Information Security Report – March 2018


Current Threats and Exploits


  • Crypto Miners Are Sneaking To Your Networks – Despite dropping off a little in the news this month, crypto currency is still a much sought after commodity for many. Attackers are looking to cash in on this to do anything possible in order to make good use of your idle CPU time. In the past we have seen malware, advertising, worms and phishing campaigns aiming to deploy mining scripts or software on unsuspecting victims. It was recently reported that a large number of websites around the world were hijacked with crypto mining scripts as a result of a compromised plugin script. As a result of this, users visiting the site were redirected to execute coinhive mining scripts for the attacker, and although this method is used by advertisers to monetise sites, the incident highlighted the importance of knowing your online supply chain (and where you get your web resource scripts from).
  • Shortened URLs In Phishing – It has been observed in the wild that shortened URLs are increasingly being used again by active phishing campaigns. As a result of this, one of the core user awareness points for phishing of looking at the link is bypassed as most users will recognise and trust shortened URL services (such as Google and Bitly). Typically seen in campaigns targeting web mail credentials, this attack vector poses a significant risk to organisations and emphasises the importance of web content filtering. It is also recommended that users are made aware to be on the lookout for this type of activity.
  • Memcache Denial of Service Attacks – A huge number of Denial of service attacks are being staged from misconfigured internet facing memcache servers. These severs accept easily forged udp packets and this makes them perfect for reflected and amplified denial of service attacks. As this service was not designed to be exposed to the internet it is unlikely that any additional security will be configured, the remediation is to firewall off this service from the internet.

Read more on SANS ISC InfoSec Forums

 

Security News and Alerts

Get updates and exclusive content from our security experts
  • This field is for validation purposes and should be left unchanged.

Recent Breaches


  • Unsecured AWS Once Again Makes News – Poorly secured AWS S3 buckets continue to be a problem. Researchers have notified the LA Times after it was discovered that their unsecured Amazon S3 bucket had been cryptojacked and has been mining Monero cryptocurrency. The LA Times did not correctly configure their S3 buckets and as a result it was publicly writable.

Read more on naked security

Other News


  • Notifiable Data Breaches Scheme Comes into Effect – Australia’s Notifiable Data Breach scheme came into effect this month. This amendment to the Privacy Act enforces businesses under certain conditions to report data breaches to the Office of the Australian Information Commissioner. It is recommended that all organisations become aware of their responsibilities under these changes and update incident response plans as required to include these potential actions. For additional information please engage with your legal and / or privacy team.
  • Read more on ZDNet

  • Chrome will label HTTP sites as not secure – Starting from July the web browser Google Chrome will label sites visited using HTTP as non-secure. This is a move to hopefully uplift HTTPS adoption and ensure that sites default to the HTTPS version of the website.
  • Read more on ars TECHNICA

  • Importance of Multifactor Authentication In the Modern Enterprise – Multifactor authentication is a practical way to add security to the logon process by requiring multiple forms of identification as an addition to the username/password sequence. As the number of password exploits continue to increase, enterprises should look into available multifactor tools and integrate them into their infrastructure so as to secure logins and access to resources.

Read more on Search Security

5 things to help you prepare for the Notifiable Data Breach scheme


Following on from my last post that covered the 5 things you need to know about the Notifiable Data Breach (NDB) scheme, this post is focused on the 5 things you really must do, in order to be prepared for the Notifiable Data Breach scheme. As you will remember the NDB impacts a significant number of organisations and requires specific actions to be followed in the event of a breach. So here is a top 5:

  1. Find out whether you need to comply with the provisions of the NDB.
  2. Determine what sensitive personal information you hold, and make a determination of what the following terms mean to you and your organisation:
    a. likely to ‘occur’
    b. ‘serious harm’.
  3. Prepare a step by step process of what you need to do in the event of a breach.
  4. Educate your stakeholders.
  5. Run a practice drill.

1.  Find out whether you need to comply with the provision of the NDB Scheme

This task should be the simplest of the 5 things you need to do. A good starting point is provided in my previous blog post, but if you are in any doubt, please refer to the Office of the Australian Information Commissioners website.

If you are covered by the scheme and need to comply, and haven’t already started on your NDB compliance journey, I’d suggest you need to initiate some internal conversations. If necessary engage some external expertise.

Even if you don’t need to comply, the investment you make in preparing a breach process will not be wasted.

2.  Determine what sensitive personal information you hold

This task may actually sound a little easier than it is for a large number of organisations. Unfortunately, many organisations have a very poor understanding of their information assets, what is important to them, and what information they need in order to run their business. If sensitive information is not understood, you may be capturing, storing or processing more sensitive information than you need to.

You should also consider, where that sensitive information is stored. Long gone are the days when you could safely say that all my data is on my big file server in my data centre under lock and key. When you really look into where sensitive personal data is stored, you are likely to find that it is located on multiple servers and applications, SAN devices, laptops, iphones, USB sticks, on your backups media, on SharePoint, OneNote, DropBox, and in a myriad of other cloud and/or shadow IT environments.

The next consideration needs to be who has access to the sensitive personal information you possess. Questions to consider include: Do you outsource functions, systems or operational tasks. Are you storing data entirely within Australia, or are you working offshore and around the Globe. Do your partners know that you have an NDB obligation. What is the state of your information supply chain, and where are you exposed. In fact, the legislation does recognise that organisations can jointly hold personal information, and has made provisions to avoid duplicate obligations.

Only once you have a full appreciation of what information you hold custodial responsibility over, where it is, and who else has access to it, can you make a determination and a judgement on what is ‘likely to result in serious harm’.

As with most approaches to information security and privacy matters, a solid understanding of risk management in terms of likelihood and consequence should be leveraged to inform the conversation around the serious harm question. The implementation of the NDB scheme effectively raises the bar on expectations from a risk management perspective.

 

Security News and Alerts

Get updates and exclusive content from our security experts
  • This field is for validation purposes and should be left unchanged.

 

3. Prepare step by step process of what you need to do in the event of a breach

After you have undertaken an information asset inventory and understood what sensitive personal information you have, where it is and who has access to it, you need to prepare for a breach by developing a breach response framework. The framework should include:

  • A process that provides:
    • Identification, investigation, validation and containment rules
    • Clear authority to initiate an investigation and declare a breach
    • High-level resolution guidelines and plans
    • Permitted timeframes for each phase of the breach
    • Communications protocols internally including a clear RACI model
    • Key contacts both within your organisation and with specialist external parties to assist with investigation and resolution where required
    • Plugs in to your work health and safety policy to help manage fatigue
  • Notification protocol for individuals affected. There are proforma’s available and these can be leveraged rather than invented. The information provided that relates to the breach should include:

    • the date, or date range, of the unauthorised access or disclosure
    • the date the data breach was detected
    • the circumstances and or known causes of the data breach
    • who has obtained or is likely to have obtained access to the information
    • the steps undertaken to contain or remediate the breach
  • Options for notifying individuals include:

    • Notify all individuals impacted
    • Notify only individuals who are at likely risk of serious harm
    • Publish your notification, and publicise it to bring it to the attention of individuals at likely risk of serious harm
  • Notification protocol for the OAIC. Again, proforma’s exist that can be used. Items required to be provided in the notification to the OAIC include:
    • Contact details for your organisation
    • A description of the data breach
    • The kind of information involved in data breach
    • The steps you recommend for impacted individuals in response to the breach

4. Educate your stakeholders

Without appropriate education and guidance, responsibility for everything during a breach may fall on you – the reader of this blog! Each stakeholder must know their roles and responsibilities and must be able to operate autonomously and as part of a team when it comes to managing a breach. An internal education activity is definitely something that you should undertake as a priority after your preparation activities. But don’t forget step 5. Knowledge helps, but nothing makes that knowledge stick like having stepped through the protocol at least once.

5. Running a practice drill

As the old saying goes, practice makes perfect. Running a breach practice drill doesn’t have to be onerous or take massive amounts of time to prepare. Although the more you plan and the more often you can practice, the better off you will be. As a first step, prepare some meaningful scenarios, book a meeting with relevant stakeholders, establish some ground rules and run through your established breach process for each of the practice scenarios. Appoint a note taker who will observe and record variations to the process flow. Initially, stick to the process that you have designed, but annotate any issues. Then roll those lessons learned into a second iteration of your NDB process.

Then keep practicing. Perhaps utilise your regular business continuity and disaster recovery drills as a vehicle to test your NDB processes.

The 5 things you need to know about the Notifiable Data Breach scheme


Mandatory Data Breach Disclosure and the Notifiable Data Breach (NDB) scheme are both really hot topics at the moment. There is a number of experts from the legal, cyber security and business community all providing their advice, many providing guidance in forensic detail on what should be done to prepare an organisation for this change.

I’m not planning to cover NDB in detail, the aim of this blog post is to quickly and succinctly outline the 5 most important things you need to know about NDB scheme within Australia.

Essentially, the why, what, when, who, and which of NDB. I’ll follow with a number of additional posts designed to provide practical guidance for organiations on this topic.

Why NDB?

With the prevalence and increased impact of data breaches on the news and in our lives, there is a greater need than ever for a consistent treatment mechanism. The absence of any industry consensus on data breach notification meant that it was only a matter of time before the Government put in place a scheme to protect the interests of consumers, and individuals.

After extensive industry and professional consultation, the Notifiable Data Breaches (NDB) scheme was passed under Part IIIC of the Privacy Act 1988 (Privacy Act).

What is the NDB?

The Notifiable Data Breaches (NDB) scheme establishes a framework governing how data breaches are assessed and responded to, and the obligations of organisations in reporting breaches.

Specifically, the NDB introduces obligations for organisations who experience a data breach that exposes personal information and meets the criteria specified as likely to cause ‘serious harm’. More on what constitutes ‘serious harm’ in a moment.

Any breach notification must include recommendations for impacted individuals on the steps that they should take as a result of the breach.

The NDB also specifies that the Australian Information Commissioner must be notified of eligible data breaches.


Security News and Alerts

Get updates and exclusive content from our security experts
  • This field is for validation purposes and should be left unchanged.

When does NDB come into effect?

The NDB comes into effect on the 22nd of February 2018.

Who does the NDB impact?

Unless you live entirely off the grid and share no personal information, ultimately, the NDB affects us all.

Whilst not an exhaustive list, with some exceptions, a good summary of the organisations that are impacted by the NDB include:

  • Australian Government agencies
  • Businesses and not-for-profit organisations with an annual turnover of $3 million or more
  • Credit reporting bodies
  • Credit providers:
    • banks, building societies, credit unions, finance companies
    • retailers who issue credit card
    • organisations where payment is deferred for at least 7 days – telco’s, energy and water utilities
    • organisations that provide credit for hiring, leasing or renting goods
  • Health service providers
  • TFN recipients, which likely impacts State Government entities if they use TFN’s

An important thing to note is NDB applies to overseas organisations that have been incorporated or formed in Australia.

Which breaches are covered by the NDB?

In broad terms a data breach is defined as either: unauthorised access; unauthorised disclosure; or loss of personal information. The type of personal information covered includes:

  • An individual’s health information or other ‘sensitive’ information
  • information used as a precursor to identity fraud (Medicare card, driver licence, and passport details)
  • financial information
  • a combination of types of personal information.

As with all legislation, the devil is in the detail. This information does not seek to be exhaustive, and the usual legal disclaimers around seeking professional legal advice do apply.

The Office of the Australian Information Commissioner (OIAC) states:

The NDB scheme only applies to data breaches involving personal information that are likely to result in serious harm to any individual affected. These are referred to as ‘eligible data breaches’. There are a few exceptions which may mean notification is not required for certain eligible data breaches.

What does all this mean? The terms ‘likely’ and ‘serious harm’ are key.

  • ‘Likely to occur’ means more probable than not/possible
  • ‘Serious harm’ may include serious physical, psychological, emotional, financial, or reputational harm to an individual

These terms are subjective and require some assessment against the so called ‘reasonable person’ test. Harm can include: loss of business or employment opportunity, damage to a person’s reputation, relationships; humiliation; identity theft; significant financial loss; threats to physical safety; and workplace or social bullying or marginalisation. The circumstances of the breach is also an important factor.

The stated exceptions are interesting, because if an organisation acts quickly to remediate a data breach, and as a result of their quick response the impact of the data breach reduces the breach to something less than what is termed serious harm, then there is no requirement to notify any individuals or the Commissioner.

Hopefully you have found this blog useful to set the scene for NDB. I’ll be following up with an additional series of posts on how to prepare for NDB, what is important during a breach and how your organisation can be prepared.

Information Security Report – February 2018


Over the past month, we have seen a number of threats, vulnerabilities, and spear phishing attacks affecting organisations worldwide. Read on for a summary of these events to help you assess their implication on your environment.

Current Threats and Exploits


  • Refined Exploits Targeting Legacy Windows Servers and PCs: – The vulnerabilities discovered in SMBv1 servers (CVE-2017-0146 and CVE-2017-0143), can be used by remote attackers to execute arbitrary code via crafted packets, to the Microsoft SMB servers. Three exploits linked to these Microsoft vulnerabilities, have been rewritten and stabilised and can now impact all Windows operating systems starting with Windows 2000 up to and including Server 2016 edition. It is highly recommended to apply all software patches available as it is reported that these exploits are being used by worm malware to enable them to spread. Additional details on the recommended actions to take against these exploits can be found in the references below. (1)
  • WannaMine: Cryptocurrency Mining Malware: An EternalBlue based malware dubbed WannaMine was discovered to be using computing resources to mine cryptocurrency on infected systems. The malware initially uses password harvesting kit Mimikatz to steal usernames and passwords from system memory and EternalBlue exploits in order to spread around the network. (2)(3)
  • CISCO ASA Remote code execution and Denial of Service vulnerability:  A vulnerability in the Cisco SSL VPN functionality of Cisco ASA was discovered and is being actively scanned and attacked across the internet. Successful attacks allow the attacker to reload the device resulting in a denial of service, or run arbitrary code on the device by sending crafted XML packets to the webVPN interface. Users of Cisco ASA devices are recommended to check the running operating system version and upgrade soon as possible.(4)
  • Cisco IOS and IOS XE Software EnergyWise Denial of Service Vulnerabilities:  Multiple vulnerabilities in the EnergyWise module of Cisco IOS and Cisco IOS XE Software have been disclosed. These are caused by the improper parsing of crafted EnergyWise packets destined to an affected device. These vulnerabilities could allow an unauthenticated, remote attacker to cause a buffer overflow condition or a reload of an affected device, leading to a denial of service (DoS) condition. Cisco has released software updates that address these vulnerabilities. (5)
  • Lenovo Networking OS backdoor: A backdoor that has existed since 2004 has been removed from the Lenovo Networking OS in use by 16 IBM and 16 Lenovo network switches. This backdoor allows for administrative access to the device and Lenovo claim the backdoor was placed into the product by the now-defunct Nortel Networks. (6)
  • CISCO ASA 9000 IPv6 Fragmentation Packet Denial of Service:  Due to an incorrect handling of IPv6 packets in the Cisco ASA 9000 series, an unauthenticated reload of trident line cards is possible in routers running Cisco IOS XR Software Release 5.3.4. with IPv6 configured. Cisco have released software updates that resolve this issue. (7)(8)

Security News and Alerts

Get updates and exclusive content from our security experts
  • This field is for validation purposes and should be left unchanged.

Recent Breaches


  • Russian hackers hacked and published 2018 Winter Olympics emails: It is reported that Russian hackers calling themselves ‘FancyBear’ have retaliated to the banning of Russia from participating in the Winter Olympics by releasing emails regarding Olympic games scheduled in February in South Korea. It is alleged that the group is associated with military intelligence. The International Olympic Committee have not commented on the allegations brought forward by the leaked documents. (9)

Other News


  • Netflix phishing campaign: A phishing campaign was reported to hijack the Netfilix brand by tricking users to handing over their login details, credit card, mugshot, and their ID. The fraudsters used a fake website that had a valid HTTPS certificate to attempt to reassure users of the legitimacy of the website. (10)

References

Information Security Report – January 2018


Current Threats and Exploits


  • Meltdown? Spectre? Where Can We Find Out More? – Early January saw the industry start the year with a bang as rumors of an Intel bug being released online. Google’s Project Zero quickly announced on the 3rd of January that nearly all modern processors are affected by a vulnerability that when exploited can allow for potentially sensitive information to be accessed from memory across local security boundaries. A combined response from processor and operating system vendors is currently underway with most vendors releasing a statement or patch where applicable. It is recommended that local administrators investigate their organisations exposure to the bug and begin a remediation plan where possible. Additional detail and vendor responses can be found in the references below. (1, 2, 3, 4)
  • Risks Created by Bitcoins Surge in Popularity – Driven by the rise in value of bitcoin over in recent months, crypto currency has become a hot topic for those in and out of the IT space. With a large number of people newly becoming curious or looking to make some quick money in crypto markets, scammers and attackers have also been thinking about how they can leverage the new found popularity of these currencies. In recent months there has been an increase in bitcoin related phishing and online scams in an attempt to either steal bitcoin or wallet private keys / passwords from unsuspecting users.

Recent Breaches


  • Forever 21 POS Malware Reminds about Encrypting Data at Rest – Retailer Forever 21 announced that for 7 months last year a number of cash register and point of sale devices were infected with malware that was successfully able to swipe payment card details. In addition to this it was reported that the malware was also present on some systems and were able to view transactional logs on a central server that were generated by non-compromised devices. It has been confirmed that encryption on these devices was not always enabled, and during periods where encryption was not enabled the logs could be read by the malware which would search for payment card details. Although POS malware is a constant threat, it is also important to ensure you are aware of all systems in your organisation that hold or process any form of payment card information. Regular testing and quality control of controls such as encryption of data at rest, and reduction of sensitive information in logs can ensure that in the event of compromise, the malware would not be able to find sensitive information. (8)
  • Leaky (S3) Buckets At it Again – Once again, a publicly exposed Amazon S3 bucket containing sensitive information was found. This time the information contained details on an estimated 123 million American households. With more companies using cloud services for storage and business, it is important to gain a good understanding of the access controls in place for data kept in the cloud. Regular reviews of access to your cloud services and data is also recommended. If you are looking for more information about securing S3, see this article here. (9)

 

Security News and Alerts

Get updates and exclusive content from our security experts
  • This field is for validation purposes and should be left unchanged.

 

Other News


  • What to expect in 2018 – With 2017 teaching us all some new lessons about patch management, ransomware, crypto currencies and securing the cloud, it is expected that 2018 will provide a similar education. With more companies looking to invest in the cloud and in new technologies, there is an increased risk in how we can better secure the modern business. The internet of things and the issues these devices have faced in the past is a constant reminder of this. Further to this it is expected that financially motivated cybercrime will remain a constant threat through the means of social engineering/phishing, crypto-currency targeted malware and possibly more organisation specific ransomware. From a defender perspective, it is expected that two factor authentication (2FA) will increase significantly. As many credential based attacks can be mitigated by enabling 2FA, and with 2FA gaining wide-spread support (especially in the cloud and online services), 2018 should see a welcomed increase in 2FA uptake. (10)

References

Information Security Report – December 2017


Over the past month, we have seen a number of threats, vulnerabilities, and spear phishing attacks affecting organisations worldwide. Read on for a summary of these events to help you assess their implication on your environment.

Threats and Exploits


Mailsploit

Mailsploit Allows Spoofed Mails to Fool DMARC. Mailsploit is a collection of vulnerabilities in various email clients which allow an attacker to perform code injection attacks, spoof senders and bypass email protection mechanisms such as DMARC(DKIM/SPF). The security researcher who developed Mailsploit described how Mailsploit allows an attacker to send emails from any address they choose by taking advantage of how servers validate the DKIM signature of the original domain and not the spoofed one. It has been reported that this technique does not currently get detected or blocked by the majority of mail client vendors.

All major email clients and web mail vendors were notified about Mailsploit prior to its public release, however a large number of popular clients still remain vulnerable.

The list of impacted mail clients can be found here >>

It is recommended that users should update their email client whenever there’s a software update available, use end-to-end encrypted messages for personal conversations and at work and/or use PGP/GPG to verify the identities and encrypt email contents.

You can read more on Mailsploit on info security magazine and mailsploit.com

Spear Phishing

Huge Increase in Email Impersonation Attacks: According to Email Security Risk Assessment (ESRA) report, a report released byMimecast Data Security, it was discovered that although organisations continue to face an ongoing threat from malware, the fastest growing threat is impersonation attacks. An organisation is seven times more likely to be hit by an impersonation attack than by email-borne malware. These attacks are also known as whaling or spear phishing where attackers trick recipients into wiring money transfers to the fraudster. These scams are highly targeted and often done after a cybercriminal has gathered enough information to send the right person the right message. These attacks continue to grow faster than malware due to the fact that it’s very hard for traditional defenses like email filters to detect them.

Good user training will give an edge in avoiding most of these payment and impersonation scams. A few other tips for security teams to help combat the social engineering threat include:

  • Conducting internal phishing by phishing your own employees and sharing the results of the testing with them so that they can learn what to look out for. This should be combines with good training on how the users can detect the phishing emails.
  • Impersonation attacks often try to mimic emails from C-level executives. Implement a company policy that closes scam avenues for would-be spear phishers (e.g., never request the sharing of sensitive documents via email).
  • Disable links inside email bodies to force users to manually navigate to the site mentioned in the email. It adds extra steps, but it can prevent a user from clicking on a phishing link by accident.

Read more on info security magazine and TechRepublic

 

Security News and Alerts

Get updates and exclusive content from our security experts
  • This field is for validation purposes and should be left unchanged.

 

Breaches


Virtual Keyboard App Data Breach

Massive Breach Exposes Keyboard App that Collects Personal Data on its 31 Million Users. A team of security researchers have discovered a huge trove of personal data of the users of the virtual keyboard app ‘AI.type’ that was accidentally leaked online for any one to download. This app is a customization for on-screen keyboards on mobile phones and tablets with more than 40 million users worldwide. It is reported that the app requests for ‘full access’ to all user data stored on the phone and appears to collect everything from contacts to keystrokes. The leaked data includes full names, phone numbers, email addresses, device information including device name, screen resolution, model details, android version, mobile network name, country of residence, GPS location and even links and information associated with social media profiles.

Events such as this raise the question about what permissions mobile applications have on our devices (and just how much access these applications NEED). In order to best protect yourself against this form of application privilege abuse, it is recommended to always read and be cautious of what access is granted to applications.

Read more on The Hacker News

Uber Technologies Data Breach

Personal data of 57 million customers and drivers was stolen last year from ride-sharing company Uber with the breach revealed to have been concealed by the company for more than a year. It is suggested that the company paid $100,000 to the attackers. The company however advised that no social security numbers, credit card information, trip location details or other data were taken. Uber is being condemned for how it chose to deal with the issue after discovery of the attack and has also been sued for negligence over the breach by a customer.

It is reported that two attackers were able to retrieve login credentials from a private GitHub coding site which they used to access Uber data from an Amazon Web Services account where they discovered customer and driver related information. Although there are state and federal laws in the United States that require companies to alert people and government agencies when sensitive data breaches occur, Uber failed to comply.

Read more on Bloomberg.com

Breach at PayPal Subsidiary Affects 1.6 Million Customers. Paypal disclosed on 1st December 2017 a data breach on its recently acquired company TIO Networks. Personal information for 1.6 million individuals may have been compromised. TIO is based in Canada and serves some of the largest telecom and utility network operator in North America. Paypal pointed out that the Paypal platform has not been impacted as the TIO systems have not been integrated into its own platform. Paypal advised that affected companies and individuals would be contacted via mail and email, and offered free credit monitoring services via Experian. The data breach was discovered as part of ongoing investigations for identifying vulnerabilities in the processing platform.

Read more on SecurityWeek.com

Other News


Simulated Attacks Uncover Real-World Problems in IT Security. A research report by SafeBreach, a cybersecurity company that has developed a platform that simulates hacker breach methods, reveals that virtual hackers “have a 60% success rate of using malware to infiltrate networks. And once in, the malware could move laterally almost 70% of the time. In half the cases, they could exit networks with data.” The research found that it was not hard to get past the perimeter and once in, it was easy for attackers to move around and exfiltrate data. This is because most organisations overlook concerns over lateral movement as they mostly focus on the perimeter.

According to the report, malware infiltration methods like nesting or “packing” malware executables were effective in bypassing security controls 50% of the time. The success rate of infiltrating a network using packed executables was found to be 55%-61% using JavaScript, VBScript (VBS) using HTTP and using HTML file format (CHM) extension. It is recommended that network security controls should be VBScript (VBS) using HTTP and using HTML file format (CHM) extension. It is recommended that network controls should be configured to scan for malicious files and block them before they make their way to the endpoints/hosts for installation to disk. The report
further outlines how cybercriminals exfiltrate data using the easiest methods which are often through traditional clear or encrypted Web traffic. Ports having the highest exfiltration success rate include Port 443 (HTTPS) and Port 123 (NTP).

It is recommended that in order to better protect resources, organisations should optimize their current security solutions, constantly update the configurations as needed, and then test the changes they make.

Read more on DARKReading.com

How to set up the right Vulnerability Management processes


Managing your network vulnerabilities and identifying the right vulnerability management processes can be complex. Whilst finding and prioritising vulnerabilities are the responsibility of the security leader, the speed at which these vulnerabilities are remediated is dependent on other people in your organisation. System architects and administrators, IT managers and system owners all play a part in remediating the issues.

As a security professional, you are acutely aware of the security risks in leaving systems in a vulnerable state. However, addressing the issues does not always align with business priorities or present workloads. So how do you set up a process that addresses the challenges above and keeps you on speaking terms with colleagues?

Here is a 3 part process — Categorise, Prioritise, Bitesize — that can help you streamline your activities. More specifically:

  1. Helps you see patterns before they become an issue
  2. Allows you to narrow down the most important threats, and
  3. Execute resolutions as effectively as possible

1- Categorise


After running your first few scans the first step to managing vulnerabilities is to categorise. This helps to indicate potential process issues and highlights common trends and weak areas.

The main categories we come across are:

Missing patches

Many of the issues we see are caused by missing patches. The scans, apart from showing that certain patches are missing may indicate gaps in the patching process. Perhaps the organisation is patching forwards only and never applies past patches to systems that may have changed over time or changed purpose.

Configuration issues

Vulnerability scans can also show an organisation how effective their build standards are. When scans show many different vulnerabilities on similar devices it can be an indication that build standards or hardening guides are not being adhered to.

I have a colleague who works at a large multinational organisation. We were talking about patching and vulnerability management and I asked him how many servers he looked after. His answer surprised and confused me, he said “One”. In reality, he looked after close to 50,000 servers, but the build was consistent, essentially the same server replicated 50,000 times. So, when he fixes one issue on his single server, he’s actually fixing the same issue on all systems.

Scans can also highlight other configuration issues such as misconfigured devices or services, default passwords being used… etc. Many of which can be fixed by fixing the process.

Outdated software

Scans will also highlight the use of outdated software. It is also quite common to discover devices that you were not aware of. For example, in one vulnerability assessment we did, the old Windows 2003 servers were known. The multitude of Windows XP devices and a Windows NT server were more of a surprise.

False positives

Every scanner has a particular way to identify issues. For example, in the early 2000s, there was computer worm called Code Red that attacked Windows IIS servers. To combat this, the vulnerability scanners at the time were primed to spot the product code and version number for IIS. However, not long after Code Red was fixed, Microsoft no longer updated the version number. This meant that vulnerability scanners would still think, based on the version number, that the system was vulnerable to this attack. Even though it had long been fixed. So it is important to understand how the scanner you use identifies certain issues. This allows you to identify false positives.

As part of your process, you need to identify and manage false positives and carefully weed out the irrelevant information for your particular environment.

Don’t care/low risk

The final category we use is the ‘Don’t care’ or Low-risk category. Whilst scanners assign their own risk ratings, there are always findings that would have no or minimum impact on your environment.

Every environment has low-risk items. One of the most common we see is the ICMP timestamp issue. While timestamping issues should be fixed, for many organisations there are more important tasks that need addressing first.

There are also issues that could almost be considered trivial. For example, if “Last user logged on” is shown then it’s a “We’ll get around to it” fix. I’m fairly safe in saying no organisation was ever compromised through this particular issue.

2- Prioritise


When it comes to vulnerabilities, everyone tends to say that every vulnerability is important and urgent – but in reality, it isn’t. Not everything is important or urgent, you do need to prioritise and focus on the most important vulnerabilities you’ve identified.

You can create your priority list by considering:

Importance of asset

Start by looking at the criticality of each asset for your organisation. That is, if the system were to go down or be broken into, what is the realistic impact, would it spell the end for the organisation or just cause a mild inconvenience.

The risks of remediation or not remediating

What is the risk of not fixing the issue? Many organisations deprioritised MS17-010(Eternal Blue). The risk, as many companies found out, was that their environments got infected with Ransomware and suffered significant downtime.

The reverse is also true. Applying a patch for Flash on a critical server, when the server can’t be used to access the internet can probably be left alone for a little while as the risk to the server is higher than the issue it addresses.

Ease and/or difficulty of remediation

The reality is that some issues can be easy to fix, others are complex and could require extensive testing. As you evaluate the vulnerabilities identify how difficult or easy it would be to address as well as the spread of the issue. An issue that has a high impact, i.e. affects a large number of devices, may be addressed prior to a critical issue identified on a few devices.

Accuracy of vulnerability

Vulnerability scanners make suggestions, based on the tests conducted, that a certain vulnerability exists and whilst in many cases that is true, in your environment that may be how things work. The tests may also be basic version checks rather than a comprehensive test, so you need to be technically minded to decide whether the vulnerabilities identified are relevant and accurate for your environment. Scanners still require human interpretation to make the right call.

Scanners, like many software tools, provide a suggested value on the vulnerabilities detected within your environment. However, while you can tweak values to better reflect your needs, you can’t always rely on these numbers to make decisions – let me show you why.

Here we have some examples of common vulnerabilities scanners detect. Let’s explore the suggested values:

Vulnerability Management Processes

 

Password that never expires: the scanner has ranked this as ‘severe’. I tend to agree and would recommend addressing this if the password contained only a handful of characters.

TLS/SSL attacks: Again, I agree with the moderate rating, however, these types of attacks are quite tricky to do as they need very specific information. We could probably leave this one down the list of priorities.

Diffie-Hellman: While this is ranked as moderate, I would categorise this risk as severe if this was an internet facing service. Interestingly, we have found on many occasions that addressing higher-priority issues like this resolves other lower-priority issues.

Windows display last username enabled: This is ranked moderate, but I know it’s a lineball call as some organisations care more about this than others.

3- Bitesize


Vulnerability Scanning Report

 

 

 

 

 

 

 

 

 

 

As you can see from the image, this scanner has spat out a report over 11,000 pages long. Imagine if someone dropped this on your desk with a “here you go, get cracking”. What are the chances you’ll get stuck into it? What are the chances you’ll stay on speaking terms with that person?

Sadly, it’s this sort of common approach that makes it almost impossible for organisations to tackle vulnerabilities effectively.

So instead, we turn this report into bitesize chunks by:

  • Selecting what aligns with the organisation’s priorities. We want to maximise valuable resources.
  • Checking that the task is achievable. This helps to determine the sort of support you need.
  • Identify the quick wins and slow burns. Will the completion of one simple task resolve a widespread issue? Or, do you need to take out more testing or request additional help to complete something more complex

Based on the priorities and the risk to the organisation liaise with the relevant teams. Provide smaller achievable tasks and objectives rather than one large bucket of issues. By splitting the tasks into smaller achievable objectives the teams will be better able to cope.

Identify:

  • What vulnerability has to be fixed now, and
  • What can the business cope with until later

Once you have your priorities in order, create a task list and work your way from top, to bottom. Perhaps start with addressing the easily achieved remediation tasks and build up.

We can’t stress enough how successful this approach is; breaking down your tasks into manageable chunks not only makes it easier to visualise results but engages your organisation along the journey.

As you can see, setting up a process for vulnerability management is essential in streamlining what can otherwise be a difficult and lengthy process. The above approach can make huge improvements in your security posture and guide your continuous improvement when it comes to cybersecurity.

Phriendly Phishing Review in ITWire


No matter the protections you have in place, the last defence for cyber security rests with the end user. But how do you educate in a respectful, engaging way?

David M Williams, CIO, tried out Shearwater’s Phishing Awareness Training & Simulation Solution, Phriendly Phishing, built on this very premise, finding it reduced risk and exposure to phishing and that his users enjoyed the process.

Read about his experience in ITWire.