Tag Archives: cyber attack

Why would anyone want to hack the weather?

A review of the news of the BoM attack  from Security Consultant, Chris Cope.

Image courtesy of Stuart Miles at FreeDigitalPhotos.net

Or more precisely, why would anyone want to hack the Australian met office?  Well, its happened and officials are quick to announce that the damage will take millions of dollars to fix and that China was responsible for the hack.  Its not the first time that allegations have been made against Chinese hackers and, with the information available, it is pure speculation for non-official sources to speculate on how accurate the Australian allegation is.  But what is interesting is the close links between the Australian met office and the Ministry of Defence.  The nature of the links aren’t specified, but for an attacker looking to infiltrate the Australian Ministry of Defence, the obvious ways in are more than likely to be heavily protected.  But what about subsidiaries?  Could the Australian met office represent a weak link?  In this case, perhaps not as the intrusion was detected but there remains a lesson here for all companies.  Increasingly, outsourcing is becoming more common.  Services that organisations don’t want to deliver themselves are passed on to a service provider.  So, whilst we might be content that the security measures in place for our company are robust, can we say the same about those third parties that we connect to?  What assurances have been carried out, do contracts cover security consideration, are those connections monitored and is there a joined up incident reporting procedure?  All of these are valid questions and ones that are increasingly important in our interconnected world.  If you don’t know the answers to these questions, perhaps its time to find out, before a trusted partner becomes your Achilles Heel.

Image courtesy of Stuart Miles at FreeDigitalPhotos.net

 

Advertisements

Trident vulnerable to hacking?

By Julia McCarron with contribution from Chris Cope.

There have been a number of press stories in the last few days that could have us searching for our 3 pronged spears to protect these shores because, if the news is to be believed, the missile version of Trident could be rendered useless or obsolete from a cyber-hack.

I don’t know about you but I viewed these articles with some skepticism as I can’t believe that the MOD and Government haven’t thought to test the technical vulnerabilities of such a critical system before now, especially one with such far reaching consequences if it were breached?

As I understand it from those who have knowledge of MOD workings, all military systems, including Trident and its associated communications networks, are assured via the Defence Information Assurance Services (DIAS) Accreditors.  This assurance process takes into account the likely threats and resulting risks that apply to those systems, including hacking and other forms of cyber-attack.  There is a stringent policy of assessment and review for all major systems, and Trident will be one of the most assured systems due to its importance.  Clearly, though details of this assurance are highly unlikely to ever be released into the public domain; information on risks and counter measures taken against them will be very closely guarded. And I would hope so too!

The MOD will employ a number of safeguards to protect its most important systems.  Many of these will be familiar to the wider information security field and it’s no surprise that ISO27001 features heavily.  The greater the risks to the system, and the more critical it is, the more stringent the controls in place. Many high level MOD systems are effectively air-gapped and have no connection to the internet, even via a controlled gateway. That means they are effectively isolated from other communications networks, even the authorised users are heavily constrained in what they can and cannot do; use of mobile media for example is highly regulated.  Given Trident’s role as a potential counter-strike weapon, the communications to the deployed vessels receive very careful attention.  Not only will there be good level of assurance against the normal range of attacks, but there will be significant redundancy in place, just in case one fails.  Trident is carried by the Vanguard class submarine, which is designed to operate virtually undetected.  Commanders of these vessels have clear direction from the Prime Minister on what to do if there is evidence of a nuclear attack and all communication from the political leadership in the UK fails.

The comments made by a former Defence Secretary about potential vulnerabilities around the Trident system make interesting reading in light of recent concerns over cyber-attack, but the timing of these comments is telling. The House of Commons is due to vote on the future of the UK’s nuclear deterrent … there I go being skeptical again but as my hero Leroy Jethro Gibbs often says, Rule 39# There’s no such thing as a coincidence…

How cyber-attacks affect local and national businesses – The Rt. Hon. James Morris MP visits Midland based experts to find out.

Midland based Cyber/Information Security Consultancy and members of the Malvern Cyber Security Cluster, Advent IM announce a forthcoming visit from Halesowen and Rowley Regis MP, James Morris.

The visit is planned for the Advent IM Offices and Training Centre on February 20th at 11.30am. 5 Coombs Wood Court, Steel Park Road, Halesowen B62 8BF.

This visit will afford Mr Morris the opportunity to understand the impact of cyber security threats to businesses and public bodies in his constituency and their supply chain partners. He will also meet members of the team dedicated to improving organisational cyber security practice both nationally and internationally, through high quality consultancy and training.

Understanding cyber threat and the resultant risk to business is vital in the fight against cybercrime and data loss. Many research papers and surveys have been produced on the topic and if we were to select just one to illustrate the scope of the problem – According to Ponemon Institute research on corporate information security, “Corporate Data: A Protected Asset or a Ticking Time Bomb?” some major issues need to be addressed as a matter of urgency. Some of these include:

  1. 71% of all surveyed users found they had access to information that they shouldn’t have and 4 in 5 of the IT professionals who responded confirmed this poor practice by saying that their organisation did not use a ‘need to know’ data policy.
  2. Almost half of total respondents believed that the Data Protection controls and oversight were weak
  3. Almost 80% of respondents thought it was acceptable to transfer confidential documents to potentially insecure devices.

Segregation of data and appropriate access controls limit what users can find and use and also controls where hackers may be able to move if they actually do manage to gain network access. If end users can see gaps in security as evidenced in point 2, you can guarantee hackers will too.

Point 3 reveals that poor practice, lack of governance and poor or non-existent training are creating a perfect environment for cyber criminals to exploit in order to attack businesses.

If technical security hygiene is also found to be lacking e.g.  out of date and/or unpatched software in use, no effective and updated anti-malware in place, systems and networks untested by regular IT Health Check including penetration testing, then any incursion from outside forces will be successfully executed and organisational information assets will be completely compromised. This can include staff personal information, as it did with the Target breach and that of clients and other supply chain partners.

Managing Director Mike Gillespie said, “Businesses are connected by the internet all over the world; local businesses may have supply chain partners thousands of miles away just as frequently as down the road. Organisations have a responsibility to each other to make sure they are taking adequate precautions both technically and corporately to ensure their information assets are properly secured”

We will be discussing this and other cyber security issues affecting the local community with Mr Morris during his visit.

Issued:  12.02.15                             Ends                                     Ref: VIP-200215- Advent

NOTES TO EDITORS

About Advent IM

Advent IM is an independent specialist consultancy, focusing on holistic security management solutions for information, people and physical assets, across both the public and private sectors. Established in 2002, Advent IM is a centre of excellence for security services, promoting the benefits of best practice guidelines and standards and the need to address risk management to protect against potential threats. Mike Gillespie is MD of Advent IM, Director of Cyber Strategy and Research for The Security Institute and a member of the CSCSS Global Cyber Security Select Committee.
From its offices in the Midlands and London, its Consultants work nationwide and are members of the CESG Listed Advisor Scheme (CLAS), Institute of Information Security Professionals (IISP), The Security Institute (SyI), Business Continuity Institute and British Computer Society.

Consultants are also Lead Auditors for the International standard for information security management (ISO 27001) and business continuity management (ISO 22301), Practitioners of PRINCE2, a recognised project

Targeting of “Western” Critical National Infrastructure and how we all play a part in its defence.

I have read several opinion pieces that suggest ISIS is planning a cyber-geddon style attack on “the West’s” Critical National Infrastructure (CNI). Given the current nature of warfare and the growth of cyberwar/terrorism this seems like a logical opinion.

From the inaugural FT Cyber Security Summit in June this year:

Countries are having to defend themselves against an increasing number of attacks on their information and communications systems from unfriendly states, terrorists and other foreign adversaries. NATO, for example, in June adopted an “Enhanced Cyber Defence Policy”, outlined
in a public information document circulated by the 28-member intergovernmental military alliance at the conference.
“The policy establishes that cyber defence is part of the Alliance’s core task of collective defence, confirms that international law applies in cyberspace and intensifies NATO’s cooperation with industry,” states the document. Key aspects of the policy were discussed at
the event including the fact, reiterated by a member of the audience, that a digital attack on a member state is now covered by Article 5 of the treaty, the collective defence clause, meaning that NATO can used armed force against the aggressor.

We can all play a part in securing our CNI by securing our own networks and businesses to make them less likely to get used as mules or zombies to deliver this threat to our CNI. Back in 2011, Chatham House issued a report on cyber Terrorism and one of its recommendation back then was,

Training and development of staff in cyber security
measures should be seen as an integral part of risk
mitigation strategies.

This says staff, not IT staff or security staff just staff and this is because ‘cyber’ is a part of everyone’s day with very few exceptions. Behaviour and culture have an impact on CNI security. Through supply chains, we are all connected and through our IP enabled devices both at home and work, these connections become ever more complex and exploitable. Part of the problem as I see it is a bit of a disconnect with security at the top of many of our organisations.E&Y visuals security survey 2012 2

 

This is where culture is driven from and addressing this worrying knowledge gap is vital. Evidence for this lack of understanding comes from businesses themselves.

 

Board Compliance visual

 

DDoS attacks cause an average jump of 36% in customer complaints

According to research commissioned by BT through Vanson Bourne, on average customer complaints to businesses increase by 36% in the aftermath of a Distributed Denial of Service (DDoS) attack.

It seems like a staggering uplift but when you consider that in the UK alone the same research revealed that almost 60% of businesses admitted DDoS attacks had bought down their systems for six hours or more…a whole working day, it becomes less staggering. Around half (49%) of UK organisations to not have a response plan in place, so in actual fact the damage from a DDoS attack could potentially continue for a considerable period after the event.Add to that the reputational damage and you can start to see why it is so vital for businesses to really get to grips with what they are dealing with.

So if a DDoS attack takes out a network or possibly a data centre for six hours and this is apparently increasing and becoming more sophisticated, surely this should be much higher up the boardroom agenda than it is? I recently read that Cyber security ranked third in importance in boardrooms (KPMG). This initially seemed a little ambitious to be honest. Though when I examine the statement more carefully…third in importance in the boardroom, so that means of the businesses that actually have cyber security represented in the board room (alongside other business functions such as HR or Finance), it is averaging in third place. However we know that around half of organistions don’t ever discuss Information Security at the top level of their organisation.(Ponemon Institute). So effectively what we are actually saying is that we have a handful of organisations discussing this as a Business critical function but even they don’t have it as top priority despite the fact it could effectively be a deal breaker in terms of customers and reputation…

Advent IM Cyber Security Experts

 

 

 

Geography Lesson – a Cyber attack has no geography

stick_figure_pointing_north_america_image_500_clrThis morning’s security news bought the usual slew of stories on new products, advice and data breaches. One data breach that caught my eye was Maryland University. For reasons that will become clear I will be watching this unfold.

Maryland University has in the last few days suffered a massive data breach that has been characterised as a cyber attack. Normally I am wary of taking this at face value for the simple reason that language around security can sometimes be sloppy and someone using login credentials that that shouldn’t gets labelled as a cyber attack or hack. It is unhelpful and allows people to drift into the dangerous thought arena of ‘someone else’s problem, probably IT’…

This one is different because the university maintains it has excellent security and this this is unlike other breaches…

“Unlike some recent high-profile data breaches elsewhere, this university’s data breach did not occur as a result of a faulty preventative system or an IT mistake” said Brian Voss, the university’s vice president of information technology and chief information officer

 

The story is here if you would like to read it.

We will post any further developments that come to  light.

Image courtesy of freedigitalphotos.net

 

 

 

Technical Security Skill Shortfall Means Heightened Risk Levels For Business

First published in Outsource Magazine September 12 2013

A report commissioned by IBM concluded that Technical Information Security Skills are in short supply and that this is creating vulnerability and risk in business. The research, carried out by Forrester Research Inc., revealed that even mature organisations are facing increased risk exposure due to difficulty sourcing and retaining Information Security talent.

Overall, 80% of Chief Information Security Officers are finding it difficult or very difficult to recruit technical security staff that met all their needs, according to the research. A range of issues are feeding this difficulty and the resulting concerns about rising risk levels include some very disturbing elements, as unfilled roles create anxiety. Only 8% of respondents said that they didn’t have a problem with security staffing issues.

The remaining 92% identified some key areas for concern that any business should be considering, regardless of whether or not they think they have security talent issue. Whilst the solution for many businesses has been to recruit further down the experience ladder, you can see from the kind of pinch points identified here, that this is not a sustainable solution. Whilst it may ‘fill a security role’ it is not filling the right one.

  • external threats not understood or discovered (27%)
  • deadlines not met/projects taking longer to complete (27%)
  • a growing gap between threat and controls (24%)
  • technical control systems not fully effective (this is anti-malware and such like) (22%)
  • technical risks not identified (20%)
  • technical control systems not implemented (20%)
  • technical risks are unresolved (20%)
  • security road map is unclear (20%)
  • internal technical security audits are not undertaken (20%)
  • Process-based controls (e.g., segregation of duties, privilege review) are poorly defined, dated, or inefficient (18%)
  • concern that Security architecture is complied with (17%)
  • It has prevented adoption of new technology (e.g., cloud, BYOD) NB. Given some of the concerns we have seen in the list so far, this is probably a blessing. (16%)
  • External technical security audits are not undertaken (e.g., at service suppliers, supply chain)  (15%)
  • It has prevented business agility and/or growth (13%)
  • Security architecture is poorly defined (13%)

istock_000012299872medium.jpgThese result show us that not only that there is an increased risk to business from the skill shortage but that the kind of risk business is facing is not simply about architecture and cyber threat but also about the prevention of growth and agility. These are positive contributions that security can make and their inclusion as potential risks show a willingness to move security out of the cost column and into the investment column, but again this is being thwarted by the skill shortage. This may reveal itself in a lack of confidence in moving certain functions or activities to The Cloud or perhaps not instituting Bring Your Own Device (BYOD). Whilst it is better not to do these things if you do not know if they are within your organisation’s Risk Appetite, if you do not know what that Appetite is and there is no one sufficiently knowledgeable and skilled to be able to ascertain this and then mitigate the risk if appropriate, then an organisation may be disadvantaged. This might mean it becomes a less appealing choice for potential new and highly skilled employees for other parts of the organisation, who perhaps demand BYOD as standard along with the flexibility it brings.

Commercially, robust security and resilience is becoming a must have and increasingly organisations are being asked to demonstrate and prove themselves in these areas. Businesses that have worked with Her Majesty’s Government and the Public Sector will be familiar with their extensive security requirements for instance, but others are now finding that if they want to grow their business, the onus is on them to be able to prove their security credentials. This pressure is coming from larger organisations not just public bodies, as they realise how important it is for their supply chain to be resilient. Again this is a real stumbling block if you simply do not have the in-house skills to handle a project like ISO27001 certification or compliance. So the risks that are immediately apparent in terms of what might happen to a business without the appropriate level of security skill are actually more convoluted than they first appear.

A perception of security as a business enabler is one that many security professionals have tried to promote for a long time and the idea of growing a business within its Risk Appetite is common sense. For too long the perception of Security has been that Security will just say no to innovation, change and anything even vaguely risky-sounding. It is disappointing to think that just as the paradigm looks ripe to shift (in the right direction) that it is being stymied by a lack of high level skills. All of these challenges presuppose the organisation has the budget to be able to employ the skilled person they need.

Physical Security like manned guarding has been on the outsource list for many years, Information Security has not always been viewed the same way.  Depending on the level of challenge, size of organisation and actual (not perceived) threat and risk, there may be a viable alternative to a full time senior technical security person, through outsourcing. Perhaps if the challenge is to get through a particular project then the high level skillset may only be required at certain times, not constantly. If there is a tipping point at which the need for the skills is justified commercially this may come a lot sooner if there is an opportunity of filling the gap without actually having to finance an FTE with all of the cost that entails. Given the difficulty in sourcing the high level skills, the best talent is following the money, leaving many organisations in an uncertain security vacuum.  Outsourcing may be the solution on either a project or buy as you need type basis. It may provide a much more cost effective solution to a convoluted set of challenges that are not showing any sign of going away or simplifying. It may also mean a level of skill and experience far in excess of that which may have been within budget for an FTE.

Of course, making sure you are certain of your partner in any outsourcing endeavour is vital and due diligence on potential suppliers is vital. As a rough guide here are some questions you should be asking.

  • Does my partner understand my organisation and its business drivers and growth imperatives?
  • Can they provide qualifications, certifications, track record, references, case studies and a cultural fit?
  • Are they flexible enough for my needs? Are they able to flex up and down as required or am I going to be rigidly contracted to a number of days per month?
  • Do we have specialist or generalist needs?
  • Do we want access to an expert individual or a team of experts?
  • Do we want Strategy, Policy, Risk skills?
  • Do we want our partner to be capable of working successfully with C-level stakeholders or at the ‘coalface’ or both?