Google and how they do their technology

Things that make security hard.

This is not an exhaustive list of the implications of poor design on security. Covering that topic adequately would likely rival the size of War and Peace. This is a discussion of a tangible example to convey understanding of how technology selection directly correlates to an organizations’ ability to secure or secure their overall environment. In order to accommodate something poorly designed, larger than necessary holes through security may need to be carved. Please get your CISO and security architect to perform a risk assessment technology BEFORE procurement.

Recent security news alerts discussed again why advertisements must be blocked. Google’s own ad network has been used for hosting and serving malware to victims.

Google and their netblocks

Their guidance to you is to whitelist their entire network blocks which is beyond insane. Just like the insanity of whitelisting *.windows.net which is what is advocated by some SaaS providers who host their resources on Azure.

Azure hosted customer resources are on windows.net. That means that a hacker can dial up a hosted VM and that’s on a windows.net FQDN and IP space.

You cannot just whitelist all of Azure either.

https://ipinfo.io/AS15169

Beware that software companies will put out idiotic statements in their support documentation that tell IT professionals to “open ports [range of ports] to all IP addresses contained in the IP blocks listed in Googles ASN.

Let’s be clear. Those are IP addresses not just for Google’s company internal resources. That is customer hosted resources that they don’t control, manage, or secure the content. So the Google netblocks represent 73.5 million domains.

There is NO legal defensibility in creating a hole that massive through any security system. Yet this is likely what 99% of IT professionals are doing because they are not network security architects. Business decision-makers must understand that there is a lot of bad advice that comes out of even major companies as it relates to information security risk management. They put out insane statements such as whitelisting the IP space representing 73.5 million domains.

Even if you look up a separate Google ASN, it is still 18,933,082 domains. That is clearly a massive amount more than just the small amount of resources that you legitimately need to access for something like Google reCAPTCHA to work. But because of the way that Google has designed their infrastructure, your ability to have network security is hampered.

https://chronicler.tech/firewall-considerations-for-google-recaptcha/

Autoblocking and DNS latency.

One of the major problems with using anything on Google’s infrastructure is that their entire system was never designed for compatibility with selective controls.

It was not mail.google.com. It was google.com/mail.

It was not drive.google.com, it was really google.com/drive. The real infrastructure was hosted as a subdomain of Google.

And then so many web developers have made google analytics a mandatory component of how their website infrastructure works that you have to allow it. It just allows google to be a data vampire.

Microsoft in contrast

https://learn.microsoft.com/en-us/microsoft-365/enterprise/urls-and-ip-address-ranges?view=o365-worldwide

There is a strong tendency to among IT support personnel to engage in over-troubleshooting. They follow software vendor’s recommendations and end up driving holes the size of North America through your security configuration. Please ensure that the personnel who are managing network security for your organization are actually qualified to do it.

Recent question I got:

What are the major changes that you have seen from security auditors in recent years and/or where do you see the audit process heading?

Quick response:

For the sake of a high level, automation is and will continue to be used. The size of the IT service provider is NOT a conveyance of their capabilities or capacity.

Many 60 person MSPs are grossly incompetent. Some small teams of about 8 people are exceptionally skilled.

C-suite needs to drive it from the end in mind. The end is compliance attestation. Back into it from there and ONLY use a team which also has the technical capabilities to perform the remediations.

Do not use vCISO services from one company and remediation services from another. You get too many cooks in the kitchen and a disjointed and more expensive outcome will be the likely result.

The insurance companies are pushing the cost of the audit on the insured or applicant. This will involve eating tools and processes that connect with their assessment process.

Hence why it is crucial to work with a company like mine that has these workflows. Most don’t.

In this podcast, I provide an overview of the role of executives, managers, internal IT, and the CISO in business risk management. Until all parties understand that this is not information security risk or cybersecurity risk, it is business risk that they are responsible for managing, then it is not likely the situation will improve.

In order for business risk managers to make good risk decisions, they first have to engage and be involved. They cannot put their head in the sand and believe that "It's an IT problem." No it's not an IT problem. When the HVAC system is open for hacking to everyone on the planet because the facilities director refuses to collaborate with IT security to come up with a solution to maintain business functionality while managing risk, that is a business risk issue.

If the facilities director REALLY believes that it is an IT problem, then IT needs to be provided the authority to rectify the issues. And when the facilities director's access is interrupted, then they will be forced to engage and collaborate at that time. But executive management needs to have the intestinal fortitude to enforce policy. The policy that IT does have that authority and no IT will not be retaliated against. That is one approach. The other approach is that the facilities director needs to acknowledge that THEY are responsible for business risk management of the HVAC system. So if the facilities director wants the right to complain when their access is revoked, then they cannot abdicate their responsibility and accountability for the security of the HVAC system.

Frank Raimondi, VP of Channel Development at IGI Cyber Labs

IGI CyberLabs has a product called Nodeware which does continuous vulnerability assessment.

PenLogic – regular penetration test – once a quarter deep dive heavy one and a monthly light test.

CEO buyer’s journey

Security velocity

Risk scoring is part of security velocity

Improve your cyber-hygiene – all small businesses

Security 101 is inventory 101

Cysurance – warranty and liability company

It’s good that insurance companies are trying to be more objective about the real risk metrics. Get the scoring and get the data about how risky they are. This feeds into the evaluation data which is used for underwriting.

FTC Safeguards policy impact

Operational security issues – MSPs that post all their personnel information publicly.

The impact of customer contracts and compliance. Squeeze between cost and staying in business in terms of insurance and customer contract requirements.

Ken Dwight is “The Virus Doctor” – Business consultant and advisor to IT service providers and internal IT at many businesses who have come to him for his training, has his own direct clients. Ken conducts a monthly community meetings for alumni. He provides a list of curated items of current interest for discussion and resources, and has a featured topic which often includes another speaker to provide breadth of perspective. He has been doing this community service for 83 months!

I asked Ken to cover with me some topics that from his perspective don’t get talked about enough.

Business Email Compromise

Also known as CEO fraud. Impersonating a CEO for purposes of wire fraud. We are focused on the technological solutions. There is no technological solution for eliminating BEC.

CEOs must be part of the solution.

Example: Subcontractor to Airbus. Used to dealing with multi-million-dollar wire transfers.

BEC is a large Fortune 500 issue, it scales down to one user environments.

Title companies are a big target.

Retention policies and standards for WHERE to store what kinds of data to make sure that email is not a file server thereby increasing the risk of what data is compromised as part of BEC.

Perfect example of the beginning of an incident response plan or a tabletop exercise. Orgs must define the cost of compromise. That plan needs to be in place long before. It makes a recovery so much more straightforward.

Attackers analyze their victims in tiers. Potential victims $10 - $50mm revenue organizations. Reputational damage, but not big enough to have an adequate cybersecurity budget.

ShadowIT is a problem, which is why you must address it with a CFO-enforced procurement policy.

Proactive management of M365 tenant security configuration is so critical

The security of your tenant is not included in the fee for biz premium or the overall licensing.

How much activity there is, changes, products, services, vendors. Ideal stack, layers, point solutions within that. Revisit that in a period of time like a year.

This is a nice resource for M365 security and BEC.

https://www.blumira.com/office-365-security-issues

Direct advice from Ken

One topic I believe falls directly into this category is the issue of Business Email Compromise, as opposed to actual malware / hacking / ransomware attacks. As you know, the losses to BEC still represent a greater dollar value than ransomware, according to the FBI statistics. But BEC isn’t even a technology problem, it’s pure social engineering – and no additional layers of hardware or software “solutions” will prevent it or reduce the cost to its victims. In my opinion, that’s why you hear so little on the subject from the cybersecurity vendors.

Another topic I find interesting, but haven’t really heard any vendors or industry pundits talk about, is the whole new ecosystem and infrastructure produced by modern threat actors. The whole business model of these sophisticated criminals has created occupations, titles, and job descriptions that didn’t exist a few years ago. Some of these are a result of the specialization, compartmentalization, and outsourcing by these organizations; here are a few that come to mind:

• Breach attorney
• Ransomware Negotiator
• Initial Access Broker
• Cloud Access Security Broker
• Multiple “As-a-Service” offerings:
• Ransomware as a Service
• Phishing as a Service
• C2 as a Service

Another area that is mentioned fairly frequently, but typically fueled by more heat than light – and raised as a point of frustration by MSPs and IT Solution Providers in general – is the users who still believe they don’t have to worry about cybersecurity, hackers, malware, or ransomware, because they “don’t have anything the criminals would want,” or words to that effect. I believe those users need to comprehend how real and serious the threats are to their business.

By defining the multiple tiers of threat actors, the threat vectors they may employ, their potential victims, the assets owned and managed by those victims, and the attacker’s strategy for monetizing those assets, I believe it becomes obvious that every organization and every individual is the intended target of some subset of those threat actors.

Visit this resource for help making argumentation. Ken is working on some additional materials for end user cybersecurity awareness training.

https://qpcsecurity.podbean.com/e/the-real-reason-you-cannot-afford-to-have-a-cybersecurity-incident/

Felicia King and Dan Moyer of QPC Security talk about vulnerability management, patch management and all the things that business owners are generally not understanding adequately. As a result of that, you're being underserved, misled, and in some cases were lied to and ripped off.

Ultimately, many business owners are refusing to pay for what they need for adequate risk management because they don't understand what they need. In today's episode Felicia and Dan fill that gap.

Announced on October 6, 2021, the US Department of Justice Civil Cyber-Fraud Initiative is applying the false claims act to those who:

• fail to follow required cybersecurity standards
• knowingly provide deficient cybersecurity products or services
• misrepresent their cybersecurity practices or protocols
• violate obligations to monitor and report cybersecurity incidents and breaches

Just let that sink in for a second. So, is your IT service provider really meeting that standard? I sincerely doubt it.

01:23 The difference between vulnerability management and patch management

Holistic vulnerability management includes, but is certainly not limited to:

• Software bill of materials analysis
• Supply chain risk management
• Third-party risk management
• End-of-life software
• Asset inventory up to date
• Lifecycle management
• Continuous vulnerability assessment
• Frequency penetration tests
• Tabletop exercises
• Procurement policy

04:38 Cybersecurity insurance applications aren’t asking JUST about patch management

1. When did you have your last penetration test?
2. Do you have continuous vulnerability assessment in place?
3. How long are you going to go without having the patches applied in the environment?
4. If you think adequate patch management can be done for $50/mo/server, you are hallucinating.

So, what’s included in patch and vulnerability management?

05:34 Patch management

Patches are the building blocks that are improving the software that lives on the hardware. Without software, you can't interact with the piece of hardware unless it's purely mechanical, and even then there's still improvements of usage.

How do you manage and protect those tools of your business from threat factors?

09:20 Third-party patches & vulnerabilities

IT service provider proposals are telling business owners that they can patch their servers and their endpoints and automate Windows updates and some third-party patches. What are those third party applications? What about all your custom business line applications? Do you actually want your critical SQL server to have its SQL instance updated using automation? How much money does it cost you if that workload is down?

10:27 Asset management

Do you know what you have in your environment? Do you have accurate asset management and vulnerability assessments? Simply stated:

“You can’t secure what you don’t have an accurate inventory for.”

It is a regulatory requirement and cybersecurity insurance requirement to adequately document and understand software dependencies in your environment. That requires a proper inventory of your hardware, software, and subcomponents of the software. This is frequently referred to as SBOM - software bill of materials. And if you think your software vendor is going to provide that information, please go ask them for that information. You will probably get a blank stare. IS security engineers can figure it out on their own.

18:48 Implementing proper procurement policies

Does your procurement policy support your vulnerability management strategy? Does your software acquisition and implementation policy (if you even have one) support your cybersecurity insurance and regulatory requirements?

When business decision makers put pressure on an IT service provider or internal IT to implement new software without proper security protocols, vetting, and process documentation, vulnerabilities are nearly always introduced into your environment. Sometimes that comes directly from their insecure software. Sometimes it comes from the tools and connectivity they use to remote into your systems or things like API connectors that your IT is supposed to just blindly trust the software vendor to secure their software with zero validation or proof. A proper CISO on your team or through your ITSP will be able to directly vet the vendor and software itself.

You are required by cybersecurity insurance and Federal regulatory guidance to do so. It is also in your business's best interest to do so.

Be very careful looking for just certifications for someone who says they are a CISO. The majority of CISOs do not have technical chops. They are often compliance managers that cannot do the technical work. Those people have limited usefulness and will not be able to

All of the vCISOs at QPC are hardcore technical because we understand the essential nature of that skillset being a mandatory requirement to deliver effective CISO services.

20:24 Privileged access management and privileged password management

How do you know who has access to remote access to your systems? How many people will have access to your systems? Today, there are many IT service providers who are not disclosing their outsourced Helpdesks that are giving full administrative-level access to a customer’s back end to all those workers at the virtual live Helpdesk. Most ITSPs also fail to disclose the totality of the quantity of people that will end up with admin access to some or all of your systems.

Ask yourself. If you have 25 office personnel, why would it take 30 remote people to have admin access to your systems in order to provide competent support? Do you think it is actually possible to have a high security environment and magically keep 30 people fully up-to-speed on the exact correct configurations required in your environment and what the interaction effects are? It's not possible and will never happen.

24:27 A procurement policy can keep a business' IT costs stable

The number one thing that business owners complain about is the cost of maintenance. With a procurement policy in place and by working with their IT service provider and procuring anything that they do not have a full understanding of the total cost of ownership for – costs can be managed.

Does your procurement policy support your business strategy and needs?

34:22 Understanding the cost and time of device and software procurement

There's also a lot of other risks that the vast majority people don't think about; they tend to only think about the budgetary risk. However, getting the strategic input from a CISO or CIO to develop an understanding of the minimum pricing floor and how that affects the total cost of ownership, can save a business not only money but time.

SaaS can get you closer to a flat-rate cost but you may have inherited additional risk and vulnerabilities, depending on how the new technology interconnects with your systems. Additional risk factors are:

• counterparty risk
• structural increase in cost of doing business risk
• accessibility risk (redundant access is then required and cannot be fully mitigated)
• external software vendor attack vector risk that cannot be mitigated through Layer3 ACLs
• takedown/contract risk

37:33 Cloud vs on-prem security

It's still a fallacy that having your systems in the cloud is better and cheaper, incorrectly thinking they can have as good security in the cloud as they can on premise. Going to SaaS can provide a lower and more predictable TCO if the counterparty risk you accept is worth it. But picking up your servers and hosting them on someone else's infrastructure will never be less expensive. IaaS cost savings are a fallacy for the majority of businesses. The exception being massive companies with heavy DevOps needs for spinning up and down workloads quickly. Most of those items are being migrated to Kubernetes and OpenShift.

46:48 IT/IS is not a utility

The electricity company, the water utility, garbage pickup, fire and safety, ISP – they are monopolies and uni-taskers. Whereas IT is far more complex. People tend to think that if it’s a utility, therefore it’s a commodity, and if it’s a commodity it doesn’t matter which service provider I choose.

Business decision makers are trying to manage budget risk without understanding their requirements. They also want to have budgetary control while abdicating their involvement upon outsourcing their IT to an ITSP.

An IT service provider can be a partner to success and can help businesses develop better business strategies IF there is regular and open communication.

This is part 1 of a 2-part series on vulnerability management. To learn more, visit us at qpcsecurity.com 

This is another resource for vulnerability management information.

https://land.fortmesa.com/vulnerability-management-101

We have seen some really goofy cybersecurity insurance application questions. It is always best to not answer a question that is goofy, but instead to write an addendum that defines terms and explains the cybersecurity posture of an organization related to the topic. You need to try to figure what the insurance company was trying to evaluate rather than just answering their questions because their questions are frequently not suitable for yes/no answers.

Greg Cloon joins me to discuss this topic.

We also touch on when you would use file hash integrity checking, when to use disk encryption, and when to use encryption for communications.

Here's a link to IISCrypto.

https://www.nartac.com/Products/IISCrypto/

Scenario 1

Phone VLAN on a switch and cross connected into a Firebox with desk phones, PCs, and printers in the environment

Questions we actually got:

On Monday, we send over the list of what switch ports are for printers, which are for PCs, and which are for desk phones. Technician says that two of the three phones are not working. We use our awesome switches to find out exactly where these other phones were plugged in. The phones were plugged into the wrong switch ports. Move desk phones, phones work.

Then later, the technician runs a test for the VOIP service from a PC on the PC VLAN not from a PC connected to the phone VLAN. So the test for the VOIP service fails. Security zone profiles exist. It is not acceptable to have an allow everything network security posture. Configures needed to support desk phones are completely different from those that are required to support domain joined Windows computer assets.

Some ITSPs have to pay for expensive add-ons like Auvik to try to compensate for the fact that they have inadequate switching equipment with inadequate design and a sprawl that they have to inventory and keep track of. TCO comes from how much time it takes to maintain, manage, adds/moves/deletes/upgrades, troubleshoot. If I have to physically go to a site to chase some cabling, something is really wrong.

The technician in this scenario also could not believe we wanted two network cables between the switch and core router. They are not the only one. I encountered this lack of vision of understanding in another client IT director earlier in the year. If you don't know why you would have two network cables between a switch and a core router, go figure that out.

Scenario 1

Phone system with desk phones. Each desk phone has its own network cable, which is good. Phone subnet should be a separate VLAN, but the choice is made by ITSP to separate the phones using physically separate switching equipment. That is something I would never do.

Commentary provided by ITSP:

I don’t like VLANs. I would rather setup a network with physical segmentation. Results in:

• Loss of visibility
• Loss of network resiliency
• More expensive because you have more switches to babysit and troubleshoot
• So if you have 20 or 40 VLANs, so does that mean you are going to have 20 or 40 physical switches?
• If you don’t have 20 VLANs then what network security do you really have?
• How do you present virtual servers on the proper microsegmented security zone when you cannot transmit tagged packets?

Let’s just talk minimum VLANs that we typically see here:

• SwitchOOBM
• ServerOOBM
• SwitchMgmt
• WAPMgmt
• Phone
• Surveillance
• CorpWired
• CorpWireless
• GuestWireless
• HVAC
• ElecMon
• Chromebooks
• CaptivePortal
• Tier0
• DCs
• AppGroup1
• AppGroup2
• DeprecatedApps
• Printer
• Storage
• IAM
• RMM

Clearly anything over two becomes ridiculous to do with physically separate switch equipment. The days of this paradigm or strategy are long gone since cybersecurity compliance is requiring microsegmentation. And network security strategies and technical controls are some of the most effective primary and compensating controls for cybersecurity posture for all the protected assets regardless of type.

More than 80% of breaches occur due to credential theft. All organizations have compliance requirements to have org-owned password management systems and MFA enforcement on accounts used by employees and contractors.

Some other needs which must be met are:

• Compliance attestation documentation
• Proper use of the best MFA method on a per resource basis
• Aligning business continuity objectives with cybersecurity objectives
• Developing procedures for staff on how to use the company password manager system properly
• Aligning procedures with information security policy
• Developing/enhancing information security policy
• End user awareness training around credentials, MFA, password management
• and more

I wrote a 16-page educational guide for clients to help them understand the complexities and challenges of password manager solutions and why this is not an easy button project. This podcast is a supplement to that whitepaper.

See the following supporting podcasts for additional information.

https://qpcsecurity.podbean.com/e/requirements-for-premise-hosted-assets-cybersecurity-bcdr-and-more/

https://qpcsecurity.podbean.com/e/how-to-achieve-compliance-for-privileged-account-management/

https://qpcsecurity.podbean.com/e/avoid-cybersecurity-insurance-fraud/

You should not put things in the cloud unless you can secure them there at least as good as a highly competent professional would have if they had that asset on premise.

Cloud hosted assets have additional risks.

• Counterparty risk
• Additional outage and accessibility risk
• You have less control
• You have less security over the human or governmental access to your content
• Zero 4th Amendment protections over that data. It's fully subject to FISA searches that the provider is required to never tell you about.

Also do NOT get sucked into the scam that cloud hosting servers is more secure than if you did them on premise or somehow more cost effective. That is sheer lunacy.

SaaS can be more cost effective and more secure. Look at Office 365 as an example. That is clearly more secure, more cost effective, and more value than a premise Exchange server. SalesForce could be better for you than running your own CRM, but then you are also fully open to their crazy policies which could rip the rug out from under one of your most business critical systems.

There is no one right answer 100% of the time. Context and artistry of security strategy are exceedingly important.

This show is about these things as well as what you must have in place to have premise hosted secure assets. I describe a Tier0 asset scenario in specific and what can easily undermine it.

Premise hosted password managers

It is worth noting that extremely high functionality privileged access management and identity management systems are available in a premise hosted format which are a perpetual licensing model with very low annual software maintenance fees. These systems are exceptionally valuable to IT departments and QPC has extensive experience in these platforms. They are an exceptional value to IT management functions and IT departments.

However, most organizations, even those with full-time IT departments, will not meet the requirements for self-hosting. Why? In order for a self-hosted password management system to be successful, it relies upon many factors which must be in place and be fully executed with extremely high levels of skill and security. This level of skill is outside of the technical skill level of nearly all IT departments of companies with less than 5000 employees.

If the requirements are not fully met continually for the life of use of the platform, the platform and its contents are likely to be compromised. A compromise could consist of the data exfiltration of the entire password vault database which would be catastrophic to the organization.

Baseline requirements for premise password managers

• Extremely tight supply chain risk network layer security rules and management
• Ability to do offline upgrades for all software and systems involved
• Extremely adept underlying server, network, power infrastructure management
• Rapid patch management within 48 hours or less
• Always on scanning for vulnerability assessment backed by active monitoring and remediation
• Active monitoring
• Multiple first line backups per day with multiple encrypted offsite backups per day
• Two physically disparate sites with significant server, network, power infrastructure with automatic backup generator service and redundant internet
• Proficiency at managing SQL server replication over WAN links in an active/active SQL server configuration
• Proficiency at maintaining active/active application server configurations and automatic failover network configurations
• Absolute rigorous discipline to adhere to documented standards for vault creation, password management system administration, application updates, database system updates, OS updates, third party app updates, network layer security management across the entire internal and site-to-site connected networks
  Any laxity in the discipline of the IT personnel managing the system will cause it to fail to deliver the security profile required for critical assets.
• Minimum of two servers involved with the addition of more servers if internet facing roles such as mobile access are desired
• IT personnel’s ability to implement and maintain complex privileged access management systems
• Regular security compliance and audit report reviews. This will require a CISO and/or compliance officer with significant technical skill.

Networking

• Network layer security appliances
  • I recommend WatchGuard Fireboxes where you use the Firebox as the core router. It must have a full Total Security Suite active subscription with fully updated Fireware or you won’t be able to learn.
  • LAG a trunk between the Firebox and the switch
  • Must use a unit with an active subscription
• Layer 3 network switches
  • Must be able to LAG and VLAN at a minimum
  • Recommend Extreme EXOS X440 G2 PoE switches. 12p, 24p, etc. But you must get modern firmware on the switch.
    These can be procured online used via eBay and other sources.
• Enterprise grade wireless access point
  • At least two wireless SSIDs on different VLANs, supply chain risk management configuration on the management interface
  • Depending on the WAP model, it may be possible to use an older WAP that has no cloud controller. It may be configurable as the local controller. Cloud controller is acceptable also as long as you do supply chain risk management network configuration.

Virtualized switches and net sec appliances don’t work for learning.

Setup OOBM VLANs.

Lock it down. Hardcore microsegmentation, hardcore packet inspection. Massive supply chain risk management strategies at the network layer. Challenge yourself to always make it more locked down.

If you want to learn networking, I do not suggest Cisco's training material at all. HP Flex Net training is quite good in terms of teaching you the fundamentals that you need to know. Then from a network security model, you need to learn and master network layer security appliances. I can only recommend WatchGuard and Fortinet. Everything else has problems which I won't waste time here on why.

Servers

Dell PowerEdge servers can be purchased from outlet.dell.com very inexpensively. Get something you can run at least the hypervisor and a couple VMs on. Must have at least iDrac Enterprise.

Knowledge of HyperV, managing VMs, hypervisors, and sophisticated patching is mandatory.

Office 365 / Microsoft 365

You should run your own tenant and learn how to use this technology if you want to be employable.

Domain/DNS

You must understand domain and DNS hosting and DNS records especially for all services hosted through Office 365.

NAS

TFTP server is mandatory for working with switching equipment for configuration backups, restores, firmware upgrades. Running TFTP on Windows or Linux desktop OS are very problematic. A Synology NAS has TFTP capabilities as well as a ton of other features. The NAS has ActiveBackup, HyperBackup and that could be used to back up the VMs in your lab and your Office 365 tenant.

BCDR skills are mandatory.

I see no better way to learn BCDR other than by doing it. Do not shortcut the size of the hard drives you put in the NAS. It's not worth it. You need lots of space to be able to fully utilize the NAS as your learning zone.

Minimum NAS is DS218. https://www.synology.com/en-us/products/DS218

Suggest Seagate IronWolf Pro drives. Must use NAS rated hard drives.

Priority recommendation

1. NAS
2. Domain/DNS/Office 365 tenant
3. Network layer security appliance
4. Layer 3 switch
5. PowerEdge server

Learning resources

TryHackMe

https://www.ultimatewindowssecurity.com/webinars/default.aspx

You must learn Tiered access control. MUST. And you must know how to implement it.

https://www.ultimatewindowssecurity.com/webinars/register.aspx?id=3695

Learn privileged access management

Privileged admin workstations

https://docs.microsoft.com/en-us/security/compass/privileged-access-devices

https://docs.microsoft.com/en-us/security/compass/privileged-access-access-model

https://docs.microsoft.com/en-us/microsoft-identity-manager/pam/tier-model-for-partitioning-administrative-privileges

https://docs.microsoft.com/en-us/microsoft-identity-manager/pam/privileged-identity-management-for-active-directory-domain-services

BHIS webinars and training

https://www.blackhillsinfosec.com/blog/

KnowBe4 excellent webinars and ebooks

https://www.knowbe4.com/webinar-library

Cybersecurity insurance requires MFA for all internal and external administrative access. How do you accomplish this?

Examples of things you might access:

• switches
• firewalls
• servers
• printers
• workstations
• DNS hosting
• website hosting
• cloud management portals
• NAS
• BCDR appliances

There are many ways to solve this problem and they are all too long to post about here, so this is what this podcast is about.

• Passwordstate remote integrated proxy authentication
• tiered access control
• compensating controls as an alternate for MFA
• access portals with MFA
• privileged admin workstations
• account logon restrictions
• hardened network access control restrictions (microsegmentation strategies)
• more

https://www.clickstudios.com.au/remotesitelocations/default.aspx

API Security is going to be the thing you need to be paying attention to in the next two years.

Partner with an information security officer like QPC Security to get an internal and external vulnerability scanning plan in place for your organization. A lot of vulnerability management is not possible to do with tools. It takes experience and expertise that comes from 29 years of hard work.

A great API scanner https://www.wallarm.com/

RMM security topics/tactics

Either fund your IT security or decide to go out of business

Companies have some hard decisions to make. They are either going to continue to be in business and allocate budget to correcting gaps, or they are going to go out of business because they will find themselves uninsurable or unable to come up with the funds to rectify all their security gaps in the required allotted time.

Reviewing your last cybersecurity insurance application

My latest offer is to review your last completed cybersecurity insurance application. The offer is only open to business owners directly or the executive management team of an organization who would be a good fit to be a client of ours.

https://qpcsecurity.com

The truth about smart cities.

https://www.theguardian.com/cities/2014/dec/17/truth-smart-city-destroy-democracy-urban-thinkers-buzzphrase

There is an updated FAQ for the CAN-SPAM Act.

https://www.ftc.gov/business-guidance/resources/can-spam-act-compliance-guide-business

Cyberlaw podcast

• What needs to be pre-documented for the breach attorney to be effective? And in what format?
• What to do to protect yourself from outrageous fees?
• What to do in order to get proper service from a breach attorney?
• What are the advantages of having a pre-established relationship with a breach attorney?
• What positive outcomes arise from having pre-breach meetings with a breach attorney?

3/24/2022

Spencer Pollock – Cybersecurity breach attorney

Felicia King – QPC Security, Security Architect and Information Security Officer

What needs to be pre-documented for the breach attorney to be effective?

Cybersecurity posture of the organization.

Compliance/legal and the technical / security

Security: identify the gaps and procedures

And in what format?

Data is everywhere.

Clients that have an IRP, data map and have a list.

Customers and data breach classification, impact / no impact

What to do to protect yourself from outrageous fees?

The more times you have to engage a breach coach in advance, the better off you are.

The more time you bake people into your team, the less time is spent on the phone when an issue occurs. This means it is less expensive and your organizational response is faster.

This is why it is critical to get the breach attorney written into the policy.

When to get the breach attorney written into the policy?

Business owner needs to be driving the breach attorney selection during the insurance application period.

Insurance policy, Beazley example. You should do a retainer with them.

Retainer: You get the benefit of cell phone, breach line.

Preparation meetings are going to be paid out of pocket. Prebreach stuff is a separate engagement, and it will usually be a lower fee.

Joy Beland joins Felicia to discuss:

• What Edwards Performance Solutions is doing in the CMMC training space
• Joy's team created the CMMC assessor textbook
• Many orgs have cybersecurity insurance enforcement for the first time ever
• Joy's extremely wise metaphor and perspective on cybersecurity insurance (15 mins)
• Transfer of risk and economic destruction
• DMARC, DKIM, SPF tuning
• What tools exist to help the SMB market with attestation, and establishing patterns of due care and due diligence?
• IS policies and processes are required as part of the proof mechanism
• Mechanisms to actually evaluate risk so that business leaders can make effective decisions
• Control planes for infrastructure

Joy's sage advice: "Know what the crown jewels are."

Learn to identify wasteful practices with Gemba walks.

https://www.creativesafetysupply.com/content/PPC/gemba/index.html

CMMC 2.0 scoping analysis

https://www.linkedin.com/feed/update/urn:li:activity:6889627454466469888/

Future Feed for CMMC orgs

https://futurefeed.co/

https://qpcsecurity.podbean.com/e/the-real-reason-you-cannot-afford-to-have-a-cybersecurity-incident/

Special guest:

Joy Beland, a CMMC Provisional Assessor and CMMC Provisional Instructor, who works with Edwards Performance Solutions as a Senior Cybersecurity Consultant.  Joy owned an MSP for twenty-one years in Los Angeles.  She has a CISM and Security+ certification.

Cyber Matt Lee joins Felicia on Breakfast Bytes to talk about massive issues with technical debt.

Senior Director of Security and Compliance at Pax8.

You have to start with the right definitions. It’s not patch management, it is vulnerability management. You have to ZOOM in. Is your TPM up to date? Is your firmware up to date? Drivers, configurations, remove unpatchable software. Are you still susceptible to spectre and meltdown? What about SMB1, PowerShell 2.0, LLMNR, etc.? “That doesn’t have a patch, and you have to get rid of it.”

Where there is technical debt with a software code base, on a 5-year journey, you need to move to different software because the software vendors are literally incapable of updating the code base of their software. They are not actually doing the work to update the software. Their paradigms for software development lifecycle and codebase are crippling them from being able to correct issues.

Matt recommends finding SaaS platforms that suck over premise applications that suck because at least you are in the shared responsibility model.

Modern dev sec op practices are what is needed. You can build software that has a good paradigm.

We still acknowledge that there are issues with resources in the cloud as well unless an organization is willing to accept the risk of data sovereignty and the third-party risk of being disconnected from their services and data. Being disconnected from your data or being disconnected from your application because the SaaS vendor disagrees with your business model even though what you are doing is legal, this needs to be regulated out of existence. SaaS vendors are playing God.

And some things are just not cost effective in the cloud or are financially unobtainable in a SaaS format. Are you comfortable with the government accessing your data through backdoors? This is a very personal decision to each organization and individual.

15:30 mins - Matt talks about paradigm challenges that impede the ability to ever create bug free software. True SaaS should be able to iterate an outcome regardless of the hardware and OS that is accessing the system, so the software vendor does not have to plan for all the variables in their testing. This allows them to have a CICD development pipeline for their software.

Get to the nugget of what is required. An information security officer can get to what is really the intent of what the compliance requirements are asking for and translate that into what is required to fulfill that and protect the organization. Interpretation is required because too frequently the questions asked or requirements specified are not as specific or accurate as what is required.

26 mins – Vendor software development and vulnerability disclosure programs. The vendors need to tie revenue lost to the vulnerabilities. Software vendors are often setup for failure. Monolithic apps start at the top and run to the bottom of the code. Better models are where apps have microservices and each microservice can be corrected individually without a massive ordeal. A different software codebase paradigm allows for sprint teams to correct software bugs easier.

28 mins – There is no real effective possible way for many of these software vendors to fix their apps.

30 mins - It is in the C-Suite and the board to fix this. You are either going to die at the hands of threat actors, in an escalating war that we cannot win. Or you are going to start having practices that understand that this is a football game. There is no one right way to run a football play, but you cannot play with 9 players. You have no defensibility in your actions if you put only 9 players on the field when 11 are required. There are requirements and boundaries to any strategy or solution. If you don’t do the things you need to do, you don’t have defensibility.

If you are already fighting with all this massive technical debt, you are not going to ever win.

Go to tryhackme.com and find out how easy the threat actor side of this is.