continuous improvement and adaptation of strategies and techniques in response to evolving threats and emerging technologies. In addition, the article underscores the collaborative and iterative approach of Red Teaming engagements, which ensures that organizations can effectively adapt to and mitigate the risks posed by an ever-evolving threat landscape. By meticulously documenting and analyzing instances where the Blue Team successfully intercepts the Red Team’s efforts, organizations can develop a comprehensive understanding of their security posture and make informed decisions to enhance their defenses. With the constant evolution of cyber threats, Red Teaming is becoming increasingly important, and organizations that embrace it will be better equipped to protect their critical assets and defend against the relentless onslaught of cyber threats.

In the ever-evolving landscape of cyber warfare, the axiom “offense is the best defense” takes on a new meaning as organizations endeavor to secure their digital infrastructure from a relentless barrage of threats. To safeguard vital information assets and ensure the integrity of their networks, organizations must embrace the concept of offense for defense, a doctrine that champions the employment of adversarial tactics to identify and remediate vulnerabilities. This article delves into the realm of Cybersecurity Red Teaming, a disciplined and systematic approach that adopts offensive strategies to bolster defensive capabilities. It expounds on the methodologies, tools, techniques, and strategies employed in Red Teaming, as well as the planning practices that underpin successful engagements.

Red Teaming, a term derived from the military, entails assembling a group of cybersecurity experts, aptly known as Red Teamers, who assume the role of sophisticated adversaries to simulate real-world cyber-attacks on an organization’s digital infrastructure. (I. & Kovačević and S. Groš, 2020) A foundational attribute of an outstanding Red Teamer is a comprehensive understanding of cybersecurity principles, technologies, and best practices. Acquired through rigorous education and continuous training, this knowledge equips them with the ability to navigate the intricacies of a target organization’s digital landscape. Their expertise extends beyond technical prowess, encompassing a deep comprehension of the organizational, legal, and ethical implications of their actions. The fast-paced and dynamic nature of cybersecurity demands that Red Team members possess an innate curiosity and an insatiable appetite for learning. This intellectual curiosity drives them to stay abreast of the latest developments in the field, engage with emerging technologies, and cultivate a profound understanding of the evolving tactics, techniques, and procedures employed by malicious actors. A commitment to lifelong learning enables Red Teamers to adapt to the ever-changing threat landscape and devise innovative strategies for identifying and exploiting vulnerabilities. In addition to technical acumen, exceptional Red Teamers are distinguished by their ability to think creatively and approach challenges with an unconventional mindset. This outside-the-box thinking is crucial for simulating the myriad of attack vectors that real-world adversaries might employ, as well as devising novel and unexpected strategies for breaching an organization’s defenses. By adopting a hacker’s mindset, Red Teamers can accurately gauge an organization’s ability to detect, respond, and recover from cyber-attacks, allowing them to recommend effective countermeasures and remediation strategies. (Marcus et al., 2019) Effective communication skills are paramount for Red Teamers, as they must be able to articulate their findings, insights, and recommendations to a diverse range of stakeholders within the target organization. This entails translating complex technical concepts into clear and concise language that can be understood by both technical and non-technical audiences. Furthermore, exceptional Red Teamers possess strong interpersonal skills, which enable them to collaborate effectively with their teammates and foster a spirit of cooperation and mutual support. The unique demands of Red Teaming engagements necessitate that Red Teamers exhibit a high degree of adaptability and resilience. The ability to thrive under pressure and remain focused in the face of setbacks is vital for navigating the plethora of challenges inherent in simulating cyber-attacks. A strong work ethic, combined with a commitment to professionalism and integrity, ensures that Red Teamers operate within the ethical and legal boundaries governing their activities, thereby upholding the trust placed in them by the target organization. An exceptional Red Team member possesses a diverse array of qualities, encompassing technical expertise, intellectual curiosity, creativity, effective communication, adaptability, and resilience. By cultivating these attributes and fostering a spirit of continuous learning and innovation, Red Teamers can drive organizations towards the development of more robust and resilient security architectures, ensuring the long-term protection of their critical assets.

Red teaming is a powerful tool that enables organizations to assess their security posture from an attacker’s perspective. Unlike conventional security audits and assessments, red teaming involves engaging in simulated attacks on an organization’s systems and infrastructure. The goal of red teaming is to identify vulnerabilities and weaknesses that may have been overlooked by traditional security measures, and to develop more effective defense strategies. Red teaming is a highly effective way for organizations to gain valuable insights into their security posture. By simulating real-world attack scenarios, red teaming exercises can help organizations identify weaknesses in their defenses and develop more effective strategies for protecting their critical assets. A key benefit of red teaming is that it provides organizations with a more comprehensive view of their security posture.

Traditional security assessments often focus on specific areas of an organization’s infrastructure or processes, but red teaming exercises take a more comprehensive approach. By simulating real-world attack scenarios, red team exercises can help organizations identify weaknesses and vulnerabilities across all areas of their operations. Another important benefit of red teaming is that it helps organizations develop more robust and resilient defenses. By identifying vulnerabilities and weaknesses, organizations can take proactive steps to address these issues and improve their overall security posture. This can include everything from implementing new security controls to improving employee training and awareness programs. Red teaming is a powerful tool that enables organizations to assess their security posture from an attacker’s perspective. By engaging in simulated attacks, organizations can gain valuable insights into their vulnerabilities and weaknesses and develop more effective strategies for protecting their critical assets. With the constantly evolving threat landscape, red teaming is becoming an increasingly vital component of any organization’s security strategy. A meticulous and comprehensive Red Teaming engagement necessitates an in-depth comprehension of the target organization’s objectives, assets, and threat landscape. The process commences with the reconnaissance phase, wherein the Red Team acquires intelligence pertaining to the organization’s infrastructure, systems, and personnel. This critical phase paves the way for the identification of potential attack vectors that the Red Team can exploit in the subsequent stages of the engagement. After the reconnaissance phase, the Red Team transitions to the planning phase. This essential phase involves the careful delineation of the scope, objectives, and rules of engagement for the Red Team. By defining these parameters, the planning phase ensures that the Red Team operates within ethical and legal boundaries while optimizing the efficacy of their offensive endeavors. Furthermore, this phase presents the Red Team with an opportunity to pinpoint any gaps or vulnerabilities in the target organization’s security posture that can be exploited in the later stages of the engagement (Everson, 2020). Upon completion of the planning phase, the Red Team embarks on the execution phase. During this stage, the Red Team employs an array of diverse tools, techniques, and methodologies to infiltrate the target organization’s systems, networks, and applications. Emulating the tactics, techniques, and procedures (TTPs) utilized by genuine adversaries, the Red Team’s strategies span from social engineering and spear-phishing campaigns to the exploitation of zero-day vulnerabilities and the leveraging of advanced persistent threats (APTs). The primary objective of the Red Team during the execution phase is to accurately assess the target organization’s capacity to detect, respond to, and recover from cyber-attacks. By mimicking the modus operandi of sophisticated threat actors, the Red Team can uncover weaknesses and vulnerabilities within the target organization’s security posture. This invaluable information is subsequently employed to recommend suitable countermeasures and remediation strategies. A comprehensive Red Teaming engagement is a multi-faceted process that demands a thorough understanding of the target organization’s objectives, assets, and threat landscape. The engagement unfolds through the reconnaissance phase, during which the Red Team gathers intelligence on the target organization, followed by the planning phase, where the scope, objectives, and rules of engagement are established. The execution phase ensues, where the Red Team utilizes a diverse assortment of tools, techniques, and methodologies to infiltrate the target organization’s systems and detect weaknesses and vulnerabilities (Veerasamy, 2009). The Red Team’s findings serve as the basis for recommending appropriate countermeasures and remediation strategies.

A potential vital aspect of successful Red Teaming engagements lies in the strategic application of cyber deception techniques to conquer and derail blue team defenses and to entice bad actors into their environment so that they can view real attack activity and learn from it. By employing an array of sophisticated deception mechanisms, such as honeypots, honeynets, and decoy systems, Red Teams can entice malicious actors into controlled environments. This enables the target organization to meticulously study the attacker’s tactics, collect valuable intelligence on emerging threats, and develop countermeasures to protect their critical assets. (Han et al., 2018) This intelligence-driven approach to cybersecurity cultivates a proactive mindset, empowering organizations to stay one step ahead of malicious actors in the ever-changing cyber threat landscape. Moreover, the continuous improvement and adaptation of strategies and techniques in response to evolving threats and emerging technologies are essential components of Red Teaming. This necessitates that Red Teamers remain abreast of the latest developments in cybersecurity, engage in continuous education and training, and cultivate a profound understanding of the intricacies of the digital domain.

By fostering a culture of innovation and collaboration, Red Teamers can propel organizations towards the development of more robust and resilient security architectures, ensuring the long-term protection of their critical assets. Another crucial aspect of Red Teaming engagements is the documentation and analysis of instances where the Blue Team, responsible for defending the organization, successfully detects and thwarts the Red Team’s endeavors. This process involves the Red Team meticulously capturing, in their reports, the precise points at which the Blue Team’s defenses caught them in their tracks. By scrutinizing these encounters, both the Red and Blue Teams can identify the strengths and weaknesses of the organization’s security posture, as well as devise improvements and refinements to fortify their defenses. This collaborative and iterative approach ensures that organizations can effectively adapt to and mitigate the risks posed by an ever-evolving threat landscape. The strategic application of cyber deception and the continuous improvement of strategies and techniques are paramount to the success of Red Teaming engagements. By employing sophisticated deception mechanisms and fostering a culture of innovation and collaboration, Red Teamers can help organizations stay ahead of malicious actors and ensure the long-term protection of their critical assets. Furthermore, by meticulously documenting and analyzing instances where the Blue Team successfully intercepts the Red Team’s efforts, organizations can develop a comprehensive understanding of their security posture and make informed decisions to enhance their defenses against an increasingly complex and dynamic cyber threat landscape.

In the ever-evolving domain of cybersecurity, red teams repeatedly strive to refine their methodologies and employ cutting-edge tools to maintain an edge over their adversaries. One such innovation that has been embraced by the cybersecurity community is the integration of Security Orchestration, Automation, and Response (SOAR) automation with automated emulation software. This confluence of technologies engenders a synergistic effect that equips red teams with the ability to execute their operations with a higher degree of efficiency, precision, and adaptability. SOAR platforms are able to dynamically analyze and synthesize vast quantities of data, thereby enabling red teams to swiftly identify potential vulnerabilities and formulate appropriate countermeasures. Furthermore, these platforms facilitate the automation of routine tasks and the orchestration of disparate security tools, which, in turn, liberates the red team members from the burden of mundane activities and empowers them to focus on more strategic and cognitively demanding undertakings. The field of automated emulation software also embodies a potent instrument that is designed to replicate the modus operandi of a diverse array of adversaries, ranging from sophisticated nation-state actors to malicious insiders (Applebaum et al., 2016). Through the meticulous emulation of the tactics, techniques, and procedures (TTPs) employed by these threat actors, red teams are afforded the opportunity to gain valuable insights into the way in which their defenses might be circumvented. Additionally, automated emulation software can be utilized to conduct continuous and iterative assessments of an organization’s cybersecurity posture, thereby ensuring that any emergent vulnerabilities are expeditiously identified and addressed. The confluence of SOAR automation and automated emulation software engenders a potent amalgamation that imbues red teams with the cost-effective capacity to confront the challenges presented by the contemporary threat landscape. By leveraging the dynamic analytical and decision-making capabilities offered by SOAR platforms, red teams can seamlessly integrate the insights gleaned from automated emulation software, thereby fostering the creation of a holistic and adaptive defense through offense strategy. The marriage of SOAR automation and automated emulation software constitutes a formidable alliance that can help to revolutionize the way red teams execute their mission-critical responsibilities. By harnessing the power of these technologies, red teams can overcome the limitations of, and excessive costs associated with traditional red team methodologies.

In conclusion, Red Teaming is a critical component of an organization’s cybersecurity strategy, enabling them to assess their security posture from an attacker’s perspective. Red Teaming involves the simulated attack of an organization’s systems and infrastructure, allowing for the identification of vulnerabilities and weaknesses that may have been overlooked by traditional security measures. This approach allows organizations to develop more effective defense strategies that can protect their critical assets from the relentless barrage of cyber threats. The success of a Red Teaming engagement hinges on the expertise of the Red Teamers, who possess a comprehensive understanding of cybersecurity principles, technologies, and best practices. In addition to technical expertise, Red Teamers must possess creative thinking, effective communication, and collaboration skills, as well as adaptability and resilience, to navigate the complex and dynamic cybersecurity landscape. They must also remain abreast of the latest developments in the field and cultivate a profound understanding of the evolving tactics, techniques, and procedures employed by malicious actors. Furthermore, the strategic application of cyber deception techniques, such as honeypots, honeynets, and decoy systems, can enhance an organization’s ability to identify and respond to emerging threats. The continuous improvement and adaptation of strategies and techniques in response to evolving threats and emerging technologies are also essential components of Red Teaming engagements. In addition, the collaborative and iterative approach of Red Teaming engagements ensures that organizations can effectively adapt to and mitigate the risks posed by an ever-evolving threat landscape. By meticulously documenting and analyzing instances where the Blue Team successfully intercepts the Red Team’s efforts, organizations can develop a comprehensive understanding of their security posture and make informed decisions to enhance their defenses. Red Teaming is a powerful tool that can help organizations develop more robust and resilient security architectures, ensuring the long-term protection of their critical assets. By embracing the concept of offense for defense, organizations can stay one step ahead of malicious actors in the ever-changing cyber threat landscape. To further bolster the effectiveness of Red Teaming, cybersecurity SOAR automation and software emulation programs have emerged as valuable tools. SOAR (Security Orchestration, Automation, and Response) automation can help Red Teams streamline their processes and automate repetitive tasks, allowing them to focus on high-value activities such as identifying new attack vectors and developing countermeasures. Meanwhile, software emulation programs can help Red Teams accurately replicate real-world attack scenarios, enabling them to more effectively gauge an organization’s ability to detect, respond to, and recover from cyber-attacks. With the constant evolution of cyber threats, Red Teaming is becoming increasingly important, and organizations that embrace it will be better equipped to protect their critical assets and defend against the relentless onslaught of cyber threats.

References

Applebaum, A., Miller, D., Strom, B., Korban, C., & Wolf, R. (2016). Intelligent, automated red team emulation Proceedings of the 32nd Annual Conference on Computer Security Applications, Los Angeles, California, USA. https://doi.org/10.1145/2991079.2991111

Everson, D. a. C. L. (2020). Network Attack Surface Simplification for Red and Blue Teams

Han, X., Kheir, N., & Balzarotti, D. (2018). Deception Techniques in Computer Security: A Research Perspective. ACM Comput. Surv., 51(4), Article 80. https://doi.org/10.1145/3214305

I., & Kovačević and S. Groš. (2020). Pentesters, APTs, or Neither 43^rd International Convention on Information, Communication and Electronic Technology (MIPRO), Opatija, Croatia.

Marcus, Carey, J., & Jin, J. (2019). , “Tinker Secor,” in Tribe of Hackers Red Team: Tribal Knowledge from the Best in Offensive Cybersecurity Wiley. https://doi.org/doi:10.1002/9781119643357.ch37

Veerasamy, N. (2009). High-Level Methodology for Carrying out Combined Red and Blue Teams

ORCID – https://orcid.org/0009-0009-8367-5292

Retaining Cybersecurity Talent

Kevin M’s Tips For Retaining Top Cybersecurity Talent

As the cybersecurity threat landscape continues to evolve, it’s important to have a talented and skilled team in place to protect your organization’s assets and data. However, finding and retaining cybersecurity talent can be a challenge.

The following best practices can help ensure your top performers stay with your organization for the long term:

Provide competitive compensation and benefits packages

This includes not only salaries and bonuses, but also benefits like healthcare, retirement plans and paid time off.

Create a supportive and inclusive work environment.

This can be done by ensuring your team members feel valued and respected. They should be able to see a clear path for professional growth and advancement within the organization. This can be achieved through regular performance evaluation, opportunities for skills development and recognition for a job well done.

Offer flexible work arrangements

This includes hybrid, remote work, and onsite options as well as flexible schedules to meet the needs of your team – which is especially important post-covid.

Develop a strong company culture

This can be done by encouraging open communication, promoting teamwork and collaboration, and fostering a sense of community amongst your team members. This not only helps to create a positive work environment, but it also helps to build strong relationships and a sense of belonging across the team.

Invest in your team’s professional development

This can be done through a comprehensive and continuous learning program that offers opportunities for your team members to expand their skills, learn about modern technologies and stay up-to-date with the latest industry trends. Offering a combination of in-person training sessions, online courses, and hands-on experiences with innovative technologies is a great way to implement this program. Providing your team with the resources and support they need to grow and develop professionally can increase job satisfaction and help foster a sense of pride and ownership within your organization.

Threat actors are working diligently every day to find new ways to compromise sensitive data and assets. Therefore, it is essential to have a strong cybersecurity team in place to protect your organization. Prioritizing the above best-practices is a great way to keep your team members engaged and motivated, which will increase the likelihood of retaining your top cybersecurity talent for the long-term.

Thank you to my friend and colleague Ibn Akbar at Nice Touch Editing Services for helping me with the edits for this entry.

Small and Medium Size Organizations at Risk

The bad guys are now starting to target mid-tier companies with their hacking activities. In many cases these companies have not yet come to realize that having a Certified Chief Information Security Officer (C|CISO) or a Virtual Cerified|CISO (vC|CISO) is something that needs to be accepted as a part of doing business. The recent Presidential report on how Cyber Attacks impact the economy of the U.S.A. makes it clear that the cost of having a security expert on staff or on retainer is well worth it if the smaller company wants to remain in business. Cyber crime is putting many of these smaller companies out of business simply because they cannot recover from the post breach losses. At the same time these companies may not have the dollars to pay for a full time C|CISO, so their alternative is to explore the vC|CISO concept. The vC|CISO model can be leveraged to effectively manage security risk for small to mid-tier companies.

If a company is going to explore the hiring of a vC|CISO they need to make sure to do their due diligence and ask about the certifications (such as the one in the graphic below) and experience of the vC|CISO they are going to have giving them advice. While there are a lot of good vC|CISO options available there are just as many vendors and security professionals touting themselves as vCISO’s who lack the background or experience to be of much help. I lack quantifiable data on this point but I would say you should expect to pay between 3 and 400.00 per hour for a vC|CISO, the good news is you can choose what % of their time you want them to work for you (10%, 20%, on retainer, etc.) and then only pay for that portion of time.

Certified CISO

The Office of No, Really?

Successful ransomware attacks are at an all time high, we are losing the cyberwar, cyber criminals are making more money than ever before and it is only going to get worse, a cyber attack could be as damaging as a nuclear war – the headlines abound with comments such as this. Yet, there are still a lot of postings about how information security should not be the office of No. Really? Information security is a security function, as an information security professional are you really going to say – Yes, sure, go ahead and port that un-scanned software code into our production environment? I would hope you are going to say no you cannot port that un-scanned software code into our production environment. No is not a bad word, it is one that the job requires us to say. If you are offended when someone says you are the office of No- don’t be. To be a security professional no is a good response. I train my team members to say “yes, but” in order to soften the perceived impression of the word no ….. (here’s a clue – “yes, but” is still a no – no matter how you spin it).

However, I have yet to sit in a business meeting and see any of my peers simply say no without being willing to engage in dialogue that would lead to a good and secure solution. So for those who don’t like to say no then do it this way – yes you can put that server with 2 catastrophic exploitable vulnerabilities into the environment after we help you remediate the vulnerabilities or work on additional adequate controls that will allow us to use the server in a safe and secure manner. For me, information security professionals can and should say no, but after doing so we need to be helpful and smart enough to engage in conversations that help the business figure out how to do what they want to do in a way that is cost effective, safe and secure.

In many ways with the types and amount of successful attacks we are experiencing across the U.S. infrastructure being the office of Yes is a far more scary response than saying No to items that put your business at risk.

For Cyber Security the Perimeter Still Exists and Never Went Away

One item that really bugs me is to hear IT and Cyber Security professionals espouse that the perimeter is dead and that Cyber Security professionals should stop focusing on tools that protect the non-existing perimeter. I was at a lunch with a fellow CISO a few months back and he had invited his CIO to lunch with us. The CIO had recently attended a seminar where they talked about the perimeter no longer existing and he was truly wondering if he could just get rid of his firewalls. It was a fun conversation but also a bit scary to me that the conversation actually had to take place. The reality is that while the perimeter has changed we still host most of our systems and data in a data center or in multiple data centers and whether these data centers are on premise or in the cloud they still have a perimeter that needs protected. Bad actors, both external and internal need to be kept out of areas they have no business being in. To do that requires a strong perimeter consisting of next-generation firewalls such as the ones Palo Alto or CISCO provides. These first line perimeter defense tools should alert into your Security Alert tool (such as QRadar or Splunk) and should also be running Intrusion Prevention and WildFire type of technologies.

The Perimeter exists, heck in most organizations an argument could be made that multiple perimeters exist. Let’s quit saying that there is no Perimeter as the people we are tasked with protecting don’t need to be walking around thinking that they can get rid of their perimeter protection tools.

Critical Manufacturing Legacy Systems

One common item that information Security Professionals working in Critical Manufacturing environments have to deal with is that of legacy systems. You see, in Critical Manufacturing environments it is very common for the systems that run and control factory lines to remain in place for a very long time. Some of these systems can be running Operating Systems(OS) that are 10 to 15 years out of date. In many cases these OS are no longer vendor supported and cannot be patched to remediate known exploitable vulnerabilities. These older systems are often used to run production lines and they still do a great job at doing what they were purchased to do. It is difficult, rightly so, to convince the leadership team at a factory to spend money to replace something that is old but that is still doing the job it was purchased to do. It cost money and reduces potential profits to replace these old and outdated systems with new systems. Because they continue to do the job they were purchased to do justifying the new spend can be a difficult thing to do.

From an Information Security point of view these systems pose a large risk to the overall manufacturing environment and if hacked could cause a large scale production outage. In smaller companies this type of major Cyber attack can result in no longer being able to conduct business and permanently closing the doors. Legacy systems that are commonly found on the shop floor are often 3, 4 or even 10 years out-of-date when it comes to standard Information Technology patching. Information Security Professionals look at these systems as attack vectors while the people working in the Critical Manufacturing environment view them as cost effective work horses that are getting the job done. While cyber attacks on networks at Sony, Target, Home Depot and the US Government are getting all the press, the greatest cyber vulnerability is in manufacturing. “By raw numbers, and by the numerous manners of attacks, manufacturing is the most targeted area now, even compared to financial services,” Chet Namboodri, senior director of Global Private Sector Industries at Cisco, told Design News. “Financial services gets more press, but industrial networks get more attacks.” Attacks and warnings such as Stuxnet, Armaco, SolarWorld and U.S., Steel to U.S. regulators and security experts sending out an official warning that hackers could now access critical medical equipment including pacemakers and insulin pumps with potentially deadly results make the threat to Critical Manufacturing a real one. Determining what to do in order to lock down and protect the Legacy systems while at the same time allowing them to continue doing the work they have been doing is a major part of an Information Security professionals job.

“You can’t scan that system (or you can’t put AV on that system) because it is old and fragile and if you bring it down we will not be able to produce our product” Is way too common of a phrase in the Critical Manufacturing environment. In many cases Information Security Professionals are asked/told to please just leave the systems alone, do not run vulnerability scans, do not put antivirus on them, do not put a light firewall on them, do not patch them, do not put updates on them, etc. This type of thinking by Information Technology and Factory leadership teams is shortsighted and is putting their entire production capability at huge risk of catastrophic failure. As these legacy systems are outdated and no longer being supported by the vendor they are hugely exploitable to any blackhat or hacker that wants to take advantage of their exploitability. The reality is that the risk is real, the risk is great and from past events we know that these systems pose easy to use attack vectors for blackhats, fraudsters and competitors seeking to cause negative business impact to the company.

Information Security professionals working in Critical Manufacturing should take the approach shown in Table 1 for dealing with the Computer Systems residing in the factory environment and that are on the plant floor. By following this methodology the legacy systems will be protected while at the same time be able to continue doing the job they are good at and that they were purchased to do. In most cases this approach will also reduce the overall risk that these systems pose to an acceptable level.

Legacy Table Table 1

This approach when combined with the network segmentation and smart firewall approach discussed in my previous blog on Critical Manufacturing is the start of a successful recipe in securing a Critical Manufacturing environment.

Cyber Security – A basic look at Defense in Depth

A basic somewhat quirky and fun look at Defense in Depth.

The Insider Threat is Alive and Well – a summary taken directly from Raytheon’s How to Build an Insider Threat Program (2014) …

Aspects of human nature further complicate matters: Well-intended managers resist any notions of “their people” doing “bad things.” They screened them. They hired them. They work with them side-by-side and – if they’re good bosses – have developed a genuine interest in their career development and even personal happiness. In addition, one of the most critical elements in building a high performing team is trust, so anything that can have a negative impact on that trust needs to be very carefully analyzed and explained before being implemented. This disposition is not about being gullible, we all have white hat syndrome at times. It’s about being a helpful manager – and a decent person.

But it would be imprudent to completely abandon a sense of cautionary oversight, as there has been a steady flow of news reports about insiders doing harm to their organizations. They range from probably the most notorious of incidents – Edward Snowden’s carefully plotted leaking of sensitive NSA documents after downloading 1.7 million files – to possibly the funniest (except for the company in question): A software developer for a U.S. critical-infrastructure company literally outsourced his job by sending his log-in credentials to a Chinese contractor, so he could get paid six figures to surf Reddit, post Facebook updates, shop on eBay and watch cat videos all day2. While the latter anecdote has generated considerable amusement, it underscores the reality that internal threats pose serious risks: 53% of organizations have experienced an insider cybercrime incident, according to the 2013 U.S. State of Cybercrime Survey from the CERT Insider Threat Center at the Carnegie Mellon University. So who are the users who pose threats? In all cases, they have authorized access to the network and their co-workers and managers are usually shocked that they would do such a thing. Clearly, tech departments need the support of their leadership to do what plant managers and foremen did in the 1950s: Watch. Audit. Intervene. Prevent.

Regardless of the user’s full time or contractual status, you want to look for classic “tip-off” behaviors which can lead to trouble, e.g. the clear taking of proprietary information without need or approval; expressing increased interest in matters unrelated to defined duties; and connecting to the network remotely from unusual places at unusual times, having access to machines that they really don’t need access to, constantly seeking for elevated privileges, to list a few examples from the FBI profiling studies. Without a program in place to stop these individuals, organizations stand to lose an estimated $412,000 on average per incident.

In many organizations, a “we trust everyone to do the right thing” mindset too often prevails, and data points abound, such as 50% of employees who leave a company admitting to taking proprietary data, to show why this is highly questionable logic.

Another issue is with internal rule benders who conclude that the added layer of protections are either unnecessary and/or overly alarmist and/or present too many inconveniences for them to deal with. They consider themselves and their work as above it all, and decide on their own as to when to follow security protocols – and when to circumvent them. As they grow more comfortable with the latter, they choose it as their “default” setting, doing things such as sending proprietary information outside the company “walls” without encryption, logging onto systems that they should not have access to, elevating other person’s access rights because security doesn’t understand the person’s real need, etc. They love external drives and USB sticks, because these tools make it nearly impossible to distinguish risky behavior from harmless, work-related shortcuts. In fact according to a recent survey conducted by Voltage Security 50% of network users admitted to having bypassed security controls to complete a task more quickly and easily. Internal Rule Benders make up 15% of treat actors who have caused or committed a breach of their organizations’ data. Senior executives are disinclined to acknowledge that the worst is, indeed, possible: “We trust the people we hire” and they perform a valuable role. We do not want to promote a culture of suspicion. These Senior executives need to realize that Trust but Verify is a good mantra for them to start living by.

It’s too difficult. It’s too costly. There’s no imminent crisis. “Status quo” is working out just fine. Then like, Target, Home Depot and many others they find out that it’s not, after it’s too late.

On our team how can we implement items that allow us to do the following?

CERT’s “Common Sense Guide to Mitigating Insider Threats” has emerged as an industry standard for program implementation. Among its recommended actions:
- Launching a security information and event management (SIEM) system to log, monitor and audit user activity.
- Detecting activities outside the users’ normal scope of duties via phone/network logs, etc.
- Regularly reviewing accounts to verify that all are still active and necessary.
- Ongoing auditing of user accounts created and passwords provided.
- Requiring all system administrators to change passwords when a fellow administrator leaves his or her job.*
- Monitoring and controlling remote access from all end points, including mobile devices.
- Incorporating threat awareness/prevention policies into comprehensive termination policies.
- Developing a baseline of “normal” network device behaviors.
- Inventorying IT assets and routinely assessing their present-day role and relevancy.

Remember:

If you don’t go looking for trouble you will never find it.

But, Trouble will find you / your Organization

How do we get back to this future in a technological workplace?

In the classic factory of the 1950s, managers strolled from their offices on a floor that towered over plant activity, closely observing whether shift crews below were doing what they were supposed to do. Because employees knew the eyes of a supervisor may be upon them at any time, they were less inclined to cheat the system – such as slipping any of the company’s property or product into their pockets, or sabotaging a machine out of spite. Thus, the business was protected. And what was good for the business was good for everyone involved: the bosses, the investors and, yes, the workers. Said another way, it is good for business and for organizations to keep one rotten apple from spoiling the bunch.