(From Twitter)For Infosec Pros who blame users -

Users: you gave us USB ports, but told us not to plug anything into them.

You tell us "Don't open links." But let's be real: if it was easy to spot a malicious link, you'd have already blocked it.

You tell us "don't open attachments" but it's something we HAVE to do for our jobs. Again, if spotting the malicious attachment was easy, why did you, the professionals, let it get to my inbox?

Is it time to move away from "AppSec" to "Software Security"?

If , you agree with the following statements are true:

1. Software is the umbrella for anything written in code; an application is a component of software and just as vulnerable.
2. Applications allow a user to perform a task or activity while software executes that task or activity.
3. Application security came about as initial security testing focused on testing a running application, much like quality assurance testing, and ignored the back-end software components.
4. If something is written in a coding language, then it needs to be tested to ensure it is secure. All software is written in a coding language.
5. Software is the ecosystem of technology while applications are the entry point into that ecosystem.

These four priorities are a good place to start:

1. Organizations need to move beyond the barriers and limitations of traditional gated security approaches and move to a new era of full visibility and control over their software exposure at any stage of the development life cycle.
2. Proper and consistent training should be funded and provided across entire organizations.
3. Remediation efforts need to be made into actionable insights that address vulnerabilities within the entire SDLC.
4. Everyone that touches software and participates in the security of it needs to be forward thinking, forgetting the typical nuances of the past.

https://www.darkreading.com/attacks-breaches/appsec-is-dead-but-software-security-is-alive-and-well/a/d-id/1333096

Security Architecture is more important than adding new security technology

Organizations flock to purchase the latest "next-generation" security technology but meanwhile ignore the basic tenants of security. A mature, secure architecture design does not require the most expensive best-of-breed solutions. However, it does involve taking time to think about one's environment and to design a secure architecture accordingly.

If you take the time to learn about your assets, you will be able to layer in multiple prevention and detection solutions and have a highly effective security architecture

The firewall should also be configured to implement internal layers of network segmentation. Controls should not only face the Internet but implemented to secure authorized access from internal assets to internal assets.


Modern challenges also must be overcome. For instance, consider an intrusion detection/prevention device, web proxy, data loss prevention sensor, network antivirus, or any other Layer 7 network inspection solution. These are all crippled by network encryption


https://www.darkreading.com/cloud/creating-a-defensible-security-architecture/a/d-id/1332169

Interesting Thought (Highly recommended Article) - Modern cars are computers we put our bodies in , whereas hearing aids and pacemakers are computers we put in our body.. This means that all of our sociopolitical problems in the future will have a computer inside them, too.

This is a very long and a well thought out article.
I have extracted a few important points (and this itself is long)



Whether you want to be free—or want to enslave—you need control. And for that, you need this knowledge.

If your world is made of computers, then designing computers to override their owners' decisions has significant human rights implications.

Human rights and property rights both demand that computers not be designed for remote control by governments, corporations, or other outside institutions. Both ensure that owners be allowed to specify what software they're going to run.


Users of computers don't always have the same interests as the owners of computers— and, increasingly, we will be users of computers that we don't own.

it's not a good security approach: if vehicular security models depend on all the other vehicles being well-behaved and the unexpected never arising, we are dead meat.

Self-driving cars must be conservative in their approach to their own conduct, and liberal in their expectations of others' conduct.

DRM and its cousins are deployed by people who believe you can't and shouldn't be trusted to set policy on the computer you own. Likewise, IT systems are deployed by computer owners who believe that computer users can't be trusted to set policy on the computers they use.

When the computer says yes, you might need to still say no.
This is the idea that owners possess local situational awareness that can't be perfectly captured by a series of nested if/then statements.

Soul of Hayekism — we're smarter at the edge than we are in the middle.

it's easy to consider the possibility that there are going to be people — potentially a lot of people — who are "users" of computers that they don't own, and where those computers are part of their bodies.

Consider some of the following scenarios:

• You are a minor child and your deeply religious parents pay for your cochlear implants, and ask for the software that makes it impossible for you to hear blasphemy.
• You are broke, and a commercial company wants to sell you ad-supported implants that listen in on your conversations and insert "discussions about the brands you love".
• Your government is willing to install cochlear implants, but they will archive everything you hear and review it without your knowledge or consent.

Far-fetched? The Canadian border agency was just forced to abandon a plan to fill the nation's airports with hidden high-sensitivity mics that were intended to record everyone's conversations.
Will the Iranian government, or Chinese government, take advantage of this if they get the chance?

Here are four major customers for the existing censorware/spyware/lockware industry: 

1. repressive governments
2. large corporations 
3. schools
4. paranoid parents.

I'm an attorney, doctor, corporate executive, or merely a human who doesn't like the idea of his private stuff being available to anyone who is friends with a dirty cop.

• So, at this point, I give the three-finger salute with the F-keys. This drops the computer into a minimal bootloader shell, one that invites me to give the net-address of an alternative OS, or to insert my own thumb-drive and boot into an operating system there instead.
• The cafe owner's OS is parked and I can't see inside it. But the bootloader can assure me that it is dormant and not spying on me as my OS fires up. When it's done, all my working files are trashed, and the minimal bootloader confirms it

This keeps the computer's owner from spying on me, and keeps me from leaving malware on the computer to attack its owner.

Fundamentally, this is the difference between freedom and openness — between free software and open source.

The potential for abuse in a world made of computers is much greater: 

• Your car drives itself to the repo yard. 
• Your high-rise apartment building switches off its elevators and climate systems, stranding thousands of people until a disputed license payment is settled.

Sounds fanciful? This has already happened with multi-level parking garages.
Back in 2006, a 314-car Robotic Parking model RPS1000 garage in Hoboken, New Jersey, took all the cars in its guts hostage, locking down the software until the garage's owners paid a licensing bill that they disputed.

https://boingboing.net/2012/08/23/civilwar.html








https://boingboing.net/2012/08/23/civilwar.html

Dh0AurDh0P@@nchV33du1@

What do you do when your network perimeter is vanishing?

With Mobile devices, IoT and Cloud where is your perimeter?
Nice Article

Protecting your perimeter today means not only protecting your network edge devices, but also a plethora of internet of things (IoT) and mobile devices.

mobile device management software that authenticates the device by the applications on it, hard-coded IDs and other authentication data.

Identity and access management software also can include user provisioning, compliance auditing, role management, directory services, federated identity, and more.

If you have service accounts with business partners such as could services providers (software, backup, managed security services and other as-a-service providers) banks, local utilities, professional services vendors or others, you need to ensure that the system trying to access your network has not been compromised.

If your company is invested in smart devices such as lights, HVAC systems, security systems, or other infrastructure electronics, these devices generally have no way to update, enhance or often to even install any security. It might seem extreme but hackers have manipulated smart devices to enter corporate networks.

IMPORTANT - Make sure your infrastructure network is completely separate from your corporate data network.

Create policies and procedures for devices that are not on the white list.

The best way to ensure that only authorized devices connect to the network is to know which devices are indeed authorized



https://www.scmagazine.com/is-your-perimeter-secure/article/755177/

what is SOAR? - Security Orchestration, Automation and Response

Another buzzword to sell new products but, will they really do anything useful?
Probably so, here is an interesting essay from Bruce on the "Orchestration" and "incident response" to understand it better

Data does not equal information, and information does not equal understanding



Data does not equal information, and information does not equal understanding

Uncertainty demands initiative, while certainty demands synchronization

When things are uncertain, you want your systems to be decentralized. When things are certain, centralization is more important. Good incident response teams know that decentralization goes hand in hand with initiative.


Automation has its place. If you think about the product categories where it has worked, they’re all areas where we have pretty strong certainty. Automation works in antivirus, firewalls, patch management and authentication systems

For More info:
https://securityintelligence.com/security-orchestration-for-an-uncertain-world/

Very Interesting conversation/debate on PASSWORDS - Highly recommended

Check Here:


https://www.schneier.com/blog/archives/2017/10/changes_in_pass.html

5 Tenets of Cyber Security

Sweet and Simple (but , rarely followed)

Your organization does not exist to be secure, it exists to get things done.

Amateurs mitigate risk, professionals manage risk. If you are confused by the difference, you need to read some of Bruce Schneier's books. There are three ways to manage risk: you mitigate it, you accept it or you transfer it

Risk is the likelihood of an incident times the harm of that incident. Likelihood is made up of Threats and Vulnerabilities

Our job is to support the organization's mission. That means when dealing with a cyber security challenge, you may not be the one to make a decision


Managing risk is based on three core areas: Technology, Process and People.
We have hit the point of diminishing returns with Technology but continue to fail in the Process and People side.

For More:
https://securingthehuman.sans.org/blog/2017/10/05/the-five-tenets-of-cyber-security/

REMEMBER - Data does not equal information, and information does not equal understanding. Very important for Incident Response

From Bruce Schneier's Blog:

Automation has its place in incident response, but the focus needs to be on making the people effective, not on replacing them ­ security orchestration, not automation.

In a world of uncertainty, the focus is on execution. In a world of certainty, the focus is on planning.

When things are uncertain, you want your systems to be decentralized. When things are certain, centralization is more important. Good incident response teams know that decentralization goes hand in hand with initiative. And finally, a world of uncertainty prioritizes command, while a world of certainty prioritizes control.


For More Info:
https://www.schneier.com/blog/archives/2017/03/security_orches.html

Interesting Idea - Add Duress Code to prevent forced unlocking of devices

From the Article:

A key observation from these cases is that the police can compel you to hand over a fingerprint, but cannot order you to tell the police which finger is used to unlock the device. This would be tantamount to ordering you to provide a passcode.

In the short term, Apple and Google can take steps to alleviate this threat by adding duress codes into their access control mechanisms. For instance, scanning anything but your right index finger might force a password-only lock.

In the long term, we need to rethink deploying deniability as a set of strategies for helping users evade coercion in general. What is similarly important is that all devices must have some sort of deniability baked-in, full stop





For more details:
http://www.mit.edu/~specter/articles/17/deniability1.html

IoT is the new frontier - Can the IoT vendors learn anything from a Electric Saw Company?

Good ideas are everywhere. The question is are we looking for them?



From the article:

This is how we need to think from a security perspective.

Safety Cover: There is a plastic safety cover that protects the entire rotating blade. The only time the blade is actually exposed is when you lower the saw to actually cut into the wood. The moment you start to raise the blade after cutting, the plastic cover protects everything again. This means to hurt yourself you have to manually lower the blade with one hand then insert your hand into the cutting blade zone.

Power Switch: Actually, there is no power switch. Instead, after the saw is plugged in, to activate the saw you have to depress a lever. Let the lever go and saw stops. This means if you fall, slip, blackout, have a heart attack or any other type of accident and let go of the lever, the saw automatically stops. In other words, the saw always fails to the off (safe) position.

Shadow: The saw has a light that projects a shadow of the cutting blade precisely on the wood where the blade will cut. No guessing where the blade is going to cut.

Safety is like security, you cannot eliminate risk. But I feel this is a great example of how security can learn from others on how to take people into account.


For more info:
https://securingthehuman.sans.org/blog/2016/10/18/what-iot-and-security-needs-to-learn-from-the-dewalt-mitre-saw

"Think before you Click" - will save us from a lot of trouble but, can we?

Why Phishing still succeeds?

Check out below

Attackers generally take advantage of a combination of five factors when constructing and distributing phishing emails:

1.Timing

Seasonal attacks can be very effective as recipients are likely to be expecting to receive particular messages

2. Emotional status of the target

Attacker might not know which employee is currently under negative stress, there is a good chance that at least one will respond differently due to their level of stress when targeted.

3. Tone of the language used in the email

Specifically design emails to cause alarm but to not give away too much information, hoping instead to prompt the recipient to open the message and follow the instructions within

4. Social media exposure

Many people expose far too much of their personal and professional lives via social networking sites, to the extent that attackers can easily construct a highly convincing message

5. State of mind

Working conditions that lead to exhaustion and/or anxiety can make employees far more susceptible

For More info:

http://www.scmagazine.com/phishing-what-makes-people-click/article/509451/

Three Things You Should Avoid on Public Wi-Fi

Sweet and Simple

1. Personal Banking
2. Credit Card Transactions
3. Anything Involving Personal Information

For More info:
http://www.getcybersafe.gc.ca/cnt/blg/pst-20160630-en.aspx

Interesting - Seven factors that contribute to the normalization of deviance:

Normalization of deviance:

Means that people within the organization become so much accustomed to a deviant behavior that they don't consider it as deviant, despite the fact that they far exceed their own rules for the elementary safety)

 By John Banja , for Healthcare industry.

I am sure it can be generally applied

1. The rules are stupid and inefficient!
2. Knowledge is imperfect and uneven.
3. The work itself, along with new technology, can disrupt work behaviors and rule compliance.
4. I'm breaking the rule for the good of my patient!
5. The rules don't apply to me/you can trust me.
6. Workers are afraid to speak up.
7. Leadership withholding or diluting findings on system problems

For more details:

https://www.schneier.com/blog/archives/2016/01/it_security_and.html

Expert v/s Non-Expert Advice to stay safe online - In one single graph

A picture is worth a thousand words

For More Information:

https://www.usenix.org/system/files/conference/soups2015/soups15-paper-ion.pdf

Security is a process, not a product. - 05/2000 Article from Bruce Schneier

The article is 14 Years old but it still makes sense why?
Because, the answer is in the title of this Blog.



From the article:

Products provide some protection, but the only way to effectively do business in an insecure world is to put processes in place that recognize the inherent insecurity in the products. The trick is to reduce your risk of exposure regardless of the products or patches.

Most products that use security are not designed by anyone with security expertise. Even security products are generally designed and implemented by people who have only limited security expertise. 

Software manufacturers don't have to produce a quality product because there is no liability if they don't. And the effect of this for security products is that manufacturers don't have to produce products that are actually secure, because no one can sue them if they make a bunch of false claims of security.

Security does not have to be perfect, but the risks have to be manageable.



Here are two examples of how to focus on process in enterprise network security:

1. Watch for known vulnerabilities. 
2. Continuously monitor your network products

For more information:
https://www.schneier.com/crypto-gram/archives/2000/0515.html#1

4 strategies that could prevent 85% of targeted high risk vulnerabilities (??)

This is something most sensible security guys always knew.

1. Application white-listing 
2. Patching applications: 
3. Patching operating system vulnerabilities:  
4. Restricting administrative privileges to operating systems and applications based on user duties: 

Check the following link for more details
http://h30499.www3.hp.com/t5/HP-Security-Products-Blog/Can-these-4-strategies-prevent-85-of-targeted-high-risk/ba-p/6744269

Another short-n-sweet advice from Schenier - Lessons from the Sony Hack

If one can condense the wisdom from an entire book then this article would be it.




From the Article

To understand any given episode of hacking, you need to understand who your adversary is, I've learned to separate opportunistic attacks from targeted ones.

You can characterize attackers along two axes: skill and focus

Security is a combination of protection, detection and response. You need prevention to defend against low-focus attacks and to make targeted attacks harder. You need detection to spot the attackers who inevitably get through. And you need response to minimize the damage, restore security and manage the fallout.

Follow this link for additional details:
https://www.schneier.com/blog/archives/2014/12/lessons_from_th_4.html

5 QUESTIONS EVERY CEO SHOULD ASK THEIR CIO / CISO

Nothing hi-tech here, just a few important common sense questions

(from the article)

1. Can we identify unusual user or network activity to cloud services?

2. Can we track who accesses what cloud-hosted data and when?

3. How are we protecting against insider attacks at the cloud service providers?

4. How do we know unprotected sensitive data is not leaving the corporate network?

5. Can we reduce surface area of attack by limiting access based on device and geography?

The link below has more information:-

https://blog.cloudsecurityalliance.org/2014/06/05/dont-get-snowdened-5-questions-every-ceo-should-ask-their-cio-ciso/

If You Are Doing Incident Response, You Are Doing It Wrong

Short but an excellent article that emphasizes on Incident Management 

According to the article:-

By managing incidents rather than responding to them, you:

• Reduce the severity of the incidents that do occur.
• Reduce the number of incidents that do occur.
• Shift from responding to incidents to managing incidents as part of your normal operations
• Reduce unforeseen expenses related to incident investigations
• Increase your visibility within the business, and thus the support for your organization
• Strengthen security posture (Thank you to Corey)
• Reduce stress on your staff and increase their job satisfaction (unless they are adrenalin junkies)

An incident management mindset depends on accepting a truism:

Compromise Is Inevitable – Something truly malicious has been in, is in, and will be in your environment.

The link below has more information:-

http://integriography.wordpress.com/2014/05/06/if-you-are-doing-incident-response-you-are-doing-it-wrong/