Cybersecurity Vs Database Engineering

What is the difference between Cybersecurity and Database engineering?

Cybersecurity specialists thinks 24 hours, and database engineer thinks end of every quarter.

The different between Information security, security resilience and cybersecurity

Here is a Venn diagram that shows the difference between Information Security, Security Resilience, and Cybersecurity.

       _____________
      /             \
     /   Cyber-    \
    |  security     |
     \_____________/
          |   |
          |   |
    _____________________
   |                     |
   |   Security Resilience |
   |_____________________|
          |   |
          |   |
     ___________________
    |                   |
    | Information Security |
    |___________________|
 

The diagram shows that Cybersecurity is a subset of Security Resilience, as Security Resilience encompasses not just Cybersecurity but also physical security, incident response planning, and business continuity planning. Similarly, Information Security is a subset of Security Resilience, as Security Resilience encompasses a broader set of security-related activities beyond just information security.

Is there a difference between information security and Cybersecurity ?

Yes, there is a difference between information security and cybersecurity, although the two terms are often used interchangeably.

Information security is a broader term that encompasses the protection of all forms of information, both digital and non-digital, from unauthorized access, use, disclosure, disruption, modification, or destruction. This includes physical security measures, such as locks and access controls, as well as technical and administrative controls, such as encryption and policies and procedures.

Cybersecurity, on the other hand, specifically refers to the protection of digital information and systems from cyber threats, such as cyber attacks, hacking, malware, and other forms of unauthorized access, use, or disclosure. It involves the use of technical measures, such as firewalls, intrusion detection systems, and encryption, to secure digital assets.

In summary, information security is a broader concept that includes both physical and digital security, while cybersecurity is a specific subset of information security that focuses solely on digital security.

Microsoft Defender Vulnerability Management

 

Microsoft Defender Vulnerability Management Dashboard:

• Exposure score and trends
  
• weakness, likelihood, device value, alerts.
  
• Recommendations
• top security recommendations, high exposure score, software update and upgrade, or uninstalls, impact, or configuration change.
  
• Alerts and threat insight.
• Ticketing with Service Now or Microsoft Endpoint Manager.
• Exception scoping, justification, and expiry.
• Track the progress of the remediation requests and review exceptions.
• Show Top Vulnerable Software.
• Supports add-ons such as asset inventory, block vulnerable versions of apps, monitor for compliance (security baseline assessment).  

Links:

• aka.ms/MDVM
  

Cloud Security for Beginners

A series of webinar that talk about cloud security.

Part 3:

• What a typical attack would look like and where to look for evidence of compromise
• How to put into place security controls to prevent the attack
• Where we can focus our efforts to increase the security of our cloud environment
  

What we can Learn from SolarWind Incident?

Lesson learned from SolarWind incident:

1. Your risk boundary is not your network boundary.
   
2. An attack timeline, from start till release date, can take almost 19 months.
3. Identity is the new "perimeter".
4. Behavioral analysis techniques are required to identify an identity compromise.
5. Network baselining and abnormal behavior analytics are instructive.
   
6. Think if you built software using third party library.
   
7. Think if you are using products/services from any compromised parties, including open source software. 
8. Think who you trust and when did you last validate?
9. Build capability to detects TTP, not IOC.
   
10. CTI likes to use different code name to identify malware.
    

Analysis of NIST NVD Vulnerabilities in 2020

Just finished reading the full analysis report from Redscan. Although more vulnerabilities are on rise, there are still more positive signs based on the analysis. Here're some key takeaways:

• Total of 18,103 vulnerabilities were disclosed in 2020 
• 57% 10,342) of vulnerabilities in 2020 were classified as being ‘critical’ or ‘high’ severity
• Vulnerabilities which require no user interaction to exploit are also increasing, representing 68% of all CVEs recorded in 2020
• Vulnerabilities which require no user privileges to exploit are on the decline (from 71% in 2016 to 58% in 2020)

Threat Intelligence data for Vulnerability Management:

1. Many CVEs are never or rarely exploited in the real world because they are too complex or require attackers to have access to high level privileges.
2. Identifying which vulnerabilities to prioritise is a perennial challenge for Cybersecurity, especially as the number of CVEs only continues to grow.
   

 

CVEs recorded by NIST NVD (1995-2020)

Links:

• Redscan analysis of NIST NVD reveals record number of critical and high severity vulnerabilities in 2020
  
• Download the full report. 
• Measuring risk: Organizations urged to choose defense-in-depth over CVE whack-a-mole 

Incident Mgmt Vs Vulnerability Mgmt

Everyone agrees that Incident Management is different than Vulnerability Management. But yet still people mix them up when things happen.

Recently, SolarWinds supply chain attack has becomes the hottest topic in the month of December 2020 for Cybersecurity world. With the SUNBURST or SuperNova backdoors found, it is obviously becomes an incident (rather than a vulnerability) if your company is using the affected products. With the investigation is still ongoing, more affected products might be included in the list.

But, why people try to manage the SolarWinds case with vulnerability management? Is it because everyone is more familiar with vulnerability remediation process.

Yes, both incident management and vulnerability management has the remediation process. However it is performed by different teams. The remediation process for an incident is performed by Cybersecurity team, while the remediation process for a vulnerability is performed by IT team.

I guess people just thought that the all remediation process are the same.

Why people mix them up so easy?

I think it is due to sophisticated Cybersecurity team structure. And there is monthly remediation reminder that continuously reminding us on the remediation process. People just like to engage with what they are familiar with.

If your company is using a vulnerability management process to handle the SolarWinds attack or incident, then you should start think about simplifying your Cybersecurity teams. 

CVSS != Risk

CVSS does not equal risk; CVSS does not equal risk; CVSS does not equal risk. (We should always repeat at least 3 times for an important thing)

Surprisingly nowadays, there are still Cybersecurity people managing vulnerabilities based on CVSS score, and claim that they are doing risk management. (don't laugh, check with your CISO)

Why a CVSS score is not the same as risk?

Because a CVSS score only helps describe the severity of a vulnerability (CVE) from a technical perspective. 

Then what is a CVSS score?

CVSS stands for Common Vulnerability Scoring System. There are 2 versions of CVSS: CVSS 2.0 and CVSS 3.1. CVSS has 3 metric groups: Base Score, Temporal Score, and Environment Score. Each metric group has own set of metric names.

There is a CVSS Scoring calculator at Common Vulnerability Scoring System Version 3.1 Calculator (first.org) 

Here's a sample of CVSS score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N

And it is common for only the CVSS Base Score to be used to prioritize how quickly those Cybersecurity team are responding to a new vulnerability. 

(Ask your Cybersecurity team when is the last time they are looking at the Temporal and environment scores)

If CVSS != Risk, then why people using it to manage risk?

IMO, it is not their fault. This is all due to regulatory bodies have built CVSS scores into their compliance schemes, and require remediation of all vulnerabilities above certain Base CVSS score in order to remain compliant. (Yes, I'm talking about PCI-DSS)

So, what's wrong with CVSS score as risk management?

First, CVSS score does not take into account the importance of asset. A same vulnerability should have different priority between a domain controller server and a workstation. 

Secondly, not all vulnerability has CVE and CVSS score. There are may vulnerabilities go far beyond CVE/CVSS. If a vulnerability without an assigned CVE/CVSS, does it mean you can skip the remediation?

Third and I think this is most important. Not every vulnerability is exploitable. Instead of remediating all vulnerabilities based on CVSS score, we should focus on those high/critical and exploitable vulnerabilities. Remediation based on CVSS score is not only unfeasible, it is also take up a lot of resource and probably still an unachievable goal. (remember 80/20 rules)

Forth. The CVSS score provides no accounting for other compensating controls, like firewall and antivirus, and thus it doesn't reflect the actual situation.   

In summary, CVSS != Risk, simply because of the following reasons.

1. Lack of asset priority.
2. Only applicable for known vulnerabilities.
3. Waste of vulnerability remediation effort.
4. Not accounting for those compensating controls.

Unlike CVSS and other static scoring methods, KennaSecurity provides the context required to understand the true level of risk that vulnerabilites pose to an organization, using a risk score. The purpose of the score is to provide Cybersecurity, IT and infrastructure teams with an understanding of the relative urgency of the vulnerability so that everyone can prioritize the remediation efforts of some over others based on real-world exploitability. 

References:

•  What You Miss When You Rely on CVSS Scores | Kenna Security
•  A Vulnerability Score On Its Own Is Useless | Kenna Security

How to Simplify Cybersecurity?

We already knew that complexity is the enemy for Cybersecurity. As the threat environment has gotten more sophisticated, it is very likely those (sophisticated) organization responded to new threat by adding new tools to their security stack.

I always believe that "less is more" is also applicable in Cybersecurity world. With all these new challenging threats nowadays, we as the Cybersecurity leaders should take control of the tools/environment, and reducing complexity by leveraging fewer tools, so it can be more efficient and effective at their daily uses.

But how can we do it? 

Based on my 13 years experience, it is possible with the correct approach and people. Here are my recommendations:

1. Automation 
• Try to automate any process, especially those repetitious process like vulnerability remediation, whenever possible.
  
2. Integration (but not consolidation)
•  Don't consolidate the tools as "defense in depth" still applicable in Cybersecurity.
• Use JSON/XML to integrate the tools for measuring any metrics.
  
3. Orchestration
•  Invest in centralized logging SIEM helps orchestrate and streamline the workflow.
  
4. Using cloud for the cloud
• Invest in modern cloud tools rather than using the traditional tool to manage the cloud.
• Then integrate both the new and old tools.
5. Public Relationship Education
• Invest a strong team that can help to communicate security updates and building the trusts with other organizations.
• The team can also provide education for others and set as single channel for communication.
  

With all the modern infrastructure, like mobile apps, IoT, hybrid clouds and DevOps being added to our operating environment, we still need to ensure Cybersecurity can grow faster and work smarter. The answer to this is Simplify Cybersecurity.  And the key to Simplify Cybersecurity is to take a "less is more" approach. 

Keep in mind that simplicity is the ultimate sophistication.

Who should be driving Simplify Cybersecurity ?

Following from the previous Simplify Cybersecurity posts, I'll should you in more details what is Simplify Cybersecurity.

Imagine, your company is entering the digital transformation for IT organization, and you need to transform the Cybersecurity organization too.

By following Simplify Cybersecurity principle, it is very easy to "transform" the Cybersecurity organization.

Even by entering the cloud world, the Cybersecurity core functions haven't changed much. It is still required to Identify, Protect, Detect, Respond, and Recover. The only thing question is, who should be leading the work.

Depends on which stage or which generation of Cybersecurity org is, all you need to do is expand the size/budget of the driving team. For example, nowadays, many company are entering cloud world. And by based on the generation in Simplify Security Stage article, it should be the IAM team that drive the Cybersecurity transformation, and help the whole organization get ready for cloud-based security. 

Many company makes a mistake by forming new team, like cloud security team, to get prepare for company to enter the cloud world. And this is where the Cybersecurity start to get sophisticated. IMO, the CISO may simply have no idea what should be the driving factor in different stage/generation.

What is Simplify Cybersecurity?

Once we know why should we simplify Cybersecurity, we need to know what is Simplify Cybersecurity.

IMO, Cybersecurity cannot (and should not) operate like an IT team. It is very likely you will end up with a very complicated Cybersecurity organization if you try to do so. In another words, we shouldn't have engineering team or operation team, just like how normally IT organization does.

Then, what should a Simplify Cybersecurity organization look like?

Cybersecurity, is all about risk management. And based on NIST Cybersecurity Framework, there should be 5 core functions which include: Identify, Protect, Detect, Respond, and Recover. 

A simplified Cybersecurity organization can follow the NIST framework here. Here's an example:

1. Identify
• Governance, Risk and Compliance team
• Project Management and Consultation team
  
2. Protect
• Network Security team
• Security Architecture and Strategy team
• Identity, Access and Management team
  
3. Detect
• Security Assurance team
  
• Threat and Vulnerability Management team
4. Respond
• Incident Management team
  
5. Recover
• Forensic and Investigation team
• Disaster and Recovery Planning team
  

Note that, the 5 core functions are merely the virtual triage, and not necessary a real team. Next, we will examine in more details about what Simplify Cybersecurity is.

Why Simplify Cybersecurity?

Everything should start with WHY.

This is a series of simplify security posts, and let's start with WHY.  ;)

The reason is simple.

• Complexity is the enemy of Cybersecurity, particularly as the cyber threat environment grows more sophisticated nowadays.
• Thus, we should always look at reducing the number of tools, and fully embracing automation based on a fewer vendors.
•  By focusing on simplicity, we, as business leaders and cybersecurity professionals, can reduce risk and improve efficiencies.

 Next, I'll share more about what Simplify Cybersecurity is.

Simplify Security Stages

Many people, even some CISO, have no idea there is a different driving factor for different security generation.

With many years in working in Cybersecurity world, I found that there are different generation of Cybersecurity, just like the gen-X and gen-Y. And these Cybersecurity generation is driven by different factors depends on which stage the company at.

I called this Simplify Security Stage. Here is the different driving factor in different generation/stage. 

1. Generation 1 - (driving by Network Security)
2. Generation 2 - (driving by Application Security)
3. Generation 3 - (driving by Identity, Access and Management)

During the security generation 1, every company is focusing on network security. Thus, a successful Cybersecurity program is largely depends on how the network security performs. 

I started my security career in 1999, there it is when the security generation 1 started for most of the company. At this stage, whenever we talk about security architecture, we are talking about network security.

At around 2005, security generation 2 becomes more popular. Everyone in Cybersecurity starts talking about Application Security, penetration testing, and ethical hacking. 

And at around 2011, web application security is focused by almost everyone including IT personnel. To me, I'm still considering it as stage 2. And at this stage, the driving factor for a successful Cybersecurity team is how your application security works. This is also where the time everyone is talking about SDLC and application security framework. Most of the time, people like to refer to application architecture as security architecture.

Starting from 2016 (actually back in 2008/2009) the cloud-based infrastructure becomes a hot topic for enterprise. Many new terms such as SaaS/PaaS/IaaS or even XaaS describes how the new generation has begin to change how things work. 

IMO, the Identity-Access-and-Management or IAM, will be the key driving factor for a successful Cybersecurity organization in stage 3. 

This is simply because of the cloud infrastructure is far more complicated and accessible comparing to the stage 2. Look at the AWS/Azure/GCP configuration, everything start from IAM. To me, IAM will be used to describe the next security architecture. Thus my prediction for stage 3 security, most attack will be focusing on testing how IAM will perform, like how we focusing on network security and application security in the past.

So, at what stage your company today? Start learning to be the key driving factor for next generation of Cybersecurity.