Magazine menu Close Magazine menu

Security Bytes

Senior security professionals share their most savvy advice in the Security Bytes series.

Latest stories

security bytes privacy reputation

How to build customer trust when a data breach happens

  • min read
    • Although common in all kinds of organizations and businesses, data breaches still make striking headlines. We all work hard to prevent them, but how should you communicate about data breaches when they happen? In the Security Bytes series, senior InfoSec professionals give their most savvy advice. This time, I asked several cybersecurity experts with incident response experience: Some chose to speak under a pseudonym, but all share sound advice that could help save your company's reputation when, despite your robust work to protect it, a cybercriminal succeeds in accessing your information. Hire the best PR firm Principal Security Consultant L0ra thinks a well-coordinated, experienced PR firm can best handle your company's reputation. She also believes the public responds well when companies admit their mistakes. "The biggest mistake companies make is glossing over their failures, but breaches happen every day. It isn't the first time. It won't be the last. "If the breach is large and public, immediately hire the best PR firm you can afford. "Sometimes, in response to a data breach, you get a raid. That's when a group of people comes at you on the internet. The number one rule for dealing with a raid is, log off and keep quiet. So you need a good PR firm to speak on your behalf." Communicate through the right people, and learn from mistakes Ray Hayes is Senior Software Engineer, Enterprise and Security at Microsoft. He highlights the importance of knowing who you're speaking with and learning from mistakes. "I don't speak about any incident off-the-cuff. I refer all inquiries to my leadership team. "If I'm asked informally about a major data breach or any other incident at my company, I make conversation, but keep it general, and make sure I know who I'm talking to. "Breach response is critical, but prevention is key. "Anyone starting a new job should think, "What could happen if the information I'm working on now was released?'" Involve everyone in planning – before it happens Security engineer Daniel says responding to data breaches must involve more than just the technical people. You need legal experts and business communicators too. "All companies should prepare for data breaches, especially those with data worth stealing. Small- and medium-sized businesses (SMBs) more often don't recognize the threat. "Before it happens, get everyone involved in making a crisis plan, not just IT. It's not only a technical problem. Involve legal, finance, safety and everyone else. They have valuable insight tech people often don't, and will have their own tasks to do when it happens." Tell customers affected, quickly and honestly James O, Director of Information Security, says informing your customers truthfully is a must. "Our insurance company gives us a Breach Coach to help our PR firm get the messages right. We also coordinate with internal communications to inform the families we serve, and start telling affected people as quickly as possible. We also report under our state data breach laws. "Companies could improve their data breach PR. When my data was accessed in a financial company's breach, I just got a form letter saying, here's your year of identity protection. "At least they included the root cause – leaving generic credentials on a public box – but that doesn't give me confidence that it won't happen again." Avoid the 'sophisticated attack' cliché Security Analyst http_error_418 says PR is vital, but companies must stop exaggerating cyberattackers' skills. "Companies often handle breaches with platitudes. They'll say the attacker was 'advanced' and 'sophisticated.' That's because, when it's later shown their app wasn't patched for eight years, investors are over the initial fright. "We also need to consider when transparency helps, and when it's overkill. "The public often don't fully understand what transparency reveals." Update regularly and learn from the best Cyber Threat Intel Analyst HackerPom points to an example of good practice. "When they know the facts, executives, PR and legal should give the media and customers regular updates. For a good example, look at Norsk Hydro's response to a bad data breach. Their communications were clear and straightforward." Better to overstate than understate the impact Joonatan Kauppi, Founder and CEO of Leijona Security, has several pieces of good advice. "If you're unsure of the impact, it's better to overstate than understate. If you downplay it, then word breaks that it's much more serious, you'll get worse press. "Bring the regulatory authorities into the loop straight away. "Inside the organization, start damage control, and don't skimp on costs. Gather the facts and inform your communicators. "Answer questions from security researchers and other InfoSec people. They ask the right stuff and are a good platform to communicate what happened. "Prepare for the flurry of questions you'll get from people or parties affected. Don't blame. Concentrate on reducing the impact of the breach." Make sure your plan fits all scenarios David Emm, Principal Security Researcher at Kaspersky, says to make sure you're planning for the full range of data that might be breached. "Balance technical and PR in responding to a breach. You can only do this well if you have a process for managing security incidents. Involve the right people across the organization – including IT, HR, legal and PR – and work out a plan before anything happens. The light of experience There are strong themes from these experts when it comes to how to communicate around data breaches. I'm hearing almost everyone say, plan for how you'll respond before it happens, involving people across the organization. Several say, to use the best PR available, and communicate with speed, honesty and regularity. By sharing the right information at the right time, in the right way, you'll get the right outcome: customers understanding how they're affected, and appreciating what you've learned. Article reflects the opinions of the author and speakers quoted. Published in 2019.
security bytes 2020 plans

How will the cybersecurity industry evolve in 2020? Perspectives from InfoSec pros

  • min read
    • 2019 saw a rise in ransomware attacks on institutions, more cyberattack services from the Dark Web and data breaches galore. What will 2020 bring? The Security Bytes series is all about senior security professionals sharing their most savvy advice. Here, I ask several leading cybersecurity insiders: Anastasios Arampatzis, cybersecurity content writer for Bora "I constantly have the feeling we're failing. And we're failing BIG. No matter how many hours we spend writing, talking, presenting… the risk and threat of poor cybersecurity insight, data breaches and security incidents keep growing. Although cybercriminals do their worst, it's our own cybersecurity industry that fails to live up to our expectations. "Have you ever seen a security warranty for any technology product? Warranties only cover mechanical parts and not software-related ones. "So I hope in 2020, cybersecurity will change in two ways. "Firstly, the industry needs to embrace security-by-design and privacy-by-design frameworks. Existing legislation in many countries leans towards this. In the near future, I'd love to see a product with a security warranty so companies offering cyber-insurance won't be able to deny reimbursing their customers. "Secondly, I'd love to see cybersecurity becoming an integral part of the school curriculum, starting even from elementary schools. Let's see what goodies Cyber Santa will bring. Ian Anderson, Security Manager and Sec Ops "I see significant control system threats. Not just critical infrastructure like electric utilities or oil and gas, but also transport. The likelihood is low, but the impact could be enormous. "Cities and states have the least funding and resources to defend their networks and systems. Cyberattacks can affect water systems, emergency services and other civic services like public transport. We've already seen examples in Atlanta and Baltimore. Those cities were big enough to afford recovery. What would happen to smaller towns and cities?" Ian predicts positive change too. "We will see significant improvements to cloud security – improved tools, default settings and accompanying technologies that focus on keeping the organization's cloud-based systems secure. "End-user awareness is rising. InfoSec pros are generally getting better at detecting attempts at compromise. Initiatives like multi-factor authentication (MFA) and role-based access control mean phishing awareness campaigns are getting easier. I think users take some of these practices home, which means safer web access for families." I researched vulnerabilities in food manufacturing and power plant ICS (industrial control systems) and SCADA (supervisory control and data acquisition). I also observed reports of the city of Toronto's susceptibility to ransomware and data breaches in the wake of Atlanta's 2018 SamSam ransomware incident. So I think Ian's predictions are on the money. Cheryl Biswas, threat intelligence specialist "The 2020 US election is around the corner. Disinformation and deepfakes are worrying trends. Obfuscation and evasion tactics keep evolving, like hiding files in files, breaking them up across deliveries and renaming processes to make malware look legitimate to the operating system. I hope national DDoS attack mitigation systems have improved to withstand the next generation of botnets." Nation-state attacks will only get more intense. Industrial control systems and Internet of Things (IoT) devices are especially at risk. But since cybersecurity practitioners become more aware of the threat, I'm optimistic we can become better prepared. Sameep Agarwal, Information Security Consultant and Penetration Tester Sameep makes predictions for new surfaces we need to protect. "With the automotive industry bringing in remote vehicle administration and infotainment integration as standard, vehicles will become new targets for hackers. "Biometrics is another risk area. Mass fingerprinting data from biometric technology will be at risk of breaches. Cyberattackers may use in-body chip implants intended for geo-location, medical and psychological purposes to monitor people. "I foresee the disruption to food processing and manufacturing to cause mass damage and spoiling. Agriculture will be targeted in 2020, through automated, remote-monitored farming systems, all possible because of industrial IoT." The in-body chips worry me most. There are already IoT medical devices like pacemakers susceptible to cyberattack, and the number of IoT devices in people's bodies will increase. If we can understand the risks now, we can make medical IoT and augmented bodies more secure. Amin Hasbini, Head of Research, Kaspersky, Middle East "The 5G telecommunications revolution is imminent. This fifth-generation network will host more network-connected devices, increase speeds considerably for users and serve as the foundation for many futuristic technologies. "But the security concerns of 5G are inescapable. As an evolving and developing technology built on top of the previous 4G infrastructure, it will inevitably inherit vulnerabilities and misconfigurations. Large-scale distributed denial-of-service (DDoS) attacks could be amplified; the massive increase in the volume of connected devices, with all the uncertainties about their quality and security in the network, will be a challenging task for telco administrators. "5G will be a more complex environment compared to its predecessors. In a global supply chain setting, bans based on the nationality of a provider offer little assurance especially to countries that have adopted a "banned provider" as part of its vendor diversification process." Read more about Mohamed's predictions for 5G security. A more connected world is an efficient but inherently vulnerable one – how will we adapt? Kurt Waller, Cyber Intelligence Analyst Kurt's predictions seem reasonable to me. "I think targeted ransomware will be used to disrupt the supply chains of bigger organizations. "The same attack could use seemingly targeted sextortion (blackmail with private photos and videos) mixed with fake thumbnails, deepfake video and phishing. "Phishing and malware distribution methods will move to office documents that aren't macro-based." Sextortion is no laughing matter. Nobody should assume they're immune to that kind of abuse. What stands out? The common threads in these points of view from some of InfoSec's brightest stars give me pause for thought. What's the one issue above all others that will define cybersecurity in 2020? I'm most concerned by the expansion of IoT without proper security measures. We'll soon see the first car accidents caused by cyberattacks to self-driving vehicles. I'm optimistic that as an industry, we can prepare for the future of IoT. It has impressive potential, like fewer accidents from synchronized cars, or checking the performance of your pacemaker through a mobile app. The future of cybersecurity is making all these new technologies safer. Here's to a year ahead of working together to make the world a safer place. Article reflects the opinions of the author and speakers quoted. Published in 2020.
security bytes data breaches

Advice from the pros: How to deal with a data breach

  • min read
    • I've a confession to make: I hate writing about data breaches. They're so frequent these days that I'm sure we've all been harmed by multiple breaches per person, whether we're aware of it or not. I've a feeling that for every data breach that's reported in the media, there are hundreds that people never hear about or the company isn't even aware of. The data breach phenomenon will escalate over time. So the more infosec professionals can help educate the businesses they work for and implement best practices, the more we can protect them from the worst effects of a breach. In the Security Bytes series, I share senior security professionals' most savvy advice. This time I spoke with cybersecurity professionals who were courageous enough to share their data breach stories with me. Each professional had to deal with a data breach incident firsthand. I've kept some details anonymous given the sensitive topic. But the insight here can help you respond to data breaches more effectively. The question: Daniel Ruf, Developer and Security Consultant First responses are critical to contain a data breach. Daniel Ruf was contracted to work for one anonymous project owner. Ruf described the first thing that happened that led to the discovery of a data breach. His quick and careful actions are a great example of how to handle a breach. "One evening, through a system monitoring alert, I became aware of a 99 percent CPU usage of our root server which impacted the availability of other websites using the same server. I informed the project owner of the hacked website, then started my first analysis. Next, I blacklisted the IP address of the attacker, blocked system access, then killed the suspicious processes. I archived as many files as I could from the project owner's web server for further analysis and conducted a system integrity check, then informed the project owner. "The culprit? A hacked CMS instance. I wasn't informed about the creation of this instance, which then used different webshells to start attacks, including cryptojacking (illegal cryptomining) which used up all our available computing resources." The major factors that led to the breach were the use of weak and reused passwords and an overall lack of robust security measures. Don't let this happen to you! Teagan M, Security Practitioner, Founder Green Duck Consulting, LLC Teagan described the data breach she dealt with. This is a common way that people can have their data compromised at work. Smaller companies and start-ups must be careful to be more thorough about their security, and realize that it's not just a problem that can be resolved with technology alone. "An authorised source had access to an email environment that was unauthorized and lasted, the first time, for four weeks. This company was very disorganized and treated security as a compliance issue instead of an actual business function. "The credentials to the user account were most likely captured by a phishing attack, and the attackers set up an email forward rule to send all emails to a Gmail account controlled by the attacker. The second time it happened, it was the same thing but I caught it much sooner. It was after the second event the company finally followed my recommendation to implement 2FA (two-factor authentication). That event still resulted in an exposure which required the company to report the incident under state data breach laws. "This was a small company that was growing fast. They didn't have the leadership in place they needed, nor did they want to properly compensate the necessary security talent. They burned through many security analysts due to weak and inexperienced security C-level management and a desire to appease audit requirements instead of securing the business. "They considered security to be a technology problem and continued buying services and equipment with no clear plan about how to integrate or manage any of it. They took their strategy from sales reps instead of properly planning their own path. "I worked closely with the C-level leadership to try to improve their program and was met with resistance the entire time. They'd give security 'lip service' but no action or empowerment. Things started to change slightly towards the end of my tenure there, but by that point I'd been burned out and needed to leave to preserve my own mental state." This naivety Teagan dealt with is one of the reasons why data breaches are so alarmingly frequent. 'BM', Former Infosec Analyst It's important to remember that large companies need to improve their data security too. BM shares a useful lesson to help anyone who secures data in any industry. 'BM' previously worked as an analyst, security engineer and later a consultant, for multiple companies. They've dealt with post-breach data forensics, incident response and triage work. 'BM' described a breach they dealt with. "When I was a consultant, I was sent to a Fortune 500 company for an incident response event. Their system was completely compromised and the attacker was threatening the CEO of the company to expose the breach. We immediately jumped on a flight. "For a full week, my manager and I reviewed the security logs and developed a remediation plan for the company. Although the company was very valuable, they had a relatively small IT staff. Much of our work was educating the team about exactly what happened, reviewing their logs, and working with them to upgrade their infrastructure. For example, they were running older versions of Windows on their entire network. "Fortunately, the incident was determined to be minor. It was pretty much a 'script kiddie' using easily available software to exploit unpatched versions of Windows. This turned into a full week of over twenty-hour days and numerous conversations to determine what could've been done better." Over twenty-hour days? That's ridiculous! It's important to educate all of your employees about security awareness. And also to make more effective use of your security staff – don't let it become a crisis management situation for external consultants to resolve. Sameep Agarwal, Information Security Consultant and Penetration Tester I've spoken with Sameep before about his data breach experiences – he's experienced several in his career. This story illustrates how personal conflicts can interfere with incident response and why it should be overcome. "A server was provided by the vendor for hosting a specific web application in a test zone. One day, flags were raised by the security team over an untested and unverified application. It was decided that since the hosting was being set up in a hurry, server hardening activity, which requires at least five working days, couldn't be completed. So internet access to the test zone server was never allowed in the initialization. "Since the vendor representative wasn't present at the client's location, server access was requested for remote administration. This was also raised as a security concern, but was overridden by the federal agency. "Operations on the targeted server started. After three days, a few updates from Microsoft were installed without verification of the update bundle. The virtual server was residing on obsolete out-of-life hardware taken from a previous government project which had many critical flaws. Since the physical server was out of life, it was not recorded in the federal agency's inventory. This meant intrusion prevention and anti-malware clients were not installed but it was accessible on their network infrastructure. "The attacker installed Telegram's desktop application, and joined the Iranian hacker group on Telegram. They started downloading applications for anonymity like proxy tools, VPN and bots. Later, the attacker added many dictionaries and combo lists containing common passwords for applications for cracking social media accounts like Instagram and gaming accounts like Fortnite. "The affected server traffic wasn't directed through the firewall because of exceptions made by the federal agency override. And because of the exception, the data breach couldn't be easily detected. "The intelligence agency investigation concluded that the blue team (defensive security specialists) made many exceptions based on personal relations to please the federal agency head. The key security findings of the red team (security testing specialists) were ignored time and again. The investigator suggested a deep probe on the intentions of insiders, and the psychology which allowed the attacks to happen, even after prior threat intelligence was available a month in advance." People are often the weakest link in security. It's important to have IT staff who have integrity and the right level of security awareness training. How to protect your business from data breaches Data breaches aren't purely technological in nature, they're also problems caused by people. The dangers posed by cyber-attackers is significant, from 'script kiddies' to advanced persistent threats (APTs). None of this surprises me. What did surprise me was how the businesses my interview subjects worked with worsened the data breach problems through a lack of personal integrity, or sometimes just through carelessness. Businesses need to start taking security more seriously by spending money, time and effort to better protect their, and by virtue their customers', data. I'm hopeful that by sharing these stories with you, cybersecurity professionals will be better prepared for the (not so) good, the bad and the ugly of data breach incident response.
cyber professionals

My best decision as a cybersecurity pro

  • min read
    • I connect with many great minds in cybersecurity on Twitter. I learn so much from them every day. In the Security Bytes series, I share senior security professional's most savvy advice. Some wished to use their real names, others preferred to stay anonymous. But they all shared tips that are seriously worthy of your consideration. The question: Learning to influence the C-Suite For two CISOs (Chief Information Security Officers), joining the C-Suite and positively influencing their peers helped them to achieve their goals. Accidental CISO "Accepting the role in the first place. The idea was terrifying to me, and I honestly didn't think I could do it. I've had such a huge impact on my company.  My work to build and certify the security program paved the way for us to land major enterprise deals." Patrick C. Miller, CISO, Archer International "I stopped using the word 'security' in executive discussions. Instead, I use risk management terms." It's a topic Patrick talked about at Kaspersky Industrial Cybersecurity 2019 conference and a very good point. If CISOs and technical professionals want to influence the C-Suite, they must learn to speak their language. And talking money – the financial costs of all possible cyberattacks – is usually a good starting point for discussing risk management. Executives are more likely to care about security hardening if they realize how much money their companies could lose from cyberattacks and the related reputational damage. Knowing your limits Knowing which responsibilities you can handle, and which you can't, is an important factor in your success as a cybersecurity professional. Secw0nk "Hiring people smarter than me. Early on in my career, I watched managers and leaders who prided themselves on believing they were the smartest person in the room. I made note of what not to do. When I got the chance to build a team, I made the conscious decision to hire people who I knew I could learn from, who had better technical experience than me, and for whom personal growth was important." Joonatan Kauppi, founder, Leijona Security "I recommended a competitor when a potential client requested a service that my company didn't offer. Because improving our clients' infosec is ultimately more important than improving our revenue." Beto on Security "Dumping a toxic client."  'Nick' "Learning to say no and sticking to just one job. I kept taking on extra contract work or even trying to work two jobs full-time, and found that I ended up failing at both of them." Lars Karlslund, founder, NetSection Security "Trusting yourself enough to say no when it felt right." Troy Blake, PCI compliance and cybersecurity expert "Focus on simplicity over complexity. Utilize products 100 percent before you add another tool to the cybersecurity environment. It makes management, maintenance and training so much easier – and it saves the company money." Henrik Klimatosse Kramshoej, "internet samurai" "I never compromise my integrity. I lost a well-paid job because they made me set approximately 4,200 logins across 48 servers back to 'passw0rd' because locking them caused too many support issues." Ouch! Don't rile cybersecurity professionals. They know how best to handle your business's precious data. Doing things your own way Some cybersecurity professionals work best when they can make their own decisions and take charge. Magda Chelly, founder of Responsible Cyber "I went on my own journey with Responsible Cyber and stopped contracts by choice (optional work opportunities). I now delegate to my employees more and more." Nderground "The best professional decision I made was to move to Bonaire (a Caribbean island) and consult. I wake up every morning and feel very fortunate to be able to live here." Lisa Ventura, founder, UK Cyber Security Association "Founding the UK Cyber Security Association and becoming a writer, blogger, influencer and keynote speaker in the cybersecurity industry. I have never been happier and I love what I do." Melanie Ensign, security and privacy communications, Uber "Work for a cause, not a company. This makes it easier to find the right opportunity or walk away if it's not right for you." Richard Greenberg, IT security evangelist "Accepting a position when I had just barely qualified was an intense but amazing learning experience. I learned so much and it gave me confidence for my future endeavors. Push your envelope!" Sameep Agarwal, former cybersecurity specialist "The best decision I made was to interact positively with everyone I met. I speak my mind and convey my message without mincing my words." It's malware!, malware researcher "Talk about salaries with co-workers. Don't let a company get away with unequal pay for anyone. And pay people for work, even if you're a start-up." That's sound advice. I agree with discussing money openly because it benefits workers. Professionalism matters Soft skills, like having a professional demeanor and being motivated to do your best, are critical for a successful cybersecurity career. Vandana Verma, security architect at IBM "Keep calm and be friends with the dev team!" mRr3b00t "Focusing on customer success and delivering fantastic services that aren't just run of the mill. Deliver the best that you can." Richard Cardona, product security maven, Electronic Frontier Foundation "Funnel customer vulnerability reports through support, but demonstrate how unaudited scans are full of false positives. For anything in question, escalate to appsec." Perhaps penetration testing relies on automation too much. There's always room for self-improvement One thing's for sure in your infosec career: you're always going to need to continue learning. M'hirsi Hamza, cybersecurity analyst, Barac.io "Never hesitate to try to learn new things, even if it isn't in your immediate field. If you understand what different teams do in your company, you can better understand what outputs you need to deliver." Justin Ruth, security researcher "Putting myself through the OSCP (Offensive Security Certified Professional certification) – never be afraid to invest in yourself." Battisto, security enthusiast "Spending a year as a helpdesk tech, then two years as a sys admin before getting into security. The best security practitioners need a good understanding of how networks function before they can learn to secure them." Experience counts. Be curious about everything. Making a difficult decision  Sometimes decisions are difficult to make. Sometimes other people in your organization will resist a necessary change. These cyber-pros made difficult choices that worked out for the best. NicoladiaZ, infosec consultant, Reporters Sans Frontieres "Switching from Windows clients to Linux. It was a good decision regarding the users' needs but it demanded strong political support and dis-learning capacities on behalf of end-users." It's tough to break old habits. Sometimes you need to be assertive if there's a good reason to switch vendors. Shelly Kramer, CEO, V3 Broadsuite "Convincing clients to go 'all in' on employee awareness training on a regular basis. Given the monumental phishing problem for corporate cybersecurity, employee training is always worth the investment."  "Joe Schlmoe" "I had to set up a security compliance team at a division of a Fortune 500 company. Dev folks resisted our efforts. The answer came to me after some weeks. I told the principals in a meeting that unless we all embraced security compliance testing, we were letting our customers down by possibly releasing a sub-par product to our customers. That took root, and within a year we went from mid 30 percent to nearly 99 percent compliance." Bl4ckP41nt, security engineer for a major US-based airline "Challenge the C-Suite to manage down: explain the 'whys,' maintain the relationship, then watch the boat slowly turn." In conclusion, you can learn things the hard way by making mistakes and reflecting upon them. But the easiest way to learn is to listen to people with experience. These opinions reflect those of the experts quoted and the article's author. Article published in 2019.
by Innovating leaders.
Innovative tech.
About Secure Futures

Secure Futures magazine is your go-to business guide for opinions, trends and insight into the world of technology and cybersecurity. We help your business to bring on the future. Brought to you by Kaspersky, the global cybersecurity experts.

  • For all other countries