Home Blog Page 75

What is Penetration Testing? What Does a Penetration Tester Do?

Penetration Testing, continuous testing, security testing

Ever since the pandemic hit, organizations across the globe stepped up their cybersecurity and automation operations, which also increased opportunities for skilled cybersecurity professionals in the industry. Organizations are looking for advanced talent and further adoption of AI technology in support of machine learning techniques to combat evolving cyberthreats. According to a survey, there are nearly 465,000 open job positions in cybersecurity in the U.S. as of May 2021, with a very low cybersecurity workforce supply ratio.

By Rudra Srinivas, Senior Feature Writer, CISO MAG

In addition to various cybersecurity profiles, the demand for penetration testers gained mainstream momentum as companies are now more focused on mitigating risks before they happen.

What is Penetration Testing?

Penetration testing is a simulated attack against a company’s network systems to find out unpatched vulnerabilities before threat actors exploit them. It is like a mock attack to check the security capabilities of the existing digital infrastructure and associated processes. In penetration testing, ethical hackers or pen testers attack existing systems and applications to find out their defensive capabilities.

What Does a Penetration Tester Do?  

A Penetration Tester, also called a Pen Tester or Ethical Hacker, is responsible to perform in-depth tests across a company’s network systems and web applications to find vulnerabilities or any security loopholes before they are exploited by cybercriminals.

Responsibilities of a Penetration Tester

  • Designing penetration tests
  • Carry out attack simulations
  • Creating vulnerability reports and recommendations
  • Advising the management on security developments
  • Work with other employees to enhance the company’s overall cybersecurity posture

How to Become a Penetration Tester

Ethical hackers need to possess a strong understanding of the psyche and motives of cybercriminals in order to conduct pen testing to discover security vulnerabilities and gaps in the network.

Required Skill Set

  • A bachelor’s degree in computer science, cybersecurity, IT, or engineering
  • Good networking skills
  • Knowledge of Java, Python, and Perl platforms
  • Black box testing
  • Coding skills
  • Vulnerability analysis
  • Proficiency in command-line scripting
  • Sound knowledge in operating systems concepts
  • Strong reporting and presentation skills

EC-Council’s certification courses like  Certified Penetration Testing Professional (CPENT), Licensed Penetration Tester (LPT), and Certified Ethical Hacker (CEH) will certainly help students and interested candidates in the pursuit of this role and opportunity. 

Wrap Up

Detecting and defending against evolving cyberthreats is critical for every organization to remain secure, and penetration testing will continue to be part of it. The field of penetration testing will evolve in the years to come and will remain a key component in the cybersecurity development program.

About the Author:

Rudra Srinivas

 

Rudra Srinivas is a Senior Feature Writer and part of the editorial team at CISO MAG. He writes news and feature stories on cybersecurity trends.       

Read More from the author.

Veeam Launches U.S. Federal Government-Focused Subsidiary – Veeam Government Solutions

Government officials

Veeam Software, a modern-day data protection solution provider, has announced the launch of its new federal government-focused subsidiary, Veeam Government Solutions (VGS), Inc. Given the volume and sophistication of ransomware attacks, Veeam aims to deliver modern data protection to the U.S government with additional industry resources.

What is Veeam Government Solutions?

Headquartered in Washington D.C., VGS brings to the table a trusted data protection solution that is independently verified and validated by the U.S. federal government-trusted, U.S.-based third-party agencies. VGS has been awarded several critical security and IT certifications, including the U.S. Navy DADMS, NIST – 1800-11, SOCOM Approved Products List (APL), Section 508, (has been sponsored by DISA and submitted for testing for the DoDIN APL). It is additionally working towards securing certifications important to other federal organizations.

With more than 1,200 government customers, VGS is focused on the backup and protection of mission-critical data for the U.S. Department of Defense, Civilian Agencies, Native American Tribes, the Intelligence Community, and Federal System Integrators. Earl Matthews, President of Veeam Government Solutions said, “Always protected and available data keeps the federal government operating. We founded VGS to be even more hyper-focused on the highest level of security and nimbler in support of federal agency needs. We’re committed to continually finding better ways to serve the government, solve its biggest data challenges, and protect the information that is a strategic asset for everything government organizations do.”

To stay abreast with the latest attack vectors and threats, VGS maintains a 100%-channel ecosystem and strategic alliance partnerships, which include established players like HPE, Microsoft, VMware, Cisco, NetApp, Pure Storage, and Nutanix. It is continuing to expand these partnerships with leading technology and service providers to provide a comprehensive data protection solution to mission-driven organizations.

The Dream Team

Since the clientele of Veeam Government Solutions includes government-based organizations, VGS carefully picked its Board of Directors and an independent Advisory Board to support the subsidiary in its operations and strategic decision-making. The VGS Board of Directors includes:

  • Nick Ayers, managing partner of Ayers Neugebauer & Co. and member of Veeam Board of Directors, he has served in the highest levels of government, including the White House.
  • Earl Matthews, president at VGS, has been a former senior director for defense policy and strategy on the National Security Council and former acting general counsel of the Army.
  • Gil Vega, CISO at Veeam. Vega has held various cybersecurity leadership posts within the U.S. Department of Defense, Intelligence Community, and in financial services. He has also served as the associate chief information officer and CISO for the U.S. Department of Energy and as CISO for U.S. Immigration & Customs Enforcement in Washington, D.C.

Apart from this, the members of the VGS Advisory Board include Harry Coker, owner of Primis Principiis; Chad Sweet, Co-founder and CEO of the Chertoff Group, and Lt. General (USAF, ret.) Thomas Trask, President of SO&A Consulting LLC, who are all veterans in this field and have at some point served in a federal agency or force. This makes them an integral part of VGS in understanding the implications and providing solutions to federal agencies.

Keeping in mind the President’s May 12, 2021, Executive Order on Improving the Nation’s Cybersecurity, which specifically was directed towards making provisions for third-party verification and validation of software, Veeam has also partnered with CACI, Inc. This association will provide the federal agencies an opportunity to ensure the security of the supply chain and further provide auditable and traceable processes.

Related News:

Veeam Software Announces Gil Vega as its New Chief Information Security Officer

Process Ghosting: A New Executable Image Tampering Technique in the Wild

Malware and Vulnerability Trends Report, Mobile malware threats

In addition to advancing hacking strategies, cybercriminals often try different tactics to evade security detections. In one such tactic discovered recently, security researchers from Elastic Security disclosed that a new image tampering attack, dubbed Process Ghosting, is being used by remote hackers to deploy malware stealthily on a targeted Windows system.

Researchers say Process Ghosting is a new kind of executable image altering technique with some similarities of endpoint methods like Doppelgänging and Herpaderping. Process Ghosting leverages veiled malicious codes to escape anti-malware defenses and detection.

“With this technique, an attacker can write a piece of malware to disk in such a way that it’s difficult to scan or delete it and where it then executes the deleted malware as though it were a regular file on disk. This technique does not involve code injection, Process Hollowing, or Transactional NTFS (TxF),” Elastic Security said. “A gap between when a process is created and when security products are notified of its creation, giving malware developers a window to tamper with the executable before security products can scan it.”

Process Ghosting Attack Flow

  1. Create a file.
  2. Put the file into a delete-pending state using NtSetInformationFile(FileDispositionInformation). Note: Attempting to use FILE_DELETE_ON_CLOSE instead will not delete the file.
  3. Write the payload executable to the file. The content isn’t persisted because the file is already delete-pending. The delete-pending state also blocks external file-open attempts.
  4. Create an image section for the file.
  5. Close the delete-pending handle, deleting the file.
  6. Create a process using the image section.
  7. Assign process arguments and environment variables.
  8. Create a thread to execute in the process.

In a proof-of-concept (PoC) demo video, the researchers detailed how Windows Defender initially tried to open the payload executable to scan it but kept failing because the file was in the delete-pending state. Later attempts to open it also failed because the file had already been deleted. The payload (ghost.exe) was executed without issue.

“We detected a variety of process image tampering techniques including Doppelgänging, Herpaderping, and Ghosting. It does this by checking the FILE_OBJECT for abnormalities during the process creation callback. These are reported in process creation events under process.Ext.defense_evasions,” Elastic Security added.

Three Lessons CISOs Can Learn from the SolarWinds Cyberattack

SolarWinds Microsoft

The recent supply chain attack, in which a backdoor was introduced by bad actors into the widely deployed SolarWinds platform, has revealed several dimensions of cybersecurity that were lacking in organizations across the globe.

By Dick Bussiere, Technical Director, APAC, Tenable

It is a stark reminder of how a single seemingly unconnected breach of a trusted third-party supplier can introduce malicious code directly into unrelated, separate infrastructures. Yet, supply-chain security is often overlooked among Indian organizations largely because the financial and technical capabilities of service providers and subcontractors don’t often match the capabilities of their clients. This is evident in a PwC report, which revealed that 76% of Indian organizations did not allocate adequate funds for cybersecurity in their budgets.

The writing is on the wall: if supply-chain security is not part of the cybersecurity plan, organizations in India are at risk of being breached. So, what lessons can CISOs learn from the SolarWinds incident to change the way they secure and manage their supply-chain infrastructure?

Continuous visibility: With interconnected networks, software systems, and subsystems being supplied by third parties, an organization’s infrastructure becomes intimately intertwined with that of its suppliers. This makes understanding how an attack against a supplier could impact your organization a critical part of maintaining cybersecurity.  The solution to gaining this understanding is to have continuous monitoring and threat intelligence relating to the full supply chain, and risk-based vulnerability management.

Inventory management: An organization may have numerous third parties in the supply chain and knowing whether its vendors maintain optimal cyber hygiene can be important in identifying the threat landscape. Here are some fundamental questions CISOs need to ask:

  • Have the vendors suffered any security breaches which could have introduced malware into the code or services being supplied by that vendor? Do vendors employ strict role-based access control models and separate duties around code repositories and technology stack?
  • Have vendors in the supply-chain deployed automation to enforce role-based access control settings
  • Are vendors constantly reviewing token and credential usage?
  • Is the vendor taking measures to ensure that the third-party code that they are using is free from malicious content?
  • Most importantly, when was the last time the vendor completed a third-party security review of their software development life cycle (SDLC)?

Zero trust model: The thought that any trustworthy, vendor-issued updates can be spoofed is concerning. This was evident in the SolarWinds breach, where the attack took place deep within the software development pipeline, and the code was signed with a valid certificate trusted by customers. From a risk management point of view, a zero-trust approach is important. Assuming that any system in an organization’s infrastructure can become rogue overnight is crucial to securing the supply chain. Having a baseline that includes accurate asset inventory, and an understanding of business processes, traffic flows, and dependency mappings are essential to establishing where trust relationships exist and where a zero trust model should be implemented.

Minimize access to sensitive data: After breaching a defense, the first thing cyberattackers do is to move laterally and look for privileged accounts. This is because privileged accounts have access to sensitive information. The more privileged access roles there are, the larger the attack surface, so such accounts need to be kept to a minimum.

It is important to identify who has access to privileged accounts and audit the appropriate level of privilege for each role within the organization. Implementing identity access management and encrypting all internal data can make it difficult for cybercriminals to establish backdoors to infiltrate during a supply-chain attack.

It is no doubt that a cyberattack on a third-party vendor creates cyber, operational, compliance, and reputational risks for all organizations the vendor works with. It can also have short-term and long-term impacts that could take months and sometimes years to resolve, resulting in financial loss. The ripple effects of SolarWinds are a painful example of how crucial it is for organizations in India to prioritize third-party security.

About the Author

Dick BussiereDick Bussiere is the Technical Lead for APAC at Tenable. Based in Singapore, Bussiere is responsible for evangelizing the criticality of cyber hygiene and vulnerability management as a continuous process to enhance an organization’s security posture.

Bussiere is also responsible for Tenable’s operational technology offering in the region, consulting with operators of critical infrastructure on how to bolster their defensive position.

Bussiere is the holder of five patents related to networking and network security. He’s also an active participant in the Institute of Electrical and Electronics Engineers and Internet Engineering Task Force working groups.

Disclaimer

Views expressed in this article are personal. The facts, opinions, and language in the article do not reflect the views of CISO MAG and CISO MAG does not assume any responsibility or liability for the same.

New Bill Mandates Australian Organizations to Notify Before Paying Ransom

Cryptocurrency scams in Australia

Ransomware attacks are not a common security incident anymore. Several countries are severely concerned about the rising sophistication of ransomware attacks. Some governments even announced ransomware attacks as a national threat, giving utmost attention to mitigate them. With a view to mandate the same, member of the Australian Labor Party and Shadow Assistant Minister for Cyber Security, Tim Watts, proposed the Ransomware Payments Bill 2021 to the House of Representatives. If approved, the new legislation would require all organizations to inform the Australian Cyber Security Centre (ACSC) if/when they are considering paying ransom to cybercriminals in the event of a ransomware attack. Organizations that fail to notify might face penalties from the authorities.

The ACSC stated that the proposed bill would act as a policy foundation for a coordinated government response to rising ransomware threats. It provides a critical platform for a comprehensive national ransomware strategy, which is much required to deal with the evolving ransomware attacks on Australian organizations.

“This is a stand-alone Bill to establish a mandatory reporting requirement for Commonwealth entities, State or Territory agencies, corporations, and partnerships who make ransomware payments in response to a ransomware attack,” the ACSC said.

Responsible Disclosure

As per the bill, all organizations in Australia, except small businesses, sole traders, and unincorporated entities, and charities, must notify the ACSC of the entire details of the cyberattack, the attacker, and the ransom payment. This information will be held by the ACSC and used to:

  • Share de-identified information to the private sector through the ACSC threat sharing platform.
  • Collect and share information that may be used by law enforcement.
  • Collect and share information to inform policymaking and to track the effectiveness of policy responses.

“If an entity makes a ransomware payment, they must provide ACSC with their details, the details of the attacker, and information about the attack to that extent that it is known. Information about the attack includes cryptocurrency wallet details, the amount of the payment, and indicators of compromise. Failure to notify the ACSC attracts a penalty,” the ACSC added.

Several industry experts support the introduction of a mandatory reporting scheme that will help enterprises to better understand and respond to cyberthreats.

Cyberattacks in Australia Rise

The recent ransomware attack on the largest meat processing giant JBS has paralyzed the company’s operations, affecting over 11,000 Australian employees across 47 units. Also, a new report from the Australian Competition and Consumer Commission (ACCC) for the year 2020 has rung the alarm for immediate recognition of these cybersecurity gaps. It revealed an 84% surge in identity theft scams and 75% in phishing scams, respectively.

Colorado Inches Closer to Becoming the Third State with a Comprehensive Privacy Act

American Cybersecurity Literacy Act

The Colorado State Senate approved the “Colorado Privacy Act” on June 8, becoming only the third state after California and Virginia to have a comprehensive data privacy law. The Senate Bill/Act 190 has now been sent to Governor Jared Polis, whose signatures will seal the fate of this act, which would then come into effect on July 1, 2023, unless he uses his veto to stop its enforcement within 10 days of transmission.

The 5 Key Rights of the Colorado Privacy Act

The privacy act will not apply to all businesses operating in Colorado but only to the ones that:

  • Store or process personal data of more than 100,000 consumers annually, or
  • Sell personal data and process or control the personal data of 25,000 or more Colorado resident consumers.

Besides, the Colorado Privacy Act has been drafted in a manner that grants the residents of the state five key rights:

  1. Right to opt-out of the sale of their personal data.
  2. Deny processing of personal data for targeted advertising purposes.
  3. Opt-out of automated profiling that produces legal or similarly significant effects.
  4. Right to access and correct their personal data for any inaccuracies held by the data controller.
  5. Right to get their data in a portable and ready-to-use format and the privilege to erase this personal data from the data controller’s database whenever they wish to.

Apart from this, the data controllers have been asked to limit their data collection only to essential information that is required to render their services and not collect it indiscriminately. Additionally, the act makes it mandatory to keep the collected data secured at all points of time to prevent unauthorized or malicious access.

The Colorado Privacy Act has also taken into consideration the inclusivity and has asked data controllers to refrain from collecting and processing sensitized information like data on ethnic background, religious beliefs, mental or physical health, sexual orientation, citizenship, genetic/biometric data, and the personal data of minors, unless the consumers opt-in or provide consent for it.

Although this Privacy Act is similar to the California Consumer Privacy Act (CCPA) and Virginia’s Consumer Data Protection Act (CDPA), it has some implications which are different from them and thus would be a challenge for businesses to comply with. So, we have to wait and watch what happens.

Related News:

Five Reasons Why Organizations Fail in Their GDPR and CCPA Compliance

California Voters Say “Yes” to Proposition 24 for Expansion of Data Privacy Law

North Korean State Actors Potentially Breached Korea Atomic Energy Research Institute

Korea Atomic Energy Research Institute

Virtual Private Network (VPN) applications that are meant to secure user privacy online are becoming an entry point for intrusions. Threat actors often exploit unpatched vulnerabilities in VPN devices. Recently, South Korea’s state-run Korea Atomic Energy Research Institute (KAERI) revealed that its internal network systems were affected after attackers exploited an unpatched VPN system vulnerability after unauthorized parties accessed the systems from 13 external IP addresses.

“The Korea Atomic Energy Research Institute checked the history of access to some systems by an unidentified outsider through the VPN system vulnerability. The attacker’s IP is blocked, and the VPN system security update is applied. Currently, the Atomic Energy Research Institute is investigating the subject of the hacking and the amount of damage, etc., in conjunction with related organizations,” KAERI said.

Korea Atomic Energy Research Institute in Denial

While the intrusion occurred on May 14, KAERI tried to cover up the damage by not revealing it, however, the incident came to light after Sisa Journal reported it. It’s claimed that KAERI initially stated that it did not suffer any cyberattack, but finally confessed when asked about the facts.

“The statement that ‘there was no hacking incident’ was a mistake in the response of the working-level staff, which occurred in a situation where damage was not confirmed during the investigation due to suspected infringement. The Korea Atomic Energy Research Institute apologizes for causing concern to the public due to this hacking accident,” KAERI added.

Commenting on the incident, Assemblyman Ha Tae-Kyung said, “The Ministry of Science, ICT and Future Planning and the Atomic Energy Research Institute all made a false report saying ‘there was no hacking accident’, but when asked about the specific facts, they finally confessed. It is a place that researches and develops key national source technologies such as rods, and the crime of trying to deceive the people by concealing such an important fact (hacking) with a brazen lie is greater.”

North Korea – the Primary Suspect

While the attackers behind the intrusion are unknown, KAERI suspects that it is an act of North Korean state-sponsored hackers. “Currently, the researchers’ investigation into the hacking incident is in progress, and analysis is coming out that it is the work of a North Korean hacking group,” KAERI said.

It is not the first time that South Korea suffered security incidents at the hands of its Northern counterpart. In the recent past, South Korea accused the state-sponsored North Korean threat actor group APT37 of using RokRAT Trojan in a new wave of cyber operations targeted against the South Korean government. The North Korean state actors were also accused of launching a cyberattack against COVID-19 vaccine maker, Pfizer.

“We want to bring together incident response and security teams from every country”

Forum of Incident Response and Security Teams

The security community strives to mitigate zero-day attacks. Timely vulnerability disclosure and incident response/handling is the way to do this. But that depends on the relationship and communication between the security researcher and the product vendor/developer. The industry established standards like Common Vulnerability Reporting Framework (CVRF) and Coordinated Vulnerability Disclosure (CVD) for gathering information from vulnerability finders, coordinating the sharing of that information between relevant stakeholders, and disclosing the existence of software vulnerabilities and their mitigations to various stakeholders including the public.

An organization called FIRST aspires to bring together incident response and security teams from every country across the world to ensure a safe internet for all. Founded in 1990, the Forum of Incident Response and Security Teams (FIRST) consists of internet emergency response teams from 575 corporations, government bodies, universities, and other institutions across 97 countries in the Americas, Asia, Europe, Africa, and Oceania.

In an interview with Brian Pereira, Editor-in-Chief, CISO MAG, Chris Gibson, Executive Director, FIRST.Org, Inc. outlines the objectives of this organization and how it works with global teams with a mission to make the internet a safer place.

Gibson brings a wealth of relevant and up-to-date experience in setting up and managing CERTs at the highest levels of the worldwide Information and Cyber Security community. He has spent over 12 years working in the Computer Emergency Response Team (CERT) while at Citigroup and, for 10 years, was part of the leadership of the Forum of Incident Response and Security Teams (FIRST); two as Chair. Within FIRST, he implemented the Fellowship program. This was created to fund CERTs from UN-designated “Least Developed Nations” (LDCs) allowing them both to join FIRST and attend conferences and training.

Gibson joined the U.K. Government’s CERT-UK team in November 2013 to build and launch the U.K.’s first formally chartered national CERT, joined Close Brothers as Chief Information Security Officer in November 2016, moved to Orwell Group as CISO in Jul 2018, and joined FIRST as it’s Executive Director in May 2019.

Gibson’s experience has allowed him to work with colleagues from inside some of the world’s largest global financial institutions, colleagues from proprietary software companies such as Microsoft and Oracle, open-source companies such as Red Hat, with upstream communities and also the global incident response community – the national CERTs of many countries – from Azerbaijan to Zambia.

Edited Excerpts from the email interview:

Can you tell us about the mandate of FIRST (Forum of Incident Response and Security Teams) and how it coordinates with security teams across the world? Do you have chapters in other countries?

FIRST is a forum where incident response and security teams meet, collaborate, learn, share, and network. Our vision is to bring together incident response and security teams from every country across the world to ensure a safe internet for all. We presently have 575 members from 97 countries, approximately 50% of the countries in the world. However, much of our output is freely available to all our community – whether they are members or not.

Trust is vital in our industry. FIRST fosters trust, global coordination, and a global language among our members through several activities including organizing training and developing standards, facilitating special interest groups, hosting global events, influencing policy and governance, and rewarding industry leaders.

We organize events all over the world. The FIRST annual conference promotes worldwide coordination and cooperation among computer security and incident response teams (CSIRTs). The conference provides a forum for sharing goals, ideas, and information on how to improve computer security on a global scale.

We also (normally) host or participate in some 20+ events annually around the world, bringing together both members and non-members. This has since moved online. Part of this is helping other organizations by bringing our expertise (IR) to their events – primarily capacity building with OAS, ITU, FCDO, etc.

We have many Special Interest Groups (SIGs) that are run by the members of the community. They allow smaller groups of members, with specific interests, to get together and further those interests. FIRST facilitates these groups by providing website infrastructure, a conference bridge, a Program Manager, and meeting space at our events. We also initiate quarterly meetings for SIG chairs to gather feedback on support needs, discuss best practices, and identify potential synergies across groups.

The Product Security Incident Response Team (PSIRT) SIG was formed in mid-2014 due to a need for more product-focused response coordination and practical sharing of best practices and experience. We noted that our Incident Response procedures have differences and other practical issues to address and establish working approaches not documented elsewhere. The SIG is extremely active and runs events specifically focused on product security response and coordination. It is this particular SIG that has absorbed ICASI.

You recently announced that ICASI – the Industry Consortium for Advancement of Security on the Internet – was officially integrated into FIRST. How would the community benefit from this integration? How will you synergize and leverage on each other’s strengths?

ICASI was born after a conversation at the FIRST conference in Seville in 2007 — there’s always been a great deal of synergy between the two organizations. At the time FIRST was not in a position to meet the requirements of ICASI.

ICASI offers a methodology for organizational exchanges for coordination, where there is little practical experience. The ability to make this available and repeatable globally is essential as we look forward to addressing supply chain issues and working for broader coordination between vendors.

The Unified Security Incident Response Plan (USIRP) and the work that goes on behind the scenes running a USIRP process are significant. FIRST has evolved since then and is able to support this. The PSIRT SIG has also grown significantly since this time and now brings together teams from some 75 companies globally.

For years, ICASI led the way in advancing multi-vendor coordinated vulnerability disclosure, introducing the Common Vulnerability Reporting Framework (CVRF) standard, developing the principles of a Unified Security Incident Response Plan (USIRP), helping to create the Guidelines and Practices for Multi-Party Vulnerability Coordination and Disclosure, and modeling a trust group of industry leaders that successfully coordinated multi-vendor responses to numerous security incidents. ICASI will now dissolve as an independent organization and transfer all its assets to FIRST. How does FIRST plan to evolve these standards once these assets are transferred?

[The CVRF standard was passed to OASIS and is now preparing to release CSAF 2.0 so that work continues independent of ICASI and FIRST.]

The PSIRT SIG will focus on furthering the USIRP and replicating additional groups with other industry focus.  The multi-party disclosure and coordination is an effort that ICASI and FIRST jointly worked on previously and continue to this day, however, we will look at how to expand the organizational coordination and expand the disclosure models to include this broader approach for cybersecurity through vendor and application coordination. The PSIRT SIG / ICASI WG will continue working on security incidents. 

Organizations continue to grapple with challenges regarding Security incident response. What is FIRST doing to improve the community’s ability to respond to vulnerabilities across multiple vendors?

ICASI is an example of coordinating across multiple vendors. We believe that expanding the groups of vendors with a like-type model will speed the coordination and bring about an ability also coordinate between the groups to better defend and protect the ecosystems that comprise the internet.

FIRST has also sponsored the creation of CSIRT and PSIRT Services Frameworks.  These documents help new security teams get started and existing teams to mature their processes.  These documents are available to members and non-members alike.

Do you see more security researchers or product developers engaging in CVD or Coordinated Vulnerability Disclosure? Do you think incentivization will encourage more CVD?

Coordinated Vulnerability Disclosure (CVD) ensures that researchers and developers are aware of how to engage and who to engage.   The largest issue has been that most finders were not aware of how to get the disclosure started and in turn, whether the vendor would respond, whether the vendor had a process and whether they would recognize and honor that disclosure.

Some vendors choose to incentivize that coordination through a bug bounty, mainly to incentivize the focus to where the customer interest is and to what is now generally available for the public.  This is a choice of organizations to make and while it may assist some and incentivize researchers, we see that as a market issue to determine.

Do you think more regulation is required around vulnerability disclosures?

FIRST supports the work of its members and doesn’t take a position on regulation, however, one of FIRST’s three missions is focused on Policy and Governance. We participate in policy and governance discussions as best we can to make sure others understand what we do, and that they enable us rather than limit us. FIRST engages with relevant stakeholders, in technical and non-technical communities, to ensure teams can work in an environment that is conducive to their goals.

About the Interviewer

Brian PereiraBrian Pereira is the Editor-in-Chief of CISO MAG. He has been writing on business technology concepts for the past 26 years and has achieved basic certifications in cloud computing (IBM) and cybersecurity (EC-Council).

Risk-based Vulnerability Management – Let’s Begin With the “Why?”

Vulnerabilities in Zimbra

Any organization’s vulnerability management program must be a cornerstone of its cybersecurity initiative. Security vulnerabilities, if left unidentified and/or unaddressed, can bring the business down like a house of cards. As your organization adopts emerging innovation and technology, it also correspondingly outgrows in the threat landscape. This makes the protection of your most critical business assets all the more difficult.

By Doug Drew, Client Solutions Advisor, Americas, Optiv

 SPONSORED CONTENT 

The number (and sophistication) of threat actors continue to spiral upwards. However, the larger problem has been finding, prioritizing, and fine-tuning the response to these susceptibilities. This has always been a top priority for security professionals, but the growing number of traditional and zero-day vulnerabilities makes it difficult, if not impossible, for legacy vulnerability assessment tools to be effective.

Legacy vulnerability assessment tool? What’s that?
A legacy vulnerability assessment tool is commonly used for scanning business networks and applications for “known weaknesses.” It checks for predefined exploitable characteristics which expose business networks to possible cyberattacks. Once the scanning is complete, the tool then sends a standard report notifying IT administrators of the vulnerabilities that need remediation. This, though, is a protracted process, as administrators must manually prioritize, align and remediate the vulnerabilities.

It’s time to move away from this one-dimensional approach – the future of cybersecurity is risk-based vulnerability management (RBVM). Your vulnerability management program needs to evolve, prioritize and continue to protect the most critical business assets rather than burning time on exposures that are unlikely to be exploited. An RBVM approach is a perfect fit for this. It reduces vulnerabilities across your attack surface by prioritizing remediation based on the risks they pose to your organization.

So, how is RBVM adopted and managed? It depends on these six simple principles.

1. See the forest through the trees

The threat landscape has evolved dramatically over the past 10 years in ways that have challenged our ability to understand, manage and predict threats. This trend is continuing at an unprecedented rate and with the attack surface growing around cloud-based services, IoT and OT, the security borders are becoming more transparent, raising the bar for security teams trying to protect business assets.

Managing vulnerabilities in today’s connected landscape requires us to understand both the extent of our attack surface and also the value of each target. Without marking your operational boundaries, you can’t predict threats in the darker side of the woods; without tagging the risk value we can’t ascertain what needs to be guarded.

So, make contextual and informed decisions using a risk-based approach. Sift through the clutter of the vulnerability trees and draw parallels between essential vulnerability characteristics. Combine the criticality of the assets affected, the threat identified and the exploit intelligence available along with other key contextual elements. What you have then is a formula that helps your organization understand the actual risk posed by each vulnerability.

2. You can’t boil the ocean

There is no way to fix it all. Time is a tremendous constraint in today’s business world. 24/7 operations, limited change windows, and staffing pressures force us to focus on what matters the most – addressing risk. However, when it comes to legacy vulnerability management practices, remediation timeframes are often based on outdated industry standards like the Common Vulnerability Scoring System (CVSS).

CVSS is an open framework that defines severity scores to software vulnerabilities based on a theoretical calculation. However, a vulnerability is only as dangerous as the threat exploiting it. 95% of “high severity” CVSS score vulnerabilities have never been exploited in the wild. This means the attackers don’t care about the vulnerability score as long as they can successfully leverage these attack vectors.

In contrast, RBVM helps in prioritizing efforts based on business risks. Acting on what is specific to the real-world activities of hostile actors is requisite to staying ahead of them.

3. Don’t ignore what’s beneath the tip of the iceberg

Seven-tenths of an iceberg never appears above water, but that doesn’t mean it can’t sink your ship. Today’s tip of the iceberg involves IoT, OT, and cloud technologies – with DevOps being an important addition to the list. The landscape has changed. But, organizations need to look below the surface into traditional IT environments too. Because traditional vulnerabilities often sink the security ship. So adopt a risk-based vulnerability management approach to cover the entire attack surface. Determine the vulnerabilities and prioritize remediation of critical assets that lie both above and below the water.

4. The tail can’t wag the dog

The strategy must drive tactics, not the reverse. Some security teams have a thought process that vulnerability scanning is the “endgame.” The risk goes beyond vulnerabilities. There is an entire set of data and tools, like application scanning, configuration scanning, and pen-testing data, which gives you a different POV of your business environment and can provide valuable vulnerability insights. Focus on what matters to your business and remediate those things or you can be consumed with repetition fatigue and staff burnout.

5. Don’t be the slowest gazelle

Always remember, “if everything is important, then nothing is important.” A risk-based vulnerability management approach allows the organization to effectively assess the problem and then appropriately prioritize or deprioritize it. But true risk-based vulnerability information doesn’t just provide a complete overview of the threat landscape; it also speeds decision-making.

Combined with orchestration and automation efforts, an RBVM program can reduce both the need for human intervention and the time to remediation and validation by integrating your security tools properly. This approach will help keep you ahead of the pack and minimize disruption in your environment.

6. Risk is a team sport; lean on your teammates

Football is a classic example of a team sport. Every touchdown scored is a well-orchestrated symphony. Every player has a different role, yet the play is carried out with one end goal – putting the ball in the end zone. It’s the same with risk management in the business world.

Facing adversaries on your own can be a daunting task. This can especially seem very difficult in the case of zero-day attacks. Your defense partner may be able to hold the fort against it – or maybe not. For such scenarios, there is one team member who creates and executes the strategy – the head coach.

Organizations need to ask who are their head coaches and how well-prepared are they? If you aren’t comfortable with your answer to this question, it’s time to upgrade your operations with a prudent risk-based vulnerability management program and tools like the one from Optiv.

Need more information on this? Click here to know how Optiv can take care of your organization’s RBVM needs right away!

Carnival Cruise Line Hacked Second Time in Two Years

Shipping cybersecurity, carnival cruise line

Recently, the U.S. Centers for Disease Control and Prevention (CDC) gave a green signal to Carnival Cruise Line to commence operations on the condition of meeting health safety protocols for its passengers. This came as a pleasant respite to the cruising industry, which had been grounded since COVID-19 ravaged through the Diamond Princess Cruise docked at the Yokohoma port in Japan. Many attributed this ship as the “Linchpin” for the spread of the virus and thus wished to stay away from such cruises. However, just when the light was finally appearing at the end of the tunnel, Carnival Cruise has been pushed back again; this time not with a biological virus but a cyberspace virus.

The world’s largest cruise ship operator has disclosed a data breach incident that took place in March and impacted an unknown number of customers, employees, and crew members of the fleet that includes Carnival Cruise Line, Holland America Line, and Princess Cruises. The data breach first came to light when the cruise line fired a notification mail to its customers. As per the notification, the company had detected unauthorized third-party access to a “limited number” of email accounts on March 19.

The data breach leaked the following information:

  • Data collected during the guest experience and travel booking process
  • Employment data of its employees
  • COVID and other safety test results of its employees and crew members

These data sets include “names, addresses, phone numbers, passport numbers, dates of birth, health information and in some limited instances additional personal information such as Social Security or national identification numbers.”

Incidentally, this is not the first time that Carnival Cruise Line has been under the radar of cybercriminals. In March 2020, a similar data breach incident rocked the cruise line, which was later followed by a ransomware attack in August 2020. During the ransomware incident, the company did not confirm the operators, or the amount of data compromised, but only said that some of its data files were “partly encrypted.”

However, Chris Hauk, Consumer Privacy expert at Pixel Privacy, said that it was “a case of a company not taking the steps to properly defend their networks against the bad actors of the world. As mentioned by cybersecurity firm Bad Packets, Carnival failed to patch its edge gateway devices and firewalls, even though patches have been available to fix both issues since earlier this year.”

Looking at the recurrence of these incidents, maybe Carnival Cruise Line should take its vulnerability management and threat detection programs more seriously, if not already. For the moment though, the firm has offered free credit monitoring and identity theft detection for 18 months to those affected by the latest data breach incident.

Related News:

These are the 5 Biggest Data Breaches in India in H1 2021

1...747576...409Page 75 of 409