Category Archives: training

Security and Policing Event 2016

s and p 2016This Home Office event will soon be upon us (March 8-10) and we just wanted to let you know you will be able to find us on stand Z20 in the Cyber Zone. You can find details of this event here.

Mike Gillespie will also be presenting in the Cyber

Mike Gillespie_headshot

Advent IM,  Managing Director, Mike Gillespie

Briefing Zone on the 9th on the subject of the cyber security of  Industrial Control Systems.

Come along and meet Mike and Gareth and enjoy some great presentations, content, updates and a bit of a chat.

Advertisements

Incident Management – an explanation and example

Advent IM Security Consultant, Del Brazil, offers some guidance on best practice in Incident Management.

Incident Management is defined by the Information Technology Infrastructure Library (ITIL) is ‘To restore normal service operation as quickly as possible and minimise the impact on business operations, thus ensuring that agreed levels of service are maintained.’  Although this definition is very much aligned to the service delivery element of IT, organisations should translate it to all areas of the organisation to form the basis of any incident management strategy.

Any Incident Management process should include:-

Incident detection and recording – Ensuring that sufficient and appropriate means of both detecting and reporting of incidents is critical, as failure to report incidents can have a serious impact upon an organisation.  There maybe a legal requirement for incidents to be reported such as incidents associated with the loss of personal data or security breaches related to protectively marked information, although not applicable to every organisation.  Ensuring that an incident is correctly reported will facilitate the correct actions are taken in line with the incident management plan and thus ensure the correct allocation of resources.

An example maybe that an individual receives an email from an untrusted source and without realising any inherent risk, opens an attachment, which in turn causes their terminal to become unresponsive.  The individual contacts the IT department in the first instance in order to initiate some form of containment measures, whilst also documenting down how the incident occurred.

Classification and initial support – There are various levels of severity associated with different types of incident and ensuring that they are correctly classified will mean that the appropriate resources or emergency services are tasked accordingly.  These levels of severity range from low impact/minor incident requiring a limited number and type of resources, through to a major incident, which has the potential to impact on the whole organisation and requires a substantial amount of resources to manage or recover from.  In the early stages of any incident the support provided by a designated incident response team is vital as their initial actions can have potentially massive implications on the organisations ability to resume normal operations.

Following on from the previous example the incident may be classified as a low priority at this stage as only one terminal/user has been affected.  The IT department may have tasked a limited number of resources in tracking down the suspicious email on the mail server and then taken the appropriate quarantining and/or deleting procedures.

Investigation and diagnosis – Further and ongoing investigations into the incident may identify trends or patterns that could further impact on the organisation, once normal operations have been resumed.

Keeping in mind the example previously discussed, should the initial findings of the IT department reveal that the email has been received by a large number of users, then further impact analysis should be undertaken to establish the impact or effect on services before any additional resources are dedicated to resolving the issue.  This further investigation requires an organisation-wide broadcast, highlighting the incident and what actions should be taken in the event that users received suspicious emails or attachments.

Resolution and recovery – Ensuring that the correct rectification method is deployed is paramount, as no two incidents are the same and as such any incident management plan should have a degree of flexibility to accommodate potential variations.

Using our example scenario, the correct rectification solution in this instance would be to purge the mail server of any copies of the suspicious email and then to execute the scanning of the mail server with an anti-virus and/or anti-spam product.  Consideration should be given as to whether to take the mail server off line to perform the relevant scans, however any potential down time may impact on the output of the organisation.  In the event that the mail server is taken off line, it is imperative that communication is maintained with all staff, contractors, customers and third party suppliers etc.

Incident closure – The closure of an incident should be clearly communicated to all parties involved in managing or effecting rectification processes as should a statement stating ‘Business has resumed to normal’ to clearly indicate to all concerned that normal operations can continue.

In our example , it’s essential that all persons involved or impacted by the incident are informed accordingly which formally closes the incident.  This also reassures any interested parties that normal service has been resumed thus preventing any additional business continuity plan being invoked.

Incident ownership, monitoring, tracking and communication – An Incident Manager/Controller should take clear ownership of any incident so that all relevant information is communicated in an effective way to facilitate informed decisions to be made along with the correct allocation of resources.

As always, good communication is vital not only with staff, emergency services and the press but also with key suppliers and customers, as these may have to invoke their own business continuity plans as a result of the incident.  Business continuity plans ensure critical outputs are maintained but the invoking of a plan comes at a cost, whether it be financial or an impact to operational outputs.  It is therefore imperative that once an incident has been deemed formally closed then key suppliers and customers should be informed accordingly, this will  enable them to also return to normal operations.  Post incident analysis or ‘Lessons learnt’ meetings should be held after any incident to highlight any weaknesses or failings so that rectification measures can be introduced accordingly.  Likewise, should there be any good practices or solutions highlighted during the incident, then these should also be captured as they may be used in other areas of the organisation.

Now our example has been correctly identified, treated and business has returned to normal it is imperative that an incident ‘wash up’ meeting takes place to clearly identify those areas for improvement and those that performed well.  The correct allocation of resources during the initial stages of the incident to address what was deemed to be initially a minor incident, resulted minimal impact to not only business outputs, but also to customers or third party suppliers.  The findings of the ‘wash up ‘ meeting should be correctly recorded and analysed for any trends or patterns that may indicate a weakness in security.  In this instance the mail server’s spam filters may have been incorrectly configured or not updated resulting in a vulnerability being exploited.

Any incident management plan should be suitably tested and its effectiveness evaluated with any updates/amendments implemented accordingly.  It would be prudent to exercise any incident management plan annually or when there is a change in the key functions of the organisation.  It is also additionally recommended that all users are reminded of how to report incidents during any annual security awareness education  or training.

As organisations become ever increasingly reliant on internet and IT services, it is imperative that an effective, appropriate and fully tested, Incident Management Procedure is embedded within the organisation.  Failure to ensure this may result in an organisation struggling to deal with or recover from any kind of security incident.

Social Engineering – Still the best attacker exploit – guest post from Dale Penn, Advent IM Security Consultant

Another great post from one of our consultants, this time from Dale Penn on the topic of Social Engineering.

Introduction

Social engineering is still the most prolific and successful method of hacking. It is a non-technical attack that relies on a user being tricked or coerced into some form of action which presents the attacker with a window of exploitation and can bypass even the most robust of technical controls. It is much easier to coerce a member of staff into providing information than is to mount a technical attack on a web application or network connection.

It is important to note that the threats from Social engineering tactics are almost always under rated by enterprise organisations even though they form an integral part of most modern day attacks. The reason behind this is that there currently exists a trend within enterprise organisations to fixate on the technical solutions to information security threats and neglect the human element.

Any organisation that wants to protect its information assets must be aware of the current Social Engineering threats.

The top 3 Social Engineering Methodologies

phishingPhishing – This is the practice of sending emails appearing to be from reputable sources with the goal of influencing or gaining personal information. A Phishing email will usually contain a link which will redirect the user to a false webpage where they are asked to provide personal information such as usernames and passwords. Once entered this information is captured and ready for use by the hacker. Gone are the days were Phishing emails will contain poor grammar and spelling and were easy to pick out. Modern day Phishing emails are professionally created and very convincing.

 

Vishing – This is the practice oAdvent IM Social Engineering securityf eliciting information or attempting to influence action via the telephone, may include such tools as “phone spoofing.”  A common attack method is to call a user within an organisation and pretend to be the IT Helpdesk. From there the attacker will coerce the user into “confirming” their user name and password

Advent IM social engineering expert

We all want to help – naturally. We also want to make the shouting stop…

Pretexting – This is the practice of pretexting as another person with the goal of obtaining information or access to a person, company, or computer system. This is where where attackers focus on creating a good pretext, or a fabricated scenario, that they can use to try and steal their victims’ personal information. These types of attacks commonly take the form of a scammer who pretends that they need certain bits of information from their target in order to confirm their identity. More advanced attacks will also try to manipulate their targets into performing an action that enables them to exploit the structural weaknesses of an organisation or company. A good example of this would be an attacker who impersonates an external IT services auditor and manipulates a company’s physical security staff into letting them into the building.

Advent IM HMG accreditation concepts training

Counter Measures

  1. Education, Education, Education – All users should be appropriately trained to recognise these methods of attack. The work force should adopt a culture of healthy scepticism when approached for sensitive information and not take things at face value.
  2. Develop policies and procedure to identify and handle sensitive information so staff will know what is sensitive to the organisation and what they can and can’t do with it.
  3. Introduce appropriate technical defences which limit the methods of these attacks (i.e. block inbound emails with active links)
  4. Review your security controls regularly to ensure they are still appropriate.

ISO27001:2013 Transition Training now available!

**PRESS RELEASE**                                                                 Media Contact: Ellie Hurst

 +44 (0) 121 559 6699,

bestpractice@advent-im.co.uk

Date :05 Nov 2014

ISO27001 Transition Training now available

Information Security experts, Advent IM, today announced the launch of ISO27001:2013 transition training course.

Last year, the de facto Information Security standard ISO/IEC27001 underwent changes and some important alterations have been made to various controls and clauses. This means that organisations who are already certified or compliant to ISO27001:2005 are now having to think about transitioning their Information Security Management System to the 2013 version. Because of this, organisations have increasingly been seeking support in successfully completing this transition. Advent IM, stepped up to the mark after the initial release of the new version, with a tool to help businesses already certified to map the controls and clauses against the 2005 version. But the growth in requests for further support has been marked and the team of specialists at Advent IM were asked to provide a tailored made course for those currently certified or compliant to ISO27001:2005 to transition to 2013.

Advent IM today announced the availability of this bespoke course which will work alongside the mapping tool to support Information Security Managers who are navigating their way through the changes. Advent IM’s track record in both successful certifications and in Information Security training, make it perfectly placed to offer this training.  Operations Director, Julia McCarron said, “We were very pleased to be asked to supply this support. It’s great to know organisations continue to take their commitment to quality Information Security Management Systems seriously. ISO27001 has proven to be an enormously helpful framework; its comprehensive nature makes it a solid choice for a holistic approach to securing information assets. The transition to ISO27001:2013 need not be onerous; we are highly experienced with this standard and our vision is to help organisations have as smooth and successful a transition as possible.”

Details on how to secure a place can be found on the website at

www.Advent-IM.co.uk/opencourses.aspx

Issued: 051114                  Ends                                     Ref: ISO27001:2013/ Advent – 1

 

 

NOTES TO EDITORS

 

About Advent IM

Advent IM is an independent specialist consultancy, focusing on holistic security management solutions for information, people and physical assets, across both the public and private sectors. Established in 2002, Advent IM is a centre of excellence for security services, promoting the benefits of best practice guidelines and standards and the need to address risk management to protect against potential threats.

 
From its offices in the Midlands and London, its Consultants work nationwide and are members of the CESG Listed Advisor Scheme (CLAS), Institute of Information Security Professionals (IISP), The Security Institute (SyI), Business Continuity Institute and British Computer Society.

Consultants are also Lead Auditors for the International standard for information security management (ISO 27001) and business continuity management (ISO 22301), Practitioners of PRINCE2, a recognised project management methodology widely used within the public sector, CISSP qualified and Home Office trained physical security assessors.

 

Some places left on our HMG Accreditation Concepts Course in December

As usual, these will be allocated on a first come-first served basis.

Designed to help delegates understand the HMG accreditation process and how to identify, assess and treat risks appropriately following the guidance in IAS Stds 1&2, associated supplement and GPG47. This course is only open to public sector employees. Please contact us for further information on 0121 559 6699.

Advent IM HMG accreditation concepts training

Please book via the website

Full details of how to book available from the training area of the website 

Public Sector SIRO training places for October 8th

There are a couple of spaces left on October’s Public Sector Senior Information Risk Owner (SIRO) training course.

In summary:

Having successfully developed and delivered SIRO Training for the UK’s Police Forces since 2012, we have redesigned our popular and well respected SIRO training course for the broader public sector.

 Our training course will give you a greater understanding of your role and responsibilities as SIRO for your organisation. It will also cover both the principles of information risk management and information assurance using several scenario based exercises to test and improve your understanding of the crisis management issues in this area. At the end of the training, you will have the confidence to deal with information risk and incidents should they occur within your organisation.

As usual it will be allocated on first come first served unless there are cancellations. 

If you are from the Public Sector and either want to find out more about this training and why it is so vital to your organisation or you want to book your SIRO onto this course, please visit the website.  http://www.advent-im.co.uk/siro.aspx or email us at bestpractice@advent-im.co.uk with PS SIRO in the subject.

October 8th at Advent IM training suite in Birmingham (just off the M5)

Senior Information Risk Owner  Training from Advent IM

Senior Information Risk Owner Training from Advent IM