FUD #2

By cliangNo Comments
Things outside your comfort zone or knowledge will generate FUD. There are always news exaggreating cyber risks causing severe consequence to certain organizations. Sometimes cyber threats are even just based on perspection with assumption threat actor has gained complete knowledge or your environment and yet skill to achieve this is very complex. As competent cybersecurity practitioner, we must assess the threat situation, what are controls in place and provide management comfort rather than spending unnecessary resources to protect something that does not harm much. Every business exposes to risks and we cannot eliminate all risks but to prioritize the limited resources to maximize protected values. ...
Read More

Patches

By cliangNo Comments
One of the key activities in cybersecurity is to deploy security patches on regular basis. This is intended to upkeep cyber protection strength of the ICT or ICS infrastructure, platform and application. Certain cybersecurity practitioners are just blindly follow text book knowledge to mandate missing patches are policy violation and need to follow exception process. The cyber protection has undergone various strategical changes over the years: from prevention to detection and now resilience because there are a lot of unknowns to make prevention nor detection effective; from physical location centric to context-based because data are everywhere. Bottom line is to apply patches according to the specific business environment via assessing likelihood of exploitation. If the system is isolated from the Internet with strong physical access control and removable media control, there is no urgency to deploy so-called zero-day vulnerability patch. Follow the now, next or never philosophy because some patches are not even needed like the log4j that has been over-amplified to incur...
Read More

Consequence

By cliangNo Comments
Certain cybersecurity practitioners are obsessive on technical controls. They overlook the consequence due to cyber or other non-cyber causes will be the same. Let's look at the illustration. Supposed if the truck has insecure network connection. It might be controlled remotely by threat actors. The adverse consequence might cause the truck hit any target or spill off the load. The same adverse consequence could be due to faults in the brake, fatigue of the chain, improper driving attitude … So, there should be a balance of cyber protection rather than creating many unnecessary technical controls to overkill the usage. More controls means more complex and more human errors will be resulted. ...
Read More

Information Security

By cliangNo Comments
It is the early term in this domain. It covers everything under the sun regarding information.As time goes by, information containers are moving into digital and seldom in hardcopies making it cyber nature and then cybersecurity becomes a fashion and buzzword. We have already replaced fax machine by email or secure electronic communication, carrying thumb drive instead of bundle of hardcopies, balance in stock account replacing the stock certificates. It is true for most of the cases but there are still information in hardcopy forms like birth certificate, marriage certificate, dealth certificate, passport, deed of assignment, legal documents in court etc. Therefore, these are outside the "cyber" sense and we must not forget the necessary protection to secure these kinds of information. The challenge is the "backup" which will require certified true copy issued by authenticated body. Sometimes, you can only have the original copy without backup like passport. Safekeeping the information container in possession is the prime protection. ...
Read More

Policy #10

By cliangNo Comments
In an organization, policy affects the culture and work practices. A good policy is practically achievable, acceptable and having buy-in with all levels why they have to follow these directives. In contrast, badly written policies will create conflict, politics and non-compliance because auditors will point out you are not doing the work according to the policies. Even worst in cybersecurity, certain cybersecurity practitioners micro-manage the protection technology down to brand name but no published standard is available. Everything is just in their mind with word slipping out from their mouth as recommendation. We must always bear in mind that cybersecurity is to help running business securely and don't overkill with unnecessary controls. There are lots of threats outside the cyber domains affecting business. The bottom line is to adopt resilience approach for prompt recovery rather than adding protection because you never know the threats outside your knowledge domain. Protections will require overheads to sustain their effectiveness too. ...
Read More

Architecture

By cliangNo Comments
ICS now totally utilitizes general computing equipment (server, workstatiom, OS, DB, communication) rather than developing own C&I. Therefore, OEM has to test the integration of machineries with these commodities sourced from the market. The industry has already defined the standard architecture how should the different types of components be zoned in the different network segments. Certain cybersecurity practitioners have misused the term architecture review. To be specific, it is the design review how is the design system deviated from the standard architecture, what are the ingress/egress points to the system, what is the worst scenario consequence and the anticipated likelihood to derive the optimal controls. We should not change the approved design by the OEM because they have validated the functionality and usability of the ICS to deliver the outcome. Catching security patches, new software version, adding extra firewall in between or even changing network layer protocol for perceived security could break the ICS. It will then be just like "The operation...
Read More

Improper Control #2

By cliangNo Comments
The detection should be deployed on the "risky" lane at junction Technical control is just one of the security measures. There are much surrounding elements to take care in order to secure. This includes but not limited to: Understand the security objectiveDesign with optimal controlsDeploy with the viable measures (be it technical, administrative or management controls)Verify if controls are deployed per designSustain the effectiveness of the controls Most often, security practitioners are focusing on technical controls with micro management. They forget the bigger picture where the technology stands in the entire business landscape. ...
Read More

Policy Making

By cliangNo Comments
For certain job roles of cybersecurity practitioners, policy making is necessary as a foundation in running the business securely to a reasonably degree. While doing so, we must fully understand the business objectives, operating environment and intended business outcomes taking text book knowledge as a reference rather than blindly applying. Where necessary, suitable qualifier or elaboration is required to enhance clarity. Example is personal privacy. The data subject must be a living individual shall have differentiated the situation in real life. Without this, it is impossible and impractical to enforce by replacing all the tombstone around the globe. ...
Read More

Stepping Stone #2

By cliangNo Comments
Jump hosts are typical used for remote access. These are controls: User accounts with multi-factor authenticationTime of day granted to this user accountRuleset to limit destination hosts when landed; and per login userSession monitoring On reasonable ground, some are mandatory while other extra measures depend. In extreme cases, multiple jump hosts are demanded that whether network latency, usability are at doubt. The optimal decision is to balance risk and usability with a hoslistic and objective assessment. Otherwise, it will be overkilled. ...
Read More

Physics #2

By cliangNo Comments
This is another great example to think deeper to balance cyber and physical world rather than just blindly putting unnecessary investment in cyber protection. There are researchers able to demonstrate remote control of the crane via a Casio watch. Is this scary? Without knowing the exploitation condition, management will be misinformed. We, as security practitioners, must analyze the situation, identify how this can be exploited before provide the correct message. The physical conditions of the crane must also be well under attention. Imagine a loosen bolt / nut, or erected at the improper foundation, incorrect procedure to extend the crane height could all result into the same catastrophic consequence. ...
Read More