Tag Archives: security

The IT and Security Leader’s Guide to ISO/IEC 27032

Best Practices, Cloud Computing, Coaching, Cybersecurity, Information Technology, ISO Standard, Security, , ,

The IT and Security Leader’s Guide to ISO/IEC 27032: Building Cyber Resilience in the Digital Age

ISO/IEC 27032 is an international standard focusing on “Cybersecurity” or “Cyberspace Security,” which provides guidelines for enhancing the state of Cybersecurity, drawing attention to the roles and responsibilities of various stakeholders in cyberspace. 

As an IT and Security Leader, understanding and implementing this guidance could be essential for protecting the organization’s information assets.

Here is a brief guide to understanding and utilizing ISO/IEC 27032:

i. Understanding ISO/IEC 27032

A. Developed by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC), ISO/IEC 27032 provides best practices for cybersecurity for cloud computing services.

B. Scope of the Standard: ISO/IEC 27032 addresses Cybersecurity risks and controls when it comes to the internet, cloud computing, and other platforms. It is not a certifiable standard but provides guidelines for ensuring secure operation in a collaborative, interconnected environment.

C. The standard outlines controls across 14 domains, encompassing aspects like risk assessment, security requirements, incident management, and business continuity.

D. Cybersecurity’s Broad Landscape: The standard acknowledges that Cybersecurity is a broader concept than information security since it encompasses the internet and extends to new electronic domains like the Internet of Things (IoT) and social media.

E. Stakeholder Collaboration: It emphasizes collaboration between stakeholders, including individuals, businesses, organizations, and governments. It ensures that there is clarity on roles and responsibilities to protect the shared cyber environment.

F. Guidelines: It offers comprehensive guidance on policies and procedures, aligning technical and management practices with cybersecurity’s unique demands.

ii. Implementing ISO/IEC 27032

A. Understanding ISO/IEC 27032:

   o Familiarize yourself and your team with the ISO/IEC 27032 standard. Understand its principles, objectives, and the role it plays in addressing cybersecurity challenges in cyberspace.

B. Risk Assessment and Management:

   o Conduct a thorough risk assessment specific to cyberspace, considering potential threats, vulnerabilities, and the impact of cyber incidents.

   o Implement risk management processes aligned with ISO/IEC 27032 to prioritize and address identified risks.

C. Establishing a Cybersecurity Policy:

   o Develop a comprehensive cybersecurity policy that aligns with ISO/IEC 27032 requirements.

   o Ensure that the policy addresses the organization’s commitment to cybersecurity, roles and responsibilities, and compliance with relevant laws and regulations.

D. Building a Cybersecurity Framework:

   o Create a cybersecurity framework based on the guidelines provided by ISO/IEC 27032.

   o Integrate the framework with existing IT and security management systems to streamline processes.

E. Engage Leadership and Stakeholders:

    o Ensure executive leadership support for cybersecurity initiatives.

    o Regularly communicate the importance of ISO/IEC 27032 compliance to stakeholders and demonstrate the positive impact on the organization.

F. Implement Controls: Deploy appropriate technical and organizational controls for the management of cyber risks including, but not limited to, encryption, access controls, penetration testing, and incident management frameworks.

G. Promote Cybersecurity Awareness: Cybersecurity is as much about people as it is about technology—initiate organization-wide awareness programs that inform and educate all stakeholders about cyber risks and best practices.

H. Encourage Collaboration: Facilitate collaboration internally and with external partners to ensure consistent adherence to Cybersecurity measures across all platforms and interactions.

I. Continuous Improvement: IT and security leaders must ensure that their cyber-security measures evolve over time. This includes regularly reviewing and updating policies and procedures, testing them to ensure they remain effective, and revising them when necessary because of changing circumstances or new threats.

J. Training and Awareness: It is fundamental to ensure that all employees, not just security personnel, are fully aware of the guidelines and their roles in maintaining cyber security. This can be achieved through regular training and updates.

K. Incident Response Planning: Develop an incident response plan that anticipates potential cyber incidents and outlines a clear response strategy to handle and recover from such events efficiently.

L. Compliance and Legal Considerations: Understand the legal implications related to Cybersecurity within your jurisdiction and ensure your policies comply with those laws.

M. Compliance Monitoring and Reporting:

   o Establish mechanisms for monitoring and reporting on compliance with ISO/IEC 27032.

   o Regularly review cybersecurity performance metrics and adjust strategies accordingly.

N. Cross-referencing with Other Standards: ISO/IEC 27032 may be used in conjunction with other standards such as ISO/IEC 27001 (ISMS) and ISO/IEC 27002 (code of practice for information security controls), ensuring a comprehensive approach to Cybersecurity.

iii. Benefits of Implementation

o Enhanced Cybersecurity Posture: Proactive risk management and mitigation strategies lead to a more secure cloud environment.

o Improved Data Protection: Implementing strong data security controls safeguards sensitive information in the cloud.

o Compliance and Regulation: Adherence to industry standards and regulations demonstrates commitment to data security and builds trust with customers and partners.

o Increased Business Continuity: Robust incident response and disaster recovery plans minimize disruptions and ensure continuous operations.

o Competitive Advantage: Demonstrating a proactive approach to cybersecurity can differentiate your organization and attract clients.

iv. Challenges and Considerations

o Resource Requirements: Implementing and maintaining ISO/IEC 27032 requires dedicated resources, including personnel with expertise in cloud security and compliance.

o Complexity of Cloud Environments: Adapting controls to dynamic and complex cloud environments can be challenging and require ongoing adjustments.

o Change Management: Transitioning to a new security framework necessitates effective change management strategies to overcome resistance and ensure widespread adoption.

v. Conclusion

Embracing ISO/IEC 27032 as IT and security leaders is not just a compliance exercise; it’s an investment in building a more secure and resilient future for your organization in the digital age. By understanding the benefits, key steps, and challenges, you can effectively navigate the implementation process and reap the rewards of enhanced cybersecurity posture, data protection, and sustainable business success.

As an IT and Security Leader, by aligning with ISO/IEC 27032, you not only protect the organization against Cybersecurity threats but also demonstrate commitment to best practices in Cybersecurity, which can enhance the trust and confidence of customers, stakeholders, and partners.

As IT and security leaders, navigating the ever-evolving cybersecurity landscape can be daunting. Fortunately, standards like ISO/IEC 27032 provide a valuable framework to build robust cybersecurity practices and mitigate evolving threats. This guide offers a comprehensive overview of how IT and security leaders can benefit from implementing ISO/IEC 27032:

Remember: ISO/IEC 27032 is a dynamic standard, so staying updated on revisions and emerging threats is crucial to maintain an effective cloud security posture. Continuous improvement and adaptation are key to achieving the full potential of this valuable framework.

vi. Further references 

The IT and Security Leader’s Guide to ISO/IEC 27032

https://www.linkedin.com/pulse/fundamentals-isoiec-27032-what-you-need-know-polyd-1c

https://www.itnewsafrica.com/2023/01/who-should-get-iso-iec-27032-certified-and-why-a-guide-for-it-and-security-leaders/

https://medium.com/@386konsult.com/iso-27032-guidelines-for-cybersecurity-management-cbb025267888

CyBOK’s Cyber-Physical Systems Security Knowledge Area

Best Practices, Body of Knowledge, Cyber-Physical, Cybersecurity, CyBOK, Governance Risk & Compliance, Knowledge Area, Security, Systems, , , , , ,

The Cyber-Physical Systems Security (CPS) Knowledge Area is part of the Cyber Security Body of Knowledge (CyBOK). It concerns the security issues that arise in systems where the virtual world of computing intersects the physical world. 

Cyber-Physical Systems (CPS) are complex systems where a collection of computing devices interact with the physical world. These can include systems like industrial control systems, autonomous vehicles, medical monitoring, traffic control systems, and many others. 

CPSes often have networked sensors, controls, processors, and software components that affect and are affected by their physical surroundings.

i. What are Cyber-Physical Systems (CPS)?

Cyber-physical systems (CPS) are engineered systems that tightly integrate computation, communication, and physical processes. 

They are becoming increasingly common in a variety of industries, including:

A. Manufacturing: CPS can be used to automate production lines, optimize resource usage, and improve product quality.

 B. Transportation: CPS can be used to improve traffic flow, manage congestion, and prevent accidents.

 C. Healthcare:  CPS can be used to monitor patients’ health, deliver medication, and perform surgery.

 D. Energy:  CPS can be used to manage the power grid, optimize energy consumption, and prevent blackouts.

ii. Why is CPS security important?

CPS are often critical infrastructure, and their security is essential for protecting public safety, economic stability, and national security. 

Attacks on CPS can have a wide range of consequences, including:

 A. Physical damage:  For example, an attacker could hack into a power grid and cause a blackout.

 B. Loss of life:  For example, an attacker could hack into a medical device and harm a patient.

 C. Economic damage:  For example, an attacker could hack into a manufacturing system and cause production to stop.

iii. What are the challenges of CPS security?

CPS security is challenging for a number of reasons, including:

 A. Heterogeneity:  CPS are often made up of a variety of different devices and systems, which can make it difficult to secure them effectively.

 B. Legacy systems:  Many CPS are based on legacy systems that were not designed with security in mind.

 C. Physical access:  Attackers may be able to gain physical access to CPS, which can make them more vulnerable to attack.

iv. The CPS Security Knowledge Area typically covers the following topics:

A. CPS Concepts: Understanding the basics of how CPS operates, including systems theory, real-time computing, and control theory.

B. Physical Process and System Modeling: This covers the modeling of physical systems, understanding the physical processes involved, and learning how to derive and use these models in a cybersecurity context.

C. Attacks, Threat Actors, and Incentives: This part discusses potential threats to CPS, including the motivations behind such attacks and the vulnerabilities they may target.

D. Security Technologies and Their Limitations: Understand the cybersecurity tech available for protecting CPS. This includes encryption, intrusion detection systems, secure communication protocols, etc., and understanding their limitations in different scenarios.

E. Risk Management and Security Measures: This encompasses the identification, assessment, and prioritization of risks followed by coordinated application of resources to minimize, monitor, and control the probability or impact of incidents.

F. Resilience and Fault Tolerance: This includes strategies to ensure the CPS can continue operating safely even during attacks or failures.

G. Safety and Security Co-engineering: Simultaneous consideration and integration of both safety and security aspects during the development process can result in more robust and secure systems.

H. Security Governance and Management: Discussing the management, organization, and regulation of CPS security in various contexts, including industrial, transportation, and healthcare settings.

I. Security Lifecycle Management: Understanding the stages of the lifecycle of CPS, from requirements analysis, design, implementation, operation, maintenance, and decommission, and how security considerations are integrated at each stage.

J. Regulatory and Compliance Aspects: Discussion of legal and regulatory aspects related to critical infrastructures, and specific sectors that rely heavily on CPS.

v. Some additional resources that you may find helpful:

 o The National Institute of Standards and Technology (NIST) Cybersecurity Framework for Cyber-Physical Systems (CSFv2)

 o The International Electrotechnical Commission (IEC) 62443 standard for industrial automation and control systems security. 

By understanding the Cyber-Physical Systems Security knowledge area, cybersecurity professionals can better protect systems that are deeply embedded in the physical world, ensuring not only digital but also physical safety.

A solid understanding of CPS Security is very useful for professionals working in fields where systems intersect with the physical world. This can range from security experts in industries using industrial control systems to software engineers working on autonomous vehicles or IoT (Internet of Things).

https://www.startus-insights.com/innovators-guide/cyber-physical-systems/

https://research.ncl.ac.uk/cplab/aboutthelab/whatarecyber-physicalsystems/

https://www.linkedin.com/pulse/cyber-physical-systems-omegaconsulting-online

CyBOK’s Physical Layer & Telecommunications Security Knowledge Area

Best Practices, Body of Knowledge, Coaching, Cybersecurity, CyBOK, Governance Risk & Compliance, Knowledge Area, Network Security, Physical Layer, Telecommunications, , , ,

CyBOK (Cyber Security Body of Knowledge) is a comprehensive framework that aims to define the core areas of knowledge within the field of cybersecurity. 

One of the knowledge areas within CyBOK is the “Physical Layer & Telecommunications Security” knowledge area. This area focuses on understanding and protecting the physical infrastructure and communication channels that underpin information systems.

The physical layer relates to the tangible components of information systems, such as physical devices, hardware, and the network infrastructure. Telecommunications security, on the other hand, specifically deals with securing the communication channels used to transmit data between devices, systems, or networks.

i. Here’s a breakdown of the key topics covered in the KA:

A. Physical Layer Concepts: Understanding the basics of how data is physically transmitted and received, including signal propagation, encoding, and modulation.

B. Physical Infrastructure Security: This includes securing data centers, server rooms, telecommunication facilities, and other physical components of information systems. It encompasses physical access controls, surveillance, perimeter security, and protection against environmental threats like fire, flood, or power interruptions.

C. Network Security: This covers securing the network infrastructure, including routers, switches, cabling, and other network devices. It addresses topics such as network segmentation, intrusion detection and prevention systems, secure configurations, and traffic monitoring.

D. Transmission Media Security: This focuses on securing the transmission media used for communication, such as wired (e.g., fiber optic, Ethernet) and wireless (e.g., Wi-Fi, cellular) channels. It involves measures to protect against eavesdropping, data interception, unauthorized access, electromagnetic interference, and signal jamming.

E. Telecommunications Protocols: This involves understanding and securing the protocols used for transmitting data, such as TCP/IP, Ethernet, Wi-Fi, Bluetooth, and cellular protocols. It includes topics like encryption, authentication, access control, and secure configuration of communication protocols.

F. Wireless Channel Characteristics:

o Understanding the fundamentals of electromagnetic waves and how they propagate through different mediums.

o Analyzing factors like multipath propagation, fading, and interference that impact wireless communication security.

o Exploring modulation techniques used in various wireless communication standards and their implications for security.

G. Wireless Physical Layer Security Mechanisms:

o Reviewing techniques for confidentiality like spread spectrum, frequency hopping, and encryption at the physical layer.

o Examining integrity mechanisms like cyclic redundancy checks (CRCs) and forward error correction (FEC) codes.

o Understanding access control mechanisms like carrier sense multiple access (CSMA) and media access control (MAC) protocols from a security perspective.

H. Physical Layer Vulnerabilities and Threats:

o Identifying common vulnerabilities in wireless communication systems, such as jamming, eavesdropping, and spoofing.

o Analyzing different categories of attacks that exploit physical layer vulnerabilities, including denial-of-service (DoS) attacks, replay attacks, and man-in-the-middle attacks.

o Understanding the risks associated with unintentional radio frequency (RF) emanations.

I. Physical Layer Countermeasures and Detection Techniques:

o Exploring techniques for mitigating threats and vulnerabilities at the physical layer, such as frequency agility, jamming resistance, and directional antennas.

o Discussing methods for detecting and monitoring suspicious activity at the physical layer, including spectrum analysis and intrusion detection systems (IDS).

o Reviewing methodologies for secure physical layer key establishment and authentication.

J. Emanation Security: Techniques like TEMPEST to prevent eavesdropping on electromagnetic emissions from electronic equipment.

K. Applications and Case Studies:

o Examining how physical layer security principles are applied in real-world scenarios, such as mobile networks, wireless sensor networks, and RFID systems.

o Analyzing case studies of successful and unsuccessful physical layer attacks to learn from past experiences.

o Exploring cutting-edge research and development in the field of physical layer security.

L. Cryptography: This area explores methods and techniques for securing data through encryption, decryption, and cryptographic algorithms. It includes studying symmetric and asymmetric encryption, key management, digital signatures, secure hash functions, and cryptographic protocols.

M. Telecommunications Service Providers: This covers the security considerations and requirements for telecommunications service providers. It involves understanding the security controls, service-level agreements, regulatory compliance, and secure interfaces between different service providers.

N. Access Control to Physical Resources: Securing access to physical infrastructure, network hubs, servers, and the implementation of measures like locks, biometric systems, and surveillance to safeguard equipment.

O. Telecommunications Infrastructure Security: Addressing the security concerns related to the infrastructure of telecommunications networks, such as cellular networks, satellites, and the Public Switched Telephone Network (PSTN).

P. Regulatory Standards and Best Practices: Understanding the compliance and legal aspects of physical security including industry standards and guidelines.

ii. Benefits of understanding the KA:

o Enhanced security posture: Grasping the vulnerabilities and threats at the physical layer enables organizations to develop stronger defenses against potential attacks.

o Improved wireless network security: Understanding secure physical layer mechanisms can guide the selection and implementation of secure wireless communication technologies.

o Greater awareness of emerging threats: Staying updated on the latest research and developments in physical layer security allows organizations to stay ahead of the curve and proactively mitigate new threats.

iii. Resources:

o The CyBOK website provides a wealth of resources for learning more about the KA, including:

    o The FA Knowledge Product: A comprehensive overview of the FA content.

    o The CyBOK Glossary: Definitions of key terms used in the FA.

    o The CyBOK Training Catalog: Lists training courses that cover the FA content.

o Other valuable resources include academic papers, industry reports, and conferences focused on physical layer security.

For those working in or studying cybersecurity, knowledge of the physical layer is fundamental, as it is where data is most tangibly interfaced with and, hence, can be susceptible to a range of attacks that must be mitigated to ensure the security of an information system as a whole.

https://www.cybok.org/media/downloads/Physical_Layer__Telecommunications_Security_issue_1.0.pdf

https://www.sciencedirect.com/topics/computer-science/physical-layer-security

https://cs.slu.edu/~espositof/teaching/4530/resources/Physical-Layer-Security.pdf

CyBOK’s Formal Methods for Security Knowledge Area

Best Practices, Body of Knowledge, Coaching, Cybersecurity, CyBOK, Formal Methods, Governance Risk & Compliance, Knowledge Area, Secure SDLC, Security, , , , , , , ,

The Cyber Security Body Of Knowledge, or CyBOK, is a scholarly initiative aimed at codifying the foundational and generally recognized knowledge on cybersecurity. 

The “Formal Methods for Security Knowledge Area” is one of the areas covered in the CyBOK. Formal Methods are mathematical approaches used for the specification, development, and verification of software and hardware systems.

In the context of security, formal methods can play a significant role in ensuring that systems are secure by design.

The application of formal methods in security can greatly reduce the risk of design flaws, which can be exploited as security vulnerabilities. However, it’s important to note that formal methods also come with challenges such as scalability and complexity, and they often require significant expertise to apply effectively.

i. Key aspects of the Formal Methods for Security Knowledge Area (KA)

A. Foundations of formal methods: Explores the theoretical underpinnings of formal methods, including logic systems, formal languages, and verification techniques.

B. Modeling and abstraction: Discusses how to create accurate and concise formal models of systems, focusing on security-relevant aspects.

C. Verification and analysis: Covers various techniques for verifying and analyzing security properties of systems, such as model checking, theorem proving, and symbolic execution.

D. Applications in security: Examines the practical application of formal methods in different security domains, including access control, information flow, cryptography, and network security.

E. Challenges and limitations: Addresses the challenges and limitations of using formal methods in security, such as scalability, complexity, and tool support.

ii. Key concepts covered in the Formal Methods for Security Knowledge Area (KA)

A. Formal languages: Languages like temporal logic, modal logic, and process calculi that represent system behavior and security properties.

B. Models and abstractions: Abstractions like finite-state machines, Petri nets, and process algebra models that capture key aspects of systems for analysis.

C. Verification techniques: Techniques like model checking, theorem proving, and symbolic execution that prove or disprove the presence of desired security properties in models.

D. Security properties: Properties like confidentiality, integrity, availability, non-repudiation, and accountability that formal methods can be used to verify.

E. Formal tools and languages: Tools like theorem provers, model checkers, and specification languages that support the application of formal methods in security.

iii. Benefits of understanding Formal Methods for Security

A. Enhanced system security: Formal methods can help develop more secure systems by rigorously verifying and eliminating vulnerabilities before deployment.

B. Improved design and development: Formal models can guide the design and development process, ensuring adherence to security principles.

C. Increased confidence in systems: Rigorous verification using formal methods can build confidence in the security of developed systems.

D. Automated analysis and verification: Formal tools can perform automated analysis and verification, saving time and resources compared to manual testing.

E. Reduced risk of vulnerabilities: Early identification and elimination of vulnerabilities through formal methods lead to reduced risk of exploits and breaches.

iv. How formal methods can contribute to cybersecurity

A. Specification: Formal methods allow for the precise and unambiguous specification of system and security requirements. By using formal languages to express these specifications, it is possible to eliminate the ambiguities that are often present in natural language descriptions.

B. Modeling: Formal modeling gives a clear framework for understanding the security properties of a system before it is built. This can include creating abstract models of the system and potential threat models that can highlight security weaknesses.

C. Verification: Formal methods can be used to prove that a system’s security properties hold true under certain assumptions. This can involve proving the correctness of protocols or algorithms, thereby ensuring that they are free from security flaws.

D. Analysis: Using formal methods can help in analyzing the system for vulnerabilities. Through tools like model checking, it is possible to explore all possible states of a system to check for security violations.

E. Design: Formal methods can guide the design of security mechanisms by providing a clear framework within which these mechanisms can be developed and verified.

v. Aspects of Formal Methods in Cybersecurity 

A. Formal Methods Overview:

   o Aspect: Applying mathematical and formal techniques for specifying, designing, and verifying security properties in systems.

   o Objective: Provides a rigorous and structured approach to ensuring security correctness.

B. Mathematical Modeling for Security:

   o Aspect: Using mathematical models to represent security policies, protocols, and system behaviors.

   o Objective: Enables precise analysis and verification of security properties.

C Theorem Proving and Formal Verification:

   o Aspect: Applying formal methods like theorem proving to verify the correctness of security protocols or system components.

   o Objective: Rigorously proves the absence of certain vulnerabilities or security flaws.

D. Model Checking:

   o Aspect: Systematically checking finite state models of a system to verify security properties.

   o Objective: Helps in identifying and eliminating potential security vulnerabilities.

E. Specification Languages:

   o Aspect: Using formal specification languages to describe security requirements and properties.

   o Objective: Provides a clear and unambiguous representation of security expectations.

F. Security Protocol Analysis:

   o Aspect: Applying formal methods to analyze and verify the correctness of security protocols.

   o Objective: Ensures that cryptographic protocols function securely and resist various attacks.

G. Automated Reasoning:

   o Aspect: Employing automated reasoning tools to analyze security properties.

   o Objective: Enhances the efficiency of security analysis, especially in complex systems.

H. Formal Methods in Software Development:

   o Aspect: Integrating formal methods into the software development lifecycle for security assurance.

   o Objective: Helps in building secure systems from the ground up.

I. Concurrency and Parallelism in Security Models:

   o Aspect: Addressing security challenges related to concurrent and parallel execution in distributed systems.

   o Objective: Ensures that security properties hold even in concurrent or parallel processing scenarios.

J. Application to Hardware Security:

    o Aspect: Extending formal methods to verify security properties in hardware design.

    o Objective: Ensures the security of hardware components in computing systems.

K. Combining Formal Methods with Other Approaches:

    o Aspect: Integrating formal methods with other cybersecurity approaches for comprehensive security assurance.

    o Objective: Takes advantage of the strengths of formal methods in conjunction with other security practices.

vi. Resources for further exploration

A. CyBOK: Formal Methods for Security Knowledge Area – [https://www.cybok.org/media/downloads/Formal_Methods_for_Security_v1.0.0.pdf](https://www.cybok.org/media/downloads/Formal_Methods_for_Security_v1.0.0.pdf)

B. National Institute of Standards and Technology (NIST) Special Publication 800-188: Software Security Engineering – [https://www.nist.gov/privacy-framework/nist-sp-800-188](https://www.nist.gov/privacy-framework/nist-sp-800-188)

C. International Symposium on Formal Methods (FM) – [https://fmi.or.id/downloads/](https://fmi.or.id/downloads/)

CyBOK’s handling of formal methods includes guidance on their scope and limitations, methodology, and practical applications within cybersecurity, with real-world examples and case studies to illustrate their use in industry and government settings. It is part of a broader effort to provide a reliable reference for academic programs, professionals, and practitioners in the field of cybersecurity.

By understanding and leveraging the knowledge and techniques offered by the Formal Methods for Security KA, organizations can significantly improve the security posture of their systems and software, contributing to a more secure and trustworthy digital environment.

https://dl.acm.org/doi/10.1145/3522582

https://link.springer.com/article/10.1007/s10639-022-11261-8#change-history

https://people.scs.carleton.ca/~paulv/papers/SKno2.pdf

Architecture Risk Analysis (ARA)

Architecture, Best Practices, Body of Knowledge, Coaching, Governance Risk & Compliance, Information Technology, Methodology, Risk Analysis, Secure SDLC, Security, , , , , , ,

Architecture Risk Analysis (ARA) is a process that specifically focuses on identifying and addressing risks that can compromise the architecture of a software system. 

i. What is ARA?

Architecture Risk Analysis (ARA) is a comprehensive review of a system’s design to identify potential security vulnerabilities and weaknesses. It aims to address security flaws early in the development process, preventing costly rework later and ensuring a more secure and resilient system.

ii. Objectives of ARA

A. Security: Ensure the architecture adequately protects assets and meets security requirements.

B. Performance: Verify the architecture can support the required performance levels under expected loads.

C. Availability and Reliability: Ensure the system design is robust, can handle faults, and maximizes uptime.

D. Maintainability and Scalability: Confirm the architecture can adapt to future changes and growth.

iii. Benefits of ARA

A. Early identification and mitigation of risks: Identifying security vulnerabilities early in the design phase saves time and resources compared to fixing them later in development or production.

B. Improved system security: ARA helps ensure that systems adhere to secure design principles, leading to a more robust and secure deployment.

C. Reduced compliance risks: By addressing security concerns early, organizations can reduce the risk of non-compliance with regulations.

D. Enhanced decision-making: ARA provides valuable insights that inform design decisions and promote a security-first approach.

E. Increased stakeholder confidence: By demonstrating a commitment to security, ARAs can build trust and confidence among stakeholders.

iv. ARA Process Steps

A. Scope Definition: Define the parts of the architecture that are to be analyzed, including the system’s components, their interactions, and security boundaries.

B. Information Gathering: Collect all relevant information about the architecture, such as design documents, threat models, workflow diagrams, and use cases.

C. Threat Identification: Recognize potential threats to the system by considering different threat agents, the value of the assets at risk, and known vulnerabilities.

D. Vulnerability Analysis: Identify weaknesses within the architecture that could be exploited by threats, such as design flaws or improper configurations.

E. Risk Assessment: Evaluate the risk level for each identified threat and vulnerability pair, often by considering the potential impact and likelihood of exploitation.

F. Mitigation Strategies: Develop strategies to reduce or eliminate risks, such as adding security controls, redesigning components, or implementing best practices.

G. Decision Documenting: Document decisions made about accepting, mitigating, transferring, or avoiding risks, including rationales for these decisions.

H. Residual Risk Analysis: Analyze and document risks that remain after mitigation strategies have been applied.

I. Action Planning: Define action items and plans to implement the chosen mitigation strategies.

J. Monitoring and Review: Establish procedures for ongoing monitoring of risks and review points to reassess the architecture as the system evolves.

v. ARA Techniques

A. Dependency analysis: Identifies critical dependencies between system components and analyzes the potential impact of vulnerabilities in one component on others.

B. Known attack analysis: Examines known attack patterns and techniques to identify vulnerabilities in the system design that could be exploited.

C. System-specific analysis: Analyzes specific aspects of the system design, such as authentication mechanisms, access control, and data security controls, to identify weaknesses.

D. Threat modeling: Identifies potential threats to the system and analyzes their impact on system assets.

vi. ARA Tools and Technologies

A. Security architecture modeling tools: These tools help visualize the system architecture and identify potential vulnerabilities.

B. Vulnerability scanning tools: These tools scan the system for known vulnerabilities and weaknesses.

C. Threat modeling tools: These tools help to identify and analyze potential threats to the system.

vii. Best Practices for Effective ARA

A. Involve stakeholders across the organization: Ensure key stakeholders from various departments participate in the ARA process.

B. Focus on critical assets: Prioritize the analysis of risks that could impact critical assets and data.

C. Use a structured methodology: Employ a standardized approach for conducting ARAs to ensure consistency and effectiveness.

D. Continuously monitor and update: Regularly review and update the ARA as the system evolves and new threats emerge.

E. Communicate findings and recommendations: Clearly communicate identified risks and mitigation strategies to stakeholders for informed decision-making.

viii. Tools and Techniques Used in ARA

A. Checklists: Pre-defined lists of risks, vulnerabilities, and checks specific to the architecture.

B. Modeling and Simulation: Creating models to simulate the architecture behaviors under various conditions and attacks.

C. Expert Elicitation: Leveraging the knowledge of experienced professionals in identifying and mitigating risks.

D. Automated Analysis Tools: Utilizing software tools to scan and analyze the architecture against known vulnerabilities.

ix. Stakeholders Involved in ARA

A. Architecture Team: Ensure the architectural choices align with business objectives and risk thresholds.

B. Security Team: Provide expertise in identifying and addressing security risks.

C. Development Team: Implement necessary changes to mitigate risks.

D. Business Owners/Product managers: Understand the impact of risks on business objectives and make risk management decisions.

Architecture Risk Analysis is a process of identifying potential risks and vulnerabilities in a system architecture or design. It helps in evaluating the potential impact of risks on the system and formulating strategies to mitigate them.

ARA is an integral part of systems development and is carried out at multiple points in the system lifecycle, providing a structured technique for understanding the risk in the context of system architecture. By systematically reviewing potential risks to the architecture, stakeholders can make informed decisions about how to manage those risks in alignment with their overall risk management and business strategies.

https://www.guardrails.io/blog/security-debt-vs-technical-debt/

https://www.garymcgraw.com/wp-content/uploads/2020/02/BIML-ARA.pdf

https://jaatun.no/papers/2019/agile-ara.pdf

CyBOK’s Distributed Systems Security Knowledge Area

Architecture, Best Practices, Body of Knowledge, Coaching, CyBOK, Distributed Systems, Governance Risk & Compliance, Information Technology, Knowledge Area, Security, , , , ,

The Distributed Systems Security Knowledge Area (KA) within the Cyber Security Body of Knowledge (CyBOK) focuses on the unique security challenges and considerations associated with distributed systems. 

These systems are becoming increasingly prevalent in modern organizations, but their inherent complexity introduces new vulnerabilities and attack vectors.

i. Key aspects of the Distributed Systems Security Knowledge Area (KA)

A. Understanding distributed systems: This includes exploring the various types of distributed systems, their functionalities, and the communication protocols they use.

B. Security vulnerabilities in distributed systems: Identifying the specific vulnerabilities and attack surfaces inherent to distributed systems, such as distributed consensus, time synchronization, and event systems.

Security mechanisms for distributed systems: Examining various security mechanisms designed to protect distributed systems, such as secure communication protocols, distributed authentication, authorization, and access control solutions.

Incident response and forensics: Understanding how to respond to security incidents in distributed systems and investigate them effectively.

Emerging trends and technologies: Exploring new technologies and trends impacting distributed systems security, such as blockchain, decentralized applications, and cloud computing.

ii. Key concepts covered in the Distributed Systems Security Knowledge Area (KA)

A. Principles and Concepts of Secure Distributed Systems Design: Emphasizes on designing secure distributed systems with concepts like the principle of least privilege, separation of duties, and defense in depth.

B. Decentralized vs. coordinated distributed systems: Understanding the differences between these two types of distributed systems and their respective security challenges.

C. Distributed consensus protocols: Examining how distributed systems achieve consensus on shared state information and the associated security considerations.

D. Byzantine fault tolerance: Exploring mechanisms for ensuring system reliability and consistency even in the presence of faulty or malicious nodes.

E. Distributed authentication and authorization: Analyzing how users and services are authenticated and authorized in a distributed environment.

F. Access Control in Distributed Systems: Focuses on methods for controlling access to resources in a distributed system including models like Role-Based Access Control (RBAC) and Attribute-Based Access Control (ABAC).

G. Distributed Systems Threats and Protections: It includes understanding the various threats unique to distributed systems (like session hijacking, distributed DoS), strategies for protecting distributed systems, and the tools and techniques used for securing them.

H. Security in Cloud Computing: This is a particular focus on security aspects in cloud computing environments including virtualization security, cloud specific threats, data privacy and isolation in the cloud, and best practices for cloud security.

I. Security of the Internet of Things (IoT): Understanding how to secure distributed systems comprised of interconnected devices in the IoT environment.

iii. Benefits of understanding Distributed Systems Security

A. Improved security posture for distributed systems: Organizations can leverage this knowledge to implement effective security controls and mitigate vulnerabilities within their distributed systems.

B. Enhanced development and deployment of secure distributed systems: Developers and architects can build secure distributed systems from the ground up by understanding security considerations throughout the development process.

C. Reduced risks associated with distributed systems: By understanding the potential threats and vulnerabilities, organizations can proactively mitigate risks and respond effectively to incidents.

D. Improved incident response and forensics: Familiarity with the unique challenges of investigating incidents in distributed systems can lead to faster and more effective resolution.

E. Preparedness for emerging trends: Understanding the security implications of new technologies and trends in distributed systems can help organizations stay ahead of threats and adapt their security strategies accordingly.

iv. General principles for securing distributed systems

A. Network Security:

   o Principle: Implementing security measures to protect data during transmission within distributed networks.

   o Objective: Safeguards against eavesdropping, data tampering, and unauthorized access.

B. Authentication and Authorization:

   o Principle: Establishing mechanisms for authenticating and authorizing users and components in a distributed environment.

   o Objective: Ensures that only authorized entities can access resources.

C. Secure Communication Protocols:

   o Principle: Selecting and implementing secure communication protocols for interactions between distributed components.

   o Objective: Protects against interception and manipulation of data during communication.

D. Data Encryption:

   o Principle: Encrypting sensitive data at rest and in transit within distributed systems.

   o Objective: Adds an additional layer of protection to prevent unauthorized access.

E. Fault Tolerance and Resilience:

   o Principle: Implementing strategies to maintain system functionality and security in the face of failures or attacks.

   o Objective: Ensures continuous operation despite disruptions.

F. Distributed Identity Management:

   o Principle: Managing and securing identities in a distributed environment.

   o Objective: Ensures proper identification and authentication of entities across the distributed system.

G. Access Control Mechanisms:

   o Principle: Enforcing access controls to regulate permissions and restrict unauthorized access.

   o Objective: Prevents unauthorized users or components from compromising the integrity of the system.

H. Intrusion Detection and Prevention:

   o Principle: Implementing mechanisms to detect and prevent intrusions across distributed components.

   o Objective: Early detection and prevention of security breaches.

I. Secure Coding Practices:

   o Principle: Adhering to secure coding practices when developing distributed system components.

   o Objective: Mitigates vulnerabilities and reduces the risk of exploitation.

J. Logging and Auditing:

    o Principle: Implementing logging and auditing mechanisms for monitoring activities within distributed systems.

    o Objective: Facilitates post-incident analysis and forensic investigations.

K. Security Updates and Patch Management:

    o Principle: Managing and applying security updates and patches consistently across distributed components.

    o Objective: Addresses vulnerabilities and ensures a secure and up-to-date system.

L. Distributed Denial of Service (DDoS) Protection:

    o Principle: Implementing measures to mitigate and prevent DDoS attacks on distributed systems.

    o Objective: Ensures availability and performance under attack conditions.

v. Resources for further exploration

A. CyBOK: Distributed Systems Security Knowledge Area – [https://www.cybok.org/media/downloads/Distributed_Systems_Security_issue_1.0.pdf](https://www.cybok.org/media/downloads/Distributed_Systems_Security_issue_1.0.pdf)

B. National Institute of Standards and Technology (NIST) Cloud Computing Security Reference Architecture – [https://www.nist.gov/publications/guidelines-security-and-privacy-public-cloud-computing](https://www.nist.gov/publications/guidelines-security-and-privacy-public-cloud-computing)

C. Open Web Application Security Project (OWASP) Internet of Things Top 10 – [https://owasp.org/www-chapter-toronto/assets/slides/2019-12-11-OWASP-IoT-Top-10—Introduction-and-Root-Causes.pdf](https://owasp.org/www-chapter-toronto/assets/slides/2019-12-11-OWASP-IoT-Top-10—Introduction-and-Root-Causes.pdf)

Distributed Systems Security is a pivotal knowledge area within the Cyber Security Body of Knowledge (CyBOK). It concerns the various challenges, designs, and methods connected to securing distributed systems.

By incorporating the knowledge and insights provided by the Distributed Systems Security KA, organizations can build and operate secure and resilient distributed systems essential for their success in today’s interconnected world.

https://www.cybersecpro-project.eu/wp-content/uploads/2023/07/D2.1_Cybersecurity_Practical_Skills_Gaps_in_Europe_v.1.0.pdf

https://www.linkedin.com/advice/3/how-do-you-secure-protect-distributed-system-from-cyberattacks

https://www.splunk.com/en_us/blog/learn/distributed-systems.html

https://ee.stanford.edu/research/software-systems

What are the most effective use cases for data provenance?

Artificial, Data, Effective, Information, Intelligence, Provenance, Safeguard, Security, Technology Trends, Use Case, , , , ,

Data Provenance, the ability to trace and verify the origin of data, its movement, and its processing history, is valuable in several use cases. 

Here are some of the most prominent verticals:

A. Agriculture Sector: Farmers, suppliers, and customers can use data provenance to trace a product’s origin and journey. This activates a more transparent food supply chain and supports the production of fair trade, organic and sustainably sourced products.

B. Art Industry: In this field, data provenance helps authenticate and trace the origins of artwork. This validates authenticity, ownership, and helps prevent art forgery.

C. Business Analytics: Provenance allows businesses to trace the origin of the data behind their business intelligence insights, which adds an additional level of confidence and credibility to their decision-making process.

D. Cybersecurity: Organizations use data provenance to keep track of changes made to their data. By knowing the source and history of a file, firms can better detect unauthorized data access or manipulation.

E. Data Governance: Organizations employ data provenance in their data governance strategy to understand their data sources, transformations, and users better, thereby ensuring high data quality.

F. Digital Forensics: Provenance assists in tracking the source and movement of digital information that can help in crime investigations and fraud detection.

G. Education Sector: Universities and education providers can use data provenance to authenticate academic credentials, thereby reducing instances of qualification fraud.

H. Energy Sector: Energy companies use data provenance to optimize their energy distribution, track energy consumption, and implement better energy-saving solutions.

I. Finance and Banking: For regulatory and auditing purposes, banks and financial institutions should trace all the financial transactions. Provenance ensures transactions are valid and helps to detect fraudulent activities.

J. Government and Public Services: Governments can use data provenance to authenticate and trace documents, improving public service transparency and efficiency. It’s also useful in fraud detection and prevention.

K. Healthcare: Medical records often pass through various departments, clinics, or hospitals. Data provenance ensures the traceability of patient records, prescriptions, treatments, and diagnosis histories, essential for patient safety and care.

L. Insurance: Companies use data provenance for claims management and fraud detection. Insurers can trace and verify the origin of the claim data, making it easier to identify potential fraud.

M. Journalism and Media: With fake news on the rise, data provenance can help verify the origin of information, increasing trust in published content.

O. Pharmaceutical Industry: Here, data provenance is used to validate the origins of medication and verify its journey through the supply chain. This can prevent counterfeit drug distribution and ensure patient safety.

P. Scientific research: Data provenance plays a crucial role in experimental sciences where researchers need to track the origin and transformation of the data throughout their experiments, facilitating replication and validation of the results.

Q. Supply Chain Management: In industries like food, fashion, and manufacturing, data provenance helps map product origin and journey, ensuring authenticity, sustainability, and regulatory compliance.

R. Technology Industry: Technology companies use data provenance to improve the performance and reliability of their products and services.

Understanding the origins and transformations of data is vital in an era where data-driven decision making is increasingly common. Using data provenance, organizations can ensure their data is accurate, consistent, and reliable.

In addition to these specific use cases, data provenance can be used to improve a variety of data-driven processes, such as data governance, data quality management, and data security.

Here are some examples of how data provenance is being used in practice:

A. Auditing and Accountability: Facilitating auditing processes by allowing organizations to trace the flow of data and understand who accessed or modified it. This enhances accountability and helps in identifying potential security breaches or unauthorized access.

B. Blockchain and Smart Contracts: Supporting blockchain applications and smart contracts by providing a transparent record of data transactions. This enhances the trustworthiness and reliability of blockchain-based systems.

C. Business Process Optimization: Optimizing business processes by analyzing the data provenance to identify bottlenecks, inefficiencies, or areas for improvement. This contributes to overall process optimization and efficiency gains.

D. Comprehensive Analytics: Enabling data scientists and analysts to understand the context and history of the data they are working with. This supports more accurate and informed analyses, leading to better business insights.

E. Data Governance: Strengthening data governance initiatives by establishing a comprehensive understanding of data lineage, ownership, and usage within an organization. This ensures that data is managed responsibly and in accordance with governance policies.

F. Data Integration and Transformation: Facilitating data integration processes by enabling a detailed understanding of how different datasets are transformed and integrated. This is valuable for maintaining data consistency and integrity across diverse sources.

G. Data Quality Management: Improving data quality by identifying the source of errors, inconsistencies, or inaccuracies in datasets. Data provenance enables organizations to trace back to the origin of issues and implement corrective measures.

H. Digital Forensics: Aiding digital forensics investigations by providing a historical record of data changes and access. This is critical for analyzing security incidents, identifying the extent of a breach, and determining the cause.

I. Fraud Detection and Prevention: Enhancing fraud detection capabilities by tracking the history of data transformations and identifying anomalous patterns or changes in the data that may indicate fraudulent activities.

J. Machine Learning Model Transparency: Enhancing transparency in machine learning models by tracking the provenance of training data, feature engineering, and model configurations. This is particularly important for model interpretability and fairness.

K. Regulatory Compliance: Demonstrating compliance with data protection regulations, such as GDPR or HIPAA, by providing a clear lineage of how and where personal data is collected, processed, and stored.

L. Risk Management: Improving risk management by providing a clear view of the data used in decision-making processes. Organizations can assess the reliability of data and understand potential risks associated with certain datasets.

M. Scientific Research and Reproducibility: Supporting reproducibility in scientific research by documenting the origin and processing steps of data used in experiments. This helps other researchers validate results and build upon previous studies.

N. Supply Chain Visibility: Providing transparency and visibility into the entire supply chain by tracking the origin and movement of products and related data. This is particularly valuable in industries like food and pharmaceuticals for ensuring product safety and authenticity.

O. Transparency: Data provenance can help to increase transparency and trust in data-driven decision-making. By understanding the origin and history of data, organizations can better explain their decisions and build trust with stakeholders.

These functions demonstrate the diverse applications of data provenance across various industries and scenarios, emphasizing its role in ensuring data reliability, compliance, and informed decision-making.

As data becomes increasingly important, data provenance is becoming essential for organizations of all sizes. By tracking the origin, lineage, and history of data, organizations can improve data quality, compliance, transparency, and risk management.

https://docs.evolveum.com/midpoint/projects/midprivacy/phases/01-data-provenance-prototype/provenance-use-cases/

https://link.springer.com/chapter/10.1007/978-3-030-52829-4_12

Safeguarding the organization’s Data from external and internal threats

Best Practices, Coaching, Controls, Data, External, Governance Risk & Compliance, Internal, Methodology, Safeguard, Security, , , , , , ,

Safeguarding the organization’s data from external and internal threats is crucial for protecting sensitive information, maintaining business continuity, and upholding the organization’s reputation.

The following steps outline important procedures to minimize risk and safeguard one’s important information:

A. Implement a Strong Security Policy: It’s not just about the tools you have but also about the practices you support. A comprehensive, organization-wide security policy is crucial for understanding and mitigating risks.

B. Risk Assessment: Understand the risks associated with the data you hold. High-risk data may require additional security measures.

C. Regular Security Audits: Regular audits can identify potential weaknesses in the organization’s system. By proactively addressing these weaknesses, you can prevent potential breaches.

D. Assign a Data Protection Officer: Larger companies might find it beneficial to assign a dedicated Data Protection Officer. Their job would be to advise on compliance with relevant data protection laws and monitor the organization’s adherence to them.

E. Strict Vendor Controls: Vendors often have access to the organization’s systems and data. Make sure you have clear security expectations in the organization’s vendor contracts.

F. Third-Party Risk Management: Assess and manage risks associated with third-party vendors and service providers. Ensure they have adequate data security practices in place.

G. Establish Strong Access Controls: Use complex passwords and consider two-factor authentication to provide an extra layer of security. Regularly update the organization’s passwords and ensure each password is unique to each platform.

H. Keep Software and Systems Updated: Regular updates keep systems guarded against known vulnerabilities that attackers could exploit. Ensure automatic updates are enabled for the organization’s operating system and apps, where possible.

I. Secure the organization’s Network: Use a firewall to secure the organization’s internet connection. If possible, use a virtual private network (VPN) when accessing information remotely to encrypt the organization’s connection.

J. Back up Data: Regularly back up the organization’s data and ensure these backups themselves are secure. This adds to a robust data recovery plan in case of an accidental loss or a ransomware attack.

K. Vulnerability Management: Regularly scan systems and applications for vulnerabilities and apply security patches promptly. Prioritize patching critical vulnerabilities that pose the highest risk.

L. Incident Response Plan: Develop and maintain an incident response plan to effectively handle data breaches or security incidents. The plan should outline roles, responsibilities, and communication protocols.

M. Cybersecurity Awareness Training: Educate employees about cybersecurity threats and best practices. Train them to recognize phishing attempts, social engineering attacks, and other common threats.

N. Implement Access Controls: Implement role-based access controls to limit the access to sensitive data within the organization. Not everyone in the organization needs to access all data.

O. Regularly Dispose of Unwanted Data: Unnecessary storage of data can enhance vulnerability. Safely dispose of data you don’t need.

P. Data Usage Control: Limit the usage of sensitive data. Only those who need access for effective functioning of their roles should have access to it.

Q. Use Antivirus Software: Use any reputable antivirus software to safeguard the organization’s systems from malware attacks and regularly update it.

R. Data Anonymization: In cases where certain sensitive data needs to be used for development or testing purposes, this data can be anonymized or pseudonymized. This method protects the real identities and any potentially sensitive connections to the data.

S. Encrypt Sensitive Data: This ensures that even if the data is accessed or stolen, it can’t be read without the decryption key.

T. Monitor and Audit: Regularly monitor and audit the organization’s network and data access logs. Any suspicious activity can be promptly detected and addressed.

U. Employ Data Leak Prevention Tools: Encrypt emails, secure important data, and use security measures to prevent unauthorized data transfers.

V. Continuous Monitoring and Auditing: Regularly monitor and audit data security controls to identify and address potential weaknesses. Conduct penetration testing to assess system vulnerabilities.

By taking steps to secure the organization’s data and staying vigilant about potential threats, you can significantly mitigate the risk of loss and theft.

It is crucial to understand that no single solution provides full security and hence a layered security approach combining multiple methods is usually the best strategy.

https://www.integrate.io/blog/data-security-threat-best-practices/

Is an Infrastructure War on the Horizon?

Governance Risk & Compliance, Security, Technology Trends, ,

Infrastructure Cyberwar

On February 24, Russia launched its full-scale assault on Ukraine. The invader’s weapons included tanks, heavy artillery… and software. On April 8, attackers armed with Industroyer2, a species of malware designed to incapacitate power stations and plunge whole cities into darkness, managed to briefly penetrate Ukrainian defenses, putting two million homes at risk. The attack was successfully repelled, but it communicated a chilling message to the world: The era of cyberwarfare has begun. 

As newscaster Ted Koppel detailed in his 2016 best-seller, Lights Out, America’s infrastructure is all too vulnerable. Since then, things have only gotten worse. According to a recent IBM report, the manufacturing sector is now the number one target for ransomware, accounting for 23 percent of all attacks. The top vectors for these attacks were vulnerabilities that organizations hadn’t or couldn’t patch (47%) and, no surprise, phishing (43%). 

The typical targets of attack within a manufacturing organization are the Industrial Control Systems (ICS), which control the operation of everything from turbines and values to robotic welding stations. Because an ICS manages physical machinery, successful exploits by bad actors can have extremely serious consequences, including enormous economic damage and even loss of human life. And because the same types of systems manage municipal water supplies and regional power generation, the potential for a real catastrophe exists. The problem of defending critical infrastructure has both technical and governmental aspects.

The Technical Perspective: Defend the Perimeters

On the technical side, the rapid growth of IoT technology, for all its promise, has clearly increased the possibilities of successful exploits. The leading ICS systems at the turn of the century were SCADA systems (Supervisory Control and Data Acquisition), which combined hardware and software to automate industrial processes. Importantly, SCADA systems were not connected to the internet. In fact, they were often “air-gapped,” with no connection to the outside world whatsoever.  

IoT technology became a factor in the manufacturing sector around 2010 and has quickly gained serious traction. Its total world market was roughly $389 billion in 2020 and is forecast to reach $1 trillion by 2030. IoT applications are often implemented on top of existing SCADA systems but may slowly replace them over time. The adoption of IoT technology used to connect SCADA systems to the internet either directly or indirectly dramatically increases the risk of a successful exploit. 

It has become extremely important for manufacturers, utilities and other infrastructure targets to make sure that their core systems such as ERP are appropriately updated. Intrusion and prevention systems should be in place to detect and respond to anomalies so that the damage that intrusions cause is minimized.

The second technical takeaway here is that perimeter defense is more important than ever. Since phishing continues to be a top attack vector, organizations need to focus on preventing malicious URLs from reaching the network, even when employees make the mistake of clicking on an unknown link – which they do. Fortunately, endpoint technology is now available that can evaluate mouse click events and block malicious URLs before malware ever reaches the network, at which point it’s often too late.

The Government’s Role: Partnering for Protection

We have seen a paradigm shift in the role the Federal government is expected to play in cyber security. Until recently, it was assumed that companies (along with educational institutions and state and local governments) were responsible for their own cybersecurity. Now, it’s clear that cyber crime doesn’t merely threaten individuals or individual companies – it threatens the common infrastructure that we all depend on. Furthermore, the “criminals” may well be nation states. 

In response to the new threat landscape, the Cybersecurity and Infrastructure Security Agency (CISA) was created in 2018 to support the ICS community in combating cybercrime and ensuring the safety of America’s infrastructure. With 2,500 employees and a budget of over $3 billion, this agency is well equipped to undertake its mission to help ICS stakeholders secure their operations against threats – but it doesn’t plan to go it alone. CISA’s slogan, “A Unified Initiative,” along with its promotional materials in general, make it clear that the agency sees itself as a nexus where information, strategies, and even anti-threat solutions can be aggregated and shared.

To date, the agency has built a vulnerability disclosure platform where individuals can report threats, developed a series of security training courses and workshops, and created an online ICS advisories page with notifications  and information about current security issues such as vulnerabilities, exploits and threats. 

Given the plethora of threats that exist today, the companies and public works organizations that comprise our infrastructure need to be more diligent than ever in managing vulnerabilities and defending their endpoints. Becoming aware of the ways CISA can help is a step in the right direction.

https://www.securityweek.com/infrastructure-war-horizon

11 Android Apps Found Secretly Harvesting Data From Millions of Users

Best Practices, Ethics, Security, Technology Trends, , , ,
Android Apps Found Secretly Harvesting Data From Millions Of Users

A mysterious company in Panama has been paying Android app developers to incorporate an SDK capable of lifting sensitive data from users’ phones, including copy-paste 

Security researchers have spotted 11 Android apps collecting sensitive information from user phones, including copy-and-paste data, phone numbers, and email addresses. 

The findings come from security firm AppCensus; it examined a software development kit (SDK) running on the Android apps, which together were downloaded over 46 million times on the Google Play Store. 

“​​Whenever a user copy/pastes something, it goes to a shared clipboard, which this SDK was scouring and uploading to its servers,” AppCensus said in a Wednesday report. “What gets put there is arbitrary data, and can include passwords, for example, if a user uses a password manager.”

The SDK can also collect precise GPS information, along with the phone number and email address associated with the device. In addition, it can try to pull the unique MAC address to the internet router the phone is connected to, exposing another way to identify the user’s activities. However, the data collection will vary, depending on the app.

AppCensus tracked the SDK to a mysterious company in Panama called Measurement Systems that’s been paying Android app developers to incorporate the software development kit. The company’s website says it’s paid $2.1 million to partners so far, and claims thousands of apps have used the SDK.  

However, The Wall Street Journal reports Measurement Systems has ties to a defense contractor in Virginia called Vostrom Holdings that does cyber intelligence work for US government agencies. “Measurement Systems told app-makers it wanted data primarily from the Middle East, Central and Eastern Europe and Asia,” the Journal added, citing internal documents from the company. 

The list of affected Android apps and what information they can harvest
The list of affected Android apps and what information they can harvest

Measurement System didn’t immediately respond to a request for comment. But the company told the Journal: “The allegations you make about the company’s activities are false. Further, we are not aware of any connections between our company and US defense contractors.”

The 11 Android apps loaded with the SDK include two Quran-themed apps, a generic QR barcode scanner, a “Speed Camera Radar” app, and a program to transform your smartphone into a mouse. In October, AppCensus reported its findings to Google, which promptly removed the apps and others containing the SDK. (You can find a link to each affected app in the AppCensus report.)

All 11 apps have since returned, but without Measurement Systems’ software development kit on board. In a statement, Google told PCMag: “All apps on Google Play must comply with our policies, regardless of the developer. When we determine an app violates these policies, we take appropriate action.”

https://www.pcmag.com/news/11-android-apps-found-secretly-harvesting-data-from-millions-of-users