Cyber Security Business | Jul 31, 2014
Mike Lloyd, CTO of RedSeal Networks, stated to TechNewsWorld: “Many organizations have been in denial for too long … Many industries are loved by the public and can lapse into thinking they don’t have enemies, and so don’t really need to worry about security.”
The discussion of cyber security is finding its way into the board room. Everyone has read about a breach like the ones at Target, or Neiman Marcus, or Sony. They also probably now have the word “Heartbleed” in their lexicon whereas six months ago most people would have thought this was a medical condition. Directors surely must be thinking about whether this could happen to them and what they should do. Just framing the discussion is often difficult because people simply have little or no background. They need to know what is going on and what the risks to the company are.
The first interested director is probably the chair of the audit committee. She or he should be active in asking key questions about security, processes, and what operationally is being done. This is no different than asking if procedures for check signing are set up and being managed, or about how the shrinkage in retail or warehouse operations is being managed and monitored. Cyber security has a complete parallel to these issues.
Of course I can’t speak for every board of directors, but a couple of companies on whose boards I serve have a line item on the agenda – usually during the audit committee report – to discuss cyber. Regrettably, the discussion usually lasts less than five minutes even though the headlines in the newspaper are full of corporate issues around being breached. I can’t tell if it is a lack of appreciation of how serious the problem is, or if there is even a real problem. I can’t tell if it is one of those “if I don’t ask, then I don’t have to know” problems. Solving any problem first requires acknowledgement of the problem. And the cyber attack problem is getting top billing in the news, just not in the board room.
Ask yourself, does the CEO get a report on cyber security, just like s/he gets a P&L or sales report? Cyber is dynamic, and it’s a constantly changing front of action, just like sales. Unfortunately, this is now part of every business and it takes away from business. But I bet it’ll take much less away than a full breach.
Today, TrendMicro announced their discovery of Emmental, proof that “…online banking may be full of holes.” The focus of the attack is on users of online banking, and it, like many of the current attacks, starts with a phishing attack on consumers. The New York Times Bits Blog covered the report, as well, providing a high-level view of the attack on two-factor authentication used by many online financial sites.
This attack unimagederscores two vital truths:
In Emmental, the cyber-criminals used the combination of fear for their finances and trust of consumer brands to convince consumers to open attachments and visit financial sites that had been created to capture their usernames, passwords, and PINs. The holes exploited in this process are many, including email systems, operating systems, web browsers, and the wide variety of multi-factor authentication in use.
It can be easy for enterprise technology specialists to write this off as simple error on the part of the unwashed consumer masses. Yet, these issues and truths exist within enterprise environments, and we see this consistently: simple typos and conceptual errors in device configurations lead to violations of security policy and potential breach paths, misunderstandings of policy intentions result in open access, and IT organizations trust more widely than is prudent.
How do you protect your enterprise from these risks while recognizing these two vital truths?
It’s unthinkable: hackers targeting that sacrosanct American institution, the sports team? The recent incident in which the Houston Astros’ internal trade discussion were hacked and posted on the Internet shows that, today, no target is off limits. Jeff Luhnow, GM for the Astros, was quite right when he said: 
“It’s a reflection of the age we living in. People are always trying to steal information” The main problem that encourages this kind of illegal activity is that it’s really relatively easy. Nobody thinks the hacker who stole the information from the Astros was heavily funded by a foreign government, or anything like that. Indeed, it’s quite possible the person or people involved had no more motivation than curiosity, and found it easy to get in. The challenge, of course, is that every business has secrets – how it approaches negotiation, or the pricelist for its upcoming products, or its next quarter of advertising plans. All that information is useful to others if it’s exposed. Many businesses like the Astros have treated IT security as a “high end” problem – something for banks, the military, or energy companies to worry about. But it’s just not possible to operate that way anymore – the risk of corporate embarrassment, or worse, is escalating. Attackers are finding our complex defenses are badly deployed, badly coordinated, and easy to walk through. All the attacker needs is persistence, and the search for a forgotten, unlocked “side door” onto the business can be largely automated. Defenders need to understand all the gaps, and how all the security defenses work together, even if their only target is “good enough” security. As the Astros have found, the standards of “good enough” are rising rapidly.
I would like to offer my congratulations to the private and public entities that participated in the recent investigation and arrests of cyber criminals in New York City, Ontario, Canada, and London, United Kingdom. A tremendous amount of hard work and dedication from all parties is required to successfully dismantle an international criminal enterprise. The success we witnessed this morning should be used as the gold standard upon which future collaboration between private companies and the International law enforcement community are modeled.
Collaboration at this scale is required to turn the tables on cyber criminals. The impact of today’s events should not be underestimated: this is bigger than any individual arrest. The global law enforcement community has sent a strong message to the individuals who commit these crimes – You are no longer safe to travel and operate outside of your home country, without significant risk of arrest and prosecution. Isolation is a powerful force in the effort to change behaviors. Confined within the borders of their home countries, I suspect we’ll see a change in behavior on the part of some of these criminals.
Continued success with prosecutions will have a lasting effect on cyber criminal behavior… but it is not a silver bullet. Cyber attacks and data breaches are still way too easy for attackers with even a moderate level of skill. We must continue working to make our systems and economy more resilient to attack.
I recently joined RedSeal Networks to work on this specific problem, making it easier for network owners to protect their assets and defend against intrusion and data breach. I’m looking forward to the coming months when we share more of our plan to make network security something that we aren’t just striving to attain, but something we actually have in our toolkit to counter cyber threats.
Security Week | Jul 23, 2014
“The global law enforcement community has sent a strong message to the individuals that commit these crimes,” said Robert Capps, senior director of customer success at RedSeal Networks and former head of global trust and safety for StubHub.
Breached! This is the new watchword in the executive office suite these days. Ever since Brian Krebs revealed to the world that Target had been breached, every company is on notice. While the primary role of the CEO is revenue and growth, there are a host of other activities that support revenue and growth. Namely, the company’s employees and its data infrastructure are critically important for every company. But what about the network?
Having been an investor in network infrastructure for a couple of decades, I know chances are very high that your company’s network has been built over decades, by scores of people of varying skill levels. Chances are your network is very complex, beyond what any person or team can truly understand. Chances are your network runs your business more than you really appreciate, and without it your business would stop. It’s just as important as your manufacturing and supply chain, or your service centers, or your employees. The network is a strategic asset of the corporation.
This was brought home in a powerful way when I recently attended a cyber security meeting in London. In addition to briefings with a number of industry analysts, this meeting also included a panel discussion with about 15 CISOs from various industries like finance, not-for-profit, publishing, media, banking, and manufacturing. To a person these CISOs said two things. First, their greatest need was skilled personal to run their networks. Second, their senior management was asking questions about not “if” they were breached but what they would do “when” they were breached. This shift in attitude, driven by all the news in recent years about breaches at large, household-name companies, was an “ah ha” moment for me.
Your company will be breached, or you will fall victim to some other network crime. As CEO, you must prepare yourself for these events. A lot can be done to prevent most breaches, and to be prepared when one inevitably does happen. It starts by knowing just how your network is built and operated. As trite a statement as it is, the truth of the matter is this: If you don’t know how your network is built, how can you possibly secure it?
Have you asked your CISO what the plan of action is when a cyber attack is successful? Does your board understand the liability of a successful attack? Regrettably, it is a matter of when, not if.
eSecurity Planet | Jul 22, 2014
“Sophisticated code like Gyges was created for a specific purpose by what appears to be a government agency, and it should have remained within the control of that agency,” RedSeal Networks Federal CTO Brandon Hoffman said by email.
Google’s move to set up Project Zero is very welcome. The infrastructure on which we run our businesses and our lives is showing its fragile nature as each new, successful attack is disclosed. 
Unfortunately, we all share significant risks, not least because IT tends towards “monoculture”, with only a few major pieces of hardware and software being used most of the time. Organizations use the common equipment because it’s cheaper, because it’s better understood by staff, and because we all tend to do what we see our neighbors doing. These upsides come at a cost, though – it means attackers can find a single defect, and it can open thousands or even millions of doors, as we recently saw with Heartbleed. This situation isn’t likely to change soon, so it’s welcome news whenever there are more eyes on the problem, trying to find and disclose defects before attackers do.
Attacks proliferate rapidly – very rapidly, in a quite robust market for newly found, highly effective vulnerabilities. As they do so, it has become crystal clear that traditional passive, reactive methods of defense are insufficient. Google’s investment underscores the critical importance of proactive analysis of potential attack vectors. Any organization that is not developing a set of defenses from proactive analysis through reactive defenses is leaving the door open to attacks. Defenders need ways to automate – to pick up all the discoveries as they are found by the “good guys”, so they can assess their own risk and keep up with remediation. Recent incidents like Code Spaces and Target make clear that the health of enterprises and the careers of their executives are at stake; just expecting defenses to hold without some way to automate validation is not tenable. Hope is not a strategy.
On an autumn day in 2008 while I was an active, practicing journalist, I sat in my office and interviewed Todd Davis, CEO of LifeLock for my article on scanning the underbelly of the web. Todd is perhaps best known for appearing in ubiquitous advertising and broadcasting his Social Security Number. At the time, it was becoming clear that online threats to identity theft were growing dramatically, and they were introducing their new service to help their customers avoid appropriation of their identity online.
We’ve come a long way since then. So far, in fact, that the NSA has change their strategy in a way that should send a shiver down the back of everyone responsible for enterprise security: They have switched to assuming that security has been compromised.
Let that settle for a moment. The NSA, the organization most responsible for understanding the cyber-security stance of the United States, its allies, and other countries and organizations worldwide has changed its approach to an assumption of breach.
As I noted in Inside the Mind of an Attacker and Inside the Mind of an Attacker (Pt 2), the motivation and environment of attackers has changed. Now, those with the greatest amount of information are agreeing that the situation has shifted.
With more than 100 foreign intelligence agencies targeting assets plus a likely greater number of criminal organizations, you need to decide how you are going to defend against this new environment. What tools and approach will you use once you recognize that evil actors are in your network? What does defense mean with this mindset?
What’s your answer?