Protocol

Protocol requires proper data format and valid ranges in different preset fields per design to work properly. Threat actors are trying to manipulate the different fields and data ranges in order to exploit weakness of underlying process to handle the protocol. Just like the illustrated locks. It allow dual admins to unlock it where each admin has own access key. If a "malicious" admin who does not follow the protocol to make the locks in series but putting them in parallel, then access is denied to other admin because unlock will require both keys at the same time. Therefore, when we talk about security, there are lots of considerations: robustness of the process enforceable by strong technology with people acting honestly and all driven by laws & regulations (or organization policies). Protection is beyond encryption, firewall, system hardening. These are evadable.Most said human is the weakess link. Yes, this is still true but we must include factors like Incompetent cybersecurity practitioners providing recommendations without...
Read More

Freedom

This is relatively speaking. Freedom is granted to certain extend. In physical world, what stops us doing bad things? It's the laws & regulations that stipulate us behave properly. For religious, there are further moral obligations to follow, say, The Ten Commandments. Then how about in the space of digital world? We are all interacting with others in the metaverse. Cyber crimes are more complex to settle because it is cross jurisdiction. We are free to use many cyber resources but that does mean we can abuse. Network activities are mostly traceable. We have to exercise the proper behaviors, be suspicious of unknown requests, learn from others' incident in keeping us as well as our connected peers safe (secure). ...
Read More

Warning Message #2

In physical world, warning sign is to alert you in keeping you safe. In cyber world, warning message might be abused as phishing attack or scam because it makes use of general public not able to differentiate if real or fake. What can we do to stay cyber secure? Some tips: Be vigilant to alerts, validate as much as possible or refer to persons with sufficient knowledge what's about Maintain your devices with latest version and necessary security patches Do not install unnecessary tools, or tools from source with doubt (social network, discussion forum, advertisement) Do not bypass system built-in feature, e.g. root or jailbreak the device to run codes from other sources ...
Read More

Architect

In physical world, an architect is "a person whose job is to design new buildings and make certain that they are built correctly", Cambridge. If this definition applies to digital world, the system architect is to ensure the system is built correctly per business requirement. Extending to cybersecurity, the cybersecurity architect is to ensure proper protection is incorporated in the digital landscape. Most often, cyber protections are overkilled. I come across an example that USB thumb drive carrying publicly downloaded security patches requires encryption because company policy only allows encrypted drive. On the IT side, there is no issue because patches are downloaded from IT machine with Internet access. But when transferring files to the OT side, it will create issue because decryption will need running special program in the USB "public" drive where OT environment is lock down. Further, the objective of encryption is to protect sensitive information in the USB because contents could be disclosed when lost. If dedicated USB...
Read More

Architecture #2

Parthenon, 447 BC Some cybersecurity practitioners always mention network diagram to have cybersecurity architecture for review and so-called approval. They know just the term and never grasp the real meaning. Cybersecurity architecture is actually the digital landscape having these core elements: network zoning, electronic perimeter control, cyber protection measures. The last one is an organization-wide issue because protection measures are not solely via technical controls which are the last to consider. Not everything can be technically enforced and if it does, it kills business. Enhancing workforce competency especially cybersecurity practitioners who act as internal subject matter expert to provide reputable and credible opinions rather than just slipping words out of their mouth. Situation awareness is another key player in protection measure. The illustrated architecture is an aged structure with and yet it is still standing there. By the same token we should not solely demand refreshing technology obsolescence because it has entered end of support. It needs a holistic...
Read More

Off Grid

Our physical world is fully integrated with the cyber world. Some derivatives like privacy, digital asset, cyber protection are of a concern. The extreme approach to get rid of these cyber issues is to stay off grid, i.e. in the wild: no cell phone, no electricity, no tap water supply, no gas, no vehicle, or a complete isolate zone with the outter world. It is easy to just talk about staying off grid but when putting into practice, it's a great challenge to adapt. You need to hunt for food, collect drinkable water, build shelter, source heat to cook or keep warmth and most importantly don't get sick. Even a recycle bin will lead you connected with others in the logistic chain. We can't escape from the cyber world but to manage this to understand and accept the consequence. ...
Read More

Twins

Ditigal Twin is a digital representation of a physical object, person, or process, contextualized in a digital environment. There are lots of use cases and solutions available in the market for different types of model. How do we ensure the results from the digital environment is truly representing the physical environment? This falls into fundamentals that need subject matter experts design, deploy, sustain and validate the digital model regularly. Otherwise, an incorrect outcome from the digital representation will cause incorrect judgment with at worst catastrophic consequence. ...
Read More

Security Culture

A trivial observation will reveal a lot of issues about the security culture of an organization. 1. Does the organization: Have information security policies in place Define the differennt information classes Provide examples of each information class Establish approval process with appropriate authoritive level to declassify information for sharing Deploy viable means to share confidential materials Communicate properly all staff with mandatory regular refresher programme Integrate information security undertaking in the employment term Impose discrepancy process for policy violation Enforce role based access profile per job function Review periodically for appropriate access rights 2. Do the staff: Have minimal access to information just per the job roles Forget to reclassify the information after approval has been granted Understand what has gone wrong It seems so many issues have been surfaced but this is the challenge and a matter of fact when all of us living in the digital world, not-to-mention unstructured information is everywhere beyond the organization cyber landscape. The bottom line relies on human rather than technologies to secure information mandated by policies (written directives). ...
Read More

United

Combat against cyber threats relies on everyone. Together, determined group of individuals will become strong. Then, what about cybersecurity practitioners. Do we still need them? Yes, they are still required in an organization but there should be a small team to prioritize cyber protections aligning with the business objectives. Cybersecurity is now integrated into every job function, executed and sustained properly for effective protection. This requires the entire work force to achieve. This is just like each work force member has to prepare report, spreadsheet, presentation materials all on its own. Clerical support in the old days have gone. This change is inevitable especially all business functions are now undergone digital transformation to stay competitiveness in the market. ...
Read More

Integrity

Here, I am not talking about the fundamental of information security, the CIA aspects. Most often, we trust the policy enforcement is honestly executed. Imagine the parking ticket is issued to vehicle with time expired. How do we ensure this is done unbiased, i.e. the actual time is expired in the meter rather than issuing the parking ticket at wish? We are not yet coming to the point of technology failure (incorrect display, incorrect calculation etc.). Personal integrity is important and that's why human is the success factor in cyber security. I have seen incompetent cybersecurity practitioner raising subjective opinions or manipulate the situation based on a buggy policy without looking in the real situation nor listen to feedback. This is the most biggest risk to an organization. The risk is no longer due to hackers, human error, insecure configuration, lack of cyber maintenance and those typical FUD issues. Therefore, evaluating the competency of the...
Read More