Tag: ciso

Defense

Changing a security posture requires changing your own behaviours

I’m sure you will have had a marketing firm or some random sales person on Linkedin tell you that security should be simple and that their product will save you from all the ATPs and nation state hax0rs under the sun. However let’s get real, thats almost certainly not true and also security isnt simple or we’d all be out of jobs and everyon woulndn’t be getting owned all the time.

Getting real
I think there’s a huge honestly part that needs to occur if you are going to actually improve a companies security posture.

Leading and acting in a manner which doesn’t contradict the message

Don’t be unrealistic – absolute security doesn’t exist, if someone is talking in those terms they are probably bullshitting and are highly unlikely to be an actual practitioner

Sort out the commmon vectors, phishing and exposed insecure configurations are clearly areas to focus on but also you should assume breach and harden the inside of your networks! (too many people don’t do this)

People like efficiencies, improvements when they don’t have to be the change, chaning behaviours is really hard.

Technology costs money, I hate to break it to people but if your approach to technology management is solely on the bottom line that is going to have a significant impact not only on your business operational capabilities but from a security point of view you are likely going to be in a weak posture. Don’t get me wrong you don’t need to buy ALL the things but expertise, logging, monitoring and management tools/technical tools cost money. Don’t shoot the messenger but don’t expect the moon on the stick either (it’s just not realistic).

Cyber Criminals operate in all time zones, your staff likely use company computing assets across a range of hours and probably sometimes in the evenings and weekends. Your security operations capability needs to be able to cover this (accepting the risk entirely is a bonkers idea, at least put people on call, oh and that means paying them too!)

The biggest improvement step to me is the cultural one, it’s the change from ignoring, assuming it ‘won’t happen to me’ and when people who are in leadership and management positions stop using bad practises. Being honest and recognising security is a challenge, it’s not a project, it’s a way or running and managing technology services.

By having a strong security posture you will need far deeper knowledge of your business, it’s assets and it’s customers. This sounds like a massive business advantage to me!

Defense

Ransomware Defence Checklist – Part 1 : Initial Access

Defending the Realm

We keep seeing organization get hit, in some kind of a sick way I think me and some of my friends in the industry are bored with the over dramatic responses of “sophisticated” “advanced” and “unpreventable” because most times the kill chains simply are not like this. But still the onslaught keeps coming. Well I know this much, whilst I would love to deploy with the team and harden everyone’s networks that simply isn’t possible. So what we thought we would do is write something to try and spread the knowledge a bit further and hopefully have some positive impact.

Ransomware 101

It’s not just that your data will be encrypted, it will likely be exfiltrated and sold. You will likely have access sold, data sold and be extorted. The Ransomware business model is adapting to defender responses. Even if you can restore from backup they will likely try and attempt to extort. This brings a key point in this equation, the best position is to NOT get pwn3d to start with. Ok that might sound silly to say but when we look at these kill chains you might start to see the world from my perspective a little. Read more “Ransomware Defence Checklist – Part 1 : Initial Access”

Defense

Cyber Defence is Hard

Introduction

If you read a book about management theory or specifically cyber security management you will find lots of frameworks, methods, formulas, models etc. None of them really let you know how insanely hard it can be to defend a moving target where regardless of how many controls you have, all it takes it someone doing something which may seem bonkers to you but perfectly reasonable for them. Their objective is to do business in an efficient manner, your objective is to protect the business in an efficient manner. Fundamentally these two things are not at odds, but there are a lot of human factors that come into play on top of some serious technical challenges. Read more “Cyber Defence is Hard”

Defense

The grass is always greener, until it is not

A PwnDefend Story – Day 7

It is a blur so far, I figured after the last place the grass would be greener, surely no one else has that many security challenges. I did some due diligence during the interview process, they seemed very confident about having certifications and that they took security seriously. hell, that should have set some red flags off but even the cynical sometimes hope that it is as someone says.

I have started to work myself around the board and I am making friends with people, my diary is filled with zoom calls and my notebook is already many pages deep.

You cannot make this stuff up though, day two and I’ve dealing with a business email compromise incident, the phishing page was not even in good English but then it only takes a second or so whilst in a meeting to not quite realise your running on autopilot so you cannot blame people. Hell, the branding was copied so we know it was a targeted phish. It would have been nice to at least had centralised logs for the team to analyse though. Read more “The grass is always greener, until it is not”