Vendor Risk Management - Remember their security practices will affect your security posture. An attacker this week simultaneously encrypted endpoint systems and servers belonging to all customers of a US-based managed service provider by exploiting a vulnerable plugin for a remote monitoring and management tool used by the MSP

The attack resulted in some 1,500 to 2,000 systems belonging to the MSP's clients getting cryptolocked and the MSP itself facing a $2.6 million ransom demand

In this case, the executable was Gandcrab, a widely distributed ransomware tool that has been used in numerous previous attacks. All customer systems that the MSP was managing via the Kaseya RMM tool were encrypted simultaneously, locking users out of them.

Attacks on MSPs are a growing concern. Recently, threat actors, some sponsored by nation states, have begun targeting MSPs in an attempt to get to the networks of their clients.

https://www.darkreading.com/attacks-breaches/ransomware-attack-via-msp-locks-customers-out-of-systems/d/d-id/1333825

STATS for RISK based security - IT professionals listed sysadmins as the biggest threat (42%) followed by C-level executives (16%).

While these executives typically have  limited IT skills, their credentials are worth more to hackers than any  other group.

Other targets:

1. Social engineering - HR and finance departments are the easiest targets.
2. Insider risk - IT staff.

For More:
https://www.infosecurity-magazine.com/news/it-staff-blame-themselves-for/

5 Tenets of Cyber Security

Sweet and Simple (but , rarely followed)

Your organization does not exist to be secure, it exists to get things done.

Amateurs mitigate risk, professionals manage risk. If you are confused by the difference, you need to read some of Bruce Schneier's books. There are three ways to manage risk: you mitigate it, you accept it or you transfer it

Risk is the likelihood of an incident times the harm of that incident. Likelihood is made up of Threats and Vulnerabilities

Our job is to support the organization's mission. That means when dealing with a cyber security challenge, you may not be the one to make a decision


Managing risk is based on three core areas: Technology, Process and People.
We have hit the point of diminishing returns with Technology but continue to fail in the Process and People side.

For More:
https://securingthehuman.sans.org/blog/2017/10/05/the-five-tenets-of-cyber-security/

Communicating Risk to Executive Leadership -Common problem with security folks.

The article starts with the following

“I don’t get it!” said the CEO as he dropped the 300 page report on the conference table.

Our reports may not be 300 pages but our inability to speake the executive language is the issue.


According to the article:- 

Common complaints (from them) we heard, included:

• “Why does it take so long? “
• “I thought we had security controls in place to take care of this stuff?”
• “How do we fix these problems?”
• “What do these risk numbers mean? Are we in danger or not?”
• “This is just busywork to keep the regulators happy.”

Challenges with current risk management techniques.

Challenge 1 – Difficult in Assigning Value
Challenge 2 – Risk and Security Language is Incomprehensible to Leadership
Challenge 3 – Numbers Can Deceive
Challenge 4 – Risk Data Gets Stale Quickly



Solutions:

Talk Like an Executive
Use Emotional Words Sparingly
Deliver Intelligence, Not Data
Communicate in the Now


How to Improve the Risk Conversation:

Step 1 – Agree on Six Words (Threat, Vulnerability,Control,Impact,Probability,Risk)
Step 2 – Establish a Lens (A lens is way to break-down a larger whole into manageable chunks)
Step 3- Express Security Issues in Terms of Threat
Step 4 – Get Data, Put it in the Backseat
Step 5 – Simplify Impact and Probability
Step 6 – Embrace Simplicity and Brevity in Reporting



The link below has more information:-

http://blog.anitian.com/communicate-risk-to-executives/

Analysis of 3 billion attacks - No surprising results , companies are big part of the problem

Result state that many basic processes and procedures that companies are failing to implement are a major contributor for the problem.

Look at the solutions, not one of them is ground breaking. All of them are common sense solutions. They all need long term planning, patience and realistic metrics to measure their success.

It is not easy but, not impossible. When the stakes are high, what are our choices?

According to the article:- 

NTT has pooled the resources of its group companies and produced a threat report based on an analysis of 3 billion attacks.

NTT makes four primary proposals. 

Companies should still protect their perimeter, even thought that perimeter is continuing to change and shrink. The primary tool here is still up-to-date anti-virus. Although this would seem to be a given, NTT notes that "43% of incident response engagements were the result of malware against a particular end point," and that significant factors "were missing basic controls, such as anti-virus, anti-malware and effective lifecycle management."

Patch management needs to be improved. While accepting that this is not easy, and that "timely installation of every patch on every system is often impractical," the report stresses that companies must be aware of the issues "and need to ensure they are prioritizing countermeasures against these exploits."

Business needs to define and test incident response. "Too many organizations have untested, immature or non-existent incident response programs. This makes them unprepared for the inevitable attack." Appropriate incident response, it says, "is critical to minimize the impact of security breaches."

Business must learn to be as fast in exploiting new defense technologies as criminals are in exploiting new attack vectors. "The speed of exploit weaponization is increasing," says NTT, "and may surpass an organization’s ability to respond quickly and effectively (if it has not already). New technologies include capabilities such as application isolation techniques, micro VMs, sandboxing and machine learning. 

The link below has more information:-

http://www.infosecurity-magazine.com/view/37678/analysis-of-3-billion-attacks-demonstrates-security-gap-between-attack-and-defense/

Wearable Tech - ISACA article on associated security Risk and Tips

SNIPPETS from the Article:-

Some general tips for wearable technology:

1. Allow wearable technology anywhere mobile phones are allowed.

    Ensure workstations and other technology are configured so that random Bluetooth requests cannot       pair.

2. Maintain your software baseline on technology:

        Validate workstation baselines to ensure unapproved software is not present.

        Ensure your software baseline does not allow installation of wearable technology clients.

3. Develop a policy that distinguishes smartwatches from health monitors:

        Bluetooth should be an acceptable risk if compensating controls are in place.

        Cameras should not be allowed in high-assurance areas.

The links below has more information:

http://www.isaca.org/About-ISACA/-ISACA-Newsletter/Pages/at-ISACA-Volume-6-12-March-2014.aspx?cid=1003960&Appeal=EDM#1