jump to navigation

What Coronavirus can Teach us about CyberSecurity February 28, 2020

Posted by Chris Mark in cybersecurity, Data Breach, Industry News, InfoSec & Privacy.
Tags: , , , , , , , , , ,
add a comment

The 2020 RSA CyberSecurity Conference was held recently in San Francisco, California. There were some notable companies that elected to not attend this over safety concerns related to Coronavirus.  On February 25th the mayor of San Francisco declared a state of emergency for their city over Coronavirus fears.

This state of emergency was declared is in spite of the fact that there are no confirmed cases of Coronavirus in the city. Mayor Breed, in discussing her prudent steps stated: “We see the virus spreading in new parts of the world every day, and we are taking the necessary steps to protect San Franciscans from harm…”

First identified in Wuhan, China in late 2019, Coronavirus (covid-19) has reportedly infected over 80,000 people worldwide and has resulted in over 2,700 deaths on several continents. Recently, the World Health Organization identified the newly identified Coronovirus as a potential “Disease X”.  “Disease X” was added to World Health Organization’s “Prioritizing diseases for research and development in emergency contexts” list of illnesses. This list includes such diseases as the Crimean-Congo hemorrhagic fever (CCHF), Ebola and Marburg virus disease, Lassa Fever, MERS, SARS, Nipah and henipaviral diseases, Rift Valley fever and Zika.  Importantly, “Disease X”:

(…represents the knowledge that a serious international epidemic could be caused by a pathogen currently unknown to cause human disease, and so the R&D Blueprint explicitly seeks to enable cross-cutting R&D preparedness that is also relevant for an unknown “Disease X” as far as possible) (emphasis added). 

What can the current Coronavirus situation teach us about cybersecurity?

Reflecting upon the situation in San Francisco and the WHO’s statements, it is possible to utilize the Johari Window to analyze the situation. The Johari Window[1]developed by psychologists Joseph Lutz and Harrington Ingram in 1955 and reintroduced to the American Public in  2012 when then Secretary of State in referencing Iraqi Weapons of Mass Destruction stated:

…there are known knowns; there are things we know we know. We also know there are known unknowns; that is to say we know there are some things we do not know. But there are also unknown unknowns—the ones we don’t know we don’t know…it is the latter category that tend to be the difficult ones.” (paraphrased)

The Johari Window identifies four panes of knowledge.  They include: The “known/knowns” where both the person and others know of a given situation. There is the “Known/Unknown” where the person knows and others do not know of a situation. Consider a personal secret that has not been shared with others. There is then an “Unknown/Known” where the situation is not known the person yet is known to others. In simple terms think of a surprise birthday party where everyone but the birthday boy/girl is aware.  Finally, there are “unknown/unknowns” where neither the party knows.  This is the truest example of an ‘unknown’ and represents, the most difficult situation to analyze because it truly represents a position of ignorance on both parties.

In 2016 the World Health Organization identified that there was a conceptual, although yet undefined threat that was both unknown to others and to themselves but they understood that, theoretically, existed and would present a major risk if and when it was eventually realized.  This, they proactively identified as ‘Disease X’. This was the ‘unknown/unknown’ in the Johari Window until the time that it was identified as Coronavirus.

It is now a ‘known/known’ threat although countries are still struggling to identify how to deal with the risk it presents. Until it was actually realized, however, there was little any country could do except wait until it was realized. Once it was identified, then actual defensive and protective measures could be put into place to address the threat.

In much the same way, organizations dealing with cybersecurity today are presented with the ‘unknown/unknown’ of the conceptual “Disease X” threat in cybersecurity.  This is any yet unidentified and yet predicted threat that may impact their organization in the not too distant future.  Companies are faced with attempting to develop security and continuity plans for a threat that they do not yet know exists and what specifically that threat encompasses.  On a nearly daily basis, however, a ‘Disease X’ arises in cybersecurity and companies are forced to react quickly and decisively to address such threats.  Adding to the threat is the fact that these threats are not naturally occurring and are, in fact, created by humans – intent on creating harm.

Compounding the problem of the ‘unknown/unknown’ is the idea of threat adaptation in known threats.  While not modified by naturally security processes, security strategies, like those of disease control must also deal with threat adaptation. Using the Coronavirus as an example, according to a South China Morning Post article posted on February 4th, 2020 Chinese scientists had already:

“…detected “striking” mutations in a new coronavirus that may have occurred during transmission between family members.” It further states that: “While the effects of the mutations on the virus are not known, they do have the potential to alter the way the virus behaves.”

It has been well established that Influenza virus ‘shift’ and ‘drift’ antigenically.  Without delving into the specifics of how these occur, according to the Center for Disease Control and Prevention, states that:

“When antigenic drift occurs, the body’s immune system may not recognize and prevent sickness caused by the newer influenza viruses. As a result, a person becomes susceptible to flu infection again, as antigenic drift has changed the virus enough that a person’s existing antibodies won’t recognize and neutralize the newer influenza viruses.”

While not a direct corollary to a natural viral drift or shift, human actors respond in a similar way when attempting to commit criminal acts. They ‘adapt’ to the changing security environment and are defined as ‘adaptive threats’.  According to the Department of Homeland Security’s Security Lexicon, Adaptive Threats are defined as:

“…threats intentionally caused by humans.”  It further states that Adaptive Threats are: “…caused by people that can change their behavior or characteristics in reaction to prevention, protection, response, and recovery measures taken.”

In short, as defenses improve, threat actors change their tactics, and techniques to adapt to the changing controls and prevent the established controls from identifying and protecting against the newly adapted threat.  As the threat actor improves their capabilities the defensive actors necessarily have to change their own protections.  This cycle continues ad infinitum until there is a disruption. This recurring cycle is known as the Defense Cycle.

Consider medieval castles.  Originally, they were built of wood.  Those assaulting castles would simply use fire to burn the castles to the ground.  Castle makers then built Castles of stone.  Assaulters then created siege engines to knock down the walls or began digging under the walls to ‘undermine’ them.  Castle walls were made larger and stronger and were nearly impenetrable until cannons were introduced.  Even in situations where the attackers could not ‘storm the castle’ they would simply lay siege and starve the inhabitants until they capitulated.  This is a classic example of threat adaptation and the defense cycle.

In a more relevant and timely example consider a standard network with security controls applied commensurate with the identified risks. An attacker may try an attack against the network layer.  If this is ineffective and the incentive is great enough the attacker will likely modify their behavior and attack methodology to attempt to circumvent some other control.  This process continues until a resource has been compromised.

Applying the concepts addressed in this article, a newly identified or developed exploit is the proverbial “Disease X”.  As it has not yet been identified, the organization has no definitive defense against it. Once it is identified and known, then the company can begin identifying new controls to address the newly identified risk. The attacker will then, once again, modify their behavior.  As stated, this cycle can continue ad infinitum.

In 2020, organizations are dealing with myriad threats.  First there are the ‘unknown/unknowns” that represent the “Disease X”of the cyber attack world.  These may include new attack vectors, or zero day exploits.  Secondly, organizations are faced with defending against motivated, determined adversaries who are not only is focused on attacking networks and resources but are continually adapting their strategies as defenses improve.  While not a direct correlation, by looking at nature and how diseases impact our society, organizations can better understand their own security strategy and risk management practices.

 

I am back ;) “The Markerian Heptad and Understanding Attacker Motivations” February 24, 2020

Posted by Chris Mark in cybersecurity.
Tags: , , , , , , , , ,
add a comment

It has been a bit of time since I have posted.  I am back with a blog post I wrote for AT&T CyberSecurity Blog. Titled, “Understanding CyberAttacker Motivations”  It discusses what I call the “Markerian Heptad” (Yes..I named it after myself 🙂 and describes the 7 basic motivations that underpin why an attacker would target a particular person, company, organization, etc.

“Implementing a risk based security program and appropriate controls against adaptive cyber threat actors can be a complex task for many organizations. With an understanding of the basic motivations that drive cyber-attacks organizations can better identify where their own assets may be at risk and thereby more efficiently and effectively address identified risks.  This article will discuss the Rational Actor Model (RAM) as well as the seven primary intrinsic and extrinsic motivations for cyber attackers.

Deterrence and security theory fundamentally rely upon the premise that people are rational actors. The RAM is based on the rational choice theory, which posits that humans are rational and will take actions that are in their own best interests.  Each decision a person makes is based upon an internal value calculus that weighs the cost versus the benefits of an action.  By altering the cost-to-benefit ratios of the decisions, decisions, and therefore behavior can be changed accordingly. 

It should be noted at this point that ‘rationality’ relies upon a personal calculus of costs and benefits.  When speaking about the rational actor model or deterrence, it is critical to understand that ‘rational’ behavior is that which advances the individual’s interests and, as such, behavior may vary among people, groups and situations.”..READ MORE HERE!

Equifax’s History of Hacks and Music Majors September 19, 2017

Posted by Chris Mark in Data Breach, Uncategorized.
Tags: , , , , , , ,
add a comment

EquifaxMain.pngLet me get this out there first.  People are making a lot of noise about Equifax’s (no former) CISO (Susan Maulden) being a Music Major in college.  So what?  Information Security really has only been a ‘profession’ since about 1998 or so.  I know MANY CSOs and CISOs that do not have technical degrees.  While I am currently working on a Doctorate in CyberSecurity my undergrad was political science and I have an MBA.  I think I am a fairly capable security professional.  I think Equifax threw Ms. Maulden under the bus by trying to scrub her information from the Internet.  Given her prior employment (First Data, SunTrust, etc.) I cannot imagine she would have been given such a role without the requisite experience or knowledge.   Until we know more...harping on her college major is simply fishing and projecting blame in the wrong area.  What we do know is that Equifax has a history of being breached and has apparently done little to stem the flow of information being stolen.

Next…in keeping with Equifax’s proclivity for telling half truths while selling their own stock, it looks like there was a breach the March prior to the one in July (announced in September 2017).  That particular hack included employee tax records.  No doubt those execs who dumped their stock were also unaware of that breach (cough, cough).

Interestingly, Equifax provided a cryptic statement that reads: “The criminal hacking that was discovered on July 29 did not affect the customer databases hosted by the Equifax business unit that was the subject of the March event,” ..using my powers of reading comprehension it appears that they are saying that the July 29th “hacking” did not affect the SAME “customer databases” (plural) that were hacked in March.  So are we to assume that in both cases customer data was compromised?  According to Brian Krebs, well known security expert and researcher, the answer appears to be ‘yes’.

Adding to the fun, according to Forbes: “In one case, it had to change its ways following a class action lawsuit over an alleged lapse in security. That suit related to a May 2016 incident in which Equifax’s W-2 Express website had suffered an attack that resulted in the leak of 430,000 names, addresses, social security numbers and other personal information of retail firm Kroger. Lawyers for the class action plaintiffs argued Equifax had “wilfully ignored known weaknesses in its data security, including prior hacks into its information systems.”

I am sure we will continue to learn more about this breach and others.  Stay tuned!

Chris Mark to speak at 2016 TASSCC Annual Conference June 3, 2016

Posted by Chris Mark in Uncategorized.
Tags: , , , , , , , ,
add a comment

I wTASCCas excited to receive a call yesterday evening in which I was informed that my presentation abstract was accepted for the 2016 TASSCC Annual Conference being held in August in Galveston, TX!  If you are not familiar TASSCC is Texas Association of State Systems for Computing and Communications.  They host a great event every year and are pretty selective about choosing speakers.

My topic will be a variation of my dissertation study related to adversarial analysis.  As opining on Bayesian Inference, Proximate reality, and apophasis as they relate to security events would likely put the crowd to sleep I am going to cover some important topics at a high level and then provide a live demonstration of the dark web.  People are always shocked to see in real time where they can hire a hitman, or have a Kilo of Cocaine delivered to their door using only BitCoins.

Chris Mark Speaking at OpenEdge 2016 Partner Advisory Board May 27, 2016

Posted by Chris Mark in cyberespionage, cybersecurity, Uncategorized.
Tags: , , , , , ,
add a comment

OpenEdgeI am honored to have been asked to present as the keynote speaker at the OpenEdge 2016 Partner Advisory Board on June 6th, in Chicago, Il.  I will be speaking on the state of cybercrime today and provide a live demonstration of the Dark Web as well as a description of how cyber thieves steal and use payment card data.  It should be a fun event for everyone!  If you are an OpenEdge Partner please consider attending!

%d bloggers like this: