• Basic principles of information security
• Awareness of information security threats and risks
• How to recognize and react to unexpected risks and security events
• How to report suspicious activity
• Builds a security culture throughout the organization

Techniques to keep security awareness fresh in user minds include:

• Ensure executive and management support. When top executives and management provide noticeable vocal support, it provides a sense of the importance of information security organization-wide.
• Use awareness aids such as posters, newsletters, email tips, blogs, and other reminders. People are different and learn in different ways. Using different types of aids helps ensure that the message gets through to employees in many different areas of the organization.
• Focus on changing behaviors. The goal is to create a culture of security. One way of doing this is relating awareness to employee’s personal life, family, and home. This allows employees to share security materials and information outside of work with family and friends making information security a part of their personal life as well. Make awareness engaging or interactive. This can often be fun for employees.
• Solicit ideas and feedback. Ask employees how security awareness can be improved. This gets employees directly involved in security programs.
• Measure success and growth. Track training completion. Get feedback on what employees like about training and what could use improvement.

References

Johnson, R. (2015). Security Policies and Implementation Issues (2nd ed.). Burlington, MA: Jones & Bartlett Learning.

Lohrmann, D. (2014, March 09). Ten Recommendations for Security Awareness Programs. Retrieved September 20, 2017, from http://www.govtech.com/blogs/lohrmann-on-cybersecurity/Ten-Recommendations-for-Security-Awareness-Programs.html.

The post Basics of Security Awareness: Users are the Weakest Link appeared first on .

The SANS Reading Room article, SANS Survey on Mobility/BYOD Security Policies and Practices found that 61% of organizations allowed personal devices to connect to protected company systems, but only 9% of organizations were truly aware of the particular devices that were connecting to protected systems, and what resources they were accessing. Of all the organizations polled, 60% responded that they have a risk program in place, but 50% of those did not have BYOD Acceptable Use Policies in place even though 95% of those surveyed stated they understood the importance of having a robust policy in place.

The SANS survey specifically mentioned that respondents listed that the most critical practices to implement included; data protection and encryption, secure access to corporate resources, knowing what sensitive data that personal devices can access, and requiring end point protection such as anti-malware, mandatory updates and patches, data loss prevention, and secure web browsing. Other practices not commonly mentioned in the survey included mandatory user education, application white and black listing, and secure distribution of applications, example; corporate app store, keeping an inventory of installed apps, and mandatory “sandboxing”.

In addition to standard end-point controls, organizations should also practice secure network control, example; Virtual Private Networks (VPN), authentication to access data, and encrypting data in motion and at rest.

In conclusion, research shows that most organizations currently rely on traditional tried and true security controls when dealing with BYOD connections to protected systems. What was of note is that control over access can often be inconsistent and decentralized. Often the fall back or backup control was policies that did not specifically address BYOD. Often organizations do not have an organized and centralized way to secure BYOD access. Fortunately, many organizations are starting to respond to BYOD security concerns by implementing stronger policies and mobile-focused controls.

References

Johnson, K., DeLaGrange, T., & Filkins, B. (2012, October). SANS Survey on Mobility/BYOD Security Policies and Practices. Retrieved September 3, 2017, from https://www.sans.org/webcasts/survey-results-byod-security-policies-practices-95940/.

Johnson, R. (2015). Security Policies and Implementation Issues (2nd ed.). Burlington, MA: Jones & Bartlett Learning.

The post Bring Your Own Device (BYOD) Policies and Practices appeared first on .

Insider security threats are the most significant threat to today’s information systems. Insiders often have elevated access within an organizations information systems which often gives them a level of authorized access that can cause a lot of damage if misused intentionally, or unintentionally.

In the SANS Reading Room article; Insider Threat Mitigation Guidance, Balakrishnan & Northcutt explain that mitigating insider threats is often a complex procedure that requires meticulous planning.  Organizations should tailor their approach to ensure that mitigation techniques meet the organizations unique needs.

Balakrishnan & Northcutt lay out a 13 step Insider Threat Mitigation Program (ITMP) road map developed by the Intelligence and National Security Alliance (INSA) as a framework for identifying and mitigating insider threats. This framework maps insider threats to mitigation controls published by the Community Emergency Response Team (CERT), and the National Institute of Standards and Technology (NIST) threat programs and best practices. The ITMP framework steps are as follows

Step 1: Initial Planning. CERT Program components include; establish insider threat program and framework, implement planning, and formalize the program. CERT best practices used are a formalized insider threat program, and asset identification and control. NIST best practices are asset management.

Step 2:  Identify stakeholders. CERT practice is to identify all areas of the business affected.

Step 3:  Leadership buy-in.

Step 4:  Risk Management. CERT program components are enterprise risk management integration. Best practices include considering all insider threats enterprise-wide, and identifying a risk management program.

Step 5:  Detailed project planning.

Step 6:  Develop Governance Structure, Policy, and Procedures. Program CERT components are Policies, Procedures, and Practices, and protection of employee civil liberties and rights. Best practices include:

• Document and consistently enforce policies
• A hiring process that screens employees for disruptive behavior
• Anticipate and manage negative issues in the work environment
• Implement and enforce strict password and management policies
• Enforce principles of separation of duties and least privilege
• Explicit Service Level Agreements (SLA)’s for all vendors and cloud services
• Stringent access controls
• Institutionalize system changes
• Comprehensive employee termination procedures
• Stringently monitoring social media content

Step 7:  Communication training and awareness. Components are training and awareness, and communicating insider threats. Best practices include insider threat and awareness training, and communication response.

Step 8:  Develop detection methods. Components are prevention, detection, and response. Best practices include establish baselines, monitor and close data exfiltration holes, monitor and detect anomaly events.

Step 9:  Data and tool requirements. Components are data collection and analysis. Best practices include Security Information Event Management (SIEM) that encompasses logging and auditing of systems, and protecting access controls and auditing technology.

Step 10:  Data fusion. Component is data collection and analysis.

Step 11:  Analysis and incident management. Components are incident response and reporting. Best practices include response and mitigation analysis.

Step 12:  Management reporting. Components are program compliance and effectiveness oversight.

Step 13:  Feedback and lessons learned. Best practices include recovery planning, improvements, and communications.

Overall it is widely recognized that insider threats are the most prevalent and damaging which is line with what both Johnson (2015), and Balakrishnan &Northcutt (2015), have examined and supported. Organizations spend great amounts of money on technical controls such as firewalls, Intrusion Detection (IDS) systems, and anti-malware, but these controls lose much of there benefit when uneducated or careless users click on a phishing email links or exhibit other risky behaviours. Other technical controls can limit the damage, but an organization can still find itself spending a lot of time repairing damage caused by insider threats.

References

Balakrishnan, B., & Northcutt, S. (2015, October 06). Insider Threat Mitigation Guidance, GIAC  GLEG Gold Paper. Retrieved August 25, 2017, from https://www.sans.org/reading-room/whitepapers/monitoring/insider-threat-mitigation-guidance-36307room/whitepapers/monitoring/insider-threat-mitigation-guidance-36307room/whitepapers/monitoring/insider-threat-mitigation-guidance-36307.

Johnson, R. (2015). Security Policies and Implementation Issues (2nd ed.). Burlington, MA: Jones & Bartlett Learning.

The post Mitigating Insider Security Threats appeared first on .

The Dot Com crash of 2000 and corporate scandals such as Enron highlighted the need for better laws to oversee financial organizations, and also highlighted the need for better corporate governance. IT Governance is the part of corporate governance that includes policies, procedures, and controls that relate to information systems use, performance, Return on Investment (ROI), and risk mitigation

When a company moves services to the cloud it must naturally extend its IT governance to include cloud-based systems and services. Governance includes policies, procedures, and controls that ensure confidence in the accuracy and security of the cloud-based systems, and also ensures the strategic alignment of cloud-based systems with the organizations goals. A key component of the governance process begins with Service Level Agreements (SLA)’s that specify contractual obligations that a cloud vendor must provide and adhere to. One important governance issue that is normally specified in a SLA is limited liability provisions. Fox (2015) states that customers generally want service provider’s liability responsibility to include, among other obligations, coverage for claims arising out of the following:

• Allegations that the cloud services provided by the vendor infringe upon, or violate, the intellectual property or other proprietary rights of any third party.

• Negligence or willful misconduct of the cloud service provider, including its contractors and agents.

• Claims that the cloud service provider including its contractors and agents caused any bodily injury to the customer’s staff, or property damage to the customer’s property.

• A breach of any of the cloud service provider’s data or system security as well as any other customer data privacy obligations.

In contrast, cloud service providers usually try and reduce the scope of their liability towards customers by attempting to negotiate SLA provisions in their favor, for example, trying to limit its liability obligations to customers using a cap on the amount that it is obligated to indemnify the customer for. Customers who agree to caps run the risk of being held accountable for damages that exceed the cap limit even if the damages can be attributed to the provider, provider contractors, and other third-parties that may be associated with the cloud provider (Fox, 2015).

Summary

Regarding the governance of cloud-based systems, it is of utmost importance that customers clearly understand that if their IT systems are hosted on a cloud-based system, their IT governance extends to include those systems. Service Level agreements with cloud providers are a method that organizations can use to extend that governance to cloud-based systems which specifies a level of service that a vendor agrees to provide, and contains provisions that specify items such as liability.

References

Fox, A. (2015, May 07). Common Mistakes Made by Customers and Service Providers when Negotiating Cloud Services Agreements. Retrieved August 10, 2017, from Association of Corporate Counsel, http://www.acc.com/legalresources/quickcounsel/negotiating-cloud-services-agreements.cfm.

Disclaimer

The post The Governance of Cloud-Based Systems appeared first on .

Threats to both cloud-based and on-site solutions should be evaluated with an additional focus directed towards security issues specific to cloud services. Cloud security threats can come from internal or external sources, and can originate as human or software based attacks. Threat agents are as follows; anonymous attackers, malicious service agents, trusted attackers, and malicious insiders. The following is a list of common security threats to cloud-based environments and methods that can be used to mitigate them.

• Traffic eavesdropping. This is a passive attack that can occur when data is being transmitted between cloud services and clients. This include actions such as packet sniffing which examines data in transmission packets, and Man-In-The-Middle (MITM) attacks where an attacker intercepts transmission packets, then can alter messages before forwarding them to their destination.  A MITM attack commonly uses a technique called ARP spoofing. Example, trick user 1 computer into thinking that it is communicating with user 2 computer, and vice versa. To prevent these types of attacks communications between machines should take place over Virtual Private Networks (VPN) when possible. Another mitigation strategy is to ensure communications use Secure Socket Layer (SSL) protocols. Example, web traffic using HTTPS instead of HTTP.

• Denial of Service. Denial of Service (DoS), and Distributed Denial of Services (DDoS) occur when an attacker uses one or many different computers to send a bombardment of message traffic to a system to try and overwhelm it’s resources and take them out of use. Defending against DoS and DDoS attacks is difficult and common strategies to mitigate them usually apply only after the attack has started and caused problems. The best defense against these types of attacks are specialized network firewalls designed to track and recognize DoS attacks, and the use of a number of reverse proxy mechanisms. Reverse proxies determine if incoming traffic is legitimate and allows or drops the incoming packets accordingly.

• Insufficient Authorization. This attack occurs when access or unauthorized levels of access are granted to an attacker in error. This can occur from weak authentication vulnerabilities related to weak passwords or shared accounts. The best protection against this threat includes both logical and physical security controls. Logical controls include administrative policies such as password policies, use firewalls and keep them updated, and auditing of systems. Physical controls include keeping system equipment in locked spaces with controlled access.

• Virtualization Attacks. Since cloud service providers often grant customers administrative rights to virtualized resources, this means they might also be used to attack underlying IT resources. This attack is commonly known as hyperjacking and it is directed towards the virtualization hypervisor software layer where an attacker will try and get control over the hypervisor and gain access to the underlying hardware. Controls such as separate Virtual Local Area Network (VLAN) connections for each service, and the use of separate management networks are the most effective way to mitigate hyperjacking attacks. Example, keep web facing traffic separate from internal traffic, and keep management interfaces on networks separate from all other services.

• Overlapping Trust Boundaries. Since cloud services often share resources among many different customers great care must be taken in establishing boundaries between them. Attackers can target shared resources with the intention of compromising other customers, or the underlying infrastructure as a way to get access to other customers resources. This attack can also include guest-hopping. This is an attack where an attacker might have access to one Operating System (OS), and use that access to try and compromise a different OS within the same cloud system. Establishing secondary private VLANs for each entity provides traffic isolation and is the ideal method for mitigating this threat.

• Malicious Employees. Staff such as software developers often has extensive access to systems which can be misused by disgruntled or terminated employees. Moving services to the cloud reduces this risk with local employees, but cloud service staff still require a stringent screening. Malicious insider threats can be mitigated by using access controls, policies and enforcement, and layered security. Examples; Access controls should be put in place so employees and third-parties can only access specified information and systems. A policy that would explain that when employees and contractors fail to comply, they could face termination of their employment or contractual relationship and lawsuits depending on how the information was misused. Taken together these methods form layered security.

• SQL Injection. This type of attack is directed towards trying to compromise or gain control over database servers and databases. It commonly takes advantage of form type data being sent from a client such as a web browser to an application database server. The attacker alters “injects” their own SQL commands into the data being sent to the server in order to get control of the server, or force the server to divulge data within the database. Controls to mitigate SQL injection threats include; use parameterized queries, use stored procedures, include code that escapes all user supplied input, enforce the concept of least privilege on user access, and the use of white lists to validate user inputs.

• Compromised Interfaces and API’s. APIs and interfaces are commonly the most exposed part of a system because they’re usually accessible from the open Internet. The use of separate VLAN’s for API and management traffic is the most effective method of mitigating this threat.

• Data Loss. Cloud providers generally provide multiple layers of redundancy and extensive data replication. Although a rare occurrence, data loss due to provider error or system problems can still occur. Cloud providers recommend distributing data and applications across multiple zones as additional protection against this threat.

• Loosely defined service contracts. Sometimes organizations do not fully understanding cloud provider contracts and environments and encounter many commercial, financial, technical, legal, and compliance risks. The Cloud Security Alliance (CSA) states that organizations must perform extensive due diligence to understand the risks they assume when they subscribe to a cloud service as the primary mitigation strategy for this risk.

Conclusions

Cloud-based services are exposed to many of the same threats that on-site services are. To protect against these threats, the use of established and proven mitigation strategies should be applied. It is important to recognize though that cloud-based environments are subject to additional threats such as virtualization attacks that do require additional assessment and controls to mitigate the additional security risks. If the common and specific security risks are both properly mitigated, cloud-based services should be just as safe to use as on-site services.

References

Berry-Tayman, L. (2015, January 16). 3 Ways to Protect Your Company Against Malicious Insiders. Retrieved July 28, 2016, from http://idt911.com/education/blog/3-ways-to-protect-your-company-against-malicious-insiders.

Burns, S. (2015, August 05). Virtualization Security Tips: Preventing Hyper Jumping. Retrieved July 28, 2016, from http://www.tomsitpro.com/articles/virtual-security-tips-hyper-jumping,2-776.html.

CloudPatterns. (n.d.). Data Link and Network Layer Trust Boundary Isolation. Retrieved July 28, 2016, from http://cloudpatterns.org/candidate_patterns/data_link_and_network_layer_trust_boundary_isolation.

Hargrave, V. (2012, November 28). What Are Man-in-the-Middle Attacks and How Can I Protect Myself From Them? Retrieved July 28, 2016, from http://blog.trendmicro.com/what-are-man-in-the-middle-attacks-and-how-can-i-protect-myself-from-them/.

OWASP Prevent SQL Injection. (2016, May 25). SQL Injection Prevention Cheat Sheet. Retrieved July 28, 2016, from https://www.owasp.org/index.php/SQL_Injection_Prevention_Cheat_Sheet.

Rashid, F. (2016, March 11). The dirty dozen: 12 cloud security threats. Retrieved July 27, 2016, from http://www.infoworld.com/article/3041078/security/the-dirty-dozen-12-cloud-security-threats.html.

Schultz, G. (2006, August 03). Top 10 ways to secure your stored data. Retrieved July 28, 2016, from http://www.computerworld.com/article/2546352/data-center/top-10-ways-to-secure-your-stored-data.html.

Weiss, A. (2012, July 02). How to Prevent DoS Attacks. Retrieved July 28, 2016, from http://www.esecurityplanet.com/network-security/how-to-prevent-dos-attacks.html.

Disclaimer

The post Security Threats to Cloud–Based Systems appeared first on .

Risk management is essential to the success of every company

Revised July 1, 2023

Risk is an inherent aspect of business operations, representing the likelihood of a loss occurring when a threat exposes a vulnerability. While organizations need to take risks to thrive, they must also recognize the importance of managing those risks. To effectively mitigate risks, it is crucial to understand the threats and vulnerabilities involved and take appropriate measures to reduce vulnerability or minimize the impact of the risks. Consider the following risk-related concerns:

1. Compromise of Business Functions: The activities performed by a business to sell products or services can be negatively affected by threats. If these essential functions are compromised, the organization may experience a significant loss of revenue.
2. Business Assets: Business assets encompass anything of measurable value to a company, which can be tangible or intangible. This includes items such as repair costs, lost revenue, loss of future revenue, cost of gaining customers, customer influence, IT system equipment, network equipment, software, and data. Protecting these assets is vital for the overall well-being of the organization.
3. Driver of Business Costs: Risk management controls add an additional cost to running a business. While managing risks is essential, it is crucial to strike a balance between risk mitigation and cost-effectiveness in order to optimize business operations.
4. Profitability vs. Survivability: Profitability reflects a company’s ability to make a profit, while survivability refers to its ability to withstand losses resulting from risks. It is important to allocate funds for risk mitigation while considering their impact on profitability. Risk management should involve weighing the cost of risk controls against the potential threats that can jeopardize the company’s survivability. Over-investing in risk controls can hinder profit generation and fail to adequately address significant threats, potentially leading to business failure.

The National Institute of Standards and Technology (NIST) Special Publication 800-30 provides a guideline for applying risk management frameworks to federal information systems. This publication emphasizes that organizations heavily rely on information technology and systems to carry out their missions and business functions. Recognizing the growing danger posed by threats, it is crucial for leadership at all levels of an organization to prioritize the management of information system-related security risks and implement well-defined risk management systems.

In summary, since risk can result in losses that negatively affect business functions and even cause a business to fail, implementing a comprehensive risk management program is essential for the success and sustainability of every company.

References and Related Articles

https://csrc.nist.gov/publications/detail/sp/800-37/rev-2/final

https://www.forbes.com/sites/steveculp/2020/10/01/why-risk-management-is-more-important-than-ever/?sh=7ee5469a30b6

Additional Articles

Sarbanes-Oxley Act (SOX): Strengthening Financial Reporting and Accountability

Compression of Network Data and Performance Issues

Cloud Architecture Models

Exploring the Implications of Artificial Intelligence

Artificial Intelligence in Texas Higher Education: Ethical Considerations, Privacy, and Security

Note: This article has been drafted and improved with the assistance of AI, incorporating ChatGPT suggestions and revisions to enhance clarity and coherence. The original research, decision-making, and final content selection were performed by a human author.

Disclaimer

Terms and Conditions of Use

The post Risk management is essential to the success of every company appeared first on .