Visibility

By cliangNo Comments
In physical world, this creates uncertainties for moving forward. In the cyber world, this means even more. From business perspective, vast amount of information that data analystic is needed to derive management insight in understanding customer profile, product popularity, performance etc. to align with business planning In cybersecurity perspective, this can be considered in various use cases Asset inventory: provides the components in the information processing infrastructure such that prompt reaction to incident and new threats plus properly managing technology obsolescence are possibleSystem events: feeds into SIEM to locate potential threats that has been persistentNetwork traffic: detects traffic flow to detect or block potential malicious activitiesVulnerability: itemizes known technical vulnerabilities to develop counter-measuresPerformance dashboard: provide cybersecurity KPI to drive improvement ...
Read More

Access Control #3

By cliangNo Comments
Controlling cyber (or network) access is always a main concern to limit threat vectors for lateral movement once they have gained a stepping stone within the infrastructure. The physical access aspect must not be forgotten. No matter how sophiscated controls are implemented and in place, if the core equipment is exposed to access at wish, this will defeat all these cyber controls. Bear in mind that all controls are to defer the access as much as possible. There is no bullet proof solution. A comprehensive risk assessment against the target of evaluation is very important to develop effective compensating controls. ...
Read More

Credential

By cliangNo Comments
It's the secret to access your protected resources in the network, or the cyber space. Therefore, you have to keep it to yourself only, traditionally. If we adopt the business continuity concept in personal life, then somehow the secret must be shared with your significant half or else the access is gone forever. Of couse, this must be arranged in advance like asset escrow but so far no credible service in the market for this cyber entity. For optimal & practical setup, use 2-step authentication (most portals now have this feature) and store the password in sealed envelop. This is a split secret arrangement. You hold the second factor with you to control access even the sealed envelop is compromised. ...
Read More

Anonymity

By cliangNo Comments
Privacy is a major concern nowadays. Sensitive info need to be tokenized or masked while leaving functional info unchanged during business analytic or conducting system tests. Nevertheless, a function might be uniquely provided by a particular individual within the information sample. In this case, even if the identity is masked, the functional aspect can also traced back to that particular individual. This is something like weak hashing function subject to reversible attack. This is the situation to watch out and need to voice out the limitation to data subject and data owner. ...
Read More

Certificate

By cliangNo Comments
Cyber Security practitioners need to acquire relevant certification or credential in demonstrating domain expertise or competency. Learning is life time process. Getting certified is not to fulfil employment but a personal acievement. Even if certified, upkeeping the field knowledge and practices is essential or else falling behind. No matter attending academic course or professional training, these are just opportunities to let you learn how to learn. The context involved is just a catalyst in doing so. Alternatively, helping peers or mentoring will also enable knowledge advancement. Therefore, never be complacent. ...
Read More

Recovery

By cliangNo Comments
We heard a lot to have frequent backup as mitigation measure to recover system from attack, most likely from ransomware. While periodic backup is important, the hard part is when do we know if the recovered system still carried the malicious codes that threat actor has planted? That said, the backup has already included the persistent threat. This is complex and situation specific. Some thoughts can be considered: Have digital forensic expert to examine the infected system, understand the attack path and the trigger for malicious codes, revalidate these behaviors after complete system recovery before back to businessSegregate contents from codes; so that a clean system can be built. The challenges are the configuration and data connector; whether persistent threat is stored as data (usually in external supplied content like readers' comment) There is no bullet proof solution but to maintain a hygiene information processing environment in reducing the likelihood: Adopt SecDevOps to address weakness during development and subsequent operationsConduct periodic holistic cybersecurity assessment...
Read More

Life Cycle Management #2

By cliangNo Comments
Like in physical world, automation components do have life time. Example is mechanical attributes of traditional hard disk drive, they are also subject to wear-and-tear during operating life. Storage technology now uses solid state without mechanical portion, we must not forget the underlying platform and applications. Apparently they won't have wear-and-tear operating condition, but the advancement of technology adoption will introduce obsolescence of the platform and applications. From vendors perspective, they will retire products not longer fit for purposes in the market and therefore drop resources to support. Hence, even if your automation components are still operating with minimal wear and tear condition, these components will still need to be refreshed for new version, bugs / vulnerabilities fixed, continuous vendor support in order to maintain the business outcome. Proper life cycle management of the ICT/ICS components cannot be overlooked. ...
Read More

Sense of Security

By cliangNo Comments
This is largely based on preception and trust. How do I trust if the infrastructure or system is secure? We need to look at these core elements: Any regulatory mandate in this industry sector? Pick public transportation as example, mandatory insurance coverage, regular inspection for license renewal, periodic operator training, compliance with safety regulations etc.How well is the service provider doing among peers? Let's say, the type and severity or incidents of this provider in past years among others, rating from customer reviews and comments.How does the service provider demonstrate what has been done to secure? Common examples are personal data handling transparency via the published privacy policy, alert end user on login from other rare locations, security tips in their official portal, committed service level pledge. All the above are applied in both the physical and cyber worlds. ...
Read More

Distance

By cliangNo Comments
Keeping social distance is recommended to avoid virus infection of COVID-19 attack. Similarly, cyber distance takes the same concept to minimize or slow down cyber attack. The cyber distance is done by incorporating perimeters at multiple layers in network and applications. Don't forget the human awareness and usage behavior are the added layers too. ...
Read More

Risk Taking

By cliangNo Comments
We can't have 100% secure solution in the course of business. We need to evalate risk and reduce to acceptable level to achieve our mission. The hard part is an objective assessment of risk with predicted likelihood and the associated value tied with the consequence. The decision support is to review the business outcome values vs the cost to reduce the likelihood. For cyber risk, it is more challenging since when new threats are uncovered, they become immediate impacts. The frequency cannot be predicted using traditional approach. At worst, be prepared bad thing happens with reasonable efforts to recover instead to prevent any KNOWN threats, because there are so many unknowns beyond imagination. ...
Read More