Information Security – Page 5 – Cyber Security Leadership

NextSec 2014 Cyber Security and Technology Careers Fair

The 2014 Cyber Careers Fair event registration is now open.

If you are thinking about a Career in Cyber Security or Technology then why not come along and meet prospective employers and training providers. This is a great opportunity for you to find out what employers are looking for in the graduate market, ask questions in a relaxed environment to HR and junior professionals recently hired by these employers, and to grow your network!

Exhibitors confirmed: KPMG, PWC, Citi Group, Morgan Stanley, Lloyds Banking Group, BP, Microsoft, HP, BAE Systems, Royal Signals – British Army, Cyber Security Challenge and (ISC)2.

Exhibitors invited and to be confirmed soon: EY, Goldman Sachs, AXA, Shell, Royal Bank of Scotland, BT, Lockheed Martin UK, HMGCC, and GCHQ.

Date: 30 October 2014 from 10:30 to 16:30 (GMT)

Location: University of Westminster, 115 New Cavendish St, London W1W 6UW

Visit our website www.nextsec.org and watch a short video of last year’s event.

Please use the link below to register for a free ticket to attend and meet employers and HR teams from the participating organisations.

How will technology transform future business?

In what ways are you personally using technology to advance your business sector?

I am an information security specialist: Technology is at the very core of my business sector with innovation as its driving force. I help companies manage their constantly changing IT risks. I enable organisations to do business securely while protecting their assets from cyber threats.

It is important to bring innovative technology products and services that are secure enough to use in today’s interconnected world.

In what ways are you personally using technology to create positive social change?

I am promoting an information security culture regardless of a person’s age or occupation.
Just as people know how to protect themselves, their belongings and information in the real world, they must know how to do the same in the virtual world.

I’m teaching people to extrapolate their secure practices from the physical world into cyberspace to ensure that everyone can live free of fear that they or their children might be the prey of a cyber criminal.

How do you envision your work impacting the world over the next ten years?

I envision a future where my bathroom scale sends my weight to the doctor, my refrigerator tells the store when I’m low on milk, my car notifies my house when I’m away so that it saves energy, etc. My life is interconnected and doesn’t put me at risk of a break-in or identity theft.

In promoting a security culture and technology innovation, I see a community that lives comfortably and does business to its fullest capacity, knowing that they are secure.

Teaching Information Security Concepts at KPMG

I delivered a 1,5-day Information Security Concepts course at KPMG UK.

We covered a wide range of topics, including information security risk management, access control, threat and vulnerability management, etc.

According to the feedback I received after the course, the participants were able to understand the core security concepts much better and, more importantly, apply their knowledge in practice.

Leron is very engaging and interesting to listen to
Leron has the knowledge and he’s very effective making simple delivery of a complex topic
Leron is an effective communicator and explained everything that he was instructing on in a clear and concise manner

There will be continuous collaboration with the Learning and Development team to deliver this course to all new joiners to the Information Protection and Business Resilience team at KPMG.

KPMG’s Cyber Security Open Evening

I’m sharing client case studies at the KPMG’s Cyber Security Open Evening.

At KPMG we believe that cyber security is about what you can do – not what you can’t. Far from being a pure technical fix which can paralyse a company, we focus on driving change and helping our clients secure the future of their business. That’s why we’re still growing.

We have talented people with a passion for fighting the cyber threat. Come along to our open evening to speak to our specialist teams, who will be showcasing our insights and debating topical issues.

Come and see what the industry’s leading Cyber Security team are working on at KPMG’s Cyber Security Open Evening, Wednesday 28 May from 6pm at KPMG, 15 Canada Square, London E14 5GL.

To register your interest please book your place

Password Policies: Security vs Productivity

A password policy can include a number of parameters. Let’s examine them from both security and productivity perspectives:

Minimum password length defines how many characters a password should consist of. The longer the password, the more resistant it is to a brute force attack given other password best practices are followed. Longer passwords, however, are usually harder to remember which may lead to instances of writing passwords down.
Password complexity. If a password includes a combination of upper- and lowercase characters combined with numbers and special characters, the harder it is to run a dictionary attack against such a password. Similarly to long passwords, complex passwords are usually harder to remember.
Password renewal policy ensures that users regularly change their passwords. This helps to minimise the potential security impact of compromised passwords. Although this policy is beneficial from the security perspective, users may struggle to come up with new passwords that satisfy security requirements.
The policy restricts users to set passwords they used before. This forces them to come up with new passwords to make sure that if the password was compromised it is not reused. Although this policy is beneficial from the security perspective, users may struggle to come up with new passwords that satisfy security requirements.
Locking out a user’s account after a number of wrong password attempts is a strong measure against a brute force attack. The attacker in this case is unable to try all possible combinations using specialized software. From the usability perspective, however, legitimate users might enter their passwords incorrectly as well and be unable to access the system. This may result in the increased number of calls to the company’s Help Desk or increased time for manual password reset.

Password complexity and usability explained in one comic.

Delivering a Seminar at the London Metropolitan University

I was invited to give a talk on industrial systems security at the London Metropolitan University.

The seminar was intended for academic staff to discuss current problems in this field. We managed to cover a broad range of issues regarding embedding devices and network and IT infrastructure in general.

The professors shared their perspective on this subject. This resulted in the identification of several research opportunities in this area.

Image courtesy of Vlado / FreeDigitalPhotos.net

Risks to Risk Management

Nasim Taleb in his book The Black Swan provides the following examples of Mirage Casino’s four largest losses:

$100 million from a tiger mauling
Unsuccessful attempt to dynamite casino
Neglect in completing tax returns
Ransom demand for owner’s kidnapped daughter

How many of these losses could’ve been identified and managed appropriately?

John Adams in his research Risk, Freedom and Responsibility suggests that “Risk management is not rocket science – it’s much more complicated.” He further elaborates on this point in his research: “The risk manager must […] deal not only with risk perceived through science, but also with virtual risk – risks where the science is inconclusive and people are thus liberated to argue from, and act upon, pre-established beliefs, convictions, prejudices and superstitions.”

According to Adams, there are three types of risk:

Directly perceptible risks are dealt with using a proper judgment. “One does not undertake a formal, probabilistic, risk assessment before crossing the road.”
Risks perceived through science are subject to formal risk managementprocess. “Here one finds not only biological scientists in lab coats peering through microscopes, but physicists, chemists, engineers, doctors, statisticians, actuaries, epidemiologists and numerous other categories of scientist who have helped us to see risks that are invisible to the naked eye. Collectively they have improved enormously our ability to manage risk – as evidenced by the huge increase in average life spans that has coincided with the rise of science and technology.”

Virtual risk is not perceived through science, hence people are forced to act based on their convictions and beliefs.“Such risks may or may not be real, but they have real consequences. In the presence of virtual risk what we believe depends on whom we believe, and whom we believe depends on whom we trust.”

Klein in his Streetlights and shadows: searching for the keys to adaptive decision making suggests the following issues with risk management:

It works best in well-ordered situations
Fear of speaking out may result in poor risk identification
Organisations should understand that plans do not guarantee success and may result in a false sense of safety
Risk Management plans may actually increase risk.

Klein also identifies three risk decision making approaches:

Prioritise and reduce
Calculate and decide
Anticipate and adapt

To illustrate individual’s decision-making process while dealing with risk, Adams introduces another concept called “Risk thermostat”

The main idea behind it is that people vary in their propensity to take risks which is influenced by the perception of risk, experience of losses, and potential rewards.

People tend to overestimate spectacular but rare risks, but downplay common risks. Also, personified risks are perceived to be greater than anonymous risks.

The protection measures also can be introduced to only increase perceived security, rather than implement actual mechanisms. A possible example might be using National Guard in airports after 9/11 to provide re-assurance. However, such a security theatre has other applications in relation to motivation, deception and economics.

Finally, Adams discusses the phenomenon of risk compensation and appropriate adjustments which take place in the risk thermostat. He argues that introducing safety measures changes behavior: for example, seat belts can save a life in a crash, so people buckle up and take more risks when driving, leading to an increased number of accidents. As a result, the overall number of deaths remains unchanged.

Preventing Insider Attacks

An insider attack is one of the biggest threats faced by modern enterprises, where even a good working culture might not be sufficient to prevent it. Companies implement sophisticated technology to monitor their employees but it’s not always easy for them to distinguish between an insider and an outside attack.

Those who target and plan attacks from the outside might create strategies for obtaining insider knowledge and access by either resorting to an existing employee, or by making one of their own an insider.

They may introduce a problem to both individuals (in the form of financial fraud, for example) and companies (by abusing authorization credentials provided to legitimate employees). In this scenario, a victim and an attacker are sharing physical space, which makes it very easy to gain login and other sensitive information.

According to CERT, a malicious insider is; a current or former employee, contractor, or business partner who has or had authorised access to an organisation’s network system or data and intentionally exceeded or misused that access in a manner that negatively affected the confidentiality, integrity, or availability of the organisation’s information. Furthermore, CERT split insider crimes into three categories:

Insider IT Sabotage, where IT is used to direct specific harm at an organisation or an individual.
Insider Theft of Intellectual Property is the use of IT to steal proprietary information from an organisation.
Insider Fraud uses IT to add, modify and/or delete an organisation’s data in an unauthorised manner for personal gain. It also includes the theft of information needed for identity crime.

But how can companies detect and prevent such attacks?

In his paper, Framework for Understanding and Predicting Insider Attacks, Eugene Schultz suggests that insiders make human errors, which when spotted can help in preventing such threats. Therefore, constant monitoring, especially focused on low-level employees, is one of the basic measures for preventing insider attacks and gathering evidence.

There are a number of precursors of insider attacks that can help to identify and prevent them:

Deliberate markers – These are signs which attackers leave intentionally. They can be very obvious or very subtle, but they all aim to make a statement. Being able to identify the smaller, less obvious markers can help prevent the “big attack.”
Meaningful errors – Skilled attackers tend to try and cover their tracks by deleting log files but error logs are often overlooked.
Preparatory behaviour – Collecting information, such as testing countermeasures or permissions, is the starting point of any social engineering attack.
Correlated usage patterns – It is worthwhile to invest in investigating the patterns of computer usage across different systems. This can reveal a systematic attempt to collect information or test boundaries.
Verbal behaviour – Collecting information or voicing dissatisfaction about the current working conditions may be considered one of the precursors of an insider attack.
Personality traits – A history of rule violation, drug or alcohol addiction, or inappropriate social skills may contribute to the propensity of committing an insider attack.

There are a number of insider attackers who are merely pawns for another inside or outside mastermind. He or she is usually persuaded or trained to perpetrate or facilitate the attack, alone or in collusion with other (outside) agents, motivated by the expectation of personal gain.

Organisations may unknowingly make themselves vulnerable to insider attacks by not screening newcomers properly in the recruitment, not performing threat analyses, or failing to monitor their company thoroughly. Perhaps the most important thing they overlook is to keep everybody’s morale high by communicating to employees that they are valued and trusted.

Understanding the Attackers

When defining attack vectors, it is useful to know who the attackers are. One should understand that attackers are people too, who differ in resources, motivation, ability and risk propensity. According to Bruce Schneier, author of Beyond Fear, the categories of attackers are:

Opportunists

The most common type of attacker. As the category indicates, they spot and seize an “opportunity” and are convinced that they will not get caught. It is easy to deter such attackers via cursory countermeasures.

Emotional attackers

They may accept a high level of risk and usually want to make a statement through their attack. The most common motivation for them is revenge against an organisation due to actual or perceived injustice. Although emotional attackers feel powerful when causing harm, they sometimes “hope to get caught” as a way of solving the issues they were unhappy with but were unable to change from the beginning.

Cold intellectual attackers

Skilled and resourceful professionals who attack for their own gain or are employed to do so. They target information, not the system, and often use insiders to get it. Unlike opportunists, cold intellectual attackers are not discouraged by cursory countermeasures.

Terrorists

They accept high risk to gain visibility and make a statement. They are not only hard to deter by cursory countermeasures, but can even see them as a thrill.

Friends and relations

Career Paths and Skills Development for Security Professionals

Career paths for security professionals typically depend on the industry. For a consultancy company, for example, it might be the same progression across all the departments, but for an end-user organisation it usually follows the path, outlined in the figure below.

Certifications for security professionals

Certified Information Security Professional CISSP (www.isc2.org)

CISSP® certification is a globally recognized standard of achievement that confirms an individual’s knowledge in the field of information security. CISSPs are information assurance professionals who define the architecture, design, management and/or controls that assure the security of business environments.

Certified Information Security Manager CISM (www.isaca.org)

The uniquely management-focused CISM certification promotes international security practices and recognizes the individual who manages designs, and oversees and assesses an enterprise’s information security. It demonstrates your information security management expertise.

Certified Information Systems Auditor CISA (www.isaca.org)

The CISA designation is a globally recognized certification for IS audit control, assurance and security professionals. Being CISA-certified showcases your audit experience, skills and knowledge, and demonstrates you are capable to manage vulnerabilities, ensure compliance and institute controls within the enterprise.

There are also more specific certifications for penetration testing (e.g. Offensive Security, CEH), project management (PMP, PRINCE2), IT service management (ITIL) or architecture (TOGAF, ISSAP). Technical security skills can also be developed through SANS Institute