Policy #6

By cliangNo Comments
What and when are allowed? Common pitfalls in writing policies (written directives) are: Embedded assumption by the author that is unknown to other readersFailed to provide clarityMost importantly, failed to listen feedback for adjustment We are hired to make professional judgment. We must not be fraid to challenge if the written directive is clear enough, not just because it has been approved by senior management. We also need to admit policy statement is never 100% perfect as the business environment is changing. An interesting example is the power energy sector. No doubt the power plant and grid are the Critical Infrastructure (CI) assets to secure from cyber-attack in order to maintain reliable supply to customers or comply with regulatory requirements. But we must not forget there are other sources like renewable energy that the "plant" is just a customer own installation outside the CI. How should the policy statement be precise enough to differentiate the cyber protection requirement will be a tough job....
Read More

Identify

By cliangNo Comments
Most often, vendors are proposing security solution in a basket of features. They claim for security suite with unified console and dashboard. It is necessary to assess and identify the baseline security in business requirements what are the necessary protection. Otherwise, it will cost more, and more to manage in terms of support, maintenance, skillset, user experience. Some guiding questions are to facilitate the decision. The answers are situation and organization specific. Taking remote access as an illustration here. Who are the users accessing the infrastructure or system: From own organization?From business partners (vendor or contractor)?General public? When is this service needed? This will decide: Resilence arrangementMaintenance windowBusiness continuityDisaster recoveryRecovey Time ObjectiveService level pledge What service needed after connection established Infrastructure (e.g. storage, email, intranet)?Business applications? Where do users access Within organization network (due to network segmentation)From business partners networkInternetOrganization device or any device? Why this remote access is needed This is the business justification, for exampleSpeedy vendor support without traveling to siteEnhancing productivity especially in COVID-19 to keep physical distance How...
Read More

Visibility #3

By cliangNo Comments
Below the iceberg, there is a large portion that is out of sight. That's why it is dangerous for vessels when approaching an iceberg. You need to keep a safe distance from it to avoid hitting it. The iceberg is often used to illustrate the dark web. The visible part is WWW (World Wide Web), below is the deep web then further down the dark web. The general perception on dark web is bad or associated with cyber criminals. However like penetration test tools, the tools can be misused to attack other computers but also to serve as a means to uncover infrastructure weakness for cybersecurity enhancement. The difference is between unauthorized and authorized intention. In the case of dark web, the usefulness might be Understand how the underground market business model operate, what are on sales such that you will revisit how to secure these cyber assets in your own environmentUncover if your or corporate information is there for sales ...
Read More