Posts

Cyber Hygiene And Digital Resilience To Withstand A Cyber Attack

ITSP Magazine | October 25, 2018

By Wayne Lloyd, RedSeal Federal CTO

After both the first and second Gulf wars, nation states such as North Korea, Iran, China and others came to the same conclusion: under no circumstances get into a shooting war with the United States military. The sole superpower in the world had a military so advanced and superior on the battlefield it left little doubt about the outcome.

CDM Designed to Help Federal Agencies Understand Risk Posture and Become Digitally Resilient

Government Technology Insider | October 24, 2018

The goal of the Continuous Diagnostics and Mitigation (CDM) Program is for all civilian agencies included in the program under the Chief Financial Officers’ (CFO) Act to feed data to the federal government-wide cybersecurity threat dashboard. With each individual agency’s information compiled, the dashboard consolidates threat information from individual agency feeds to give an overall understanding of the cyber risks facing civilian agencies and enables them to prioritize the most critical issues. 

Is AI Resilient Enough for Security?

SIGNAL Magazine | October 22, 2018

By Dr. Mike Lloyd, RedSeal CTO

Machines need to be hard to fool and reliable under pressure.

Artificial intelligence can be surprisingly fragile. This is especially true in cybersecurity, where AI is touted as the solution to our chronic staffing shortage.

It seems logical. Cybersecurity is awash in data, as our sensors pump facts into our data lakes at staggering rates, while wily adversaries have learned how to hide in plain sight. We have to filter the signal from all that noise. Security has the trifecta of too few people, too much data and a need to find things in that vast data lake. This sounds ideal for AI.

If You Protect Everything, Are You Protecting Anything?

Government Technology Insider | October 12, 2018

With Nate Cash, Senior Network Security Engineer

For decades, cybersecurity professionals have been tasked with protecting organizational IT assets, whether hardware, software, systems, or data. But have they been setting priorities for cybersecurity?

This is a monumental task, especially when the technology environment not only continues to change but is accelerating – just look at the spread of the Internet of Things. IT folks may be told to protect “everything,” but they know it’s an impossible task. They don’t have unlimited resources, after all.

In particular, organizations suffer from a skills gap.

RedSeal and DHS CISO’s Current Priorities

In early August, at MeriTalk’s Cyber Security Brainstorm, Paul Beckman, chief information security officer (CISO) at the Department of Homeland Security (DHS), said that his biggest new priorities are:

  • Increasing use of software-defined networking (SDN)
  • Adopting a zero-trust model
  • Optimizing DHS’ security operations centers (SOC)

He added that the ability to leverage micro segmentation in cloud or SDNs is an efficient way to provide network data security services.

Which is true to an extent.

Unfortunately, Mr. Beckman puts too much trust in SDN security. If that word “software” does not concern you, then you are not thinking about the problem hard enough.  Humans make and deploy software and humans make mistakes, even in something called “software-defined.” They often don’t see what’s exposed as they build out their architecture. They may have intended to have something segmented and not realize it isn’t.

SDNs grow and change quickly. An equally agile modeling solution can ensure that any mistakes are caught and fixed rapidly. There can easily be millions of rules to check as workloads spin up and down too fast for any human to keep up. RedSeal will validate all your security rules over time to ensure that configuration drift doesn’t cause segmentation violations.

Agencies can create risks, too, by making multiple changes over time without comprehending the combined effect those changes have on end-to-end security. This problem is exacerbated by SDNs because of the ease and speed of change they offer. To reduce the risks and realize the true power of SDNs, agile change control should be part of your approval process. This will allow you to model changes at machine speed to see exactly what effect a change will have on end-to-end security.

Added to architecture, updating and workflow issues, is the fact that most SDNs exist in hybrid data center environments, connected to other SDNs, public clouds and physical assets. RedSeal’s model of your network includes all your environments, so you can see access between and within each one. While I agree that SDNs are an improvement on the earlier way of providing security services, they are not a silver bullet.

Mr. Beckman also said, “One of the things that I think we are, as an IT organization, going to be evolving to, is that zero-trust model. Traditionally the perimeter was your primary means of defense, but once you got into the squishy center, you were generally a trusted entity. That needs to go away.”

With zero trust, he said that you need to authenticate everything a user is trying to access inside the perimeter. It’s a great idea for any organization to trust no one on the inside of a network and make them prove they’re authorized to be there. But what happens when credentials are compromised? It is harder to do today, after implementation of two factor authentication procedures and password managers, but not impossible. Hackers still find a way.

Lastly, Mr. Beckman wants to consolidate 16 independent SOCs into four or five centers operating in a “SOC-as-a-service” format. These kinds of consolidation efforts have happened before. The government has put a lot of effort into merging SOCs, only to have them split apart again due to performance issues or mission requirements.

What is new and admirable is a focus on grading the performance of each individual SOC. Identifying poor performers and merging them with high-scoring SOCs seems like a logical way to take advantage of the limited numbers of highly skilled security professionals and improve outcomes. Again, this sounds good in theory. We will see how it works in real life environments.

For more information about how RedSeal meets the DHS’s highest priorities this year, visit our website at: www.redseal.net/government.

Cyber Protection Team Workshop

Recently, I was privileged to spend half a day with some of our nation’s finest cyber warriors at a RedSeal workshop. Early in the morning, members of various DoD Cyber Protection Teams (CPTs) gathered around a u-shaped table in Columbia, Maryland.

The workshop showcases how CPTs use RedSeal every day to secure cyber terrain and support the warfighter’s mission. This was the fourth workshop that RedSeal has organized this year.

RedSeal in a simulated real world mission environment

The workshop’s mission concept is to validate that a secure network for a THAAD antimissile battalion had been deployed in South Korea. For the workshop, we say that an initial network survey has been completed on the deployed THAAD system and we are in phase two of a CPT mission called Secure. In this phase, the teams must verify that the network — primarily the key battery line IT systems — is secure.

Further, verifying that the THAAD system’s key cyber terrain is secure is of paramount importance to protect alliance forces in South Korea. Intelligence indicates a high probability of a kinetic war breaking out on the Korean peninsula soon. Cyber activity penetrating military C2 and civilian infrastructure would be a precursor to a shooting war.

RedSeal for Network Mapping and Automation

First, the attendees are shown how RedSeal ingests all the network information in a matter of hours, using configuration files. Everyone could see that manually attempting this process would be a time-consuming folly. It would take years to scan thousands of lines of code in each config file, multiplied by hundreds and thousands of devices.

RedSeal automates this process for CPTs and generates an accurate, up-to-date network model.

Second, the attendees are shown that RedSeal’s network topology map is not static but can be moved around and adjusted. All the network information can be organized into an easy and clear graphic representation of the devices and how they connect with each other.

When attendees ask if this is a scanning tool that will jam up their networks, we explain that there isn’t any scanning at all.

Then, we show detailed path results that look like a subway map of connected devices. One attendee said, “RedSeal shows me all the hops on the path from device to device.”

Visualizing cyber terrain serves an important role. CPTs often find themselves in debates with network operators about the significance of vulnerabilities. RedSeal provides a single source of truth that everyone can agree on.

Another attendee commented, “Now that I’m done worrying about access control, I’m worrying about threats. I can focus on higher level questions like, how are they using payloads against us?”

We discuss the value of using RedSeal to make higher-level informed decisions and to create hypotheticals around changes to the network. This allows accurate risk management of proposed network changes, even “temporary” changes.

RedSeal has been deployed successfully by active CPTs in every service branch. Our team looks forward to supporting each and every CPT as it conducts its important mission.

Want to learn more about RedSeal’s support of CPTs and how it will improve your agency’s digital resilience? Click here to set up your free trial of RedSeal and choose the better way.

RedSeal and DHS CDM DEFEND

This year, the big news in government cybersecurity is the DHS CDM DEFEND program and task orders being announced by various federal departments. The DHS CDM DEFEND, which stands for Continuous Diagnostics and Mitigation (CDM) Dynamic and Evolving Federal Enterprise Network Defense, task orders are awarded under the General Services Administration’s Alliant 1 Unrestricted contract. GSA and the Department of Homeland Security (DHS) jointly run CDM to secure civilian agency “.gov” networks from cyber attacks.

RedSeal and Government Cybersecurity

RedSeal has a history of support for federal government cybersecurity initiatives. The company’s network modeling and risk scoring platform is installed in numerous defense, intelligence, and civilian organizations for continuous monitoring.

At the highest level, RedSeal delivers three core security controls:

  • Visibility: Automated network mapping and situational awareness
  • Verification: Continuous comparison of network security architecture against desired posture
  • Prioritization: Analysis of vulnerability scan data and network architecture to identify the highest risk vulnerabilities that must be remediated immediately

These controls apply to both legacy deployments and new architectures. In legacy deployments, RedSeal allows you to understand the existing environment and identify security control gaps. In new architectures, RedSeal validates that the network is built and operated as designed. And in all situations, RedSeal increases the value of scanning and penetration testing by prioritizing those vulnerabilities that are the most dangerous cybersecurity threats – based on how each network is put together.

The objective of the DHS CDM DEFEND program is to discover, assess and plan for 100% agency network coverage and provide context for prioritizing the closure of coverage gaps. Winners of task orders must discover all networked assets in an agency – including perimeter, cloud and mobile environments. Plus, they must develop a plan to protect all environments within six months of work commencing, and on a continuous basis after implementation. What’s more, merely visualizing what’s on the network isn’t enough, but vendors must prioritize fixing the worst problems first.


How Does RedSeal Fit with DHS CDM DEFEND Solution Requirements?

RedSeal supports six of the eight DHS CDM DEFEND solution requirements.

Hardware Asset Management: RedSeal’s complete network map and network device inventory provides a framework for hardware inventory processes and discovery. The solution also provides a complete inventory of in-scope Layer 2 and Layer 3 network devices.

Configuration Settings Management: RedSeal automatically analyzes individual device configurations to see if they are secure. This includes password policies for firewalls, routers, load balancers, and wireless controllers, services enabled, logical port configurations, and networking parameters. You can also create custom checks and be notified automatically about any deviations from baselines.

Vulnerability Management: At the highest level, vulnerability management consists of two tasks: vulnerability scanning and remediation. RedSeal can determine if you have any gaps in your vulnerability scan coverage and identify the device blocking it. In addition, RedSeal has a unique ability to prioritize remediation by identifying the vulnerabilities that pose the highest risk—in each network. RedSeal combines results from top scanners (such as Rapid7 InsightVM, Tenable Nessus, and Qualys) and centralizes scoring and prioritization. Then, it overlays its detailed knowledge of all network paths to prioritize the specific systems and vulnerabilities that could be used to do the most damage if they were exploited. Without this, organizations waste huge amounts of time remediating “high priority” vulnerabilities that could wait, because the potential damage from an exploit is very limited. And they ignore “low priority” vulnerabilities that are actually dangerous because they can be used to pivot into higher value targets in a network.

Boundary Protection: Effective boundary protections are typically based on network architecture and access policies on routers, switches and firewalls. In practice, it is extremely difficult to operationalize this control, especially in multi-vendor environments. However, RedSeal Is able to analyze networks continuously and evaluate possible connectivity against desired policy. This enables even the largest organizations to implement boundary protections on multi-vendor networks in an operationally efficient manner. And this, in turn, makes it realistic to implement multi-layer segmentation policies, where assets can be isolated from the rest of the internal network to better protect sensitive data, and limit the ability of malware to spread after initial compromise.

Incident Response: Many information sources and technical disciplines must work in concert for effective incident response. Once an indicator of compromise is identified by a SIEM, RedSeal brings network topology and reachability information to help determine how significant the risk is and what systems may be at risk. Normally this is a manual and time-consuming process, relying on traceroutes and network maps that are often out of date. Staff must comb through configurations to piece together the potential malware exploit paths. This delays an organization’s ability to respond appropriately to the event, increasing both risk and the eventual overall damage. RedSeal automates this entire network investigation process, providing incident response teams with accurate information about network exploitation paths so their response can be quicker and more focused.

 

  RedSeal Capabilities
CDM DEFEND Requirements Hardware Config Vuln Mgmt Boundary Response
Rapid Assessment Yes Yes Yes
Boundary Architecture Changes Yes Yes Yes Yes
Evaluate multiple CDM states Yes
Vuln Mgmt and Triage Yes Yes Yes Yes Yes
Change Control & L2/L3 Auditing Yes Yes Yes Yes
Incident Response Yes Yes Yes Yes

 

Summary

The federal government’s DHS CDM DEFEND program is a response to today’s cybersecurity reality. By encouraging organizations to rely less on auditing static preventive measures but instead on implementing CDM, the program better positions agencies to ensure their defenses are well established at all times. The program also encourages agencies to put in place procedures to detect, evaluate, and respond to incidents, no matter when they occur.

RedSeal provides a substantial contribution to the CDM framework by delivering a unique control set for boundary protection, situational awareness, vulnerability mitigation prioritization, and configuration management.

RedSeal is a “must-have” part of any CDM team currently bidding for DHS CDM DEFEND task orders.

Want to learn more about RedSeal’s integration with cybersecurity tools and its integral part of any CDM program? Click here to connect with RedSeal today.

The Only Cybersecurity Metric That Matters for Digital Resilience

While the focus on cybersecurity has never been higher, the cybersecurity community – a combined team of solution providers, CISOs, boards and others– haven’t been able to stop most attacks from being successful.

Why?

We have focused too much of our efforts on network perimeters, working to detect and prevent cyber attacks. We haven’t done enough to build resilience INSIDE the network, the part of the equation we can control and quantify with a security metric.

Organizations need to build resilience into their infrastructures and adopt an end-end digital resilience strategy to survive and thrive.

How big is the problem? There are 1400+ vendors focused on cybersecurity. Nearly $100B was spent on information security just in 2016. Yet billions of records have been compromised.

The reason is we have not addressed fundamental issues inside the network. Companies need to build resilience into their infrastructure and adopt a corporate-wide digital resilience strategy with a corporate-wide security metric.

A few years back, RedSeal gathered 800 surveys during the RSA Conference. We learned that:

  • Practitioners are drowning in data
  • They can’t measure the performance or impact of their security efforts
  • Current solutions can’t turn data into action
  • They need useful cybersecurity metrics

The problem with measuring security is that security is the absence of something. You can’t report how often you were NOT on the cover of Washington Post. Many people start by counting what they are doing. But this measures busy-ness, not business. How can you show actual improvements in cybersecurity?

The Shifting Terrain and Digital Resilience

According to the 2016 TechCrunch CIO Report, 82% of global IT leaders report significant labor shortages in cybersecurity. This, combined with issues such as software defined everything, digital transformation, hybrid datacenters, IoT, and shadow IT, means a big shift in thinking is required. We don’t have enough people to throw at the problem.

Digital resilience is a comprehensive strategy across all IT functions and business processes to minimize the impact of cyber attacks and network interruptions. It’s a different way of thinking.  Being resilient means simultaneously striving to minimize each attack and being able to recover quickly from a strike. Resilient organizations have fewer, smaller incidents, understand and respond to them faster, and can rapidly return to normal operations afterwards.

It’s not enough to see the devices in your “as-built” infrastructure – you have to really understand how they are configured and automatically get a list of vulnerabilities.

And that list of vulnerabilities is a problem; there are too many to act on. Even knowing asset value and vulnerability severity aren’t enough to fully understand the risk. You need to understand if they can be accessed. A high value asset with a vulnerability that is segmented behind a firewall is not as big a risk as one that is slightly lower in value, but has an open path to the internet.

RedSeal’s Digital Resilience Score

Resilient organizations must focus on three main areas—being hard to hit, being ready for an attack when it comes, and being able to recover quickly.

RedSeal helps these organizations identify defensive gaps, run continuous penetration tests to measure readiness, and map their entire network infrastructure.

From these capabilities, RedSeal calculates one unified number, so managers, boards of directors and executive management have the understandable and actionable cybersecurity metric they need to drive towards digital resilience.

RedSeal’s Digital Resilience Score focuses on three essential questions:

  • Do you have defects that are easy to hit? RedSeal evaluates how weaknesses from incorrectly configured devices and third-party software could impact you.
  • Can an attacker reach your valuable assets? RedSeal evaluates how well your network is structured, identifying attack pathways and chains of vulnerability that reduce your ability to withstand and recover from attack.
  • Is your network understanding complete? By identifying previously unknown parts of your network, RedSeal evaluates how well you know what your digital infrastructure looks like. With a complete picture, you can be sure you’re managing all assets on your network. During an attack, you’ll be able to understand where an attacker can reach. And, you’ll be able to recover much more quickly.

Instead of getting stuck in an ineffective focus on measuring activity, resilient organizations use RedSeal’s Digital Resilience Score (DRS). This cybersecurity metric works like a creditworthiness score, deducting pointing for defensive gaps, weaknesses revealed by attack simulations, and blind spots in your network awareness. A higher score means there is a higher likelihood that your business can withstand an incident and keep running.

It’s the cybersecurity metric that matters for digital resilience.

Why agencies are shifting from cyberdefense to digital resilience

FedScoop | June 26, 2018

RedSeal CEO Ray Rothrock said that achieving digital resilience begins when you know about your networks — “where they connect, how they connect, to whom they give access, and what they expose.”

According to Rothrock, there are specific steps agencies should take to improve resilience:

U.S. Department of Defense Information Network (DoDIN) Supports Digital Resilience by Adding RedSeal Platform to its Approved Products List (APL)

Thorough testing from Joint Interoperability Test Command (JTIC) and DoD Interoperability (IO) certifies RedSeal is secure, trusted and approved to model and monitor U.S. Army, Navy, Air Force, Marine Corps and DISA networks

SUNNYVALE, Calif., June 18, 2018 – RedSeal (www.redseal.net), the leader in network modeling and cyber risk scoring, today announced that the Defense Information Systems Agency (DISA) added its RedSeal platform to the Department of Defense (DoD) Unified Capabilities (UC) Approved Products List (APL). RedSeal is now certified to model and monitor any network within the DoD infrastructure, including those of the U.S. Army, Navy, Air Force, Marine Corps and DISA.

RedSeal’s patented platform models and continuously monitors network infrastructure, providing visibility into network segmentation, as well as a measure of overall resiliency, to deliver risk-based situational awareness. The Joint Interoperability Test Command (JTIC) and the DoD Interoperability (IO) certifying authority issued its approval, confirming RedSeal meets all Common Criteria and FIPS 140-2 certification to achieve its place on the UC APL, the DoD’s master list of secure and approved products for deployment within the DoD’s infrastructure.

Due to the DoD’s extensive criteria – which also includes IA and STIG testing – federal agencies and Global 2000 companies often look to the DoDIN APL for the best technology. Currently, RedSeal is the only certified product that creates a network model from the inside out, including physical assets, as well as those in public and private cloud environments.

This certification stems from a $33.8 million multi-year contract DISA awarded to RedSeal in January 2017, to model and continuously monitor the infrastructure of the Joint Regional Security Stacks (JRSS). This DoD program creates a single, standardized, security architecture, which will eventually support more than 95 percent of the DoD’s network.

“The UC-APC achievement will expedite network, cybersecurity and risk management teams’ efforts to build, operate and verify resilient networks,” said Kimberly Baker, Public Sector SVP and GM for RedSeal. “The UC-APL provides for reciprocity between the services and provides authority to operate (ATO) without continually recertifying, which will accelerate RedSeal’s already significant growth into DoD networks. Our partner community is excited about this achievement, which gives them an unmatched differentiator for their cyber solutions for DoD as well as accelerates procurements.”

The DoDIN APL approval of RedSeal platform as a Cybersecurity Tool is posted on the DoDIN APL site.