Cyber Security Articles

The Other Problem with the 2020 Census
The 2020 Census approaches, fraught and politicized. The most visible issue seems to be the debate (and litigation) over whether
Securing the DevOps Process
How do you ensure security and compliance in the fast-moving DevOps process? Security has always been a challenging proposition in
Building Collaboration and Trust in SecOps  
I spoke recently with John Cassidy, Co-Founder and CEO of King & Union, about the inspiration that led to the
Arctic Wolf: SOC-as-a-Service
Sam McLane is concerned about mental health. In particular, McLane, who serves as Chief Technology Services officer at Arctic Wolf,
Thinking Beyond the Basic MSSP
Managed Security Services Providers (MSSPs) are great. They help SecOps teams focus on important security tasks by taking over routine
The Firmware Risk
The recent flap over whether Chinese intelligence agencies placed spy chips on motherboards built by SuperMicro is a good reminder
Providing the “Re” in “Rethinking Cyber Security”
“Cyber security is not an IT issue. It’s not even about security, per se,” says Andrew Morrison, Principal in Deloitte’s
Network Security Innovators
Securing the network was a major focus at the recent Black Hat 2018 conference. For vendors like ProtectWise, Awake, Webroot
Does the United States Need a National Cybersecurity Agency?
General David Petraeus, the former Director of the CIA, published an Op-Ed in Politico recently that advocates for the creation
Black Hat 2018: Understanding Government Cyber Policy
Even the most tech savvy among us get caught flat-footed once in a while. For Justin Cleveland, head of government

Cyber Security Articles

What This Cyber Security Articles Page Is About

The goal of Journal of Cyber Policy is to provide commentary and stimulate conversations about important cyber security topics. Our parallel goal is to discuss cyber issues in plain English, liberating this critical subject from the exclusive realm of specialized engineers and hackers. Throughout, we try to talk about cyber security and related issues from the perspectives of public policy, national security, corporate policy and compliance.

 

Why Articles about Cyber Security Matter

We are living in an era where digital technology dominates so much of our lives. Digital risk naturally accompanies this reality. Smartphones, the IoT, the Internet and so forth make our lives easier, but they also expose us to threats. Some of these threats come from nation state actors. We believe Americans could be better-informed about these risks. And, while there’s certainly no lack of content online about cyberthreats, room still exists for cyber security articles that integrate the subject’s diverse themes of technology, politics and business.

For example, Russian disinformation and Chinese espionage are not new, but today’s digital landscape makes these familiar tactics deadly, in political terms. The Cold War was largely analog in nature, with offensive campaigns quite limited in scope and impact. While Cold War dynamics may survive today, they are having a radically different effect on American society and politics than anything that came before.

It can be tricky to tease out the differences between today and a generation ago. American politics and governance have always been messy, dishonest and idiotic, but there were at least some fact-based controls on it. This is no longer the case. Our enemies are exploiting this new reality. In some cases, they’ve created this new reality.

We see the impacts of these new measures, but leaders across the government and business sectors generally fail to understand the transformative nature of technology, e.g. Amazon is not just a bigger mail order store; the iPhone is not just a phone with fancy features, and so forth. These cognitive gaps lead to deficiencies in the perception of risk. They enable our leaders to underestimate our enemies and how they can win without firing a shot. We also tend to overestimate our defenses and resiliency.

The digitization of society, commerce and politics renders America defenseless in ways that we are only beginning to understand. Digital transformation is double edge. America’s rush to digitize its economy and society produces as much risk as it does benefits. For example, we have to manage the tensions between mobility and surveillance, between big data and privacy and so on.

The Topics We Cover in These Articles

We deal with a wide range of cyber security topics in these articles. Some discuss cyber election interference. Others look at geopolitical cyber risks, such as our recent series on Russian disinformation and “Active Measures.” We will frequently check in on the state of enterprise architecture and cloud computing, seeking expert insights into the best practices and new security technologies that are influencing security policies in these areas of information technology. We cover the gamut of security subjects: malware, phishing, identity and access management (IAM), privileged access management (PAM), zero trust, data security, application security, secure DevOps (DevSecOps), red-blue teaming, automation, Security Orchestration, Automation and Response (SOAR), threat monitoring, incident response, intrusion detection, encrypting, key management and on and on. Our cyber security articles look at compliance, government cybersecurity frames like NIST NSF, GDPR, CCPA and more.

The Other Problem with the 2020 Census

The 2020 Census approaches, fraught and politicized. The most visible issue seems to be the debate (and litigation) over whether it is fair to ask respondents if they are American citizens. This is surely a troubling question, but there is at least one other major problem looming with the census. It won’t draw much heat, in political or media terms, but it’s no less important. In fact, it could be much more serious than the citizenship flap. It’s the matter of data security.

Risk to census data is on the mind of Jonathan Couch, Vice President of Strategy at ThreatQuotient, which makes a threat intelligence platform. Couch brings impressive credentials to the discussion, having served in a number of roles related to advanced cyber warfare, cybersecurity, information operations and policy. These include stints in the Air Force at the National Security Agency, the Air Force Information Warfare Center and in Saudi Arabia for the Joint Task Force.

Jonathan Couch, Vice President of Strategy at ThreatQuotient

Couch’s concerns cross several dimensions of the census. First, there are the mechanics of the data collection and storage. As he points out, much of the census data will be collected digitally through devices like tables. From there, census workers will upload the data to cloud-hosted databases. This architecture was devised to enable different groups of stakeholders, e.g. state and federal agencies to have easy access to the data.

“One of the most striking aspects of the census, from a cyber security perspective, is the sheer size of the effort,” Couch says. “You’ve got thousands of people collecting information on thousands of devices. That alone is a big attack surface area. But, the red teamer in me wants to ask, ‘what happens if someone loses a device?’ or ‘what are the authentication rules for the main database?’ Who gets access? Is the data submission secure? How? How is it logged, and on and on?”

The need to preserve data integrity is absolutely essential for the Census. Over 2,500 government program depend on the Census. Without accurate information, many elements of the government and citizens they serve will suffer.

These practical concerns are actually secondary to Couch’s bigger worry. “We’re not seeing the plans for securing the census,” he says. “It appears that the Census Bureau is not serious about bringing cybersecurity industry partners in to the process of designing the data collection workflow. Neither I, nor anyone else I know in the security sector, has any idea how this is being implemented or secured.”

Couch doesn’t know why details not available. “Maybe it’s like healthcare.gov, where the administration is concerned about revealing too much, for political reasons. If that’s the case, it’s an error in judgement, in my view.”  Alternatively, Couch suspects the government is attempting a “security through obscurity” strategy, figuring if they publish nothing about the Census data and security architecture, it will be harder to hack. “This has been proven wrong,” Couch adds. “Someone will always find it and find a way in, for bragging rights, if nothing else.”

In Couch’s mind, the biggest threats to the Census involve malicious actors manipulating data in order to manipulate budgets, voting district residential tallies and so forth. “It could be ransomware, too,” he shares. “You don’t want to think about what that will look like.”

Couch recommends bringing together a consortium of companies and individuals to look at the Census’ architecture. Then, they might find areas where that specific technology and architecture have been used before and tested for security. “This way, we can start to gain confidence that it will at least work properly and be secure. Then, I would do a bug bounty,” Couch says. “Let’s pay people to break in. It will save a lot of time, embarrassment and money down the road.” He also advocates using a “trust but verify” approach with paper backups to information gathering processes. “That way, we can spot check and cross-correlate data,” Couch says, adding, “I think the country deserves this level of care in the Census. It’s too important to treat it in the current manner.”

Photo Credit: Municipalidad de Córdoba Flickr via Compfight cc
 

 

 

 

 

Securing the DevOps Process

How do you ensure security and compliance in the fast-moving DevOps process? Security has always been a challenging proposition in the software development and releasing cycle. However, security becomes even more precarious with DevOps, which fuses the previously separate development and IT operations workflows into a single, accelerated process.

“We have a natural conflict here,” said Joseph Kucic, Chief Security Officer at Cavirin Systems. Cavirin offers solutions to address security challenges in the cloud and DevOps. “A DevOps team is under pressure to move quickly, to write and implement code. At the same time, the SecOps team is usually perceived to be slowing down the process in order to try and prevent breaches. We see this tension all the time. Unresolved, it can cause organizational trouble and increased risk exposure.”

As Kucic sees it, security can lag because reviews occur late in the DevOps pipeline. “In the worst case,” he added, “Security is an afterthought after the CI/CD pipeline is deployed. The various groups operate in silos. This creates friction, rework and the potential for error.”

The truth is, it’s even worse than that. The very nature of modern software, the kind that’s cranked out daily through Continuous Integration (CI) and DevOps, makes it more vulnerable to threats than earlier generations of code. Risk exposure arises from a variety of factors. DevOps work is often spread out across multiple geographies and corporate entities. That alone creates risk.

Joseph Kucic, Chief Security Officer at Cavirin Systems, Inc.

Then, the software often uses standards-based APIs, web services, containers and microservices. These are all great for agility, but their loosely-coupled, distributed nature makes them easy to hack. Finally, there’s cloud hosting, which decouples IT operations from the infrastructure.

None of these issues would be particularly problematic if everyone followed rigorous security policies and consistently employed countermeasures. The trouble, as one might imagine, is that the loose nature of the DevOps world makes such a goal difficult to attain.

Cavirin has undertaken a solution to these problems. They offer what they call a DevSecOps solution that injects security and compliance policies into the DevOps process. With Cavirin, developers provision and manage data center resources through software. This way, secure infrastructure becomes possible as a natural extension of coding.

Security gets integrated into DevOps through 80,000 policies, 25 benchmarks and a host of programmable security controls. The tool integrates version control and enables adherence to security and compliance policies like patch management. An API enabled architecture facilitates DevOps Security Orchestration, connecting security tools for centralized protection.

DevOps can be friendly and secure…. if done right. DevSecOps can help make it happen.

The Cavirin example shows how apparently difficult security scenarios have solutions. It’s tempting to look at DevOps and conclude that it will never be a secure process. This is not true. It can be secure (or more secure) if stakeholders are willing to take the steps and make the investments in new solutions that address new risks.

Photo Credit: wocintechchat.com Flickr via Compfight cc

Building Collaboration and Trust in SecOps  

I spoke recently with John Cassidy, Co-Founder and CEO of King & Union, about the inspiration that led to the formation of the company. King & Union’s Avalon product enables security analysts to collaborate across organizations in threat assessment. For Cassidy, the idea emerged from working in a number of different government-facing roles.

John Cassidy, Co-Founder and CEO of King & Union

As a participant and executive in the development of DHS’s Einstein 3 at various telecoms companies, Cassidy was struck by how little opportunity there was for communication and coordination between security teams at different organizations. “I would watch people ineffectively working together, in silos, spending billions,” said Cassidy. “They were working for their own protection, but there were duplicating work being done elsewhere. Or, there were so many times that if an analyst had insight into something going on in another place, it would save everyone a lot of time and heartache. There had to be a better way.”

From this insight, Cassidy and his co-founder sat down to brainstorm how to make a better collaborate SecOps toolset. “Part of the burnout we see so often in SecOps is coming from a lack of good quality information,” Cassidy added. “We kept that issue in our sights as well. We felt if we could help security analysts collaborate and evaluate alerts in real time in multiple organizations, we could reduce stress levels quite a bit.”

The result was Avalon, a SaaS workspace in the cloud that enables analysts to visualize threats. With Avalon, analysts can collaborate in real time and manage data without being constrained in their individual bank or government agency silo. “They can go ‘across the aisle,’ as we like to say here in DC,” Cassidy said. “Analysts can use Avalon to cut across vertical sectors. A gas company’s SecOps team can talk to a bank’s. The bank can talk to the government. All three can share their most important security information in a trusted space.”

Avalon consists of groups. Some groups are publicly visible. Others are private. Joining a collaborative group involves a process of identity verification. Inside a group, members can share their findings about threats and other issues in their security landscapes. They can “enrich” findings from others with added data. The tool makes it possible to connect threats, malware signatures and so forth.

Screen shot of King & Union’s Avalon SaaS-based SecOps collaboration platform

That way, an analyst can look up a threat and see, for instance, that it’s already been detected and remediated in another place. Avalon will auto-populate information and show relationships between threats. Users can did into the data and discover the IP address the threat comes from and so forth. This saves time and increases the effectiveness of the SecOps team’s response capabilities.

Avalon can integrate with other tools, such as Alienvault or Crowdstrike. “We want to help teams do better with the tools they have,” Cassidy said. “Our goal is more extensive, productive collaboration in SecOps.”

 

 

 

 

 

 

 

 

 

 

 

Arctic Wolf: SOC-as-a-Service

Sam McLane is concerned about mental health. In particular, McLane, who serves as Chief Technology Services officer at Arctic Wolf, worries about the mental health of security professionals. “This is no joke,” McLane said. “It’s like working in an ER. There’s a lack of available resources.  People have to work in a very intense, fast-paced environment without a lot of support nor much validation of success.”

He’s not alone in making this observation. Many security experts point to burnout and even post traumatic stress disorder (PTSD) among SecOps team members. SecOps works shifts from mind-numbing review of alerts to high-adrenaline incident response.

Sam McLane, Chief Technology Services officer at Arctic Wolf

These insights led to the founding of Artic Wolf, which functions as a “concierge” SecOps service. The goal of the company is to provide enterprise-grade security but at a manageable price. For the sake of simplicity, Artic Wolf identifies itself as a Managed Security Services Provider (MSSP), but in reality, the company’s capabilities extend further than that definition would imply.

For some clients, particularly smaller organizations, Artic Wolf is essentially a Security Operations Center (SOC) as a service (SOCaaS). They can operate as an entire security department if necessary. For larger clients, the company works like a specialized, outsourced security team. Arctic Wolf has a crisp response process and offers a detailed post mortem on security incidents. They like to demonstrate to the client what has been learned in the experience of handling a security event.

The main benefit to the client is the lifting of the heavy HR pressure. “We have the people and the tools ready to go,” McLane explained. “That way, you don’t have to worry so much about hiring and retaining SecOps people. Alternatively, your team can focus on what matters most to them in security but leave most of the operational stuff to us.” Some clients work with Arctic Wolf on determining which security tools are the best fit for their organization.

There are challenges in this model, for sure. “We can get thrown under the bus,” McLane noted. “We don’t work there, so it’s easy. However, most of the time, we have found that the occasional problem helps make everyone—us and the client—better at what we do.”

Photo Credit: Dave77459 Flickr via Compfight cc

 

 

 

 

 

 

 

 

 

Thinking Beyond the Basic MSSP

Managed Security Services Providers (MSSPs) are great. They help SecOps teams focus on important security tasks by taking over routine operations like monitoring firewalls and so forth. The nature of the threat environment, however, makes it necessary to think beyond the basic MSSP in certain cases.

Eldon Sprickerhoff, Founder and Chief Innovation Officer at eSentire

I spoke recently with Eldon Sprickerhoff, Founder and Chief Innovation Officer at eSentire. eSentire is a managed detection and response service that leverages Machine Learning (ML) to detect cyber attacks that are hard to spot with standard SecOps tools and processes. Sprickerhoff shared an example of how ML can make a difference in threat detection.

He talked about PowerShell, Microsoft’s task-based command-line shell and scripting language. Built on .NET, PowerShell exists on every Microsoft Windows instance. It’s a useful tool for administrators. From a security perspective, however, this pervasiveness is a weakness. “PowerShell can be incredibly granular,” Sprickerhoff said. “There’s also a ton of PowerShell traffic on the networks, so it’s a lot to parse. You can obfuscate code in PowerShell easily, encoding in octal [base 8]. This makes it possible to hide malware very effectively in PowerShell.”

eSentire has witnessed a big increase in PowerShell-based attacks in the last year or two. They see process tunneling within Microsoft apps, e.g. load redirects running inside a legitimate-looking app. Such attacks are quite difficult to detect. To mitigate the PowerShell risk, Esentire does a complete packet search. Then, they looked at an enormous amount of PowerShell code. Using ML, they developed a model that spots potential malware.

They nicknamed the PowerShell detection analysis project “Blue Steel,” after the movie Zoolander with Ben Stiller. Blue Steel reviewed commands in PowerShell and found an attack on Kaseya’s Virtual Systems Administrator (VSA) at several eSentire customer sites. The attacker had seen an opportunity in Kaseya’s endpoint updating process and used PowerShell to embed the Monero crypto mining malware on the endpoints. eSentire Blue Steel detected the attack and disclosed it to Kaseya, which has remediated the vulnerability.

The Blue Steel/Kaseya case illustrates how challenging it can be to detect stealthy attacks. A basic MSSP is usually not equipped to do this, nor is it paid to look this deeply into threats in its standard contracts.  Rather, they need tools, or perhaps partners, who can augment basic SecOps services to provide the kind of highly sophisticated threat detection that today’s cyber risk landscape demands.

The Firmware Risk

The recent flap over whether Chinese intelligence agencies placed spy chips on motherboards built by SuperMicro is a good reminder of risks we face from hardware. The allegations against SuperMicro are about a physical implant. Skeptics point out that it’s quite difficult to place a spy chip on a board and know, with any confidence, that it will be shipped to an espionage target. In contrast, firmware, which is largely invisible, appears to represent an even more insidious hardware-borne threat.

I spoke with Ambuj Kumar, CEO of Fortanix, about his perceptions of the firmware risk. In Kumar’s view, firmware is a critical entry point for malicious actors. “Wherever you see software, you need to realize that the code is really a slave to a more powerful entity, the firmware,” he said.

Ambuj Kumar, CEO of Fortanix

He cited the example of an app running on Linux. “I think I can achieve security for the app by patching Linux,” he shared. “But, I’m not really achieving as much security as I think. There is a lot firmware powering the Linux through many chips on the motherboard of the server. They typically come from multiple manufacturers. Each is running its own embedded operating system with its own firmware. If that firmware is compromised, then all bets are off. The firmware is more critical to security than the Linux operating system.”

The nature of the industry is partly to blame for this level of firmware risk, Kumar believes. From his perspective, there are thousands of people whose job is to make sure that platforms like Linux and Windows stay secure. Even then, there are vulnerabilities, but at least there are mechanisms in place to detect and remediate them. Firmware is a “dark horse,” as Kumar put it. “We have little idea what’s in it. There’s a lot of it, and few best practices. Even if you find a vulnerability in the firmware, it’s not always clear how to fix it or whom to contact about the issue.”

Luckily for everyone, firmware hacks are still extremely hard to pull off. However, Kumar pointed out that attackers are being pushed to firmware. “We’re starting to beat back software-based exploits in the same way that medicine started to defeat infectious disease a hundred years ago. Firmware starts to look appealing as an attack surface even if it’s more challenging to penetrate.”

The Fortanix approach to mitigating firmware risk is to enable data encryption at runtime. While this capability does not solve the problem of systemic takeover from compromised firmware, it makes it nearly impossible for the attacker to steal data from the system. Even if the hacker gets root control, he or she is blind to the data itself.

Providing the “Re” in “Rethinking Cyber Security”

“Cyber security is not an IT issue. It’s not even about security, per se,” says Andrew Morrison, Principal in Deloitte’s Cyber Risk Services Practice. “It’s a risk issue.” I caught up with Morrison after Black Hat 2018 to get his insights into how corporations need to rethink their fundamental approach to cyber security. This is the mission of the 3,400 people in Morrison’s organization.

“Cyber security is not an IT issue. It’s not even about security, per se.”

In Morrison’s view, cyber is a risk that needs to be managed. Cyber can no longer be just a service line within a business. The business itself needs to focus on being secure, vigilant and resilient.

Andrew Morrison, Principal in Deloitte’s Cyber Risk Services Practice

If anything, security is part of an even bigger picture. Cyber security—and threats—are an inescapable element of digital transformation. “All organizations are becoming digital, Morrison argues. “A bank is basically a tech company with banking services. A hospital is a health-oriented tech company, and so on.”

He then adds, “It’s really like the fourth industrial revolution. First, we had steam power, followed by electricity and computers. Now, we have hyperconnected and intelligent businesses. It’s incredible, but it’s also a security challenge. Boards are becoming much aware of their role in ensuring the durability of business in this environment.”

Digital transformation increases risk exposure. That’s an inevitable consequence of the paradigm shift. Deloitte’s approach is to guide the board and the broader organization through the security and risk management issues that arise with the transformation process. “Where is your perimeter?” Morrison asks. “You’ve had an exponential increase in nodes. Where does your entity end and another’s begin? The answer is not as simple as it used to be, that’s for sure.”

He shares, “You can also make things a lot worse as we push access to information. A network designed for sharing, which is wonderful, is a network that is at odds with security. You can have a lot of unintended consequences.” As an example, he cites recent accidental security breaches in the US military caused by fitness tracking devices worn by troops. As he puts it, “A generation ago, we worried about computer bugs. Now, there are 100 microphones in the board room I’m sitting in right now. Each is connected to the network.”

“Start with your customers. The market is looking for someone who will be the best steward of its data. Is that you?”

What’s the best way to start the rethinking of security as a risk issue? Morrison recommends taking a market-level view of the issue. “Start with your customers,” he advises. “The market is looking for someone who will be the best steward of its data. Is that you? Do you exercise an appropriate standard of care with your customer’s data? If the answer is ‘maybe,’ then you have work to do, work that goes far beyond the IT department and cybersecurity itself.”

The goal should be to differentiate through strong security technology and policies, e.g. identity management, SIEM, threat intelligence, backup and recovery and so forth. Deloitte approaches this work by pairing risk management professionals with cybersecurity and regulatory experts. All three disciplines necessarily join together to put the client on a good cyber risk footing. “From there, we work on security by design,” he says. “Going forward, you have to factor cyber risk into any system or business process you’re contemplating.”

 

Network Security Innovators

Securing the network was a major focus at the recent Black Hat 2018 conference. For vendors like ProtectWise, Awake, Webroot and Gigamon, network security is one of their main value propositions. I spoke with each company at the event. They offer distinct points of view on the state of network security and what can be done to improve it.

 

ProtectWise

ProtectWise offers cloud-based Network Detection and Response (NDR). The Denver-based company has raised $77 million to date. Founded in 2013, it operated for two years in stealth mode. It has been in-market for three years.

 

Gene Stevens, Co-Founder and CTO of ProtectWise

The company originated from a series of discussions with major enterprises about the security challenges they faced. “We talked to a lot of big companies,” said Gene Stevens, Co-Founder and CTO of ProtectWise. “What emerged was truly fascinating. The biggest security challenge they had was essentially an HR problem. People building technology cannot get enough employees on board to identify and respond to network-based threats.”

With that insight, ProtectWise set out to create an improvement over what Stevens considers a deficient model of network protection. “Right now, the dominant mode of network security involves real time detection of threats as they arise,” Stevens explained. “This makes you vulnerable to targeted advanced attacks executed over long time. Your defense tends to be myopic, like ‘is this email or packet good or bad?’ This is good for understanding and blocking attacks, but it’s not suited to advanced attacks. These are harder to investigate using existing tools.”

ProtectWise created a new way for enterprises to acquire and manage security. They shift core network security functionality away from the data center and to the cloud. Their solution deploys across all architecture as a result, making copies of data for network transactions. They can perform analytics on this data in the cloud, which helps provide visibility that was difficult to achieve previously. ProtectWise takes a platform approach that integrates existing endpoints, firewalls and so forth.

“The biggest security challenge they had was essentially an HR problem. People building technology cannot get enough employees on board to identify and respond to network-based threats.” – Gene Stevens, Co-Founder and CTO of ProtectWise

Awake Security

Rahul Kashyap, CEO of Awake Security, was also focused on the security personnel shortage. “You are never going to have enough people for the threat activity you see on the average network,” Kashyap said. “We need to augment to abilities of each network security analyst.”

Rahul Kashyap, CEO of Awake Security

Awake uses AI and machine learning (ML) to identify the most serious threats affecting the network. Many vendors at Black Hat are leveraging AI and ML, but each has it own, differentiated approach.  Awake focuses on correlating device-to-device communication. “Our solution wants to understand what is normal versus what stands out that should not be happening given the nature of the devices,” Kashyap added. Awake is designed to make itself smarter over time. By compiling and continuously analyzing current and historical network data, Awake can identify and “fingerprint” attackers, learning to spot lateral movement in the network. For example, if an IoT device is leaking data to a foreign country, Awake will spot the problem.

Alerts in Awake are based on correlation and interpretation. The solution is designed not to produce an excessive number of single-event alerts. This can cause burnout in SecOps and enable attackers to overwhelm defenses.

Awake dashboard

Architecturally, Awake works through an OS-agnostic, advanced network traffic analysis plug-in product. It’s agentless, which makes it lightweight and relatively easy to manage and change. “We light up the network and tell you what’s going on,” Kashyap said. The plug-ins enumerate all the assets on the network and learn which is communicating with which. “People sometimes find things they didn’t realize were on their networks,” Kashyap noted. “Or, they’d forgotten. Without really doing much, we can quickly reveal previously unknown attack surfaces. That’s already a win for most SecOps teams.

 

Gigamon

“Security has been too ad hoc,” said Shehzad Merchant, CTO of Gigamon. “We see this so often. An enterprise has deployed a set of boxes that then must contend for access to traffic. Security solutions are challenged to keep up with traffic volume, but the solution is to throw more tools at the problem. This results in a tension between network and security operations.” A better approach, in his view, is to get access to network data and then distribute it for analysis. This is the Gigamon model.

“Security solutions are challenged to keep up with traffic volume, but the solution is to throw more tools at the problem. This results in a tension between network and security operations.” – Shehzad Merchant, CTO of Gigamon

Shehzad Merchant, CTO of Gigamon

Gigamon, which recently acquired Iceberg, enables users to select their own security and analytics tools. “This solves a lot of problems,” Merchant added. “You can load balance. You can change tools. We’re agnostic.” Their approach leads to what Merchant calls a convergence of security and network operations. “With our next generation packet broker, you can more easily see threats across cloud, hybrid and on-premises environments. You can deploy resources faster where they’re needed.” With Gigamon, security solutions only see traffic they are meant to see. The solution deals with SSL TLS encryption one time, rather than the alternative, which is to have every tool execute the process.

 

 

Webroot

Webroot sees things a little differently. They’re not a pure network security vendor, but their predictive threat intelligence offerings figure into network security. Using AI, they are able to identify threats lurking amid billions of web pages worldwide. Armed with threat data, network admins are better able to block malicious content and traffic.

Webroot DNS protection reference architecture

 

Gary Hayslip, CISO of Webroot

The company takes a broader view, however. “Network security today needs to start with a realization that the perimeter model is dead,” said Gary Hayslip, CISO of Webroot. “Rather, we need to be secure at the data layer. It’s a dynamic process. Data is like water that flows between biz units. What’s important? What data can third parties access? That’s where we need to focus our security efforts. It’s all about visibility.” These perspectives are informing the Webroot strategy and roadmap.

 

 

 

 

Photo Credit: Bob Mical Flickr via Compfight cc</a

Does the United States Need a National Cybersecurity Agency?

General David Petraeus, the former Director of the CIA, published an Op-Ed in Politico recently that advocates for the creation of a new, independent National Cybersecurity Agency (NCA) “to take the lead in protecting our critical infrastructure.” Co-authored with Kiran Sridhar, the Op-Ed expresses concern that the government’s current “grab bag” approach to cybersecurity isn’t working.

Almost everyone I have ever spoken to about this issue agrees that the government’s cyber program is dangerously deficient despite a lot of effort by smart people.

Almost everyone I have ever spoken to about this issue agrees that the government’s cyber program is dangerously deficient despite a lot of effort by smart people. However, does the US need an NCA, or something else? Could existing structures be modified to achieve the same goals? These are vital questions that must be asked at this risky moment.

A need for greater authority in cybersecurity

Petraeus and Sridhar acknowledge the Department of Homeland Security’s (DHS) work on cyber to date, but they believe an independent agency could be the vehicle for realizing a much-needed strengthening of the cybersecurity posture of the United States. In their view, the DHS cybersecurity strategy is late to the game.

Image result for general david petraeus

General David Petraeus

“The organization lacks a sufficient ‘brand’ to recruit and retain top talent,” the Op-Ed states, adding, “Many companies have proven reluctant to collaborate with it.”  According to Petraeus and Sridhar, “As the head of an independent agency, the director would report directly to the president and have the ears of members of Congress to get much needed legislation.”

The Op-Ed also states, “The prestige of a new agency and the cultural shift it would drive would also allow it and, hopefully, the rest of government to build the public-sector talent base we need.” The proposed NCA would, per Petraeus and Sridhar, would provide “an effective coordinating body with the authority to convene companies and government agencies at all levels.”

 

According to Petraeus and Sridhar, “As the head of an independent agency, the director would report directly to the president and have the ears of members of Congress to get much needed legislation.”

 

Praise for the NCA concept from the cybersecurity industry

Cybersecurity industry veterans, many of whom have transitioned from government service to the private sector, expressed a range of opinions about the proposed NCA. Some favor the idea. Roman Arutyunov, Co-Founder and VP Products at the ICS security vendor Xage Security, said, “As industries become more interconnected with networks and digital systems sharing information, there needs to be a consistent cybersecurity policy and regulation framework across industries. An NCA could be potentially helpful in accomplishing this goal.”

Hopefully we don’t have to endure a Cyber Pearl Harbor to spur lawmakers into action.

Steven Sprague, CEO of Rivetz, which offers multi-factor authentication solutions, added, “Building an agency focused on strong cyber defense and investing in a transition to only known devices connected to sensitive networks and data would be a strong step forward.”

“Building an agency focused on strong cyber defense and investing in a transition to only known devices connected to sensitive networks and data would be a strong step forward.”

According to Tamara Anderson, VP of Corporate Strategy and General Counsel at PAS, Global, which works in ICS security, “Consolidating the various federal cyber operations into a highly-functional, focused and coordinated organization is imperative.” She noted, however, “Rather than creating a hard-handed, authoritative regulating body, it’s crucial that a new cybersecurity agency collaborate effectively with the private sector, which serves as the guardian of 85% of our critical infrastructure assets.”

Jeffrey Buss, Captain USN (Retired) who ran the US Naval Academy’s Center for Cyber Securities Studies, explained, “No fault to the dedicated folks DHS who are currently tasked with this, it is just not enough and the policies and laws to ensure the successful defense of our citizens in cyber are lacking.  Hopefully we don’t have to endure a Cyber Pearl Harbor to spur lawmakers into action.”

Concerns about the viability of an NCA

A number of industry executives I spoke with expressed concerns about the viability and efficacy of a hypothetical NCA. The big question that emerged from these conversations went something like, “Should we stick with the DHS, which is already positioned to do what the NCA might be able to do, or create a new agency?” For instance, Duncan Greatwood, CEO of Xage, commented, “There is already significant information and advice sharing between industry and government, usually spearheaded by DHS and FBI together on the government side, and various consortia on the industry side.”

I put this question to General Petraeus via email. He replied, “I think my OpEd is quite clear about why the NCA needs to be pulled out from under DHS and established as an independent agency, Hugh…  Please reread the assessment of DHS in it….” I love the use of my first name. That must come from DoD media training.

I put this question to General Petraeus via email. He replied, “I think my OpEd is quite clear about why the NCA needs to be pulled out from under DHS and established as an independent agency, Hugh…  Please reread the assessment of DHS in it….”

In any event, many industry experts were highly skeptical of the NCA concept. Scott Petry, CEO and Co-Founder of the secure browser vendor Authentic8, while acknowledging that General Petraeus makes a compelling case for better coordination of cyber security practices to protect critical infrastructure, felt “His argument that the failure is based on poor coordination and lack of resources doesn’t ring true.” As he explained, “In fact, a simple timeline review of high-profile data breaches within government organizations – from OPM to DNC, and commercial breaches like Sony show that responsible parties were suitably warned of their exposure – by FBI, by OIG, or others.  To no avail.”

Terry Ray, CTO of Imperva noted, that the US has many existing regulatory oversight schemes in place for critical infrastructure. As he put it, “I don’t know whether, yet another three-letter agency, even one specifically tasked, would solve this problem, but I do agree that what legislators and existing agencies are doing today is not working. Should we continue to do the same thing, yet expect a different or better outcome?”

“I don’t know whether, yet another three-letter agency, even one specifically tasked, would solve this problem, but I do agree that what legislators and existing agencies are doing today is not working.”

“People I know within the critical sectors acknowledge that things aren’t perfect, but also believe that DHS has made some noteworthy progress in tackling several of the problems raised by General Petraeus,” remarked Katherine Gronberg, Vice President for Government Affairs at the access control and endpoint security company ForeScout. “Having a new, standalone agency may only add to the noise since other existing cyber functions (FBI, DHS, DoD, IC, Energy, etc.) will continue to exist.”

She added, “Similarly, creating a new agency isn’t going to change the fact that our critical infrastructure is owned and operated mostly by private entities. It just gives them a new touchpoint within the federal government that doesn’t have the track record of liaising with the private/critical sectors that DHS has established.”

One major advantage of DHS over a standalone NCA is its “whole hazard” approach to critical infrastructure risks. This was the point of view expressed by Suzanne Spaulding, a former DHS undersecretary who now serves as an advisor to King & Union, the cybersecurity solutions provider. As she put it, “DHS works across multiple agencies and private companies to ensure that goods and services relied on by the US public will be there when they need them.” This might mean coordinating with FEMA and Treasury, for example. An NCA might replicate or complicate such arrangements.

A separate cabinet level agency like the proposed NCA would become a “cyber stove pipe” that actually makes the government’s capabilities more, not less limited.

Spaulding also worried that a separate cabinet level agency like the proposed NCA would become a “cyber stove pipe” that actually makes the government’s capabilities more, not less limited. “There has to be a holistic risk assessment,” she said. She also pointed out that in the inevitable year or two it would take to reorganize and build the NCA, the US would lose cybersecurity focus.

 

The government cyber conundrum

The question of whether the US needs an NCA reflects a much broader problem, which is the potential (and limits of potential) for government to protect the country from cyber threats. Petraeus and Sridhar are definitely onto something when they say, “The solution isn’t just to try harder. We need to acknowledge that cyberthreats have reached a new level, and that they need to be addressed in a new way.”

What they get right, and what they’re channeling, is the widely held view that the US is fundamentally unprepared and vulnerable. And, that existing efforts, no matter how well-intentioned and thought out, are not adequate for defense. A higher-profile agency might address this issue, but it could easily make things worse.  Even the dialogue presented in this article reveals the potential for bureaucratic infighting and disorganization that could achieve the exact opposite of the NCA’s intent.

It’s a conundrum. The government alone can’t make us secure. Industry alone can’t do it, either. Working together is a good idea, but challenging to execute. The real opportunity, which is implied in the Op-Ed, comes from the idea that an individual Director, or a team of respected people, could drive the change we all know we need.

If someone that most Americans trust and respect (like General David Petraeus) stands up and says, “cyber is our number one threat and we’re going to change the way we deal with it,” that might have the desired effect on the government’s cybersecurity posture. On the other hand, if an NCA devolves into another Washington turf battle, it will send things in the wrong direction.

Photo Credit: cmfgu Flickr via Compfight cc

Black Hat 2018: Understanding Government Cyber Policy

Even the most tech savvy among us get caught flat-footed once in a while. For Justin Cleveland, head of government business at Authentic8, it was an experience at home. Cleveland arrived at his house to find a dozen boxes from Amazon.com on his doorstep. Not having ordered anything, he asked his wife what she had bought. Nothing. She had no idea what he was talking about. It was then that Cleveland and his wife noticed their 4-year-old daughter standing in the corner, her expression somewhere between alarmed and proud of herself.

“Did you ask Alexa for something?” they asked her.

Justin Cleveland

“I wanted some new dolls,” the girl replied. “Alexa said she would get them for me.” Mystery solved, but oh boy… The fact that Cleveland, who logged a decade in the intelligence community, could be outsmarted by a toddler and a home shopping assistant is very revealing in this day and age.

Do we ever truly understand what’s going on behind the scenes? Certainly, things are not always as they appear. Authentic8 approaches this problem through a secure browser. Authentic8 sets up a buffer between the machine, user and the external Internet. “Using the web puts your machine into contact with many unknown entities,” said Cleveland. “Regardless of what security tools you have, you really have no idea what code is being loaded onto your machine, and what data you are exposing to the outside world when you surf the net. Yet, there’s no way to control it, unless you establish a secure browsing presence.”

Cleveland’s job is to interest government agencies in the merits of secure browsing. Government personnel are online like everyone else, exposing their employers to zero day attacks and a variety of advanced persistent threats. Cleveland is finding strong interest in secure browsing in the government sector as the government, in his view, has become increasingly serious about cyber security. The Department of Defense, for example, has begun tightening controls governing data management by defense contractors. This is a topic we have covered previously.

According to Cleveland, government cyber security policy is still uneven, however. “It depends on the department,” he observed. Some agencies assume a leadership role in policy setting and standards of policy enforcement. He cited the example of the Customs Service inside the Department of Homeland Security. “They establish a path forward on cyber, and other agencies inside DHS follow their lead.”

Politics affect the process of securing the government, Cleveland also noted. “It’s inevitable, but it can be frustrating,” he observed. “There is more emphasis on sharing threat data today, and progress is being made on that front, but things could be going a lot more smoothly.” In the meantime, he’s advocating for secure browsing as a countermeasure for unknown threats.

Photo Credit: Virvatulia Flickr via Compfight cc

 

 

Privacy Policy