Security By Trust

By cliangNo Comments
In physical world, we trust this glass roof is safe and secure to walk on because there are underlying processes to sustain its safety: Regular inspection and maintenance Regulatory requirement for license issue and renewal 3rd party insurance etc. In addition in building this infrastructure, the design will cater for the intended loading with safety margin, wind speed, anchor points stability plus build it per engineering standard to ascertain the quality. We will therefore have no doubt and trust these arrangements are in place and safely step on it. In cyber world, things are different. There might be cybersecurity standards as foundation but the design and build will require competent practitioners. Even there is comprehensive verification tests before commissioning, there are always new cyber threats requiring recurring effort to sustain the protection effectiveness. Deception to lurk victim into malicious web site to compromise the device or application will further complicate the situation. Then, how do we stay secure in the cyber world? It's a very...
Read More

Welcome

By cliangNo Comments
When we establish usage terms, we must consider the consequence and adopt the most appropriate wordings. Similar to other system settings, do not take default even for logon banner. In the past, there was incident threat actor penetrated into FTP server but caught. There is no legal ground to indicate this is unauthorized activity because the FTP server gives "Welcome to xxx FTP server, …" upon logon. There is no explicit wording of unauthorized usage will be prosecuted. So, there is the need to have holistic review what are default settings come with the software or application, review and revise accordingly. ...
Read More

Label

By cliangNo Comments
Label is commonly seen and required to identify things especially in cables. Without proper identification, it will be tedious in trouble-shooting. There is always debates on label. On one hand, it eases operation and maintenance tasks but on the dark side, it exposes the usage of the marked item. A mitigation is to assign label ID and mark this is the drawing. This requires resources to sustain the documentation when changes occur and regular inventory check to validate the marking is still correct. For the illustration, it has certain pitfall for insights. It exposes the location is for military purpose, a target for threat actor to penetrate or attack. "No trespassing" is unlikely enforceable especially during political conflict time. Ultimately, this requires the holistic assessment to balance the signage, back-end enforcement mechanism and cater for unexpected scenarios. All these are the attributes of writing a good policy that can be practically achieved. That said, don't just copy textbook knowledge and apply to your organization cybersecurity...
Read More

No Direction

By cliangNo Comments
The principle of governance is to enforce processes are conducted consistently per established and approved policies or directions in an organization. That way, the business outcomes are also consistent. Some incompetent cyber security practitioners I have seen are just play by ear to spell out requirements for what they think is more secure. without considering practicality and the underlying overheads. An example is to keep an register to record which OT system uses USB thumb drive. All OT systems use USB because of isolated network environment for file exchange. The key point is how to manage the use of USB securely rather than keeping such a register. We must ask how much protection is increased by adding protection (no matter technical control or administrative control) and will more risks be introduced if not doing so. We must stick to the established policies. If there are "bugs" in the policies, admit it. Schedule revisions with stakeholders involved to align with...
Read More

Trust #4

By cliangNo Comments
A machine in the corner of the mall for digital currency exchange. Whether you use it or not is a kind of risk taking because you don't know what is behind the machine, who operates it, any proper business license to protect your money if things go wrong. In digital world, we must not solely put focus just on cyber protection. Every aspect counts towards a secure business model. From the digital currency operator's perspective, secure cyber protection is not enough. Physical security, anti-tampering to manipulate network connection, I/O port interfaces and so on are all attack vectors. From he customer perspective, trustworthy of the machine is the prime concern. ...
Read More

Clarity

By cliangNo Comments
Policies must be written precisely. That said, clarity is essential or otherwise it will create dispute, confusion in policy enforcement, audit exercise. The illustration has different interpretations: Apartment solely for retired government officials Government managed apartment for senior citizen If this appears in policy statement, it is not ideal. ...
Read More

Availability

By cliangNo Comments
Typical security objectives of cybersecurity are confidentiality, integrity and availability. It's just how they are prioritized in dealing with different use cases. Confidentiality is per the associated information classification to derive the necessary protection. Integrity protection is to understand consequence thru risk assessment what info entities need to protect. Then what about availability? I saw a cybersecurity practitioner developed security policy by copying textbook definition - simply to ensure information is available at all time. Without a measurement, it is not practically achievable. We have to define information must be available per the service pledge. Then, give certain margin in the service pledge with definition availability excludes planned outage for maintenance, achieving say 99.99% at all time. This is the foundation to establish cost-optimal resilience to achieve the committed target. ...
Read More

Enforcement #5

By cliangNo Comments
What can and what cannot be practically enforced? Setting up a written directive (policy statement) is easy. But the actual value of a policy statement is to achieve certain purpose in arriving at the desirable consequence. If something cannot be practically accomplished, that is a bad policy. Some cybersecurity practitioners establish policies very strictly hoping to secure the organization business operations. The pitfall is a large gap will be resulted with reality or the current setup. Flexibility must be built to avoid so many non-compliance cases. Non-compliance also affects the corporate governance in the entire organization. The proper approach is to make it incremental strengthening, listen and adopt feedbacks from field users who will tell what works and what absolutely not works. Even if that works, other elements to consider are maximize the investment for best protection and the urgency to do so. Never establish policies based on media, sales pitch nor textbook knowledge. ...
Read More

Security Culture

By cliangNo Comments
A trivial observation will reveal a lot of issues about the security culture of an organization. 1. Does the organization: Have information security policies in place Define the differennt information classes Provide examples of each information class Establish approval process with appropriate authoritive level to declassify information for sharing Deploy viable means to share confidential materials Communicate properly all staff with mandatory regular refresher programme Integrate information security undertaking in the employment term Impose discrepancy process for policy violation Enforce role based access profile per job function Review periodically for appropriate access rights 2. Do the staff: Have minimal access to information just per the job roles Forget to reclassify the information after approval has been granted Understand what has gone wrong It seems so many issues have been surfaced but this is the challenge and a matter of fact when all of us living in the digital world, not-to-mention unstructured information is everywhere beyond the organization cyber landscape. The bottom line relies on human rather than technologies to secure information mandated by policies (written directives). ...
Read More

ZTNA

By cliangNo Comments
Zero Trust Network Access (ZTNA) is suddenly becoming eye-catching in ICT. No doubt, this will enhance cybersecurity as untrusted by default. The theory is simple: going thru multiple policies (technical configuration settings) and authentication before gaining access to the designated network resources. The controls are applied on who (access roles), when (time of day), what (network resources), where (network location) & why (what type of transaction or business reason). In a nutshell, who to access what resources from where and when with legitimate reason (why). The pitfall is the "how" … how does the existing environment fit with this access model and not-to-mention the changes in user experience. A M2M (Machine to Machine) ZTNA might be applicable use case but this will definitely take a while to transform for access involving human. Even worst, some cybersecurity practitioners introduce this ZTNA model in the ICS environment to combat against cyber threats which are even just conceptual because the ICS environment has...
Read More