Cyber Security Leadership

Presenting on cyber security at UCL

The UCLU Technology Society invited me to deliver a talk on information security to UCL students. Together with my colleague, I discussed various aspects of information security focusing on both technical and non-technical topics.

We talked about Advanced Persistent Threats and common misconceptions people have about them. When referring to protection measures, I emphasised the importance of considering human aspects of security. I described typical causes of a poor security culture in companies, along with providing some recommendations on improving it.

I concluded the evening with a discussion on managing and communicating the necessary changes within the organisation and the skills required to successfully do that.

User experience and security

Have you seen the Google Analytics ad yet? I know it is meant to promote a Google service and have little to do with security, but I quite like the metaphor they use to illustrate how people are trying to just complete their task – buying bread in this example – and how everything else gets in the way.

Security can end up in the way too and it’s our job as security specialists to recognise that. Regardless of the industry you are working in, chances are people in your company are hired to deliver a productive task. It’s our job to make sure they perform that task in the most frictionless and secure way possible

Cyber criminals are also aware of this dynamic. I remember working on the case of an online banking trojan that played on people’s desire to use the service. Attackers introduced friction in this process and took advantage of victims’ willingness to click ‘Ok’ on any pop-up just to get to the screen they wanted. A lot of the phishing campaigns use this trick too.

There are grey areas too. Dark Patterns are techniques used in websites and applications that trick you into buying or signing up for things you didn’t want.

Why are they so effective?

Because our attention spans are limited. We tend to glance over a page rather than reading every word. It is natural to make assumptions and some companies trick us by making a page look like it is saying one thing when it is in fact saying something else.

The short video below sums it up well.

Resistance to change

I’ve written about change management in my previous blog and wanted to tackle the topic from a different angle here. Let’s talk about change resistance.

According to Dannemiller, for a change to take place three factors not only must be present, but their sum must outweigh the resistance to change:

C = D × V × F > R

C – Change
D – Dissatisfaction with how things are now
V – Vision of what is possible
F – First concrete steps that can be taken towards the vision
R – Resistance

Meanwhile, the phenomenon of employees resisting organisational change is viewed as a widely accepted fact. But why is this the case? And, more importantly, what to do about it?

As with many things, the first step to solving this puzzle is to understand the root cause of it. Yes, it may appear on the surface that people may resist a new policy or technology. But look deeper: what do individuals value in the current state of affairs?

More ofter than not it’s their human relationships. Precisely the social element of the change; the change to these relationships that usually goes hand in hand with ‘technical’ change is something people resist the most.

Unpin the social interactions, pay attention to the moods and you might end up on the positive side of the Dannemiller’s equation.

Biometric authentication

If you want to learn more about biometric authentication, the best place to start is FIDO Alliance. Regardless of where you stand when it comes to passwords (are they obsolete and must be eliminated?), their standards and specifications can be useful.

The ecosystem enables enterprises and service providers to deploy strong authentication solutions that reduce reliance on passwords and protect against phishing, man-in-the-middle and replay attacks using stolen passwords.

The Psychology of Information Security – Resolving conflicts between security compliance and human behaviour

In today’s corporations, information security professionals have a lot on their plate. In the face of constantly evolving cyber threats they must comply with numerous laws and regulations, protect their company’s assets and mitigate risks to the furthest extent possible.

Security professionals can often be ignorant of the impact that implementing security policies in a vacuum can have on the end users’ core business activities. These end users are, in turn, often unaware of the risk they are exposing the organisation to. They may even feel justified in finding workarounds because they believe that the organisation values productivity over security. The end result is a conflict between the security team and the rest of the business, and increased, rather than reduced, risk.

This can be addressed by factoring in an individual’s perspective, knowledge and awareness, and a modern, flexible and adaptable information security approach. The aim of the security practice should be to correct employee misconceptions by understanding their motivations and working with the users rather than against them – after all, people are a company’s best assets.

I just finished writing a book with IT Governance Publishing on this topic. This book draws on the experience of industry experts and related academic research to:

Gain insight into information security issues related to human behaviour, from both end users’ and security professionals’ perspectives.
Provide a set of recommendations to support the security professional’s decision-making process, and to improve the culture and find the balance between security and productivity.
Give advice on aligning a security programme with wider organisational objectives.
Manage and communicate these changes within an organisation.

Based on insights gained from academic research as well as interviews with UK-based security professionals from various sectors, The Psychology of Information Security – Resolving conflicts between security compliance and human behaviour explains the importance of careful risk management and how to align a security programme with wider business objectives, providing methods and techniques to engage stakeholders and encourage buy-in.

The Psychology of Information Security redresses the balance by considering information security from both viewpoints in order to gain insight into security issues relating to human behaviour , helping security professionals understand how a security culture that puts risk into context promotes compliance.

It’s now available for pre-order on the UK, EU or US websites.

Project Manager’s Toolkit

There are many factors that make an effective project manager. From my experience, project managers face the biggest challenges managing and communicating project inter-dependencies, open actions, risks and issues.

To help myself and others, I’ve developed a simple spreadsheet, which includes templates for the above items.

For example, open actions can be tracked in the table below, making it easier to keep all the stakeholders aligned on what needs to be done and by when.

Date Raised	Raised By	Original Action	Progress Update / Revised Actions	Category	Owner	Priority	Target Completion Date	Status

Additionally, dependencies can be captured in the table below. This format emphasises the potential conflict between the parties and enables a constructive dialogue to clarify inter-dependencies and agree on the critical path.

Deliverable Title	Provider	Delivery Date	Receiver	Required Date	HandShake?	RAG	Comments / Actions

Feel free to download the PM Toolkit template (in the Excel format) along with tabs for risk and issue management and adjust it to your needs.

Image courtesy phasinphoto / FreeDigitalPhotos.net

Security in an Agile World – NextSec event

Santander have kindly agreed to host our next workshop event in their London offices on the 14th October. View the event flyer here.

Hear from leaders in Digital Innovation and Information Security on:
– The balance of Security and Innovation: The Cyber Threat and Opportunity
– Phishing and Social Media
– The Importance of Communication in Security

Speakers
– Edward Metzger, Head of Innovation, Santander
– Matt Bottomley, Senior Manager, Cyber Risk, Lloyds Banking Group
– Christine Maxwell, Head of Digital Security, Governance and Operational Excellence, BP

Networking and Careers Session
– Opportunity to network with junior professionals, students in Information Security and Technology
– Post event drinks and canapés reception
– Information Security careers stands from Santander, EY and KPMG will be at the event

Date: Wednesday 14th October 2015

Online Safety and Security

We live in the developed world where it is now finally safe to walk on the city streets. Police and security guards are there to protect us in the physical world. But who is watching out for us when we are online?

Issues:

Cyber crime and state-sponsored attacks are becoming more and more common. Hackers are now shifting their focus form companies to the individuals. Cars, airplanes, smart homes and other connected devices along with personal phones can be exploited by malicious attackers.
Online reputation is becoming increasingly more important. Potential business partners conduct thorough research prior to signing deals. Bad reputation online dramatically decreases chances to succeed in business and other areas of your life.
Children’s safety online is at risk. Cyber-bullying, identity theft; with a rapid development of mobile technology and geolocation, tracking the whereabouts of your children is as easy as ever, opening opportunities for kidnappers or worse.

Solution:

A one-stop-shop for end-to-end protection of online identity and reputation for you and your children.

A platform of personalised and continuous online threat monitoring secures you, your connections, applications and devices and ensures safety and security online.

Image courtesy ofwinnond / FreeDigitalPhotos.net

Cyber Wargaming Workshop

I was recently asked to develop a two-day tabletop cyber wargaming exercise. Here’s the agenda.
Please get in touch if you would like to know more.

Day 1
Introduction
Course Objectives
Module 1: What is Business Wargaming?
How Does Business Wargaming Work?

Teams
Interaction
Moves

Module 2 Cyber Fundamentals

Practical Risk Management
Problems with risk management
Human aspects of security
Conversion of physical and information security
Attacker types and motivations
Security Incident management
Security incident handling and response
Crisis management and business continuity
Cyber security trends to consider

Module 3: Introducing a Case Study

Company and organisational structure
Processes and architecture
Issues

Module 4 Case study exercises

Case study exercise 1: Risk Management
Case study exercise 2: Infrastructure and Application Security

Day 2
Introducing a wagaming scenario
Roles and responsibilities
Simulated exercise to stress response capabilities
The scenario will be testing:

How organisations responded from a business perspective
How organisations responded to the attacks technically
How affected organisations were by the scenario
How they shared information amongst relevant parties

Feedback to the participants
Course wrap up

Image courtesy zirconicusso / FreeDigitalPhotos.net

Removing Unused Firewall Rules

ID-100234172

Implementing cutting-edge technology solutions is not the only way to combat cyber threats. Seemingly mundane administrative tasks such as network infrastructure hardening could yield greater results in terms of risk reduction.

I ran a remediation project for a major blue chip company, which successfully removed over 8,000 unused firewall rules.

Such projects can be complex and require a rigorous process to be designed to ensure that no active rules are removed. For example, a period of monitoring and subsequent hypercare ensured that only a few rules were reverted back to production after being indicated as “unused”. Proactive stakeholder engagement was key in completing the work ahead of schedule and under budget.

As a result, the project improved network security by eliminating the chance an attacker can exploit a weak unused firewall rule. Moreover, the number of rules on the firewalls was cut by half, which made it easier and cheaper to monitor and manage.

Image courtesy renjith krishnan / FreeDigitalPhotos.net