Security n Cigars: Fear, Uncertainty, & Doubt

Getting Back To New Normal and Good Security Hygiene

Eric — Fri, 26 Mar 2021 20:46:02 GMT

Today at work we were working with some clients who still had some very old, and insecure, authentication methods in their networks. Methods that could enable a malicious person to take over their entire Active Directory domain in a matter of minutes. Fortunately these clients are taking action to fix the problem and while they are doing that, they have my company actively protecting them. But it highlights how security hygiene in the new normal has to change.

This led me to back to thinking about the new normal again. Things are changing rapidly and continuously, as we all know. And in getting back to normal, that is not going to change. That is one of the aspects of getting back to normal that is here to stay. So, we see things like the Exchange Server attacks by Hafnium (a Chinese threat actor) that we learned about in February, 2021, or the Solarwinds attack that we first learned of in December, 2020. These things are going to continue to happen. And faster, more rapidly than ever before.

Side note: In the Solarwinds attack, 18,000 entities globally were vulnerable. But only 10% or so were actually breached by malicious actors. In the Exchange Server breaches, over 70,000 entities were vulnerable and it appears that 30,000, or so, were breached by malicious actors. The changes in magnitude are quickly exploding.

At the same time, so is the change in our own networks, applications, and infrastructure supporting our schools, governments, companies, and homes. Over the last 12 months we have seen organizations move ALL of their data and applications to cloud computing, whether to something like Amazon Web Services or to Software as a Service like Sales Force or to Storage as a Service like Dropbox. They are moving, or have entirely moved, their traditional network infrastructure (authentication, file services, email, office productivity) to the cloud as well: Google Drive, Microsoft Azure, Apple iCloud have all been great beneficiaries of this. Many of these organizations are maintaining crazy hybrid environments. All in a quest to support their business that is seeking to survive this insane time we are going through.

But all of this leads us to how do we, security professionals, deal with the inevitable problems that this is going to introduce in to our networks. Unpatched systems, poorly configured authentication, new vulnerabilities, and more. How do we deal with the cyber hygiene problems?

I’m going to suggest that now is the time for even more of the basics than ever before. Every vendor under the sun is going to try and sell you some miraculous tool to solve your problems. It will be magical for the low, low price of just XXXX. And I’m going to tell you that your first instinct should not to be to buy some magic silver bullet. We’ve been chasing the silver bullet in security for decades now. If that was going to work, wouldn’t it have worked already?

What I can tell you from decades in the business, as both a practitioner and a vendor, is that the organizations that solve the basics are the ones that do the best when confronted by security challenges.

But, just like everything else about Getting Back To Normal, there are going to be changes you need to make to the basics. You have to patch faster. You have to look deeper into your environment. You have to connect on-prem and cloud systems better. You need more resiliency in your defensive layers. And, most importantly, you have to figure out how to detect and respond to bad things much faster.

If you do, your organization stands a chance in the new normal.

Facebook 0 Twitter 0 LinkedIn 0Shares

The post Getting Back To New Normal and Good Security Hygiene appeared first on Security & Cigars.

Back to Normal

Eric — Wed, 24 Mar 2021 23:53:57 GMT

Yesterday I was thinking about this whole “back to normal” thing that we are now experiencing. You know, COVID-19 vaccinations, and herd immunity, re-opening the economy and institutions, all of the things that are happening around us right now after over 12 months of a very decidedly not normal world. Public schools in WA state are beginning full in person education next week. I just bought tickets to a Mariners baseball game. Life is heading back to normal.

And that really means all sorts of things. We are going to see people returning to working in offices, children back in schools, bars open, regular travel again.

However, the world changed dramatically 12 months ago. Businesses transitioned to a completely remote work force and no travel. Schools moved to online education. Bars are allowed to send you cocktails via Uber Eats. The genie of a modern, networked, computerized world is well and truly out of the bottle. In our desire to “get back to normal”, we haven’t realized that there is no going back. You can’t stuff the genie back in the bottle.

And this new world is going to be difficult and challenging, fast paced, and ever changing. March 11, 2020 is as much a world changing day in the history of the world as November 11, 1918 or September 11, 2001 or August 6, 1945.

I will be seeing the Mariners play baseball in person, working from home, supporting clients globally, and traveling somewhere this summer with my family. And perhaps all of that explains my thinking in joining Milton Security a few weeks ago. I had literally left my previous employer just a few days prior. In the past, I’d always taken a little while to figure out what is next, what I want to do, where I want to go. This time, though, it happened very quickly, just a couple days.

And that is part of this “new normal”. Things change. Rapidly. You have to adjust and adapt just as quickly. An opportunity to do really great things in this brave new world popped up and I jumped on it. A company by veterans, dedicated to supporting veterans, and committed to the mission of protecting clients. What could be better?

So, here I am …. and yes, there will be cigars and FUD, not just blah blah about security stuff. Meanwhile, I’m the Chief Operating Officer of a great company, working with one of my best friends, taking care of great people.

As Jim McMurry and I say to each other … #BLESSED

Facebook 0 Twitter 0 LinkedIn 0Shares

The post Back to Normal appeared first on Security & Cigars.

How To Get My Attention

Eric — Fri, 05 Jan 2018 20:33:16 GMT

A couple days ago, I let it be known on LinkedIn that I had taken a new position as the Director, Information Security at Esterline Technologies. Then I got a bunch of private messages from sales folks trying to sell me stuff. So, I posted a quick response to that calling out the poor behavior. And finally, decided to write something longer. I wrote it as an article on LinkedIn, but thought I’d post it here, also. Everything below the line is the original LinkedIn article.

I know the other day I was somewhat flip, and absolutely critical, of a common social media behavior used by many in the sales, business development, and marketing professions. But, perhaps, I wasn’t clear on two things. First, why this behavior is so wrong and second, that I absolutely like, need, and want good sales folks in my ecosystem.

What has happened is that many folks in sales, marketing and business development have turned to using social media in the same way that they conduct direct email marketing. When I…

Travel Like a Pro

Eric — Fri, 26 May 2017 16:18:19 GMT

I was chatting with my friend Katie Ledoux (@kledoux) a few weeks ago about travel type stuff. She was totally stoked that, for the first time ever, she had status on an airline. Remembering that, I saw that her airline had a bonus for flights going to/from NYC. Since she lives in Boston, it should be pretty easy for her to route through NYC airports and earn the bonus.

When I shot her a quick note this morning about the bonus offer, Katie got excited all over again. I asked her if she had a travel credit card, and she said that was next on her “being a grown-up” list of things to do. Thinking about what travel credit card to advise her to get, I asked if she was loyal to a specific hotel chain. After saying “wow, imagine being fancy enough to prefer a particular hotel chain”, then Katie said to me “please advise” ….. hence the new blog tags of “please advise”, “being a grown-up” and “doing adulting right”.

Millenials are the biggest group of new travelers, with cash in hand, that the a…

Trolls

Eric — Wed, 16 Dec 2015 16:05:41 GMT

I hate it when I get caught by trolls. No, there is no new LinkedIn breach. I read the article and missed the date on it. Thanks Jayson Street for pointing out the date to me.

Facebook 0 Twitter 0 LinkedIn 0Shares

The post Trolls appeared first on Security & Cigars.

Eric Update

Eric — Wed, 09 Dec 2015 21:15:16 GMT

As many of you probably know by now, we sold Core Security. Courion and Core Security will be merging as a result of the sale. This is good for Core. At the same time, I am leaving Core Security and looking for my next adventure!

Courion acquires Core Security

Facebook 0 Twitter 0 LinkedIn 0Shares

The post Eric Update appeared first on Security & Cigars.

Information Security and Tanks

Eric — Tue, 20 Oct 2015 16:39:02 GMT

Not too long ago my good friend, Michael Farnum, invited me to be the closing speaker at HouSecCon. I told him I would love to … then he asked me to give a talk that involved my military experience and how it prepared me for the world of Information Security. Two things that are very important in my life, but not necessarily ones I had connected very strongly. After I spent a bunch of time looking at old pictures and revisiting stories of my years in the Army, I realized that the Army had actually prepared me quite well for a career in Information Security. And I knew just the pictures and stories to share with my audience.

One of the things that was going to be key was to share my experiences on tanks and to show pictures of tanks. And, because of the awesome contributions of Adrian Crenshaw, I am able to share not just the slides and pictures of tanks, but the entire presentation with you.

Everything I Know About Information Security, I Learned Shooting Tank Guns!

Facebook 0 Twitter 0 …

Emergency Preparedness and Cyber Security

Eric — Fri, 09 Oct 2015 18:49:41 GMT

This week I had the opportunity to be the plenary speaker for the Alaska Homeland Security Preparedness Conference. It was a great chance to talk to folks who worry about terrorism and natural disasters and convey to them the impact that information security threats could have in their readiness planning and response. I thought people might be interested in the presentation I used. It doesn’t have huge detail in it, I spoke to that. But it conveys the issues I think Homeland Security Emergency Planners at the state and local level should be thinking about.

Homeland Security And Cyber Threats

Facebook 0 Twitter 0 LinkedIn 0Shares

The post Emergency Preparedness and Cyber Security appeared first on Security & Cigars.

Thinking About Reducing Risk

Eric — Fri, 02 Oct 2015 20:56:47 GMT

Wow, it’s been a long time since I’ve posted here. I’ve been kinda busy, tons of travel, sending a kid off to college, BlackHat and DefCon and DerbyCon, lots of engagement with customers around the idea of a mature vulnerability management program. It’s been busy. No excuse, though. Although some of my content and thoughts can be found over at the RSA Conference Blog. So, I’ve got that going for me anyway.

Be that as it may, I’ve been thinking about something and thought I would put it out there.

I often hear that perfection when it comes to risk is critical for airlines and the aviation industry. But that perfection is not possible for the security industry and we just have to do our best. Now, let’s think about this for a minute. Does it really makes sense to just blithely say we can’t do it, throw our hands in the air and give up?

When I was a kid growing up I remember roughly an airplane crash almost once a week on the evening news. It was sort of common place. Today? We are shocked …

Advice for Board Members

Eric — Mon, 06 Apr 2015 22:18:28 GMT

Recently a CEO that I worked for in the past reached out to me. Like many successful CEO’s, he has “retired”. But do you ever really retire at that point? John now sits on the board of a few companies and does some consulting. He’s written a very insightful book about transformation in the industry we worked in. And he is an insanely successful guy in his entire career. I was very pleased and honored that he reached out to me for some advice.

His question revolved around what a board member should be asking to get informed about the security program of the company he was responsible for as a Director. This is a fantastic question. One I think more Directors need to think about. After all, they have a fiduciary responsibility for that company.

I wrote my former CEO a long (for me) email around all of this. After thinking about it a bit, I realized that this is something that should be shared more broadly. So, stripping the personal content out, I am including my answer to John in full fo…

Do The Security Basics Well ….. AGAIN (and again, and again)

Eric — Wed, 10 Dec 2014 19:01:48 GMT

I’m not really sure what it is going to take for people to do Information Security basics well. Just how many multi-million credit card breach, PLA attacks a hospital company, hacktivists use insider to breach you headlines is it going to take? Seriously people, I feel like the boy who cried wolf. Except that I really am alerting you to the wolf and you appear to think I’m just making it up.

I’ve been writing and presenting on what is going on for years now. For example, there is this piece I wrote in July. In it I said that you could reduce 80-90 percent of the risk you face by doing the following:

Patch and Update (yep, they listed it first)
Good fundamental policies
Security education
Encryption where it’s warranted
Serviceable perimeter protection
Identity and Access Management

Based on the onslaught of breaches since then, this hasn’t sunk in yet. Nor the 14 other times I wrote some variation of that piece. In Jan, 2008 I gave this presentation to the ISSA CISO Forum …. notice that most …

Cigars

Eric — Tue, 28 Oct 2014 21:43:33 GMT

I realized I haven’t been living up to the full name of this site lately. Here’s what’s on the menu for this weekend!

Lagavulin, Graycliff and a Montecristo

Facebook 0 Twitter 0 LinkedIn 0Shares

The post Cigars appeared first on Security & Cigars.

The Threat & Vulnerability Management Maturity Model Arrives

Eric — Thu, 23 Oct 2014 13:25:00 GMT

If you follow my blog, you know the Threat & Vulnerability Management Maturity Model has been in the works for a while now. I’m happy to report the full model has finally been published in Core Security’s latest white paper.

What’s the value?

By moving through this model, organizations will simultaneously 1) reduce risk exposure and the likelihood of a breach 2) gain ongoing visibility into true business risk, improving future decision-making 3) align IT, information security, and the rest of the organization in the direction of strategic business goals and 4) significantly increase operational efficiency. It’s not merely an ideal model from a security perspective; it’s a no-brainer for the business.

So take a look. What do you think? Can you easily identify where your organization stands on the model, and steps for advancing to the next level? Looking forward to your thoughts and feedback!

PS This is free to the security community and completely focused on how security programs improve t…

The Burj Khalifa

Eric — Mon, 13 Oct 2014 05:47:05 GMT

On Saturday evening I went up to the top of the Burj Khalifa. If you aren’t sure what I mean, the Burj Khalifa is the tallest building in the world. It’s 2772 feet high (830 meters). The observation deck itself is 1483 feet high. It is insanely impressive.

Below the fold are some of the pictures I took while I was up there.

Yes, I was 1480 feet above Dubai.

Burj Khalifa is the world’s tallest building

23 Years is a Long Time

Eric — Sat, 11 Oct 2014 07:14:44 GMT

I woke up in the Middle East this morning. In Dubai in the United Arab Emirates, to be precise. This isn’t the first time I have been in the Middle East. I’ve been to Saudi Arabia, Kuwait, Iraq, Egypt and Bahrain. Although there are no stamps in my passport for any of those countries. That’s because I went to those countries in 1990 and 1991 during Operation Desert Shield/Storm.

23 years is a long time. I left Saudi Arabia on April 14, 1991. And I was prepared then to say that I would never go back to the Middle East. In fact, until a few months ago I would have told you that the only country in the Middle East I would ever willingly visit, unless things changed dramatically, was Israel. Obviously, now I find myself in the Middle East again.

It’s really an interesting experience. So many things are similar. The smells and sounds are the same. The color of the sky, the way the town and the horizon and the colors look. They are different here. It’s more brown, less green, of course. But r…

Another Preventable Breach

Eric — Wed, 08 Oct 2014 15:43:45 GMT

Another entry in the “Preventable Breach” and “We could have prevented this” columns. This appears to be all about change and configuration management. An area that really needs some work, clearly.

Brian Krebs announced last night that there has been a huge data leak at MBIA, the nation’s largest bond insurer. On Monday, he notified MBIA Inc. that a misconfiguration in a company Web server had exposed countless customer account numbers, balances and other sensitive data. Much of the information had been indexed by search engines. That includes a page listing administrative credentials that attackers could use to access data that wasn’t accessible via a simple Web search: https://krebsonsecurity.com/2014/10/huge-data-leak-at-largest-u-s-bond-insurer/

Let’s be honest, a misconfigured webserver simply should not happen. This is what makes this a preventable breach. This is the same class of problem as connecting a test server with a default password to the internet, like happened at Health…

Year One

Eric — Sun, 05 Oct 2014 18:12:49 GMT

It’s the end of Year One at Core Security. Time really flies when you’re having fun. I’ve been here for 12 months now, and a couple days, and I guess I should do the “looking back after the first year” blog post. A year ago I wrote about my new adventure:

Most people in the information security field … know that I am firmly convinced that the bad guys are currently winning the war we are engaged in. This move is, in many ways, because I want to do even more to change the situation. One key area where we can do that is by providing security professionals with tools that allow them to reduce the attack surface they have to worry about. Right now, organizations have to defend everything. CORE Security can help with how to defend what is critical in ways that are meaningful. Frederick the Great said, “he who defends everything defends nothing” … and that applies now in information security as much as it did in the 1700’s during Frederick’s military campaigns.

And that has really turned out …

The Maturity Model … Matures

Eric — Tue, 26 Aug 2014 21:20:32 GMT

We are making good progress with the Vulnerability Management Maturity Model now. We have a very nice looking graphic that aligns activity across each stage of maturity. Next steps include demonstrating the business value of improving maturity, providing an assessment tool, and developing a white paper to fully explain this.

I should also note that we appear to be ahead of most folks in this line of thinking. I read an article on financial services cyber risk today where it appears that someone (the SEC, perhaps) is developing risk management standards that “firms in the industry could better use to spot and block cyber-attacks.” Sounds an awful lot like our Maturity Model. Nice to know we aren’t the only folks thinking about this and glad to see others following where we are already at.

I thought I’d share the mostly final graphic of the Maturity Model. This is something that anyone is free to use for their security program as long as you provide attribution to Core Security and I for…

Thinking About BlackHat – The Suits vs. The Shorts

Eric — Wed, 13 Aug 2014 20:55:11 GMT

One of the interesting things about BlackHat is that hackers and CISOs rub elbows. One of the few places where that happens routinely. It’s kinda funny. The CISOs are trying not to look so much like a “suit”, so they wear khakis and polo shirts. The hackers aren’t worried about that, so they wear shorts and t-shirts, kilts, jeans, camo, etc. And have crazy hair and tattoos. I thought of Suits vs. Shorts all week.

On Monday, with a little rest and a weekend under my belt, Core’s Communications Manager asked me what I thought about BlackHat and how it was different from the past. A couple folks chimed in, not just me, and there’s a good write up on the Core blog. I thought I’d put my relevant thinking in a quote here and invite you to read the whole thing, as well.

Sure, the conference has become much more mainstream,” noted our VP of Advanced Security and Strategy Eric Cowperthwaite. “Some have started to refer to it as ‘RSA Lite.’ I think that is unfair. This is a conference dealing wit…

Just A Few Things Left

Eric — Thu, 07 Aug 2014 21:19:56 GMT

That’s right, not too much more left here at BlackHat. A couple of meetings with customers, a couple of analysts. And of course, Core’s party at the RX Boiler Room. Which is supposed to be pretty epic.

Then I’m gonna get some sleep, get on a plane tomorrow and head home now that Security Summer Camp is over with.

So far have seen many good friends, like RSnake, Bill Brenner, Alex Hutton, Katie Moussouris, Wendy Nather, Mortman, McKeay, Adam Shostack, Richard Stiennon, Mark Weatherford, Mike Yaffe, MattJay, Michael Farnum, Cindy Valladares, ThatDwayne … hmmmmm, not sure I can catalog everybody. Sorry for those I missed. It’s been great to see you, chat with you, get caught up and generally enjoy summer camp.

Facebook 0 Twitter 0 LinkedIn 0Shares

The post Just A Few Things Left appeared first on Security & Cigars.