Blog - Page 4 of 115 - J Wolfgang Goerlich

Steps to take when there’s an active adversary

January 28, 2022

CISOs know they must respond quickly and effectively to an incident, yet surveys point to continuing challenges to deliver on that goal. These steps will help you respond quickly, without letting a crisis turn into chaos.

Excerpt from: 12 steps to take when there’s an active adversary on your network

3. Bring in the business

CISOs should be looping in business during the triage process, security leaders say, a point that’s often overlooked during active responses. As part of this, security teams need to immediately identify what impacted components are critical for conducting business, who owns those components and who controls them.

As J. Wolfgang Goerlich, advisory CISO with Cisco Secure, says: “This is a business problem. But in a security breach, a very technical person will be thinking, ‘I have to remediate.’ However, one of the things that CISOs need to remember is that a breach is a business problem not a technical problem. So there should be a secondary process that’s running business continuity and disaster recovery so that the business can keep doing what it needs to be doing.”

12. Stay calm; tend to staff needs

Goerlich says he has seen teams “run themselves into the ground” by working long hours without breaks and even a day or more without sleep. Although that grueling schedule shows a level of dedication, it’s likely to lead to mistakes.

“People get into their zones and work well beyond the times that they should,” Goerlich says, noting that CISOs should plan for clear lines of communications, caps for work hours, staggered schedules, and post-event time off. He adds: “As much as possible, organizations should think out in advance how to handle the human elements.”

Read the full article: https://www.csoonline.com/article/3645690/12-steps-to-take-when-there-s-an-active-adversary-on-your-network.html

This post is an excerpt from a press article. To see other media mentions and press coverage, click to view the Media page or the News category. Do you want to interview Wolf for a similar article? Contact Wolf through his media request form.

Always On Podcast: Secure and Trusted Access at Scale

January 26, 2022

I was a guest recently on the Always On Podcast.

“The past year has brought about an enormous shift in how we work which has led to security issues on a much broader scale. On this episode of Always On, Wolfgang Goerlich from Duo joins me to discuss how organizations are handling secure access and deploying trusted access at scale. You won’t want to miss our review of a secure outcome study, so press play to listen.”

You will want to hear this episode if you are interested in…

Trusted access [1:22]
The challenges that customers are seeing with the remote workforce [4:18]
Learning what Duo can do for an organization [9:45]
Improving the user experience [18:50]
Intangibles that customers are getting from Duo [25:04]
The outcomes of a secure outcome study [30:18]

Have a listen here: https://nwncarousel.com/podcast/secure-and-trusted-access-at-scale/

To see listen to other podcast interviews, click to view the Podcasts page or the Podcasts category.

Identify improvements as security matures – Design Monday

January 20, 2022

In writing the book Rethinking Sitting, Peter Opsvik manages to do with chairs what we should do with cyber security: study the item in the wider context of how people interact.

Peter Opsvik’s critique is that furniture design isn’t “particularly concerned with the needs of the sitting human body.” Many rituals, he believed, are driven by a need to relieve people and compensate for poor seats; like kneeling to pray or standing to sing. Opsvik considered how the positioning of a chair, say in a kitchen or dining area, can make a person feel more or less connected, more or less important. He also spent considerable time thinking about how sitting changes as children grow into adults.

Design spans time frames: an experience lasting an hour, a stage in life lasting years, a lifetime. It spans contexts: personal, communal, societal.

We struggle with this in cyber security. Take, for example, break glass account. Right then. We setup an account with administrative-level access, write the password on an envelope, and stuff the envelop in a vault. But what happens when most administrators are working remotely? Fair point. Let’s move the password from a physical vault to a password vault, and share the vault with our backup person. But what happens when the vault goes down? How about when the person resigns and leaves for another company? How do we handle the longer lifecycle of this seemingly simple control?

Peter Opsvik’s answer to the lifecycle question is the Tripp Trapp chair. The chair is well-made, long-lasting, and stable. Simply change the seat and footrest, and the chair accommodates the user from infancy to adult. Five sets of adjustments as they mature.

The chair reminds me of the five stage maturity models. Security capabilities move from initial, repeatable, defined, capable, and finally, to optimized. To design a Tripp Trapp security control, think through how to reconfigure the control to support the evolving capability. Ideally, simplify these adjustments down to a small number of items.

What’s the seat and footrest in our break glass example? I suggest the credential storage and credential access. That is, how we set it up, and how the person handling the emergency breaks the glass.

Tripp-Trapp-Tresko is Norwegian for Tic-Tac-Toe. In the kids game, like chairs and like security, you succeed by thinking ahead. “The best sitting position,” Opsvik once said, “is always the next position.” Start with minimum viable security. Plan for future stages early, and identify the adjustments we can make. Good security controls support an evolving capability maturity.

This article is part of a series on designing cyber security capabilities. To see other articles in the series, including a full list of design principles, click here.

Detection at Scale podcast: Rebuilding Trust in Security Tools

December 24, 2021

I was recently a guest on the Detection at Scale podcast: Rebuilding Trust in Security Tools.

“Why is SIEM an area of unease for so many security officers? To make detection and response successful, we need tools capable of upscaling the practitioners as well as equipping them to be successful. We need tools we can rely on.

In today‘s episode, we had an inspiring conversation with J Wolfgang Goerlich, Advisory CISO at Cisco Secure. We discussed how trust is a determinant factor in building the security tools of the future, why so many CISOs lost trust over SIEMs and what we can do to rebuild it.”

Have a listen here: https://podcasts.apple.com/us/podcast/ep-11-cisco-secure-s-j-wolfgang-goerlich-rebuilding/id1582584270?i=1000545619648

To see listen to other podcast interviews, click to view the Podcasts page or the Podcasts category.

Nudge and Sludge: Driving DevOps Security with Design

December 16, 2021

Nudge and Sludge: Driving DevOps Security with Design

Security people say users are the weakest link. When security becomes burdensome, users take shortcuts jeopardizing security. Design offers a solution. We will walk through affordances, nudges, sludge and principles to inform and direct our design. Come learn how better usability leads to DevOps security.

This talk was given at DevOpsDay Tel Aviv 2021.

Adoption of hardware-based security keys

October 13, 2021

Google last week revealed that it was coordinating efforts with global partners to hand out free USB security keys to 10,000 elected officials, political campaign workers, human rights activists and journalists, and other users considered to be at high risk of getting hacked.

Excerpt from: Tech giants encouraging adoption of hardware-based auth keys

“Whenever a major organization makes a major announcement bolstering their security controls, it sparks conversation and movement in the broader industry,” agreed Wolfgang Goerlich, advisory CISO at Cisco Secure. “Google’s announcement that it is enrolling 10,000 people in authenticating with strong security keys will make it easier to explain a similar need in other organizations.”

And this isn’t the first such corporate endorsement of hardware-based authentication. Among the companies using FIDO’s standards for Universal 2nd Factor (U2F) authentication keys is Yubico, which like Google has been working with DDC to provide its hardware-based authentication keys to campaigns from both major parties.

Read the full article: https://www.scmagazine.com/analysis/physical-security/tech-giants-encouraging-adoption-of-hardware-based-auth-keys

Kim Crawley and 8 Steps to Better Security

October 4, 2021

Kim Crawley, author of 8 Steps to Better Security, discusses what it takes to make a resilient security program.

Watch more videos on my YouTube channel.

Remote Work Drives Continued 2FA Adoption

September 15, 2021

79% percent of people used two-factor authentication at least once in 2021, with 72% regularly using the technology, as remote work, social media, and online retail spur demand.

Excerpt from: Security Fears & Remote Work Drive Continued 2FA Adoption

SMS texts continued to be the most-used type of two-factor authentication, with 85% of people using that 2FA technology. Verification emails are the second most common type at 74%, while passcodes issued by mobile authentication apps came in third with 44%.

Companies need to educate consumers more on the pitfalls of SMS text messages as a second factor, Goerlich says. More than half of people surveyed would choose SMS as the second factor for a new account, while less than 10% would choose a mobile passcode application and 7% would use a push notification. SMS tied with security keys, such as YubiKey and other technology, for highest perceived security and topped the list for usability.

“There is a clear mismatch between what the survey respondents are using in terms of security and what researchers have found and identified in terms of security,” he says. “It makes sense that SMS is rated high in usability, and there is a really strong familiarity with the factor, but a lot of issues have been identified by researchers.”

Attempts to educate people on security problems with SMS should be careful, however, not to dissuade them from using two-factor authentication at all, Goerlich stressed.

Read the full article: https://www.darkreading.com/authentication/security-fears-remote-work-drive-continued-2fa-adoption

Backup Central’s Restore it All podcast: Information Security Expert Says it Must Evolve

July 24, 2021

I was recently a guest on Backup Central’s Restore it All podcast: Information Security Expert Says it Must Evolve.

“Wolfgang Goerlich, Advisory CISO, explains the current state of information security, and why he thinks many environments are focusing on the wrong things. We speak about ransomware, extortionware, and phishing, even giving examples where we know we have personally been phished! He explains how this illustrates his point that we need more emphasis in different areas of information security.”

Have a listen here: https://castbox.fm/episode/Information-Security-Expert-Says-it-Must-Evolve-id4299067-id405986591

To see listen to other podcast interviews, click to view the Podcasts page or the Podcasts category.

Hacker History Podcast Guest

May 25, 2021

I was a guest recently on the Hacker History podcast.

“Hacker History sits down with Wolfgang Goerlich. We learn about the importance of having root and admin when becoming a hacker and how truly important it is that we have patience and empathy for one another. We also learn that skateboarding in a datacenter doesn’t actually work.”

Have a listen here: https://hackerhistory.com/podcast/the-history-of-wolfgang-goerlich/

To see listen to other podcast interviews, click to view the Podcasts page or the Podcasts category.