Article | March 20, 2020
The Cybersecurity Solarium Commission's recently released report outlines a strategy to fundamentally reshape the U.S.’s approach to cybersecurity and prepare for resiliency and response before a major cyber incident occurs, not after. Unlike the original Solarium Commission, which operated in a classified environment, the Cybersecurity Solarium Commission chose to release its report publicly out of recognition that cybersecurity involves everyone. “In studying this issue,” begins the letter from Sen. Angus King and Rep. Mike Gallagher, the chairmen of the commission, “it is easy to descend into a morass of classification, acronyms, jargon, and obscure government organization charts. To avoid that, we tried something different: an unclassified report that we hope will be found readable by the very people who are affected by the very people who are affected by cyber insecurity – everyone. This report is also aimed squarely at action; it has numerous recommendations addressing organizational, policy, and technical issues, and we included an appendix with draft bills that Congress can rapidly act upon to put these ideas into practice and make America more secure.”
Article | March 20, 2020
Technology is reshaping society – artificial intelligence (AI) is enabling us to increase crop yields, protect endangered animals and improve access to healthcare. Technology is also transforming criminal enterprises, which are developing increasingly targeted attacks against a growing range of devices and services. Using the cloud to harness the largest and most diverse set of signals – with the right mix of AI and human defenders – we can turn the tide in cybersecurity. Microsoft is announcing new capabilities in AI and automation available today to accelerate that change. Cybersecurity always comes down to people – good and bad. Our optimism is grounded in our belief in the potential for good people and technology to work in harmony to accomplish amazing things. After years of investment and engineering work, the data now shows that Microsoft is delivering on the potential of AI to enable defenders to protect data and manage risk across the full breadth of their digital estates.
Article | March 20, 2020
1. Zero Trust – Demystified
Everyone seems to be talking about Zero Trust in the security world at the moment. Unfortunately there seems to be multiple definitions of this depending on which vendor you ask. To help others understand what Zero Trust is, this white paper covers the key aspects of a Zero Trust model.
1.1. What is Zero Trust
Zero Trust is a philosophy and a related architecture to implement this way of thinking founded by John Kindervag in 2010. What it isn’t, is a particular technology!
There are three key components to a Zero Trust model:
1. User / Application authentication – we must authenticate the user or the application (in cases where applications are requesting automated access) irrefutably to ensure that the entity requesting access is indeed that entity
2. Device authentication – just authenticating the user / application is not enough. We must authenticate the device requesting access as well
3. Trust – access is then granted once the user / application and device is irrefutably authenticated.
Essentially, the framework dictates that we cannot trust anything inside or outside your perimeters. The zero trust model operates on the principle of 'never trust, always verify’. It effectively assumes that the perimeter is dead and we can no longer operate on the idea of establishing a perimeter and expecting a lower level of security inside the perimeter as everything inside is trusted. This has unfortunately proven true in multiple attacks as attackers simply enter the perimeter through trusted connections via tactics such as phishing attacks.
1.2. Enforcing the control plane
In order to adequately implement Zero Trust, one must enforce and leverage distributed policy enforcement as far toward the network edge as possible. This basically means that granular authentication and authorisation controls are enforced as far away from the data as possible which in most cases tends to be the device the user is using to access the data. So in essence, the user and device are both untrusted until both are authenticated after which very granular role based access controls are enforced.
In order to achieve the above, a control plane must be implemented that can coordinate and configure access to data. This control plane is technology agnostic. It simply needs to perform the function described above. Requests for access to protected resources are first made through the control plane, where both the device and user must be authenticated and authorised. Fine-grained policy can be applied at this layer, perhaps based on role in the organization, time of day, or type of device. Access to more secure resources can additionally mandate stronger authentication. Once the control plane has decided that the request will be allowed, it dynamically configures the data plane to accept traffic from that client (and that client only). In addition, it can coordinate the details of an encrypted tunnel between the requestor and the resource to prevent traffic from being ‘sniffed on the wire’.
1.3. Components of Zero Trust and the Control Plane
Enforcing a Zero Trust model and the associated control plan that instructs the data plane to accept traffic from that client upon authentication requires some key components for the model to operate. The first and most fundamental is micro-segmentation and granular perimeter enforcement based on:
Their devices and its security posture
Their Context and other data
The above aspects are used to determine whether to trust a user, machine or application seeking access to a particular part of the enterprise.
In this case, the micro-segmentation technology essentially becomes the control plane. Per the above section, encryption on the wire is a key component of Zero Trust. For any micro-segmentation technology to be an effective control plane, it must:
Enforce traffic encryption between endpoints
Authenticate the user and machine based on their identity and not the network segment they are coming from.
1.4. Zero Trust Technologies
As stated earlier, Zero Trust is an architecture. Other than micro-segmentation, the following key technologies and processes are required to implement Zero Trust:
Multifactor authentication – to enforce strong authentication
Identity and Access Management – to irrefutably authenticate the user / application and the device
User and network behaviour analytics – to understand the relative behaviours of the user and the network they are coming from and highlight any unusual behaviour compared to a pre-established baseline which may indicate a compromised identity
Endpoint security – to ensure that the endpoint itself is clean and will not act as a conduit for an attacker to gain unauthorised access to data
Encryption – to prevent ‘sniffing of traffic on the wire’
Scoring – establishing a ‘score’ based on the perimeters above that will then determine whether access can be granted or not
Apart from the above key components, the following are needed as well:
File system permissions – needed in order to implement role based access controls
Auditing and logging – to provide monitoring capabilities in case unauthorised access is achieved
Granular role based access controls – to ensure access is on a ‘need to know basis only’
Supporting processes – all of the above needs to be supported by adequate operational procedures, processes and a conducive security framework so that the model operates as intended
Mindset and organisational change management – since Zero Trust is a shift in security thinking, a mindset change managed by robust change management is required to ensure the successful implementation of Zero Trust in an organisation.
1.5. Challenges with Zero Trust
So Zero Trust sounds pretty awesome, right? So why haven’t organisations adopted it fully?
As with any new technology or philosophy, there are always adoption challenges. Zero Trust is no different. At a high level, the key challenges in my experience are:
Change resistance – Zero Trust is a fundamental shift in the way security is implemented. As a result, there is resistance from many who are simply used to the traditional perimeter based security model
Technology focus as opposed to strategy focus – since Zero Trust is a model that will impact the entire enterprise, it requires careful planning and a strategy to implement this. Many are still approaching security from the angle that if we throw enough technology at it, it will be fine. Unfortunately, this thinking is what will destroy the key principles of Zero Trust
Legacy systems and environments – legacy systems and environments that we still need for a variety of reasons were built around the traditional perimeter based security model. Changing them may not be easy and in some cases may stop these systems from operating
Time and cost – Zero Trust is an enterprise wide initiative. As such, it requires time and investment, both of which may be scarce in an organisation.
1.6. Suggested Approach to Zero Trust
Having discussed some challenges to adopting a Zero Trust model above, let’s focus on an approach that may allow an organisation to implement a Zero Trust model successfully:
1. Take a multi-year and multi-phased approach – Zero Trust takes time to implement. Take your time and phase the project out to spread the investment over a few financial years
2. Determine an overall strategy and start from there – since Zero Trust impacts the entire enterprise, a well-crafted strategy is critical to ensure success. A suggested, phased approach is:
a. Cloud environments, new systems and digital transformation are good places to start – these tend to be greenfield and should be more conducive to a new security model
b. Ensure zero trust is built into new systems, and upgrades or changes – build Zero Trust by design, not by retrofit. As legacy systems are changed or retired, a Zero Trust model should be part of the new deployment strategy
c. Engage a robust change management program – mindset adjustment through good change management
3. Take a risk and business focus – this will allow you to focus on protecting critical information assets and justify the investments based on ROI and risk mitigation
4. Ensure maintenance and management of the new environment – as with everything, ensure your new Zero Trust deployment is well maintained and managed and does not degrade over time.
To summarise, Zero Trust is a security philosophy and architecture that will change the way traditional perimeter based security is deployed. A key component of it is the control plane that instructs the data plane to provide access to data. Zero Trust dictates that access can only be granted once the user / application and device are irrefutably authenticated and even then this access is provided on a ‘need to know’ basis only. Micro-segmentation is a key technology component of Zero Trust implementation and this paper has stated other key technology components and processes that are needed to implement Zero Trust adequately. This paper has discussed some of the challenges with implementing Zero Trust which include change resistance as well as legacy systems. The paper then provided an approach to implementing Zero Trust which included taking a phased approach based on a sound strategy underpinned by a risk and business focused approach.
Article | March 20, 2020
Social media has become an integral part of business promotion, especially to build brand image and maintain brand reputation. Small businesses to large corporations are active on various social media platforms to interact with their target audience daily. Moreover, the onset of the Pandemic has compelled businesses to rely more on these platforms to connect with their world of customers. This has skyrocketed the amount of information businesses, and customers share on social media. As a result, social media security threats have increased. Hackers are looking for a chance to get into accounts, steal personal and business information, and use it for various gains.
Publically accessible social media information is vulnerable to cyber-attacks from cybercriminals. To communicate with customers directly, corporations today operate multiple social media channels. However, cybersecurity measures have to be ensured within the organizations while accessing the channels to increase security. The commonly used safety models, such as the Least-Privileged Administrative model, can be applied in organizations to ensure security. In addition, social media access to employees should be minimized.
Taking necessary steps to increase social media security in organizations will help in avoiding deliberate sabotage. However, taking no care in this matter may jeopardize your business, as your company's platforms will be vulnerable to malpractices and attacks by cybercriminals.
These factors make social media security vital than ever before. Let us look into some social media security threats and mitigate them through adequate cybersecurity best practices.
Social Media Security Threats
Even if you ensure a hundred percentages of security for your social media channels, hackers can quickly get into your account through vulnerable third-party apps. International Olympics Committee and FC Barcelona were victims of it. Twitter accounts of these organizations were hacked through vulnerabilities of connected third-party apps. You cannot foresee how dangerous the third-party apps you use are.
Cyber adversaries trick their targets into installing malware to systems and start to control and monitor it. This way, they get sensitive information.
Phishing scams can quickly get into your social media security walls. Phishing scams make employees of organizations hand over information to frauds unknowingly. These can be private information such as passwords, bank details, etc.
Organizations are likely to use some accounts for some time and ignore them after a while. Cyber hackers are targeting these accounts, as they know no one is watching them. Even without hacking, they can post fraudulent messages on those accounts. They use an imposter account for it. They even can send malicious links from these unattended accounts to your followers. Therefore, these unmonitored accounts are a huge threat to your social media security.
Social Media Security Tips
Above mentioned are some of the social media security threats that corporations face while handling social media pages to interact with tier customers. However, following a social media strategy with stringent social media security best practices can save your company from these frauds and criminals. Cybersecurity products are also available to secure your online activities and business.
Social Media Policy
All organizations should have an effective social media strategy with a social media security policy for employees, especially those handling the profiles. The guidelines in this policy will make your social media executives handle the accounts safely. Additionally, it will save you from various vulnerabilities that make criminals break into your social media security walls.
Social Media Security Audit
Due to the technology improving every second, new vulnerabilities, threats, and new hacking tactics emerge. In addition, criminals are also coming up with new viruses, strategies, and scams to hack social media accounts. Thus, it is always good to audit the social media security measures implemented in your company. The audit should be done often, such as quarterly or semi-quarterly. This will ensure that your social media security measures are strong enough to fight new-age hackers.
Strong passwords alone can fight any social media security breaches and cybersecurity threats. Therefore, you have to ensure that you have a strong password for each of your accounts. Your employees should be educated regarding what constitutes a strong password. In addition, it is a good practice to change your password often.
According to privacy advocate of Comparitech, Paul Bischoff, two-way authentication is the best way to keep all your social media accounts secure.
Whenever an employee logs in from a new device, they are required to input a PIN sent to the account owner via an app, SMS, or email. This not only protects you from stolen passwords but can ensure that whoever is in charge of the accounts is present when logging in on new devices.
Although some social media channels provide this facility, it is better to enable it for all your accounts with all the channels to ensure social media security.
Social media is an integral part of business today. Companies need it to interact with customers to build brand image. However, social media security is a concern as technology is improving every second. Criminals are upgrading themselves with new tactics and techniques to hack accounts. Therefore, it is vital to follow and ensure stringent social media security best practices for your accounts to confirm your business's safety, avoiding going sensitive information to the wrong hands.
Frequently Asked Questions
Are social media channels safe for businesses?
Social media is an integral part of marketing today. Therefore, it has to be handled with utmost care and vigilance. It will harm your business if you do not adhere to essential social media security measures, as hackers can get into your accounts quickly.
What are some of the social media threats for businesses?
There are many social media threats for businesses. Some are unmonitored social media accounts, imposter accounts, vulnerable third-party apps, human error, and phishing attacks and scams.
"name": "Are social media channels safe for businesses?",
"text": "Social media is an integral part of marketing today. Therefore, it has to be handled with utmost care and vigilance. It will harm your business if you do not adhere to essential social media security measures, as hackers can get into your accounts quickly."
"name": "What are some of the social media threats for businesses?",
"text": "There are many social media threats for businesses. Some are unmonitored social media accounts, imposter accounts, vulnerable third-party apps, human error, and phishing attacks and scams."