Operation Risk #2

By cliangNo Comments
Part of the critical infrastructure is in close proximity for public access. Two main types of attacks causing service interruption. Cyber attack takes advantage of launching behind the scene anywhere. Contributors for successful attack include but not limited to: Lack of cyber protection including detectionVulnerable systems and applications using configuration defaults or outdated versionInsufficient control over remote access However, the facility is also subject to physical attack because of the "weak" perimeter. Prevention is not effective but relying detection to respond, sufficient resilience to maintain service. Therefore, the asset owner needs to Firstly identify or categorize the value and impact of the asset The next is to deploy effective counter-measures and the protection focus should not be just in cyber sense though this is always hot topic exaggerated by media and mostly exploited by vendors to create FUD in convincing asset owner to adopt their solutionsPhysical security, equipment faults, general tear-and wear are equally important to consider ...
Read More

Masking

By cliangNo Comments
Like any types of tools in both physical and cyber worlds, this can be used for legitimate or evil purposes. Examples are illustrated below. Legitimate purpose Content masking: required to protect privacy information in meeting regulatory compliance or certain industry requirements.Penetration test tools: cybersecurity assessment to uncover weakness of the target of evaluation for strengthening Evil purpose Identity masquerading: the usual trick for phishing or social attacks.Without the asset owner authorization, use of penetration test tools is considered as malicious purposes to launch cyber attack and subject to disciplinary action, civil or criminal litigation. Who judges the proper use? It's set out by Corporate policies (if internal matters)Laws & regulations (when externally involving different entities) ...
Read More

Warning Message

By cliangNo Comments
We are more cautious about warning messages in physical world to keep ourselves safe from risk of fatality. In cyber world, we should use the same attitude. If there are system warning messages (e.g. malicious files or threats detected), we have to be vigilant or refer to persons with sufficient knowledge what's about. However, be also cautious about fake messages to lure victim installing unnecessary ad-ware or even malware. It's important to maintain your computing platform with: Latest version with security patchesAnti-malware protection from known sources with sound rating from the cyber communityHost-based firewallNon-administrative rights in logon session Further, have home router to act as certain network perimeter between your computer and the untrusted Internet; if you are using mobile device, consider to subscribe cloud based proxy for protection. ...
Read More

Perimeter #2

By cliangNo Comments
Perimeter is intended to control and scrutinize access. Now, systems are interconnected and standalone system is no longer considered effective. This will then expose the attack surface. Example is port 80. You have web site for point of presence in the market. Web site needs to allow anonymous access, or the Internet surfer. Though firewall is deployed, the web port (TCP 80, 443 or whatever is required) must be opened. Attack then shifts to application like injecting malicious contents passing thru the network layer, submitting large amount of requests to slow down or corrupt the system, manipulating client side data and resubmit to back-end. Counter-measures will then require Software Secure Development LifecycleSecure configurationRegular security patches and upgradesPeriodic comprehensive assessment (indeed, some industries mandate this)Situation awareness for different types of roles involved ...
Read More

Big Picture

By cliangNo Comments
Common pitfalls in conducting risk assessment are Controls in place are not explicitly stated as assumptionLack of big picture A holistic view on the target of evaluation (ToE) as well as its surrounding is vital. We should not just look at the ToE only. We need to think and assess Risks due to compromised components around ToESimilarly risks affecting them due to insecure ToE ...
Read More

Protocol

By cliangNo Comments
The road is clear and why are these pedestrians waiting for? This is because all road users need to observe the protocol in the road system to keep alive. Similarly, we need to observe protocol in the cyber world to keep secure. Examples are: Maintain access credential secret and renew regularlyActivate 2-step authentication if identity provider supportsBeware of emails that appear legitimate requesting for sensitive or personal informationBe alert for too good to be true rewardsAvoid using shared computers in the public that anyone can accessAvoid plugging into USB power ports in public to charge your portable devices (cell phone, tablet)etc. ...
Read More

Policies #3 (From Directive to Enforcement)

By cliangNo Comments
1. Use case Authenticate the user of parking is "Aliens" status, a yes/no decisionGrant usage durationDisclaim loss/damage responsibilities 2. Enforcement If yes: allowIf not: rejectIf violate: consequence 3. Somehow, vulnerabilities exist: Identity provider is compromised Method of authentication is circumventedResult of authentication is manipulatedBarrier to the authorized resource (parking lot) fails and being bypassed without authentication 4. Consequence: False negative: non-alien is mistaken as alien for fraudulent useFalse positive: genuine alien is mistaken as non-alien resulting into denial of service 5. Counter-measure: Protect identity providerSecure communication from end point to identity providerEnsure authentication result integrityConduct periodic system health-checkPerform regular patrol of parking lotPost terms of use and consequence of violation (e.g. tow away at vehicle owner's expense) ...
Read More

Foundation

By cliangNo Comments
Proper cybersecurity in an organization must have a foundation. The effective approach is driven from the top to mandate integration of cybersecurity in the business process. This is in the form of Policies and enforced via corporate governance. Underneath the policies, various domains in risk management, policies exceptions, technology standardization, secure architecture, secure system deployment, procurement specification, incident respond, recovery, business continuity and workforce development are the pillars. Without a sound foundation, the object in the air will fall, just a matter of when. ...
Read More