Cyber Security – A basic look at Defense in Depth

A basic somewhat quirky and fun look at Defense in Depth.

Your Horse Was Analog

Kevin L. McLaughlin

A speech I made to 350+ people at the Michigan joint Military Ball. Amway Grand Plaza Hotel.

Like my tie? My wife didn’t – gave me a lot of grief before we left the house, you know how difficult things can be when your significant other doesn’t approve of your choice in clothing.

Well you see this tie has snoopy, the moon, the space shuttle and Apollo craft on it and it was given to me by Fred Hayes, yes the Apollo 13 Fred Hayes , yes astronauts are pretty neat people, anyways Fred gave this to me when we were working on a project together and he told me that whenever I wore this tie I could look down at the pictures and that no matter what I do in the life I should remember that if we put a man on the moon we can do anything as a country.

…. as a country we can do anything, even figure out how to defeat this cyber threat.

I want to change that thought just a little bit because I know what type of people went to and walked on the moon – as a whole the U.S. Military and its veterans can do anything make no mistake we are under attack, not by conventional weapon systems like guns and missiles but by cyber warriors utilizing digital attack vectors.

My speech tonight will be about trust and how it will help us win our cyber battle. But, before I start I would like to do a shameless plug for the Whirlpool Veterans Association, who mentors soldiers transitioning to the private sector and with multiple outreach programs – I am sure many of the companies you work for have similar programs and a big thank you to those as well.

Trust and authority will be tonight’s theme. A lot of Information Security Professionals left Home Depot after years of not having their voices heard and repeatedly being over-ridden about whether a system could be touched or not. Many Board of Directors are asking how to fix the cyber issue – a lot of the CIO’s and some of the CISO’s when asked that question are taking a passive posture of saying that their job is to make them aware of the risk versus telling them what to do. In my opinion that is not the right answer… the people who are trained in cyber defense need to drive answers and solutions not just show risks

I will admit though that this morning while I was working out I had a big moment of angst, you see I am an expert in this field and I can have an opinion and if I get it wrong a company will lose money but you know – if you get it wrong lives will be lost and in the worst case our Homeland can fall. Even with that – tonight you will hear what I feel we need to do in order to start winning the cyber battle. We got our butts kicked by the bad guys in 2014 and it was a loud wake up call to anyone paying attention that what we have been doing is not the answer.

The general theme throughout my speech tonight will be one of trust. High performing teams consist of players that trust each other and who understand that each of the team members has an area that they are the expert in. We cannot continue to ignore or muffle the voices of our highly trained and skilled cyber defenders and expect to be successful in our cyber defense efforts.

One of the first things we need to understand is that there is always in existance a large understanding gap. I got my first taste of this type of understanding gap when I returned from Basic Training and I was talking to my Grandpa. He asked me where I was stationed and I said Fort Bliss Texas, he asked me what units were stationed there and I said the 3rd Cavalry. He got excited and we started talking; about 5 minutes into the conversation it dawned on me that he was talking horses and I was talking tanks. He was talking analog.

You see, we continue to increase our combat effectiveness by implementing new tools and technologies the majority of which are not analog, but are instead digital. Digital means that they present entirely different attack vectors and will require us to have an entirely different level of trust in the expertise of the cyber defenders we put in place. We must protect our digital assets.

The current generation of service men and woman are some of the first who have known nothing but digital tools.

(I left out this next part due to time constraints)

[Did anyone see the movie BattleShip? It’s a bit of a cheesy movie but there is a part in it where the modern digital destroyer gets blown up and the only available ship to fight the aliens was a WW II BattleShip, they are working to try and figure out how to use the ship and the Chief looks at the Ensign and says “sir, this old thing is completely analog, it will take us years of reading the manuals to learn how to float and fight it”. All of a sudden a long line of navy veterans come walking up and they are able to work side by side to show the team how to run and fight the ship – think about this – in another 10 to 15 years people who understand analog are not going to be around to help us out. ]

I continued my speech here — I have to wonder how many of these digital troops would use a smartphone or GPS, even if disallowed in the mission parameters, if they get lost during training? I’m not disparaging anyone, I just realize how very hard it would be for any level of team leader to stop themselves from using an alternative before calling into command and telling someone that they were lost. We all know how difficult that radio call would be to make.

What is scary is that if these digital devices were suddenly taken away our combat effectiveness would be greatly impacted – maybe by 90% or greater. Ok, each of your digital devices, smartphones, etc. have just been reset to 0:00 – how many of you can tell me what time it is? Show of hands {note – out of 350+ people in attendance only 2-3 raised their hands} wow, that was actually far worse than I expected it was going to be.

Having these digital items give us a significant advantage but also put us at risk if we don’t adequately protect them from cyber attack. Tanks, Planes and ships will not operate if their computer systems are taken off-line. Year after year we see annual reports that tell us that our military systems are in no better shape than private sector systems are and our military IT staff feels the same pressures to get systems in place quickly rather than securely – we must be better than that. {looked down at tie and lifted it up} We can do anything….

Most of us Cybersecurity professionals (risk professionals, assurance, etc. ) are very passionate about what we do – I personally spend upwards of 30-40 extra hours each week staying current, learning, wargaming, gathering intelligence, figuring out business enabling security strategies, and more.

How many of you in this room (Cybersecurity men and women you are not allowed to answer) can say you spend that much time studying and focusing on cybersecurity? How many of you even spend 2 hours per week? Of course you don’t spend time studying Cybersecurity nor should you – that’s why you put cyber security professionals on your team.

Then why is it that across Corporate America, and I can only imagine it is a bit worse in the military, is it so hard to build trust between the Cyber defenders and the management community of the organization? I know some of you are sitting out there thinking -What’s this guy talking about – I trust my Cybersecurity person. Do you? Do you really?

Think about this … you are the Colonel in charge of finance imagine an E6 Cyber defender walking into your office at month end closure and telling you that he has to take one of your business critical system off-line immediately for security patching as it is critically exposed and can be very easily compromised which could put the rest of our infrastructure at risk. He then tells you that the outage may last 8 to 10 hours. Well, after 17 years experience as a security professional in Corporate America I can tell you that this request would be met with a lot of resistance and most likely the Cyber Defender will be told to wait for a day or two to do the patching. Often times that directive will come with a comment about “you security guys and girls don’t really understand the business and tend to over-react”….

Hmmm… I can only imagine similar conversations happening inside of Target, HomeDepot, Sony, Subway, Dairy Queen, Sigh, I’m not going to name them all – but like I said earlier we really got our butts kicked in 2014. 2015 continues the theme with the Anthem breach – a breach which directly impacts each one of you the Feds feel China committed the breach to continue their mission of gathering the personal data of our active and former military and their dependents. We don’t know what they want the data for but it is obvious that they want it

Trust, Target has a 148 million reasons – those are dollars by the way – plus open lawsuits, HomeDepot has 120 million reasons and Sony has 1 billion reasons, to implement a Cyber Defender authority policy. 1 billion? how many of you work for companies that would even be able to survive a 1 billion dollar loss? I imagine if I lost a billion dollars for a company I’d be out on the street. and luckily for us we are starting to see Board Chairman, CEOs and CIOs resigning due to allowing a security breach to occur on their watch. Why is that lucky? because it might raise the awareness we need to help fix this issue.

A base level of trust needs to be in place that makes it so that is assumed your cyber defender, who also is part of your profit sharing plan and wants the company to make money or who is a strong patriot and wants our tanks to run or planes to fly, is not going to willy-nilly. I just wanted to say willy-nilly in a formal speech, is not going to willy-nilly take systems off-line and that when they say a system really needs to be fixed immediately they need to be granted the authority, we already give them the responsibility and career risk when a breach occurs, now let’s give them the authority they need to protect the organization, even if there is a small short term negative profit impact – wow that is hard to say but I bet if we asked Target, HomeDepot, Sony, Anthem, you get the idea if they could go back in time and accept a $5,000.00 profit hit in order to take a system off-line and patch it instead the breach they would all say yes.

For you the risk of allowing the E7, E8, Lt. Captain, Major, etcetera, I’d try to go on but I’ve been out of the military for a loooong time and would most likely get the other command ranks wrong… to trump the cyber defender may just result in a significant loss to both your combat effectiveness and your ability to defend our country.

Trust, trust the cyber defense experts that we are graduating from our military schools to both understand the business and to effectively assess the risk and make the call on fixing open and exploitable channels of attack. While the department heads and commanders should still have the final say an answer of “don’t touch this system” or an answer of “you are over-reacting to this threat – yet how would they even have the expertise to make that judgment? should be the rare exception and not the norm. – Trust and authority- we can win this cyber war and defend our systems against the cyber threat.

Home Depot Breach 43M loss posting on LinkedIn

I just read an article on LinkedIn about the negative impact caused by the recent Home Depot breach. Here are my thoughts about how all the 2014 breaches should change some C level and Information Security paradigms. These could cause a major C suite thought shift and maybe even a large paradigm thought shift in how our profession thinks about the skills and talents really needed by Information Security professionals.

Note – I know this opinion will not resonate well with some CISO’s – Major IT departments continue to hire CISO’s that have little to no security background. Hackers and blackhats are associated with organized crime and IMO until we put more of an emphasis on the word SECURITY in the CISO title and until CISOs stop walking a tightrope by always trying to compromise and keep the business happy by letting the business need trump the security need (“ok, don’t patch that extremely vulnerable system I understand your business need not to” ) the crooks will continue to win.

Also, it appears that too many companies are basing their CISO hiring decisions on the candidate’s business acumen. Wouldn’t it be better to focus on how well the candidate knows how to fight and deter criminals?
I’m not saying CISO’s don’t need to understand the business I am saying that a stronger focus should be on how much the CISO knows about criminals and crime fighting. I also realize that thought would take a major paradigm shift in the thinking of the C suite.

The Insider Threat is Alive and Well – a summary taken directly from Raytheon’s How to Build an Insider Threat Program (2014) …

Aspects of human nature further complicate matters: Well-intended managers resist any notions of “their people” doing “bad things.” They screened them. They hired them. They work with them side-by-side and – if they’re good bosses – have developed a genuine interest in their career development and even personal happiness. In addition, one of the most critical elements in building a high performing team is trust, so anything that can have a negative impact on that trust needs to be very carefully analyzed and explained before being implemented. This disposition is not about being gullible, we all have white hat syndrome at times. It’s about being a helpful manager – and a decent person.

But it would be imprudent to completely abandon a sense of cautionary oversight, as there has been a steady flow of news reports about insiders doing harm to their organizations. They range from probably the most notorious of incidents – Edward Snowden’s carefully plotted leaking of sensitive NSA documents after downloading 1.7 million files – to possibly the funniest (except for the company in question): A software developer for a U.S. critical-infrastructure company literally outsourced his job by sending his log-in credentials to a Chinese contractor, so he could get paid six figures to surf Reddit, post Facebook updates, shop on eBay and watch cat videos all day2. While the latter anecdote has generated considerable amusement, it underscores the reality that internal threats pose serious risks: 53% of organizations have experienced an insider cybercrime incident, according to the 2013 U.S. State of Cybercrime Survey from the CERT Insider Threat Center at the Carnegie Mellon University. So who are the users who pose threats? In all cases, they have authorized access to the network and their co-workers and managers are usually shocked that they would do such a thing. Clearly, tech departments need the support of their leadership to do what plant managers and foremen did in the 1950s: Watch. Audit. Intervene. Prevent.

Regardless of the user’s full time or contractual status, you want to look for classic “tip-off” behaviors which can lead to trouble, e.g. the clear taking of proprietary information without need or approval; expressing increased interest in matters unrelated to defined duties; and connecting to the network remotely from unusual places at unusual times, having access to machines that they really don’t need access to, constantly seeking for elevated privileges, to list a few examples from the FBI profiling studies. Without a program in place to stop these individuals, organizations stand to lose an estimated $412,000 on average per incident.

In many organizations, a “we trust everyone to do the right thing” mindset too often prevails, and data points abound, such as 50% of employees who leave a company admitting to taking proprietary data, to show why this is highly questionable logic.

Another issue is with internal rule benders who conclude that the added layer of protections are either unnecessary and/or overly alarmist and/or present too many inconveniences for them to deal with. They consider themselves and their work as above it all, and decide on their own as to when to follow security protocols – and when to circumvent them. As they grow more comfortable with the latter, they choose it as their “default” setting, doing things such as sending proprietary information outside the company “walls” without encryption, logging onto systems that they should not have access to, elevating other person’s access rights because security doesn’t understand the person’s real need, etc. They love external drives and USB sticks, because these tools make it nearly impossible to distinguish risky behavior from harmless, work-related shortcuts. In fact according to a recent survey conducted by Voltage Security 50% of network users admitted to having bypassed security controls to complete a task more quickly and easily. Internal Rule Benders make up 15% of treat actors who have caused or committed a breach of their organizations’ data. Senior executives are disinclined to acknowledge that the worst is, indeed, possible: “We trust the people we hire” and they perform a valuable role. We do not want to promote a culture of suspicion. These Senior executives need to realize that Trust but Verify is a good mantra for them to start living by.

It’s too difficult. It’s too costly. There’s no imminent crisis. “Status quo” is working out just fine. Then like, Target, Home Depot and many others they find out that it’s not, after it’s too late.

On our team how can we implement items that allow us to do the following?

CERT’s “Common Sense Guide to Mitigating Insider Threats” has emerged as an industry standard for program implementation. Among its recommended actions:
- Launching a security information and event management (SIEM) system to log, monitor and audit user activity.
- Detecting activities outside the users’ normal scope of duties via phone/network logs, etc.
- Regularly reviewing accounts to verify that all are still active and necessary.
- Ongoing auditing of user accounts created and passwords provided.
- Requiring all system administrators to change passwords when a fellow administrator leaves his or her job.*
- Monitoring and controlling remote access from all end points, including mobile devices.
- Incorporating threat awareness/prevention policies into comprehensive termination policies.
- Developing a baseline of “normal” network device behaviors.
- Inventorying IT assets and routinely assessing their present-day role and relevancy.

Remember:

If you don’t go looking for trouble you will never find it.

But, Trouble will find you / your Organization

How do we get back to this future in a technological workplace?

In the classic factory of the 1950s, managers strolled from their offices on a floor that towered over plant activity, closely observing whether shift crews below were doing what they were supposed to do. Because employees knew the eyes of a supervisor may be upon them at any time, they were less inclined to cheat the system – such as slipping any of the company’s property or product into their pockets, or sabotaging a machine out of spite. Thus, the business was protected. And what was good for the business was good for everyone involved: the bosses, the investors and, yes, the workers. Said another way, it is good for business and for organizations to keep one rotten apple from spoiling the bunch.

A day in the life of a senior Cyber Security Incident Responder

The day was proving to be an exciting one for team Havoc, the Company’s cyber Red Team, as the L2 report he had just read showed that 4 of the core company servers were vulnerable to a very common exploit. Glacier, the Red Team leader, was evaluating the report and figuring out how he was going to communicate this to the Global IT leaders. It was important to not just inform IT of the vulnerability, but to have recommended solution sets to present that were reasonable and that would allow them to be able to
remediate the vulnerabilities. Glacier was on his second read through of the report when cyber hacker he noticed a section that mentioned end user data on the systems being encrypted.

“Hey Hammerhead come over here.” Hammerhead is the teams best Wintel expert. “What’s up?” “Take a look at these systems and check out what is happening with the data on the shared drive. I’m thinking we’ve already been hacked and have a serious issue here. What do you think?” “Oh man Glacier, it looks like we have an active ransomware attack, maybe using something like Cryptowall. ”

Glacier immediately contacts NightShade, the Cyber Incident Response Team (CIRT) coordinator and asks her to get the team assembled.

While the above scenario does happen more often than we would like it to, thankfully it is not an everyday occurrence. Most days consist of conducting risk assessments on malware and zero-day events, investigating abnormal system behavior, and investigating employee or corporate security reports of suspicious activity. Each of these events has to be analyzed and assessed quickly, all the while knowing that each of the actions decided upon will be second guessed by arm chair quarterbacks across corporate IT leadership. Let’s say the Incident Response (IR) team makes a decision to patch systems based on their initial intelligence gathering and risk analysis. If any of these systems have a production failure due to the patch, pushback from IT immediately begins and argument over the need and criticality of the patch ensues. Even when the actions taken, such as having corporate executives change their passwords, are less impactful to productivity than leaving a building due to a fire alarm, second guessing by business leaders is inevitable. Even though the IR team’s decisions are rooted in cyber intelligence followed by an appropriate risk analysis, they are frequently told they are overreacting.

The business and IT leaders who do this second guessing often ask that in the future when these decisions are made they be made by group consensus. This thinking shows a complete lack of understanding on how fast cyber-attacks can move. For example: When the blaster worm came out as a zero day event it took down Fortune 500 companies around the globe in less than 15 minutes. The other issue with this type of reasoning is that these business and IT resources, while highly intelligent, have limited knowledge of cyber security and what it takes to prevent or quickly remediate data breaches. This fact has been made obvious by the long line of large data breaches all in companies that had limited Cyber Security resources or that did not listen to the ones they did have.

The same business and IT leaders who are doing the second guessing of Cyber Security professionals most likely read the first paragraph of this paper with thoughts that it is silly and bizarre for Cyber Security IR teams to use nicknames. Experienced IR professionals understand that hackers and fraudsters are highly intelligent and capable of conducting social engineering research to find the names of IR members so they can track those names on chats and systems in an effort to disrupt response capabilities. In the past, law enforcement professionals have had the bad guys call police stations pretending to be a hospital where their wife or husband had just arrived after being in a car accident. it is very possible that cyber attackers would try some of the same tactics to disrupt IR response capabilities. There are many IR teams that only have one UNIX or one Wintel resource and having them not engaged would cause a large negative impact to team operations. So, not only should IR teams use nicknames but these nicknames should also be treated as restricted data.

So, after that interlude, let’s get back to a day in the life of a senior IR professional. As with most jobs, coffee is the beginning of the day. While drinking their coffee, the IR professional reviews a variety of Cyber Intelligence sources to determine potential impact to the current employer. On some days this leads into the intelligence gathering and risk analysis work discussed above, on other days it leads to a check through emails to make sure that the Level 1 (L1) or Level 2 (L2) Security Operations Center (SOC) did not have any urgent findings for immediate handling. If there are no urgent needs in email, then a variety of L1 and L2 SOC reports are reviewed and analyzed and items of interest are followed up on as needed. Being a student of Stephen Covey’s 7 habits and the Corporate Athlete methods, lunch is something lite and is followed by a walk or quick work out. After lunch, the senior IR professional performs a quick check-in with each of the team members to see what items they are working on and to make sure that moral is high. This is followed by another quick email review to make sure nothing urgent has come in from Corporate Security, the company’s See Something – Say Something campaign, or either of the SOCs. Assuming nothing needing attention has come in, the IR professional brings up the SIEM dashboard to conduct a Quality check of the work being done by the L1 and L2. This often leads to some phone calls or a meeting with their team leaders to reinforce Standard Operating Procedure (SOP) items that are not being correctly followed. The end of the day usually consists of going through all the emails that have had to sit while the daily tasks were completed.

Department of Homeland Security, Fusion Centers & the Cyber Security Liaison Program: A sharing of intelligence

By: Kevin L. McLaughlin

March 9, 2013

The amount of data available through electronic means is hard to wrap your mind around and even more daunting is trying to figure out how to gather and collect the disparate pieces of data that exists in organizations that have suffered a cyber attack or that have suffered a negative cyber event. The reality of the internet and its associated connectivity is that if one organization is experiencing a certain type of cyber event so are a lot of others. The puzzle associated with how to share attack information with others and, more importantly, receive actionable information about attacks other organizations are receiving is one that we need to solve if we want to be able to successfully mitigate or reduce cyber attacks being launched against our organization to a manageable level. An issue felt by private corporations is that they do not perceive that a safe harbor for their sharing of information that may be of interest to the intelligence communities exist. There are some private sector partners who are heavily involved in a program of information sharing such as the National Counsel of ISACS (http://www.isaccouncil.org), National Initiative for Cyber Security Education (NICE), the NIST National Security Cyber Security center of excellence and the DHS National Cybersecurity and Communications Integration Center (NCCIC) all of which are good starting points for reaching out to and providing private sector Information Assurance professionals with avenues into the Cyber Security information reporting pipeline. One of the primary issues with most of the programs is that they are, even if inadvertently, almost exclusively focused on critical infrastructure partners. This focus on critical infrastructure, most likely prompted by the Cyber security Act of 2010 which is in place to increase collaboration between the public and the private sector on cyber security issues, (Jilani, 2011) leaves other private organizations wondering what they should do with the myriad of data that is captured by their security alerting infrastructure. “What can businesses and Uncle Sam do, together, to reverse this dangerous trend? There must be three areas of immediate focus. First, the public and private sectors need to share more information – more parties must be included and new platforms used (Bataller, 2011; Newbill, 2008)”. Items such as large scale data loss going to a foreign country are often remediated and no mention of the event is made outside of the corporate walls.

The U.S. government Department of Homeland Security (DHS) has established Fusion centers across the country in order to collect, analyze, and share information to assist in preventing, protecting against, and responding to crime and terrorism. These Fusion Centers often work in coordination and partnership with urban or regional Terrorist Early Warning Groups (TEWGs) so that relevant terrorism information can be processed, analyzed and shared quickly. Often times the fusion centers work closely with the US-CERT (http://www.us-cert.gov/) to share information about Cyber incidents and relevant data but once again the majority of education and use surrounding this partnership and the usage there-of is primarily focused on federal agencies and private sector critical infrastructure partners.

On a daily basis we hear about a major negative cyber event (Denial of Service against the CIA website, Denial of Service against the U.S. Treasury website, the U.S. Census Bureau being hacked, China has stolen yet another item of sensitive data, Wiki leaks, etc.) that was experienced by a U.S. Federal, State, Local, Private or Non-Profit institution and the significant negative impact caused by that Cyber event. With the Cyber threat being espoused by many Senior U.S. government officials as one of the most significant threats to the homeland it is understandable why cyber crime and negative cyber events are items of great interest to DHS and the Fusion Centers. Unfortunately, in the author’s experience as a private sector partner who was tightly involved with regional and state fusion centers, there is a limited structure outside of the Federal Government and law enforcement agencies for passing information along to these regional fusion centers and an even more limited structure for the fusion centers to pass actionable warning and cyber event data to the non-government agencies in their area of responsibility (AOR). Even if a structure for bi-directional information sharing was in place the private organizational sector WIIFM (what’s in it for me) factor still needs to be determined; without an incentive for taking the time to fill out a basic event information report and send it to their local Fusion Center very few cyber security professionals will take the time to do so. Further, it is difficult for private sector resources to get the clearances necessary for them to receive effective and relevant information from their fusion center partners.

In early 2011 the University of Cincinnati’s (UC) Office of Information Security (OIS) in partnership with their state of Ohio and Federal DHS liaisons came up with a plan and program to make it simple for the private and educational sector to share negative cyber event data with their regional Fusion center. The UC model poses that every organization, not just a critical infrastructure partner, that has a cyber security person or team provides a Cyber Liaison Officer (CLO – pronounced See-Low – name credited to Greg Seipelt, ISO at UC, 2011) to attend quarterly CLO group meetings with their regional Fusion center liaison. These meetings will be used to share information and build strong working relationships and understanding as to why the cyber events within their organizations are of tremendous value as intelligence to their brethren across the U.S. and to educate each other on the concept that knowledge is understanding and that the sharing of cyber event knowledge will allow them to design more effective defenses and protection for their organization’s cyber infrastructure and its associated data.

The CLO program can be used to establish the private sector web reporting infrastructure that allows each identified CLO to create a Cyber Event Report (CER) quickly and easily and then with one push of a button submit that report to their Regional or State Fusion center for analysis and, if appropriate, further dissemination. Two types of actionable reports could then be created by the Fusion center, classified and unclassified; the unclassified reports can then be sent broadly across the CLO community. Theoretically, a broad based dissemination to the CLO community can be sent from the Fusion centers to their CLO partners. The creation of this type of Cyber event information can be focused on providing actionable intelligence to the CLO partners.

An example of how this concept works can be seen in the following hypothetical story.

The day was proving to be an exciting one for team Havoc, the ACME Company’s cyber Red Team, as the cyber attack they had launched against ACME’s premier web application pwnd it and provided deep access to the information in ACME’s core research database. Glacier, the Red Team leader was evaluating the successful compromise and figuring out how ACME was going to be able to best remediate the vulnerabilities his team had just found when he noticed an abnormality in the data stream he was analyzing.

“Hey Blackout come over here”, Blackout was the team’s best data stream analyst. “What’s up boss man?” “Take a look at this streaming data; it looks like it’s already outbound for a foreign IP address. I’m thinking we’ve already been hacked and have a serious issue here. What do you think?” “Whoa boss man, that’s one pretty little hack job and yea, it looks like we just lost all the research data on project X.”

Glacier notifies ACME’s Cyber Incident Response Team (CIRT) briefs them on the incident and sits down to write his internal report. Glacier, being ACME’s CLO for the local Fusion Center then opens up his web browser after finishing his internal report, goes to the Fusion Center’s reporting application and then provides an ACME approved sanitized version of the Project X hack that includes all the detail on the attacker and the type of attack used but more generic information about the attack vector and what may have been compromised. Glacier knows and understands that his Fusion Center contacts don’t really care about any of the ACME proprietary information, employee names or anything like that; they just want enough information to understand the hack and provide information to the rest of the U.S. CLO community to enable them to establish proper prevention measures against the hack, or to be able to detect whether their organization was suffering from the same negative cyber event.

The upside to the private CISO community is that they now get relevant and verified data from across the country and the DHS can cover the WIIFM for their private CLOs by providing their qualified security resources, many of whom had Secret and Top Secret clearances in the past, with updated and reactivated clearances. Yes, there is a cost to the Government agency to do the clearance checks but this is a commodity that no one else can provide the X-Special Agents, X-military, etc. who have moved into the private sector and the draw of maintaining one’s clearance level seems to continuously be undervalued by Federal agencies who remain puzzled as to why they can’t get enough interest in their programs. Those of us who have proudly served, who are strong patriots and who now find ourselves working Cyber Security operations in the private sector are ready to continue serving but we need to show and demonstrate a clear value add to our corporate leaders and to ourselves.

Bataller, Erik. (2011). Cyber Partnerships. InformationWeek(1295), 21-24.

Jilani, Salman Shah. (2011). Cyber Security. Southasia, 15, 51-52.

Newbill, Raymond. (2008). Intelligence sharing, fusion centers and homeland security. DTIC Online.

Conceptual assistance rendered in conversations with my friend and colleague Greg Seipelt, University of Cincinnati Student and Cyber Security Professional and with my University of Cincinnati students who participated in all of our Red vs Blue Team Cyber Security events.

Why Is It?

Why is it that Internet Crime statistics continue to show that for the criminally inclined internet crime is a very viable and fast growing field?

Why is it that millions of dollars are stolen from end users who simply fail to pay attention to the basics of Information Security like strong pass-phrases and “don’t click the link”?

Why is it that in March of 2010 there was a breach of University student’s personally identifiable information (PII) that numbered over 3.3 million identities being stolen?

Why is it that in 2012 there was a breach of over 6 million IDs from the state of South Carolina IT Infrastructure?

Why is it that online banking theft is at an all time high with thefts against mid size business and metropolitan areas taking center stage?

Why is it that even though unheard amounts of information is being stolen daily that non-cyber security professionals are still very vocal in explaining to experts in the field of cyber security why passwords, pass-phrases, encryption and other basic controls don’t work and are too cumbersome?

Yet in most breach cases if basic information security controls and best practices like defense in depth would have been in place and followed the breach would not have occurred

Why is it that the non- Cyber Security professional’s opinions on what Cyber Security controls are important are often given more weight than the Cyber Security professional’s opinions within an organization?

Why is it that Senior IT and Business managers within an organization still won’t listen to the Cyber Security professionals they employ when it comes to building and maintaining an effective security and control infrastructure?

Why is it that Cyber Security professionals still don’t have the voice they need within most corporations (Government, Public and Private) to actually protect the organization’s data?

Why is it that blame for failure to protect corporate data is quick to be placed on the shoulders of Cyber Security professionals who weren’t listened to in the first place?

Why is it that as experts we really do have the knowledge and ability to protect sensitive corporate data but in most organizations we are not given the power to do so?

Why is it that rhetorical questions are not answered?

The Talent Within

11/8/2012

In his book “Topgrading: How leading companies win by hiring, coaching and keeping the best people” (2005) Dr. Smart talks about how important it is for a company to not only hire A level talent but then keep and retain them through the years. I have had the good fortune to work for a company that was very good at this and not only did they hire and retain A players they had a very good internal training program to make sure that the A players they hired were trained and taught the new roles they moved into in order to lessen the knowledge gap and learning curve for the new position. In this environment efficiency, streamlining, being agile, having solid and well followed processes were the norm. Needless to say this is a good environment for a talented knowledge professional to work and grow in. The basic idea was to hire and surround yourself with great and talented A performers and then allow them to make decisions and drive systemic change ongoing. To me this process of hiring smart and talented people and then promoting them as next step openings become available makes a lot of sense.

Unfortunately, throughout my professional travels what I have often observed is that even in companies with great training programs and who espouse the philosophy of growing talent from within there is a strong psychological tendency to seek outside for the next professional with a briefcase (J that’s an old joke about how your own company or organization never views you as an expert or qualified candidate, even if the rest of the nation views you that way), and bypass their internal talent pool.

What a lot of the VPs and directors who are hiring do not realize is that if you have an A player on your staff who is one level lower than the position you are filling they will succeed if you put them in the position, even if they have some knowledge gaps, that is pretty much what A players do. I know, a lot of you who are reading this are scratching your heads and thinking about all the times a resource is promoted beyond their ability and wondering how that fits in. The answer is simple, they weren’t an A player or they were an A player who, inherited all B and C players and wouldn’t aggressively cull the herd.

Both competent B and lower level C performers, especially ones that are non-performing destroy any possibility of creating a high performing team. These lower talented professionals don’t create this less than successful environment on purpose, it is just that they really don’t understand the higher level connections and thought process of the A player and they end up being more of a hindrance and distractor to overall success than they are a key component to the accomplishment of overall success.

There is research study after research study that shows if you have 90+% A players in your management ranks you will be extremely successful in your team and corporate endeavors. That being said I continue to scratch my head when I see organizations with A level talent who are available to move into a next tier open position go out on a public search to fill the position. A level talent is very hard to find, and to think that you are going to be able to search outside and find it more readily than you can identify and find it in the work force that has been with you for an extended period of time is simply naive. What typically happens is that an experienced director or VP is brought in from the outside and they end up after a short amount of time showing that they are a B or low level C talent. Even more mind boggling to me is that none of the people who were responsible for bringing this less than high end performer into the organization want to admit to making a bad hire so they live with the impact an under talented manager brings to their organization. The outcome of such a decision is that their true A players are driven from the organization and they take their talents to a competitor, where they are typically extremely successful working and managing at a level their previous employer would not promote them into.

Organizations really need to take a good look at their talent retention programs and give them more than just lip service and they also need to come to the realization that all forced ranking systems do is allow for the B and C players figure out sly ways to sabotage their talent pool of A players. Like Ken Blanchard says, organizations should help all of their “employees earn a grade of an A”, in my opinion the Blanchard approach to talent management will more readily allow you to identify and distinguish between the A, B and C players in your talent pool.

In Cyber Crisis

We are a country in crisis in regards to adopting adequate Information Security practices. I am not an alarmist but when I review the Cyber Security update that my team compiles and sends out a couple of times per week and see multiple breaches in every update and when I see reports like the one conducted by Adam Dodge or the Verizon Report that show steady amounts of information security breaches every year I have come to believe that we are a country in Cyber crisis.

Puzzling to me is that for some reason we, as a society have decided that the safeguarding of personal information should be a soft skill that is done by committee instead of by the certified and trained professionals we hire into Information Security roles. Interesting enough the members who are sitting on the committees making Information Security and data protection decisions are often times not Information Security professionals. To use an analogy – it seems that instead of deferring to our qualified “pilots” we are allowing the passengers to fly the airplane without providing them flight instructions first. If we really want to protect our corporate data then we cannot keep making Information Security decisions, such as should Personally Identifiable Information (PII) be encrypted, by consensus. We also need to see the cost benefit with hiring Information Security professionals and then listening to their advice. Due to a large data breach the State of South Carolina recently ended up paying $12 million that could have been put to better use; they could have asked any of us Information Security professionals if the data they lost should have been encrypted at rest and in transit to save $12 million. Instead (and this is pure conjecture on my part) they probably made the decision not to do so by a consensus of the CIO and other IT professionals, none of whom were trained Information Security professionals.

In my personal life I refrain from telling my accountant how to complete my taxes or from telling my surgeon where and how to make her surgical cuts. It is time, if we truly want to protect our data or the data we are entrusted to safeguard, for our communities to start adapting the course of action that Information Security Professionals and Information Security Standards advise. If we don’t start allowing our certified and trained professionals to specifically mandate how organizational PII, Intellectual Property, e-PHI, collectively referred to as restricted data, should be protected we will continue to allow this data to be lost or stolen.

While there is no silver bullet that will prevent 100% of this type of data loss most experienced and certified information security professionals know that there are many controls and safeguards we can put in place, if allowed to do so, that will minimize the loss of restricted data.

Note – my use of the words Information Security is synonymous with Information Assurance.

A Myth of Information Security: All data needs to be protected!

When you think about the total amount of data that goes across an organization on a daily basis protecting all of it becomes a daunting, if not impossible, task. It is hard to wrap one’s mind around how much a gigabyte of data is, let alone trying to conceptually understand what a terabyte of data is! It seems that current regulatory requirements and Information Security professionals are saying that all this data needs to be protected? Not true… that is a myth generated to scare the masses! For most business units and organizations the reality is that only 5-10% of the data that transverses their infrastructure or sits within electronic and physical filing cabinets is sensitive enough to need protection.

How do we differentiate between data that needs to be protected and data that does not need protected? One answer is for us to embrace an enterprise wide data classification scheme that allows the owner of the data to decide which of their data should be treated as:

Highly Restricted
Sensitive
Public

Once data owners classify their data they can then make smart choices about which data to protect very tightly and which data not to protect as well. This also allows the site data owners to save money by purchasing tools or establishing business processes that protect the 5-10% of data that requires extra protection vs. trying to protect 100% of the data flowing through their work areas.

By focusing on the small amount (5-10%) of data that truly needs to be protected we can lessen the complexity and obtrusiveness of data protection and regulatory compliance while reducing the cost of people, time and dollars. This reduced focus and scope is beneficial to the organization’s bottom line.

Yes, there is certain data that we are legally required to protect and secure and doing so can require small sacrifices and inconveniences on our part, similar to having to wear a seat belt when driving a car. However, if we focus our attention and tightened security on the small percentage of data that needs to be protected we might actually find out that there really is such a thing as a cost effective Information Security program.