Defeated Control

By cliangNo Comments
Detective control is blocked (defeated) When designing security controls, it is necessary to determine if the controls can be executed effectively. Somehow due to unexpected situation, controls are defeated. To avoid this pitfall, holistic assessment is required during: Design stage if intended control function is effective without being circumvented, the design effectiveness reviewO&M stage if the control can be operated as per design, the operation effectiveness review The entire life cycle of digital solution shall be: Identify the business value at initiation such that necessary and optimal controls are in place to minimize the business impact; this acts as procurement requirementDetermine proposed controls during design if they are effective and if not, develop necessary compensating controls. A typical example is the guard patrol to validate if CCTV are still operating properlyValidate controls before system goes live; rectify any deviations in the deployed solution from designAssess if controls are effective to combat new threats during O&M regularlyDispose controls securely at retirement of the digital...
Read More

Proper Usage

By cliangNo Comments
Roads connect different destinations in physical world. Every road user (vehicle or any kind, pedestrian or live objects) has to comply with the usage rule for safety. Network connects different hosts or systems as cyber world. Similarly, there are also rules that every user (device, human) must follow to become cyber safe. Even if you are using the information processing facility without any network connection, say a totally isolated computer, you also need to bear the same in mind. This is because it is a usage habit such that you adopt consistently. Like driving habit, you apply the same attitude no matter for work or for leisure. ...
Read More

Connection

By cliang1 Comment
The cyber world is built up by connecting different systems and devices via information highway. Therefore, the key cybersecurity element is to establish the perimeter. In physical world, port control is the location perimeter. You need to go thru immigration, bag scanning at custom before you and your accompanied goods are permitted for entry. Some countries also require going thru immigration before exit. This is easily visualized. In cyber world, controls at the network perimeter will need precise directives (or policies) such that adding new components or functions shall comply with the rules accordingly. That said, the policy must be precise. Most often, "connection" is unclear and need clarity. Using ISO 7 layer concept, network cables are always physically connected to the network devices. For certain cases if network based IPS or IDS is deployed, it will need collecting mirrored traffic from all over the network devices even if these network segments are zoned by design. ...
Read More