What is your security posture?

Great matrix to see where you stand with your cyber security posture. If you have questions, or would like an evaluation conducted of your environment, please feel free to reach out to me at (605) 251-2131.

Ransomware - should you pay?

   

Unfortunately, I have had cause to write rather regularly in recent times about ransomware, and what it can do to you. As straight-talking Naked Security writer John Zorabedian put it recently:

Ransomware is about the bluntest sort of malicious software you are likely to experience.

Ransomware shoves itself unavoidably right in your face.

It deliberately locks you out of your computer or your files, and then demands money to let you back in.

There are two main sorts of ransomware:

• Lockscreen ransomware. Pops up a window that takes over your computer or mobile device, so you can't use any other applications, make calls, or run your anti-virus. This ransomware usually accuses you of some sort of crime, but offers to let you keep on working once you have paid a "fine."
• File-encrypting ransomware. Leaves your applications running just fine, but scrambles your data files so you can't open them any more. This ransomware usually pops up a window offering to sell you the decryption key.

The good news is that with a bit of technical savvy, or help from a friend that has the savvy, it is usually possible to work your way past most lockscreen ransomware without paying up.
The bad news is that with most recent file-encrypting ransomware – well-known ones are CryptoLocker, CryptoWall and TeslaCrypt – there isn't a savvy shortcut.
Loosely speaking, if you don't have a backup of your scrambled files, you are stuck.
If the crooks have implemented the encryption process properly, the only way to get your files back is to to pay them for a copy of the decryption key. Public-key cryptography
Most modern ransomware uses public-key cryptography, which is where you have separate keys for locking and unlocking a file. The public key can be given to anyone to encrypt files, but only the private key can later decrypt them.
So, the crooks generate a public-private keypair on their own servers, and send only the public key to the ransomware running on your computer.
That means that the malware can scramble your data, but the key needed to unscramble it never shows up on your computer – not on disk, and not even in memory.
There's no point in scouring your computer in the hope of finding a local copy of the private key: your private key exists only on the crooks' servers until you pay up.
No-one else's private key will work for your files, either, so there simply isn't a shortcut.
You need that private key, and to get it, you have to pay the ransom.
What to do?
So the big question, usually left unanswered in technical discussions of ransomware, is, "Should you pay?"
At a typical price point around $300 to $600 (£200 to £400), ransomware can be expensive.
On the other hand, think about what might be in those scrambled files: your baby videos; those tax return documents you were supposed to keep for seven years; the dissertation you need to turn in on Friday...how much are those worth?
For better or for worse, most ransomware gangs have acquired a bit of an "honour among thieves" reputation, so that if you do pay over the money, you almost certainly will get your files back.
On the other hand, law enforcement and security experts are very likely to say, "These are crooks! This is extortion! If you can possibly take it on the chin, we urge you NOT TO PAY!"
But those are easy words to say if it's not your data on the line.
Interestingly, one reason for not paying extortionists is that there is often no way to ensure that they won't come back to gouge you for a second payment, or a third, and so on.
But, as described above, modern file-scrambling ransomware doesn't actually steal your files.
The crooks don't have a copy of anything of yours, just the private key to unlock the scrambled files on your own computer.
In theory, then, once you've paid up, decrypted your files and disinfected the malware, you and the crooks are back on an even footing, and they can't come back for more.

Should you pay?
We're not going to moralise about whether it's always unacceptable to support criminality by paying up, even if you are in a difficult position.
We'll leave you with plainer advice, namely, "It's OK to pay, but it's much better not to."
So, keep these two points in mind:

1. Don't pay if you can possibly avoid it, even if it means some personal hassle.
2. Take precautions today (e.g. backup, proactive anti-virus, web and email filtering) so that you avoid getting into a position where you ever need to pay.

Remember: if you don't have backups and you lose your laptop, you're in the same trouble – worse, actually – than you would be with ransomware.
After all, there's no-one you can pay any amount of money to in order to get your data back if your hard disk is at the bottom of Boston Harbour. (It happens.)

10 Tips for Cybersecurity

Protect Your Business

The Federal Communications Commission (FCC) has created the Small Business Cyber Planner 2.0, a free, online cybersecurity planning guide to help small businesses create a customized security program and protect themselves against cyberattacks. The FCC also offers these tips for improving cybersecurity:

1. Establish security practices and policies and train employees to follow them.
2. Protect information, computers and networks from cyberattacks.
3. Create and use Internet firewall protections.
4. Create and implement a cybersecurity plan for all mobile devices.
5. Back-up important data, documents and information.
6. Control physical access to your computers and create user accounts for each employee.
7. Secure your Wi-Fi networks.
8. Create security procedures for your payment systems and payment cards.
9. Limit employee access to data and information and limit authority to install software.
10. Create and use challenging passwords. Then, change them often!

The FCC Cybersecurity Hub for Small Businesses offers a variety of other tips, tools and resources

Dangers of Local Windows Administrator Rights

One of the questions that has come up, and it always does, is the question – how bad is it if users have local administrator rights?


Obviously the easiest answer is BAD, REALLY BAD! It’s like you buy a house or a car and then decide that you don’t need locks on any of the doors. The reason we have file permissions, registry permissions, user right assignments, and the like in Windows is to limit ourselves to only having the rights we need on a system that are necessary in order for us to do our jobs. We shouldn’t have any more or any less rights than are necessary. But when we give our end users administrator rights, it is like we’ve just taken all the locks off the doors and given those users the ability to go into any room of the house without our permission.


Ok, so beyond the simple answer, what else could happen on a machine if we allow users to be local administrators of their machines? Here are just a few of the things that could happen:
System files can be accessed or changed.
Program files or program configurations could be modified.
Software that is not approved could be installed, and won’t be maintained.
Malicious code can be installed with unlimited rights.
New, unapproved user accounts could be added to the system.
Password policies could be subverted.
Security controls such as anti-malware, firewalls, removable media controls, could be disabled.


And as you can imagine, the list goes on and on…


One other fun issue to consider is the issue of passwords. Many people have heard of the pass the hash attack where an attacker steals the local password hash from a machine and then replays it into the system’s memory whenever they want to authenticate as that user. This attack is certainly possible when users have local administrator rights. But wouldn’t it be easier if the user could just steal passwords out of memory in clear text instead? Well it turns out that’s possible too. Enter Mimikatz.


For a nice long, technical explanation of how Mimikatz works, there are plenty of nice tutorials (although to be fair many of them are in French). But here’s the bottom line, if your users are local administrators on their Windows machine, then they will by default have the user right assignment of “Debug Programs” (or they can assign themselves this right if it is taken away by a security policy). Once they have this right they have the ability to interact with sensitive portions of memory, such as those where authentication credentials are stored. With that information they are able to read authentication credentials out of memory.


Not only are we able to read the NTLM password hash out of memory – which could be taken offline and cracked or used in a pass the hash attach, but we are given the passwords for every logged in user in plain text. Even in the above example where the user is utilizing upper case, lower case, numbers, and special characters and a long password, there is no need for the time or computing resources to crack the password because it is there in clear text.


Many people might wonder at this point, is this only in older versions of Windows? Unfortunately the answer is no. Version 1.0 of Mimikatz works all the way through Windows 8 systems (although Windows 8.1 does appear to be safe). Version 2.0 of Mimikatz works even with Windows 8.1 systems to manipulate this type of information. And if you were wondering, yes, there is integration between Mimikatz and the Metasploit framework to make your penetration testing efforts easier. And, just because, there is also a plugin for Mimikatz for Volatility if you’d like to play with this tool with offline forensic memory dumps.


So once again, let’s restate the issue. How bad is it if end users have local administrator rights on their Windows machines?  It’s BAD, REALLY BAD!! Both the Australians DSD in their Top 35 Mitigation Strategies document and the Council on CyberSecurity in their Critical Security Controls document list this issue as a serious concern. Hopefully we can all make sure to keep this issue in mind as we defend our systems.

Vulnerability Assessments vs Penetration Testing

There are many instances where I have had discussions with an organization asking about the difference between a Vulnerability Assessment and a Penetration Test. So I thought I would take a shot at identifying the differences between the two types of testing.

Vulnerability Assessment is the process of identifying vulnerabilities on a network using a series of automated tools that scan the network for known weaknesses. A penetration test is focused on actually exploiting those weaknesses to gain unauthorized access to the tested systems or data (as directed by the client). A vulnerability assessment provides an overview of the flaws that exist on the system while a penetration test goes on to provide an impact analysis of the flaws, and identifies the possible impact of those flaws on the underlying network, operating systems, databases etc.

Vulnerability Assessments use scanners to identify vulnerabilities that are known to report a great amount of false positives. In Penetration testing, there is human intervention to exploit vulnerabilities, thus eliminating false positives. Vulnerability Assessments are more of a passive process. In vulnerability assessment you use software tools that analyze both network traffic and systems to identify any exposures that increase vulnerability to attacks. Penetration testing is an active practice wherein ethical hackers are employed to simulate an attack and test the network and systems’ resistance.

Vulnerability assessments deal with potential risks, whereas penetration testing is actual proof of concept. Vulnerability assessments are just a process of identifying and quantifying the security vulnerabilities in a system. Vulnerability assessments do not provide validation of security vulnerabilities. Validation can be only done by conducting a penetration test.

The scope of a Penetration Testing can vary from a Vulnerability Analysis, to fully exploiting the targets, to destructive testing. Penetration Testing consists of a Vulnerability Analysis, but it goes one step ahead where in you will be evaluating the security of the system by simulating an attack usually done by a malicious hacker. For instances, a Vulnerability Assessment exercise might identify absence of anti-virus software on a system or open ports as a vulnerability. However, a penetration test will determine the level to which existing vulnerabilities can be exploited, and the damage that can be inflicted due to this.

A vulnerability assessment answers the question: “What are the present vulnerabilities and how do we fix them?” Penetration testing simply answers the questions: “Can any external attacker or internal intruder break-in, and what can they attain?”

 

Top tips for educating employees about Cybersecurity

1. Educate your employees and regularly talk to them, explaining the potential impact a cyber-incident may have on your operations. Employees need to know their obligations, especially when it comes to mobile data. It's not enough to require an annual review and signing of an "I have read and understand company IT policies" statement.
    
2. Remember top management and IT staff. Top managers are often the target of cyber criminals because of their higher level of access to critical corporate and customer data. This increased access has a much bigger damage/financial payoff for the hackers. IT staff are also more vulnerable, given their administrative access over the network.
    
3. The weakest link - Any network is only as strong as its weakest link. Explain to employees that while your organization is making its best effort to secure the company's infrastructure, it's critical that employees fully engage and do their part in following company policies. Policies should be sophisticated enough to cover all possible attack vectors.
    
4. Social engineering - Warn employees to pay special attention to social engineering ploys they will find in social media, blogs and emails. It's also important to point out that many cyber incidents begin with a phone call from someone posing as a co-worker asking seemingly innocuous questions. Meanwhile, they are actually gathering information about the company and its operations.
    
5. Recognizing an attack - Train employees to recognize an attack. It's critical that organizations have policies in place that assume they'll be infiltrated. Don't wait to react. Have a documented remediation plan in place and update or review it frequently. Communicate step-by-step instructions about what employees should do if they believe they've witnessed a cyber-incident.
    
   Training should include specific rules for email, web browsing, mobile devices and social networks. Don't forget the basics, such as physically unplugging the machine from the network and notifying the admin of any suspicious emails, activity or lost devices. Kaspersky suggests that employees should be able to locate their emergency IT contact number in 20 seconds or less.
    
6. Notifications - If an incident happens, give employees a heads-up as soon as possible. A lack of transparency or improper handling of a cyber-incident may significantly increase the impact of the event. Issue instructions to employees about how to speak to the public and the press about the incident. Have an internal communications plan and PR strategy in place before anything happens. Consider insurance for cyber incidents.
    
7. Regularly test employees - Organizations should regularly test their employees' cybersecurity knowledge and tie the results back into the training curriculum. It's important to make it fun and/or rewarding, with incentives for prompt responses

Healthcare will see a substantial increase of data stealing attacks

According to the Identity Theft Resource Center, healthcare data accounted for 43 percent of major data breaches reported in 20131. Medical records and patient data are logical targets for cybercriminals. Healthcare records hold a treasure trove of data that is valuable to an attacker. No other single type of record contains as much Personally Identifiable Information (PII) that can be used in a multitude of different follow-up attacks and various types of fraud.

Healthcare records not only contain vital information on the identity of an individual (name, address, social security) but also often link to financial and insurance information. Access to PII allows an attacker to commit identity fraud, while the financial information can lead to financial exploitation. This is a logical and profitable secondary attack area for cybercriminals who have already dealt in stolen credit card data.

Healthcare professionals are also at risk. Often, they have an increased tendency to try and get around IT security policies in order to better serve their patients. In a medical emergency, the stakes couldn’t be higher. When a doctor or nurse needs access to computing resources or data because a patient’s health is at risk, IT policy takes a back seat to the patient’s health. In the heat of the moment, such behavior can lead to increased risk to cyber threats or insecure access and storage of sensitive information.

This is also occurring in a healthcare environment that is still undergoing a transformation to digital and electronic records. While there has been a huge political push to move to electronic health care records, hospital and medical care security (especially in smaller offices) has not yet caught up to the challenge of protecting this valuable patient data. As a result, targeted cyber-attacks against healthcare organizations.                   

Will continue their rapid rise in frequency and success.

3 Persistent Security Myths

I have this Friend, and you probably know someone like this too—the one that is always sending forwards even though you asked them to stop 10 years ago, and even though you’ve told them that forwarded messages can present safety risks online.
Besides the fact that netiquette has been well established and widely understood for years, and these friends (or relatives) are being impolite by spamming you, the more important fact is the messages also present a security risk, for individuals as well as organizations.
After the most recent forwarded link, I mentioned to my Friend that I hoped she had good security software. Her response: “My friend sent this to me. It’s a valid clip/link and virus free.”
And I just had to shake my head at the security fallacies in those brief statements. I hate to be the smart-ass of the family who tries to lecture or educate the less tech-savvy, but I also don’t want to see my relatives fall victim to dumb social engineering scams. Now, this particular link probably was virus-free and safe enough, but when someone continually sends links and forwards, I start to worry they don’t know how to stay safe online.
So, what’s a conscientious security professional or blogger to do?
I’d love to hear your approaches and comments on this topic. For now, I’m going to try breaking down the myths that seem to persist, and see if I can think of a way to quietly explain the issue.


1. “My friend sent this to me.”
Of course you trust your friend, but that doesn’t make it safe to always trust the links they send out. First, the link could contain a virus or malware that your friend doesn’t know about either. Say your friend’s coming down with a cold, but doesn’t know it yet. You both share a drink at a café—two days later, you both get sick because your friend passed the cold on to you. Same idea.
In computers, it’s even more dangerous, because you may never know you’re sick. Spyware, for example, is designed to watch what you do and send information to the hackers about your online behavior, or even about your passwords. Malware can install itself on your computer without your even knowing. Many people get infected with software that forms a network with other computers, called a botnet. When the hacker contacts all those computers, they can be activated and do whatever he wants—like send messages from your computer to your friends.
These hackers don’t want your or friends to know you’ve been hacked. Your computer might just slow down a few hours a day…because it’s being used secretly by someone else. They can change your security settings, see your passwords, or even corrupt your files and shut down your computer without your permission.
If your password information is stolen, hackers can access your accounts and send forwarded links and emails to your friends without your even knowing. Those messages can contain more malware that installs on your friends’ computers, or spreads through your accounts.
Of course we trust our friends. But that doesn’t mean that our friends won’t have problems online, or that they won’t get infected.


2. “It’s a valid clip/link.”
Images, documents, and all sorts of valid files are used to send viruses and malware to users. The most popular are PDFs and Microsoft Office documents lately, but picture and video files can also be suspect—and for many years it was images most of all that were most dangerous. The link might contain something useful, entertaining, or even work-related. Just because the link works and does what you expect it to, doesn’t mean that it’s safe. It could also contain other problematic files– while you’re being entertained or even learning a fun factoid, something bad might be happening in the background…


3. “And it’s virus-free.”
Again, just because it works and your friend sent it, you can’t assume it’s virus free.
First, did you scan it for viruses? If your scanner says it’s virus-free, how well do you trust your scanner? Many well known and popular anti-virus programs, even if they’re mostly reliable, can’t pick up every infection. Additionally, viruses aren’t the only problems you have to worry about online.
Everyone—hey, even MAC users—should get themselves a good anti-virus/malware program and check regularly for updates. But it’s also good to keep in mind that even the best program won’t always protect you. The best defense is being careful about what you click, and what the source is.

Third party / vendor management - due diligence standards

Third Party Due Diligence Standards

Things every organization should look at when conducting initial or annual due diligence on a vendor/client.

 

The third party’s controls must either meet or exceed the defined controls required by PCI and meet GLBA compliance.

 

The GLBA safeguard rule requires all financial institutions to have security plans in place to ensure the confidentiality and integrity of customer data. An Information Security Plan must make use of the following:

 

• Administrative safeguards, such as employee oversight and training;
• Physical safeguards, such as restricted access to hardware and disaster recovery plans;
• Technical safeguards, such as firewalls, encryption, access controls and secure computer networks.

 

Safeguards must be implemented in proportion to the scope of and risk to the institution and the information it handles. Furthermore, the safeguards rule requires that an employee oversees the development and coordination of security in the institution.

 

The following areas should be reviewed during the due diligence process.

 

Incident Response

Incident response is an organized approach to addressing and managing the aftermath of a security breach or attack (also known as an incident). The goal is to handle the situation in a way that limits damage and reduces recovery time and costs. An incident response plan includes a policy that defines, in specific terms, what constitutes an incident and provides a process that should be followed when an incident occurs.

 

• The incident response document should include the following:
• Define an incident response team with assigned roles and responsibilities
• Categorize or identify what types of detected activities require incidence response
• Define incident response investigation and validation requirements. For example all administrative and/or privileged activities must be logged including date, time, activity performed and any suspect information identified.
• Define evidence gathering and handling techniques that will be used as part of the response activity
• Define a containment strategy and who has the authority to make critical or business impacting decisions when a breach occurred. Time is critical waiting for executive approval could be costly.
• Define requirements for who must be contacted, and within what time period should that contact occur when reporting a compromise or breach.
• Include requirements to use an association approved forensics vendor listed or referenced within the document
• Reference the creation of a formal incident report. Include historical tracking, training and lessons learned.
• Include a schedule for the plan to be practiced and reviewed.
• Assign responsibility for creating and distributing security incident response and escalation procedures.

 

Information Security

A security policy is a document that states in writing how your organization protects the company’s physical and logical information technology assets. A security policy is often considered to be a “living document”, meaning that the document is never finished but is continuously updated as technology and employee requirements change. A company’s security policy may include an acceptable use policy, a description of how the company plans to educate its employees about protecting the company’s assets, an explanation of how security measurements will be carried out and enforced, a procedure for evaluating the effectiveness of the security policy, and steps taken to ensure that necessary corrections will be made.

 

The Information Security Policy should include the following:

• Define access controls for device management (routers, firewalls and switches)
• Define roles and responsibilities
• Define the process followed for user creation and modifications
• Define the process for removing/disabling user accounts immediately upon termination
• Define the requirements that all employees and contractors sign an acceptable use policy
• Define the requirements that all employees and contractors sign non-disclosure agreements regarding confidential information
• Define server hardening procedures
• Define system patching procedures and schedules
• Define logging requirements for all critical systems as well as review retention requirements
• Define authentication requirements
• Define a formal access approval process
• Define the requirements that criminal background checks are performed on employees
• Define the frequency for penetration tests and location of documented results
• Define anti-virus standards including actions to be taken when a virus is detected
• Define the risk management program
• Categorize data based on sensitivity
• Define due diligence preformed on third parties
• Define data encryption requirements
• Define encryption key management requirements
• Define remote access procedures
• Define a log and  firewall review schedule
• Define automated alerts on security, logging and monitoring systems
• Define security awareness training is performed annually
• Define data retention and destruction procedures
• Define how visitors are identified and logged
• Define data center environmental controls
• Define how facility entry points are secured including the use of cameras to monitor sensitive areas, a definition of the retention plan for these videos
• Is wireless being utilized, define strong authentication and encryption that is in place for mobile devices
• Define the process for the inventory and review for all computer equipment maintained

Business Continuity

Business continuity describes the processes and procedures an organization has in place to ensure that essential functions will continue during and after a disaster. Business contingency planning seeks to prevent interruption of mission-critical services and to recover as swiftly and smoothly as possible. A document review and update should occur at least annually or as systems are modified and/or enhanced.

 

• The business continuity plan should include the following:
• Include a risk analysis or reference to  risk assessment in the document
• Include a Business Impact Analysis in the document
• Define redundant processes that are in place to continue business
• Define roles for all crisis management team members
• Define cross-training in the plan
• Define the BC/DR testing, including the frequency of the test (at least annually) and make sure the results are documented
• Define communication responsibilities for clients and staff
• Document the locations covered by the plan, including data center locations
• Document that backup recovery testing occurs annually

 

Change Control

Change control is a formal process used to ensure that changes to a product or system are introduced in a controlled and coordinated manner. It reduces the possibility that unnecessary changes will be introduced to a system without forethought, introducing faults into a system or undoing changes made by other users or software. The goals of a change control procedure usually include minimal disruption of services, reduction in back-out activities, and cost-effective utilization of resources involved in implementing change.

 

• The change control procedure should include the following:
• Define how infrastructure and software changes are documented and formally approved
• Define the user acceptance testing process
• Define how changes are tested in a separate user acceptance testing (UAT) environment prior to implementing into production
• Define documented back out procedures required for changes
• Define segregation of duties
• Define change release cycles
• Define the process for emergency changes

 

Risk Assessments

An effective risk management process is an important component of a successful IT security program. The principal goal of an organization’s risk management process should be to protect the organization and its ability to perform their mission, not just its IT assets. Therefore, the risk management process should not be treated primarily as a technical function carried out by the IT experts who operate and manage IT systems, but as an essential management function of the organization.

 

Risk assessments are an important part of assessing your organizations controls and overall security.

 

The risk assessment should include the following:

• Clearly defined process for accessing and scoring the threat likelihood, business impact, controls in place and residual risk of effectiveness of the control.  If the residual risk score exceeds the defined acceptable risk level a plan for remediation including proposed additional controls needed should be included.
• Assessments should include all methods of handling customer information including;
  • Access, Collections, Storage, Use, Transmission and Disposal

 

Following publications can be used to assist in the development of the program.

http://csrc.nist.org/publications/nistpubs/800-30/sp800-30.pdf

http://www.gao.gov/special.pubs/ai99139.pdf

 

CVV/PIN Generation Policy (Processors only)

Section 3.2 of the PCI DSS standards spells out specific requirements for CVV and PIN generation. CVV and PIN are some of the items that cannot be stored and must always be generated. The CVV/PIN generation policy should include:

• Describe the equipment and methodologies used to ensure PINs are kept secure
• Define the key creation and key management procedures
• Define how are keys conveyed and/or transmitted
• Define the process used to administer keys
• Define the process used for key loading to hosts and PIN entry devices
• Define how unauthorized key usage is prevented or detected
• Define the manner in which equipment used to process PINs are keys are managed
• Define key storage and management procedures
• Define if PINs or CVV/CVV2s are stored anywhere on the network and how we detect if they were or ensure they are not in the future

 

SSAE16

The following information and controls should be included in this document.

• An Information Security Policy exists and has been approved by an appropriate level of executive management
• Procedures exist and are followed to authenticate all users of a system (both internal and external) to support the existence of transactions
• Procedures exist and are followed relating to the timely action of requesting, establishing and issuing user accounts
• Procedures exist and are followed relating to the timely action of suspending and/or changing user accounts
• A control process exists and is followed to periodically review and confirm access rights
• IT security staff monitors and logs security activity at the operating system, application and database levels and identified security violations are reported to senior management
• Access to facilities is restricted to authorized personnel and requires appropriate identification and authorization.
• Request for program changes, system changes and maintenance (including changes to system software) are standardized, logged, approved and documented and subject to formal change management procedures
• Emergency change requests are documented and subject to formal change management procedures
• Controls are in place to restrict migration of programs to production by authorized individuals only
• The organization has a system development life cycle (SDLC) methodology, which includes security and processing integrity requirements for the organization.
• Post-implementation reviews are performed to verify controls are operating effectively
• A testing strategy is developed and followed for all significant changes in applications
• The organization has policies and procedures regarding computer operations which is periodically reviewed, updated and approved by management
• Management protects sensitive information – logically and physically, in storage and during transmission – against unauthorized access or modification
• Management has implemented a strategy for critical backup of data and programs
• The restoration of information is periodically tested