Fault Detection

By cliangNo Comments
When using technology, usually there is inherent trust that the outcome is correct because it has been tested before going to market. With competition, time-to-market is squeezed. We have seen examples of vehicle recall for fixing certain faults. Even worst, other factors like insufficient training, lack of comprehensive operation instruction could cause tragedy or fatality. In the illustration, GPS infrastructure is proven but the map data might not be updated or the software to map the GPS signal to the location could have fault. A dual GPSs could mitigate an incorrect navigation if the impact due to incorrect route is significant. That said, the entire principle gets back to risk management - what measures can be controlled to reduce likelihood and what does not. ...
Read More

Trust #5

By cliangNo Comments
For free Internet kiosk like this, will you use? In old days when device is rare for Internet ready and Internet access isn't anywhere, yes, facility like this is welcome. Even at that era, use it with caution and for general web browsing (e.g. searching for information rather than login to web portal like bank account) because your sensitive information might be captured and stored elsewhere behind the scene. With cell phone and data plan generally affordable, such facility will be phased out like public paid phone. That's the expected consequence of technology innovation and advancement. It's just a matter of time when these facilities will be decommissioned. ...
Read More

Orchestration

By cliangNo Comments
One of the pain points in cybersecurity is the protections are always choosing the "best of breed" technology. This is fine except each technology has its own protection management tool, GUI, dashboard. As as result, SOC or IR personnel will need to dive into each cyber protection solution and analyze time of sequence event. Orchestration technology is available to consolidate logs from various log sources to make life easier. However, cautions must be exercised: Are extra investment or recurring operating costs properly funded and ready? The ROI might result into workforce reduction to justify the deployment. That means some one might lose the job. How are the integration done? Will this breach network zoning? Last but not the least, how to validate the solution is successfully deployed as a means of acceptance criteria. ...
Read More

No Direction

By cliangNo Comments
The principle of governance is to enforce processes are conducted consistently per established and approved policies or directions in an organization. That way, the business outcomes are also consistent. Some incompetent cyber security practitioners I have seen are just play by ear to spell out requirements for what they think is more secure. without considering practicality and the underlying overheads. An example is to keep an register to record which OT system uses USB thumb drive. All OT systems use USB because of isolated network environment for file exchange. The key point is how to manage the use of USB securely rather than keeping such a register. We must ask how much protection is increased by adding protection (no matter technical control or administrative control) and will more risks be introduced if not doing so. We must stick to the established policies. If there are "bugs" in the policies, admit it. Schedule revisions with stakeholders involved to align with...
Read More

Trust #4

By cliangNo Comments
A machine in the corner of the mall for digital currency exchange. Whether you use it or not is a kind of risk taking because you don't know what is behind the machine, who operates it, any proper business license to protect your money if things go wrong. In digital world, we must not solely put focus just on cyber protection. Every aspect counts towards a secure business model. From the digital currency operator's perspective, secure cyber protection is not enough. Physical security, anti-tampering to manipulate network connection, I/O port interfaces and so on are all attack vectors. From he customer perspective, trustworthy of the machine is the prime concern. ...
Read More

Physics #3

By cliangNo Comments
In automation world, cyber components control the machinery or the physical portion. Examples of machinery are turbine, passenger lift, vehicle, vessel, aircraft, vehicle, entry control etc. I have seen certain cyber security practitioners who solely put focus on the cyber part and ignore the physical part. That's no ideal. We MUST treat both portions with sufficient protection and good operating conditions. If the components are very cyber secure while the physical wear and tear conditions are ignored, this is just like the "operation is successfully but the patient is dead". ...
Read More

Clarity

By cliangNo Comments
Policies must be written precisely. That said, clarity is essential or otherwise it will create dispute, confusion in policy enforcement, audit exercise. The illustration has different interpretations: Apartment solely for retired government officials Government managed apartment for senior citizen If this appears in policy statement, it is not ideal. ...
Read More

Protocol

By cliangNo Comments
Protocol requires proper data format and valid ranges in different preset fields per design to work properly. Threat actors are trying to manipulate the different fields and data ranges in order to exploit weakness of underlying process to handle the protocol. Just like the illustrated locks. It allow dual admins to unlock it where each admin has own access key. If a "malicious" admin who does not follow the protocol to make the locks in series but putting them in parallel, then access is denied to other admin because unlock will require both keys at the same time. Therefore, when we talk about security, there are lots of considerations: robustness of the process enforceable by strong technology with people acting honestly and all driven by laws & regulations (or organization policies). Protection is beyond encryption, firewall, system hardening. These are evadable.Most said human is the weakess link. Yes, this is still true but we must include factors like Incompetent cybersecurity practitioners providing recommendations without...
Read More

Freedom

By cliangNo Comments
This is relatively speaking. Freedom is granted to certain extend. In physical world, what stops us doing bad things? It's the laws & regulations that stipulate us behave properly. For religious, there are further moral obligations to follow, say, The Ten Commandments. Then how about in the space of digital world? We are all interacting with others in the metaverse. Cyber crimes are more complex to settle because it is cross jurisdiction. We are free to use many cyber resources but that does mean we can abuse. Network activities are mostly traceable. We have to exercise the proper behaviors, be suspicious of unknown requests, learn from others' incident in keeping us as well as our connected peers safe (secure). ...
Read More

Warning Message #2

By cliangNo Comments
In physical world, warning sign is to alert you in keeping you safe. In cyber world, warning message might be abused as phishing attack or scam because it makes use of general public not able to differentiate if real or fake. What can we do to stay cyber secure? Some tips: Be vigilant to alerts, validate as much as possible or refer to persons with sufficient knowledge what's about Maintain your devices with latest version and necessary security patches Do not install unnecessary tools, or tools from source with doubt (social network, discussion forum, advertisement) Do not bypass system built-in feature, e.g. root or jailbreak the device to run codes from other sources ...
Read More