The death of the SMS OTP

The National Institute of Standards recently issued a ruling on digital authentication that states SMS messaging as a second authentication factor should now be considered insecure. While sending an SMS for OTP is still better than having no additional authentication factors, the NIST ruling suggests that organizations wanting to raise the bar on their security standards consider more secure authentication methods.

You can read the rest of my white paper for Vasco (reg. req.) here.

Security Intelligence: Use a Malware Simulator to Better Defend Against Ransomware

If you are looking for ways to run a malware simulator to test ransomware and other forms of malware in your environment, but don’t want to deal with the actual materials to infect your systems, look no further than the Shinosec ShinoLocker suite. This is a malware simulator and target attacking suite for penetration testers and other researchers. I talk more about this innovative product in my post today for SecurityIntelligence blog.

WindowsITpro: Going beyond the password

We have a love/hate affair when it comes to using passwords. The average person has to remember dozens of them for various logins, and many of us try to cope by reusing our favorites. That just opens up all sorts of security issues: if a popular service (take your pick: Yahoo, LinkedIn, Dropbox, and many more sites all have been breached over the years) is compromised and millions of user names and passwords revealed, there is trouble ahead.

In this piece for WindowsITpro, I talk about the past, present and future of the lowly password.

Learning from the US Secret Service how to protect your enterprise

With all the changes to infosec technology, here is a not-so-outrageous idea: maybe you should take a page from the US Secret Service playbook in how you run your IT security department. Actually, this idea didn’t come from me, but from someone who actually is familiar with both roles. Nathaniel Gleicher is trained as a computer scientist and a lawyer, and currently is the Head of Cybersecurity Strategy at Illumio, a security vendor. Previously, he prosecuted cybercrime at the US DOJ and served as Director for Cybersecurity Policy at the White House National Security Council. While he worked at the White House, he saw multiple data breaches. “Every breach relies on lateral movement, and instead of attackers being at risk once they get inside, they’re able to take all the time that they need to identify high value information and cause damage.”

He thinks organizations need to take a different, simplified approach and go back to the basics: get visibility inside the data center and cloud and then be able to truly lock the doors inside.

In a blog post for his firm, he writes: “Like the Secret Service, cybersecurity defenders face a similar problem: they are defending high-value assets that must be protected, but also have to speak to hundreds or thousands of other servers. You have to have visibility, and reduce your attack surface, and focus on the security consequences for your most valuable assets. Shutting down the attack surface constrains attackers, makes lateral movement harder, forces attackers to risk exposure, and makes other security tools more effective.”

Sadly, most organizations focus their cybersecurity spend today at the perimeter, making no effort to secure or even understand the interior of their data centers. After reading Gleicher’s post, I asked him if there is a difference between interior and exterior networks any longer. He told me in a phone interview, “Everything is a potential threat. One difference is that you can have greater control around an interior network. And your network visibility is much more limited with exterior ones. But that’s missing the point. An intruder can find something once they are inside your network and can look around. Organizations are trying to layer defenses at the fortress wall, while the cyber attackers are parachuting inside and then free to move around as they want inside the data center and cloud.”

He continued, “I still have conversations with CISOs that don’t know how their devices are connected to their networks. And I don’t mean just a list of these devices, but how they are related to each other, both logically and operationally. This is the kind of information that attackers can exploit.”

His work with the Secret Service has him focused on understanding some of these lessons from providing physical security to protect the President. “People don’t see the Secret Service advance work that was done months before any presidential visit. They had to map the location and understand the physical space. The same is true for cybersecurity, because we need to identify the attacker quickly and respond fast too. This means that any cybersecurity effort should start months before any potential attacker actually shows up.” In other words, it isn’t just about stopping someone from getting across the White House fence, but understanding what will happen once then enter the grounds and what they might end up doing.

He agrees that good security isn’t easy. And he started early in his career with his first IT job for the Peace Corps. There he created a created a campus-wide network to connect 85 machines that were located in the different buildings of a college on a Caribbean island. Less than five minutes after it was first connected to the Internet it was breached. It took him several tries to close various ports and other vulnerabilities before he could defend the network properly. “This was an early lesson on how hard it was to do security properly: there are way more people trying to get in than keeping them out. It also showed me that the steps to strengthen data security aren’t rocket science and are very straightforward. It is a lot more how to orchestrate them and use them efficiently across the enterprise.”

Instead of focusing on the lack of response, he says we should be doing a better job of evaluating the highest-value targets, which is another lesson he learned from watching the Secret Service in action. He said, “You shouldn’t be in the business of protecting the app that handles your employee’s lunch request.” And not everything in the data center should be treated equally, too. “There are some things in your data center that are more valuable and you have to focus on what needs the most protection. If a burglar gets into your house and gets into your basement that is different from him getting into your bedroom where you keep your jewelry.”

Like what you are reading?

Subscribe to Inside Security!

Email Address

// < ![CDATA[
// < ![CDATA[

iBoss blog: How Cyber-geddon Could Happen to Financial Networks

An article in the June Economist paints a dark picture of the aftermath of a fictional financial services hack. They start with some history and extrapolate based on current potential compromises to various networks. What is interesting about this piece is how cold and calculating they can be: “Processes designed to make banking safer have created new vulnerabilities: large amounts of money flow through certain key bits of infrastructure.”

What this means for the finserve industry and a more detailed description of their scenario can be found in my blog post for iBoss here.

How to create a great content strategy for your company (podcast)

Does this sound familiar: You don’t have a coherent content marketing program at your company. You have multiple stakeholders and content authors scattered across several divisions, with no single person in charge overall. You don’t have an editorial calendar, or even know what one is. You don’t have any content strategy or an editorial advisory board, or have a clue how to create either of them. You have a corporate blog but haven’t posted anything in weeks, or maybe months. You began a corporate YouTube channel years ago but don’t know who is in charge of posting videos there.

Sadly, most of these aspects are all too often the situation when it comes to how many companies treat their content. I have been in many organizations where content is often a dirty word, and a lack of understanding of how to produce great content is pervasive. It doesn’t have to be that way. This isn’t a hard thing to turn around, and indeed I came across recently a great case study of one company where they did exactly that.

This week, my podcasting partner Paul Gillin and I interviewed Giuseppe Caltabiano for our latest episode, which you can play directly here:

He is the VP of marketing integration of the IT division at Schneider Electric, a company with 180,000 worldwide employees and a producer of data center power conditioning equipment. When he took the job, he was brought in to fix their marketing efforts, and he realized that he had to turn towards managing their content to do so.

His story is an interesting one, because within a year he was able to pull together the things that I mentioned up top: pull together a unified edit calendar (the company had several), set up an editorial advisory board, and assemble a solid team who understood the importance of great content and how to formulate a strategy.

One of the things that Caltabiano did was to focus on their corporate blog and use it as the center of their content strategy. He planned content that would target readers who are at the very early stages of their journey as potential customers. They also supplemented the blog with an internal email newsletter and with paid promotions too.

He uses what is called a “big rock” strategy for his content. This means stories are centered around anchor feature topics that can be repackaged and reused in multiple formats and on multiple platforms. “Content leads to three times as many downloads as traditional marketing campaigns,” he writes.

Another element was the role that pilot projects played in getting executive buy-in to his plans. “If your bosses are pleased with the initial progress, they’ll give you the money so you can” run with your plans. They are now setting up pilots in other places around the world to expand their reach.

“We learned that email newsletters drive more traffic than other owned channels, SlideShare and YouTube are great for B2B content, and that we need weekly governance calls with employees from each country to solve any immediate problems that pop up,” he wrote.

So take a listen to our podcast interview, and see if there are ways that you can reinvigorate your content plan with some of the innovative ideas that Schneider used.