Business Value

By cliangNo Comments
One of the fundamental principles in cybersecurity is to apply necessary controls to reduce business impact. Business value is the catalyst in the risk management. The cyber poker machine is chosen as an illustration here. If this cyber application is deployed in a casino, the bet outcome means money. The result of each bet must be protected against manipulation like session replay, unauthenticated or fraudulent submission to control the coins release valve. But if it is deployed as part of the entertainment system in an aircraft, then it doesn't matter. The bet outcome is just for fun....
Read More

The 4C of cybersecurity

By cliangNo Comments
Cautious - understand cybersecurity is important but need to explore how to execute or manage Conformance - doing things adhere to the cybersecurity requirements Compliance - having 3rd party review and certified for cybersecurity assurance of a selected scope Committment - every aspect takes care of cybersecurity For the illustration, it is solely BS1363 compliance for the scope of the AC plug itself.  Though there is metal earth pin, it is just dummy and cannot achieve the intended protection (end-to-end security)...
Read More

Cyber Risk Likelihood

By cliangNo Comments
In physical world, likelihood is based on historical frequencies, scientific calculation like path of hurricane, engineering specification such as MTBF (Mean Time Between Failure). Likelihood is the foundation to predict when an event will occur. It is the key catalyst in the insurance industry. In cyber world, this is not going to be the same. Uncovered vulnerability will turn security protection insecure over night. An example is TLS (Transport Layer Security). People take TLS for granted as a secure means to protect sensitive information submission over the network. The Heartbleed suddenly shocked everyone and this can't be predicted per traditional manner. A different approach has to be adopted to address cyber risk likelihood....
Read More

Give and Take

By cliangNo Comments
Cybersecurity and convenience are always contradictory.  The Touch ID is a convenient means to unlock the device and deemed secure because fingerprints are supposed unique. But if we give further thoughts, there are several pitfalls. The Touch ID only protects the data-at-rest scenario. It can't secure your data if your phone is unlocked (data-in-use) nor you submitting sensitive data across the network (data-in-motion). Frequent use of Touch ID will make you tend to forget the text base password, affecting availability in situation you need to provide password Text base password is secure over biometric in a special case: if you are under duress, attacker can force you to unlock your device from your biometric attributes ... even if you are dead; but text base password cannot be extracted from a dead person's mental memory. An example is the locked iPhone from the Boston bomber that evolved into court case to debate national security vs data privacy. This is a matter of expectation...
Read More

Router or DPI?

By cliangNo Comments
One of the roles in cybersecurity practitioner is to share threat intelligence with internal stakeholders to enhance the situation awareness. If you are doing this, don't just share the links of the news. You need to analyze the published threat: Assess the credibility of the threat source Explore what are protection currently deployed in your organization How to avoid similar issues in your organization Prioritize protection investment if not yet deployed with applicable work around to reduce likelihood Essentially, it's WIIFM (What's In It For Me?). If you don't, you don't add value to sharing the threat intelligence. Sadly just a router rather than a smart Deep Packet Inspection....
Read More

Expect the Unexpected

By cliang1 Comment
The network anomalies detection suddenly becomes a popular topic in cyber protection market.  This is to expect something unexpected then manage it, i.e. deviation from normal. At a glance it appears as an amazing technology: no more signature based detection, no need to update detection definition, deploy and forget solution. But if you think deeper, the technology needs a time period to learn your environment as baseline.  Any deviations from this baseline will be treated as the "unexpected". The challenges are: How do you know if current network traffic is normal but not already compromised How much time is sufficient to establish the baseline in order to reduce false negatives or false positives to acceptable trusted level? How about traffic that disappears from baseline, is the technology able to report? Seasonal network traffic will further add complication Is the technology that vendor claims only able to handle specific scenarios? Does the vendor need extensive time to learn your environment? Last but not least,...
Read More

Improper Usage

By cliangNo Comments
Park your car at a legitimate parking lot in the street. What's wrong? Even it is a legitimate parking zone, the permitted usage restricts to bus only. Similarly in the cyber world, proper usage is essential to stay secure. Examples are software license (commercial or personal; by device or user; internal or Internet facing application), penetration tools (for authorized  assessment or malicious purpose), specific hardware (prohibit for re-export to 3rd party) etc....
Read More

CONFIDENTIAL?

By cliangNo Comments
People talk about leaking company CONFIDENTIAL information.  It is not just a word slipped from your mouth to blame your staff but a proper management system to formalize it. You have to rethink: - Do you have an information classification policies? - Does your information carry any classification marking? And if no marking, what is the default classification? No classification label should never be regarded as CONFIDENTIAL. - Are you holding information that is also available from other sources or publicly known? - Have you provided training or orientation to raise the staff awareness the proper handling of company information? If you don’t have any one of these, it’s the fault of your company but not your staff....
Read More