Grade of Protection #3

By cliangNo Comments
The commodities (toys) are encapsulated in the vending machine (plastic containers). All containers share the same Point of Sales (PoS) device - the Octopus sensor. Upon successful payment, the outlet valve is released to pass out the selected item. You might wonder if these vending machines are securely protected as they are placed in open area and unattended. This is a typical scenario for cybersecurity practitioner in recommending business people the appropriate level of protection. There are CCTV in the arcade to record people accessing the vending machine. Physical brute force attack will be recorded. And for vending machine like this, physical is far more effective over cyber attack to collect the toys. Having recorded footage of physical attack won't be useful without the laws & regulations coming into place. The deterrent is that offender will be caught and prosecuted for criminal act. Last but not least, consider the total value of the commodities plus the equipment itself. If...
Read More

Policy #8

By cliangNo Comments
We face many "policies" (directives) everyday - whether in real world or in the cyber space. And we are told to comply with these policies for keeping ourselves safe or secure in both domains. Sometimes, don't blindly follow the policy because policy makers could make mistake: lack of field experience, don't understand the subject matter well, having implicit assumption causing incorrect interpretation or putting something that is even not practically achievable. As an user, you need to think, contribute or challenge policy makers. There isn't perfectness in this world. Things always need continuous improvement. Policy makers are expected Solicit opinions objectivelyListen feedbacksResolve ambiguityAddress incorrectness If they don't, they simply fail. ...
Read More

DeMilitarized Zone (DMZ)

By cliangNo Comments
DMZ becomes the de facto standard for network segmentation. It is used to control network traffic across trust and untrusted network zones. Network traffic is used instead of network connection because the latter is not precise. A network cable is connected across components but what does matter is the traffic flowing thru. The network zoning is typically implemented by network firewall. More functions like anti-malware protection, site filtering, application requests screening are adding to the network firewall making it the so-called next generation (NG) firewall. To enhance customer confidence, there are 3rd party accredition for firewall cybersecurity. No matter how secure the component is manufactured and deployed, the important aspects to maintain a secure network perimeter are: Proper design, i.e. placing the firewall(s) at the correct network nodeProper configuration, i.e. device management and least privilege firewall rulesPeriodic assessment, i.e. validate if the configuration is still valid (don't retain the associated firewall rules when system has retired)Proper maintenance, i.e. update firmware...
Read More

Reinforcement

By cliangNo Comments
Sometimes, security protection needs reinforcement to avoid deterioration of effectiveness over time. This can easily be visualized in real world. Screws are used to tighten the wheels. Multiple screws are used for resilience. You add further clamp on to limit the screws from spin off. In dealing with cyber protection, the easiest deteriorating stack is the human factor. You have policy published and communicated. You still need to reinforce the situation awareness to bring back attention. An example is the phishing email. It is the common cyber attack vector resulting into infect ransomware to hijack all systems, install backdoor to corporate network, infiltrate sensitive information etc. Other than regular communication, launch phishing test campaign to validate how many in the organization will fall into the trap. Through repeated exercise, the awareness to combat against phishing attack will be reinforced. ...
Read More

Enforcement

By cliangNo Comments
Enforcement Having policy as written document isn't enough. If there is violation, it must be enforced thru correctional approach. In real world, this is done by disciplinary action, imposing fine or even imprisonment depending on severity of violation. This will reinforce the attitude for policy compliance. An example is jumping the light detected by traffic camera. At best if there is no traffic accident, impose fine and deduct marks to remind this act will hurt other road users. At worst this misbehavior has triggered traffic accident, it might be resulted in criminal offence for imprisonment. In cyber world, the situation is similar. Stipulate the cybersecurity directive (policy) and indicate what is the protection objectiveEstablish policy exception processDefine the levels of correctional action per violation natureAnd most importantly, raise awareness to educate all levels why the policy must be complied for what purpose and consequence of violation ...
Read More

Assumption #3

By cliangNo Comments
DO NOT ACROOS - implicitly applied to vehicles only When we develop written directive, there might be chance that certain elements are assumed and be implicit. It is essential to engage stakeholders, listen to feedbacks and address opinions rather than dictate what should be done. If you do, you deem to be failed to develop a good policy. ...
Read More

Taxonomy #2

By cliangNo Comments
I have seen cybersecurity directive regarding applicability is to protect OT (Operational Technology) system so as to minimize cyber attacks to energy production. Renewable energy like solar panel or consumer grade wind turbine at household are producing energy with certain OT systems for control. Unfortunately, that organization also markets these equipment. Confusion arises if these OT systems should be under the same set of protection principles unless a precise specific taxonomy is specified in the directive. ...
Read More

Landscape

By cliangNo Comments
Some cybersecurity practitioners only drill down to the level of details of network diagram or even wiring diagram to identify adequacy of cyber protection. The system landscape or architecture is no doubt an element to look at but just part of it. The holistic approach shall look like these: What is the purpose of the systemHow is information used - control machine, information for decision making of critical operation or solely display as-isWhat is the consequence if compromisedWhat is the tolerable down timeWhat are options to bring up service within this unplanned down time windowHow to strike the balance for freezing the compromised system for digital forensic vs system recovery in meeting service pledge With these in mind, these diagrams are only useful to assess the attack path and the optimal countermeasures. And don't criticize insufficient information in the diagrams without setting a reference standard - this should be objective rather than subjective. ...
Read More

Taxonomy

By cliangNo Comments
In policy development, it is essential the coverage of the rule is sufficient and precise to avoid ambiguity. A living creature could be animals, birds, fishes, reptiles and human beings for full coverage. A targeted group might be stipulated as non-human living creatures, or even specific as reptiles when certain situations need more precision. Policy maker needs to understand clearly the scenario when formulating the directive just right in meeting practical implementation. ...
Read More

Suspicious

By cliangNo Comments
It is common to see such directive in subway, airport, key facilities, incident respond playbook etc. The problem is different people have different interpretation of "suspicious". Take phishing attack as an example. Email is apparently sent from the one you know. Should it be suspicious? If so, there won't be so many successful cyber attacks originated from phishing to launch ransomware, data exfiltration or remote access trojan (RAT). Therefore, more needs to be done to elaborate what is "suspicious" to raise situational awareness. Of course, it is a challenge to include so many information in a sign board. If the facility is so critical, each personnel (staff, visitor, contractor) should be briefed the threat scenario (like the safety rules before the aircraft departure) while the signage is just a reminder of what has been briefed. ...
Read More