Category Archives: Security

NIST Cybersecurity Framework

Leave a reply

A cybersecurity framework is a system of standards, guidelines, and best practices to manage cyber risks.  The three most popular cybersecurity framework are:

  • The US National Institute of Standards and Technology (NIST) Framework for Improving Critical Infrastructure Cybersecurity (NIST CSF)
  • The Center for Internet Security Critical Security Controls (CIS)
  • The International Standards Organization (ISO) frameworks ISO/IEC 27001 and 27002.

NIST cybersecurity framework is intended to be used to protect any organization’s infrastructure from cyberattacks. The framework’s core is a list of cybersecurity functions that follow the basic pattern of cyber defense: identify, protect, detect, respond, and recover. The framework provides an organized mechanism for identifying risks and assets that require protection.

Identify

The Identify Function assists in developing an organizational understanding to managing cybersecurity risk to systems, people, assets, data, and capabilities. Understanding the business context, the resources that support critical functions, and the related cybersecurity risks enables an organization to focus and prioritize its efforts, consistent with its risk management strategy and business needs.
Examples of outcome Categories within this Function include:

  • Identifying physical and software assets within the organization to establish the basis of an Asset Management program
  • Identifying the Business Environment the organization supports including the organization’s role in the supply chain, and the organizations place in the critical infrastructure sector
  • Identifying cybersecurity policies established within the organization to define the Governance program as well as identifying legal and regulatory requirements regarding the cybersecurity capabilities of the organization
  • Identifying asset vulnerabilities, threats to internal and external organizational resources, and risk response activities as a basis for the organizations Risk Assessment
  • Identifying a Risk Management Strategy for the organization including establishing risk tolerances
  • Identifying a Supply Chain Risk Management strategy including priorities, constraints, risk tolerances, and assumptions used to support risk decisions associated with managing supply chain risks

Protect

The Protect Function outlines appropriate safeguards to ensure delivery of critical infrastructure services. The Protect Function supports the ability to limit or contain the impact of a potential cybersecurity event.
Examples of outcome Categories within this Function include:

  • Protections for Identity Management and Access Control within the organization including physical and remote access
  • Empowering staff within the organization through Awareness and Training including role based and privileged user training
  • Establishing Data Security protection consistent with the organization’s risk strategy to protect the confidentiality, integrity, and availability of information
  • Implementing Information Protection Processes and Procedures to maintain and manage the protections of information systems and assets
  • Protecting organizational resources through Maintenance, including remote maintenance, activities
  • Managing Protective Technology to ensure the security and resilience of systems and assets are consistent with organizational policies, procedures, and agreements

Detect

The Detect Function defines the appropriate activities to identify the occurrence of a cybersecurity event. The Detect Function enables timely discovery of cybersecurity events.
Examples of outcome Categories within this Function include:

  • Ensuring Anomalies and Events are detected, and their potential impact is understood
  • Implementing Security Continuous Monitoring capabilities to monitor cybersecurity events and verify the effectiveness of protective measures including network and physical activities
  • Maintaining Detection Processes to provide awareness of anomalous events

Respond

The Respond Function includes appropriate activities to take action regarding a detected cybersecurity incident. The Respond Function supports the ability to contain the impact of a potential cybersecurity incident.
Examples of outcome Categories within this Function include:

  • Ensuring Response Planning process are executed during and after an incident
  • Managing Communications during and after an event with stakeholders, law enforcement, external stakeholders as appropriate
  • Analysis is conducted to ensure effective response and support recovery activities including forensic analysis, and determining the impact of incidents
  • Mitigation activities are performed to prevent expansion of an event and to resolve the incident
  • The organization implements Improvements by incorporating lessons learned from current and previous detection / response activities

Recover

 The Recover Function identifies appropriate activities to maintain plans for resilience and to restore any capabilities or services that were impaired due to a cybersecurity incident. The Recover Function supports timely recovery to normal operations to reduce the impact from a cybersecurity incident.
Examples of outcome Categories within this Function include:

  • Ensuring the organization implements Recovery Planning processes and procedures to restore systems and/or assets affected by cybersecurity incidents
  • Implementing Improvements based on lessons learned and reviews of existing strategies
  • Internal and external Communications are coordinated during and following the recovery from a cybersecurity incident

Source: https://www.nist.gov/cyberframework/online-learning/five-functions

Improving the Nation’s Cybersecurity

Leave a reply

Due to the rampant cyber attacks on private and public companies as well as government institutions, the President of the United States issued an Executive Order 14028 on May 12, 2021 to improve the nation’s cybersecurity.

To comply, companies must implement the five best practices from the Executive Order of the President:

  • Back up data, system images, and configurations; regularly test them, and keep the backups offline.
  • Update and patch systems promptly.
  • Test the incident response plan.
  • Check the work of the security team.
  • Segment the networks.

More information can be found at the Cybersecurity and Infrastructure Security Agency.

Cyberthreat Defense Report 2021

Leave a reply

CyberEdge Group has been conducting yearly surveys to IT security professionals all over the world. The latest one – 2021 Cyberthreat Defense Report – is a comprehensive review of the perceptions of 1,200 IT security professionals representing 17 countries and 19 industries.

The report has become a staple among security leaders and practitioners, helping them gauge their internal practices and security investments against those of their peers across different countries and industries.

Here are the key insights from the 2021 report:

  • A record 86% of organizations suffered from a successful cyberattack last year
  • A record 69% of organizations were compromised by ransomware
  • 57% of ransomware victims paid ransoms last year, but one-quarter (28%) of them failed to recover their data
  • Low employee awareness and lack of skilled personnel inhibit IT security’s success
  • 87% of organizations are experiencing a shortfall of skilled IT security personnel
  • The typical enterprise IT security budget increased 4% last year, but the rate of budget growth slowed for the first time in years
  • Four out of five respondents prefer security products that feature machine learning (ML) and artificial intelligence (AI) technology
  • The percentage of IT security applications and services are delivered from the cloud climbed from 36% to 41%

The report can be downloaded from the ISC2 site: https://www.isc2.org/-/media/ISC2/Research/Cyberthreat-Defense-Report/2021/CyberEdge-2021-CDR-Report-v10–ISC2-Edition.ashx

Source: 2021 Cyberthreat Defense Report, CyberEdge Group, LLC.

Secure Coding Practices

Leave a reply

Software developers are the backbones of creating secure software. The recently found vulnerability in Apache Log4j underscores the importance of developing secure software. Securing critical software resources is more important than ever as the focus of attackers has steadily moved toward the application layer. It is much less expensive to build secure software than to correct security issues after the software package has been completed, not to mention the costs that may be associated with a security breach.

OWASP has published a secure coding checklist that developers should follow:

  1. Input Validation
  2. Output Encoding
  3. Authentication and Password Management (includes secure handling of credentials by external services/scripts)
  4. Session Management
  5. Access Control
  6. Cryptographic Practices
  7. Error Handling and Logging
  8. Data Protection
  9. Communication Security
  10. System Configuration
  11. Database Security
  12. File Management
  13. Memory Management
  14. General Coding Practices

Reference:

https://owasp.org/www-pdf-archive/OWASP_SCP_Quick_Reference_Guide_v2.pdf

Updated CIS Controls Version 8

Leave a reply

One of the most adopted security frameworks is the CIS Controls (formerly known as Critical Security Controls). It has been updated in May of 2021 to keep up with the ever changing cybersecurity landscape. CIS Controls are a prioritized set of safeguards to mitigate the most prevalent cyber-attacks against systems and networks. They are recommended set of actions for cyber defense that provide specific and actionable ways to stop today’s most pervasive and dangerous attacks. Compared to the other security frameworks such as the NIST CSF (Cybersecurity Framework), CIS Controls are more prescriptive.

CIS Controls v8 has been enhanced to keep up with modern systems and software. Movement to cloud-based computing, virtualization, mobility, outsourcing, work-from-home, and changing attacker tactics prompted the update and supports an enterprise’s security as they move to both fully cloud and hybrid environments.

Here are the updated 18 CIS Controls:

  1. Inventory and Control of Enterprise Assets – Actively manage (inventory, track, and correct) all enterprise assets (end-user devices, including portable and mobile; network devices; non-computing/Internet of Things (IoT) devices; and servers) connected to the infrastructure physically, virtually, remotely, and those within cloud environments, to accurately know the totality of assets that need to be monitored and protected within the enterprise. This will also support identifying unauthorized and unmanaged assets to remove or remediate.
  2. Inventory and Control of Software Assets – Actively manage (inventory, track, and correct) all software (operating systems and applications) on the network so that only authorized software is installed and can execute, and that unauthorized and unmanaged software is found and prevented from installation or execution.
  3. Data Protection – Develop processes and technical controls to identify, classify, securely handle, retain, and dispose of data.
  4. Secure Configuration of Enterprise Assets and Software – Establish and maintain the secure configuration of enterprise assets (end-user devices, including portable and mobile; network devices; non-computing/IoT devices; and servers) and software (operating systems and applications).
  5. Account Management – Use processes and tools to assign and manage authorization to credentials for user accounts, including administrator accounts, as well as service accounts, to enterprise assets and software.
  6. Access Control Management – Use processes and tools to create, assign, manage, and revoke access credentials and privileges for user, administrator, and service accounts for enterprise assets and software.
  7. Continuous Vulnerability Management – Develop a plan to continuously assess and track vulnerabilities on all enterprise assets within the enterprise’s infrastructure, in order to remediate, and minimize, the window of opportunity for attackers. Monitor public and private industry sources for new threat and vulnerability information.
  8. Audit Log Management – Collect, alert, review, and retain audit logs of events that could help detect, understand, or recover from an attack.
  9. Email and Web Browser Protections – Improve protections and detections of threats from email and web vectors, as these are opportunities for attackers to manipulate human behavior through direct engagement.
  10. Malware Defenses – Prevent or control the installation, spread, and execution of malicious applications, code, or scripts on enterprise assets.
  11. Data Recovery – Establish and maintain data recovery practices sufficient to restore in-scope enterprise assets to a pre-incident and trusted state.
  12. Network Infrastructure Management – Establish, implement, and actively manage (track, report, correct) network devices, in order to prevent attackers from exploiting vulnerable network services and access points.
  13. Network Monitoring and Defense – Operate processes and tooling to establish and maintain comprehensive network monitoring and defense against security threats across the enterprise’s network infrastructure and user base.
  14. Security Awareness and Skills Training – Establish and maintain a security awareness program to influence behavior among the workforce to be security conscious and properly skilled to reduce cybersecurity risks to the enterprise.
  15. Service Provider Management – Develop a process to evaluate service providers who hold sensitive data, or are responsible for an enterprise’s critical IT platforms or processes, to ensure these providers are protecting those platforms and data appropriately.
  16. Application Software Security – Manage the security life cycle of in-house developed, hosted, or acquired software to prevent, detect, and remediate security weaknesses before they can impact the enterprise.
  17. Incident Response and Management – Establish a program to develop and maintain an incident response capability (e.g., policies, plans, procedures, defined roles, training, and communications) to prepare, detect, and quickly respond to an attack.
  18. Penetration Testing – Test the effectiveness and resiliency of enterprise assets through identifying and exploiting weaknesses in controls (people, processes, and technology), and simulating the objectives and actions of an attacker.

Sources:

https://www.sans.org/blog/cis-controls-v8/

https://www.cisecurity.org/controls/v8/

Updated OWASP Top 10 for 2021

Leave a reply

OWASP has updated its Top 10 list for 2021.

What is OWASP?

The Open Web Application Security Project (OWASP) is a non-profit foundation dedicated to improving the security of software. The Open Web Application Security Project® (OWASP) is a nonprofit foundation that works to improve the security of software. Through community-led open-source software projects, hundreds of local chapters worldwide, tens of thousands of members, and leading educational and training conferences, the OWASP Foundation is the source for developers and technologists to secure the web. OWASP is a repository of all things web-application-security, backed by the extensive knowledge and experience of its open community contributors.

What is the OWASP Top 10?

OWASP Top 10 is an online document on OWASP’s website that provides ranking of and remediation guidance for the top 10 most critical web application security risks. The report is based on a consensus among security experts from around the world. The risks are ranked and based on the frequency of discovered security defects, the severity of the vulnerabilities, and the magnitude of their potential impacts. The purpose of the report is to offer developers and web application security professionals insight into the most prevalent security risks so that they may incorporate the report’s findings and recommendations into their security practices, thereby minimizing the presence of these known risks in their applications.

Here’s the updated 2021 Top 10 list:

  • A01:2021-Broken Access Control moves up from the fifth position to the category with the most serious web application security risk; the contributed data indicates that on average, 3.81% of applications tested had one or more Common Weakness Enumerations (CWEs) with more than 318k occurrences of CWEs in this risk category. The 34 CWEs mapped to Broken Access Control had more occurrences in applications than any other category.
  • A02:2021-Cryptographic Failures shifts up one position to #2, previously known as A3:2017-Sensitive Data Exposure, which was broad symptom rather than a root cause. The renewed name focuses on failures related to cryptography as it has been implicitly before. This category often leads to sensitive data exposure or system compromise.
  • A03:2021-Injection slides down to the third position. 94% of the applications were tested for some form of injection with a max incidence rate of 19%, an average incidence rate of 3.37%, and the 33 CWEs mapped into this category have the second most occurrences in applications with 274k occurrences. Cross-site Scripting is now part of this category in this edition.
  • A04:2021-Insecure Design is a new category for 2021, with a focus on risks related to design flaws. If we genuinely want to “move left” as an industry, we need more threat modeling, secure design patterns and principles, and reference architectures. An insecure design cannot be fixed by a perfect implementation as by definition, needed security controls were never created to defend against specific attacks.
  • A05:2021-Security Misconfiguration moves up from #6 in the previous edition; 90% of applications were tested for some form of misconfiguration, with an average incidence rate of 4.5%, and over 208k occurrences of CWEs mapped to this risk category. With more shifts into highly configurable software, it’s not surprising to see this category move up. The former category for A4:2017-XML External Entities (XXE) is now part of this risk category.
  • A06:2021-Vulnerable and Outdated Components was previously titled Using Components with Known Vulnerabilities and is #2 in the Top 10 community survey, but also had enough data to make the Top 10 via data analysis. This category moves up from #9 in 2017 and is a known issue that we struggle to test and assess risk. It is the only category not to have any Common Vulnerability and Exposures (CVEs) mapped to the included CWEs, so a default exploit and impact weights of 5.0 are factored into their scores.
  • A07:2021-Identification and Authentication Failures was previously Broken Authentication and is sliding down from the second position, and now includes CWEs that are more related to identification failures. This category is still an integral part of the Top 10, but the increased availability of standardized frameworks seems to be helping.
  • A08:2021-Software and Data Integrity Failures is a new category for 2021, focusing on making assumptions related to software updates, critical data, and CI/CD pipelines without verifying integrity. One of the highest weighted impacts from Common Vulnerability and Exposures/Common Vulnerability Scoring System (CVE/CVSS) data mapped to the 10 CWEs in this category. A8:2017-Insecure Deserialization is now a part of this larger category.
  • A09:2021-Security Logging and Monitoring Failures was previously A10:2017-Insufficient Logging & Monitoring and is added from the Top 10 community survey (#3), moving up from #10 previously. This category is expanded to include more types of failures, is challenging to test for, and isn’t well represented in the CVE/CVSS data. However, failures in this category can directly impact visibility, incident alerting, and forensics.
  • A10:2021-Server-Side Request Forgery is added from the Top 10 community survey (#1). The data shows a relatively low incidence rate with above average testing coverage, along with above-average ratings for Exploit and Impact potential. This category represents the scenario where the security community members are telling us this is important, even though it’s not illustrated in the data at this time.

Sources:

https://owasp.org/Top10/

https://www.synopsys.com/glossary/what-is-owasp-top-10.html

Partnering with the Business to Improve Your Company’s Security

Leave a reply

The string of high profile ransomware attacks on major companies has led executives and boards to take security seriously. In the past, spending money on security is a hard sell and security folks often resort to using the FUD factor (fear, uncertainty and doubt) to implement security projects. Now, they are realizing the importance of security to avoid major disruptions and keep the business going.

For security folks, this is the best time to forge the partnership with the business. You should define strategic directions for both the business and security. Map out a high high-level path to get from current to future objectives as well as identify organizational
roadblocks, standards/policy challenges, and business goals. This is not a one and done thing. Continue to collaborate and have an ongoing discussion to maintain the relationship and to determine if things have changed such as new strategies.

Security folks must understand the business value. Work closely with them to strike the appropriate balance for risk acceptance, and make sure the risk is stated in the context of business objectives.

While you have the attention of the business, do not squander this opportunity.

Securing Your Data on AWS S3

Leave a reply

If you store critical and sensitive data on the cloud, particularly on AWS S3 object storage, it is important that you continually protect and monitor your data. Fortunately, AWS has a lot of tools to help you secure them. AWS built their services with security in mind. However, it is still your responsibility as a data owner to protect your data.

Here are the top ten best practices for securing your data on AWS S3:

  1. Ensure that your S3 buckets are not publicly accessible by using Amazon S3 block public access.
  2. Ensure that your S3 buckets have the correct policies. Use Amazon S3 bucket policy and IAM user policy, as well as the bucket access control list (ACL) to implement effective permissions on the buckets. Make sure to implement least privilege access, granting only minimal rights for users to get their jobs done.
  3. Encrypt data at rest on the server side using Amazon S3 managed keys (SSE-S3), customer master keys stored in AWS Key Management Service (SSE-KMS), or customer-provided keys (SSE-C). You can also encrypt your data on the client side before uploading to AWS S3.
  4. Encrypt data in transit using HTTPS (TLS). You can enforce this by setting it in the Amazon S3 bucket policies.
  5. Enable and require VPC endpoints for AWS S3 access. A VPC endpoint can help prevent traffic from potentially traversing the open internet and being subject to the open internet environment.
  6. Enable versioning to keep multiple versions of a file in the same bucket. With versioning, you can easily recover files from both unintended user actions and application failures.
  7. Use cross-region replication (CRR) to replicate your data to a different AWS region, thereby increasing data resiliency.
  8. Enable multi factor authentication (MFA) Delete and S3 Object Lock feature to prevent malicious or accidental bucket deletions.
  9. Continually monitor and audit your S3 buckets by using AWS tools such as Cloudwatch, Cloudtrail, S3 access logging, and AWS Config.
  10. Use AWS Access Analyzer for S3 to quickly analyze resource policies, continuously monitor and analyze permissions, and resolve findings by updating policies.

Reference: https://docs.aws.amazon.com/AmazonS3/latest/userguide/security-best-practices.html

Disaster Recovery Site vs Cyber Recovery Site

Leave a reply

While the ultimate goal of both Disaster Recovery (DR) and Cyber Recovery(CR) is the same, to bring your IT services back online after an event, DR and CR differ in many ways. DR protects against physical disasters (such as flooding, earthquake, fire, terrorist attacks), user errors, and hardware malfunctions, while CR protects against cyber attacks.

Because of these differences, a DR site may not be able to provide the necessary function for restoring systems after a cyber attack. A Cyber Recovery site is needed to recover your systems from a cyber attack. A CR site is a vaulted site, containing replicated data of critical systems. It is isolated from the network and only connects during replication. A CR site doesn’t have to be in a geographically separate location (unlike a DR site), but it should be physically secured. In fact, it will be beneficial if it’s close to the primary Data Center to take advantage of a fast network connection.

DR usually supports most of the business operations (since disasters are usually bigger in magnitude), whereas CR supports only the most critical systems for operational recovery.

While IT admins have access to a DR site, a CR site should be restricted to a few select security folks.

Usually a DR site is also dormant, but a CR site will always have monitoring and analytics tool – checking for security breaches.

Many companies with mature IT infrastructure typically have a DR site. They also conduct regular DR tests. But most do not have a Cyber Recovery site yet. With the prevalence of cyber security attacks, it is high time for companies to install Cyber Recovery sites and conduct regular cyber recovery tests.

Checklist for a Secure Backup Infrastructure

Leave a reply

Ramsomware attacks are running rampant these days. The ability to restore your servers, data and applications after an attack is critical to minimize costly disruption and bring your business back in service.

A secure backup infrastructure is key to this. Here’s a checklist on how to keep your backup systems robust and secure:

  1. Backup and retain data for several weeks. For critical systems, you will know right away if they have been compromised. But some may take days or weeks before you know you have been attacked or get a demand for payment from attackers. It’s better to have retained good copies of backup to restore.
  2. Replicate backup to an offsite location.
  3. Conduct regular file recovery and bare metal recovery tests.
  4. Perform regular patching and upgrade of backup devices. You also need to work with your device vendor to discuss vulnerabilities, monitor security advisories and apply critical security patches as soon as possible.
  5. Harden your backup infrastructure, for instance by replacing default passwords and turning off unneeded services.
  6. Implement data-at-rest and data-in-flight encryption.
  7. Monitor and send alerts for unusual activities such as privileged user multiple login attempts as well as backup deletion attempts. You can integrate with Splunk, CyberSense or other security analytics applications that have advance AI technology to easily monitor, detect, and analyze security breaches.
  8. Recertify user accounts on your backup devices periodically.
  9. Use security tool to store and encrypt local and service accounts passwords on the devices.
  10. Use two factor authentication.
  11. Implement Retention Lock.
  12. Implement backup vault by isolating the second copies of the backup. This can be done by using tapes or air gapping the backup storage.