The different between Information security, security resilience and cybersecurity

Here is a Venn diagram that shows the difference between Information Security, Security Resilience, and Cybersecurity.

       _____________
      /             \
     /   Cyber-    \
    |  security     |
     \_____________/
          |   |
          |   |
    _____________________
   |                     |
   |   Security Resilience |
   |_____________________|
          |   |
          |   |
     ___________________
    |                   |
    | Information Security |
    |___________________|
 

The diagram shows that Cybersecurity is a subset of Security Resilience, as Security Resilience encompasses not just Cybersecurity but also physical security, incident response planning, and business continuity planning. Similarly, Information Security is a subset of Security Resilience, as Security Resilience encompasses a broader set of security-related activities beyond just information security.

Is there a difference between information security and Cybersecurity ?

Yes, there is a difference between information security and cybersecurity, although the two terms are often used interchangeably.

Information security is a broader term that encompasses the protection of all forms of information, both digital and non-digital, from unauthorized access, use, disclosure, disruption, modification, or destruction. This includes physical security measures, such as locks and access controls, as well as technical and administrative controls, such as encryption and policies and procedures.

Cybersecurity, on the other hand, specifically refers to the protection of digital information and systems from cyber threats, such as cyber attacks, hacking, malware, and other forms of unauthorized access, use, or disclosure. It involves the use of technical measures, such as firewalls, intrusion detection systems, and encryption, to secure digital assets.

In summary, information security is a broader concept that includes both physical and digital security, while cybersecurity is a specific subset of information security that focuses solely on digital security.

Active Directory Security Assessment with PowerShell

Krishna has a security assessment script that pulls important security facts from Active Directory and generates nicely viewable reports in HTML format by highlighting the spots that require attention. 

The powershell script covers:

• User account issues and Inactive accounts
• Users with ReversibleEncryptionPasswordArray
  
• Use Kerberos DES encryption types for this account
• Do not require Kerberos pre-authentication
• Review the domain password policy
• Tombstone lifetime and backups
• Unconstrained Kerberos delegation
• Scan SYSVOL for Group Policy Preference passwords
• Review KRBTGT account information
• Audit privileged AD groups

Security assessment helps to identify settings that do not meet the security standards. And remediation guidelines and best practices can be defined based on the assessment outcome.

 

Links:

• https://4sysops.com/archives/perform-active-directory-security-assessment-using-powershell/
• https://4sysops.com/wp-content/uploads/2022/01/AD_SecurityCheck.ps1
  

Congratulations! You found it.

Anti-Thief v3.0

Just been introduced to new Intel processor's feature called remote-kill switch (Anti-Thief  v3.0). This technology embedded in the CPU (Intel Sandy Bridge) allows the user to remotely disable the processor through 3G, that is, even when the computer is not connected to the Internet or it switched off. The goal is to offer the user the capability to shut down remotely the computer if it is lost or stolen.


Some extra reading for those interested on this technology:

• http://www.intel.com/en_US/Assets/PDF/general/br_IT_AntiTheft_vPro.pdf?wapkw=(vpro+antitheft)
• http://antitheft.intel.com/Libraries/Documents/Intel_R_Anti-Theft_Technology_-_Technology_Brief.sflb.ashx
• http://download.intel.com/technology/vpro/Whitepaper_AllNew2010IntelCorevProProcessors.pdf

Top 5 Security Threats in HTML5

HTML4 was introduced in 1997. Recently, with the introduction of new features, HTML5 also brings with it potential security vulnerabilities. This isn't to say that HTML5 is "flawed," but that there will be new attack vectors for hackers to exploit. Some originate from elements of the standard itself, some from implementations of the standard in each browser, and some from the care that developers do (or do not) take in building their HTML5 code.

• 
  
• Below is the summary of the potential security threats in HTML5. You may read the full article at the original source at http://www.esecurityplanet.com/features/article.php/3916381/Top-5-Security-Threats-in-HTML5.htm (By Aaron Weiss on December 9, 2010)
• 
  

1. Cross-Document Messaging

HTML5 does not itself enforce the origin check in the newly introduced API, called postMessage that creates a framework for a script in one domain to pass data to a script running on another domain. This means a careless developers might not actually implement origin verification, essentially leaving the script exposed to postMessage requests from malicious sites.

2. Local Storage

A newly introduced HTML5 feature is offline storage, a client-side SQL database that can be accessed by JavaScript (offline). When storing sensitive data, such as email messages or passwords, it is up to the developers to use SSL and to generate unique database names (to prevent a predictable attack). Also, developers are expected to use prepared SQL statements, rather than constructing queries in JavaScript code, or else hackers could intercept or emulate these queries to execute "SQL injection"

3. Attribute Abuse

In addition to providing many new tags, HTML5 also introduces new attributes, some of which may be subject to abuse. A particular threat is when attributes can be used to trigger automatic script execution.

For example, the new HTML5 attribute "autofocus" will automatically switch browser focus to the specified element—a trick that is sometimes useful for user interface design and previously had been implemented using JavaScript. Other new attributes, including "poster" and "srcdoc," allow page elements to point to external resources—resources that may be malicious in nature. 

Again, it is not that these attributes are flawed—they exist to enable richer functionality in Web applications—but that they also could be abused by bad actors.

4. Inline Multimedia and SVG

With its new <audio>, <video>, and <svg> tags, HTML5 can natively render popular formats and vector graphics without external plug-ins. For example, an earlier version of Google Chrome contained a documented bug in its SVG parser which, could allow scripts to access the object properties of a page hosted on a different domain and violating cross-domain security policy.

Each browser needs to implement native multimedia handling and crop up for different bugs. And this may lead to multiple attack vectors been exposed.

5. Input Validation

HTML5 provides rich client-side input validation, empowering Web developers to define input boundaries alongside the forms themselves, with instant feedback provided to users. Since this input validation syntax is new to HTML5, developers may be more prone to make mistakes in their validation code, such as flawed regular expression (regex) syntax in page code that lead to DoS against browser.

Related links:

• https://developer.mozilla.org/en/DOM/window.postMessage
• http://diveintohtml5.org/offline.html
• http://code.google.com/p/html5security/wiki/WebSQLDatabaseSecurity
• http://code.google.com/p/chromium/issues/detail?id=21338
• https://developer.mozilla.org/en/HTML/HTML5/Forms_in_HTML5#Constraint_Validation

SANS Consensus Audit Guidelines (Draft 1.0)

On Feb 23, 2009 SANS publishes the first draft of the Consensus Audit Guidelines (CAG). As represented in the press release, the CAG includes 20 controls, 15 of which can be automated and 5 are not.

The 20 Critical Controls subject to automated measurement and validation (AMV):

1. Inventory of Authorized and Unauthorized Hardware.
2. Inventory of Authorized and Unauthorized Software.
3. Secure Configurations for Hardware and Software For Which Such Configurations Are Available.
4. Secure Configurations of Network Devices Such as Firewalls And Routers.
5. Boundary Defense
6. Maintenance and Analysis of Complete Security Audit Logs
7. Application Software Security ***
   
8. Controlled Use of Administrative Privileges
9. Controlled Access Based On Need to Know
10. Continuous Vulnerability Testing and Remediation
11. Dormant Account Monitoring and Control
12. Anti-Malware Defenses
13. Limitation and Control of Ports, Protocols and Services
14. Wireless Device Control
15. Data Leakage Protection
    
16. Secure Network Engineering (not AMV)
17. Red Team Exercises (not AMV)
18. Incident Response Capability (not AMV)
19. Assured Data Back-Ups (not AMV)
20. Security Skills Assessment and Training to Fill Gaps (not AMV)

Two (2) points I would like to make here:

• When your only tool is hammer (For*ify), you tend to see every problem as a nail. Hey dude, *** is only 1/20 of the entire infosec.
• RedTeam Exercise isn't an automated measurement and validation.
  

Information Security in Cloud Computing

This is a typical example of information security within cloud computing: you just don't know when will you're vulnerable.

See how Google has handled a bug reported on Google Docs: error allowed unauthorised document access.

Cracking Acrobat 9 Password

Adobe admits Acrobat 9 passwords can be guessed more quickly.

Is this a True-Positive or True-Negative alert?

Adobe recently replied to the online discussion of Acrobat's vulnerability to brute-force attacks. Adobe claims that the specification for the 256-bit AES encryption in Acrobat 9 provides greater performance than the 128-bit implementation in previous versions. It is this improved performance that allows Acrobat 9 to open protected documents much more quickly.

Adobe has admitted that brute-force attacks and dictionary-based password cracks benefit from the program's extra speed, because "fewer processor cycles are required" to test each password guess than with AES 128-encrypted documents. Adobe does not say how much faster attacks can be carried out, but Elcomsoft, a manufacturer of password-recovery tools, claims that passwords can now be cracked 100 times faster.

To help mitigate dictionary attacks, Adobe advises customers to use long passwords or pass-phrases. Version 9 supports Unicode pass-phrases up to 127 characters in length. For even greater security, Adobe recommends using encryption based on the Public Key Infrastructure (PKI), although this requires the use of Adobe LiveCycle Rights Management.

See also:

• Manufacturer claims that passwords in Acrobat 9 are easier to crack than in version 8

HITB Material Archive is Online

The presentation slides for Hack-in-The-Box security conference are online now.

• http://conference.hackinthebox.org/hitbsecconf2008kl/materials/

Tracking Gimmiv

There is an interesting post from research Joe Stewart's research.

This is a tracking of a 0-day exploit which targetting an out-of-band Microsoft patch (MS08-067). This is a patch against a flaw in Windows RPC code.

Because of some mistakes made by the author(s) of Gimmiv worm, 3rd parties were able to download the logfiles of the Gimmiv control server. Even most of the data in the logs is AES-encrypted, the key hardcoded in the Gimmiv binary was recovered for decrypting the data.

From the decrypted log file into KML format, the result shows that:

• Only around 200 computers were infected since the time Gimmiv was actively deployed on September 29, 2008.
• Only 23 countries had infected users, and Southeast Asia appeared to have the greatest number of infections. Two networks in Malaysia had the most infections.
• While Malaysia was the hardest hit, it appears that the “in-the-wild” spread of Gimmiv may have started in Vietnam on September 29.
• The log shows that Gimmiv appeared first on August 20, 2008.

The Gimmiv's author is probably from South Korea, because:

• A zip file left behind on one of the control servers contained Korean characters in the compressed folder name.
• One of IP addresses, located in Korea, was running Gimmiv in a VMware virtual machine (could be someone testing a piece of malicious mobile code to do).

Cyber Security Awareness Month

In case you don't know, October is our Cyber Security Awareness Month. SANS will be sharing a series of tips focus on incident handling. Here's the schedule:

• Preparation: October 1-4
• Identification: October 5-11
• Containment: October 12-18
• Eradication: October 19-25
• Recovery: October 26-31
• Lessons Learned: November 1-3

See also:

• Cyber Security Awareness Month - We Need Your Ideas

Security Screen Saver

Seldom I come across any screen saver for security. Today, when I clean up some of my old files, I discovered an old screen saver I downloaded from Microsoft, "The 10 Immutable Laws of Security Administration". 

• Law #1: Nobody believes anything bad can happen to them, until it does 
  
• Law #2: Security only works if the secure way also happens to be the easy way 
  
• Law #3: If you don't keep up with security fixes, your network won't be yours for long 
  
• Law #4: It doesn't do much good to install security fixes on a computer that was never secured to begin with 
  
• Law #5: Eternal vigilance is the price of security 
  
• Law #6: There really is someone out there trying to guess your passwords 
  
• Law #7: The most secure network is a well-administered one 
  
• Law #8: The difficulty of defending a network is directly proportional to its complexity 
  
• Law #9: Security isn't about risk avoidance; it's about risk management 
  
• Law #10: Technology is not a panacea 
  

If I remember correctly, the screen saver was released in December 2000 (8 years back). You can download it from Microsoft Security Screen Saver.

Something Can't Find by Google

You better make sure you are not found.

>>>> Something You Can't Find Using Google:

Google Profiles, the public pages that include information about Google users, continue to add new questions. Some of the recent additions: "where I grew up", "where I live now", "places I've lived", "current company", "companies I've worked for", "current school", "schools I've attended", "my superpower".

There's even a metaphorical field "something I can't find using Google". What would you write if you were to answer that question in your Google profile?

See this for yourself now how many profiles are indexed by Google.

BlackHat and Defcon Media Archives are Online

Both Black Hat USA 2008 and Defcon 16 slide presentations and White Papers are online now.

• https://www.blackhat.com/html/bh-usa-08/bh-usa-08-archive.html
• https://www.defcon.org/html/links/defcon-media-archives.html

2008 Data Breach Investigations Report

A study on data breach was conducted by the Verizon Business RISK Team. It is the most comprehensive and detailed report on data breaches as it covers around 4 years of forensic researches.

This data breach report found that 73% of the breaches were caused by external sources. However, the impact caused by the insiders were much larger when they did occur. The report shows that 59% of the breaches involve hacking. Of those (hacking) the breakdown is this:

• Application/Service layer -39%
• OS/Platform layer - 23%
• Exploit known vulnerability -18%
• Exploit unknown vulnerability - 5%
• Use of back door -15%

"Attacks targeting applications, software, and services were by far the most common technique, representing 39 percent of all hacking activity leading to data compromise. This follows a trend in recent years of attacks moving up the stack. Far from passé, operating system, platform, and server-level attacks accounted for a sizable portion of breaches. Eighteen percent of hacks exploited a specific known vulnerability while 5 percent exploited unknown vulnerabilities for which a patch was not available at the time of the attack. Evidence of re-entry via backdoors, which enable prolonged access to and control of compromised systems, was found in 15 percent of hacking-related breaches. The attractiveness of this to criminals desiring large quantities of information is obvious."

So if we multiply 59% times 39% we get 23% of those data breaches are due to attackers hacking applications. It is clear that securing applications is a significant part of protecting against data breaches. And data breaches have been moving to upper stack of the the OSI model.

>>> http://www.veracode.com/blog/?p=107

What Organizations Are Spending on IT Security

In March 2008, Gartner updated a document to provides an insight into information security budgets. The objective of this document is to help managers compare their information security spending with that of their peer organizations. It examines how information security spending will grow, and where organizations have and continue to make investments.

By 2008, the most-efficient and secure enterprises will safely reduce the share of security in their IT budgets to between 3% and 4%.

Top 10 Strategies on Responding to Security Issues

This top 10 list is to about how to hide/handle security problems reported. It is taken from Thomas Ptacek's article at Matasano.

1. Deny everything
2. Keep it secret
3. Forget the report
4. Make excuses
5. Downplay
6. Wait for next release
7. Beta-test the fix
8. Patch the exploit
9. Shoot the messenger
10. Threaten lawsuit

You may laugh, but these are what loved by most employers.

ISMS Implementation and Certification Process

ISMS and ISO27K

Found some useful materials if you are planning on your ISO/IEC 27002 implementation project. The ISMS Documentation Checklist is a list of the documents required by by an Information Security Management System (ISMS).

The list was created by a team of ISMS users from ISO27001security.com.
There is a free ISO27k Toolkit to provides a suite of sample documents to get your ISMS implementation off to a flying start. There's also an implementer forum opened for those who have ISO27000 implementation experience.