USB Port Misconception

By cliangNo Comments
Most often, people said blocking USB port is a control in the company but somehow there is exception process to "authorize" company USB storage device to connect due to business reason. Two mistakes: 1. USB ports are standard I/O interface now.  There are different needs like keyboard, mouse, IP phone device using USB connection.  They cannot be blocked as a blanket directive.  The proper way to say is to manage removable media. 2. The protection objective is not clear. What is this technical control for: Limit importing malware Limit data leakage Something else With an "authorized" company USB storage device, it will be in vain for any of these cases as long as that company device is shared with other non-company computers.  This is totally outside technical control. The reality is that file exchange is always legitimate business needs.  Providing a means to facilitate secure file exchange will eliminate the use of removable media as well as getting user buy-in. The ultimate control relies on management...
Read More

Cyber Risk Likelihood #2

By cliangNo Comments
In physical world, public touch points are not hygiene.  The more people touch it, the more "dirty" it will be. In cyber world, if a network node has exposured as a public touch point, e.g. accessible elsewhere in the internet, it will become more vulnerable and cyber attack is highly increased. The "distance" to access the network node will influence the cyber risk likelihood rather than prediction based on historical occurrence.  The different layers of protection in between will reduce this cyber risk likelihood. Last but not least, don't forget to secure the physical access path....
Read More

Limitation

By cliangNo Comments
Every technology or system must have inherent limitations: no matter itself or its environment. Say, surveillance via CCTV for physical security, there is still the need to deploy guards patrolling the strategic locations to validate what you see if legitimate and augment the "blind spot" of CCTV coverage. Therefore: Unmanaged limitations will develop into vulnerabilities Exploitable vulnerabilities will become risks Neglected risks will impact the business Regular process review or system vulnerability assessment are then required for continuous cybersecurity strengthening....
Read More

Blockchain

By cliangNo Comments
Everyone is talking about this great technology and every industry is trying to adopt in the business model. Without going deep into technicality and in nutshell, the digital proof of the transaction is established and guaranteed in this distributed ledger.  However, an important element need to think about: how can the digital transaction in the cyber world be enforced for fulfillment in the physical world without any regulation? Think twice: if you have paid ransom via such digital transaction intended to unlock files encrypted by ransomware, how do you ensure that "service" is delivered? Therefore, internal use or limited adoption within closed community enforced with contractual terms are likely the use case in near term....
Read More

Myths of DLP

By cliang1 Comment
The cybersecurity industry commonly names DLP as Data Leakage Prevention.  It lacks of qualifier because the technology just tries to detect/prevent human mistake nor broken business process.  In that sense, DLP is likely capable. There are always many means to exfiltrate data as there are many "holes" in the infrastructure.  The fencing is good to block trespasser but not getting materials thru the fence. Use of DLP or other technology just makes data exfiltration harder, or takes longer time to do so.  Imagine, all of us have cell phone that is an effective tool to beat DLP.  How many organizations will demand surrendering cell phone before: Coming to attend confidential discussion (e.g. the movie "Salt") Accessing sensitive information at workplace Disabling remote access The term shall therefore be rephrased as Data Leakage Protection and set the proper expectation what can be done and what are limitations....
Read More

Least Privilege

By cliangNo Comments
Another practice in physical world is adopted in cyber world - least privilge principle. However, we must bear in mind that privileges could be elevated or circumvented due to system weakness or unmanaged vulnerabilities. Therefore, regular assessment for assurance is required to validate if controls are still effective....
Read More

Zoning

By cliangNo Comments
Many cyber practices are actually adopted from physical world. Zoning is an example. Main purpose is to isolate object path (incoming / outgoing) to secure the port control. Authentication (immigration) and inspection (security screening) are added measures....
Read More

Give and Take

By cliangNo Comments
Cybersecurity and convenience are always contradictory.  The Touch ID is a convenient means to unlock the device and deemed secure because fingerprints are supposed unique. But if we give further thoughts, there are several pitfalls. The Touch ID only protects the data-at-rest scenario. It can't secure your data if your phone is unlocked (data-in-use) nor you submitting sensitive data across the network (data-in-motion). Frequent use of Touch ID will make you tend to forget the text base password, affecting availability in situation you need to provide password Text base password is secure over biometric in a special case: if you are under duress, attacker can force you to unlock your device from your biometric attributes ... even if you are dead; but text base password cannot be extracted from a dead person's mental memory. An example is the locked iPhone from the Boston bomber that evolved into court case to debate national security vs data privacy. This is a matter of expectation...
Read More