Slack Is Becoming The Dominant IM Tool - But It Is Not The Safest To Use

 

As I was out walking last night to take a break from looking at my computer screen, I had a rather long conversation with a neighbor of mine.  We talked about what we do for a living, and he said that actually does the geometrical layouts for the railroad tracks here on the UP-W in the western burbs of Chicago.  Naturally, my ears perked up . . . math? 

I’ve got to hear about this.  He said that there was really nothing that you had to understand about geometry to do his job, as he said everything was done on the computer.  But still I said, you have to have some background.

So the conversation went about as to what I did, and after that, we brought out a book that we has reading, which was all about the Web 3.0 and the metaverse.  I told him that it was amazing how far we have come in terms of technology, and what more is yet to come. 

Then I posed to him this question:  How did we do it in the 80’s and 90’s when there was no Google or wireless devices?  He gave out a very candid answer:  We were forced talk to each other face to face, and communicate that way.

That statement got me really pondering, and kept me up for the good part of the night.  Really, how did we do it?  What was the first form of digital communications that we used?  I remember getting my first cell phone back in 2001, but the first true digital communications I have ever used was Yahoo Messenger. 

I used it for a very long time, as well as my other geek friends, until Yahoo discontinued it a few years ago.

Why they ever did that, I don’t know.  It was really a great tool, albeit clunky.  Well, since then, hundreds of other Instant Messaging (IM) tools have propped up, of many now come bundled with Zoom, Microsoft Teams, Web Ex, etc.  The only standalone IM tool that I now of which is available is what is called “Slack”.  I used that for brief stint I had as a Proposal Writer.

My first impressions of it were that it was rather cumbersome to set up and use at first, but when I was forced to use it (as you can tell, I am not a lover of technology) it seemed to OK.  I really saw no difference from it as opposed to Yahoo Messenger, but it came with a lot of bells and whistles.  Honestly, I would much rather use the IM chat agent in Teams than Slack.

But one thing I did not realize, which was until today.  While many IM platforms are built off proprietary technology, Slack has actually been created using an Open-Source platform.  While this is a good thing, it can  also be a bad thing as well, because now the Cyberattacker has a much easier way to get in. 

Although I am unaware of any large-scale attack against Slack, the following are some examples of what could possibly happen:

*It is quite easy to send spoofed messages to lure in unsuspecting on the receiving side (other IM platforms that I know of at least send you some kind of alert if a message looks suspicious in nature).

*It has a ton of public channels that go unmonitored, this is also a wide-open terrain to penetrate into.

*Slack allows you to create your own customized apps to meet your IM requirements. But the problem here is that you have to use their APIs, which are largely open sourced.  Therefore, nobody has really checked if the source code is secure, or even upgraded with the latest patches and upgrades.  This can trigger yet another large-scale supply chain attack, perhaps even greater than that of Solar Winds.

*The log files that are kept can only be accessed by the owner of the account.  The IT Security team at Slack has no access to this (which is really surprising), and once any conversations are deleted, they are gone forever (though there is a way to get them – nothing is ever truly deleted in the digital world).

*Many of the other forms of authentication and authorization (such as MFA) are only available in their Pro plan and on up.

So now, this comes to the question:  Given these flaws of Slack, should you not use it anymore, and use something else like Zoom or Teams.  Ultimately in the end, the decision is yours and what will work best for your team in the end.  But if you do continue to use Slack, keep this pointers in mind:

1)     Clearly define the public and private channels:

For example, if you have to have a proprietary meeting with your software development team, then the choice is obvious:  Use a private channel. Make use that this channel is using an SSL means of Internet connection, and only restrict your meetings to those who have exclusively been invited.  Any body else should be booted out, without question.  Also, any sensitive material should be shared on a private channel, not on a public one.

2)     Keep apps down:

Yes, apps make our lives a lot easier (or at least we like to think that they do), but given the open-source nature of Slack, keep your app development for usage of it to the barest minimum possible.  If you have to create any apps using Slack APIs, make sure you test the final product in a sandbox environment, and that APIs used have been upgraded with the latest patches.

3)     Backup, Backup, Backup:

This is probably one of the oldest mantras spoken in the world of Cyber, but it is so true. Backup everything, most especially those conversations that you are having.  In this regard, consider using full, incremental, and differential backups.

4)     Allow additional layers of security:

 

This means that you are going to have get a paid plan.  When you get this, you can then throw the additional layers of security, most notably that of encryption.  But keep in mind that at first glance, the pricing for Slack seems to be very reasonable, which can be seen at the link below:

 

https://slack.com/pricing

My Thoughts On This:

I forgot to mention this earlier in this blog, I also use another chat mechanism, when ever I have to communicate with my ISP for any issues.  I am forced to here, as that is the only, they will communicate (other than Email).  I look at this way:  If you are going to spend 30 minutes on Slack, why not just simply call the person on the phone and go over what you need to with them?

But then again, I am very old fashioned in my ways . . . .

Are We Pushing It To The Societal Limits With Edge Computing? 5 Realisms To Consider

 

Whenever you open up an account on either the AWS or Microsoft Azure, you get a whole, wide world open to you that were once thought to be unfathomable.  In fact, I was just talking about this with an old professor of mine last night. 

I did my thesis with him when I was doing my MBA, and back then Windows NT and Netscape were some of the biggest technology platforms out there.  I asked him point blank:  Did we ever think that technology would evolve to the point where it has today?

Of course, his answer was no, as mine would be as well. Back then, creating an Oracle database On Premises would have easily cost around $30k.  Not to mention that their licensing was almost impossible to understand.  But now, with just a few clicks of a mouse, and five minutes, you can create a hosted Oracle Enterprise Database server for just around $70.00 a month or so.

Now with these Cloud juggernauts, you can access shared resources and datasets whenever and wherever you may be at the world.  Heck, you can even create your own Virtual Datacenter and have that stored across different regions in the world as well. 

But as all of this advancing is forward, so do our needs and wants.  In other words, we can’t be happy with what we have, we always want more and more, which is simply human nature.

A perfect example of this is what is known as “Edge Computing”.  There is no doubt that the AWS and Azure can handle gargantuan amounts of data (we are talking about Petabytes here), and they are very quick in processing.  But now, we want this to happen even faster. 

The basic premise behind Edge Computing is that the Virtual Machine (VM) that stores and processes your data will actually be closer to the sources of data that is being fed into it.

The idea with this is that the transaction times for your data queries will be even faster, and you will get what you need even quicker as well.  The concept sounds relatively simple, but it can be complex to deploy, given whatever your requirements are.  The technology to do all of this is still relatively new, so along with that, comes the security risks.

I came across an article that actually addresses these fears, so I wanted to share that along, in case your company has either implemented it, is planning to do so.  Here we go:

1)     Malicious payloads can be inserted easier:

Web applications have always been a favored target for the Cyberattacker, especially when it comes to the backend, primarily the database.  From here, the hacker can then inject and launch SQL Injection Attacks, in an effort to capture the PII datasets that are stored in them.

2)     The attack surface is increased:

This line of thinking is normally associated with IoT devices, because as you add more devices, the interconnectivity grows even more.  Although with Edge computing the gap between the VM and the data feed has actually become narrower, in some respects, it has also been widened as well.  This also makes it just as vulnerable to Cyberattacks, if not more than with IoT devices.

3)     Routing Attacks could increase:

When the data source is close to the server which is processing it, this makes it even mor tempting for the Cyberattacker to try to conquer.  The primary case for this is that many businesses still neglect to fortify their endpoints even in the most traditional of deployment models, so the chances are even greater of unprotected endpoints with Edge Computing.  Not only will it be easier to capture the PII datasets, but there are even greater probabilities that further tampering with the network flow of communications will occur due to the close proximity of the data source to the VM.

4)     DDoS attacks will still occur:

This is an acronym that stands for “Distributed Denial of Service”.  This is where a server is bombarded with malformed data packets and web requests where it totally drains it of its processing power, and the server crashes as a result.  These are probably some of the oldest threat variants in the book, but they are still widely used by the Cyberattacker in different flavors. But once again, by having the data source so close to the VM, it will be far easier to launch these kinds of attacks, but in a rapid-fire succession.

My Thoughts On This:

So now you might be asking, how can you mitigate the chances of happening to you?  Well actually, there is some good news here, believe it or not.  If you have a Cloud based deployment in which you plan to deploy Edge Computing, your provider will already have a great set of tools that you can use. 

I know may be sounding a little biased here, but my hats go off to Microsoft Azure in this regard.  Although the number of security tools they have in stock may overwhelm at you first, they are quick to install and will keep an eye on your Edge Computing setup on a daily, real-time basis. 

But you should probably consult with a Cloud Services Provider first to make sure that you are planning to use the right tools.

Second, follow an established frameworks available from the Cloud Security Alliance (CSA), the Cybersecurity and Infrastructure Security Agency (CISA), and the National Institute of Standards and Technology (NIST). 

This will help you set up the right set of controls that you need in order to come into compliance with the data privacy laws of the CCPA, GDPR, HIPAA, etc., as it relates to Edge Computing.  The very last thing you want is to face an audit and steep financial penalties.

But now all of this comes to an interesting question:  As a digital society, are we moving way too fast?  Yes, and I will be blunt, I think we are moving too fast.  We need some time to settle down, especially with what we have been through the last two years with COVID-19 and the emergence of the permanent Remote Workforce. 

Really in the end, does getting answers to data queries a few seconds faster really mean anything in the end by using Edge Computing?  Not, it does not. As long as we can access it safely and securely within a reasonable quick timeframe is all that should matter.  We are now even pushing it with the adoption of the Metaverse. 

Is it really needed now?  No it is not.  Let us take some time, slow down, and enjoy the great stuff in technological advancements that we have right now before rushing off to find the new, next great thing.

What Is Predicted For The Second Half Of 2022? More Supply Chain Attacks

 

Well, here we are now in the first full weekend in June.  Finally summer is here, and it feels great.  But with the way the time is going, soon we will be complaining about winter approaching.  On the Cyber front, things are moving quickly, but believe it or not, so far, we have not yet had the major catastrophes that were feared after Russia invaded the Ukraine.

But we still have half of the year to go, so anything is still possible.  But as I go through the news headlines, this fear seems to be diminishing somewhat.  In fact, there are articles even out there now that discuss why Russia has not launched a major Cyberattack yet.  More to come about that in future blogs.

I think as I mentioned last week, and on a couple of podcasts I have had recently, the attention is still on Ransomware and whether or not a payment should be made to the Cyberattackers that launch these kinds of assaults.  But, another hot button topic that is reemerging yet once again is that of Cybersecurity Insurance. 

A lot of businesses now seem to be concerned about this, especially with regards that it is more difficult now then ever before to procure a rock-solid insurance policy.  A business owner now has to go through a whole rung of compliance checks and even fill out a self-assessment before their particular is even looked at.  I know this for a fact, as I have seen some of them.  Yes, they are detailed, and take time to go through.

Another topic that has seemed to resurface again is that of supply chain attacks.  I actually have reviewed what this is in previous articles, and in a few podcasts.  But to refresh, rewind back to some time ago.  Remember the entire Solar Winds fiasco?  Well, for lack of a better term, this is a prime example of such an attack. 

Essentially, the Cyberattackers were able to find a small hole in the IT/Network Infrastructure, and at that point, they were able to install their malicious payload.

Once the victims downloaded the needed software patches, their devices and other systems became infected with this malware.  But we are not talking about just a few victims, we are talking about literally thousands of them.  But what is unique about the supply chain attack is that it is not what you would call a one to one (1:1) attack, but rather, a one to many (1:N).  In fact, this is the trend that we will now be seeing as these kinds of attacks happen even more.

In the mind of the Cyberattacker, why waste valuable time just hitting one target, when you can hit a lot more, especially all at the same time?  But keep in mind, the key is finding that vulnerable weak spot.  But there are other reasons for this, and these include some of the following:

*Supply chain attacks allow the Cyberattacker to reap a quicker payoff in terms of financial gain, because so many victims are involved.  And of course, the more of there are, the quicker the ROI will be.  Don’t forget the press attention that this well get.  Remember, Cyberattackers are humans also.  Once they get the attention in the press, they get a high on their ego (for all of the wrong reasons of course), and are thus motivated to launch more attacks.

*Web based applications are becoming the norm today in the Remote Workforce environment.  Because of this huge uptick, software developers are even more pressure to deliver on time.  Because of this, checking for the security of the source code often falls to the wayside. Worst yet, many developers are now heavily relying upon source APIs to develop web applications, and these often go untested or unchecked.

*After COVID-19 hit and the Remote Workforce now being a permanent thing, many businesses have moved entirely into the Cloud, such as the AWS or Microsoft Azure.  But, one thing that gets overlooked is that many enterprises choose a Public or Hybrid deployment, which means that the Cloud resources are shared.  Although technically speaking everybody has their own server instance, things are still shared.  So a vulnerability that exists in one tenant could spill into your environment, thus making a valuable point of entry for the Cyberattacker to penetrate into.

So given all of this, what can you do so that you can mitigate the risks of being a point of delivery for a supply chain attack?  Here are some tips:

1)     Check all assets:

Normally this is done when you conduct a Risk Assessment in order to determine which of your digital assets are the most vulnerable to a Cyberattack.  However, this gets trickier of you are totally based in the Cloud.  For example, you don’t know what could be inserted into your platform.  For example, your provider could have put in a something you are not aware about, or even an employee could have unintentionally deployed something also.  Therefore, you need to keep a 100% of what is coming and going in your Cloud deployment on a 24 X 7 X 365 basis.  Of course, doing this manually would take forever, but technology has now come to the point where this can be done automatically for you.  Or, ask your Cloud provider if such tools are available, and if they can set up a system of warnings and alerts as new things pop up in your Cloud environment.

2)     Keep watching and keep assessing:

Apart from monitoring of what is going in and coming out, you need to keep a constant eye also of what still remains vulnerable.  You can do this by conducting automated Vulnerability Assessments and Penetration Testing exercises of your Cloud environment.  On top of this, you need to keep on top of what is still vulnerable in the way of your digital assets.  In this regard, you make use of what is known as a “SIEM” to give you a bird’s eye view of just what is happening in your Cloud infrastructure, from just one, single dashboard. In this area, I do have to recommend that you make full use of Microsoft Azure. They have great tools that you can use at no extra charge to help you do all of this.

3)     Have an Incident Response (IR) Plan in place:

Even  after you have taken all of the preventative measures, there is still no guarantee that you will not become a victim. In this case, you need to have a rock-solid IR Plan in place that will dictate the sequence of activities that you need to follow immediately to mitigate the risk of spreading even further.  This plan should be rehearsed at least once a quarter, and updates made to the documentation with lessons learned.  There are many templates that are available online that you can use for this very purpose.

My Thoughts On This:

According to the latest from Gartner, supply chain attacks will among in the top 10 for Cyberattacks, and up to 60% of security breaches will happen in this fashion.  More information about these stats can be seen in the following links:

https://www.gartner.com/en/newsroom/press-releases/2022-03-07-gartner-identifies-top-security-and-risk-management-trends-for-2022

https://www.cyberpion.com/blog/types-of-supply-chain-attacks/

But going forward into the second half of 2022, you may not see another Solar Winds attack.  Rather, it is anticipated that the Cyberattacker will launch much smaller scale ones simultaneously, in order to cause more damage without being noticed too quickly.

Introducing The Verizon 2022 DBIR Report: Cyber Trends You Must Know About

 

It is about this time of the year that many of the much larger Cyber vendors start to publish their reports as to what transpired on the Cyber threat landscape.  Some of these include IBM, Malware Bytes, etc.  Of course, there those other vendors that come out with their own periodically, and if there is one that relates to a blog posting that I am writing on, I usually cite it there. 

One such vendor that comes out regularly is Verizon.  One may often think of them as the wireless business, but they are also strong in the Cyber area as well, and their reports are fairly exhaustive in nature.  So without much ado, I now introduce to you the “2022 Data Breach Investigations Report, once again, made available from Verizon.

Interestingly enough, Verizon did not poll any respondents in any particular survey, but rather, they looked at the total number of security breaches that occurred in 2021, and from there, formulated a number of hypotheses. 

So for this project, there were a total of 23,896 security incidents which were studied, and from that 5,212 were actual data breaches. From here, these incidents and breaches were divided into eight distinct groups, which are as follows:

*Web application attacks: 

As the name implies, these are attacks against Web based apps, no matter what they may be.

*DoS/DDoS attacks: 

This is the where the server is flooded with malformed data packets, causing to almost shut down.

*Lost/stolen assets: 

These are both the digital and physical assets that have either lost or stolen.

*Miscellaneous errors: 

These are the unintentional mistakes caused most likely by employees.

*Privilege misuse: 

This is the unapproved escalation of privileges, rights, and permissions.

*Social engineering: 

This is when an individual or employee is tricked into giving out confidential information and/or data points.

*System intrusion: 

These are pretty much the Malware based attacks.

*Everything else: 

This includes any other threat vectors that do not fit in any of the above categories.

These can be seen in the illustration below:

(SOURCE:  https://www.darkreading.com/edge-threat-monitor/most-common-threats-in-dbir)

From the above, the top two security threat vectors were that of Web applications, and Social Engineering, which is not surprising.  This can be seen in the diagram below:

(SOURCE:  https://www.darkreading.com/edge-threat-monitor/most-common-threats-in-dbir)

Here are some of the other key findings from the Verizon Report:

*Systems intrusions are probably amongst the most difficult to detect, because there are so many different avenues that the Cyber attacker can get in and stay for a very period of time going unnoticed.  This is why the average time to detect a security breach is 300 days.

*One key reason for the increase in in the system intrusion attacks is the sheer rise in the total number of supply chain attacks that are happening as well, such as the Solar Winds example, in which over 1,000+ victims were impacted through one single point of failure.  It is through here that the Cyberattacker was able to deploy their malicious payloads.

*In these kind of attacks, there has been a drastic rise in the number of command-and-control VMs that are being used, in an attempt to avoid being tracked down.

*For systems intrusion attacks, the most commonly used threat vectors are as follows:

Ø  Third party software;

Ø  Software updates and patches;

Ø  Desktop sharing software packages;

Ø  E-mail, primarily that of Phishing.

*With regards to the Web based application attacks, the use of backdoors, remote injection techniques, and the use of desktop sharing software to compromise the hosted server were the most vectors that were used. 

*In terms of the most impacted victims, the breakdown is as follows:

Ø  For system intrusion:  Manufacturing.

Ø  For Web based apps:  Manufacturing and financial services;

Ø  For Social Engineering:  Retail and professional organizations (such as staffing firms).

Finally, the report stated that in 82% of the security breaches that were examined, the human element played a key role whether it was intentional or not.

My Thoughts On This:

Truthfully speaking, I have not read the entire Verizon report in detail, there are just some of the key findings that I picked up from it.  But whatever else it has mentioned, it is true that, IMHO Web based attacks and Social Engineering are going to be the norm of the future, going well into 2023.  This stems from two key areas: 

Insecure source code that is being used to create the Web application; and Cyberattackers are fully aware now that people’s minds are on protecting their digital assets.

Therefore, why not turn attention to what is called as the weakest link in the security chain, which is the human being?  Social engineering attacks work great here, especially for those people that are on the go and as a result, do not carefully think about what they are saying.  This is well exemplified by the retail sector, as the report has found.

But another key thing to keep in mind is that with systems intrusion, we will probably not see the likes of another Solar Winds for some time to come. Rather, as it has been forecasted, we will probably see much smaller scale ones happening, but the objective of the Cyberattacker here is to cause even more mass confusion for the IT Security teams that have to deal with them.

Finally, Phishing, probably the oldest of the threat variants will never go away.  It will be here for a long time yet to come, with more potent variations of it coming out. 

Finally, the Verizon Report can be downloaded at this link:

https://www.verizon.com/business/resources/reports/2022/dbir/2022-dbir-data-breach-investigations-report.pdf

I am eventually planning to make an eBook based on this, so stay tuned!!!

5 Point Checklist: How To Draft A Solid BYOD Security Policy

 

Looking back over the past two years, it’s hard to believe that COVID-19 pandemic happened.  When I first say the headlines, I thought it would pretty much stay confined to China.  But it did not, and it has impacted the world we never thought were possible, for the good and the bad. 

It was scary for those first few months, seeing the financial markets literally melt and everybody getting sick. 

Probably one of the biggest lessons learned from this whole thing is the Remote Workforce.  It seems like that everybody wants to work from WFH, and in fact, the people that I know of whom have received offers made WFH a condition of acceptance. 

But there is one common denominator with this, and that is remote workers (heck, really everybody for that matter) are now more glued than ever before in front of their smartphone.

In fact according to recent surveys, the following trends were discovered:

*Over 58% use their personal devices to do work related matters when they know it is against company policy to do so;

*84% of the businesses polled said that they have literally given up in trying to come with new strategies to keep employee’s personal devices protected. 

Given these trends, one could surmise that as long the Remote Workforce is here to stay, employees will continue to use their own devices to do their job. So what can, you the CISO, do to circumvent this from happening?  Unfortunately, there is not a lot, unless you want to enter your employee’s home and do all of the upgrades and patching to their personal device.

But we know that this will never happen.  So here are some tips:

1)     Force to have meetings on Zoom or Teams:

These two video conferencing platforms have come a long way since two years ago, especially Zoom with all of the security flaws that it had at the time.  In fact, I have started to use Teams a lot more now, and I am astonished as to all of the features it has with it.  For instance, you can dial directly to other coworkers, and even hold private chat sessions.  But back to the topic at hand, whenever there has to be a meeting, make your employees login through their laptop (or other company issued device).  If you discover that they have connected in through their personal device, kick them off and don’t let them log back in again until they have reconnected using the appropriate device.

2)     Try to make use of the Zero Trust Framework:

I have written about this before, so not much more to say.  From what I have been reading about in recent articles, some 80% of business entities are trying to adopt this framework.  Although there have been some setbacks, overall, it seems that there is some success coming out of it.  Heck, IMHO, it is far better to make use of at least three layers of authentication or more, that just one two, as the 2FA methodology prescribes.  Note that this kind framework is quite extreme, and you may not have all of the buy in from your employees.  But in the end, you the CISO have the ultimate responsibility for the protection of your digital assets.

3)     Implement the use of Mobile Device Management (MDM):

With this policy, you are making sure that each and every wireless device that is accessing the shared resources on your servers has been authenticated through the channels your have set forth.  If your employees are still insistent of using their own smartphone to reach such resources, then you have to tell them that their personal device has to be registered through the MDM tools and directives.  If not, then its plain and simple:  They won’t have access to shared resources.  It’s their choice.  In fact, many companies in Corporate America are adopting the MDM framework, and this market is expected to a high of almost $16 Billion by the year 2025.

4)     Make sure that only legitimate apps are downloaded:

This can be a dicey situation.  If you have given your employees a company issued device, then there is no worry about conducting random audits on them to make sure that only legit apps have been downloaded. But if an employee is using their own device, well then this becomes an issue of privacy rights violation.  I really don’t have a definite answer on this one, so it may be best to consult with your business attorney to see how you can go about doing this.

5)     Train your employees:

If you expect your employees to maintain good levels of Cyber Hygiene when it comes to using their personal devices for doing work related stuff, then you need to give them the ammunition to do so.  So in this regard, you need to be delivering at least on a quarterly basis security awareness training programs, with a focus on safe smartphone usage.  No need to keep these training programs hours on end, even just a simple 30 minute one will do.  Remember , you want your WFH employees to remember and apply what they have learned. In fact, this has been one of the key mantras of Cyber ever since COVID-19 hit.  But quite astonishingly, only 50% actually give any sort of formal training program for their employees, whether they are remote or not.  More information about this can be seen here at this link:

https://newblogtrustlook.files.wordpress.com/2016/10/trustlook_insights_q4_2016_byod.pdf

My Thoughts On This:

This concept of employees using their own smartphones to conduct work related matters is really nothing new, in fact I first wrote about this back in 2012.  It is called “Bring Your Own Device”, or “BYOD” for short.  In the end, given the work climate today, you want to keep your good employees by giving them certain freedoms that would not existed before.

But employees also need to come halfway in this regard, and allow some sort of safety scrutinization of their personal devices by you and your IT Security team, if they are going to use them for work related purposes.  Once again, I am not sure about the legal ramifications of this are, but I would say go ahead and try this policy the best you can.

The worst-case scenario your employee that does agree with this will probably just simply quit.  But of course, during this period of the so called “Great Resignation”, finding a new employee that is willing to abide by your security policies should not be too difficult either.

Healthcare Faces an Aggressive Threat Landscape - How To Remediate It With Node Zero

 

Hey Everybody,

Asd we approach the second half of the year, luckily we remain unscathed yet from a major Cyber breach from occurring. Of course, there are the usual ones that we hear about on a daily basis, but given the political situation with Russia and the Ukraine, there has always been a huge fear that something cataclysmic would happen, especially with our Critical Infrastructure.

But needless to say, there are certain market segments that keep getting pounded with security breaches, and one of them is the healthcare sector.  There is a huge risk here, especially since you are dealing with patient’s records.  If they are ever accessed, people with implanted medical devices are also at a graver risk, because they can be easily infiltrated into as well, putting their own lives at risk. 

What is one to do?

One  solution is  through Penetration Testing, in which all of the gaps and vulnerabilities can be discovered and remediated.  But on the flip side, conducting one can be quite expensive, in the range of at least $30,000.00.  As a result, many SMB healthcare organizations cannot afford this, especially if they need to keep up with compliance regulations (such as HIPAA), which require repeated Pen Tests to be done.

The Cybersecurity Industry is aware of this, and as a result, they have come out with automated tools that you use for your Pen Testing needs.  One such company is called Horizon3, and they have developed a completely autonomous tool called “Node Zero”. 

In this podcast, we have the honor and privilege of interviewing of Snehal Antani, the Co-Founder and the CEO.  He will do a deeper dive into this cutting-edge product, and so you will get to see for yourself how you can benefit from the “Node Zero”.

You can download the podcast at this link:

https://www.podbean.com/site/EpisodeDownload/PB12353C7S7E2D

Thinking Strategically Is Far More Valuable Than $$$ To Cyber Protect Your Town

 

Whenever we hear about Cybersecurity in the news, especially when it comes the government, it is always what happens in DC that comes our first in the news, and for that matter, gets the most attention.  For example, when Biden announced his Executive Order for Cybersecurity some time ago, everybody was all for it. 

But the verdict is still out if it all has come to any fruition or not yet.  Then there were I believe one or two more major ones that Biden signed off one, plus a plethora of others that the House has tried to introduce, but I don’t has gotten anywhere substantial yet.

But what about the local governments?  When do we hear about them?  Unfortunately we don’t really hear anything about them until some sort of disaster has impacted them.  For example, last year which was deemed to be the year of Ransomware, there were a bunch of cities and towns that were hit by such attacks. 

Some had their water supply choked off, there were attacks on their energy grids, and even IT/Network Infrastructures were infiltrated into.

Unfortunately, it is these local governments that are left hanging out on their own trying to figure what to do if they have been hit by a security breach.  Some have paid the ransom, and some have not (good for them, actually).  The Federal Government does seem to help out, and many of the Cyber vendors don’t offer too much help because there is not enough money to be made off of local government contracts.

So, what is a mayor to do to help their defend their town or city?  Here are some ideas:

1)     Try to get hold of a Cyber Vendor who can work with you:

Ok, this may sound like that I am going back against what I just earlier said, but there are Cyber Vendors that focus, or at least partially, on the local government sector.  These are not easy to find at first, but after enough digging and Google searching, you should be able to find a few vendors.  But just don’t take the first one that you meet, try to get some choices lined up.  After all, they have to meet your needs, and fit within your budget also.  After you have selected one, it is important that they stay with you for the long haul, and not bail out on you.  In this regard, try to get a long-term contract going.  Now, as the leader of your town or city, if you are completely new to Cyber (and there is nothing wrong with that), one of the best pieces I can offer to you is to first hire a vCJSO.  These are CISOs that have many years of experience in the field, but are now working on a contractual basis for fixed term projects. Having one on your staff even for a short term can be a big benefit, as they will most likely have the contacts to help you find that Cyber Vendor to work with you for the long haul.  But timing is of the essence here, as it Ransomware attacks on US local governments have reached a staggering cost of almost $19 Billion.

2)     Don’t be a miser:

For the most part, everybody knows that local governments all over the US are hard pressed for money, and are under constant pressure to keep watching their budgets.  In fact, the lack of money is an excuse that is often by used by mayors or other leaders, for totally ignoring Cybersecurity.  But don’t you make that kind of excuse either!!!  The moment you start doing that, you are setting up yourself for failure.  While you may not get all of the money you need, there is always some to be found somewhere.  For example, you can always have fund raisers, or if need me, set up a Go Fund Me account on Facebook.  Also, the Federal Government, while of course not doing a very good job at advertising it, has money set aside, believe it or not, for the local governments.  At the height of COVID-19, the American Rescue Plan was signed into law.  In it, there has been about $350 Billion allocated to the 50 states and their local governments.  Now it does not specifically dictate how that money should be spent once its allocated to a state, but that should give you more reason to spend more than you do for Cybersecurity.  In fact according to a recent study by Deloitte,  it has been discovered that spend only 1% - 2% of that money for Cyber related needs.  More about this report can be seen here at this link:

https://www2.deloitte.com/content/dam/insights/us/articles/6421_Ransoming-government/DI_Ransoming-government.pdf

Heck one study even found that at least 45% of Ransomware attacks are hit upon the local governments and their corresponding municipalities.  More on this can be seen at this link:

https://blog.barracuda.com/2020/08/27/threat-spotlight-ransomware/

In fact, don’t be afraid to even approach your local SBA offices.  Although there are designed to work SMBs, they can help local governments as well.

The moral of the story here is that while you may not get all of the money you need, there is availability at least for some of it.  You just have to be creative in finding them. And once you get some extra money in your wallet, think strategically as to how it will be spent for what Cyber purposes.  In other words, just don’t give a blank check to your IT Security Administrator, get the bare minimum that you need, and figure out the best optimal way to deploy those new gadgets.  Remember, two firewalls can be just as effective as having ten of them, provided that they used in the most optimal way.

3)     Conduct a Risk Assessment:

Once you have found a Cyber Vendor that you can work with, it is first very important that you conduct a Risk Assessment.  This simply means, on a general level, you are taking an inventory of all of your digital and physical assets, and ranking them on some sort of vulnerability scale.  Of course, those that are found to be the most vulnerable should receive the immediate attention of your IT department.  From there, you then need to figure out the controls you will need to put into place.  There are many frameworks out there that are available for free to help you do this.  For example, they include the ones from the CIS and NIST.  Follow these links to get more information on them:

https://www.cisecurity.org/controls/cis-controls-list

(FOR THE CIS)

https://www.nist.gov/cyberframework

(FOR NIST)

After this, the next step would be to conduct a deep dive Penetration Test, in order to discover any other gaps or weaknesses that have not been seen yet.  Then follow a path of security where eventually at some point you will be able to deploy the Zero Trust Framework.  This is where absolutely nobody is trusted.  Sound extreme?  Yes, it is, but has yielded some results to the businesses that have implemented this methodology.

My Thoughts On This:

Another line of thinking is to find out those resources that are freely available to the SMBs in your city or town.  I know there are a lot of them, especially when Trump signed into law this kind of allocation before he left office.  You don’t have to have deep pockets to adequately mitigate the Cyber risks that are posed to your city.  You just have to think strategically, especially when it comes to doing the Risk Assessment.

And to the Cyber Vendors:  Yes, we are all businesses and have to make money.  But Cybersecurity is also a team effort for everybody.  Forget the bottom line for a little and offer your services even pro bono to a local government for a small period of time. Doing so could yield you a lot of fruit in the end.