Monthly Archives

October 2020

The Anatomy of Great Cybersecurity

The Anatomy of Great Cybersecurity

By | Data Protection, Security

If security professionals were asked to define the anatomy of great cybersecurity, it would likely be significantly different than a few years ago. IT departments are allocating more resources to improve their cybersecurity outlook. This is due in part to the large number of security breaches that have exposed critical data. The developers of the  Norton anti-virus software report that of the 3,800 publicly disclosed security breaches reported in the first six months of 2019, a record number of 4.1 billion records were exposed (more than a 50% increase over 2018 for the same time period). There is probably a lot more that are not publicly disclosed. While there isn’t a single “right” way to implement a cybersecurity strategy, there are areas of importance in which you should direct your focus.

Here are three key tale-tale signs of effective cybersecurity:

1: Leadership Buy-In

2: A Comprehensive Cybersecurity Framework

3: Security Awareness

Leadership Buy-In

As a security professional, your ideas about the best cybersecurity strategy for the organization are important to leadership (typically includes the board of directors, executive team, and security officers and managers). The weight that an organization places on cybersecurity begins at the top. This is because the top executives usually have the final authority to approve the cybersecurity budget that is appropriate for an organization’s needs. However, it’s not enough that you have the knowledge and a good picture of your organization’s cybersecurity stance. You must also effectively communicate this information to leadership, often for the purpose of persuading them.

Here are ideas to help you communicate your cybersecurity plan to leadership and obtain their buy-in:

  • Focus on providing metrics instead of explaining technical jargon.
  • Outline your recommendations. Make sure you provide multiple effective options that vary in cost. Explain the pros and cons of each option.
  • Explain how increasing the cybersecurity budget fits in with the organization’s goals. Focus on revenue cost savings, ROI, and customer satisfaction.
  • Emphasize any weaknesses that your analysis or an expert’s assessment has uncovered and the potential threats that your organization could become victim to if the weaknesses are not addressed.
  • Highlight security breaches of organizations that are similar to yours and the devastating results. If your organization isn’t one of the top organizations that are threatened most often (financial, healthcare, manufacturing, or government), leadership may not worry about security as much. Do your research and point out an organization that is similar to yours that has experienced a devastating breach. For example, if your organization is a gaming company, you could point out the data breach of mobile gaming producer Zynga that resulted in 218 million records of customers (the largest data hack of 2019).

Once you’ve prepared your list of ideas, make sure you also prepare answers to questions that leadership may have. Think of the pros and cons of the ideas you present to them and any other questions that may come up. It’s also a good idea to communicate with other cybersecurity professionals who have successfully obtained leadership buy-in and how they obtained it.

A Comprehensive Cybersecurity Framework

A cybersecurity plan must address the methods of protecting information assets. Since this involves a variety of components, a comprehensive cybersecurity framework is the best choice. When you are considering your framework, you should focus on how you want to handle potential threats. You want a framework that helps you understand your organization’s needs (assessment and analysis), provides components for implementing and managing risk controls and enables you to continually monitor your progress.

When you are considering the cybersecurity framework to implement in your organization, you should also check if there are any regulations specific to your organization or industry. An example is  the Healthcare Insurance Portability and Accountability Act (HIPAA) that provides security requirements for healthcare organizations.

To implement a comprehensive cybersecurity framework, you will likely combine multiple systems and controls. Here are five notable cybersecurity structures that are available for organizations:

 

National Institute of Standards and Technology (NIST) Cybersecurity Framework

This framework was developed specifically for organizations that manage critical systems in the United States but identifies five elements that any organization can use for managing and mitigating their cybersecurity risks. The five elements include Identify, Protect, Detect, Respond, and Recover. NIST provides the framework as downloadable files from their website. They also provide additional resources.

 

Center for Internet Security (CIS) Controls

These 20 controls are prioritized best practices that CIS has developed to help organizations prevent cyber attacks. The controls are prioritized as basic, foundational, and organizational and are downloadable in their entirety in PDF or Microsoft Excel format. CIS provides information for implementing the 20 controls as well as other cybersecurity resources on their website.

 

Information technology — Security techniques — Information security management systems — Requirements (ISO/IEC 27001)

This compliance specification, which provides requirements for managing information management systems (IMS), was officially adopted into the International Organization for Standardization (ISO) in 2005 and has been modified over the years to address the advancements in cyber threats. Organizations can choose to simply follow the requirements or request an audit to become ISO 27001 certified. Meeting these requirements can help organizations develop a cybersecurity framework. Companies that meet the rigorous requirements can choose to request an audit to become ISO 27001-certified organizations. This is an added benefit that provides proof to leadership, customers, and partners that a company has met a high standard for cybersecurity and is serious about protecting its information assets.

 

Federal Deposit Insurance Corporation (FDIC) Cybersecurity Framework

In 2016, the FDIC announced this framework to provide guidance to banking organizations for mitigating cyber risks that are specific to the industry. According to a report by the Keeper Security firm, of the thousands of IT professionals they surveyed, two-thirds of the financial organizations experienced cyber-attacks. This framework identifies four areas of focus to reduce cybersecurity risks: Corporate Governance of Cybersecurity, Threat Intelligence, Security Awareness Training, and Patch-Management Programs.

The FDIC also lists other cybersecurity resources on their website. In January 2020, the FDIC issued the Joint Statement on Heightened Cybersecurity Risk document to “remind supervised financial institutions of sound cybersecurity risk management principles.” The document outlines six areas of focus: Risk Management, Identity, and Access Management, Network Configuration and System Hardening, Employee Training, Security Tools and Monitoring, and Data Protection.

 

Plan-Do-Check-Act (PCDA) Methodology

Wikipedia defines PCDA as “an iterative four-step management method used in business for the control and continuous improvement of processes and products.” It was part of the ISO 27001 compliance standard for many years and has been incorporated in a variety of other cybersecurity frameworks. Organizations can use this system to improve their security implementation by using four steps: Plan, Do, Check, and Act.

Security Awareness

Security awareness refers to the ability to identify a potential threat and take appropriate action to alleviate it. An effective cybersecurity strategy would be incomplete without a plan for establishing awareness in employees. According to a study by the information security firm Shred-It, employee negligence poses the greatest information security risk to organizations. If employees in the organization do not understand security risks and make bad choices, leadership buy-in, and implementing a comprehensive cybersecurity framework will have a limited effect. Creating an environment characterized by employees having security awareness involves providing employees the information they need to understand the cybersecurity landscape and educating them on the behavior that is best in that landscape.

The following are the ways your organization can increase security awareness:

  • Develop a training program that identifies the types of cybersecurity threats and provides best practices for preventing security issues (recommended behavior when using email, social media, and company assets). The training should be mandatory for all employees and should be repeated and updated on a regular basis.
  • Make security policies (part of your cybersecurity framework) easily accessible by employees. Adding hardcopies to new hire packages is a good idea.
  • Send regular reminder notifications about cybersecurity best practices via email and text messages.
  • Hang up posters and security reminders in common areas of the organization.
  • Incentivize good employee behavior. For example, reward an employee that comes across a potential phishing email and performs the steps outlined in the training manual or security policy.

Next Steps

Developing and implementing an effective cybersecurity strategy can be a daunting task. Not only does it require resources, but it also requires an understanding of your organization’s needs in relation to the current cybersecurity environment. Developing an effective cybersecurity strategy shouldn’t be a singleton task. Engage your security team and other members of the organizations to perform specific tasks. If you decide to reach out to a security firm for assistance, choose one that is experienced in all facets of cybersecurity.

BACS specializes in providing a full spectrum of IT services to companies of all sizes. They can help you assess your security requirements and develop the most effective strategy to mitigate your organization’s security risks.

data protection - IT security services

TECH TALK: 3 Steps to Developing an Effective Cybersecurity Strategy

By | Data Protection, Security

Has the task of developing an effective cybersecurity strategy landed on your To-Do list? As the average worldwide cost of a data breach is estimated as $3.92 million (from The Cost of a Data Breach Report for by Ponemon Institute), it’s an important responsibility for all organizations that manage digital data. A cybersecurity strategy can be defined as a set of policies that outline your organization’s plan for mitigating the cyber risks to its assets. The key then to creating an effective strategy is aligning the plan to the specific needs of your organization. You can scour the Internet for a model to use for your organization’s strategy, but know that for it to be effective, you’re going to have to make it very personal to your organization. How do you do that?

Here are three basic steps:

1: Define Your Threats

2: Inventory Your Assets

3: Outline Your Protection Measures

 

1: Define Your Threats

The first step of developing a successful cybersecurity strategy is to identify the threats to your organization. If you’re not sure what the threats are, consider the general threats to all businesses, threats common to your industry, and the threats that are currently gaining momentum.

  • General Cyber Threats to Your Business

The technology company Cisco acknowledges the following six types of cyberattacks:

Malware

Malware, formally known as malicious software, refers to a group of computer software that cybercriminals design to gain access to a system and cause havoc, usually in the form of damaging or disabling the system. The most common types of malware are adware, ransomware, viruses, worms, and spyware.

Phishing

Cybercriminals use phishing attacks to obtain sensitive data such as social security numbers, credit card numbers, and passwords. This type of attack occurs via email or any other means of digital communication.

Man-in-the-Middle (MitM)

Just as it sounds, a MitM attack occurs when a cybercriminal gets in the middle of an exchange of data between two parties, such as a computer and a server, for the purpose of performing malicious acts.

Denial-of-service

One of the most dangerous types of threats to businesses is a distributed denial-of-service attack. A cybercriminal commits this threat by gaining access to a system, often by exploiting a vulnerability, with the goal is to overload it to the point of blocking people (your employees and/or customers) from accessing the system.

SQL injection

A SQL injection attack refers to malicious SQL code that is created to access and cause havoc to a vulnerable SQL database.

Zero-day exploit

A zero-day exploit is a cyber threat that is designed to exploit a vulnerability that has not yet been discovered and patched by the designer.

DNS tunneling

The domain name system (DNS) protocol is a legitimate method of exchanging data across the Internet. Cybercriminals can manipulate the DNS protocol to create a path or “tunnel” for infiltrating a network and exposing sensitive data.

 

  • Threats to Your Industry

You should also consider cyber threats that are specific to your organization’s industry. The following are common industries and the threats that they often face.

Financial

Organizations that handle financial transactions are big targets for cyber criminals. Insight, a cyber intelligence company, reported findings of  that malware attacks in 2019 were targeted more often in a specific area—financial institutions (25.7 percent). Malware isn’t the only threat to these organizations. According to a report by technology consulting firm Mindsight, the top three cyber threats to the financial industry are web application attacks, DDoS attacks, and backdoors and supply-chain attacks.

Healthcare

Healthcare companies are a common target for cyber criminals because of the large amounts of personal data they manage. The Fact Sheet of the Cybersecurity Act of 2015 lists the following as common threats to healthcare organizations: Ransonware, email phishing attacks, loss or theft of equipment or data, internal, accidental or intentional data loss, and attacks against connected medical devices that may affect patient safety are common threats to these industries.

Government

The IT systems of governmental organizations, federal agencies in particular, are responsible for managing critical infrastructures and are often targeted by cyber criminals. According to the U.S. Government Accountability Office, the Department of Homeland Security received more than 35,000 security incidents reports from federal executive branch civilian agencies in 2017. Of those incidents, the largest number (31%) were from an unidentified source. The remaining incidents were from improper usage (22%), email/phishing (21%), loss or theft of equipment (12%), web-based attack (11%), multiple attack vectors (2%), and attrition, external/removable media, and physical cause made up 1%.

Manufacturing

The infrastructures that are critical to keeping countries moving smoothly require manufacturing operations. Cyber criminals know this and have been increasing their threats on this industry. According to a study by Deloitte and the Manufacturers Alliance for Productivity and Innovation (MAPI) nearly 40% of the surveyed manufacturing companies were affected by cyber incidents in the prior 12 months, and 38% of those impacted indicated cyber breaches resulted in damages of $1 million or less.

The National Institute of Standards and Technology (NIST) identifies the following threats to manufacturing: Identity theft, phishing, spear phishing, spam, and compromised webpages

 

  • Trending Threats

As the world changes, we see old cyber threats improve and new ones emerge. Sometimes, we see threats increase on the radar of cyber intelligence trackers because of specific events. In 2020, for example, the COVID-19 global pandemic was associated with the following three significant cyber attacks, as reported by MonsterCloud:

Corporate ransomware attacks

Large corporations are often the target of ransomware attacks. During the COVID-19 pandemic, cyber criminals have been threatening doxware (extortionware), which is a type of ransomware that involves a cyber criminal threatening to sell or publish sensitive data.

Research and vaccines

As companies are in the midst of developing a vaccine for COVID-19, cybercriminals are increasing their attacks to obtain information to sell to other companies and governments wanting it.

Social engineering (Twitter)

In the summer of 2020, a teenage hacker managed to scam high-profile Twitter users out of more than $100,000. He was arrested, but not before obtaining $100,000 from his victims.

An additional threat that many companies neglect to acknowledge is within their organization. In the article “The Biggest Cybersecurity Threats Are Inside Your Company” , insider threats account for 60% of all threats to an organization.

2: Inventory Your Assets

Once you understand the threats to your organization, you should then understand your assets that could be threatened. The plan you develop will be effective only if you understand the assets you need to protect. The best way to learn this information is to perform an inventory. The National Initiative For Cybersecurity Career and Studies (NICCS) defines an asset as “A person, structure, facility, information, and records, information technology systems and resources, material, process, relationships, or reputation that has value.”

Here are a few examples of common assets within an organization:

  • Data that flows through your organization. This includes personal data (sensitive data about employees, vendors, and third-party companies and the work data the organization obtains or produces.
  • Physical assets or endpoints that employees use connect to your organization’s network.
  • Network that employees connect to.
  • Infrastructure resources such as databases and servers that store your data.
  • Software that employees use in the company (note the identifying information as well as dates).

A simple spreadsheet is a good way to manage the assets, but it shouldn’t be a laundry list of your assets. You should include details that help you determine the critical value of the asset. This includes adding information about its intended use, how it is accessed, by whom is it accessed, and an assessment of its value. You should devise a system for noting those assets that are critical to the business.

3: Outline Your Protection Measures

Once you understand the threats to your organization and the most critical assets you need to protect from those threats, you are ready to specify how your organization plans to protect its assets from cyber threats.

The following are examples of types of cybersecurity protection methods referenced in an effective cybersecurity strategy:

  • Training to develop cybersecurity awareness among all employees.
  • Security policies for every type of asset (examples listed below):
    • Perimeter security such as network security includes firewall and anti-virus protection, and encryption
    • Endpoint security that protects the systems that connect to your network
    • Application security methods such as sandboxing and encryption
    • Password security that requires employees to use strong passwords
    • Email security measures such as multi-factor authentication and email security gateway protection
    • Remote access security measures such as virtual private networks (VPNs) and end-to-end encryption
  • Insurance that protects your organization from liability should you suffer a cyber attack

Next Steps

The information presented above will help you develop your cybersecurity strategy. Keep in mind that your cybersecurity strategy is not a document that you develop and forget about. It should be a dynamic document that you revisit often to ensure it is up to date.

Seeking the assistance of a cybersecurity expert is a good plan of action to ensure that your cybersecurity strategy addresses all the needs of your organization. BACS is an IT services company that partners with organizations to help them solidify effective security strategies that are based on in-depth analysis.

data-backup-and-recovery-business-continuity

Best Practices for Building a High Availability Cloud Architecture

By | Cloud

The critical nature of today’s cloud workloads has made choosing the right cloud architecture more important than ever. To reduce the potential for system failures and hold downtime to a minimum, building your cloud environment on high availability architecture is a smart approach, particularly for critical business applications and workloads.

High availability is a design approach that configures modules, components, and services within a system in a way that helps ensure optimal reliability and performance, even under high workload demands. To ensure your design meets the requirements of a high availability system, its components and supporting infrastructure should be strategically designed and thoroughly tested.

While high availability can provide improved reliability it typically comes at a higher cost. Therefore, you must consider whether the increased resilience and improved reliability is worth the larger investment that goes along with it. Choosing the right design approach can be a tedious process and often involves tradeoffs and careful balancing of competing priorities to achieve the required performance.

Although there are no hard rules of implementing a high availability cloud architecture, there are several best practice measures that can help ensure you reap maximum return on your infrastructure investment.

 

Load balancing:

Modern cloud designs allow for the automated balancing of workloads across multiple servers, networks or clusters. More efficient workload distribution helps optimize resources and increases application availability. When instances of server failure are detected, workloads are automatically redistributed to servers or other resources that continue to operate. Load balancing not only helps improve availability, but it helps provide incremental scalability and supports increased levels of fault tolerance. With network load balancers installed in front of servers or applications, traffic or users will be routed to multiple servers, improving performance by splitting the workload across all available servers.  The load balancer will analyze certain parameters before distributing the load, checking the applications that need to be served, as well as the status of your corporate network. Some load balancers will also check the health of your servers, using specific algorithms to find the best server for a particular workload.

 

Clustering:

Should a system failure occur, clustering can provide instant failover capabilities by summoning resources from additional servers. If the primary server fails, a secondary server takes over. High availability clusters include several nodes that exchange data using shared memory grids. The upshot is that should any node be shut down or disconnected from the network, the remaining cluster will continue operation―as long as one node is fully functioning. Individual nodes can be upgraded as needed and reintegrated while the cluster continues to run. The additional cost of implementing extra hardware to build a cluster can be offset by creating a virtualized cluster that uses the available hardware resources. For best results, deploy clustered servers that both share storage and applications, and can take over for one another if one fails. These cluster servers are aware of each other’s status, often sending updates back and forth to ensure all systems and components are online.

 

Failover:

Failover is a method of operational backup where the functions of a component are assumed by a secondary system or component in the event of a failure or unexpected downtime. In the event of a business disruption, tasks are offloaded automatically to a standby system so the process remains seamless for end-users. Cloud-based environments offer highly reliable failback capabilities. Workload transfers and backup restoration is also faster than traditional disaster recovery methods. After problems at the initial site or primary server are solved, the application and workloads can be transferred back to the original location or primary system. Conventional recovery techniques typically take longer as the migration uses physical servers deployed in a separate location. Depending on the volume of data you are backing up, you might consider migrating your data in a phased approach. While backup and failover processes are often automated in cloud-based systems, you still want to regularly test the operation on specific network sites to ensure critical production data is not impacted or corrupted.

 

Redundancy:

Redundancy helps ensure you can recover critical information at any given time, regardless of the type of event or how the data was lost. Redundancy is achieved through a combination of hardware and/or software with the goal of ensuring continuous operation in the event of a failure or catastrophic event. Should a primary component fail for any reason, the secondary systems are already online and take over seamlessly. Examples of redundant components include multiple cooling or power modules within a server or a secondary network switch ready to take over if the primary switch falters. A cloud environment can provide a level of redundancy that would be cost-prohibitive to create with on-premises infrastructure. This redundancy is achieved through additional hardware and data center infrastructure equipped with multiple fail-safe measures. In the case of geographic redundancy, multiple servers are deployed at geographically distinct sites. By capitalizing on specialized services and economies of scale, cloud solutions can provide much simpler and cost-efficient backup capabilities than on-premises systems.

 

Backup and recovery:

Thanks to its virtualization capabilities, cloud computing takes a wholly different approach to disaster recovery. With infrastructure encapsulated into a single software or virtual server bundle, when a disaster occurs, the virtual server can be easily duplicated or backed up to a separate data center and quickly loaded onto a virtual host. This can substantially cut recovery time compared to traditional (physical hardware) methods where servers are loaded with the application software and operating system and updated to the last configuration before restoring the data. For many businesses, cloud-based disaster recovery offers the only viable solution for helping to ensure business continuity and long-term survival.

 

Business continuity:

Even with the best high availability practices and architecture in place, IT-related emergencies and system failures can strike at any moment. That’s why it’s vital to have a well-designed business continuity plan in place as part of your cloud strategy. Your business continuity and recovery plan should be well-documented and regularly tested regularly to help ensure its viability when confronting unplanned interruptions. In-house training on recovery practices will help improve internal technical skills in designing, deploying, and maintaining high availability architectures while well-defined security policies can help curb incidences of system outages due to security breaches. Additional practices involve defining the roles and responsibilities of support staff. If you must failover to a secondary data center, how will you effectively manage your cloud environment? Will your staff be able to work remotely if the primary office or data center location is compromised? In addition to the hardware and infrastructure, the fundamental business continuity logistics and procedures are an important part of your high availability cloud design.

 

 

Building a Solid Cloud Foundation

Cloud environments have helped make high availability and disaster recovery designs supremely efficient compared to traditional methods. Despite many highly publicized examples of security breaches and system failures, many organizations effectively run critical workloads in the cloud when they are built on the right architecture and employ the appropriate management tools.

While high availability techniques can help improve uptime and aid in recovery, it’s important to maintain and test your systems and processes on a regular basis. It’s better to uncover any issues early on rather than have them emerge during a crisis. Determine what needs to be corrected and continue to test the processes until they are perfected.

While putting together all the pieces in place to achieve a highly available cloud environment can be complex and time-consuming, the effort will pay dividends far beyond the initial investment.