Cybersecurity is Complicated, but is AI the Answer?
Computer Business Review | Feb 21, 2018
By Dr. Mike Lloyd, RedSeal CTO
Tag Archive for: Thought Leadership
IoT: Why It Is Vulnerable
Security Advisor Middle East | Jan 16, 2018 | Pages 22-23
Feat. Dr. Mike Lloyd, RedSeal CTO
Seven Important Steps Law Enforcement And Government Agencies Can Take To Combat Hackers
Forbes | Jan 10, 2018
By Dr. Mike Lloyd, RedSeal CTO
Who Says Software-Defined Security Is What We Want?
Forbes | Dec 21, 2017
By Dr. Mike Lloyd, RedSeal CTO
Network Segmentation, Security and RedSeal
Over the last few decades, many network security architecture products have come to market, all with useful features to help secure networks. If we assume that all of these security products are deployed in operational networks, why do we still see so many leaks and breaches?
Some say the users are not leveraging the full capabilities of these products – which is true.
Other say the users are not fully trained on how to use the product. Also true, and probably why they’re not using the full capabilities of their products.
Instead, we might benefit from remembering a basic truism: We humans are lazy.
Most of us, if offered a button that simply says “fix,” will convince ourselves that it will fix any network problem. We’ll buy that button every day of the week.
Our belief in fix buttons has led to a situation where many of us aren’t following standard security practices to secure our networks. When a network is designed or when you inherit a network, there are some basic things that should be done.
One of the first things to do is isolate, or segment, your network. Back in the 1990s, network segmentation was done more for performance reasons than security. As we moved from hubs to large, switched networks, our networks have become flat, with less segmentation. Today, once attackers get in, they can run rampant through a whole enterprise.
If we take the time to say, “Let’s step back a second,” and group our systems based on access needed we can avoid much trouble. For instance, a web server most likely will need access to the internet and should be on a separate network segment, while a workstation should be in another segment, printers in another, IoT in one of its own, and so on.
This segmentation allows better control and visibility. If it’s thought out well enough, network segmentation can even reduce the number of network monitoring security products you need to deploy. You can consolidate them at network choke points that control the flow of data between segments versus having to deploy them across an entire flat architecture. This also will help you recognize what network traffic should and should not be flowing to certain segments based on that network segment’s purpose.
This all seems to make sense, so why isn’t it done? In practice, network segmentation is usually implemented at the start. But, business happens, outages happen, administrators and network engineers are under enormous pressure to implement and fix things every day. All of this causes the network design to drift out of compliance. This drift can happen slowly or astonishingly fast. And, changes may not get documented. Personnel responsible for making the changes always intend to document things “tomorrow,” but tomorrow another event happens that takes priority over documentation.
Network segmentation only works if you can continuously ensure that it’s actually in place and working as intended. It is usually the security teams that have to verify it. But, as we all know, most security and networking teams do not always have the best partnerships. The network team is busy providing availability and rarely has the time to go back and ensure security is functioning.
Even if the security teams are checking segmentation in large enterprises, it is a herculean effort. As a result, validating network segmentation is done only yearly, at best. We can see how automating the inspection of the network security architecture is a clear benefit.
RedSeal enables an automated, comprehensive, continuous inspection of your network architecture. RedSeal understands and improves the resilience of every element, segment, and enclave of your network. RedSeal works with your existing security stack and network infrastructure (including cloud and SDN) to automatically and continuously visualize a logical model of your “as-built” network.
RedSeal’s network modeling and risk scoring platform enables enterprise networks to be resilient to cyber events and network interruptions in an increasingly digital and virtualized world, and to overcome one of the main enemies of cybersecurity – human nature.
Experts Weigh In On Information Security Predictions For 2018
Techaeris | Dec 14, 2017
The world of information security was certainly a whirlwind of activity in 2017. It seemed no one was immune to some sort of security breach or incident and it only got worse through the year. Some of the affected companies involved in incidents are still paying the price for those breaches.
With 2018 coming, the landscape for information security is wide open. We’re lucky enough to have a group of information security experts who are making some predictions for the industry in 2018.
Uber Hack: A Bad Breach, But A Worse Cover-Up
The Uber hack is a public lesson that a breach may be bad, but a cover-up is worse. (See Nixon, Richard.) It was a foolish mistake to try to hide an attack of this scale, but then, the history of security is a process where we all slowly learn from foolish mistakes. We live in an evolutionary arms race – our defenses are forced to improve, so the attackers mutate their methods and move on. Academically, we know what it takes to achieve ideal security, but in the real world, it’s too expensive and invasive to be practical. (See quantum cryptography for one example.) Companies rushing to grow and make profits (like Uber) aggressively try to cut corners, but end up finding out the hard way which corners cannot safely be cut.
It’s likely that the stolen data was, in fact, deleted. Why? On the one hand, we would likely have seen bad actors using or selling the data if it were still available. That is, from the attacker’s point of view, data like this is more like milk than cheese – it doesn’t age well. Many breaches are only detected when we see bad guys using what they have stolen, but nobody has reported a series of thefts or impersonations that track back to victims whose connection is that they used Uber.
But we can also see that the data was likely deleted when we think about the motives of the attackers. Our adversaries are thoughtful people, looking for maximum payout for minimum risk. They really don’t care about our names, or trip histories, or even credit card numbers – they just want to turn data into money, using the best risk-reward tradeoff they can find. They had three choices: use the data, delete it, or both (by taking Uber’s hush money, but releasing the data anyway). The problem with “both” is thieves are worried about reputation – indeed, they care more about that than most. (“To live outside the law, you must be honest” – Bob Dylan.) Once you’ve found a blackmail victim, the one thing you don’t do is give up your power over them – if the attackers took the money but then released the data anyway, they could be sure Uber would not pay them again if they broke in again. The cost/benefit analysis is clear – taking a known pot of money for a cover-up is safer and more repeatable than the uncertain rewards of using the stolen data directly.
The Board’s Role in Managing Cybersecurity Risks
MIT Sloan Management Review | November 16, 2017
Ray Rothrock (RedSeal), James Kaplan (McKinsey & Co.), and Friso van der Oord (National Association of Corporate Directors) write that cybersecurity can no longer be the concern of just the IT department. Within organizations, it needs to be everyone’s business — including the board’s.
This Essential Job Role Will Go Unfilled at Millions of Companies. But, There’s an Immediate Solution for Your Business.
Entrepreneur Magazine | October 16, 2017
RedSeal CEO Ray Rothrock tells Entrepreneur Magazine that there is little to no rational hope do business leaders have of recruiting or training between 1.8 million and 3.5 million cybersecurity personnel ASAP. So, it is time to rethink the crisis.
RedSeal CEO Joins Cheddar TV to Talk Equifax Breach, “Bad Governance”
Cheddar | October 3, 2017
With Ray Rothrock, RedSeal Chief Executive Officer
RedSeal CEO Ray Rothrock joined Cheddar TV’s this morning to discuss the the Equifax data breach, the response from retiring CEO Richard Smith, and how this was ultimately a “case of bad, bad governance.”