Tunnel #3

By cliangNo Comments
See thru tunnel TLS is breakable. Similar post is here. This is normally done at the Internet gateway. Anything flowing thru the tunnel will be visible and web surfers don't even know. The major rationales for Deep Packet Inspection are: Organizations impose DLP (Data Leakage Protection) technology Certain regions control the contents Therefore, don't expect privacy even the padlock is displayed in the web browser bar. Either you exercise further content protection before passing out to cloud folder, use VPN or even going extreme using the Dark Web. ...
Read More

Integrity

By cliangNo Comments
Here, I am not talking about the fundamental of information security, the CIA aspects. Most often, we trust the policy enforcement is honestly executed. Imagine the parking ticket is issued to vehicle with time expired. How do we ensure this is done unbiased, i.e. the actual time is expired in the meter rather than issuing the parking ticket at wish? We are not yet coming to the point of technology failure (incorrect display, incorrect calculation etc.). Personal integrity is important and that's why human is the success factor in cyber security. I have seen incompetent cybersecurity practitioner raising subjective opinions or manipulate the situation based on a buggy policy without looking in the real situation nor listen to feedback. This is the most biggest risk to an organization. The risk is no longer due to hackers, human error, insecure configuration, lack of cyber maintenance and those typical FUD issues. Therefore, evaluating the competency of the...
Read More

ZTNA

By cliangNo Comments
Zero Trust Network Access (ZTNA) is suddenly becoming eye-catching in ICT. No doubt, this will enhance cybersecurity as untrusted by default. The theory is simple: going thru multiple policies (technical configuration settings) and authentication before gaining access to the designated network resources. The controls are applied on who (access roles), when (time of day), what (network resources), where (network location) & why (what type of transaction or business reason). In a nutshell, who to access what resources from where and when with legitimate reason (why). The pitfall is the "how" … how does the existing environment fit with this access model and not-to-mention the changes in user experience. A M2M (Machine to Machine) ZTNA might be applicable use case but this will definitely take a while to transform for access involving human. Even worst, some cybersecurity practitioners introduce this ZTNA model in the ICS environment to combat against cyber threats which are even just conceptual because the ICS environment has...
Read More

Trust #3

By cliangNo Comments
Driving on the road is risky in the physical world. The worst consequence is fatality. There are life-saving measures like air bag, seat belt in the vehicle. As a driver, how do you ensure these measures will work when needed? No, we can't but to trust these safety measures will work per design. At most these are checked during vehicle maintenance but no guarantee they work without actually activating the trigger. Similarly a data exchange link is purposely built to convert TCP with DPI (Deep Packet Inspection) to serial communication in getting around the so-called vulnerable routable protocol in a lock down (both physical & cyber aspect) environment. Assessment of this communication link appears reasonable to verify properly configured but extending the scope to its surrounding systems how well they are secure will be excessive, overkill and waste of resources. There are many things we must trust based on our instinct and exercise professional judgment. Otherwise, there is no...
Read More

Policy and Usability #2

By cliangNo Comments
For regions driving on the left, driver seat in the vehicle is on the right. If this policy is blindly followed in private venue without reimagine for practicality, it will end up the driver is unable to activate the toll gate, or make this a very complicated task. This can be resolved either at design stage to move the toll gate at the centre position serving both lanes, or simply change the direction of driving in this private venue for cost-effective retrofit. Therefore, competent cybersecurity practitioners must fully understand the business nature of the organization they work for, remove unnecessary controls in the systems to fit practicality or even revise the policy with flexibility making cybersecurity as business enabler. ...
Read More

Policy and Usability

By cliangNo Comments
I came across certain cybersecurity practitioners who are obsessive with technical controls and insist a strict binary decision in determining policy compliance. Otherwise, so-called non-compliance process needs to be initiated with necessary executive signature as acceptance. Even worst, the policy is badly written and lack of precise generic as well as precise specific at the appropriate scenarios. Such mentality is not securing the business but an major obstacle in digital transformation and competitiveness with peers. As competent cybersecurity practitioners, our roles is to explain what are protection in place to neutralize the published cyber threats rather than creating FUD to management. Sometimes, a management directive with disciplinary action for non-compliance is far much cost-effective than technical controls. Example is password complexity and MFA, this only make password sharing harden but not impossible. Education is another domain why we should not doing so. More technical controls means complexity. Complexity doesn't make it more secure but user will try to evade or circumvent the...
Read More

Safety and Cybersecurity

By cliangNo Comments
In any field work, safety is the most important thing. Yet, we cannot totally eliminate the likelihood of fatality no matter which types of organization. What we can do is to demonstrate that there is safety system, culture, management committment, user education, pre-work assessment to reduce the likelihood. Likewise, there no 100% cyber secure business. Do not introduce unnecessary controls or else more chance of human error, technology failure that all these will impact the business outcome rather adding protection. Think also the likelihood of exploit from physical aspect rather than just drill down in the cyber aspect. The best strategy is to ensure resilience to resume business operation because there are too many threats in the wild that we don't know. We can only protect what we know and that is worth to protect. ...
Read More

Container or Content

By cliangNo Comments
When installing controls, you have to understand what is the protection objective. Don't just apply textbook knowledge for the sake of having controls. Understand the business environment and the consequence to determine the optimal controls. Sometimes, controls are really unnecessary because the consequence is acceptable by common sense. If you put the wrong focus, the protection doesn't make any sense and wasting valuable resources. Don't just insist for policy compliance because policy could be written incorrectly. Apply your professonal judgment as we are hired to do so. If not, you are neither competent for the job nor having common sense. ...
Read More

Dual Home

By cliangNo Comments
Certain cybersecurity practitioners have no knowledge of the implication when writing policy statement even with help from external subject matter experts. A typical example is that host with "dual home" connection must not be allowed. There are some rationales that this network setup will incur cybersecurity risks but only on particular scenarios. It is risky if one network interface card (NIC) lands on trusted zone while the other NIC lands on a "dirty" zone. The host is then acting as a network firewall that might not be robust as a dedicated network firewall device capabilities. But if the host (especially in control systems) needs this setup to be managed by computer management system (e.g. domain controller) in one network while the other network manages the controllers, sensors and the design is certified by the manufacturer, blindly changing this to non-dual home setup will affect the intended operational capabilities. Lesson learned: don't write something that causes your business immediately falling into...
Read More

FUD #2

By cliangNo Comments
Things outside your comfort zone or knowledge will generate FUD. There are always news exaggreating cyber risks causing severe consequence to certain organizations. Sometimes cyber threats are even just based on perspection with assumption threat actor has gained complete knowledge or your environment and yet skill to achieve this is very complex. As competent cybersecurity practitioner, we must assess the threat situation, what are controls in place and provide management comfort rather than spending unnecessary resources to protect something that does not harm much. Every business exposes to risks and we cannot eliminate all risks but to prioritize the limited resources to maximize protected values. ...
Read More