My Top 5 Predictions for 2015

Predicting the future is almost impossible especially with such a fast evolving topic like cybersecurity. Nevertheless I’ll give it a try and share some of my thoughts with you.

I had a lot of chats with CIOs, CEOs and COOs as well as journalists talking about what we all see what our biggest fears are and what they and I expect to see in the near future.

Here are my thoughts about theTop 5 challenges our world will face in 2015. Just in case you would like to add something feel free to drop me a line and I will add your thoughts / comments promptly.

Top 1: Rent-A-Botnet
As we all saw in the past that botnets seem easy to rent (1.000 for some 100 USD down to 10 USD for an hour accesstime) the service quality is dramatically increasing while prices are decreasing. The service quality is key to the evolution of this market. When selling services to the “normal” world credentials are important. Selling services on the dark side means that delivering cybercrime services is only possible when having top credentials and a hard proof of delivery and 100% reliability. These requirements drive service quality enhancements that even lead to service desk support with your rented bot net, customization support and other services most people can hardly imagine when talking about a crime scene. We even see that targeted attacks lead to new customer creation efforts. An example is that DDoS targets sometimes receive blackmail eMails with 3 key messages:


1.      Pay the fee to avoid DDoS attacks leading to unavailability of your services

2.      Do not contact any cybersecurity specialist to defend your services because this will lead to a dramatical increase in bots attacking you

3.      Order your own botnet attack against attackers and you will receive a discount of 20-40%

Top 2: Industry 4.0
Industry 4.0 discussions very often end up in security concerns. On one hand companies fear that SCADA systems, PLCs and Industry devices could come under fire. This is a serious concern and it is very realistic when considering that a lot of industry devices are not hardened but connected to office networks having no virus scanners and very often being protected by firewalls having more communication exceptions than limitations.

Imagine that in combination with IP V6 internet structures become more stable and reliable and your refrigerator, lightbulb or industry roboter is infected and becomes part of a botnet or is in other ways involved in cybercriminal activities.

Top 3: Data Destruction
2014 ended up with a huge security incident at Sony pictures. We saw problems at Sony companies before like the PSN hack. Nevertheless the hack shows a new quality in cyberattacks. It became very common to hack companies and to leak information as a “proof of hack” to make the cybercriminal business plan work. During this hack we saw that users couldn’t use their workstations any more and data destruction seemed to be part of the game. Also in other security incidents we became aware of the fact that data loss is common but data manipulation and data destruction become even more serious and are on the rise.

Top 4: Supply Chain Security
In the past we already recognized the supply chain security seems to be important but the headlines have not been filled with stories about companies being attacked using supply chain connections. One of the most remarkable stories has been the virus problem on Predator and Reaper drones in 2011. Other hacks we saw in 2014 demonstrated that very often companies rely on their security measures like firewalls, awareness trainings, encryption and so forth. But as we all know is the strength of a chain determined by the weakest link which is very often a supplier. A “good” example is the “Target” breach where Fazio Mechanical, an air condition and heating maintenance company, was compromised. As we all know for various investigation reports on Targets incident the attack on their supplier seemed to be high sophisticated.

With research on this topic we see this threat on the rise and being more and more successful.

Top 5: Mobile Device Exploit Kits 
Years ago mobile devices have been pretty safe. But with the trend showing that mobile devices may replace notebooks and “thick clients” in general Exploit kit developers seem to start focussing on mobile device exploit kits. The mobile world seems to know several Operating Systems but in the end these are only 3 (IOS, Windows and Android). At least IOS shows only few variants – users keep their IOS up to date so that creating one exploit kit has a huge impact in the user community. Also with spyware for smartphones increasingly being thrown on the market a baseline software repository to duplicate calls, copy WhatsApp conversations as well as SMS messages is available. The step from “legal spyware” (in Germany it is not legal but in other jurisdictions its use is pretty common) to an exploit kit is pretty small.

Right now effective antivirus and other prevention software is hard to find and only few users even care about this problem leads to millions of vulnerable devices being in the focus of cybercriminals.

Advertisements

Security – A Misleading Concept?

Currently I am creating a presentation on cyber security as a competitive advantage. It looked like a simple task, but ….

When building a presentation I feel that the content should be meaningful. Starting to think about a good starting point, the fundamentals I need/want to transport and a good starting point i thought it would be a good idea to start with a definition of cyber security.

Defining both words, Cyber and Security I found a definition which is a little bit strange but it was taken from William Gibson’s Novel 1984:

„Cyberspace. A consensual hallucination experienced daily by billions of legitimate operators, in every nation, by children being taught mathematical concepts… A graphic representation of data abstracted from the banks of every computer in the human system. Unthinkable complexity. Lines of light ranged in the nonspace of the mind, clusters and constellations of data. Like city lights, receding.“ 

Source for the artwork: http://hqwide.com/wallpapers/l/1920×1080/61/artwork_neuromancer_william_gibson_1920x1080_60671.jpg

Another one I found good and better suitable for business purposes was given by the university of maryland

The interdependent network of information technology infrastructures, that includes the Internet, telecommunications networks, computer systems and embedded processors and controllers.

Source: http://www.umuc.edu/cybersecurity/about/cybersecurity-basics.cfm

I believe this one has a better fit for purpose. Nevertheless it gives a limited view on security issues. Cyberspace is meant to be digitally. But what does that mean related to intellectual property that people have. Information written or printed on paper. Proof of concepts doming from a machine and so on. Short story: What is the representation of non digital Information? From what I found non digital information is not covered by the term “cyber”!

What is the better term to provide a holistic view on security?

To be honest: I didn’t find one. Information is written on paper, stored in brains, computers. Sometimes it is tangible, sometimes not. Sometimes it is related to buildings and other forms that might represent information or a value. The next question deriving from these thoughts:

Is there anything of value that is not related to information?

If you find something please tell me!

Security in general is meant to be a concept that implies protection from harm to any asset.

That is also the reason why we find numerous security functions in enterprises:

  • Corporate security
  • Facility security
  • Information security
  • IT security
  • Cyber Security
  • Data protection

When talking to clients about their security functions I very often hear that there is a wish to add new skills to the organization to cover new threats! When doing this organizations tend to look for reasonable compromises which are more likely to be trade offs. Usually existing structures are maintained (e.g. the IT Security Officer) and new functions like a Cyber Security Department is added to the organization with newly defined responsibilities and different reporting lines.

Looking at the cyber definition again the conflict is obvious! IT security deals with infrastructures. The information protection officer deals with information stored anywhere and the Cyber Security Defense Service feels extremely hip because it is something new, really important having excellent budget and sits on the territory of the CISO, IT SecOfficer and others.

I started to write down where security applies and found numbers of issues and security functions. Most of them have an overlap which I feel that it is ok.

Detection is the new Prevention

In another article I already presented my view on Detection versus Prevention. I believe Detection is key! A huge misunderstanding is that looking at the concept of security the spotlight is on prevention. This might be true but detection is the new prevention. In order to avoid harm to your organization you need to know your enemy and be prepared against almost everything that can happen. You will have to accept hackers to jump into your networks and you will need to be prepared to detect them and fix the damage asap.

What happens here: It is RESILIENCE!

Organizations need to be better prepared to fix security incidents no matter if they are related to buildings, employes, VIPs, IT infrastructure, paper based information etc.

When I came to this conclusion I felt that any security function in an organization is an important feature. It is preventive feature. It helps to detect issues. But recovery from incidents will be more important than we have ever believed.

I feel that a Business Resilience Function in any organization is the key to eliminate conflicts between different security functions and helps to align them to a powerful organization helping with prevention, detection and recovery!

What do you think? I do not know if I am right or wrong! I am really interested to read your views on this! Please share your thoughts with me and the rest of the community!

The link Between a Company’s Supervisory Board and its Security Strategy

Companies Need New Security Strategies

With regard to cloud computing, Bring Your Own Device (BYOD) or Social Networks companies have to think about their security strategy. Whereas the principle of prevention was effective for a long time it is not effective any more. Having a huge number of mobile devices in place, using various storage systems within the enterprise or outside and the demand for flexible and fast collaboration with clients, partners and suppliers nobody is able to predict where a certain piece of data is right now, how often it has been copied or will be tomorrow.
It is just a fact that business critical information does not reside within the perimeters of the enterprise any more.
Given this fact a company can protect its perimeters with huge efforts and be almost save, a weak system outside the enterprise like a social network or a pubic cloud system destroys all efforts of protecting the assets by preventing intrusion in the own infrastructure. The enterprises are simply not in control of prevention system any more.
Another challenge is the complexity of of attacks against enterprise infrastructures. Nowadays more often zero day exploits and strongly customized malicious code is being used, applying advanced persistent threat techniques which leads to the situation that most of the high sophisticated attacks are not recognized by any prevention system like antivirus, intrusion detection / prevention system or firewalls.
These attacks are simply below the radar screen of the traditional security systems.

What are the new Security Strategies to be applied better today than tomorrow?

The prevention of the future is detection! What does that mean? This means that enterprises have to improve their ability to register anomalies in the data flows leading to a more reliable and faster detection of security incidents. There are two main areas of improvement:

  1. Time to detect a security incident caused by APTs or other high sophisticated techniques
  2. Time to fix the issue

Especially the time to detects requires companies to have intense monitoring capabilities in place to ensure reliable detection. By building these capabilities not only the requirements of companies are in scope but also the personal rights of employees are affected. A company going this way will need to have trust within their working councils and from my perspective it is even better to integrate the employees to build trust that these facilities are not only a requirement to secure the enterprise but also the individual.

Any requirement for the supervisory board?

With respect to the supervisory boards requirements to monitor and give advise to C-Levels, a few questions have to be clarified:

  1. Does the internal control system of the enterprise reduce the risk of exposure of employees and management against threats from the outside (e.G. Use of eMail, websites, unknown documents)?
  2. Is a reporting system in place to to indicate potential threats and suspicious activities?
  3. Does the enterprise have a stable detection system in place to uncover security incidents?
  4. Did the company test the effectiveness of detection techniques and includes the results in a continuous improvement process?
  5. Are security incidents adequately reflected in the board of management’s report on the business situation of the company?

Conclusion

In the end this means that companies have numerous options in place to improve security, deal with liabilities of board members and the supervisory board and drive efficient security measures.

I would suggest to keep an eye on two work streams:

  1. Switch of non effective security measures that simply address prevention – Just talk to me and I will assist you to go this way based on a success fee.
  2. Establish a process too ensure that materiality and severity of security incidents becomes transparent to board members and their supervisory boards to ensure conformity to financial reporting standards.

Just in case that you do not believe that security is to be reflected in the financial reporting you should read the Corporate Finance Disclosure Guidance No. 2: Cybersecurity issued by the SEC. You might also want to use Google to find out who was already addressed by the Regulators of the US to have not properly addressed this issue!

What is the bigger threat? Employees or hackers?

Years ago I read an FBI survey on security incidents and a root cause analysis. I didn’t find it again (if you have it – please send it to me) but I can still remember that it said something like almost 70% of security incidents have been caused by employees.

The last survey I found from the United States Secret Service named “2013 US State of Cybercrime Survey” says that only 21% of cybersecurity incidents have been caused by current and former employees (There is a summary availabe from PwC in the US that helps you to avoid reading all this stuff).

Nevertheless I found it really difficult to qualify these information and have a more solid foundation of sources that helps me to better understand and to better argue with my peers.

But as time went by and big data is not just a buzzword but real applications are available I found a website I desperately want to share with you. They analyzed hacks and other security incidents and built categories to classify these hacks.

The result is a really meaning- and beautiful visualization of security breaches and their sources. What strikes me is the possibility to slice and dice industries sources and size of the incident and get a visual presentation.

Bild

I believe that this is one of the most advanced ways to present these figures without leaving room for arguing if the numbers are correct or not. They are simply based on press releases!

My suggestion: Read it and play with it! Click on the graphics and you are forwarded to the website. Enjoy it!

Btw: They also disclose the source of information that leads to this fantastic visualization: Click me!

Building a TOR WLAN AccessPoint

Since a couple of years I am using different distributions of TOR routing packages. I installed TunnelBlick, TOR Browser Bundle and tried to build something different based on a Linux distribution hosted on my VMWare platform.

It was always a little bit difficult. My family did not like those things installed by me and was not very supportive to switch to this kind of anonymous browsing.

Some months ago I saw different articles related to Raspberry Pi which I really liked. Some years ago I created my home automation and watering system based on Arduino and a self developed client server environment with some 10 thousand lines of code for the SQL server, the server and the Arduino environment.

So taking a closer look at the Raspberry was the next thing to find out what you can really use it for. Given my experience with the Arduino I was really surprised about the fact that there is already a Linux distribution available and a lot of projects based on Linux features.

Difference between Arduino and Raspberry

The roots of Arduino and the Raspberry Pi seem to be pretty similar. Both have been developed to make projects as easy as possible.

Bild

The Arduino needs to be loaded with self developed code. It is developed in a java based coding environment, then make a compile step and load it via USB into the NVRAM of the Arduino. The board itself is developed to have as many I/O ports as possible. These ports may be used as digital I/O or analog I/O. Use-cases are switching relays (I do so in my watering environment) , sensors for water, temperature and others. It was designed to operate actors and sensors in art projects.

The Raspberry is more or less used as a micro computer having everything in place what a “big” machine has: USB ports for keyboards and Mouses, HDMI interface for Monitors and an SD Card Slot for storage and booting the OS.

My Own Raspberry Pi Project

When I decided to start with the Raspberry Pi it took me longer time to figure out whether this is a step of improvement for my home IT or is it just another platform.

I believe that a single Raspberry is powerful enough to serve as AccessPoint or work as XMBC Device  but first time that I was really convinced when I saw that the Raspberry can also work in a cluster successfully and it scales excellent.

In different articles I read that the scaling effect of Raspberry Pi is pretty good when up to 50 (the exact number is 48 – don’t ask me why) nodes are clustered.

All the machines that I have in my Home IT environment use on central SAN so that I no not need storage but application servers for eMail,OpenVPN, TOR and MySQl and some other minor applications. Especially for OpenVPN and MySQL I believe that the Raspberry Pi could be a good choice to get rid of the VMWare servers (I want to switch my platform from a DELL server to a MAC OSX server to have more benefits in my home entertainment environment which is dominated by APPLE products).

So let’s start to build the Raspberry TOR AccessPoint. For all of you which are German native speakers you may also want to read the Spiegel Online Posting which is excellent. For all other readers I try to make it as simple as possible. Just to let you know: I am not a Linux expert so bear with me if you feel that you might have more easy or elegant ways to go a certain step.

There are also some sceptic voices I do not want to conceal. The TOR network itself has a good foundation to enable anonymous communication. If you do things wrong you will not be anonymous anymore. Login in to social websites, using eMail and other things might endanger your privacy. The TOR concept itself has also some weaknesses in the exit node. To compromise the exit nodes means eliminating privacy. To be on the safe side it is recommended to use secure exit nodes. A list of those exit nodes is available in the internet. A good article about this issue comes from Mike Kuketz. I will try to find something similar in english and update this posting.

During the project I will fix this issue and define a number of secure exit nodes in the configuration files.

Step 1: Prepare your environment

What you need is a PC or Mac to build your boot device based on an SDHC Card.

I will be using a SanDisk Ultra with 16GB and Speedclass 10. You will find several articles about the influence of the SD card related to the Raspberry Pi so that I do not describe it in detail.

This SDHC card will be prepared with the Linux Distribution coming from Adafruit, called Occidentalis. Please download it here: Occidentalis on Adafruit.

This Linux distribution needs to be written to your SDHC card. For the preparation of  the SDHC card you can use Ray’s installation script or any other tool for your platform described in Adafruit’s article about the preparation of an SDHC card.

Extract Occidentalis and Ray’s script to one single folder – which makes life a lot easier when running the install script later.

Open a terminal window on your mac and go to your directory.

Please make sure to get rid of all devices that you mounted before like software installers and disks you do not need because it makes it easier to find the right device later when you have to select the device to install the Linux distribution on.

Beware: In case you select the wrong disk (eG your Mac startup volume) it will be lost!

You can check upfront in the terminal using the command df -hl 

Bild

which devices are mounted.

Hint: I already gave the SDHC Card a Name to make it better identifiable in the course of the installation process

Step 2: Install the Image

Run the command sudo ./install Occidentalis_v02.img and select the SDHC card you inserted in your cardreader.

Bild

Please be patient – the process takes a couple of minutes to complete.

It is completed when you see the message “All done!“. That’s the point when you already have a full bootable standard Linux for your Raspberry Pi in hands.

I decided to over clock the Raspberry Pi to have a better performance. Some people are writing that this might damage the SDHC card but I decided to ignore this hint. There are tables available for the different values but keep in mind that over clocking means increasing power consumption. If your power supply is weak this may cause instabilities. On certain cases (starting with 950 MHz) you also need to have a 6 V power supply! and set the over_voltage flag.

To over clock the Raspberry Pi you can directly mount the SDHC card again in your Mac and edit the config.txt file in the root partition.

#uncomment to overclock the arm. 700 MHz is the default.
arm_freq=900

I decided to replace the 800 MHz over clock with 900 MHz.  After saving the file please unmount the SDHC card again.

Step 3: Start up the Raspberry for the first time

I do not use an external keyboard or monitor. I just use a ssh connection.

Starting up the Raspberry means plugging in the Micro USB, the SDHC card and the ethernet cable. The Raspberry looks for a DHCP connection.

BildIn the next step you will need to open an SSH connection using the IP address the Raspberry Pi uses. Simply look in the administration console of your DHCP server (usually in home environments your DSL router)  and identify the device called raspberrypi. My Raspberry has the IP address 192.168.1.122 so you will find this IP in the course of the documentation.

Use ssh pi@<IP address> to connect and add the Raspberry Pi to the list of the known hosts by following the questions on your screen.

The default user is pi and the password is raspberry. Please make sure to have it changed asap using the command sudo passwd.

Step 4: Install the TOR package

Next step is to install the TOR environment that comes from Spiegel Online.

Please execute the following lines of code in your ssh console:

git clone https://github.com/spiegelonline/sponionpi.git SPONionPi

cd SPONionPi

sudo sh install.sh

The whole installation takes a longer time – around 45 minutes. You will be asked to reboot the Raspberry Pi by powering off and on again. After that you will have to run again (please be aware that this installation procedure resets the Pi’s password to raspberry) :

cd SPONionPi

sudo sh install.sh

Before doing anything with the card it is recommended to clone the SDHC card to avoid any additional work when misconfiguring  the interface later. Some tutorials how to do that are available in the internet. One is this one.

The commands you need to use are

diskutil list  (assume your SDHC Card is disk4)

sudo dd if=/dev/rdisk4 of=~/Desktop/pi.img bs=1m

You may use the SDHC image installer described in Step 2 to install the clone on a new SDHC card.

After the procedure terminates with success you will have to power off the device and plug in both WLAN adapters and remove the ethernet cable from the device.

After that you need to reconfigure the access point interfacce which is available under https://192.168.99.1 with the login credentials SPONionPi-Tor and spiegelonline.

Please follow the steps described there to modify your installation.

I will update this posting to after my next steps to tailor my Raspberry to meet my requirements including interfaces, Passwords, usernames etc.

Social Media – C-Levels Tricked and Trapped

During various conversations at the dmexco 2012 in cologne I realized that Social Media Risk Management already hit the boardroom but almost nobody is aware of it. So was I!

The reason why I believe that social media already reached the boardroom is so simple and so complex at the same time.

Almost everybody knows that you need to be active on social media. As social networks and social media is constantly gaining more and more power it is the ultimate source to solve a couple of challenges companies and their C-Levels experience:

Marketing Efficiency

Who wants to spend millions for marketing campaigns some really enthusiastic and creative brains build without giving you the tools to find out how effective your campaign is.

War for Talents

New employees are the lifeblood of every professional services firm. Attracting the right people and retaining them is key. But how do you do that? Go social! Young people leaving university and school have an incredibly huge social media competence and define themselves different than people like I did at their age. During interviews with potential candidates for our firm I had to realize that the questions I am asked are different than 10 years ago. People ask for BYOD, Smartphones, Work Life Balance Concepts, Mobility Concepts and much more. Most of the time they already used social media to inform themselves about my company. They even do not use our website, but they use facebook and twitter. So going social is not optional! It’s mandatory and therefore it’s a boardroom issue. The C-Suite usually approves this “HR stuff”.

CRM

Is customer relationship management an application to plugin to you ERP system or buy a monumental application that stores all your client data. I believe we will see distributed CRM systems in the future. These are the Facebook profiles, twitter lists and Xing / linked in groups which are the data marts for future CRM systems. Right now most of the professional people, being active on social networks, maintain not only private but also business contact lists and support sales and delivery through these channels. It became more viral than most of the non social networking C-Levels believe. In the end it means that you need to rely on those people acting in social networks and facilitate sales and generate leeds. In most of the companies (especially the professional services firms)  this is done unintentionally and the leaderships are overwhelmed by the “new” opportunities that arise.

What is the conclusion

You might ask yourself or me why a blogger about security and risk management writes something about CRM and war for talents and what this has to do with Social Media Risk Management.

As I already said it is simple but also complex. Everybody accepts that social media is in important factor in people’s life and business matters. We design campaigns for our businesses.  We sometime try to enforce social media policies. But do we really think that there is a difference between private and professional social media? We think so but it’s not! People have to disclose which company they are working for or they should not write one word about this company and stay private.

When asking people about their profiles on social network sites like facebook I very often get the answer:

Uuuh good question, but I am prepared for this! I arranged this in a propper way: facebook is used privately and linkedin is used in the professional part of my life!

Sounds reasonable but reality looks different. If you look at those facebook profiles you see that people disclose their company name and their position in the firm. This is the moment when a private account is not private any more. In Germany there was a law suite about where the judges came up and said that the use of a company name and maybe writing that you want to get (business contacts) is sufficient to assume you are not a privateer and that you have to behave professional.

Following this argumentation the C-Levels need to be in control over what their employees do just in case a third party cannot find out ad hoc if a person is a private or a professional person when looking at posts or their profiles.

C-Levels need to have an overview, who is acting as an employee of their company (even when knowing it). And last but not least it means that C-Levels have to enforce and monitor the use of policies in these open spaces. Right now I believe that boardroom members do not realize that they have to extend their control to social media or tell their people that they may not act on behalf of the firm and have to stay strictly private.

But who wants this? Nobody! You would loose the viral effect of social networks!

I know that this is a provocating statement but I absolutely believe what I wrote. Any comments are highly appreciated.

Collateral Damage of Cyberwarfare is Unpredictable – Security 2.0

During the last quarter of this year I had a lot of talks with CISOs and CIOs from major European companies about the impact of cyber warfare on their organizations.

Most of them refused even thinking about the impact of cyber warfare, which I can absolutely understand since most of them are not working in the defense industry and thinking about warfare is nothing we like to do. Nevertheless I feel that everybody should be encouraged to think about this topic and what it means to civil organizations in general.

Remember the latest press releases about Stuxnet, Duqu and Flame. What was / is the difference between cyber warfare and traditional war concepts.

 

Artwork found on jewlicious

The main difference – and that is what makes it so important to me – is that collateral damages can never be linked directly to the armed conflict. In traditional warfare concepts you will always be able to see the collateral damage caused by a bomb. You will see it on TV. You will see it in the press. You will hear it on the radio.

With cyber arms no one really knows who fired the gun – remember distributed attacks – and who is the target. Companies or organizations experience that they are hit by a serious attack but never know if they have been really the target. They just feel like it.

But what does that mean to civil organizations and companies?The situation regarding cyber attacks is heating up. We increasingly see serious attacks which are linked to those three “governmental” viruses (Stuxnet, Doqu, Flame) or experience malicious code like the trojan code built by the German government, called the “Staatstrojaner”. After Stuxnet we saw a huge number of organizations that had security incidents linked to Stuxnet which underpins the opinion that the company might experience a collateral damage without even knowing that it is the result of a (cyber) armed conflict. One nationstate might attack the other using cyber arms turning off the light in small and medium businesses in other, not in this conflict involved, countries, disturb operations in hospitals and so forth.

In the future companies need to built their own “cyber shield” to protect themselves against this kind of “advanced persistent threat”. In case of Stuxnet, Duqu and others we can learn that these intelligent pieces of code have been distributed in a way where traditional concepts like IDSes, IPSes and firewalls have been useless. Distribution was done using eMails, USB sticks, removable media and other very simple vehicles. They did not cross traditional company borders.

The conclusion is: Perimeter security does not work anymore and companies need to rely on safeguards they will have to put around individual assets. We arrived at the absolute need to create asset based security mechanisms instead of big walls! This is another reason why I believe: We reached security 2.0! We need to change the way we are doing security. I absolutely know that I do not meet everyone’s opinion of this serious topic but nevertheless I encourage you to discuss it with me and discuss what you feel what security should look like in the future. Maybe I am wrong. Convince me if I am wrong!