02.11.2021 Views

Cyber Defense eMagazine November Edition for 2021

Cyber Defense eMagazine November Edition for 2021 #CDM #CYBERDEFENSEMAG @CyberDefenseMag by @Miliefsky a world-renowned cyber security expert and the Publisher of Cyber Defense Magazine as part of the Cyber Defense Media Group as well as Yan Ross, US Editor-in-Chief, Pieruligi Paganini, International Editor-in-Chief and many more writers, partners and supporters who make this an awesome publication! Thank you all and to our readers! OSINT ROCKS! #CDM #CDMG #OSINT #CYBERSECURITY #INFOSEC #BEST #PRACTICES #TIPS #TECHNIQUES See you at RSA Conference 2022 - Our 10th Year Anniversary - Our 10th Year @RSAC #RSACONFERENCE #USA - Thank you so much!!! - Team CDMG

Cyber Defense eMagazine November Edition for 2021 #CDM #CYBERDEFENSEMAG @CyberDefenseMag by @Miliefsky a world-renowned cyber security expert and the Publisher of Cyber Defense Magazine as part of the Cyber Defense Media Group as well as Yan Ross, US Editor-in-Chief, Pieruligi Paganini, International Editor-in-Chief and many more writers, partners and supporters who make this an awesome publication! Thank you all and to our readers! OSINT ROCKS! #CDM #CDMG #OSINT #CYBERSECURITY #INFOSEC #BEST #PRACTICES #TIPS #TECHNIQUES

See you at RSA Conference 2022 - Our 10th Year Anniversary - Our 10th Year @RSAC #RSACONFERENCE #USA - Thank you so much!!! - Team CDMG

SHOW MORE
SHOW LESS

Create successful ePaper yourself

Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.

The Top 3 <strong>Cyber</strong> Security Mistakes and How<br />

to Avoid Them<br />

NetOps Enhances Security<br />

Guntrader Data Breach: Victims Concerned<br />

Over Impact<br />

Is the Edge Really Secure?<br />

<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 1<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


CONTENTS<br />

Welcome to CDM’s <strong>November</strong> <strong>2021</strong> Issue ---------------------------------------------------------------------------------------- 6<br />

The Top 3 <strong>Cyber</strong> Security Mistakes and How to Avoid Them ------------------------------------------------------34<br />

By Ivan Paynter, National <strong>Cyber</strong>security Specialist at ScanSource<br />

NetOps Enhances Security ---------------------------------------------------------------------------------------------------37<br />

By Simon Pincus, VP of Engineering, Opengear<br />

Guntrader Data Breach: Victims Concerned Over Impact ----------------------------------------------------------40<br />

By Aman Johal, Lawyer and Director, Your Lawyers<br />

You’ve Been Attacked by Ransomware. How Will You Respond? ------------------------------------------------43<br />

By Steve Schwartz, director of security, ECI<br />

Digital Trans<strong>for</strong>mation Security: Guidelines <strong>for</strong> Success ------------------------------------------------------------47<br />

By Yehudah Sunshine, Head of PR, odix<br />

Why The Integration of Netops And Secops Is Here To Stay -------------------------------------------------------51<br />

By Eileen Haggerty, Sr. Director, Enterprise Business Operations, NETSCOUT<br />

What To Know to Fight Against <strong>Cyber</strong> Attacks ------------------------------------------------------------------------54<br />

By Gergo Varga, Senior Content Manager / Evangelist at SEON<br />

Five Cloud Telephony Security Vulnerabilities That Can Threaten Your Business ----------------------------57<br />

By Sujan Thapaliya, CEO and Co-Founder, KrispCall<br />

The 5 Most Common <strong>Cyber</strong>-Attacks on Mobile Devices In <strong>2021</strong> --------------------------------------------------63<br />

By Nicole Allen, Marketing Executive, Salt Communications.<br />

Why Email Archiving Builds <strong>Cyber</strong> Resilience --------------------------------------------------------------------------68<br />

By Adnan A. Olia, Chief Operating Officer, Intradyn<br />

Overcoming the Limitations of VPN, NAC, and Firewalls with Zero Trust Access ----------------------------73<br />

By Burjiz Pithawala, CPO & Co-Founder, Elisity<br />

Multicloud Rolls In: Federal IT Professionals Share Insights and Challenges ----------------------------------78<br />

By Rick Rosenburg, Vice President and General Manager, Rackspace Government Solutions, Rackspace<br />

Technology<br />

SOAR Into More Integrated <strong>Cyber</strong>security ------------------------------------------------------------------------------81<br />

By Josh Magady, Section Manager, Senior <strong>Cyber</strong>security Consultant, and Practice Technical Lead, 1898 & Co.<br />

Analyzing The Security Challenge of Hybrid and Remote Working Models -----------------------------------84<br />

By Mike East, VP EMEA, Menlo Security<br />

<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 2<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


How To Effectively Secure Connected Devices -------------------------------------------------------------------------88<br />

By Gnanaprakasam Pandian, Chief Product Officer and Co-Founder, Ordr<br />

Financial Institutions Leveraging CIAM Benefits to Scale Customer Experience and Brand Equity -----91<br />

By Balraj Dhillon, Director – Engagement & Delivery, Simeio<br />

How Certificate Pinning Helps Thwart Mobile MitM Attacks -----------------------------------------------------94<br />

By David Stewart, CEO, Approov<br />

What Do Spear Phishing Attacks Look Like In <strong>2021</strong>? -------------------------------------------------------------- 101<br />

By Tim Sadler, Co-Founder & CEO, Tessian<br />

Keeping Your Guard Up: Protecting Against Inherent Trust Risks --------------------------------------------- 105<br />

By Zubaid Kazmi, a managing director in MorganFranklin Consulting’s cybersecurity practice<br />

Empowering Your Employees To Prevent <strong>Cyber</strong>attacks In A Remote Work Era ---------------------------- 108<br />

By Bill DeLisi, CEO of GOFBA – a leading secure search engine and communication plat<strong>for</strong>m<br />

Lateral Movement – The Key Element in Advanced Attacks ----------------------------------------------------- 111<br />

By Jon Murchison, founder and CEO, Blackpoint <strong>Cyber</strong><br />

When Does a Vulnerability Become a Vulnerability? -------------------------------------------------------------- 115<br />

By Jason Kent, Hacker in Residence, Cequence Security<br />

How To Bring Your Own Key to Hybrid Cloud Without Losing Control Of Your Data --------------------- 119<br />

By Marcella P. Arthur, VP Global Marketing, Unbound Security<br />

Protect Data with Deep Packet Inspection or Be Breached ------------------------------------------------------ 125<br />

By Randy Reiter CEO of Don’t Be Breached<br />

Can Netflix Save <strong>Cyber</strong>security? ----------------------------------------------------------------------------------------- 128<br />

By Corey White, co-founder, and CEO of Cyvatar<br />

How To Do Disruptive Innovation Right ------------------------------------------------------------------------------- 133<br />

By Karla Jo Helms, FOUNDER & CEO, JOTO PR Disruptors<br />

<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 3<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


@MILIEFSKY<br />

From the<br />

Publisher…<br />

Dear Friends,<br />

We’ll be celebrating our 10 th Year in business and of our Global InfoSec Awards and as a<br />

From my hawkeye view at the head of <strong>Cyber</strong> <strong>Defense</strong> Media Group (CDMG), every day I see the<br />

emergence of many trends and fact patterns. This month is no exception. But with these challenges,<br />

including Active Directory becoming the major target vector of exploiters, we see solutions like Attivo<br />

Networks and Cion Systems among others focusing on the proactive defense and hardening of Active<br />

Directory.<br />

Suggestion: get a budget <strong>for</strong> “AD SECURITY” like your job and security posture depends on it. IAM is a<br />

target. Identities are GOLD to cybercriminals – like a golden ticket attack.<br />

Among the opportunities CDMG offers is our currently active 10 th Global Infosec Awards 2022,<br />

happening during the RSA Conference <strong>for</strong> 2022. It’s our 10 th year in business as well and we feel blessed<br />

and are so thankful to our partners, to the winners, leaders, vendors, product and service buyers,<br />

customers all whom share our belief that yes, we can get one step ahead of the next threat.<br />

As always, among the valuable resources we rely on to respond to cyber threats are the providers of<br />

cybersecurity solutions; we commend your attention to the excellent group of articles in this month’s<br />

<strong>Cyber</strong> <strong>Defense</strong> Magazine.<br />

Wishing you all success in your own cyber endeavors.<br />

Warmest regards,<br />

Platinum Media Partner of RSA Conference on Feb 7 – 10, 2022 – See You There!<br />

Gary S.Miliefsky, CISSP®, fmDHS<br />

CEO, <strong>Cyber</strong> <strong>Defense</strong> Media Group<br />

Publisher, <strong>Cyber</strong> <strong>Defense</strong> Magazine<br />

P.S. When you share a story or an article or in<strong>for</strong>mation about<br />

CDM, please use #CDM and @<strong>Cyber</strong><strong>Defense</strong>Mag and<br />

@Miliefsky – it helps spread the word about our free resources<br />

even more quickly<br />

<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 4<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


@CYBERDEFENSEMAG<br />

CYBER DEFENSE eMAGAZINE<br />

Published monthly by the team at <strong>Cyber</strong> <strong>Defense</strong> Media Group and<br />

distributed electronically via opt-in Email, HTML, PDF and Online<br />

Flipbook <strong>for</strong>mats.<br />

INTERNATIONAL EDITOR-IN-CHIEF & CO-FOUNDER<br />

Pierluigi Paganini, CEH<br />

Pierluigi.paganini@cyberdefensemagazine.com<br />

InfoSec Knowledge is Power. We will<br />

always strive to provide the latest, most<br />

up to date FREE InfoSec in<strong>for</strong>mation.<br />

From the International<br />

Editor-in-Chief…<br />

On the international front, we continue to see developments<br />

involving privacy regulations, ransomware developments, and<br />

criminals operating within jurisdictions which either deny their<br />

existence or refuse their extradition.<br />

Un<strong>for</strong>tunately, the continuation of diverse and sometimes<br />

conflicting initiatives tends to drive us farther away from creating<br />

and adopting common solutions, and often sets up dynamics more<br />

favorable to threat actors than the societies and nations we seek to<br />

protect.<br />

To some degree, the private sector may be encouraged to take the<br />

lead in breaking out of this impasse. As has been observed many<br />

times be<strong>for</strong>e, the imperatives of government differ fundamentally<br />

from those of industry. At the same time, it’s interesting to note<br />

that some of the wider concerns <strong>for</strong> society appear to be gaining<br />

greater influence with private sector entities.<br />

Some of those influences are positive and in the ordinary course of<br />

business; some are better understood as risk-averse, as in avoiding<br />

civil liability <strong>for</strong> lapses in cybersecurity practices.<br />

The message remains clear, however, that the international<br />

implications <strong>for</strong> both government and business participants cannot<br />

ignore the importance of cybersecurity.<br />

To our faithful readers, we thank you,<br />

Pierluigi Paganini<br />

International Editor-in-Chief<br />

US EDITOR-IN-CHIEF<br />

Yan Ross, JD<br />

Yan.Ross@cyberdefensemediagroup.com<br />

ADVERTISING<br />

Marketing Team<br />

marketing@cyberdefensemagazine.com<br />

CONTACT US:<br />

<strong>Cyber</strong> <strong>Defense</strong> Magazine<br />

Toll Free: 1-833-844-9468<br />

International: +1-603-280-4451<br />

SKYPE: cyber.defense<br />

http://www.cyberdefensemagazine.com<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine, a division of CYBER<br />

DEFENSE MEDIA GROUP<br />

1717 Pennsylvania Avenue NW, Suite 1025<br />

Washington, D.C. 20006 USA<br />

EIN: 454-18-8465, DUNS# 078358935.<br />

All rights reserved worldwide.<br />

PUBLISHER<br />

Gary S. Miliefsky, CISSP®<br />

Learn more about our founder & publisher at:<br />

http://www.cyberdefensemagazine.com/about-our-founder/<br />

9+ YEARS OF EXCELLENCE!<br />

Providing free in<strong>for</strong>mation, best practices, tips, and<br />

techniques on cybersecurity since 2012, <strong>Cyber</strong> <strong>Defense</strong><br />

magazine is your go-to-source <strong>for</strong> In<strong>for</strong>mation Security.<br />

We’re a proud division of <strong>Cyber</strong> <strong>Defense</strong> Media Group:<br />

CYBERDEFENSEMEDIAGROUP.COM<br />

MAGAZINE TV RADIO AWARDS<br />

PROFESSIONALS VENTURES WEBINARS<br />

CYBERSECURITYMAGAZINE (FOR CONSUMERS)<br />

<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 5<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


Welcome to CDM’s <strong>November</strong> <strong>2021</strong> Issue<br />

From the U.S. Editor-in-Chief<br />

As always, in this month’s issue of <strong>Cyber</strong> <strong>Defense</strong> Magazine, we are pleased to include a broad variety of excellent<br />

articles with actionable intelligence from highly knowledgeable cyber professionals.<br />

Risk identification, attack prevention, and incident response <strong>for</strong>m the bulk of this month’s articles, with<br />

contributions coming from domestic and international sources, as well as from public and private sector<br />

writers.<br />

Not only do we see solutions to today’s recognized threats, but also projections of responses to attacks<br />

our expert writers perceive to be coming down the pike.<br />

We continue to draw your attention to the 16 elements of our critical infrastructure, which are fast<br />

becoming the most targeted areas <strong>for</strong> cyber criminals. In my role as editor, I would reiterate my call to<br />

our readers to become familiar with the 16 areas of critical infrastructure designated by the Department<br />

of Homeland Security, found at www.dhs.gov . Going <strong>for</strong>ward, activities in these areas will become more<br />

and more important in the world of cybersecurity.<br />

In this <strong>November</strong> <strong>2021</strong> issue, we continue our tradition of making <strong>Cyber</strong> <strong>Defense</strong> Magazine most valuable<br />

to our readers by keeping current on emerging trends and solutions in the world of cybersecurity.<br />

Wishing you all success in your cybersecurity endeavors,<br />

Yan Ross<br />

US Editor-in-Chief<br />

<strong>Cyber</strong> <strong>Defense</strong> Magazine<br />

About the US Editor-in-Chief<br />

Yan Ross, J.D., is a <strong>Cyber</strong>security Journalist & U.S. Editor-in-Chief of <strong>Cyber</strong><br />

<strong>Defense</strong> Magazine. He is an accredited author and educator and has provided<br />

editorial services <strong>for</strong> award-winning best-selling books on a variety of topics. He<br />

also serves as ICFE's Director of Special Projects, and the author of the<br />

Certified Identity Theft Risk Management Specialist ® XV CITRMS® course. As<br />

an accredited educator <strong>for</strong> over 20 years, Yan addresses risk management in<br />

the areas of identity theft, privacy, and cyber security <strong>for</strong> consumers and organizations holding sensitive personal<br />

in<strong>for</strong>mation. You can reach him by e-mail at yan.ross@cyberdefensemediagroup.com<br />

<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 6<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 7<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 8<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 9<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 10<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 11<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 12<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 13<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 14<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 15<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 16<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 17<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 18<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 19<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 20<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 21<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 22<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 23<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 24<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 25<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 26<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 27<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 28<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 29<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 30<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 31<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 32<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 33<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


The Top 3 <strong>Cyber</strong> Security Mistakes and How to Avoid<br />

Them<br />

As hacks become more common, organizations have no room <strong>for</strong> cybersecurity mistakes.<br />

By Ivan Paynter, National <strong>Cyber</strong>security Specialist at ScanSource<br />

Ransomware cost Americans an estimated $1.4 billion last year, and beyond high-profile hacks<br />

like the Kaseya and Colonial Pipeline breaches, cyber threats are more common than ever. As a<br />

result, businesses of all sizes are scrambling to learn more about cyber security and ensure that they<br />

have the proper measures in place to protect their operations. These are the top three considerations<br />

organizations must take into account when implementing or upgrading their cyber security approach.<br />

1. People and Training<br />

First and <strong>for</strong>emost, there is a significant lack of cybersecurity education among employees. The<br />

human firewall is the most important defense, but it is also the most vulnerable. That means<br />

security training has to be a top priority when it comes to an organization’s cyber security.<br />

Organizations should implement a security awareness training plat<strong>for</strong>m which trains, tests and<br />

scores all employees. It’s important to teach employees how to identify cyber security threats and<br />

remain vigilant toward anything suspicious, such as scams, fraudulent emails, or even physical<br />

threats. It’s also important to consider implementing some sort of email gateway filter. With the<br />

rise of remote working, additional problems emerge as more people go mobile. For example, it is<br />

much easier on mobile to mix company and private mail and people tend to click quickly, which<br />

leads to errors. We all need to slow down, verify incoming requests and be cognizant of what we<br />

are clicking on so that we do not fall victim to a cyber security threat.<br />

<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 34<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


2. Technology and System<br />

It is also paramount that organizations ensure systems are fully patched, inclusive of their OS,<br />

firmware and applications. They must ensure each endpoint detection and response application<br />

is installed on each device, with all systems reporting back to a central location or Security<br />

Operation Center, where all notifications, events, and alarms can be correlated. A quality<br />

Detection and Response application is not only going to defend against malware and other<br />

malicious activity, but it will also identify possible insider threats by monitoring lateral traffic.<br />

Utilizing such Security SaaS should be part of the overarching security plat<strong>for</strong>m which will provide<br />

a level of behavioral analytics with the ability to determine what is standard <strong>for</strong> that user and/or<br />

system. There<strong>for</strong>e, this allows organizations to identify unusual activity, even if the user has the<br />

rights to the systems being accessed.<br />

Additionally, I would suggest V-LANs and least privilege access or even zero trust as a greater<br />

security play. For example, IoT devices should not cohabitate on the same V-LAN as the<br />

accounting or human resources department. This type of network segmentation allows <strong>for</strong> greater<br />

risk reduction.<br />

3. Staffing and Security Operations<br />

Many organizations <strong>for</strong>go the managed services model to create an in-house security operation<br />

center, believing they can do it themselves. There are many cyber security tools available;<br />

however, there are very few trained and certified security engineers, and these tools often rely<br />

upon alarms, event notifications, or automated messaging to provide alerts. However, this begs<br />

the question, who will be monitoring and mitigating the environment at 3 a.m. on New Year’s Eve?<br />

Effective cyber security infrastructure requires extensive resources to reduce the total volume of<br />

alerts, alarms and events to an actionable notification which requires mitigation. Vacation,<br />

training, sick time, education and retention programs are all factors to consider when creating a<br />

security operator center. There is a deficit of security analysts, engineers and architects<br />

throughout the cyber security space today. Even if you can hire a strong team of cyber security<br />

specialists, security operation centers require at least five to six people to ensure 24/7 coverage.<br />

In addition to the personnel issues, there are also equipment, software updates and proper<br />

configuration to consider. True quality deployment will require multiple layers, and the systems<br />

will have to be integrated, monitored and managed. In comparison, an organization that<br />

outsources its cyber security needs can depend upon systems being maintained and a team of<br />

experts to support them. Simply put, organizations should secure their environment through a<br />

third-party managed security service. These services are inclusive of EDRs, patching systems, a<br />

security in<strong>for</strong>mation event manager, behavioral analytics and east/west traffic monitoring. At best,<br />

with the current staffing shortage, an in-house SOC is an ineffective method to detect, quarantine<br />

and/or remediate an infected device and/or network.<br />

<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 35<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


Hackers are only becoming more sophisticated and, big or small, no organization can af<strong>for</strong>d to go<br />

unprotected. Being aware of these three points is critical in protecting your organization from cyber<br />

threats. In the current cyber security environment, there is no room <strong>for</strong> mistakes.<br />

About the Author<br />

Ivan Paynter is the National <strong>Cyber</strong> Security Specialist of ScanSource<br />

and has over 30 years of experience in cyber security, working at<br />

Verizon and Masergy be<strong>for</strong>e coming to ScanSource in 2019.<br />

Ivan can be reached online on LinkedIn and through ScanSource’s<br />

company website https://www.scansource.com/<br />

<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 36<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


NetOps Enhances Security<br />

Growing numbers of network engineers turn to this IT mindset to address mounting concerns of network<br />

safety in an age of hybrid work and edge commuting<br />

By Simon Pincus, VP of Engineering, Opengear<br />

Today, NetOps (network operations) utilizes a combination of automation, virtualization and<br />

orchestration, to make networking operations and functions faster and more accessible. While the<br />

potential <strong>for</strong> greater productivity may seem to be the main pull <strong>for</strong> engineers to adopt the current NetOps<br />

iteration, more than four in ten (41%) network managers, network engineers and network architects say<br />

their organizations use NetOps to enhance network security. In fact, the top use <strong>for</strong> NetOps overall,<br />

according to new research spanning the U.K., the U.S., France and Germany is network security. The<br />

research also revealed that a growing number of network engineers are turning to NetOps, specifically,<br />

to bolster their network security.<br />

Why Security?<br />

Network engineers understand that without the network, conducting business isn’t possible. A survey of<br />

500 senior IT decision-makers found that security is key to avoiding network downtime. Although the shift<br />

<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 37<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


to remote work and virtualization are partly to blame <strong>for</strong> the rise in costlier and more common network<br />

outages, the primary culprit <strong>for</strong> network downtime is that networks are becoming more layered, and as a<br />

result, more vulnerable. Software stacks must be updated more regularly, creating more opportunities <strong>for</strong><br />

cyber-criminals to compromise systems. Moreover, with bad actors and external bots constantly probing<br />

corporate networks <strong>for</strong> weaknesses, there was a recent rise in unassuming employees falling victim to<br />

phishing attacks resulting in breaches and downtime.<br />

Customers today expect uninterrupted network experiences, and because everything from leisure to<br />

work-related activities is dependent on a stable network connection, it is not an unreasonable<br />

expectation. The health of networks directly correlates to the health of businesses. Increasingly,<br />

organizations consider network resilience to be a necessity rather than an insurance policy. Security is a<br />

critical aspect of network resilience, or the ability to keep a network running during issues, ensuring<br />

business continuity. Whether at the core or on the edge of infrastructure, network resilience prevents<br />

disruptions to the customer experience from cyber-attacks.<br />

The True Cost of a Poor Security Posture<br />

Network engineers are leveraging NetOps because they know the true cost of a network outage is much<br />

more than the loss of revenue. According to the same survey of the 500 senior IT decision-makers, the<br />

three greatest impacts network outages have on their organizations included clear drops in customer<br />

satisfaction (41%), data loss (34%) and financial loss (31%). Additionally, 39% of companies revealed<br />

that it took more than a full day to restore network functions after an outage. Likewise, in 2020 alone,<br />

31% of companies lost at least one million USD due to downtime. Downtime consequences are so severe<br />

that they could lead to an untimely disaster <strong>for</strong> a business.<br />

Unsurprisingly, due to the heightened risk of outages and increases in cyber-attacks, 83% of network<br />

engineers put network resilience as their number one priority. And because network outages from cyberattacks<br />

are a matter of when and not if – businesses can deploy NetOps to minimize the most damaging<br />

effects.<br />

NetOps and Network Management<br />

Network engineers use NetOps <strong>for</strong> its various benefits, from the standard day-to-day processes of<br />

keeping the network running to providing an alternative route to remediate the network when it goes<br />

down. Increasingly, NetOps is used to build and maintain a network that is automated, agile and available.<br />

Having this type of network is vital to protecting the production network from accidental misconfiguration<br />

or, more importantly, cyberattacks. Furthermore, all network configuration and management should be<br />

restricted to the core network operations team through an independent management plane, including an<br />

out-of-band network; this has led to the management plane being referred to as the network <strong>for</strong> network<br />

engineers.<br />

Those organizations who use an independent secure management plane separate from the production<br />

network, such as an out-of-band network, noticed significant improvements to their security. Similarly,<br />

<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 38<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


the businesses utilizing an independent management plane experienced fast remediation of devices and<br />

the heightened monitoring of their remote network. As stated early, security was central to reducing<br />

network downtime. For instance, 39% of respondents using an SD-WAN deployment from the same<br />

survey that observed the increase in adoption of NetOps amongst network engineers said that they use<br />

multi-layer security to avoid downtime. One in five (18%) of those surveyed indicated that they use endto-end<br />

micro-segmentation and security zoning.<br />

NetOps <strong>for</strong> Network Engineers<br />

NetOps is fundamentally changing the role of the network engineer. With network teams having more<br />

locations to look after, more equipment to manage and more flowing data to oversee, the purpose of the<br />

network engineer had to grow exponentially to keep up. Now, using the tools and capabilities of NetOps,<br />

IT personal have evolved their role from one that was reliant upon manual process to a fully automated<br />

approach. Through automation, businesses can enhance their security and network monitoring while also<br />

accelerating their cloud adoption. As a result, organizations will decrease unwanted downtime and<br />

safeguard themselves financially and reputationally.<br />

About the Author<br />

Simon Pincus is responsible <strong>for</strong> the Opengear Engineering<br />

team, developing, releasing and maintaining all Opengear<br />

software and hardware products. He has over 28 years of<br />

experience in product management and product development<br />

roles. Prior to joining Opengear, Simon held senior management<br />

roles at CSG, Intec and ADC. He has worked in technology<br />

companies serving a variety of industries including<br />

Telecommunications and Customer Communication Centres. His passion is building engineering teams<br />

that develop products that delight customers, with the highest quality, usability and responsiveness to<br />

changing business needs. Simon holds a BSc (Hons) degree in Computer Science from the University<br />

of Queensland. Simon can be reached online at LinkedIn and at our company website<br />

https://opengear.com/.<br />

<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 39<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


Guntrader Data Breach: Victims Concerned Over Impact<br />

By Aman Johal, Lawyer and Director, Your Lawyers<br />

In July <strong>2021</strong>, the details of over 111,000 Guntrader users – which included registered firearm owners -<br />

were leaked online after a cybersecurity breach affecting the Guntrader.co.uk website.<br />

Guntrader, an online plat<strong>for</strong>m that allows farmers, landowners and shooting enthusiasts to buy or sell<br />

firearms online, reportedly attracts more than 350,000 visitors each month. Given the volume of visitors<br />

and the nature of the in<strong>for</strong>mation they store and process, strong cybersecurity ought to be at the <strong>for</strong>efront<br />

of the company’s mind.<br />

Un<strong>for</strong>tunately, a wealth of sensitive in<strong>for</strong>mation has been exposed. The personal in<strong>for</strong>mation affected<br />

was incredibly detailed in some cases, including names, home addresses, postcodes, phone numbers,<br />

email addresses, IP addresses, and ID numbers, as well as details of the users’ account creation date,<br />

last login dates and times, last login browser details, and even latitude and longitude coordinates of their<br />

last login.<br />

Alarmingly, it has since been reported that victims’ details have been published in a Google Earthcompatible<br />

<strong>for</strong>mat, specifically pinpointing their locations.<br />

<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 40<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


Sensitive data exposure and the serious and long-term impact<br />

The in<strong>for</strong>mation exposure could pose a serious, prolonged and direct risk <strong>for</strong> the victims. These<br />

individuals could now be targeted, and firearms owners affected by the breach, or anyone who has<br />

recently moved to an address previously linked to a gun owner, could also be at risk of being targeted by<br />

criminals.<br />

Organised crime groups could target data breach victims, and affected firearm owners have been advised<br />

to be wary and ensure that they have sufficient home security deployed. However, individuals living in<br />

the previous addresses of gun owners may be unaware that they are even at risk, which is a further<br />

cause <strong>for</strong> concern.<br />

The implications of this threat could have a significant and long term impact on the victims. It is common<br />

<strong>for</strong> data breach victims to suffer from distress caused by the loss of control of their personal in<strong>for</strong>mation,<br />

and ruminating over risks and worries can lead to recognised and diagnosable conditions, such as anxiety<br />

and depression. Your Lawyers represents thousands of data breach victims, and many have required<br />

medical help to manage the impact of a data breach.<br />

Serious data breaches like this are becoming increasingly frequent, and cybercriminals do target data<br />

controllers in charge of particularly sensitive in<strong>for</strong>mation. It is clear to see how badly victims can be<br />

affected when such sensitive in<strong>for</strong>mation is exposed.<br />

In another recent example from September, the Ministry of Defence accidentally leaked the personal<br />

in<strong>for</strong>mation of Afghan interpreters, with the email addresses of more than 250 Afghan interpreters who<br />

worked <strong>for</strong> British <strong>for</strong>ces being erroneously shared. This group is already at heightened risk due to the<br />

political climate in Afghanistan, and the timing of this leak is alarming given the volatile situation there.<br />

Organisations need to take their data protection responsibilities seriously and understand, at all times,<br />

the real-life repercussions of in<strong>for</strong>mation exposure.<br />

Victims must demand accountability<br />

People should not allow data breaches to go unpunished. Victims can take action with data breach<br />

compensation claims and by joining class action cases against the organisations responsible <strong>for</strong> large<br />

data breach incidents. Holding companies accountable is an important way to ensure best practice<br />

cybersecurity becomes commonplace in the future.<br />

Given the severity of an incident like the Guntrader data breach, settlement pay-outs could be substantial.<br />

If enough people come <strong>for</strong>ward to join the Your Lawyers Claimant Group, a Group Litigation Order (GLO)<br />

may be initiated unless the Defendant agrees to settle cases<br />

Victims can be eligible to claim compensation on a No Win, No Fee basis by contacting Your Lawyers<br />

via its Data Leak Lawyers website here: https://www.dataleaklawyers.co.uk/start-your-claim<br />

<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 41<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


About the Author<br />

Aman founded consumer action law firm Your Lawyers in 2006,<br />

and over the last decade he has grown Your Lawyers into a<br />

highly profitable litigation firm.<br />

Your Lawyers is a firm which is determined to fight on behalf of<br />

Claimants and to pursue cases until the best possible outcomes<br />

are reached. They have been appointed Steering Committee<br />

positions by the High Court of Justice against big corporations like British Airways - the first GDPR GLO<br />

- as well as the Volkswagen diesel emissions scandal, which is set to be the biggest consumer action<br />

ever seen in England and Wales.<br />

Aman has also has successfully recovered millions of pounds <strong>for</strong> a number of complex personal injury<br />

and clinical negligence claims through to settlement, including over £1.2m in damages <strong>for</strong> claimants in<br />

the PIP Breast Implant scandal. Aman has also been at the <strong>for</strong>efront of the new and developing area of<br />

law of compensation claims <strong>for</strong> breaches of the Data Protection Act, including the 56 Dean Street Clinic<br />

data leak and the Ticketmaster breach.<br />

Aman can be reached via our company website https://www.dataleaklawyers.co.uk/start-your-claim<br />

<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 42<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


You’ve Been Attacked by Ransomware. How Will You<br />

Respond?<br />

By Steve Schwartz, director of security, ECI<br />

Earlier this year, a ransomware attack on the Colonial Pipeline led to a shutdown of 45% of the East<br />

Coast's fuel supply, 12,000 gas stations running dry and the highest gas costs in years. Five days and<br />

$4.4 million later, the pipeline was back up, with the CEO of the company acknowledging he authorized<br />

the ransom payment because executives weren’t sure of the extent of the breach and how long it would<br />

take to restore operations.<br />

He noted, “I will admit that I wasn’t com<strong>for</strong>table seeing money go out the door to people like this.”<br />

Yet, it was all about business, and eerily, that’s what it was <strong>for</strong> the perpetrators. Hackers from DarkSide<br />

were quick to make this point clear; the attack had nothing to do with a political agenda or social causes<br />

-- it was about money. Period. DarkSide not only carries out such attacks, it offers Ransomware-as-a-<br />

Service so aspiring cybercriminals can profit from doing the same. In fact, DarkSide provided assurance<br />

that moving <strong>for</strong>ward they’d “check each company that our partners want to encrypt to avoid social<br />

consequences in the future.”<br />

<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 43<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


Sounds fairly professional, right? You bet it is. And that should worry a chief in<strong>for</strong>mation officer (CIO),<br />

whether they’re in investing, insurance or any industry where identifying, assessing and quantifying risk<br />

to the organization is essential. Businesses produce a wealth of data, and not only can downtime take a<br />

devastating financial toll and result in missed opportunities, a breach can ruin a corporate reputation and<br />

send customers <strong>for</strong> the door.<br />

CIOs don’t want that and hackers know it. Further, their perception is organizations must have the<br />

resources to pay huge demands, quickly, and their cybersecurity ef<strong>for</strong>ts are probably underfunded<br />

because corporate emphasis is placed on generating profit.<br />

In their eyes, this all makes your company a prime target.<br />

First things first<br />

Yes, hackers know when they have a company over a barrel. So, how should you respond to a<br />

ransomware attack? What actions should you immediately take or avoid?<br />

The immediate question <strong>for</strong> many leaders is should they pay the ransom at all? The knee jerk reaction is<br />

“no” in order to discourage extortion. But, the reality is, the pros and cons needs to be examined on a<br />

case by case basis. Operations must get back up and running ASAP, so nine times out of 10, paying a<br />

ransom is a straight business decision. After all, inaccessible data equals loss, and in a worst-case<br />

scenario, perhaps even the end of a company<br />

There are two mistakes that often occur during response. Failure of personnel to immediately report the<br />

initial signs of an attack can enable ransomware to spread across systems and do even greater damage.<br />

This can be caused by an employee lacking understanding about what’s happening, thinking they can<br />

rectify the situation and getting in over their heads or simply not wanting to admit there’s an issue out of<br />

fear. The other mistake is turning off systems and possibly losing the ability to recover keys or thoroughly<br />

conduct a <strong>for</strong>ensic investigation.<br />

Some companies wonder if they should take matters into their own hands and look <strong>for</strong> decryption keys<br />

online. Once you’ve contained the malware, then you can search online or even try to get them directly<br />

from the locked system. With limited ransomware applications being written, there isn’t a huge volume of<br />

keys out there, so it’s possible to find them. Some groups use static keys, which are easily decrypted,<br />

others use asymmetric ones and key pairs, which are more difficult to crack. But it helps that hackers<br />

often re-use the same underlying code.<br />

What are you going to do about it?<br />

Today, it’s not a matter of if you’re going to be attacked, it’s a matter of when. But there’s plenty you can<br />

do to mitigate risk, including the following:<br />

<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 44<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


● Stop the bleeding: Segregate the system or systems from the networks so you can reduce<br />

the damage and keep other parts of your business running.<br />

● Maintain backups: Be sure you regularly review backups of your data so that you can<br />

recover with as little loss as possible. If a full restore will take longer than you can tolerate,<br />

prioritize the data and applications to be restored in order of importance.<br />

● Create and update response plans: These strategies should include such things as<br />

immediate containment tasks, chain of command, disaster recovery processes and more. Update<br />

these regularly whereas new threats are constantly emerging, personnel can leave key posts and<br />

infrastructure changes.<br />

● Assess and test: Per<strong>for</strong>m risk assessments and network penetration tests. This includes<br />

conducting table-top exercises so IT and executives can define and refine the response plan.<br />

● Go phishing: Employees are often the way into a company’s network, particularly now<br />

whereas remote workers often have lax security. Test them with fake phishing attempts and be<br />

sure to regularly conduct preventative training.<br />

Fuel <strong>for</strong> thought<br />

Some attacks I’ve seen have been investigated internally, but typically, these ef<strong>for</strong>ts don’t include a<br />

<strong>for</strong>ensic chain of custody that provides the chronological electronic evidence needed <strong>for</strong> a court of law. I<br />

make this distinction because I believe it’s very difficult <strong>for</strong> a company to get all the data that they need<br />

in order to take legal action that may result from a ransomware or other type of attack.<br />

If an organization uses a managed services provider (MSP) to get the cloud-based services they need,<br />

they likely won’t need to hire a <strong>for</strong>ensic investigator to delve deeper. For that matter, an MSP can defray<br />

a lot of costs, concerns and aggravation, particularly if they cater to industries that deal with financial and<br />

sensitive data. MSPs tend to have the best security in place, constantly invest in new technology and<br />

have experts versed in best practices and fast recovery. And, it doesn’t hurt to have a team that can take<br />

a calm, collected approach during chaos.<br />

The Colonial Pipeline attack has indeed given CIOs “fuel <strong>for</strong> thought.” In a way, that’s good, after all, the<br />

frequency of ransomware and other threats is on the rise. Your organization could be next – so be sure<br />

you’re ready.<br />

<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 45<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


About the Author<br />

Steve Schwartz, director of security, ECI.<br />

Steve has spent more than 15 years in the cybersecurity industry<br />

with the past five at ECI. At ECI he helps clients understand the<br />

shifting cybersecurity landscape and to plan, prepare and respond<br />

<strong>for</strong> cyber-related events. Steve also works to bridge the gap<br />

between the business and the security priorities, helping<br />

organizations make sense of their investments.<br />

Prior to joining ECI, Steve spent five years in the U.S. Navy onboard a submarine and has worked with<br />

several boutique consulting organizations in addition to S&P Global Markets and PwC. Steve’s<br />

experiences primarily revolve around penetration testing and security assessments. He has worked with<br />

a variety of different security standards and frameworks and has multiple industry recognized<br />

certifications.<br />

Steve can be reached online at Sschwartz@eci.com and at our company website ECI: Cloud, Digital<br />

Services and <strong>Cyber</strong>security Solutions<br />

<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 46<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


Digital Trans<strong>for</strong>mation Security: Guidelines <strong>for</strong> Success<br />

By Yehudah Sunshine, Head of PR, odix<br />

With the work<strong>for</strong>ce going remote and IP existing almost exclusively in the digital domain enterprises, local<br />

and federal agencies, and SMBs alike are all striving to find the right digital blend to meet their industry<br />

trans<strong>for</strong>mation needs.<br />

Supercharged by the Covid-19 pandemic, businesses in all sectors have been increasingly demanded to<br />

‘digital trans<strong>for</strong>m’ and somehow mitigate all the evolving risks and regulatory expectations they face in<br />

the cyber battlefield. While the drive towards digital trans<strong>for</strong>mations has now become commonplace, its<br />

tangible achievements may be difficult to be seen.<br />

From incorporating innovative technology and security protocols to protect their assets, digital<br />

trans<strong>for</strong>mation is the process of optimizing new and existing technologies, fluid ways of thinking, and<br />

automation heavy processes to mitigate human error and cyber risk.<br />

What is a Digital Trans<strong>for</strong>mation?<br />

For many, digital trans<strong>for</strong>mations mark a critical readdress of how their organization manages technology,<br />

process, and most importantly the individuals responsible <strong>for</strong> integrating new business models and new<br />

<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 47<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


evenue streams. The end goal of all of these is drastically alter driven customer expectations around<br />

products and services, changing brand image and technical capacity in the process.<br />

For those who operate in traditional goods, this trans<strong>for</strong>mation entails building digital products, such as<br />

a mobile application or an e-commerce plat<strong>for</strong>m.<br />

What does it take to reach digital trans<strong>for</strong>mation?<br />

According to McKinsey, regardless of the public push towards digital trans<strong>for</strong>mation very few have<br />

achieved this goal. “Years of research on trans<strong>for</strong>mations has shown that the success rate <strong>for</strong> these<br />

ef<strong>for</strong>ts is consistently low: less than 30 percent succeed. This year’s results suggest that digital<br />

trans<strong>for</strong>mations are even more difficult with Only 16 percent of respondents say their organizations’ digital<br />

trans<strong>for</strong>mations have successfully improved per<strong>for</strong>mance and equip them to sustain changes in the long<br />

term.”<br />

Talk is cheap. In practice, top-down directives only achieve their aims if the process is well defined, and<br />

the objectives are clear. In the case of digital trans<strong>for</strong>mation, this means compartmentalizing which<br />

segments stand to gain the most through digitalization and defining the core technologies and vendors<br />

whose implementation meets a strategic need.<br />

<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 48<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


When the partners and solutions have been identified, the organization are then positioned to set realistic<br />

short-term and long-term goals to determine success based on predefined KPI.<br />

Importance of security layers within Digital Trans<strong>for</strong>mation<br />

Ingraining security capabilities at every step of the digital trans<strong>for</strong>mation is the key to mitigating cyber<br />

risks in the future. Just like you wouldn’t build a house and then add the plumbing and electrical after the<br />

fact when building towards digital trans<strong>for</strong>mation, organizations must focus on the technologies,<br />

cybersecurity education, and industry best IT practices that lay the groundwork <strong>for</strong> cybersecurity from<br />

square one.<br />

From implementing encryption and mandatory policies on prohibited email attachments to offering regular<br />

training sessions and focusing on skills-based approaches vs fear-mongering, the digital trans<strong>for</strong>mation<br />

process can result in a higher level of security systemwide.<br />

Metrics <strong>for</strong> success?<br />

Effectively integrating new technologies, innovative processes, and industry best protocols takes time,<br />

money and a qualified staff of well-trained employees to do it right.<br />

Digital trans<strong>for</strong>mation is not like a boxing match. While they both are hard-fought battles, only one gets<br />

the privilege of being judged by an outside panel of experts with a clear winner crowned at the end.<br />

For digital trans<strong>for</strong>mation, measures of success may not be as clear cut as a knockdown, but they can<br />

be as straight<strong>for</strong>ward as:<br />

• Ensuring HR is attracting and hiring top technical talent<br />

• Identifying % of processes designed <strong>for</strong> the cloud<br />

• Comparing year on year operational improvements<br />

The name of the game in analyzing your KPI is to keep them simple, easy to gauge on a year-to-year<br />

basis, and directly linked to business productivity.<br />

Guidelines <strong>for</strong> success<br />

Realizing an effective digital trans<strong>for</strong>mation strategy involves tough choices, and long hours implementing<br />

new technology but more importantly ensuring buy-in from strategic partners across the organization.<br />

Through clear vision and careful planning, the digital trans<strong>for</strong>mation process will be difficult to implement<br />

but more than pay dividends in the value it achieves and security it assures to organizations of any size.<br />

Ensuring a secure digital trans<strong>for</strong>mation can most directly be tied to:<br />

<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 49<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


• Capacity building <strong>for</strong> the future work<strong>for</strong>ce<br />

• Implementing and updating day to day tools and processes<br />

• Investing in staff education to manage and optimize new technology<br />

• Demanding leadership prioritize and implement best-in-class technology to streamlines workflows<br />

and decrease human error.<br />

About the Author<br />

Yehudah Sunshine Head of PR at Odix<br />

Bringing together his diverse professional cyber know-how,<br />

intellectual fascination with history and culture, and eclectic<br />

academic background focusing on diplomacy and the cultures of<br />

Central Asia, Yehudah Sunshine keenly blends his deep<br />

understanding of the global tech ecosystem with a nuanced<br />

worldview of the underlying socio-economic and political <strong>for</strong>ces<br />

which drive policy and impact innovation in the cyber sectors.<br />

Yehudah's current work focuses on how to create and enhance<br />

marketing strategies and cyber driven thought leadership <strong>for</strong> odix<br />

(www.odi-x.com), an Israel-based cybersecurity start-up. Sunshine has written and researched<br />

extensively within cybersecurity, the service sectors, international criminal accountability, Israel's<br />

economy, Israeli diplomatic inroads, Israeli innovation and technology, and Chinese economic policy.<br />

<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 50<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


Why The Integration of Netops And Secops Is Here To<br />

Stay<br />

By Eileen Haggerty, Sr. Director, Enterprise Business Operations, NETSCOUT<br />

The pandemic accelerated digital trans<strong>for</strong>mation and increased organizations’ reliance on cloud services,<br />

VPNs, and other solutions designed to support remote work. These changes have redefined, if not<br />

destroyed, the idea of the traditional security perimeter.<br />

At the same time, the pandemic led to a massive increase in DDoS attacks and ransomware attacks.<br />

Globally, 2020 saw more than 10 million DDoS attacks, the most ever, with a record-setting 929,000<br />

attacks in a single month that year. Furthermore, attacks against remote workers have increased through<br />

the pandemic as employees have left the safety of their corporate networks, leaving security teams<br />

stretched thin.<br />

In another survey, three fourths of financial institutions reported greater cybercrime during the pandemic,<br />

with many (42%) expressing concern that the work from home model made them less secure. Survey<br />

analysis showed that education institutions also faced 80 million assaults in the first half of <strong>2021</strong>. And<br />

bad actors frequently targeted hospitals and healthcare organizations, through Internet of Things devices<br />

like tablets and smart beds, as well as via wholesale network shutdowns with malware and ransomware<br />

attacks.<br />

<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 51<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


At many organizations, these events served as a catalyst to closer cooperation between the network<br />

operations (NetOps) and security operations (SecOps) teams, deepening collaborative relationships that<br />

had already been <strong>for</strong>malized, and initiating collaborations where silos had existed in the past.<br />

Now, many IT executives are considering how these teams could be structured to work more closely<br />

together <strong>for</strong> the long-term.<br />

A Historical Failure to Collaborate<br />

To understand the benefits of closer collaboration, let’s start by examining the state of NetOps and<br />

SecOps collaboration just be<strong>for</strong>e the beginning of the pandemic.<br />

In EMA’s Network Management Megatrends 2020 survey, although 78% of companies reported <strong>for</strong>mal<br />

collaborations, only 47% reported that they fully converged to the extent of sharing tools and processes.<br />

At 31% of companies, the collaboration involved some integration of tools, but at 16% of companies, the<br />

collaboration was strictly ad-hoc. Small and mid-sized companies were the most likely to report high<br />

levels of integration.<br />

In practice, 35% percent of network operations teams said security system problems, such as bad policies<br />

and device failures, had led to complex and difficult-to-troubleshoot service per<strong>for</strong>mance issues. Another<br />

35% reported incidents that originally presented themselves as complex service per<strong>for</strong>mance problems<br />

that later required cross-silo collaboration.<br />

Add a pandemic to that recipe and it’s easy to see why so many organizations struggled with supporting<br />

and securing millions of remote workers early in the pandemic. Given that network per<strong>for</strong>mance and<br />

security issues often go hand-in-hand, organizations with low levels of collaboration had fewer avenues<br />

to communicate and diagnose the root causes of issues, which likely led to longer than necessary<br />

disruptions.<br />

In response, with security teams stretched thin, it was often networking professionals who filled the void<br />

to manage the complex challenges introduced by organization-wide extended remote work. After all, they<br />

already understood much of the underlying infrastructure -- and brought their own perspective to play<br />

when collaborating with security teams.<br />

By working together, NetOps and SecOps teams gained increased visibility, quickened time to<br />

remediation of network and security issues, and reduced security risk.<br />

Fostering Cooperation <strong>for</strong> the Long Haul<br />

The conditions — a faster pace of digital trans<strong>for</strong>mation, the continuation of the hybrid work<strong>for</strong>ce, and an<br />

expanded threat environment — will endure <strong>for</strong> the <strong>for</strong>eseeable future. So how can IT executives foster<br />

and maintain better collaboration and (hopefully) integration? The answer is especially important at large<br />

<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 52<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


organizations, where siloed operations are likely to persist. There are a few steps to put in practice,<br />

specifically:<br />

●<br />

●<br />

●<br />

●<br />

Begin at the design stage: NetSecOps collaboration tends to center on infrastructure and<br />

deployment, while incident monitoring and response are secondary. As digital trans<strong>for</strong>mation<br />

continues to introduce new features into the IT environment, it’s critical that communications<br />

between the teams are delivered early and natively.<br />

Find a single source <strong>for</strong> truth: Collaboration demands that everyone has equal access to<br />

current, relevant network data. Too often, this isn’t the case because in<strong>for</strong>mation shared across<br />

silos is outdated or irrelevant. If one team has too many blind spots, they can’t partner effectively.<br />

Establish a common toolset: Per<strong>for</strong>mance management tools can help analysts understand<br />

how a security incident affects per<strong>for</strong>mance and vice-versa. Network automation and<br />

orchestration tools also benefit from collaboration as they allow enterprises to make quick<br />

changes to the network in response to a security event.<br />

Formalize the collaboration: Cooperation between NetOps and SecOps requires ongoing<br />

management that documents processes, identifies challenges, improves where necessary and<br />

borrows from best practices where relevant. Executive input needs to make sure the teams don't<br />

drift apart and recreate silos again.<br />

Building on Pandemic Successes<br />

The successes of collaboration over the past year have proven the advantages of having NetOps and<br />

SecOps teams work more closely together. In short, the more integrated the tools and processes used<br />

between them, the more successful they can be. But if left to stray apart, organizational silos can pop<br />

right back up. For closer collaboration between NetOps and SecOps teams to stick, IT managers must<br />

be vigilant in ensuring collaboration remains a priority even after the pandemic subsides.<br />

The current environment, and the future one, will require these integrations to expand. Working together,<br />

an integrated NetSecOps team can achieve results greater than the sum of their parts: better network<br />

per<strong>for</strong>mance, increased security, and faster incident response.<br />

About the Author<br />

As Senior Director of Enterprise Business Operations, Eileen is<br />

responsible <strong>for</strong> working with enterprise customers to ensure that<br />

NETSCOUT's service assurance and cybersecurity solutions are<br />

meeting the needs of NETSCOUT’s customers and the market. Eileen<br />

has worked <strong>for</strong> NETSCOUT <strong>for</strong> nearly 20 years, where she has held<br />

several product management and marketing roles. Prior to joining<br />

NETSCOUT, Eileen leveraged her MBA from Boston College working<br />

in a variety of technical marketing roles at Motorola Codex, Racal<br />

Data Group and Celox Networks. Our company website<br />

https://www.netscout.com/<br />

<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 53<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


What To Know to Fight Against <strong>Cyber</strong> Attacks<br />

By Gergo Varga, Senior Content Manager / Evangelist at SEON<br />

<strong>Cyber</strong> attacks have become a part of our reality, not only that we are all constantly getting phishing<br />

emails, but you can read about some cyber attack or data breach happening on a daily basis. Some of<br />

the attacks are concentrated on large businesses like Volkswagen & Audi or tech giants like Twitch,<br />

Facebook, Linkedin, but the truth is that nobody is safe. By October of <strong>2021</strong>, according to Fortune’s<br />

research, there had been nearly 281.5 million people affected by some sort of data breach. That means<br />

that there is a high chance that you and your business will be affected by some type of cyber attack,<br />

unless you start being proactive and fight against it.<br />

<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 54<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


How to protect yourself from cyber attacks?<br />

The only way to effectively fight back against cyber attacks is by implementing a cyber security plan which<br />

includes various tools and policies that make it impenetrable. Let us introduce you to everything you need<br />

to know to fight against cyber attacks and how to implement it in your cyber security plan.<br />

Implement device fingerprinting<br />

One of the tools that should be added to any security is device fingerprinting. In short, device<br />

fingerprinting is a process of collecting and analysing different variables of users’ devices like its software<br />

and hardware configurations to create a unique user profile. SEON’s view on device fingerprinting, shows<br />

us how crucial it can be in fighting against cyber attacks. By creating a unique profile or device fingerprint<br />

<strong>for</strong> each user you can recognize when some of the variables change and confirm if it is a legitimate<br />

change in user details or suspicious behaviour. This way you can stop the fraud attempt be<strong>for</strong>e it even<br />

happens.Use multi-factor authentication<br />

This is a great tool to use to provide an extra layer of security, especially when used together with device<br />

fingerprinting. It asks users to provide extra verification be<strong>for</strong>e giving them access to their accounts, like<br />

a special code being sent to the user's device. This can come especially handy if there is a difference in<br />

users device fingerprint, as it can confirm if they are legitimate users or if they are attempting an account<br />

takeover.<br />

Train your employees<br />

Your employees are the most important element of your business, and also its biggest security risk. Most<br />

of the cyber attacks will try to use the human element of the business in order to get access to confidential<br />

data like their credentials, bank account details, or even intellectual property. This is why it is extremely<br />

important to educate your employees about what are the cyber threats and risks, how to recognize them,<br />

and how to fight against them. Report to cyber threats from Netwrix, explains that 58% of all organizations<br />

claimed that their employees do not follow cyber security guidelines. Truth is that if you are not proactive<br />

about the fight against cyber attacks, neither will your employees be, regardless of your guidelines,<br />

especially if nobody is en<strong>for</strong>cing them. This is why it is extremely important to have a clear and easy to<br />

understand cyber security policy and to keep your employees in<strong>for</strong>med about emerging threats.<br />

Introduce the password policy<br />

This step might seem small, but it can make an enormous difference in your cyber security plan. Did you<br />

know that 81% of hacking-related breaches happened due to stolen and/or weak passwords?<br />

Considering that a large number of people use either the same or similar passwords <strong>for</strong> all of their<br />

accounts, one breach can cause a domino effect and put all of the other accounts in danger. Introducing<br />

password policy <strong>for</strong> your employees and also your users can significantly reduce the risk of data breach.<br />

<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 55<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


Update software and systems regularly<br />

<strong>Cyber</strong> criminals will exploit all the weaknesses they can to gain access to your confidential data, and by<br />

not updating software and systems you are opening doors wide open <strong>for</strong> them. This is at the same time<br />

the easiest and one of the most important elements of your cyber security plan as it stops cyber criminals<br />

be<strong>for</strong>e they can even access your network.<br />

It is difficult to know where to start when it comes to fighting against cyber attacks, especially because<br />

new threats are emerging every day. By implementing these steps into your cyber security plan, you will<br />

set your business on the right path in the fight against cyber attacks.<br />

About the Author<br />

Gergo Varga, Senior Content Manager / Evangelist at SEON. He<br />

has been fighting online fraud since 2009 at various companies -<br />

even co-founding his own one, enbrite.ly. He's the author of the<br />

Fraud Prevention Guide <strong>for</strong> Dummies - SEON Special edition. He<br />

currently works as the Senior Content Manager / Evangelist at<br />

SEON, using his industry knowledge to keep marketing sharp,<br />

communicating between the different departments to understand<br />

what's happening on the frontlines of fraud detection.<br />

He lives in Budapest, Hungary, and is an avid reader of philosophy and history.<br />

Gergo can be reached via Our company website https://seon.io/<br />

<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 56<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


Five Cloud Telephony Security Vulnerabilities That Can<br />

Threaten Your Business<br />

The Flip Side of Using Cloud Telephony Services<br />

By Sujan Thapaliya, CEO and Co-Founder, KrispCall<br />

It is evident that VoIP will be the future of business communications. Historically, it has been difficult to<br />

predict whether a call would be reliably <strong>for</strong>warded over the internet, but that problem is mostly gone now.<br />

The versatility and adaptability of today's VoIP plat<strong>for</strong>ms allow them to beat traditional landlines in<br />

competition. Additionally, they can be configured within minutes, and they come at a significantly lower<br />

cost than typical phone setup and maintenance. It's not surprising that more than 60% of businesses<br />

have already migrated to VoIP from landlines.<br />

There are many benefits associated with VoIP phone systems. From af<strong>for</strong>dability to increased<br />

functionality, VoIP systems have become more popular because they make businesses run more<br />

smoothly and efficiently than traditional phone systems, which is why they have gained such popularity.<br />

<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 57<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


While all of these benefits are important, one of the biggest downfalls of the technology is its lack of<br />

security.<br />

It's like a phone setup with calls not connected via a traditional phone line but rather over the internet. All<br />

internet-connected devices are exposed to hacking, which leaves them at least somewhat vulnerable.<br />

There<strong>for</strong>e, your VoIP system is less important than your internet network when it comes to security.<br />

Importance of VoIP Security<br />

Are VoIP security concerns really as important as you think they are? The reality is that security breaches<br />

via phone systems present a pretty serious threat to everyone, even if you've never been a victim yourself.<br />

More than half of businesses in 2018 had their phone numbers hacked through social engineering, a type<br />

of scam that disguises itself as a real call to obtain valuable in<strong>for</strong>mation. In the year 2020, several wellknown<br />

Twitter accounts were used to promote a cryptocurrency scam that amassed hundreds of<br />

thousands of dollars. Among the users were Barack Obama, Kim Kardashian, and Bill Gates.<br />

VoIP security is crucial and cannot be overstated. Furthermore, VoIP technology relies on the web to<br />

make calls, so it is susceptible to attacks that target the web. A lax VoIP provider could leave your<br />

business open to serious security risks since 24% of Wi-Fi networks in the world lack encryption.<br />

The situation actually deteriorates. The US is not ahead of the worldwide average when it comes to Wi-<br />

Fi networks without encryption, as 25% of all networks lack encryption worldwide. Especially if your<br />

business is based in Europe, the chances are very high (34% - 44%) that your network is not encrypted,<br />

so you should really pick a VoIP company like Krispcall that follows best practices.<br />

Cloud Telephony Security Vulnerabilities<br />

1. Packet Sniffing and Black Hole Attacks<br />

As the name suggests, packet sniffing is one of the most common VoIP attacks. With this attack, hackers<br />

may steal and log the in<strong>for</strong>mation included in voice data packets as they travel.<br />

Sniffers attempt to steal in<strong>for</strong>mation by using packet drop attacks (often called black hole attacks) to<br />

prevent voice data packets from reaching their destinations, causing packet loss. By taking control of<br />

your router, packet sniffers deliberately drop packets into data streams, causing your network service to<br />

be much slower or to stop working completely.<br />

Using packet sniffing, hackers can also collect sensitive data such as usernames, passwords, and credit<br />

card numbers.<br />

Use a trusted VPN to send in<strong>for</strong>mation over the internet to help make your lines more secure. Getting<br />

started and getting the system up and running takes some time, but it ensures the safety of in<strong>for</strong>mation.<br />

<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 58<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


By encrypting all data end-to-end and monitoring their networks consistently, users can protect<br />

themselves against packet sniffing and black hole attacks. This alerts them to suspected login attempts,<br />

unusual devices, and so on.<br />

2. DDoS Attacks<br />

According to a survey by Corero, approximately 70% of companies experience at least 20-50 DDoS<br />

(distributed denial-of-service) attacks per month.<br />

Despite the fact that they are mostly unsuccessful, the main issue is that cybercriminals are now able to<br />

launch DDoS attacks much faster and cheaper with highly capable machines, special tools, and much<br />

higher bandwidth than they were previously. This puts businesses of all types and sizes at risk, including<br />

large institutions (like banks or enterprises).<br />

During a DDoS attack, criminals use all the bandwidth of a server and overwhelm it with data. This allows<br />

hackers to temporarily or permanently interrupt a machine or network so that its users can no longer<br />

access it. The VoIP system cannot make or receive calls when that occurs.<br />

However, that's not all - in the worst-case scenario, the attacker might even gain access to the server's<br />

admin controls.<br />

<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 59<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


3. Vishing<br />

Vishing uses VoIP to lure your attention, meaning that hackers pretend to be someone or something<br />

trusted in order to get sensitive in<strong>for</strong>mation from you. Credit card numbers, passwords, and more are<br />

typically stolen.<br />

Vishing hackers use caller ID spoofing to deliberately confuse potential victims, making their phone<br />

number and name appear legitimate. Your bank's phone number may appear to be the number they call<br />

from, claiming your account has been compromised. They can also ask you to do a thing or two,<br />

promising to secure your account.<br />

The IT department of the targeted agency should verify all phone requests, regardless of whether they<br />

look like they came from within the department. Additionally, agents need to be trained to refrain from<br />

disclosing sensitive in<strong>for</strong>mation unless authorized by their supervisor.<br />

<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 60<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


The following signs may indicate a vishing attack:<br />

• There is a great deal of urgency coming from the other end of the line.<br />

• The hacker continuously requests that you provide the in<strong>for</strong>mation to verify it.<br />

• A call from a known number or an established company that you weren't expecting<br />

• On Caller ID displays, you may see short and unusual phone numbers.<br />

4. Weak Encryption Tools<br />

Obviously, data packets carrying voice data must be encrypted from beginning to end in order to ensure<br />

that they cannot be intercepted during transmission. You might encounter this at your network, your ISP,<br />

or anywhere in between.<br />

Due to the complexities of voice encryption and the fact that it varies depending on factors like the<br />

sensitivity of the voice data you send, this is not something that's easy to understand. For this reason,<br />

Cisco has recommended some basic encryption best practices <strong>for</strong> its customers, including:<br />

• Balance encryption costs with business-specific requirements while keeping costs low.<br />

• SIP over TLS implementations in your switch fabric should be enabled by your vendor.<br />

• Encrypting mobile device calls with VPNs when packet encryption protocols are not available<br />

(e.g., SRTP).<br />

• A secure voice channel protected against eavesdropping during the transmission of packets over<br />

public networks.<br />

Cloud security is threatened by APIs by their very nature. You can customize the features of the cloud to<br />

match your business needs. They also authenticate users, provide access, and take steps to encrypt<br />

data. A comprehensive protection strategy can provide you with all these benefits.<br />

Using encryption is one way in which you can protect your data. Due to this, having a holistic approach<br />

to end-to-end encryption is important instead of focusing on both your vendor and network separately.<br />

You will be better prepared to handle any potential threats this way.<br />

5. VOMIT and SPIT<br />

It may sound like a gross acronym, but VOMIT describes a serious threat to any business. Criminals can<br />

steal sensitive in<strong>for</strong>mation and voice packets straight from calls by using a tool called "Voice over<br />

Misconfigured Internet Telephones." In addition, they can also find out where the call originated, which<br />

they can use later in order to intercept everything you say.<br />

The SPIT method consists of sending voicemails or automated calls several times a week. Because<br />

spammers have access to so many different tools, they can easily send many messages at once to<br />

several IP addresses or pretend to be local businesses when they are actually <strong>for</strong>eign companies.<br />

If the call is answered, the recipient may end up being redirected to a very expensive phone number from<br />

another country, or the messages may contain viruses or spyware.<br />

<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 61<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


Is VoIP Secure to Use Then?<br />

You might feel anxious to make internet calls <strong>for</strong> your business after reading about the risks and dangers<br />

of VoIP. The good news is that by learning some basic cybersecurity methods, you can ensure that your<br />

calls and data are secure.<br />

●<br />

●<br />

●<br />

●<br />

●<br />

The most effective way to avoid hackers accessing your sensitive info is by encrypting it. Data or<br />

messages can still be intercepted, but they will be worthless to hackers with strong encryption.<br />

Make sure your VoIP plat<strong>for</strong>m's various devices have strong, varied passwords.<br />

Maintain a security vulnerability testing program.<br />

Ensure that your tools are always up-to-date.<br />

Prepare your employees on what to do in the event of phishing attacks.<br />

Conclusion<br />

Currently, VoIP appears to be in a state of evolution, as no widely accepted general security solution<br />

seems to be available to address all the challenges it faces. So many methods have been suggested and<br />

evolved over the years; VPNs, <strong>for</strong> example, are good security options, though they sometimes have some<br />

shortfalls, such as affecting per<strong>for</strong>mance.<br />

Even though VoIP has been the subject of huge amounts of research, more research is needed to identify<br />

ways to combat the numerous attacks without drastically decreasing the per<strong>for</strong>mance. VoIP over VPN<br />

and other already suggested approaches should also be considered.<br />

About the Author<br />

Sujan Thapaliya is the CEO and Co-founder of KrispCall. He has a<br />

wealth of computer, communications, and security experience. As well<br />

as years of experience in the industry, Sujan has also conducted<br />

investigative research into issues such as privacy and fraud. Through<br />

KrispCall, he aspires to make business communication safer, reliable,<br />

and more af<strong>for</strong>dable. Sujan can be reached online at (sujan@krispcall.com and<br />

https://www.linkedin.com/in/sujanthapaliya) and at our company website https://krispcall.com/<br />

<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 62<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


The 5 Most Common <strong>Cyber</strong>-Attacks on Mobile Devices In<br />

<strong>2021</strong><br />

By Nicole Allen, Marketing Executive, Salt Communications.<br />

Many companies are prioritising mobile ef<strong>for</strong>ts these days with research suggesting that increased<br />

mobility helps businesses enhance their operations and efficiency. Verizon's <strong>2021</strong> Mobile Security Index<br />

Report demonstrates, there are many pre-existing and new hazards when it comes to mobile security<br />

that businesses must consider in order to stay safe.<br />

Traditionally the increases in organisational mobility often resulted in a rise in the number of mobile<br />

devices accessing your systems from afar. With COVID-19 impacting business operations globally in<br />

2020 there are much higher numbers of mobile users accessing internal systems from home. For your<br />

security staff, this implies an increasing number of endpoints and risks to secure in order to prevent a<br />

data breach at your company.<br />

Be<strong>for</strong>e we get into the top attacks of <strong>2021</strong> here are four different types of mobile security threats<br />

that businesses need to continue to look out <strong>for</strong>:<br />

Most people think of mobile security risks as a single, all-encompassing issue. However, there are four<br />

major <strong>for</strong>ms of mobile security concerns that businesses must be aware of in order to defend themselves.<br />

<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 63<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


• Web-Based Mobile Security Threats<br />

Web-based attacks constitute an ongoing challenge <strong>for</strong> mobile devices since they are continually linked<br />

to the Internet and regularly used to access web-based services. These threats can be carried out through<br />

phishing scams, drive-by downloads and browser exploits.<br />

• Mobile Network Security Threats<br />

Cellular and local wireless networks are usually supported by mobile devices (WiFi, Bluetooth). Different<br />

<strong>for</strong>ms of risks can be found on each of these types of networks through threats such as network exploits<br />

and wi-fi sniffing.<br />

• Mobile Device Security Threats<br />

Theft or loss of a device are the most common physical hazards to mobile devices. This threat is<br />

especially dangerous <strong>for</strong> businesses because hackers have direct access to the hardware where<br />

confidential data is housed.<br />

• Mobile Application Security Threats<br />

Mobile application security threats, like all other sorts of security threats, are continually evolving. Security<br />

threats to mobile applications, on the other hand, are of particular concern because they receive less<br />

security attention than other <strong>for</strong>ms of software and technology. Some of the top mobile application threats<br />

are through malware, insecure coding, ransomware and crytojacking.<br />

5 Most Common cyber attacks on mobile devices this year:<br />

1. Social engineering<br />

Social engineering is the term used <strong>for</strong> a broad range of malicious activities accomplished through human<br />

interactions. When unscrupulous actors send bogus emails (phishing attacks) or text messages<br />

(smishing attacks) to your employees, they are attempting to deceive them into giving over personal<br />

in<strong>for</strong>mation such as passwords or downloading malware onto their devices. According to reports from<br />

cybersecurity firm Lookout and Verizon, workplace mobile phishing assaults have increased by 37%, and<br />

phishing attacks will be the leading source of data breaches globally by the end of <strong>2021</strong>.<br />

The best protection against phishing and other social engineering threats is to teach employees how to<br />

recognise suspicious phishing emails and SMS messages so they don't fall <strong>for</strong> them. Reducing the<br />

amount of employees with access to sensitive data or systems can also help protect your company from<br />

<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 64<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


social engineering attacks by reducing the number of ways attackers can obtain access to key systems<br />

or in<strong>for</strong>mation.<br />

2. Data breach via malicious apps<br />

The millions of freely available apps on employees' devices pose a significantly greater threat to<br />

businesses than mobile malware. Since 85% of today's mobile apps are essentially insecure, this is the<br />

case. Hackers may now simply locate an unprotected mobile app and exploit it to plan broader assaults<br />

or steal data, digital wallets, backend details, and other lucrative in<strong>for</strong>mation directly from the app.<br />

When your employees go to Google Play or the App Store to download apps that appear to be harmless,<br />

the apps will ask <strong>for</strong> a list of permissions be<strong>for</strong>e they can be downloaded. These permissions typically<br />

demand access to files or folders on the mobile device, and most individuals simply scan over the list of<br />

permissions and agree without thoroughly evaluating them.<br />

This lack of oversight, on the other hand, might leave devices and businesses susceptible. Even if the<br />

software per<strong>for</strong>ms as expected, it has the potential to mine corporate data and distribute it to a third party,<br />

such as a rival, exposing critical product or business data.<br />

3. Unsecured public & home WiFi Networks<br />

Since there's no way of knowing who set up the network, how (or if) it's secured with encryption, or who's<br />

now accessing or watching it, public WiFi networks are inherently less secure than private networks.<br />

Furthermore, as more firms provide remote work choices, the public WiFi networks your employees use<br />

to access your servers (<strong>for</strong> example, from coffee shops or cafés) may pose a security risk to your<br />

organisation. <strong>Cyber</strong>criminals, <strong>for</strong> example, frequently set up WiFi networks that appear legitimate but are<br />

actually a front <strong>for</strong> capturing data that travels through their system - a "man in the middle" attack.<br />

Requiring employees to utilise a VPN to access corporate systems or data is the greatest approach to<br />

safeguard your firm from dangers over public WiFi networks, this can also be carried out <strong>for</strong> those working<br />

from home wifi’s. This ensures that their session remains private and safe, even if they access your<br />

systems via a public network.<br />

4. End-to-end encryption gaps<br />

A hole in an encryption gap is similar to a hole in a water pipe. While the point where the water enters<br />

the pipe (your users' mobile devices) and exits the pipe (your systems) may be secure, the hole in the<br />

middle allows bad actors to gain access to the water flow.<br />

One of the most common examples of an encryption gap is unencrypted public WiFi networks (which is<br />

why they pose such a significant risk to businesses). Since the network isn't secured, fraudsters can gain<br />

access to the in<strong>for</strong>mation your employees share between their devices and your systems. WiFi networks,<br />

however, aren't the only thing that may be exploited; any application or service that isn't protected might<br />

provide attackers access to important company data. Any unencrypted mobile messaging apps that your<br />

<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 65<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


employees use to communicate work-related in<strong>for</strong>mation, <strong>for</strong> example, could provide an entry point <strong>for</strong> a<br />

bad actor to intercept important business communications and documents.<br />

End-to-end encryption is required <strong>for</strong> any sensitive work data. This means ensuring that any service<br />

providers you interact with encrypt their services to prevent illegal access, as well as encrypting your<br />

users' devices and systems.<br />

5. Internet of Things (IoT) devices<br />

Mobile devices that access your company's systems are expanding beyond smartphones and tablets to<br />

include wearable technology (such as the Apple Watch) and physical hardware (like Google Home or<br />

Amazon Alexa). Since many of the latest IoT mobile devices have IP addresses, bad actors can exploit<br />

them to acquire internet access to your organization's network if those devices are connected to the<br />

internet that are connected to your systems.<br />

It is the responsibility of each organisation to implement the necessary technological and regulatory<br />

regulations to ensure that their systems are secure. According to statistics, you probably have more IoT<br />

devices connected to your networks than you think. In a research conducted by Infoblox, 78% of IT<br />

leaders from four countries indicated that over 1,000 shadow IoT devices accessed their networks every<br />

day.<br />

What can your company do today?<br />

Seeing the destruction that cyber attacks can do should be enough to convince your organisation to take<br />

the necessary measures as soon as possible. So, there are some steps you can do to improve your<br />

company's cybersecurity and protect it from cyber threats.<br />

Mobile security should be at the <strong>for</strong>efront of a company’s cybersecurity agenda, especially in an era<br />

where remote working is the new norm, and not something that will be going away anytime soon. Many<br />

companies and organisations that Salt Communications work closely with have seen an increase in<br />

mobile usage <strong>for</strong> communications and day-to-day work requirements. Often firms will look at developing<br />

a mobile security guide <strong>for</strong> what users should and should not be doing while operating from their mobile<br />

devices. Other companies have deployed MDM/UEM systems to lock down devices and provide an extra<br />

layer of security to workplace issued devices which employees are utilising from home.<br />

At Salt we understand the requirement <strong>for</strong> a secure communications system to be utilised in an era where<br />

mobile interception is rife. With the ever increasing requirement <strong>for</strong> sensitive communications to take<br />

place remotely, organisations need to be able to deploy a system that they have complete assurance<br />

that everything they are disclosing remains confidential. This may be law en<strong>for</strong>cement events, or lawyerclient<br />

communications; effectively any <strong>for</strong>m of communications that needs complete security. Salt<br />

Communications works with clients all around the world that understand the importance of having<br />

complete control over their private communications. Leaks to the public tarnish their organisation's<br />

reputation and, in some cases, jeopardise the safety of their employees and the broader public. You will<br />

be able to govern your communications and feel safe in whatever situation you may experience<br />

<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 66<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


throughout your everyday operations by utilising a secure communication plat<strong>for</strong>m such as Salt<br />

Communications.<br />

At Salt Communications we work with businesses of all sizes all around the world to enable them to have<br />

secure, confidential discussions wherever they are, at any time.<br />

To discuss this article in greater detail with the team, or to sign up <strong>for</strong> a free trial of Salt Communications<br />

contact us on info@saltcommunications.com or visit our website at saltcommunications.com.<br />

About Salt Communications<br />

Salt Communications is a multi-award winning cyber security company providing a fully enterprisemanaged<br />

software solution giving absolute privacy in mobile communications. It is easy to deploy and<br />

uses multi-layered encryption techniques to meet the highest of security standards. Salt<br />

Communications offers ‘Peace of Mind’ <strong>for</strong> Organisations who value their privacy, by giving them<br />

complete control and secure communications, to protect their trusted relationships and stay safe. Salt is<br />

headquartered in Belfast, N. Ireland, <strong>for</strong> more in<strong>for</strong>mation visit Salt Communications.<br />

About the Author<br />

Nicole Allen, Marketing Executive at Salt Communications. Nicole has<br />

been working within the Salt Communications Marketing team <strong>for</strong><br />

several years and has played a crucial role in building Salt<br />

Communications reputation. Nicole implements many of Salt<br />

Communications digital ef<strong>for</strong>ts as well as managing Salt<br />

Communications presence at events, both virtual and in person events<br />

<strong>for</strong> the company. Nicole can be reached online at (LINKEDIN, TWITTER or by emailing<br />

nicole.allen@saltcommunications.com) and at our company website https://saltcommunications.com/<br />

<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 67<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


Why Email Archiving Builds <strong>Cyber</strong> Resilience<br />

Plus 3 Email Archiving Solutions<br />

By Adnan A. Olia, Chief Operating Officer, Intradyn<br />

As innovations in technology continue to create new uses across an array of industries, cyber safety has<br />

become more important than ever be<strong>for</strong>e. Technological advancements have made cyber security a top<br />

concern <strong>for</strong> small businesses, global enterprises, educational institutions and government agencies alike,<br />

all of whom must keep cyber resilience a top priority.<br />

While cyberattacks can be difficult to predict, building a cyber resilience strategy can help combat any<br />

potential issues that might arise. This is where email archiving becomes of paramount importance <strong>for</strong><br />

businesses across nearly every industry.<br />

With an email archiving solution, you can have peace of mind knowing that your emails are safe, secure<br />

and easily searchable. Read on to learn how email archiving can support cyber resilience, including tips<br />

on how to build a comprehensive cyber resilience plan <strong>for</strong> your organization.<br />

What is <strong>Cyber</strong> Resilience?<br />

According to the National Institute of Standards and Technology (NIST), cyber resilience is “the ability to<br />

anticipate, withstand, recover from, and adapt to adverse conditions, stresses, attacks, or compromises<br />

on systems that use or are enabled by cyber resources.” <strong>Cyber</strong> resiliency addresses all threats that can<br />

reach any <strong>for</strong>m of a cyber resource. There<strong>for</strong>e, a cyber resiliency plan is an all-encompassing strategy<br />

that should be applied across an entire organization or operation. A cyber resilience strategy helps to<br />

<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 68<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


protect critical systems, applications and data and enables faster reaction times in the event of a<br />

disruptive cyber incident such as a data breach.<br />

<strong>Cyber</strong> resilience plays both a preventative and a reactive role. By putting the necessary measures in<br />

place, such as email archiving, you are mitigating significant risks <strong>for</strong> your organization. In the event of<br />

an attack, cyber resilience is important <strong>for</strong> analyzing, managing and recovering efficiently.<br />

What is Email Archiving?<br />

Email archiving refers to the ability to completely move an electronically stored message from one data<br />

store to another. The ultimate goal of email archiving is to preserve and make all emails searchable.<br />

Businesses and organizations need to archive electronic communications and in<strong>for</strong>mation <strong>for</strong> a number<br />

of reasons, including business continuity and disaster recovery. With email archiving, businesses can<br />

preserve such communications in a safer, more accessible way.<br />

Not only is an email archiving solution vital to an organization’s protection, but it can also aid in saving<br />

on storage, reducing storage load, eliminating PSTs and improving productivity.<br />

Email Archiving Solutions<br />

Spending in the cybersecurity industry reached around 40.8 billion U.S. dollars in 2019 and is only<br />

continuing to grow as the use of technology increases. It is important that organizations today place a<br />

strong focus on investing in cyber security and following best practices in cyber security risk management,<br />

such as continuous data monitoring and record-keeping.<br />

When building a cyber resilience strategy, it is important to work with an email archiving consultant that<br />

has the necessary expertise to meet your unique cyber resilience requirements. It is also critical to find<br />

an email archiving solution provider that maintains a high standard of security and reliability.<br />

<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 69<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


3 Ways Email Archiving Builds <strong>Cyber</strong> Resilience<br />

So, how exactly does email archiving build cyber resilience? Here are some of the ways that email<br />

archiving supports a strong cyber resilience strategy:<br />

• Combat Phishing Attacks<br />

Phishing is the fraudulent practice of sending out malicious emails to acquire sensitive data, steal<br />

in<strong>for</strong>mation or gain access to a system. Such attacks are one of the most common threats to<br />

businesses and individuals in <strong>2021</strong>.<br />

It is of the utmost importance to act quickly when combatting any <strong>for</strong>m of cyberattack. If your<br />

systems are compromised, an email archiving solution both ensures that important data is not<br />

lost, and that private in<strong>for</strong>mation remains private. If a data breach were to occur without an email<br />

archiving solution, an organization could face a hurdle so major that the damage could ultimately<br />

be irreversible.<br />

• Email Security<br />

There is no doubt that storing emails in your inbox is no longer as safe as it once was. Today’s<br />

hackers are so advanced that they can get in and gain access to anything that they want in a<br />

matter of minutes.<br />

Fortunately, an email archiving solution will maintain the data in a manner that cannot be changed<br />

or deleted. This guarantees that an organization can present any in<strong>for</strong>mation needed should they<br />

be faced with litigation or record requests and quickly get back online following a malicious<br />

cyberattack.<br />

<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 70<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


• Protect Data<br />

There are various types of archiving solutions that can be used to protect data contained within<br />

an email archive, such as encryption, role-based permissions, multi-factor authentication and<br />

redaction tools. Data protection is one of the many reasons why having a secure electronic<br />

in<strong>for</strong>mation archiving plat<strong>for</strong>m is an essential part of a cyber resilience strategy.<br />

• Recoverability & Compliance<br />

With email archiving, an organization can recover company-wide inboxes back quickly and<br />

correctly. The best way to maintain compliance in regulatory industries while maintaining<br />

cybersecurity is to use an independent archiving solution.<br />

An archiving solution stores emails in the most resilient manner because it moves and secures<br />

only one copy of the email immediately after it is sent or received. This subsequently enables an<br />

organization to collect, secure and store incredibly large amounts of email into a single central<br />

location that can be easily searched or audited. Moreover, the metadata within the message will<br />

not be duplicated again, regardless of how many more times the in<strong>for</strong>mation is passed along<br />

through various accounts.<br />

Additional Benefits of Email Archiving<br />

Aside from the notable benefits that relate to building cyber resilience, there are numerous other<br />

advantages that come with email archiving. Some of these advantages include:<br />

• Reduced storage costs<br />

• Reduced stress on servers<br />

• Faster restoration<br />

• Reduced costs <strong>for</strong> email backups<br />

• Instantaneous access to email records<br />

• Faster disaster recovery<br />

• Increased productivity<br />

• Regulatory and legislative compliance<br />

As technology continues to evolve, building cyber resilience will continue to be crucial. With the right<br />

email archiving solution, your data can be preserved and protected using consistent backup and disaster<br />

recovery capabilities.<br />

<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 71<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


About the Author<br />

Adnan A. Olia is a senior member of the Intradyn team and is<br />

responsible <strong>for</strong> keeping an eye on the regulatory and technological<br />

marketplaces. Adnan provides thought leadership in the archiving and<br />

compliance sector to help Intradyn understand the latest trends in<br />

business innovation.<br />

Adnan can be reached online at our company website<br />

https://www.intradyn.com/.<br />

<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 72<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


Overcoming the Limitations of VPN, NAC, and Firewalls<br />

with Zero Trust Access<br />

During 2020 and <strong>2021</strong>, we’ve seen ransomware-as-a-service wreak havoc in the IT supply chain and<br />

critical infrastructure. Below we explore how technologies and approaches to help protect organizations<br />

from these types of attacks.<br />

By Burjiz Pithawala, CPO & Co-Founder, Elisity<br />

We live in a world that is making a trans<strong>for</strong>mational leap into uncharted territory out of necessity. The<br />

pandemic has challenged us both at home and at work. We now live and work differently than a couple<br />

of years ago. What was called the “new normal” has become the “now normal”: the hybrid workspace,<br />

with users working alternatively from home and on campus. This rapid change is still in progress and<br />

challenges networking and in<strong>for</strong>mation security teams in many novel ways. This article focuses at a high<br />

level on some of the problems and solutions derived from the need to secure remote access to enterprise<br />

resources, the sprawl of IoT, the growth of shadow IT, and the acceleration of the migration to cloud<br />

infrastructure.<br />

<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 73<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


Trends making implicit trust security controls obsolete<br />

As a result of the pandemic-driven changes in the workspace and IT environments, bad actors have<br />

adapted rapidly to tap into a growing attack surface. During 2020 and <strong>2021</strong>, we’ve seen ransomware-asa-service<br />

wreak havoc in the IT supply chain and critical infrastructure just at a time when IT organizations<br />

were migrating infrastructure and applications to the cloud and trying to secure access <strong>for</strong> an all the<br />

sudden majority of remote workers. It’s been a rollercoaster across all industries <strong>for</strong> organizations of all<br />

sizes, to say the least.<br />

Users, devices, applications, and data have <strong>for</strong> the most part left the traditional perimeter, and as a result,<br />

traditional security controls are failing to secure them. The enterprise networks have become more<br />

challenging than ever be<strong>for</strong>e to secure against these ever-growing cyber threats from outside and inside<br />

the new perimeter. Rogue applications, unmanaged IoT devices, and overlap of IT and Operational<br />

Technology (OT) networks add more to these difficulties, with growing risks as the attack vectors multiply.<br />

In the end, network availability and productivity are suffering too due to the lack of scalability of traditional<br />

cyber defenses.<br />

These trends resulted in a re-definition of the enterprise perimeter which is now centered around the<br />

identities of users, devices, applications, and data. It is being said that identity is the new perimeter. By<br />

now, you should have read about the Zero Trust model enough to be confused by the sheer amount of<br />

spin around this in<strong>for</strong>mation security concept. To make it simple, short, and sweet, let’s stick to the fact<br />

that Zero Trust is not a product, but a premise from which to derive a ubiquitous in<strong>for</strong>mation security<br />

strategy and the controls that help operationalize it. Zero Trust is based on the assumption that all network<br />

communications are compromised and there<strong>for</strong>e should be untrusted regardless if these occur within or<br />

outside a network’s boundaries. The solution to minimizing risk under that premise demands <strong>for</strong> identities<br />

to be continuously verified and access authorized regardless of location in the network.<br />

Zero Trust is essentially a journey towards the aspirational elimination of the attack surface. In this regard,<br />

identity has a central role. But identity alone is not enough. It’s behavioral intelligence that should deliver<br />

the power of end-to-end protection <strong>for</strong> all of your assets, regardless of location. There is a pressing need<br />

to contextualize three things: identity, environment, and behavior. This new fluid perimeter is a<br />

combination to be managed by organizations with a simple business logic policy to securely connect all<br />

of the assets across every domain: campus, branches, data center, cloud, and remote.<br />

Although the concept of Zero Trust has been here <strong>for</strong> a decade or so, it was always challenging to<br />

operationalize it because the traditional security controls, designed under the premise of Implicit Trust,<br />

are inefficient and ineffective to enable it at scale. Let’s list some of the limitations of these legacy security<br />

controls.<br />

Virtual Private Networks (VPN)<br />

User-to-application access from outside the traditional network perimeter has been traditionally secured<br />

with VPN, but:<br />

<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 74<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


• VPN cannot limit access control after authentication and can’t provide continuous verification that<br />

would prevent the ability to traverse the network unhindered (East-West/North-South movement).<br />

• It’s inefficient to drag all user traffic back to the corporate data center, and split-tunneling brings<br />

loss of visibility and control.<br />

• VPN provides an inefficient traffic path <strong>for</strong> SaaS and cloud applications or services, delivering a<br />

bad end-user experience.<br />

• No policy can be defined when a user is within the network perimeter, and not using VPN.<br />

• VPN concentrators are expensive and complex to deploy and manage.<br />

Network Access Control (NAC)<br />

NAC technology has been around <strong>for</strong> a while but it is showing its age vis-à-vis of the evolving threat<br />

landscape.<br />

• NAC provides binary network access (either on or off) and has limited granular control and<br />

segmentation capabilities.<br />

• It typically has no supplicants <strong>for</strong> wired users or unmanaged devices such as IoT and OT, and<br />

provides limited access control <strong>for</strong> such devices.<br />

• With NAC, there is no continuous verification of authorization. User identity is verified at the point<br />

of authentication, limiting the ability to monitor <strong>for</strong> threats post-authentication, changes to<br />

permissions, and abnormal behavior.<br />

• Typical NAC solutions cannot manage and deploy NAC policies to cloud infrastructure.<br />

• Most NAC solutions have separate policy management systems <strong>for</strong> remote access VPN and<br />

firewall configuration.<br />

• As with most security controls designed under the old Implicit Trust model, traditional NAC<br />

solutions can be highly complex and expensive to deploy and maintain.<br />

Firewalls<br />

Deploying and managing firewalls across an SD-WAN is quite an undertaking, and firewall policy drift is<br />

a common ailment. This is why:<br />

• IP-based policies are hard to manage and do not provide micro and nano-segmentation<br />

capabilities.<br />

• Firewalls policies are statically configured and cumbersome to manage and update, and are often<br />

based on traditional networking constructs.<br />

• True micro-segmentation to limit lateral movement within the network requires a proliferation of<br />

firewalls, which is costly and resource-intensive to deploy and manage.<br />

• Access is based on location, i.e., inside or outside the moat: the network perimeter. Once a user<br />

is inside the network perimeter, they are inherently trusted and free to roam the network.<br />

• It is challenging to unify policies <strong>for</strong> on-prem and remote users (i.e., behind the firewall and outside<br />

remote users).<br />

<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 75<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


Solving <strong>for</strong> the long run<br />

All these limitations drive the requirements <strong>for</strong> the trans<strong>for</strong>mation of network security and how in<strong>for</strong>mation<br />

security is approached altogether. Some of this trans<strong>for</strong>mation was in progress be<strong>for</strong>e the pandemic, but<br />

it accelerated rapidly out of necessity when it struck. Zero Trust is still riding the hype curve, and many<br />

fragmented point solutions exist that address specific use cases without accounting <strong>for</strong> the bigger picture.<br />

This bigger picture is the need to decouple security from the underlying network construct to avoid the<br />

traditional cybersecurity vs. networking trade-offs that either cripple network availability or the security<br />

posture.<br />

There is also a need <strong>for</strong> ubiquitous access policy management (across all domains) and simplification<br />

via automation of cybersecurity operations to accelerate detection and response times. An ideal Zero<br />

Trust Access (ZTA) plat<strong>for</strong>m should deliver full visibility about what’s flowing through the network (users,<br />

devices, apps) by integrating with existing identity providers (IDP). The solution should also provide a<br />

unified policy management plane across multiple domains that would address the need <strong>for</strong> ubiquity and<br />

agility.<br />

It’s just then, through a single pane of glass across all domains, that the never-ending Zero Trust journey<br />

to eliminate the attack surface can start. Organizations can begin by securing the crown jewels first, or<br />

by piloting Zero Trust Network Access (ZTNA) to secure access <strong>for</strong> the hybrid work<strong>for</strong>ce. Alternatively,<br />

Network Security Architects may choose to learn the ropes of Zero Trust network security by addressing<br />

the sprawl of IoT in the workplace. Whatever the most pressing use case may be, the worst they can do<br />

is to lose sight of the long game: that the same solution should address all use cases and avoid network<br />

chokepoints that prevent scalability.<br />

The ideal end game is a distributed architecture where multi-domain policies are managed centrally but<br />

distributed and en<strong>for</strong>ced as close to the resources as possible, with continuous identity verification via<br />

integration with any flavor of IDP, including those providing telemetry about health status and other<br />

contextual attributes alongside identity. By making identity, context, and behavior the new (and now<br />

dynamic) enterprise perimeter, it becomes easier to manage risk and implement a potent cyber defense<br />

system that works under the Zero Trust paradigm.<br />

<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 76<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


About the Author<br />

Burjiz Pithawala is the CPO and co-founder of Elisity. Burjiz’s<br />

experience as a leader and technology visionary spans 23 years with<br />

deep roots in networking, cloud trans<strong>for</strong>mation, and enterprise<br />

software. Prior to Elisity, Burjiz led many of Cisco’s best-recognized<br />

routing and switching product groups with teams of 15 to 300 people.<br />

Burjiz is an Internet Task Force (IETF) author and patent holder <strong>for</strong><br />

technologies ranging from routing, switching, and predictive cloud<br />

management.<br />

Burjiz co-founded Elisity, now a series A start-up, to address the challenges depicted in this article. Elisity<br />

offers an identity-driven control plane <strong>for</strong> corporate networking and remote access without tying<br />

customers to a particular network or network security technology. Its Cognitive Trust plat<strong>for</strong>m, delivered<br />

as a cloud-based service, is deployed as an overlay or underlay on whatever WAN and/or SD-WAN<br />

infrastructure an enterprise prefers to protect data, users, devices, and applications in the data center,<br />

the cloud, at home, and everywhere. Based in San Jose, Elisity is backed by Two Bear Capital,<br />

Allegis<strong>Cyber</strong> Capital, and Atlantic Bridge. Burjiz can be reached online at LinkedIn and at our company<br />

website: www.elisity.com<br />

<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 77<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


Multicloud Rolls In: Federal IT Professionals Share<br />

Insights and Challenges<br />

By Rick Rosenburg, Vice President and General Manager, Rackspace Government Solutions,<br />

Rackspace Technology<br />

Federal agencies kicked into IT modernization overdrive during the pandemic and, as 2022 approaches,<br />

agencies are looking <strong>for</strong> ways to capitalize on investments and continue to accelerate trans<strong>for</strong>mation.<br />

One of the key investments has been in the cloud technologies that largely enabled operations across<br />

the government during the past year. And now, agencies are looking to expand capabilities, shore up<br />

security and optimize their investments in both cloud infrastructure and solutions.<br />

To achieve these goals, agencies need to invest in a comprehensive multicloud strategy to address the<br />

complexities and challenges inherent to managing and optimizing cloud investments and capabilities<br />

while emphasizing security, work<strong>for</strong>ce optimization, and resource availability. While using multiple cloud<br />

vendors is not new, crafting a multicloud strategy is – and it is complex, especially when it comes to<br />

addressing security and compliance, so Federal agencies seek a clear path <strong>for</strong>ward.<br />

<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 78<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


A Work in Progress<br />

The Advanced Technology Academic Research Center (ATARC), in partnership with Rackspace<br />

Technology, AWS, VMware, and Carahsoft, recently surveyed Federal IT professionals to take the pulse<br />

of the Federal multicloud world to better understand the current landscape, the most significant<br />

challenges, and how agencies can move faster on the path to implementing a multicloud strategy.<br />

First, it is encouraging to see that many organizations are utilizing the capabilities of multiple cloud<br />

vendors and thinking about optimizing their investments. Thirty-seven percent of respondents report their<br />

agency uses multiple clouds (infrastructure and solutions), and 60 percent have started on a cloud<br />

strategy journey. Federal IT professionals understand that it is necessary and critical to their operations.<br />

Thirty percent of respondents rank business agility as the number one benefit of cloud adoption – followed<br />

closely by legacy modernization, improved citizen experience, and optimizing IT investments.<br />

And while agencies are taking steps in the right direction to utilize vendor-provided cloud solutions and<br />

services, budget is reported as the most significant barrier in making that shift, followed closely by<br />

work<strong>for</strong>ce skillset and procurement challenges.<br />

Another significant barrier holding agencies back is understanding cloud security and compliance<br />

requirements. Nearly one-third of respondents report their agency struggles with a basic understanding<br />

of their annual security and compliance requirements – where only 40 percent of responders give a strong<br />

rating on their agency’s understanding, whether they are procured or developed in-house.<br />

FedRAMP – A Mixed Bag<br />

One of the most important programs <strong>for</strong> ensuring cloud solutions meet Federal security and compliance<br />

procedures is the Federal Risk and Authorization Management Program (FedRAMP). Survey responses<br />

showed that most Federal agencies understand FedRAMP’s significance, with 62 percent agreeing that<br />

FedRAMP helps streamline the procurement of secure, trusted cloud solutions. However, FedRAMP<br />

authorization levels vary widely, with 43 percent of agencies reporting that their highest FedRAMP impact<br />

level implemented is moderate, while 32 percent noted high FedRAMP.<br />

Even though Federal IT leaders see the benefits of FedRAMP, 41 percent say that the program hinders<br />

modernization through a slow ATO process. Respondents agree there is room <strong>for</strong> greater collaboration<br />

between government and industry to accelerate FedRAMP authorization and avoid the pressure and risk<br />

of alternative or shadow IT procurement.<br />

Multicloud as a “Business” Model<br />

Cloud modernization is critical in government agencies’ lowering their cybersecurity risks and improving<br />

<strong>Cyber</strong> posture, optimizing operations, and maximizing the potential in leveraging other emerging<br />

technology applications (e.g., artificial intelligence and machine learning). Choosing cloud does not<br />

actually mean choosing a vendor; it is a business model. Rather than thinking of cloud (and multicloud)<br />

<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 79<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


as a destination, agencies should think of cloud as a great strategy requiring planning <strong>for</strong> the complete<br />

lifecycle and utilizing multiple vendors to maximize their capabilities and outcomes.<br />

Using multiple cloud technologies brings new challenges and complexities to every phase of that lifecycle<br />

– design, build, secure, manage, and optimize – because agencies have to manage multiple public,<br />

private, and hybrid clouds. So, it’s vital to know what, where, and when to migrate <strong>for</strong> workloads, data,<br />

and applications – and the security and compliance required to maximize value and reduce risk and cost<br />

associated with missteps that necessitate multiple moves. For example, buying AWS does not mean that<br />

all of your cloud security comes along with it. AWS protects the perimeter of the cloud, but everything<br />

else inside the permitter needs to be secured on top of that. It means understanding all the data<br />

applications and workloads and what goes where and at what level of security.<br />

The complexity that comes along with multicloud can be overcome. The key is a fully baked multicloud<br />

strategy that puts security first, optimizes internal resources, and utilizes the right industry partners,<br />

services, and solutions. When done right, agencies realize all the benefits of streamlined operations and<br />

optimized cloud environments with unified governance and security.<br />

About the Author<br />

Rick Rosenburg is the vice president and general manager of<br />

Rackspace Government Solutions at Rackspace Technology. He<br />

oversees services in support of government agencies and holds 35<br />

years of leadership experience across companies that have<br />

supported the Federal government’s technology needs. Prior to<br />

Rackspace, the government services vet held leadership roles at<br />

NTT Data Services, Seros, and Dell Services Federal Government.<br />

Rick Rosenburg can be reached online at rick.rosenburg@rackspace.com and at our company website<br />

https://www.rackspace.com/industry/government.<br />

<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 80<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


SOAR Into More Integrated <strong>Cyber</strong>security<br />

By Josh Magady, Section Manager, Senior <strong>Cyber</strong>security Consultant, and Practice Technical Lead,<br />

1898 & Co.<br />

Why is being cybersecurity compliant not the same as preparedness <strong>for</strong> threats? Shouldn’t compliance<br />

mean full coverage against all current and future threats? Compliancy builds in a checklist mentality. A<br />

company measures their compliance compared to certain standards like NERC CIP and HIPAA <strong>for</strong><br />

example but, they can’t account <strong>for</strong> a company’s environment. They are intended as a starting point. The<br />

problem <strong>for</strong> organizations is when they stop with just meeting compliance standards and don’t look <strong>for</strong><br />

avenues to bolster their cybersecurity ef<strong>for</strong>ts. They might follow the best practices of the CIS Top 20, but<br />

they need a more comprehensive approach. They require a suite of tools and policies that allow them to<br />

handle the challenges of remote working and access, nation state-sponsored attacks, and broader digital<br />

trans<strong>for</strong>mation.<br />

An ideal counterpoint to various threats and digitization is a SOAR plat<strong>for</strong>m. SOAR stands <strong>for</strong> Security<br />

Orchestration, Automation, and Response. Orchestration means coordinated devices and software<br />

applications. Automation involves security processes and protocols happen based on pre-set rules, and<br />

Response relates to a collection of in<strong>for</strong>mation and rapid actions taken against threats in real time. It’s<br />

an ideal solution <strong>for</strong> protecting critical infrastructure against an ever-increasing number of threats.<br />

<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 81<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


Threats <strong>for</strong> OT, Industrial Control Systems, and SCADA Environments<br />

The threats <strong>for</strong> OT, ICS and SCADA vary by sector. Nation states are a consistent threat which are<br />

targeting municipalities, electrical grids, and other similar entities. They’re looking to destabilize these<br />

systems and, in some cases, they’re fronting the ef<strong>for</strong>ts of ransomware gangs.<br />

For industrial control systems (ICS), the challenge comes when security experts are asking engineers<br />

and system operators to think about cybersecurity. These people often feel the data produced by their<br />

ICSs is not valuable and might not warrant strong cybersecurity. However, bad actors have interest in<br />

control over these systems, not the data.<br />

The push towards remote work and broad digitization of services complicates the cybersecurity<br />

responses. Within OT, ICS and SCADA environments, there’s a range of related threats, including the<br />

risk of human error and usage of old and outdated legacy systems. With spreading digitization, there’s<br />

also an increased need <strong>for</strong> connectivity <strong>for</strong> in<strong>for</strong>mation sharing and insights. Further digitization means<br />

additional endpoints and transits that expose data to bad actors. Within all three of these environments<br />

there’s also some networks and systems that are not secure by design, so there is deep inherent flaws.<br />

Adding to all these flaws are a market with too many vendors and not enough integrated systems that<br />

enable continuity.<br />

With remote work, firms are reliant on their employees to maintain security over their home networks but,<br />

traditionally these staff don’t have the training or the background to understand the risks and<br />

threats facing their home networks. People remain the vector <strong>for</strong> threats. Firms need robust hardened<br />

endpoints and implement technologies that can provide endpoint detection response (EDR) as well as<br />

adopt zero trust architectures (ZTA). Managing all these threat exposures at scale proves challenging<br />

<strong>for</strong> any business unless it brings onboard a SOAR plat<strong>for</strong>m to unify its infrastructure and automate<br />

various processes.<br />

SOAR Adds Efficiency to <strong>Cyber</strong>security Ef<strong>for</strong>ts<br />

SOAR uses automation to extend the ability of security teams to manage multiple systems. It integrates<br />

across various plat<strong>for</strong>ms and efficiently codifies existing workflows to expand the work of understaffed<br />

teams. It’s an operations plat<strong>for</strong>m, one that blends technology and operational processes. In the hands<br />

of an experienced practitioner, SOAR can improve various processes.<br />

SOAR plat<strong>for</strong>ms provide almost infinite capabilities because at heart, they are application plat<strong>for</strong>ms.<br />

This means if a user can think it, it can most likely be implemented in a SOAR plat<strong>for</strong>m. Since it’s only<br />

limited by one’s imagination, sometimes SOAR plat<strong>for</strong>ms can intimidate teams. However, when used<br />

properly SOAR functions as an integrative plat<strong>for</strong>m that saves time and gives cyber teams a deeper<br />

reach. It automates vital processes and integrates various systems within a single plat<strong>for</strong>m, which creates<br />

streamlined actions and familiarity over time.<br />

With SOAR, organizations can orchestrate existing resources together with automation. It enables a more<br />

proactive response model, with UI standardization, improved data gathering, and workflow analysis that<br />

work together to manage today’s complex threats.<br />

For example, a firm might spend several hours per<strong>for</strong>ming an indicators of compromise (IOC)<br />

investigation. They might receive a notification from E-ISAC about checking certain domains or IP<br />

addresses or even a specific hash of a file. This creates a significant amount of work, as the analyst will<br />

need more in<strong>for</strong>mation than what’s provided in the alert. For example, if a file hash alert comes in, the<br />

<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 82<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


analyst requires more data to really understand what it’s doing. They might reach out<br />

to AlienVault or Virus Total and lookup that hash and get all the details, such as what things it usually<br />

changes, attack vectors, and other details that build a <strong>for</strong>ensic case. Once this in<strong>for</strong>mation has been<br />

collected, a search of a systems endpoints is required to check if that IOC is present in the<br />

environment. With the tasks already programmed into SOAR, along with an email parser that recognizes<br />

the E-ISAC alert, a company can tackle the investigation in minutes. The SOAR plat<strong>for</strong>m produces a<br />

report, so the team can take further actions as needed.<br />

This dynamic cuts through the noise <strong>for</strong> optimal efficiency and accuracy. So, the cybersecurity team can<br />

focus on dealing with present threats that are in the network, while automating threat identification and<br />

investigations. It also limits analyst burnout from responding to the hundreds of thousands of threat alerts<br />

that come across their desks nearly every hour. Going through these manually and determining which<br />

ones are actionable is not a reasonable task.<br />

One caveat <strong>for</strong> SOAR is be<strong>for</strong>e a significant implementation, an organization needs to review and improve<br />

its documentation. Especially if the company expects the full SOAR capabilities of incidence response,<br />

endpoint detection, phishing management, and asset management. A quality SOAR plat<strong>for</strong>m can<br />

manage all of this, but it requires a mature organization that has its policies in place with documentation.<br />

It doesn’t work with “tribal knowledge” that differs based on staff’s opinions because it cannot automate<br />

unknown processes. Be<strong>for</strong>e diving into a SOAR plat<strong>for</strong>m, it’s worthwhile <strong>for</strong> organizations to take any<br />

undocumented processes and put them on paper and then per<strong>for</strong>m smoke testing to insure they are<br />

indeed the right processes.<br />

SOAR provides an operations plat<strong>for</strong>m that enables threat investigation at scale and can streamline<br />

existing processes. It addresses staffing shortages and the need <strong>for</strong> leaner operations by automating<br />

mundane tasks. Through integration of different systems, SOAR drives efficiency <strong>for</strong> the benefit of<br />

overworked cybersecurity teams who now have time and energy to conquer other operational issues.<br />

About the Author<br />

Joshua Magady is a proven security professional and leader of<br />

security teams and programs within a variety of markets. For the<br />

past 5 years he has been working to secure our nations critical<br />

infrastructure with 1898 & Co. For the 10 years prior to that, he was<br />

leading the charge in the DoD helping to keep the systems our<br />

warfighters rely on safe and secure. He has many initials after his<br />

name, including CISSP, OSCP, and GICSP. He has a passion <strong>for</strong><br />

helping the average person and new security professionals<br />

understand the why, what, when and how of security.<br />

Joshua can be reached online at https://www.linkedin.com/in/joshuamagady/ and at our company<br />

website: https://1898andco.burnsmcd.com/.<br />

<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 83<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


Analyzing The Security Challenge of Hybrid and Remote<br />

Working Models<br />

By Mike East, VP EMEA, Menlo Security<br />

The pandemic has shifted the balance in many arenas, not least in relation to cybersecurity.<br />

Where COVID-19 has continued to have a drastic influence over economies, societies and governments<br />

globally, cybercriminals have been able to piggyback on a perfect storm of uncertainty and confusion,<br />

tapping into fears and capitalizing on new vulnerabilities.<br />

One of the most significant indirect impacts of the pandemic has been the uptick in remote and hybrid<br />

working models.<br />

Indeed, such models deliver a variety of benefits, from improved work life balances <strong>for</strong> employees to the<br />

ability to access wider talent pools <strong>for</strong> employers who are no longer restricted by geographies and offices.<br />

However, with remote and hybrid operations have come distinct changes in relation to IT, revealing a<br />

host of security vulnerabilities in those organizations that have failed to adapt appropriately.<br />

Menlo Security recently surveyed over 500 IT decision makers in the US and the UK to gain insight into<br />

the attitudes surrounding securing remote access to applications and resources and potential methods<br />

of doing so.<br />

<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 84<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


Critically, this survey found that while 83 percent of organizations are confident in their ability to control<br />

access to applications <strong>for</strong> remote users, 75 percent are still opting to err on the side of caution and<br />

conduct additional evaluations of their security strategy to gauge suitability in the ‘new normal’.<br />

While a quarter of organizations are opting not to do so, the fact that three in every four companies are<br />

is a promising sign.<br />

Critically, security protocols in relation to on-premise models and hybrid cloud-based models differ wildly.<br />

Both require different approaches, and there<strong>for</strong>e those companies that have made the shift to cloudbased<br />

operations since the pandemic first emerged must update in order to be secure.<br />

At the same time, however, it is vital that those organizations conducting such reviews come to the right<br />

conclusions.<br />

Our survey also found that three in every four organizations still rely on virtual private networks (VPNs)<br />

<strong>for</strong> controlling remote access to applications – this ratio rising to more than four in five <strong>for</strong> organizations<br />

with over 10,000 employees.<br />

With traditional security tools such as VPNs being inherently insecure in the modern day, this is a<br />

challenge – yet there is significant opportunity to address this, and organizations are showing willing.<br />

Achieving holistic protection in the hybrid era<br />

So, what improvements should organizations be considering in order to bolster their security within an<br />

environment dominated by remote and hybrid business models that are plagued by rising cybercriminal<br />

activity?<br />

Enter zero trust – the perfect starting point <strong>for</strong> trans<strong>for</strong>ming security.<br />

Unlike traditional protocols that take a somewhat outdated ‘castle and moat’ approach to security, only<br />

working to defend the external perimeter of an organization, zero trust takes an approach rooted in three<br />

key principles:<br />

• That all available data points must be continually authenticated.<br />

• That user access must be limited to specific applications.<br />

• That a breach must always be assumed to be imminent.<br />

In simple terms, zero trust is about viewing trust as vulnerability.<br />

While defending the perimeter once worked, today’s hyperconnected world, underpinned by the cloud<br />

and the integration of a sea of external applications, the perimeter no longer exists. As a result, the threat<br />

landscape has become increasingly exacerbated, and there<strong>for</strong>e it is critically important to limit risks and<br />

exposure.<br />

Many of the most harmful cyberattacks in recent times have largely been the result of a lack of proper<br />

security protocols beyond the perimeter. After hackers have gained initial access to a company’s network,<br />

<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 85<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


they have been able to move laterally to access data and elevate privileges without any meaningful<br />

resistance.<br />

For this very reason, zero trust ensures that all external and internal traffic – be it emails, websites,<br />

videos, documents or other files that originate from either inside or outside an organization – must be<br />

verified.<br />

Implementing zero trust: Isolation technologies<br />

Indeed, many organizations agree that the inherent connectivity that comes with hybrid and remote<br />

working models is creating additional areas of security consideration.<br />

Some 75 percent of Menlo’s survey respondents stated that they believe hybrid and remote workers<br />

accessing applications on unmanaged devices pose a significant threat to their organization’s security.<br />

Further, almost four in five agreed that remote access by third parties is a cause <strong>for</strong> concern with more<br />

than half planning to reduce or limit third party/contractor access to internal systems and resources over<br />

the next year or two.<br />

Yet such concerns could easily be addressed by the implementation of zero trust policies – given the<br />

intensity of today’s threat environment, controlling internal and external user access has never been more<br />

important.<br />

That said, it can be difficult to know where to start.<br />

What does zero trust look like? What technologies and tools are required? How can I implement it<br />

throughout my entire organization? Here, a security specialist can be a highly valuable partner, helping<br />

to answer many key questions and implement a zero-trust architecture that suits the specific needs and<br />

functions of any one individual organization.<br />

Isolation technology, <strong>for</strong> example, is one tool available that can achieve zero trust in its truest sense.<br />

Isolation essentially moves the browsing process from the endpoint – be it a desktop, mobile device,<br />

tablet or other – and executes it in the cloud. In this process, a <strong>for</strong>m of digital air gap is created between<br />

the internet and endpoint where all content can be rendered safely to always deliver holistic peace of<br />

mind.<br />

Isolation-centric zero trust there<strong>for</strong>e does not leave any room <strong>for</strong> error. Indeed, it can halt threat actors in<br />

their path 100 percent of the time.<br />

<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 86<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


About the Author<br />

Mike East is Vice President EMEA, Menlo<br />

Security Mike East is Vice President EMEA<br />

Sales. In this role, he is helping to grow the<br />

business across the region and develop and<br />

manage the EMEA sales team. Mike has<br />

worked in the IT industry <strong>for</strong> 30 years, in<br />

technical and sales leadership roles, focusing<br />

on security <strong>for</strong> the last 15 years, building and<br />

restructuring the UK and EMEA businesses<br />

<strong>for</strong> vendors, including Symantec, Mandiant,<br />

FireEye, CrowdStrike and Duo Security.<br />

Passionate about solving the ever-increasing cybersecurity issues that companies and governments face<br />

on a daily basis, Mike has experience of presenting at industry events and participating on panels and<br />

webinars talking about web isolation, network security, malware and cybersecurity resilience.<br />

Mike can be reached at mike.east@menlosecurity.com or via https://www.linkedin.com/in/mike-east/ and<br />

at our company website http://www.menlosecurity.com/<br />

<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 87<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


How To Effectively Secure Connected Devices<br />

By Gnanaprakasam Pandian, Chief Product Officer and Co-Founder, Ordr<br />

As connected devices, including Internet of Things (IoT), Internet of Medical Things (IoMT) and<br />

Operational Technology (OT) continue to explode in growth, they introduce a new attack surface. In fact,<br />

an astonishing 46% of all connected devices are vulnerable to medium and high severity attacks. This is<br />

just one of the key findings of a new report released by connected device security company Ordr, in its<br />

2 nd annual Rise of the Machines <strong>2021</strong> Report “State of Connected devices -- IT, IoT, IoMT and OT report.<br />

The report analyzed connected device security risk and adoption between June 2020 and June <strong>2021</strong>,<br />

across more than 500 customer deployments in healthcare, manufacturing, financial services<br />

organizations and more. According to the report, the following are the key security issues that should be<br />

on the radar of every network security professional.<br />

Extending security to agentless or un-agentable devices<br />

The report found that 42% of connected devices were agentless or un-agentable devices – meaning that<br />

they cannot support endpoint security agents. This represents a 32% increase since 2020, further<br />

confirming that a security strategy focused only on agent-based endpoint security is insufficient. A<br />

<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 88<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


complete security strategy should include solutions that can identify and secure these devices via the<br />

network to complement endpoint security solutions.<br />

Adopting a “whole organization” approach to connected security<br />

To ensure connected device security, it is vital that all devices and assets on a network be identified and<br />

profiled. The Colonial Pipeline attack showed us that when IT and IoT systems are hit by a cyberattack,<br />

business is impacted even if the OT environment continues to function. For example, in a hospital<br />

environment, a cyberattack impacting an elevator control system will similarly bring down the entire<br />

healthcare operations if patients cannot be transported, even if medical devices are unaffected.<br />

Understanding the Risks posed by “Shadow IoT” and personal devices<br />

Reflecting current times, the report found that the number of Pelotons, Sonos, Alexas and Teslas in<br />

customer networks have almost doubled since 2020. Many of these devices (with the exception of Teslas)<br />

are being used <strong>for</strong> actual business operations. In fact, many of “Smart Hospitals” have deployed Alexas<br />

in their rooms <strong>for</strong> their pediatric patients. Alexas were used <strong>for</strong> “nurse call functions,” to switch channels<br />

on TVs, and to dim or change the smart lighting in the rooms. Pelotons are being used <strong>for</strong> physical<br />

therapy in hospitals, deployed in gyms in hospitality verticals and enterprises.<br />

Not only do these devices have vulnerabilities (<strong>for</strong> example leaky APIs within Pelotons) that threat actors<br />

can take advantage of, but there is also an overwhelming amount of data stored that could be used to<br />

target users within the organization. Threat actors are already targeting disgruntled employees to get<br />

them to unleash ransomware. Data from personal devices could present a whole new range of threats.<br />

Gauging the level of security risk posed by devices<br />

It is important to be aware that outdated operating systems present the greatest security risks <strong>for</strong> most<br />

organizations. According to the report, about 19% of deployments include devices running outdated<br />

operating systems Windows 7 and older, and almost 34% of deployments have devices running Windows<br />

8 and Windows 10, which are expected to end-of-life in 2023 and 2025, respectively.<br />

Within healthcare, 15% of medical devices and 32% of medical imaging devices run on outdated<br />

operating systems. This is because many medical devices remain in operation <strong>for</strong> many years and cannot<br />

be easily replaced <strong>for</strong> cost reasons. Segmentation is the only way to ensure security of these devices,<br />

keep them in operation and avoid the costs of replacing devices early.<br />

Managing user access to devices and appropriate offboarding when status changes<br />

A particularly interesting finding of the report was that about 55% of organizations examined had devices<br />

with orphaned users. These are most often devices that were the responsibility of users that have left an<br />

organization or changed roles. Devices with orphan accounts retain the same access rights as when they<br />

were associated with an active user. These orphaned user accounts provide a gateway to privilege<br />

<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 89<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


escalation and lateral movement. There<strong>for</strong>e, as part of a robust and complete Zero Trust strategy <strong>for</strong><br />

connected devices, security teams need to ensure that all devices are being utilized only by current users.<br />

This latest Rise of the Machines report identified a substantial number of vulnerabilities and risks in<br />

connected devices, which is a crucial reminder that organizations must have comprehensive visibility as<br />

well as security <strong>for</strong> everything connecting to their networks. The number of network-connected devices<br />

is only going to increase and the number and sophistication of attacks targeting them will continue to<br />

grow in parallel.<br />

About the Author<br />

Gnanaprakasam Pandian, Chief Product Officer and Co-<br />

Founder of Ordr. Pandian has more than 20 years of product<br />

and engineering leadership experience and is also a serial<br />

entrepreneur. Be<strong>for</strong>e founding Ordr, he was the Chief<br />

Development Officer at Aruba, responsible <strong>for</strong> all of engineering<br />

and product management functions. Aruba, an enterprise<br />

mobile wireless company, was acquired by HPE <strong>for</strong> $3 Billion<br />

in March 2015. Be<strong>for</strong>e Aruba, Pandian served as the head of<br />

engineering <strong>for</strong> Cisco’s multi-billion-dollar Wi-Fi business unit and be<strong>for</strong>e that as VP of engineering <strong>for</strong><br />

low-end switching product lines. He graduated with a master’s degree in Electrical Engineering from IIT,<br />

Chennai, India and holds several patents to his credit in various networking technologies.<br />

He can be reached online at GPandian@ordr.net, on Twitter at @ordrofthings, and on LinkedIn at<br />

https://www.linkedin.com/in/gpandian/, and at our company website is www.ordr.net.<br />

<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 90<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


Financial Institutions Leveraging CIAM Benefits to Scale<br />

Customer Experience and Brand Equity<br />

By Balraj Dhillon, Director – Engagement & Delivery, Simeio<br />

Financial Services is one of the best-known use cases of IAM. With ever-increasing regulations,<br />

protocols, and complexities surrounding the industry, adopting the latest and the best tools to manage<br />

Customer Identity and Access Management (CIAM) has become critical <strong>for</strong> businesses. New report from<br />

TransUnion has found an alarming spike in fraud attempts targeting the financial services industry.<br />

Compared to the last four months of 2020, suspected digital fraud attempts increased by 149% in <strong>2021</strong><br />

in financial services. For financial services organizations, in such a scenario, there is constantly<br />

tremendous pressure to ensure their customers are safe from such identity theft attempts. As part of<br />

digital revamps that financial institutions are engaged in, scaling their CIAM programs becomes<br />

mandatory to keep up with changing security briefs and trends and protect their brand equity. Whether it<br />

is a large or mid-size financial services organization, customer expectations from their digital experience<br />

have changed. And with Covid, the digitized world has become more relevant than ever be<strong>for</strong>e, driving<br />

significant investments. The increase in demand <strong>for</strong> self-service tools has led to customer identity and<br />

access management becoming a top priority. So, some digital features and access that were “nice to<br />

haves” are now an absolute necessity <strong>for</strong> increased brand loyalty and trust. According to Forrester<br />

analysts (reported in Gauge Your Identity and Access Management (IAM) Program Maturity, August 2nd,<br />

<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 91<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


<strong>2021</strong>), “Without effective CIAM strategy customers and prospects will take their business elsewhere and<br />

cost you revenue."<br />

Customers want financial institutions to<br />

prioritize great user experiences. They also<br />

want brands and organizations to protect them<br />

from fraud, breaches, and privacy violations.<br />

CIAM enables this functionality by bringing<br />

features such as customer registration,<br />

service account management, consent, single<br />

sign-on (SSO), multi-factor authentication<br />

(MFA), and data access governance. One of<br />

the leading financial services organizations<br />

has implemented customer-focused, digital<br />

trans<strong>for</strong>mation programs and prioritized CIAM.<br />

Coastal Capital Savings, the largest memberowned<br />

financial cooperative in Canada with<br />

more than 500,000 members, is aiming to enable digital interactions, driving seamless customer<br />

experiences, and onboard users in a digital capacity safely and securely. According to Stephen<br />

Pedersen, Director, In<strong>for</strong>mation Security, Coastal Capital, “Customer needs have changed where<br />

simplicity, transparency, and security is critical <strong>for</strong> them, when interacting with a financial service provider.<br />

The question is how do we ensure that these are addressed, and customers access applications<br />

efficiently and seamlessly? Customer identity and access management (CIAM) thus became integral in<br />

the modernization and trans<strong>for</strong>mation of our applications to ensure accessing applications <strong>for</strong> customers<br />

remain ef<strong>for</strong>tless without compromising security. Our legacy services needed to modernize its interfaces<br />

and integration patterns into CIAM which was a priority to offer the best experience <strong>for</strong> our customers.”<br />

When talking about customer data<br />

security and financial transactions, a<br />

strong CIAM program must provide the<br />

highest level of security and a seamless<br />

customer experience no matter which<br />

channel (web, mobile, etc.). In terms of<br />

investments, financial institutions are<br />

not wary of the fact that significant<br />

investments are required to achieve the<br />

desired digital experience <strong>for</strong> their<br />

customers. Canadian financial<br />

institutions have reportedly spent over<br />

C$100 billion on technology to provide customers digital banking plat<strong>for</strong>ms. In a Forrester research,<br />

(reported in The Top Trends Shaping Identity and Access Management, July 12th, <strong>2021</strong>) 62% of<br />

respondents comprising of senior decision-makers, indicated increasing their budget by at least 1% in<br />

Customer Identity and Access Management. 31% of respondents said they would increase the same by<br />

at least 5%, and 72% of organizations either already adopted it or will have it between 2025. Undoubtedly,<br />

<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 92<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


CIAM is an area that is increasingly becoming a focus to achieve a robust, and seamless customer<br />

experience that significantly impacts brand equity. CIAM adoption and customer experience are<br />

increasingly becoming a basis <strong>for</strong> competition. It will not be an exaggeration to say that to offer the best<br />

and an end-to-end customer experience, a robust CIAM investment will <strong>for</strong>m a critical part of the overall<br />

technology spent.<br />

About the Author<br />

Balraj Dhillon is a Director, Engagement & Delivery at Simeio. As a<br />

cyber security leader, he leads customer engagements, technology<br />

delivery, and product advocacy across IAM deployments. Prior to<br />

joining Simeio he co-founded a patient engagement healthcare<br />

startup, that delivered natural processing (NLP) experiences<br />

to solve patient engagement using voice and chat-based interfaces.<br />

He also served as Director of Product at Ontario Health, where he led multiple cyber-security and identity<br />

modernization initiatives focused on consent, privacy, healthcare provider identity and API gateway <strong>for</strong> a<br />

system that aggregated over 7 billion electronic health records. Balraj has a robust background in<br />

developing, deploying, and positioning products/solutions across multiple domains.<br />

First Name can be reached online at bdhillon@simeio.com and at our company website<br />

http://www.simeio.com/<br />

<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 93<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


How Certificate Pinning Helps Thwart Mobile MitM<br />

Attacks<br />

By David Stewart, CEO, Approov<br />

The massive deployment of mobile apps is presenting new attack surfaces to bad actors and the API<br />

channel between the apps and backend services is one of the 5 defined attack surfaces in the ecosystem.<br />

In this article we will explore the challenges of defending this channel and outline some practical steps<br />

you can take to put immediate protection in place.<br />

Mobile app usage has been increasing year on year and that seems unlikely to change. As shown in the<br />

chart below, direct revenue derived from mobile apps is also showing impressive growth. Most consumer<br />

facing enterprises now have a mobile app since it is the preferred touchpoint <strong>for</strong> their customers and<br />

even if those apps don’t generate revenue directly <strong>for</strong> the company, trust in the mobile app plat<strong>for</strong>m is<br />

vital <strong>for</strong> brand reputation.<br />

<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 94<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


(Image source: Statista)<br />

Attacking the API channel between mobile apps and their backend servers through Man-in-the-Middle<br />

(MitM) attacks are a growing threat <strong>for</strong> mobile users. The ability to intercept and manipulate<br />

communications between mobile devices and servers is an issue that has been known <strong>for</strong> some time<br />

and, backed by the explosive growth in mobile app usage, it has become commonplace. In spite of this,<br />

many enterprises are not clear on effective and efficient ways to combat these attacks.<br />

In the following sections, we'll look at how certificate pinning can help thwart mobile MitM attacks, as well<br />

as the pros and cons involved with static versus dynamic pinning, and what else you could do to protect<br />

your organization's data and revenue from these types of exploits.<br />

Man-in-the-Middle Attacks - A Brief Explainer<br />

Man-in-the-middle attacks are when an attacker intercepts or manipulates mobile device communications<br />

to gain access to sensitive in<strong>for</strong>mation. The bottom line is that they give attackers the ability to see any<br />

communications, modify messages using the channel, steal login details or certificates from encrypted<br />

traffic, intercept sensitive commercial/personal data, or even launch a denial of service attack against the<br />

service being accessed via a mobile app with ease.<br />

<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 95<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


(Image source: Approov)<br />

You might be wondering about the fact that API traffic is normally encrypted using TLS (Transport Level<br />

Security). You are right and in TLS there's a whole protocol around ensuring that the mobile app thinks<br />

it's talking to a legitimate backend server. However, a MitM can insert themselves into the channel such<br />

that the mobile app ends up talking to the MitM actor over an encrypted channel thinking that it's actually<br />

the backend server. Thus, the MitM can see all the traffic, potentially modify the traffic, and then transmit<br />

that on, again over an encrypted channel back to the backend service. Let’s look at how TLS is supposed<br />

to work and how it can be manipulated.<br />

When a communication is made from the app to the backend service, there is a certificate that is on your<br />

server that's part of an overall trust chain that proves the legitimacy of that particular server and that it<br />

actually belongs to the person you say it belongs to. This uses public key infrastructure (PKI) and during<br />

the negotiation, a number of different certificates are presented and are checked by the client to prove<br />

that they are correct, and this follows a trust chain that ultimately needs to lead to a root certificate<br />

authority. The anchor point in terms of trust is the fact that there are a number of certificates which are<br />

essentially pre-installed and updated on the mobile device itself from certificate authorities and you only<br />

accept the traffic if you have a chain of trust leading there.<br />

Now, there are a couple of ways that this trust chain can be subverted. One way is to use a MitM tool, of<br />

which there are many, such as mitmproxy. In such cases you’ll be analyzing traffic from a mobile app<br />

and you're also controlling the device. Tools such as mitmproxy create a certificate that is installed onto<br />

the end user device. Rather than being a certificate from a root certificate authority, it is actually a selfsigned<br />

certificate that the tool has made up. You install it into the trust store on the device and then when<br />

the tool intercepts traffic, on the fly it will create leaf certificates <strong>for</strong> the particular domains that you are<br />

visiting, which have a chain of trust back to the self-signed certificate authority that you have put on the<br />

device. Thus, everything will check out on the trust side and the traffic is redirected to the MitM rather<br />

<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 96<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


than actually going to the server. From there the MitM will then connect to the real server, allowing the<br />

traffic to continue but actually there's this proxy in the middle that's seeing all the traffic. You can replay<br />

the traffic and you can now modify the traffic if you want.<br />

(Image source: Approov)<br />

The other way that you can break the trust is if there has been a breach of a certificate authority or a bad<br />

issuance of a certificate. One of the weaknesses of the PKI architecture is the fact that there are a large<br />

number of root certificate authorities that are installed on the device and if there's a breach in any of those<br />

then that could lead to a situation in which a certificate <strong>for</strong> a domain that you're connecting to you could<br />

have an attacker certificate incorrectly issued.<br />

So the trust is only as strong as the weakest link.<br />

The Benefits of Certificate Pinning<br />

Certificate pinning helps mobile app developers protect mobile apps from the MitM attacks described<br />

above. However, despite its usefulness, it isn't widely used.<br />

Certificate pinning allows mobile applications to restrict communication only to servers with a valid<br />

certificate matching the expected value (pin). The connection is terminated immediately if communication<br />

is attempted with any server that doesn't match this "expected" value.<br />

<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 97<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


(Image source: Approov)<br />

In the past, certificate pinning has been challenging to implement and highly reliant on the networking<br />

stack in use. DataTheorem's TrustKit, as always, has been a fantastic tool <strong>for</strong> putting it into action.<br />

However, Google and Apple have recently enhanced their plat<strong>for</strong>ms to simplify the process, removing<br />

any dependency on the network stack.<br />

Since Android 7, Google has supported pinning. Developers simply define pins in the file's particular XML<br />

syntax. Apple has lately followed suit and added NSPinnedDomains support with iOS 14. Developers<br />

may add Pins by entering them in the Info.plist file <strong>for</strong> the app in the correct <strong>for</strong>mat.<br />

There's now some solid plat<strong>for</strong>m support, but the configuration part is tricky, especially if you're not<br />

familiar with PKI and certificate management. The majority of the setup is based on issuing numerous<br />

complex OpenSSL commands and managing certificate files in various <strong>for</strong>mats.<br />

If you want to get started with understanding and implementing certificate pinning, this free Pinning<br />

Generator Tool makes it simple to generate and maintain pinning configurations <strong>for</strong> mobile apps, ensuring<br />

that they are kept up to date on Android and iOS.<br />

Static Pinning Risks<br />

Un<strong>for</strong>tunately, certificate pinning isn't quite the panacea <strong>for</strong> preventing MiTM attacks, particular <strong>for</strong><br />

mobile. There are certain risks where a certificate pin is set statically as described above. For example,<br />

when you hardcode the pins into an app be<strong>for</strong>e releasing it, there are a few things to consider:<br />

●<br />

If somebody with malicious intent gains access to one of your private keys that have been used<br />

in production, they could then use this key on any other server linked to your mobile application<br />

<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 98<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


and have complete control over all communications from users' devices, without them knowing<br />

anything was amiss;<br />

●<br />

●<br />

If you make changes (<strong>for</strong> instance, by changing encryption algorithms), old versions of the code<br />

using static pinning will break;<br />

If there is a problem with the pins in your mobile app and you release an updated app, users will<br />

remain vulnerable until they get around to updating it.<br />

A good example of a situation where static pinning was disastrous is the 2016 Barclays Bank UK incident.<br />

The bank's mobile application had been pinning an obsolete intermediate certificate in the mobile<br />

application - making transaction authentication impossible. Hundreds of thousands of consumer payment<br />

transactions were affected due to the outage, which prevented many small and medium-sized enterprises<br />

from conducting important transactions. As a result, many companies had to close their doors at 8:30 am<br />

on 25th <strong>November</strong> 2016 (Black Friday) and <strong>for</strong> the rest of the festive period leading to immense financial<br />

losses. In addition, it had a significant negative impact on Barclays' reputation and its business<br />

customers.<br />

The Need <strong>for</strong> an Alternative Pinning Approach<br />

What mobile app developers need is a way to pin certificates that don't require static pins. Instead, mobile<br />

applications should have access to dynamic or live pinned certificates from an online service so they can<br />

be updated automatically on the fly - without having users download and install updates <strong>for</strong> their apps<br />

every time there's a change in security infrastructure.<br />

Essentially, this approach allows mobile application developers to stay one step ahead of hackers by<br />

keeping up with changes in certificate authorities' keys over time while minimizing downtime due to<br />

misconfiguration, avoiding any potential reputational damage among consumers that could lead them<br />

away from using your business' mobile offering altogether.<br />

This would allow developers and DevOps teams to avoid further incidents like Barclays' and improve<br />

customer experience over mobile. Certificate pinning must be implemented <strong>for</strong> all APIs that service<br />

mobile apps in industries which handle commercially or personally sensitive data. Trust is a major factor<br />

in mobile security, and app developers need to do everything they can to protect their customers from<br />

cyber-attacks while also maintaining trust among their users that the mobile application has been<br />

designed with privacy and data protection as top priorities.<br />

<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 99<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


About the Author<br />

David Stewart is CEO of Approov. He has 30+ years’ experience<br />

in software security, mobile apps/APIs, embedded software tools,<br />

design services, chip design, design automation tools, technical<br />

support, marketing, sales, fundraising, executive management &<br />

board advisory roles. Current focus is growing a business<br />

delivering revenue assurance <strong>for</strong> enterprises reliant on mobile<br />

channels to reach their customers. Approov is a SaaS security solution preventing APIs being accessed<br />

by anything other than genuine instances of your mobile apps running in a safe environment. David can<br />

be reached at @approov_io and https://approov.io/<br />

<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 100<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


What Do Spear Phishing Attacks Look Like In <strong>2021</strong>?<br />

Understanding the Threat Landscape in <strong>2021</strong><br />

By Tim Sadler, Co-Founder & CEO, Tessian<br />

You don’t need to tell me that the security threat landscape has changed a lot over the last two years.<br />

Fuelled by global pandemic and a widespread shift to online operations, cybercriminals have changed<br />

their tactics once again to target businesses and their remote workers.<br />

And one of the top ways to target employees has been phishing attacks. Not the bulk spam and phishing<br />

attacks that have become easier to spot, though. We have seen a rise in highly targeted spear phishing<br />

emails, which are designed to bypass existing email security defences and manipulate people into<br />

complying with cybercriminals’ malicious requests.<br />

In fact, Tessian’s recent ‘Spear Phishing Threat Landscape <strong>2021</strong>’, revealed that two million malicious<br />

emails landed in employees’ inboxes, having slipped past defences like Secure Email Gateways (SEGs)<br />

and native tools between July 2020 and July <strong>2021</strong>. This rendered people as a company’s last line of<br />

defence and, consequently, left organisations vulnerable to costly cyberattacks like business email<br />

compromise or ransomware.<br />

<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 101<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


It’s not that people aren’t smart enough to spot a scam when they see one. The problem is that today’s<br />

advanced phishing attacks are difficult to detect, given that they don’t contain the tell-tale signs that<br />

employees are told to look out <strong>for</strong>. When you then add in the fact that cybersecurity is rarely front of mind<br />

<strong>for</strong> all employees and that many are distracted by their overwhelming to-do lists, you can hardly expect<br />

on every employee to spot every malicious email that they receive – even with training. For example, in<br />

a previous report, we revealed that 45% of people had clicked on a phishing email at work because they<br />

were distracted.<br />

So how are these emails bypassing existing security solutions and which employees are most likely to<br />

be targeted?<br />

Who is being targeted?<br />

According to our data, an average employee receives 14 malicious emails a year and cybercriminals<br />

aren’t picky when it comes to company size, with our researchers finding that SMBs and enterprises are<br />

targeted in equal measures.<br />

However, employees in the retail industry were prime targets, with the average worker receiving 49 emails<br />

per year – making retail the most targeted industry during this time. People working in manufacturing<br />

received the second most at 31 emails per employee, per year. To put this into context, an employee in<br />

the retail industry would have to successfully identify up to 50 carefully crafted emails a year to avoid<br />

causing a serious security incident.<br />

That’s not so easy when the emails are crafted using sophisticated techniques to avoid detection. These<br />

include display name spoofing, whereby the attacker changes the sender’s name to someone the target<br />

recognises; domain impersonation whereby the attacker sets up an email address that looks like a<br />

legitimate one, and account takeover attacks where a bad actor poses as a legitimate customer or<br />

employee, gains control of an account and then makes unauthorised transactions.<br />

When are they being targeted?<br />

We’re often told that bad actors borrow best practice from marketers. If that’s the case, most phishing<br />

attacks would land in employees’ inboxes around 10AM on Wednesdays, but our research revealed a<br />

different story.<br />

The most malicious emails are delivered between 2PM and 6PM, with very little fluctuation day-to-day<br />

(except over the weekend). This isn’t an accident. Since employees are more likely to make mistakes<br />

when they’re stressed, tired, and distracted, the second half of the working day is likely a bad actor’s best<br />

bet.<br />

<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 102<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


Our report also suggests that employees need to keep an eye out key calendar events in the year, as<br />

cybercriminals jump on key trends or holidays as lures in their attacks. For example, last year, the most<br />

malicious emails were received on the days surrounding Black Friday, one of the busiest days <strong>for</strong> online<br />

shopping.<br />

How are they evading detection?<br />

Employees – and the traditional security defences in place to protect them – typically rely on a set of<br />

guidelines and rules to determine whether something is malicious. For instance, does the email have a<br />

suspicious attachment or link? Does the message contain certain words that signal a threat? Does the<br />

sender’s domain contain incorrect characters?<br />

<strong>Cyber</strong>criminals are aware of these rules - and they are doing everything they can to reverse engineer the<br />

rules and remove these tell-tale signs from their campaigns to evade detection.<br />

In our report, <strong>for</strong> example, 75% of the malicious emails we detected and analysed didn’t contain an<br />

attachment.<br />

Zero payload attacks, which don’t rely on a malicious payloads like attachments or links, were used<br />

instead – a technique whereby the attacker builds a rapport with victims over time and persuades them<br />

to action a request once trust is established. Zero payload attacks can be as devastating as malicious<br />

payload attacks, and traditional antivirus and anti-phishing software – which often rely solely on keyword<br />

detection and deny/allow lists – struggle to detect them every time.<br />

What’s more, our researchers also found examples of account takeover – a type of attack whereby a<br />

cybercriminal sends an email to their victim using a legitimate account that they hacked into previously.<br />

To all intents and purposes, the sender’s email looks like the real deal. There would be no reason to flag<br />

it as malicious – if you’re relying on rules to detect threats.<br />

To sophisticate cyber defence policies, then, business decision makers must ensure employees are<br />

trained and made aware of the types of threats they could be exposed to. The training must be delivered<br />

regularly, if they are to keep up to date with the evolving threat scape.<br />

But it’s unrealistic to expect your employees to spot every threat, every time. Regardless of training,<br />

employees are prone to mistakes and can be tricked. So, businesses must also consider how to bolster<br />

their defences to keep the bad guys out of the inbox. Rules are not enough. For advanced threats, you<br />

need advanced machine intelligent security solutions which can detect, and flag, potentially malicious<br />

emails based on people’s behaviours on email and alert employees be<strong>for</strong>e it’s too late.<br />

<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 103<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


This advanced and layered approach to email security is critical as cybercriminals continue to evolve<br />

their techniques to bypass detection and deceive people using phishing attacks.<br />

About the Author<br />

Tim Sadler is the CEO and co-founder of Human Layer<br />

Security company Tessian. He leads the company to<br />

achieve its mission of securing the human layer and<br />

empowering people to do their best work, without security<br />

getting in the way. Since starting the company in 2013,<br />

Tim has raised $127m from leading VC funds and he has<br />

grown the company across the UK and US.<br />

Tessian can be contacted via tessian@centropypr.com, or at our company website<br />

https://www.tessian.com/<br />

<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 104<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


Keeping Your Guard Up: Protecting Against Inherent<br />

Trust Risks<br />

Important steps to identify inherent trust in the risk management process<br />

By Zubaid Kazmi, a managing director in MorganFranklin Consulting’s cybersecurity practice<br />

Trust is a huge problem in cybersecurity. Whether gaining access to a building or infiltrating a computer<br />

network, anything can be breached with the right credentials. While implementing multiple identity zones<br />

is a good measure in the zero-trust playbook, a bad actor that can get through a first checkpoint, can<br />

certainly make it through the second. This is why implementing a second checkpoint that requires<br />

biometric verification or requests in<strong>for</strong>mation only the real employee would know is vital <strong>for</strong> security.<br />

Meanwhile, most organizations still inherently trust the strength of their verification processes, and this<br />

trust extends to what happens once an intruder is inside the organization.<br />

The Risks of Inherent Trust<br />

In a world where it is increasingly difficult to trust that an identity is true and not compromised, models<br />

like “zero-trust” are catching interest and frequently being implemented. The best way to approach zerotrust<br />

within an organization is by being intentional about trust. This goes beyond traditional<br />

authentication and access governance use-cases. It extends to the supply chain of identities,<br />

organizations, and services. It also goes beyond just third-party risk management and starts delving into<br />

fourth-party risk management. Truly protecting an organization means thinking about zero-trust as an<br />

assessment of where there is inherent trust across business processes, contractual agreements, systems<br />

integrations, and (yes) identity and access controls.<br />

<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 105<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


When designing and implementing systems, policies, and processes, organizations commonly make<br />

assumptions about the security and trustworthiness of the applications, systems, partners, and other<br />

entities that they work with. A billing application logically needs access to customer data to do its job.<br />

However, this doesn’t mean that this is all the application does with this data.<br />

An application may be created by a reputable manufacturer, but this does not ensure it is secure. As<br />

incidents like the SolarWinds and Syniverse hacks have demonstrated, supply chain and third-party risk<br />

are major security threats. Simply by using a particular application and granting it the access and<br />

permissions necessary to do its job, an organization inherently places trust in that software, its<br />

manufacturer, the manufacturer’s suppliers and partners, and so on.<br />

These inherent risks are not limited to external supply chains and third-party risks. Employees and<br />

systems within the organization can be inherent risks as well. For example, access to a company’s<br />

financial records may be explicitly granted to members of the finance department. However, these<br />

records are stored, processed, and transmitted on infrastructure managed by the IT department. By using<br />

computer systems, organizations inherently place trust in their IT department, its processes, and its<br />

security against cyber threats.<br />

Syniverse: A Case Study in Inherent Trust<br />

The recently reported Syniverse hack is a prime example of the risks of inherent trust. Syniverse is an<br />

SMS routing company that transfers SMS messages between the networks of major carriers (T-Mobile,<br />

AT&T, and Verizon). On October 6, <strong>2021</strong>, the company reported in an SEC filing that it discovered in<br />

May <strong>2021</strong> that an attacker has had access to its systems since May 2016.<br />

Syniverse has access to the contents of all text messages sent via its plat<strong>for</strong>m, and, while there is “no<br />

indication” that the attacker had access to these messages, it is certainly a possibility. Companies using<br />

SMS <strong>for</strong> business communications are not only trusting their own carrier to protect the confidentiality of<br />

their communications. They are also inherently placing trust in companies like Syniverse often without<br />

even knowing it.<br />

How Security Initiatives Fall Short<br />

Security initiatives are commonly designed to address a specific issue. Initiatives can be reactive,<br />

addressing regulatory compliance failures or vulnerabilities that lead to cybersecurity incidents, or<br />

proactive such as an attempt to implement a zero-trust security model.<br />

In most cases, these security initiatives boil down to deploying a solution to solve a problem, such as<br />

using encryption solutions to improve data privacy and security. However, without the necessary context<br />

and a holistic approach to the problem, these solutions may not actually fix the issue they intend to solve<br />

and could potentially make things worse.<br />

Often, inherent trust and its associated risks are a vital missing piece during this decision process. A<br />

failure to appropriately assess an organization’s inherent trust and take appropriate precautions can<br />

<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 106<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


create significant security risks that undermine the effectiveness of the original solution. Encryption<br />

provides no benefit if an attacker can access the decryption keys.<br />

Effectively Managing the Risks of Trust<br />

Inherent trust – and its associated security risks – are inescapable. It is impossible to do business without<br />

placing trust in some systems, applications, users, etc.<br />

However, this is not to say that organizations should blindly extend this trust. The risks of inherent trust<br />

should be a core part of corporate risk management calculations and categorized, addressed, or<br />

accepted just like any other type of risk.<br />

Gaining the visibility into the corporate supply chain needed <strong>for</strong> effective management of inherent trust<br />

can be difficult. Many companies struggle to manage their third-party risks, let alone fourth-party and<br />

beyond.<br />

Acknowledging and attempting to identify inherent trust when it occurs is an important first step in the risk<br />

management process. By examining security initiatives in context – looking at both upstream and<br />

downstream effects – and attempting to limit and manage inherent trust when possible, an organization<br />

can dramatically reduce the impact that inherent trust poses to its overall level of risk.<br />

About the Author<br />

Zubaid Kazmi is the Managing Director <strong>for</strong> Identity and Access<br />

Management at MorganFranklin Consulting. Prior to joining<br />

MorganFranklin, Zubaid held managing director and director<br />

positions at large and boutique consulting firms with a specific focus<br />

on Identity & Access Management and Digital Identity governance.<br />

Combined with over 20 years in professional service, Zubaid brings<br />

his experience advising clients on how to realize their IAM<br />

trans<strong>for</strong>mation objectives while advancing their compliance, security, and business initiatives.<br />

Zubaid can be reached online on LinkedIn and at our company website<br />

https://www.morganfranklin.com/services/cybersecurity/<br />

<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 107<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


Empowering Your Employees To Prevent <strong>Cyber</strong>attacks In<br />

A Remote Work Era<br />

By Bill DeLisi, CEO of GOFBA – a leading secure search engine and communication plat<strong>for</strong>m<br />

<strong>Cyber</strong>crime’s business impacts reached $1 trillion in 2020. This staggering sum represented around one<br />

percent of global GDP. It reflected the total costs incurred with implementing security measures, lost<br />

productivity and profits, ransomware payments, and other considerations. <strong>Cyber</strong>crime is a global problem<br />

that impacts companies big and small. An August <strong>2021</strong> survey from CNBC found 56 percent of small<br />

business owners were concerned about an attack, and 59 percent of those surveyed were majorly<br />

confident they could quickly handle any attack. However, only 28 percent had a plan in place to combat<br />

cybercrime, and many of those plans would likely prove insufficient against a sophisticated hacker group.<br />

For small business owners and managers, overconfidence about preparations and capabilities, and a<br />

lack of concern are a troublesome mix. To fix this dynamic, they need to focus ef<strong>for</strong>ts on preventing cyber<br />

intrusions. The best place to start is by focusing on staff members actions, as people are often the conduit<br />

<strong>for</strong> hackers through phishing schemes, malware, and personal devices.<br />

<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 108<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


Stop Phishing in its Tracks<br />

The Delta variant COVID-19 surge prompted cybercriminals to develop fake “vaccination requirement”<br />

emails. These phishing schemes were sent to millions of workers, with official looking <strong>for</strong>ms and links<br />

asking <strong>for</strong> recipients to confirm their vaccination status while providing valuable personal in<strong>for</strong>mation. It<br />

is a common tactic <strong>for</strong> phishing schemes to prey on people’s fear and uncertainty along with a message<br />

of urgency and possible consequences.<br />

Hackers enjoy phishing schemes because they are easy to deploy and can provide fast access into<br />

networks. The recipient clicks a link or opens an email or an attachment, and that launches malware<br />

which can infect a computer and give the hacker administrative control. And, once they have control, they<br />

encrypt the data and hold it <strong>for</strong> ransom.<br />

Preventing phishing schemes requires staff training. They need to understand the risks of opening emails<br />

and downloading attachments from unrecognized senders. Be sure to conduct training sessions with<br />

images of phishing emails, pointing out common tricks like misspelled URLs, poorly constructed<br />

sentences, and other signs of non-genuine emails.<br />

Here are some other signs of phishing emails employees should be aware of:<br />

• URLs do not match the purported business. Users can hover over the URL (place your curser<br />

over the URL or email address) to see the real destination or address<br />

• Emails asking <strong>for</strong> Social Security Numbers, bank account in<strong>for</strong>mation, and other personal data<br />

are always fake<br />

• Emails that attempt to elicit panic and suggest the recipient ‘must act’ are always suspicious<br />

• Phishing schemes often change to reflect current events, such as vaccination, political decisions,<br />

COVID “cures”, and other hot topic issues<br />

For employees, deletion is always the answer. If there is any doubt about the veracity of an email, they<br />

can simply contact the organization or individual that sent the message. Institute a policy that no worker<br />

will be in trouble if they delete a genuine email if they thought it came from a shady sender.<br />

Managing Remote Workers: Flexibility vs. Safety<br />

It is obvious remote work is here to stay. For new hires it is now considered a standard condition of<br />

employment, instead of a rare sought-after benefit. With remote work comes inherent hazards <strong>for</strong><br />

businesses to manage devices and employee actions as they relate to cybercrime risks. Ideally, business<br />

owners will provide employees with dedicated laptops and phones <strong>for</strong> work. These will come preloaded<br />

with malware protection, firewalls, and strict access points <strong>for</strong> reaching company data. It is a better route<br />

than ”BYOD” as workers tend to use their own devices <strong>for</strong> riskier behaviors that can offer convenient<br />

entry points <strong>for</strong> bad actors.<br />

There is also privacy and support benefits with corporate-provided devices. IT can control company<br />

property without worrying about stumbling across an employee’s photos or their Facebook posts.<br />

<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 109<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


Corporate devices enable uni<strong>for</strong>mity in terms of software updates and patches as well as phone and<br />

computer OS versions.<br />

Remote workers should also utilize encryption software <strong>for</strong> all their data production. This protects them<br />

and the company against loss or theft, either virtual or physical. They can also leverage encrypted internet<br />

connections, with end-to-end encrypted email and file sharing that protects data in transit when it is most<br />

vulnerable.<br />

Business owners and managers offering remote work need to construct clear policies <strong>for</strong> all electronic<br />

activities. Give them examples of why policies are needed, including how hackers can use devices, Wi-<br />

Fi, and other conduits that may cause harm. The policies should include devices, VPN access<br />

procedures, and password creation and usage. Utilizing secure communication and file sharing plat<strong>for</strong>ms<br />

(such as GOFBA) within the office can help mitigate threats and other phishing schemes within the<br />

company. Consider making two-factor authentication mandatory to reduce password-related exposures<br />

and require employees to change passwords on a regular schedule. Within policy documents, you can<br />

include context <strong>for</strong> why stringent controls are needed. Detail how ignoring or “going around” these<br />

controls could mean an end to the remote work benefit and irreparable harm to the company’s future.<br />

About the Author<br />

Bill DeLisi is one of the world’s most authoritative experts on<br />

cybersecurity. He is currently the Chief Executive Officer, Chief<br />

Technology Officer and a founding member of the Board of<br />

Directors <strong>for</strong> GOFBA, Inc. DeLisi has more than 30 years of<br />

experience in the computer industry, including holding the<br />

position of Chief Technology Officer at several companies. He has<br />

worked closely with Microsoft Gold Certified Partners, helping<br />

pioneer “cloud” computing and creating security infrastructures<br />

that are still in use today. DeLisi is responsible <strong>for</strong> the<br />

development of proprietary technology that serves as the<br />

backbone of GOFBA’s plat<strong>for</strong>m and has over 30 certifications with<br />

Microsoft, Cisco, Apple, and others, which includes the coveted Systems Engineer with Advanced<br />

Security certification, as well as expert status in Cloud Design and Implementation.<br />

Bill can be reached online at www.GOFBA.com.<br />

<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 110<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


Lateral Movement – The Key Element in Advanced<br />

Attacks<br />

Understanding lateral movement techniques in advanced cyberattacks and how to fight back<br />

By Jon Murchison, founder and CEO, Blackpoint <strong>Cyber</strong><br />

Advanced Attacks on the Rise<br />

When the pandemic made its impact around the globe early last year, it simultaneously ushered in an<br />

exponential surge in cybersecurity attacks. In the scramble to mass-migrate businesses to virtual work<br />

environments, many did not have the time nor resources to implement strong cybersecurity policies and<br />

processes. This climate has allowed attacks in particular to boom in nearly all industry verticals,<br />

impacting critical infrastructure, utilities, transport, food supplies, healthcare, education, and the US<br />

economy at federal, state, and municipal levels.<br />

Advanced cyberattacks are now considered a risk to national security following the sweeping uptick in<br />

cyberattacks. Once targeting small companies or individuals, threat actors are now making headlines by<br />

growing their attack radius to include major infrastructure companies and even leading security firms.<br />

What’s more is that threat actors are quickly evolving their tactics and targets when it comes to deploying<br />

their cyber assaults.<br />

Understanding Lateral Movement in APTs<br />

Advanced persistent threats (APTs) are seeing increased success due to lateral movement techniques.<br />

When threat actors infiltrate a network, the initial, vertical entry seldom causes damage. Actors are likely<br />

to break in through low-level web servers, compromised email accounts, or a poorly protected endpoint<br />

device. The real damage begins once the actors secure their foothold and start to pivot laterally through<br />

<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 111<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


the rest of the environment to find and reach their targeted assets. Examples of lateral movement<br />

techniques include:<br />

●<br />

●<br />

●<br />

●<br />

Exploiting remote services<br />

Remote service session hijacking<br />

Pass the Hash (PtH)<br />

Pass the Ticket (PtT)<br />

By taking advantage of one vulnerability, threat actors use lateral movement techniques to access many<br />

systems within an IT environment, obtaining the privileges and access they need along the way to their<br />

target. While pivoting laterally, actors will utilize anything they come across that may help them access a<br />

targeted asset more efficiently. By leveraging built-in operating systems and other IT policies and support<br />

tools that your business already uses day-to-day, they can save their own resources and evade<br />

detection, appearing as anomalous network activity.<br />

Lateral movement is a critical element in the execution of long term, advanced attacks. Rather than just<br />

compromising a single asset or target, threat actors use these techniques to establish a persistent,<br />

malicious presence in their victim’s environment.<br />

How to Fight Back Lateral Movement<br />

Lateral movement attacks are extremely fast moving with many proving successful <strong>for</strong> the threat actor in<br />

less than one day. To fight back, live detection of privileged lateral movement is a must. In the last year<br />

alone, Blackpoint <strong>Cyber</strong> only saw next-gen anti-virus and EDR alerts in 14% of the attacks stopped –<br />

experts at defending must be able to quickly discern between normal IT operations and hijacked IT<br />

operations. Most companies are unable to detect lateral movement because it is lost among the regular<br />

traffic of daily network traffic and operations. Even plat<strong>for</strong>ms such as SIEMs (Security In<strong>for</strong>mation and<br />

Event Management), advanced analytics tools, anti-malware, and anti-virus solutions have proven<br />

inadequate at catching this phase in the attack lifecycle.<br />

However, it is during the lateral movement phase that threat actors are most vulnerable to detection.<br />

Having the right tools and cybersecurity best practices in place can minimize the chance of infiltration<br />

and, in the case of a breach, detain the actors be<strong>for</strong>e they can take root and devastate your business.<br />

Below are the three core elements needed to prevent lateral movement:<br />

Purpose-Built Managed Detection & Response (MDR) Plat<strong>for</strong>m<br />

When an attack occurs, detection and response times often determine whether the actors succeed in<br />

their ef<strong>for</strong>ts. To combat the sophisticated attacks occurring in today’s cyberthreat landscape, investing<br />

in an around-the-clock true Managed Detection and Response (MDR) service means that you can fight<br />

back within minutes and hours, not days and weeks. MDRs can help close the gap between the<br />

identification of an event and the actual response and remediation. By immediately shutting down or<br />

<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 112<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


isolating endpoints, MDR analysts can terminate malicious processes, delete bad files, and stop the<br />

threat from moving laterally into other systems.<br />

Combining both prevention and advanced tradecraft detection technologies means that you can monitor<br />

your account activity and behavior in real-time; a critical factor in staying ahead of threat actors. 24/7<br />

active threat hunting and response service provided by experienced analysts can detect reconnaissance<br />

activities at their earliest stages. With monitoring, detection, and response executed in tandem, MDR<br />

analysts have unparalleled visibility into hacker tradecraft, lateral spread, and remote privileged activity.<br />

Proactive Threat Hunting by Experienced Analysts<br />

Threat hunting is the practice of being proactive in the search <strong>for</strong> cyberthreats within an organization’s<br />

network. It is per<strong>for</strong>med deep within the network to deliberately search <strong>for</strong> hidden actors and malware<br />

that may have found a way to exist undetected otherwise. Many organizations invest in various managed<br />

services and tools in defense, but MDR threat hunting is a crucial, offensive strategy. Threat hunting has<br />

three main components:<br />

●<br />

●<br />

●<br />

Investigation through threat intelligence and hypothesis<br />

Analysis of Indicators of Compromise (IoC) / Indicators of Attack (IoA)<br />

Machine learning and advanced telemetry<br />

Threat hunters are highly-specialized and trained specifically in hacking tradecraft. They always take an<br />

‘assume breach’ stance and investigate thoroughly to find evidence of suspicious behavior or changes<br />

that may indicate the existence of threat. These threat hunters rely on security experience and human<br />

analysis of current threat tactics, techniques, and procedures (TTP) to instigate hypothesis-driven hunts.<br />

The human-powered element is a vital link that synchronizes collected threat intelligence, data logs, and<br />

advanced security technology towards safeguarding your business.<br />

Strict <strong>Cyber</strong>security Hygiene & IT Best Practices<br />

Set your business up <strong>for</strong> success by adopting tried and true cybersecurity hygiene practices. When<br />

consistently executed, they can help prevent breaches from occurring at all. This is especially true <strong>for</strong><br />

the IT world as even one breach could be detrimental to your operations. Here are some examples of<br />

cyber hygiene best practices you can implement to strengthen your in-house security and fight back<br />

against lateral movement:<br />

●<br />

●<br />

●<br />

Implement a principle of least privilege (PoLP) and zero trust model/architecture • Ensure<br />

networks are properly segmented<br />

Practice stringent password management including password complexity, rotation, and expiry •<br />

Establish app-based multi-factor authentication (MFA/2FA) <strong>for</strong> all devices and RMM tools • Keep<br />

your software up to date. Ensure that patching and upgrade activities are completed particularly<br />

<strong>for</strong> firewall and VPN appliances.<br />

Remove internet-exposed remote desktop services (RDP) services<br />

<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 113<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


●<br />

Run regular vulnerability assessments against all systems on your network<br />

About the Author<br />

Jon Murchison, founder and CEO of Blackpoint <strong>Cyber</strong>, started<br />

his career in network engineering and IT operations but quickly<br />

made the switch over to the covert world of the intelligence<br />

community. He has since spent more than 12 years planning,<br />

conducting, and executing high-priority national security<br />

missions. As a <strong>for</strong>mer NSA computer operations expert and IT<br />

professional, he brings a unique perspective to the mission of<br />

developing cyber defense software that effectively detects and<br />

detains purposeful cyber intrusions and insider threats. Jon<br />

has also helmed multiple cybersecurity assessments, including Fortune 500 enterprises and critical port<br />

infrastructures. Currently, Jon holds multiple patents in methods of network analysis, network defense,<br />

pattern analytics, and mobile plat<strong>for</strong>ms.<br />

Jon can be reached online on LinkedIn, and on our company’s website https://blackpointcyber.com/<br />

<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 114<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


When Does a Vulnerability Become a Vulnerability?<br />

If a vulnerability exists in a server <strong>for</strong>est and no one finds it, does it exist?<br />

By Jason Kent, Hacker in Residence, Cequence Security<br />

When I worked in vulnerability management, my role was to scan an organization’s environment <strong>for</strong><br />

network vulnerabilities. We would analyze the devices found and create a list of things that needed fixing.<br />

During one such engagement, I found something that made me stop and immediately report a<br />

vulnerability that needed to be fixed that day.<br />

The manager didn’t want to hear it. I tried to explain the machine was externally facing, had a flaw that<br />

was trivial to exploit, and I was cut off with, “If I know it is there, I am culpable to fix it. I’d prefer to not<br />

scan at all.”<br />

If a vulnerability exists in a server <strong>for</strong>est and no one finds it, does it exist?<br />

A vulnerability is simply an exposure to a possible attack. The network manager I spoke about was<br />

placing all of his “if” on “possible”: “If they don’t attack, we are good.” The problem with this type of “headin-the-sand”<br />

approach is it rarely works.<br />

As an example, BrewDog was recently notified that someone had figured out how to dump their entire<br />

customer database via their mobile application APIs. In addition to enabling customer account takeovers,<br />

the researcher figured out that they could generate unlimited free beer utilizing the entire customer base<br />

<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 115<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


of coupons. BrewDog didn’t believe the vulnerability existed and didn’t acknowledge the report. The<br />

in<strong>for</strong>mation was made public and BrewDog is dealing with significant fallout.<br />

This year, I did some similar research on the well-known Lithium community <strong>for</strong>um plat<strong>for</strong>m, which is now<br />

owned by Khoros. Lithium is a multi-tenant SaaS architecture used by many organizations including<br />

Roku, DropBox and FitBit to host user <strong>for</strong>ums. If you are logged in to FitBit, then you are using Lithium,<br />

configured as a public community, to share results, discuss workout regimens, and so on.<br />

While logged into the FitBit Community I noticed a weird request being made by my browser:<br />

GET<br />

/xmnuz23762/api/2.0/search?q=SELECT+id,+login,+avatar.profile,+rank,+view_href+FROM+us<br />

ers+WHERE+id+%3D+%22REDACTED%22<br />

My first thought was that it was strange to find SQL queries in the request, so I wondered if I could change<br />

them. My second thought was, “what the heck is xmnuz23762?”<br />

I first tried changing the SELECT criteria and the WHERE in<strong>for</strong>mation, yielding:<br />

GET<br />

/xmnuz23762/api/2.0/search?q=SELECT+*+FROM+users<br />

This showed me all users. I found User 1, whose profile showed that they were the Lithium Admin. Now<br />

I knew what the FitBit community plat<strong>for</strong>m was based on.<br />

Recall that a vulnerability is simply an exposure to a possible attack. So, is this an exposure to an attack?<br />

I believe so and here’s why.<br />

Exploiting the Flaw<br />

I can change the query to get intended results. This means I can dump various parts of the database at<br />

will. Khoros disagrees, stating that what I had found is their API, called LiQL (Lithium Query Language)<br />

which uses a syntax similar to SQL. Occasionally, the similarity causes confusion with security experts<br />

concerned about SQL injection vulnerabilities. Okay, so it’s not identical to a SQL injection, but I can still<br />

change it at will and get various pieces of data.<br />

Let’s turn our attention to the other oddity I saw: What is xmnuz23762? This alphanumeric sequence is<br />

available on every request so it must be related to FitBit. Since this data element was available in each<br />

request, I figured it was a domain ID. Querying the DNS entries <strong>for</strong> Lithium showed that<br />

xmnuz23762.lithium.com will redirect you to community.fitbit.com. Pulling a different ID from my DNS<br />

entries I found aempf32337.lithium.com, which redirects me to community.roku.com.<br />

<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 116<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


So, what if I change my query from:<br />

To:<br />

GET<br />

/xmnuz23762/api/2.0/search?q=SELECT+*+FROM+users<br />

GET<br />

/aempf32337/api/2.0/search?q=SELECT+*+FROM+users<br />

The answer is exactly what you think. I get the list of users from Roku. By the way, Roku requires<br />

authentication, but I didn’t create an account. I just used all the authentication from FitBit to log into Roku<br />

and see the users there. This is commonly known as an authentication bypass.<br />

I have now exploited the flaw in the request structure that allows <strong>for</strong> me to use my FitBit login credentials<br />

to bypass the Roku community authentication process. This means that I can observe the Roku <strong>for</strong>um<br />

without logging in, without accepting terms and conditions and I can read any public <strong>for</strong>um I wish by<br />

sending random requests and getting valid responses.<br />

So What?<br />

The question is, is this a vulnerability that enables me to execute an attack? The majority of the<br />

organizations that use this plat<strong>for</strong>m have requirements <strong>for</strong> use. FitBit requires you to register, establish a<br />

strong password and be over the age of 13. If I do not have to be logged in, then this requirement cannot<br />

be en<strong>for</strong>ced. In this single use case alone, I am able to exploit this flaw to bypass terms and conditions.<br />

Is bypassing the terms and conditions an “attack”? Maybe or maybe not.<br />

In a public community there is an assumption you are going to share in<strong>for</strong>mation, but you are also<br />

af<strong>for</strong>ded some level of privacy as most <strong>for</strong>ums allow you to configure sharing permissions, yet my<br />

research showed that several scenarios were possible:<br />

● A malicious actor could scrape the data off of all of Khoros’ public tenants<br />

● A competitor could easily uncover Khoros’ customer names and contacts.<br />

● A disgruntled user could use in<strong>for</strong>mation from posts about product issues to execute a<br />

disparaging social media campaign.<br />

● Given the lack of authentication and the ability to view data in the tables, we believe the plat<strong>for</strong>m<br />

may be susceptible to SQL injection attacks, despite their statements to the contrary.<br />

If you are using a multi-tenant SaaS plat<strong>for</strong>m and assuming that plat<strong>for</strong>m is secure, but not testing the<br />

security of the plat<strong>for</strong>m, you might be surprised. Though we played it very safe here to ensure we didn’t<br />

break anything, I am certain that bypassing authentication isn’t the intended use of authentication on the<br />

plat<strong>for</strong>m.<br />

<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 117<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


Now, most security teams would say, “Yes, this is a vulnerability that Khoros should address.” They have<br />

insisted it works as designed. The reader can decide <strong>for</strong> themselves.<br />

About the Author<br />

Jason Kent is Hacker in Residence at Cequence Security. For over the<br />

last 20 years, Jason has been ethically peering into Client Behavior,<br />

Wireless Networks, Web Applications, APIs and Cloud Systems,<br />

helping organizations secure their assets and intellectual property from<br />

unauthorized access. As a consultant he's taken hundreds of<br />

organizations through difficult compliance mine fields, ensuring their<br />

safety. As a researcher he has found flaws in consumer IOT systems<br />

and assisted in hardening them against external attacks. At Cequence<br />

Security Jason does research, community outreach and supports ef<strong>for</strong>ts in identifying Automated Attacks<br />

against Web, Mobile, and API-based Applications to keep Cequence's customers safe. Jason can be<br />

reached online at jason.kent@cequence.ai and at our company website https://www.cequence.ai/.<br />

<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 118<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


How To Bring Your Own Key to Hybrid Cloud Without<br />

Losing Control Of Your Data<br />

By Marcella P. Arthur, VP Global Marketing, Unbound Security<br />

Amid the post-Covid increase in cloud spending, hybrid infrastructure remains the preferred option <strong>for</strong><br />

many organizations. Cost-efficiency, scalability, agility and security are why many companies opt <strong>for</strong> this<br />

model, believing they can obtain the advantages of the cloud while protecting their most sensitive data<br />

and applications on-premise.<br />

Research firm MarketsandMarkets predicts demand <strong>for</strong> hybrid cloud will increase at a compound annual<br />

growth rate of 17% into 2023. Meanwhile, analysts at IDC estimate more than 90% of enterprises<br />

worldwide will be relying on a mix of on-premise/dedicated private clouds, multiple public clouds, and<br />

legacy plat<strong>for</strong>ms to meet their infrastructure needs by next year (2022). The Flexera <strong>2021</strong> State of the<br />

Cloud Report also found that 82% of the 750 IT professionals surveyed now have a hybrid cloud strategy<br />

in place and that on average, respondents use 2.6 public and 2.7 private clouds.<br />

<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 119<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


But as companies distribute their data across these increasingly complex hybrid cloud infrastructures,<br />

they need to cast a wider security net as the volume of in<strong>for</strong>mation exchanged continues to increase<br />

exponentially. The hybrid cloud model has significant security challenges in relation to the cryptographic<br />

keys that govern access and use of data and applications across and between existing infrastructure and<br />

perhaps multiple cloud environments. Keys are similar to the combination of a physical safe and the lock<br />

that secures it, and their poor management can easily compromise strong encryption algorithms.<br />

Since keys offer access to plaintext data, the encrypted data in an organization is only as secure as the<br />

security of its key. Every enterprise should have the strongest encryption key security possible and a key<br />

management policy (KMP) that describes the goals, responsibilities, and overall requirements <strong>for</strong><br />

managing cryptographic keying material. The policy should guide every employee accessing the keys,<br />

and include protection objectives, and what users can and cannot do with the keys. Responsibilities <strong>for</strong><br />

the management of cryptographic keying material should be clear along with constraints that apply to the<br />

entire key lifecycle.<br />

This sounds straight<strong>for</strong>ward enough, but key management can be a complex task in any environment,<br />

because of the number of keys and processes involved and the sensitivity of the data they protect. In<br />

hybrid cloud this is especially problematic where each environment has its own requirements and<br />

effective oversight is difficult.<br />

Two questions about hybrid cloud key security that must be answered<br />

Cloud service providers (CSPs) provide a key management service (KMS) that generates encryption<br />

keys <strong>for</strong> customers and manages them throughout their lifecycle, from generation to storage, distribution,<br />

use and destruction.<br />

This seems attractive <strong>for</strong> any enterprise, but two critical questions immediately arise in relation to key<br />

security, which organizations with hybrid infrastructure should address if they are to avoid exposing<br />

vulnerabilities or tying themselves up in complicated and time-consuming key management problems.<br />

The first is: “Who is responsible <strong>for</strong> encryption security – the CSP or the organization?” The second is:<br />

“Is the key management strategy compliant with government and industry-led regulations?”<br />

<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 120<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


Absence of sole control – is BYOK the solution?<br />

The problem with this <strong>for</strong>m of key management is that organizations lack sole control and ownership of<br />

the keys, resulting in confidentiality risks and failure to meet compliance or internal security requirements.<br />

Having the keys held by the same entity that holds the data is far from best practice. Whenever encrypted<br />

data is stolen it is because hackers have stolen the keys first.<br />

This is where Bring Your Own Key (BYOK) in theory provides the solution. It is an encryption key<br />

management system that should allow organizations to generate their own encryption keys and retain<br />

control and management. It appears to be ideal <strong>for</strong> hybrid cloud infrastructure, but un<strong>for</strong>tunately, it still<br />

has significant drawbacks that enterprises should be aware of. Depending on the technology’s<br />

deployment, businesses can still lose control of their cryptographic keys to the CSP.<br />

How BYOK Works<br />

BYOK typically allows cloud users to import their own key material. Users can generate keys using an<br />

on-premise physical or virtual hardware security module (HSM) then upload them to the CSP’s KMS. The<br />

upload is usually protected using a public key provided by the CSP.<br />

This customer-generated key is then used to encrypt data encryption keys (DEKs) – not the actual data<br />

– generated by the cloud KMS. From there, enterprise applications can use the key by connecting to the<br />

CSP’s KMS.<br />

Since this key is uploaded to the cloud, however, it gives the CSP full access and control and by<br />

extension, access to data. All other key management lifecycle processes are taken back to the CSP,<br />

meaning that the BYOK deployment has not brought control and management back to the enterprise<br />

despite the added complexity.<br />

One of the potentially very adverse consequences is that the CSP’s employees can compromise the data<br />

either through malice or incompetence. Even worse, the government can subpoena the cloud service <strong>for</strong><br />

the encrypted data and the decryption key and prevent them from notifying the customer about it.<br />

<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 121<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


How enterprises can regain control<br />

Enterprises considering using BYOK technology should determine the amount of control the deployment<br />

is going to bring. If an organization is subject to stringent data access requirements or needs to comply<br />

with complex regulation, that necessitates having the keys under its supervision throughout their lifecycle.<br />

If an enterprise uses an external, third-party key controller, however, it will have greater control and is<br />

more likely to know whenever its data needs to be accessed. It can implement identity and access<br />

management (IAM) policies to control access to the key store, revoking CSP access to keys (<strong>for</strong><br />

encryption and decryption) at any time.<br />

And while BYOK ensures enterprises can migrate their encrypted data and its keys to the cloud, they<br />

should avoid refactoring applications to fit a specific CSP. Refactoring is highly time-consuming and very<br />

costly, requiring significant levels of skill. It hinders time-to-market, and if a cloud provider alters the way<br />

it runs its systems, an application must be refactored again.<br />

Instead, enterprises should opt <strong>for</strong> an intermediary that can communicate with the CSP using a standard<br />

library or an easy-to-use RESTful API. The intermediary will handle all backend intricacies and ensure<br />

an enterprise can run its service or application on any cloud that makes the best business case <strong>for</strong> doing<br />

so. This also means avoiding cloud the HSMs provided by CSPs such as AWS, since organizations<br />

cannot migrate encryption keys that are managed there.<br />

BYOK with cloud KMS versus external key management<br />

Using BYOK in conjunction with a cloud KMS seems advantageous. Yet while it allows organizations to<br />

bring their own ‘master’ keys to the cloud, their data is still encrypted using the CSP’s keys. This key<br />

management model does not require any specialized skilled resources and provides native integration<br />

with other services provided by the CSP. But the CSP remains in control of the encryption keys’ lifecycle<br />

management.<br />

External key management on the other hand, eliminates CSP control, and is implemented by using a<br />

supported external key management partner through services such as Google Cloud External Key<br />

Manager (Cloud EKM). This key management model allows organizations to store and manage keys<br />

outside the CSP’s KMS, gaining total control over the location and distribution of the keys. Organizations<br />

can then regulate access to the keys and manage them from a centralized plat<strong>for</strong>m.<br />

<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 122<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


On-premise versus virtual HSMs<br />

To bring keys under total control, an enterprise needs to store them in its own HSM, whether on-premise<br />

or virtual. An on-premise HSM provides complete control over keys and policies as there is no<br />

dependency on a vendor. However, it requires a substantial upfront investment in terms of hardware,<br />

skilled personnel, and management software. More fundamentally, it will not support the requirements of<br />

modern applications that drive digital services.<br />

A virtual HSM, on the other hand, will offer flexible services while providing scalability and on-demand<br />

cryptographic services. Third-party virtual HSMs will also facilitate a multi-cloud infrastructure and are<br />

provide the flexibility needed <strong>for</strong> enterprises to meet modern business needs.<br />

Enhancing BYOK security and control in the cloud<br />

BYOK certainly brings benefits in terms of confidentiality, control, and compliance. However,<br />

organizations need to plan carefully to ensure that their BYOK deployment does not hand over<br />

management to their CSP. The point is that an external FIPS 140-2 Level 2 (and higher) certified key<br />

management service will store cryptographic keys outside the CSP KSM with a high degree of safety and<br />

ease-of-use.<br />

Yet to maximize security and prevent a single point of failure, enterprises should use an external key<br />

management service that takes advantage of multiparty computation (MPC). This is a plat<strong>for</strong>m that<br />

application developers can write to, offering them flexibility and crypto agility. It will allow enterprises to<br />

override the need to refactor numerous applications to ensure their compatibility across each cloud<br />

environment.<br />

Such a service will split keys into multiple random shares, enabling the enterprise to retain control as it<br />

chooses where the key shares are located. Since the CSP does not have the keys and no unauthorized<br />

party can access the full key, the enterprise can keep any data in the cloud no matter how sensitive it is<br />

while meeting compliance and governance guidelines. This allows enterprises to synchronize key<br />

management across many data environments and applications, eradicating the single point of failure. It<br />

creates a virtual mesh of key management and protection devices, wherever they are – in any datacenter<br />

and any cloud, both <strong>for</strong> management and consumption of cryptographic services.<br />

If enterprises are to streamline their management and increase the security of the increasingly vast<br />

amounts of data held and used in the cloud, they must think much harder about how they use encryption<br />

<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 123<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


keys. Cloud vendors’ BYOK key management systems have much to recommend them in terms of utility<br />

but are not a route to either maximum security or a cost-effective use of resources. For that external,<br />

innovative new approaches, like MPC should be a consideration.<br />

About the Author<br />

Marcella Arthur, Vice President, Global Marketing of Unbound<br />

Security. During her career, Marcella spearheaded two successful<br />

IPOs and led the global marketing and channel strategy of several<br />

of the world’s technology innovators and IT security vendors,<br />

including Sybari, Mimecast, and Microsoft.<br />

Marcella can be reached online at<br />

https://www.linkedin.com/in/marcellaarthur , @sheknowsmktg and<br />

at our company website https://www.unboundsecurity.com/<br />

<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 124<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


Protect Data with Deep Packet Inspection or Be Breached<br />

By Randy Reiter CEO of Don’t Be Breached<br />

Recent <strong>Cyber</strong>attacks Have Been Brutal<br />

A global surge in cyberattacks has resulted in organizations being hit with 490+ cyberattacks per week.<br />

This is 40% higher than pre March 2020. Government, military and healthcare followed by education and<br />

research organizations are targeted most often.<br />

Recent High Profile <strong>Cyber</strong>attacks:<br />

• Amazon Twitch 126 GB Data Breach. Hackers claim they stole 126 GB of data that included<br />

customer payment details in October, <strong>2021</strong>. Twitch live streams video games and videos. The<br />

streaming service was acquired by Amazon in 2014 <strong>for</strong> nearly $1 billion.<br />

• 70 GB of Data Stolen from Acer. Acer the Taiwanese tech giant was breached the 2 nd time this<br />

year in October, <strong>2021</strong>. The Hackers posted a link to the stolen data that included data from<br />

millions of customers. The stolen data included login credentials and financial documents.<br />

• Hacker Group that Breaches Networks in 30 Minutes. The Hacking group SnapMC has been<br />

successful in exploiting vulnerabilities in webserver and VPN applications (October, <strong>2021</strong>) to gain<br />

<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 125<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


access to confidential data within 30 minutes of the start of a cyberattack. SnapMC has been<br />

observed exploiting remote execution flaws in .NET as well as SQL injection attacks.<br />

Conventional approaches to cyber security are not preventing data breaches. In 2020 the DHS,<br />

Department of State, U.S. Marine Corps and the Missile <strong>Defense</strong> Agency recognized this and all issued<br />

requests <strong>for</strong> proposals (RFP) <strong>for</strong> network full packet data capture <strong>for</strong> deep packet analysis or Deep Packet<br />

Inspection analysis (DPI) of network traffic. This is an important step <strong>for</strong>ward protecting confidential<br />

database data and organization in<strong>for</strong>mation.<br />

Zero-day vulnerabilities that allow Hackers to gain SYSTEM PRIVILEGES are a major threat to all<br />

organizations encrypted and unencrypted confidential data. Confidential data includes: credit card, tax<br />

ID, medical, social media, corporate, manufacturing, trade secrets, law en<strong>for</strong>cement, defense, homeland<br />

security, power grid and public utility data. This confidential data is almost always stored in DB2, In<strong>for</strong>mix,<br />

MariaDB, Microsoft SQL Server, MySQL, Oracle, PostgreSQL and SAP Sybase databases.<br />

How to Stop the Theft of Data with Deep Packet Inspection<br />

Protecting encrypted and unencrypted confidential database data is much more than securing databases,<br />

operating systems, applications and the network perimeter against Hackers, Rogue Insiders and Supply<br />

Chain Attacks.<br />

Non-intrusive network sniffing technology can per<strong>for</strong>m a real-time full packet capture and Deep Packet<br />

Onspection (DPI) of 100% the database query and SQL activity in real-time from a network tap or proxy<br />

server with no impact on the database server. This SQL activity is very predictable. Database servers<br />

servicing 1,000 to 10,000 end-users typically process daily 2,000 to 10,000 unique query or SQL<br />

commands that run millions of times a day. Deep Packet Analysis does not require logging into the<br />

monitored networks, servers or databases. This approach can provide CISOs with what they can rarely<br />

achieve. Total visibility into the database activity 24x7 and 100% protection of confidential database data.<br />

Advanced Behavioral Analysis from Deep Packet Inspection Prevents Data Breaches<br />

Advanced SQL Behavioral Analysis of 100% of the real-time database SQL packets can learn what the<br />

normal database activity is. Now the database query and SQL activity can be non-intrusively monitored<br />

in real-time with DPI and non-normal SQL activity immediately pinpointed. This approach is inexpensive<br />

to setup, has a low cost of operation and disk space usage. Now non-normal database activity from<br />

Hackers, Rogue Insiders or and Supply Chain Attacks can be detected in a few milli seconds. The<br />

Security Team can be immediately notified and the Hacker session terminated so that confidential<br />

database data is NOT stolen, ransomed or sold on the Dark Web.<br />

Advanced SQL Behavioral Analysis of the query activity can go even further and learn the maximum<br />

amount of data queried plus the IP addresses all queries were submitted from <strong>for</strong> each of the 2,000 to<br />

10,000 unique SQL queries that run on a database server.<br />

<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 126<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


This type of Data Breach Prevention can detect never be<strong>for</strong>e observed Hacker database query activity,<br />

queries sent from a never observed IP address and queries sending more data to an IP address than the<br />

respective query has ever sent be<strong>for</strong>e. This allows real-time detection of Hackers, Rogue Insiders and<br />

Supply Chain Attacks attempting to steal confidential database data. Now an embarrassing and costly<br />

Data Breach can be prevented.<br />

About the Author<br />

Randy Reiter is the CEO of Don’t Be Breached a Sql Power Tools<br />

company. He is the architect of the Database <strong>Cyber</strong> Security<br />

Guard product, a database Data Breach prevention product <strong>for</strong><br />

In<strong>for</strong>mix, MariaDB, Microsoft SQL Server, MySQL, Oracle,<br />

PostgreSQL, and SAP Sybase databases. He has a Master’s<br />

Degree in Computer Science and has worked extensively over the<br />

past 25 years with real-time network sniffing and database<br />

security. Randy can be reached online at<br />

rreiter@DontBeBreached.com, www.DontBeBreached.com and<br />

www.SqlPower.com/<strong>Cyber</strong>-Attacks.<br />

<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 127<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


Can Netflix Save <strong>Cyber</strong>security?<br />

The CSaaS membership model offers a new paradigm <strong>for</strong> successful protection from today’s advanced<br />

cyber attacks by pairing skilled security practitioners with proven processes and best-of-breed<br />

technologies<br />

By Corey White, co-founder, and CEO of Cyvatar<br />

Hacked. Breached. Compromised. Attacked.<br />

Call it by any name you like, but there’s no denying that cyber threats, incidents, and events continue to<br />

outpace our ability to protect against them.<br />

Increasingly sophisticated relentless attacks and high-profile breaches spur the purchase of more and<br />

more security tools, but companies rarely (if ever) have the right people and processes in place to ensure<br />

the solutions they buy are installed correctly, not to mention the ongoing assessments, remediation, and<br />

maintenance needed to achieve cyber resilience.<br />

<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 128<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


We buy more products...and we’re hacked. We adhere to compliance standards...but we get breached.<br />

We hire managed services providers...our data is compromised anyway. The industry’s response has<br />

long been to build new products, knowing that buyers will come; when the technology fails to defend<br />

against a breach, managed services providers step in to remediate after the fact and “manage” the<br />

customer’s environment against future incursions.<br />

Then a Colonial Pipeline happens, and we buy more stuff.<br />

It’s a vicious cycle, but <strong>for</strong>tunately it’s a cycle organizations can finally break. By stepping away from<br />

traditional notions of ownership (like buying a security solution) and embracing Membership Economy<br />

principles, organizations can improve cyber resilience while decreasing the complexity of their technology<br />

stacks and reducing their overall cyber spend.<br />

What’s the Membership Economy, Anyway?<br />

The Membership Economy includes any organization whose members (customers) have an “ongoing<br />

and <strong>for</strong>mal stake” in that organization. 1 The human desire to belong, to be part of a community or affiliated<br />

with an exclusive organization, is fulfilled in the Membership Economy, and Netflix is one of its bestknown<br />

acolytes.<br />

Importantly, the Membership Economy moves organizations away from transactional sales that are costbased<br />

and require conversions, cross-sells, and other additional transactions toward what Baxter calls<br />

the <strong>for</strong>ever sale -- a lifetime of customer value where retention and delight are the outcomes. The<br />

relationship ends only when the member cancels subscription; otherwise, that first transaction lasts<br />

<strong>for</strong>ever.<br />

Key components of the Membership Economy include:<br />

●<br />

●<br />

●<br />

●<br />

●<br />

Continually focusing on the needs of members<br />

Understanding member frustration and satisfaction<br />

Embracing a willingness to f meet member needs and wants through flexibility, innovation, and<br />

evolution<br />

Communicating a strong, clear value proposition<br />

Investing in the membership experience<br />

Ownership as Liability<br />

<strong>Cyber</strong>security companies, like many technology organizations, focus on transactional sales. Customers<br />

buy a solution <strong>for</strong> a period of time--typically two to three years--and are largely left to fend <strong>for</strong> themselves<br />

until their contract comes up <strong>for</strong> renewal. Also like other technology deployments, security installations<br />

1<br />

Baxter, Robbie Kellman.”The Membership Economy: Find Your Superusers, Master the Forever Transaction, and Build<br />

Recurring Revenue”. McGraw-Hill Education. 2015, p. 26.<br />

<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 129<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


can be complex, costly, and time consuming, often making it difficult <strong>for</strong> customers to change or add<br />

products in their production environments. Even when a customer is unhappy with a product, swapping<br />

it out <strong>for</strong> something new may be more trouble than the customer thinks it’s worth, which leaves little<br />

incentive <strong>for</strong> transaction-driven companies to build meaningful innovation into their offerings.<br />

Ownership then becomes a liability. The thousands--even millions--of dollars organizations spend on<br />

multiyear licensing agreements effectively hold them hostage regardless of product efficacy. In the event<br />

of a breach, they're still stuck in their contract and may even feel the need to buy more tools to bolster<br />

their security posture.<br />

The product companies don’t fare much better: Once they create a new offering, they become limited by<br />

the scope of their own design, <strong>for</strong> good or ill, and innovation remains stalled.<br />

Groundbreaking innovation has toppled entire organizations that were displaced by the rapid<br />

advancement of others, as Blockbuster was by Netflix. Transactional organizations cannot hope to keep<br />

pace with the growing costs of breaches and the ease with which they can be executed without<br />

foundationally changing the way new defenses are designed, built, and adopted.<br />

Membership--the Netflix model--is just such a foundational change. It can be every bit as disruptive and<br />

trans<strong>for</strong>mational to the cybersecurity industry as Netflix itself was to the movie rental and streaming<br />

industries. Here’s how.<br />

1) Subscriptions. Subscriptions make it easy <strong>for</strong> members to select the pricing and options that are<br />

best <strong>for</strong> them, and consistent and predictable revenue streams benefit shareholders and users<br />

alike. But subscriptions alone do not make a Membership Economy. Organizations must grow<br />

members into new offerings and ensure value is continuously delivered.<br />

2) Loyalty programs. As American Express famously said, membership has its privileges. In<br />

cybersecurity, privileges can include freemium pricing models, discounted upgrades, free<br />

services engagements, and more.<br />

3) Engagement. The Membership Economy can’t work without high levels of member engagement,<br />

which is why Baxter recommends the program be beneficial <strong>for</strong> members as well as the company<br />

that serves them. Benefits stemming from loyalty create bonds, even emotional connections,<br />

between members and the companies they associate with, which in turn create vibrant<br />

communities of influencers and evangelists that become a continual source of innovation <strong>for</strong><br />

Membership Economy organizations.<br />

By staying close to your members and active in the communities you share with them, you’re always a<br />

part of the feedback loop, enabling you to continue to evolve your offerings to meet member needs.<br />

Ongoing feedback ultimately becomes a source of competitive differentiation too, because traditional<br />

security organizations selling through transactions are less able to tap into widespread customer<br />

sentiment (positive or negative) and there<strong>for</strong>e less likely to be able to turn the in<strong>for</strong>mation they do get into<br />

meaningful innovation.<br />

<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 130<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


Access over Ownership<br />

<strong>Cyber</strong>security-as-a-service, or CSaaS, brings all of these concepts to life. CSaaS is inherently a memberdriven<br />

model, allowing providers to focus on access rather than ownership. Instead of selling<br />

transactional point solutions or fee-<strong>for</strong>-services to create what we used to call customer “stickiness,”<br />

security companies can use the membership model to level the playing field and democratize<br />

cybersecurity, making the best protection accessible and af<strong>for</strong>dable <strong>for</strong> every size organization, even<br />

those with no cybersecurity expertise in house.<br />

The CSaaS membership model offers a new paradigm <strong>for</strong> successful protection from today’s advanced<br />

cyber attacks by pairing skilled security practitioners with proven processes and best-of-breed<br />

technologies. Importantly, CSaaS handles the heavy lifting associated with evaluating and<br />

recommending solutions from more than 4500 security vendors so that members can focus on scaling<br />

their businesses without worrying about securing the sensitive data and in<strong>for</strong>mation they need to<br />

succeed.<br />

CSaaS also ensures that recommended solutions are installed and configured completely (and correctly)<br />

in addition to providing ongoing remediation of vulnerabilities and regular maintenance of security tools,<br />

thus walling off the majority of entry points <strong>for</strong> cyber criminals and ensuring members get value from all<br />

of their security investments, from conception and strategy to implementation and maintenance.<br />

By selling membership rather than ownership in the CSaaS model, members can achieve faster<br />

compliance to standards like NIST CSF, SOC 2, PCI, and HIPAA; they can also receive better cyberattack<br />

protection from threats like the OWASP Top 10 and the CWE Top 25, giving them true resilience,<br />

lower costs, less stress, and the ability to implement the very best technologies available at any time, all<br />

the time.<br />

The CSaaS membership model is Netflix <strong>for</strong> cybersecurity: inherent innovation and bespoke solutions at<br />

scale.<br />

<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 131<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


About the Author<br />

Corey White is the co-founder and CEO of Cyvatar, an<br />

all-inclusive cybersecurity-as-a-service (CSaaS)<br />

company committed to helping businesses – of all sizes<br />

– learn how they can prevent cybercrime and<br />

ransomware attacks. White is a proven security industry<br />

veteran backed by more than 25 years of success<br />

managing security practices and consulting teams and<br />

delivering on strategic projects as well as tactical<br />

assessments, penetration tests, and incident response<br />

engagements. His work encompasses virtually every<br />

industry sector, including defense, technology,<br />

government, critical infrastructure, automotive, finance,<br />

healthcare, and manufacturing. Corey has a deep<br />

technical background, which has allowed him to deliver and oversee technical assessments, incident<br />

response engagements, strategic planning, and risk assessments. Corey served as the senior vice<br />

president of worldwide consulting and chief experience officer at Cylance managing a team of 150+<br />

globally, culminating in the acquisition of Cylance by Blackberry <strong>for</strong> $1.5 billion. Also at Cylance, Corey<br />

created the first outcomes-based service, evolving traditional implementations to continue engagements<br />

with prevention experts until every client reached its goal, giving customers measurable, sustainable<br />

prevention. He managed seven practice areas led by distinguished experts in industrial control systems,<br />

red team services, incident containment and <strong>for</strong>ensics, IoT and embedded systems security,<br />

ThreatZERO, strategic services, and education. Prior to joining Cylance in 2012, Corey was the director<br />

of consulting <strong>for</strong> Foundstone & McAfee/Intel professional services with responsibilities <strong>for</strong> all aspects of<br />

the business <strong>for</strong> the Southwest region.<br />

Follow Cyvatar on LinkedIn and Twitter or connect with us through our company website<br />

https://cyvatar.ai/.<br />

<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 132<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


How To Do Disruptive Innovation Right<br />

By Karla Jo Helms, FOUNDER & CEO, JOTO PR Disruptors<br />

Industry disruptors are the driving <strong>for</strong>ce behind every industry innovation, advancement, and<br />

improvement <strong>for</strong> the end-users. These are the pioneers that defy their industries' status quo, putting <strong>for</strong>th<br />

not seeing how to create a better solution but also having the vision to see how that solution succeeds.<br />

For innovators, solving issues that plague themselves and their industries are more important than<br />

maintaining a com<strong>for</strong>table status quo. They are unafraid of provoking their competitors or upsetting their<br />

possible allies. But when innovators upset the balance, they will meet with real resistance from their<br />

foes—those who don’t want them to succeed. Innovators upset the balance. They threaten their position<br />

in the industry. There<strong>for</strong>e, innovators are seen as dangerous, and these foes will work to take them down.<br />

Lack of preparation has caused the downfall of innumerable innovators. Because they are so focused on<br />

their solution, they are inadvertently putting on blinders and never see the attack coming, leaving them<br />

<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 133<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


lindsided and wholly unprepared <strong>for</strong> the lawsuits, libel, slander, and other techniques, ethical or<br />

otherwise, their foes will use against them.<br />

Fortunately, new innovators can take steps to mitigate the inevitable attacks they will face. The first step<br />

in arming themselves against active resistance is doing thorough research on not just these foes, but on<br />

their "comrades in arms" as well.<br />

Innovators must ask themselves:<br />

• What are the possible obstacles to market adoption?<br />

• Who are the INFLUENCERS that will inspire the early adopters?<br />

• What is the probable level of resistance and realistic adoption rate?<br />

• When, NOT IF, there will be a need <strong>for</strong> legal counsel? (hint: hire them upfront)<br />

And perhaps most critical, Innovators MUST UNDERSTAND:<br />

• That PR and Publicity must be at work WELL BEFORE achieving business goals<br />

Disruptors who fail to heed any one of these concepts put not only their solution’s success at great risk<br />

but their very business as well. Fortunately, any damage can be avoided by first taking these steps:<br />

• Conducting market research on the key target audiences (including foes) to uncover the reasons<br />

behind acceptance or resistance to adoption. Understanding their perceptions be<strong>for</strong>ehand can<br />

provide a significant benefit—prediction.<br />

• Executing Key Opinion Leader market research that discovers the key target audiences’<br />

INFLUENCERS. Implementing the new media methodology today—communicating through<br />

influencers and key opinion leaders—makes adoption happen ten times faster.<br />

• Utilizing the two preceding tools and their data to mathematically determine the size and potential<br />

impediments to adoption. For target audiences, this means estimating the level of ef<strong>for</strong>t (i.e., time,<br />

money, marketing) necessary to persuade a segment of the population to change their attitude or<br />

to think in a particular way.<br />

Innovators should take special note: there is competition out there with the business model of using<br />

Patent Assertion Entities (PAEs), frivolous lawsuits specifically designed to drive out smaller businesses<br />

and then purchase their assets <strong>for</strong> pennies on the dollar. As mentioned earlier, disruptors must have their<br />

legal teams hired as soon as possible.<br />

Once the legal council is established, innovators need to take further steps to prepare <strong>for</strong> the impending<br />

attacks:<br />

1. Discover the competitions’ SOP <strong>for</strong> identifying and stamping out the early competition. Have<br />

the legal firm do research of public records, lawsuits, etc.; they are very telling.<br />

2. Recognize all stakeholders, their plausible or actual resistance or explicit resentment to<br />

change, and who among them could be litigious?<br />

<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 134<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


3. Verify all patents, trademarks, service marks, copywrites are filed or up to date.<br />

4. Ideally, as soon as one year be<strong>for</strong>e initiating aggressive marketing, set out on a public opinion<br />

publicity campaign to get markets familiarized with the coming change. Publish stories of<br />

goodwill, thought leadership articles, etc. discussing it and popularizing the <strong>for</strong>thcoming<br />

solution.<br />

5. Seek out any weaknesses to attacks and decide what should be done using PR and legal<br />

procedures.<br />

6. Create a crisis communications plan that can be immediately implemented in the likely event<br />

of lawsuits or slander/libel incidents.<br />

Disruptive innovators that took these steps have seen the benefits— established reputations <strong>for</strong> being<br />

thought leaders, gained the public’s confidence, and had well-deserved ROI. To illustrate, the belief that<br />

decentralized work<strong>for</strong>ces couldn't have the same level of secure and reliable data services outside of the<br />

office had been the long-established status quo, even be<strong>for</strong>e the advent of the global pandemic. When<br />

COVID-19 <strong>for</strong>ced employees to work from home en masse, Technologent, a provider of in<strong>for</strong>mation<br />

technology solutions and services, overturned that perceived necessary evil. They provided a solution<br />

<strong>for</strong> business data security and management woes—a single-source, cost-effective means to remove data<br />

silos, guard against breaches, provide client management, and more. They could provide all needs—<br />

security, software, infrastructure service, back-up, automation— through their “as a service” plat<strong>for</strong>m.<br />

However, be<strong>for</strong>e all else, they took the offensive, and the offenders to task, via messaging that<br />

expounded on their expertise on cybersecurity matters across the relevant business and technology trade<br />

publications, industry podcasts, and mainstream media sources. Their constant message in essence?<br />

Businesses could overcome perceived cost-prohibitive and technically unworkable data silo and security<br />

issues with their centralized service model.<br />

Technogent utilized a publicity campaign of goodwill that told the story of how they were solving<br />

businesses' data management and security issues. Not only were they communicating an effective<br />

message, but they were also doing so via the appropriate channels. (Because they knew their key target<br />

audiences) Technologent introduced and nurtured the idea that businesses didn’t have to accept their<br />

increased susceptibility to attack, loss, or lost revenue opportunities. For their ef<strong>for</strong>ts, Technologent drew<br />

not only massive attention, but it came from from the right audiences, with a disruption that reached<br />

across multiple industries that were experiencing unfeasible data management issues.<br />

New disruptors should see their innovation as part of a larger process of solving their audiences’<br />

problems. If anything, they must never be lulled into a sense of complacency, naïvely believing their<br />

solution on its own is all but doomed from the start. Winning over hearts and minds and fighting off the<br />

foes will take a lot of preparation and due diligence. Yes, being an innovative disruptor isn’t solely about<br />

that great solution – it’s also about how to maintain it time and time again. Because true innovators never<br />

stand still, do they?<br />

<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 135<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


About the Author<br />

Karla Jo Helms is the Chief Evangelist and Anti-PR (TM) Strategist <strong>for</strong> JOTO<br />

PR Disruptors (TM) .<br />

Karla Jo learned firsthand how un<strong>for</strong>giving business can be when millions<br />

of dollars are on the line—and how the control of public opinion often<br />

determines whether one company is happily chosen, or another is brutally<br />

rejected. Being an alumni of crisis management, Karla Jo has worked with litigation attorneys, private<br />

investigators, and the media to help restore companies of goodwill back into the good graces of public<br />

opinion—Karla Jo operates on the ethic of getting it right the first time, not relying on second chances<br />

and doing what it takes to excel. Helms speaks globally on public relations, how the PR industry itself<br />

has lost its way and how, in the right hands, corporations can harness the power of Anti-PR to drive<br />

markets and impact market perception.<br />

Karla can be reached online at https://jotopr.com/<br />

<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 136<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 137<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 138<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 139<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 140<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 141<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 142<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 143<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 144<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 145<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 146<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 147<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 148<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


<strong>Cyber</strong><strong>Defense</strong>.TV now has 200 hotseat interviews and growing…<br />

Market leaders, innovators, CEO hot seat interviews and much more.<br />

A division of <strong>Cyber</strong> <strong>Defense</strong> Media Group and sister to <strong>Cyber</strong> <strong>Defense</strong> Magazine.<br />

<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 149<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


Free Monthly <strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> Via Email<br />

Enjoy our monthly electronic editions of our Magazines <strong>for</strong> FREE.<br />

This magazine is by and <strong>for</strong> ethical in<strong>for</strong>mation security professionals with a twist on innovative consumer<br />

products and privacy issues on top of best practices <strong>for</strong> IT security and Regulatory Compliance. Our<br />

mission is to share cutting edge knowledge, real world stories and independent lab reviews on the best<br />

ideas, products and services in the in<strong>for</strong>mation technology industry. Our monthly <strong>Cyber</strong> <strong>Defense</strong> e-<br />

Magazines will also keep you up to speed on what’s happening in the cyber-crime and cyber warfare<br />

arena plus we’ll in<strong>for</strong>m you as next generation and innovative technology vendors have news worthy of<br />

sharing with you – so enjoy. You get all of this <strong>for</strong> FREE, always, <strong>for</strong> our electronic editions. Click here<br />

to sign up today and within moments, you’ll receive your first email from us with an archive of our<br />

newsletters along with this month’s newsletter.<br />

By signing up, you’ll always be in the loop with CDM.<br />

Copyright (C) <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine, a division of CYBER DEFENSE MEDIA GROUP (STEVEN G. SAMUELS LLC. d/b/a)<br />

276 Fifth Avenue, Suite 704, New York, NY 10001, Toll Free (USA): 1-833-844-9468 d/b/a <strong>Cyber</strong><strong>Defense</strong>Awards.com,<br />

<strong>Cyber</strong><strong>Defense</strong>Magazine.com, <strong>Cyber</strong><strong>Defense</strong>Newswire.com, <strong>Cyber</strong><strong>Defense</strong>Professionals.com, <strong>Cyber</strong><strong>Defense</strong>Radio.com and<br />

<strong>Cyber</strong><strong>Defense</strong>TV.com, is a Limited Liability Corporation (LLC) originally incorporated in the United States of America. Our<br />

Tax ID (EIN) is: 45-4188465, <strong>Cyber</strong> <strong>Defense</strong> Magazine® is a registered trademark of <strong>Cyber</strong> <strong>Defense</strong> Media Group. EIN: 454-<br />

18-8465, DUNS# 078358935. All rights reserved worldwide. marketing@cyberdefensemagazine.com<br />

All rights reserved worldwide. Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved. No part of this newsletter<br />

may be used or reproduced by any means, graphic, electronic, or mechanical, including photocopying, recording, taping or<br />

by any in<strong>for</strong>mation storage retrieval system without the written permission of the publisher except in the case of brief<br />

quotations embodied in critical articles and reviews. Because of the dynamic nature of the Internet, any Web addresses or<br />

links contained in this newsletter may have changed since publication and may no longer be valid. The views expressed in<br />

this work are solely those of the author and do not necessarily reflect the views of the publisher, and the publisher hereby<br />

disclaims any responsibility <strong>for</strong> them. Send us great content and we’ll post it in the magazine <strong>for</strong> free, subject to editorial<br />

approval and layout. Email us at marketing@cyberdefensemagazine.com<br />

<strong>Cyber</strong> <strong>Defense</strong> Magazine<br />

276 Fifth Avenue, Suite 704, New York, NY 1000<br />

EIN: 454-18-8465, DUNS# 078358935.<br />

All rights reserved worldwide.<br />

marketing@cyberdefensemagazine.com<br />

www.cyberdefensemagazine.com<br />

NEW YORK (US HQ), LONDON (UK/EU), HONG KONG (ASIA)<br />

<strong>Cyber</strong> <strong>Defense</strong> Magazine - <strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> rev. date: 11/02/<strong>2021</strong><br />

<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 150<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


Books by our Publisher: https://www.amazon.com/Cryptoconomy-Bitcoins-Blockchains-Bad-Guys-ebook/dp/B07KPNS9NH<br />

(with others coming soon...)<br />

9+ Years in The Making…<br />

Thank You to our Loyal Subscribers!<br />

We've Completely Rebuilt <strong>Cyber</strong><strong>Defense</strong>Magazine.com - Please Let Us Know What You<br />

Think. It's mobile and tablet friendly and superfast. We hope you like it. In addition,<br />

we're past the five nines of 7x24x365 uptime as we continue to scale with improved Web<br />

App Firewalls, Content Deliver Networks (CDNs) around the Globe, Faster and More<br />

Secure DNS and <strong>Cyber</strong><strong>Defense</strong>Magazine.com up and running as an array of live mirror<br />

sites and our new B2C consumer magazine <strong>Cyber</strong>SecurityMagazine.com. Millions of<br />

monthly readers and new plat<strong>for</strong>ms coming…starting with<br />

https://www.cyberdefenseprofessionals.com this month…<br />

<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 151<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 152<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 153<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 154<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.


<strong>Cyber</strong> <strong>Defense</strong> <strong>eMagazine</strong> – <strong>November</strong> <strong>2021</strong> <strong>Edition</strong> 155<br />

Copyright © <strong>2021</strong>, <strong>Cyber</strong> <strong>Defense</strong> Magazine. All rights reserved worldwide.

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!