360

By cliangNo Comments
In physical world, 360 degree can further be 2D or 3D.  Anyway, it has the sense for a holistic view of the surrounding. In cyber world, there isn't any concept of dimension.  The cyber world is connected via different network, gateway and nodes.  The 360 approach is required to assess risks and attack paths to the cyber applications such that the optimal and effective controls can be deployed....
Read More

Zero

By cliangNo Comments
The topic can associate to many things The boundary between positive and negative value Calibration for instrumentation integrity Absolute zero (temperature) Zero-day exploit, attack One of the 2 binary digits From zero to hero Zero-trust ... The zero-trust model (or architecture) is chosen here.  In cyber space with zero-trust, every component needs to be re authenticated for trust even if inside the network.  This is to limit lateral movement when adversary once gains access to an insecure node. This model will reimagine the work process.  Of course, to what degree applying this model will be the trade off of security and productivity plus the risks tolerated....
Read More

The Human Factor

By cliangNo Comments
Email becomes part of our life in both cyber and physical worlds.  We execute actions in physical world based on email context in cyber world. Email is an example of mixed information classification because the sensitivity is content driven.  Therefore, applying protection per the highest sensitivity requirement will be the one-size-fits-all solution.  Typical email technical controls are S/MIME, TLS, RMS, 2FA etc. No matter how secure the protections are applied, a negligent but legitimate business user will defeat them all. Educate the consequence of improper usage will uplift the human awareness, and becoming the first line of defense....
Read More

100% Cyber Secure

By cliangNo Comments
Are you kidding?  Yes, there is.  These computers are 100% secure from cyber-attack, but ... What about physical threat? Are they still serving the intended purposes? Once these computers are power up (whether connect to network or not), there will be different degrees of cyber risk imposed. So, never expect a 100% cyber risk free solution....
Read More

Privacy

By cliangNo Comments
We all know the importance of privacy and the need to protect it. While protecting privacy, we need to look at regulation requirements in 360 degrees, i.e. we cannot hide something that is supposed mandatory for display. A question for reader: in postal mail, is the window envelop displaying both name and address violating privacy?...
Read More

Shadow IT

By cliangNo Comments
Gartner defines Shadow IT as IT devices, software and services outside the ownership or control of (IT) organizations. Given that information processing facilities or information containers are no longer centralized, the shadow IT is a common phenomenon.  Each one of us has a cellular phone that is indeed a powerful information processing facility and large storage device in the pocket. The extensive connectivity and cloud computing via access anywhere and any platform model further accelerate this situation.  Cyber risks are incurred to different degrees.  Various protection technologies are surfaced in the market: Mobile Device Management, end point lock down, cloud-based proxy, Data Leakage Protection, disk encryption and so forth; but they are never bullet proof. Organization needs to think about enablement (as well as empowerment) rather than prohibitive thru streamlined approach.  Policy formulation, usage guidance, risk management, user awareness and enforcement via disciplinary process are required to minimize the impacts....
Read More

Vulnerability Management

By cliangNo Comments
This is always a debating topic during audit or security assessment. Auditor: your control system lacks of the latest security patches installed and vulnerable to cyber attack Asset owner: security patches must be certified by OEM or else OEM will not be responsible for failure or damages due to non-certified changes made to the control system Whether patches are up to date isn't the key issue.  The bottom line is to understand if there is repeatable mechanism to manage security vulnerabilities.  After all, having all latest patches deployed doesn't mean the control system is secure while any missing patches doesn't mean control system is immediately at risk. The motto from VX Heaven gives a good inspiration: "Viruses don't harm, ignorance does!"...
Read More

Cybersecurity Transformation

By cliangNo Comments
To be successful in cybersecurity transformation, each one in the organization shall contribute as the baseline. Culture or politic in certain organizations prohibits; and this is not just applied to cybersecurity. If you SEE something need improvement and TALK about it with your boss, you'll become the issue owner to handle the resolution.  This drives the culture of don't see and don't talk.  Top  executives don't HEAR things that potentially affects the organization. The essential success factors in the transformation journey include but not limited to: Senior management buy-in Provide necessary support for sustainability (not just a slogan in the air but actually allocate dedicated resources and invest in human capital) Top-down approach to drive end result with metrics Staff own passion adaptive to the changing business environment Once the people barrier is break-thru, other process issues will then go well....
Read More