SDxCentral: Debunking Cybersecurity Myths

Archive for the ‘Security’ Category

SDxCentral: Debunking Cybersecurity Myths

Posted by Wolf Goerlich

Of all the cybersecurity myths about small to midsized businesses, the most damaging is the widely held believe that SMB leadership doesn’t take security and data privacy seriously, says Wolfgang Goerlich, Advisory CISO at Cisco Duo. This myth must be stamped out immediately, he said. And while it’s myth No. 8 in a new Cisco report, “it really needs to be myth one.”

Excerpt from: Cisco Debunks Cybersecurity Myths

“Maybe that was true 10 years ago,” Goerlich said. “The executive teams of these organizations are taking security and data privacy very seriously. Every other myth downstream is effected by that awareness and visibility at the top.”

Cisco’s latest security report, based on a survey of almost 500 SMBs, aims to debunk myths about smaller companies’ security posture and threats. This is important because the security industry has traditionally been biased against SMBs, perpetuating the myth that they don’t prioritize cybersecurity, the report says.

To come up with the 10 myths debunked in the report, Cisco compared responses from SMBs (250-499 employees) versus larger organizations with 500 or more employees. It shows that SMBs face the same threats and potential damages from an attack and they take security preparedness every bit as seriously as their larger counterparts.

Read the full article: https://www.sdxcentral.com/articles/news/cisco-debunks-cybersecurity-myths/2020/05/

This post is an excerpt from a press article. To see other media mentions and press coverage, click to view the Media page or the News category. Do you want to interview Wolf for a similar article? Contact Wolf through his media request form.

Dark Reading: OS, Authentication, Browser & Cloud Trends

Posted by Wolf Goerlich

New research shows cloud apps are climbing, SMS authentication is falling, Chrome is the enterprise browser favorite, and Android leads outdated devices.

Excerpt from: OS, Authentication, Browser & Cloud Trends

Application integration is up across most key categories. The number of customers per cloud app is up 189% year-over-year, and the number of authentications per customer per app is up 56%.

The massive spike in cloud applications means any given employee has at least two or three cloud apps they use to do their jobs, says Wolfgang Goerlich, advisory CISO for Duo Security. “It was a big explosion of shadow IT,” he adds. “It really got away from a lot of the organizations.” Some people often use the same applications for personal and business use, driving the need for businesses to enforce their security policies for cloud-based applications and resources.

Read the full article: https://www.darkreading.com/cloud/security-snapshot-os-authentication-browser-and-cloud-trends/d/d-id/1335262

Wolf’s Additional Thoughts

IT history repeats itself.

The organization moves slow to provide employees with tools and technology. Consumer tech fills in the gap outside of the office. People get savvier and more experienced with tech. People innovate with what they know, to get done what they need to get done.

The organization notices people doing things in an innovative yet ad hoc way. Work is done to standardize tech use. More work is done to secure the tech use. The wild ways of people, the wilderness of shadow IT, is tamed and brought into the light.

We’re at this point now. That’s what the numbers show. But tamed IT is slower than shadow IT. If the past has taught us anything, it is that the cycle will repeat.

This post is an excerpt from a press article. To see other media mentions and press coverage, click to view the Media page or the News category.

Microsoft Valuable Professional (MVP)

Posted by Wolf Goerlich

Microsoft has recognized my work in Cloud Computing security with a 2017-2018 Microsoft Valuable Professional (MVP) award. I’ve long relied upon the guidance and advice from MVPs. It’s a fantastic program. I’m honored to now be included, specifically under Enterprise Security.

Hybrid cloud security: 8 key considerations

Posted by Wolf Goerlich

Hybrid cloud should strengthen your organization’s security posture, not diminish it. But that doesn’t mean improved security is a default setting. While security fears are declining as cloud matures, security remains an ongoing challenge that needs to be managed in any organization. And a hybrid cloud environment comes with its own particular set of security considerations.

 

1. Ensure you have complete visibility.

Too often in modern IT, CIOs and other IT leaders have blind spots in their environments, or they focus too narrowly (or even exclusively) on their on-premises infrastructure, says cybersecurity veteran J. Wolfgang Goerlich, who serves as VP of strategic programs at CBI.

Now that companies and their end users can use hundreds of cloud-based apps, and multiple departments can spin up their own virtual server on an Infrastructure-as-a-Service platform, complete visibility across private cloud, public cloud, and traditional infrastructure is a must. A lack of visibility, says Goerlich, snowballs into much greater security risks than are necessary.

2. Every asset needs an owner.

If you lack 360-degree visibility, you probably lack ownership. Every piece of your hybrid cloud architecture needs an owner.

“A key tenet in IT security is having an owner identified for every asset, and having the owner responsible for least privilege and segregation of duties over the asset,” Goerlich says. “Lack of visibility results in a lack of ownership. This means, quite often, hybrid cloud environments have loosely defined access controls and often are without segregation of duties. Excessive permissions introduce risk, and unowned risk is unaddressed risk.”

Read the full article:

Hybrid cloud security: 8 key considerations
https://enterprisersproject.com/article/2017/7/hybrid-cloud-security-8-key-considerations

Enterprisers Project: Expert advice on securing hybrid cloud environments

Posted by Wolf Goerlich

Hybrid cloud should strengthen your organization’s security posture, not diminish it. But that doesn’t mean improved security is a default setting.

Excerpt from: Hybrid cloud security: 8 key considerations

Ensure you have complete visibility. Too often in modern IT, CIOs and other IT leaders have blind spots in their environments, or they focus too narrowly (or even exclusively) on their on-premises infrastructure, says cybersecurity veteran J. Wolfgang Goerlich, who serves as VP of strategic programs at CBI.

Now that companies and their end users can use hundreds of cloud-based apps, and multiple departments can spin up their own virtual server on an Infrastructure-as-a-Service platform, complete visibility across private cloud, public cloud, and traditional infrastructure is a must. A lack of visibility, says Goerlich, snowballs into much greater security risks than are necessary.

Read the full article: https://enterprisersproject.com/article/2017/7/hybrid-cloud-security-8-key-considerations

This post is an excerpt from a press article. To see other media mentions and press coverage, click to view the Media page or the News category.

Viewing cached credentials and clearing cached credentials in Windows 10

Posted by Wolf Goerlich

This article applies to Windows 10 Anniversary Update (Version 1607). For previous versions of Windows, please see the earlier article.

What are cached credentials?

Windows 10 caches and stores usernames and passwords for Active Directory domains, other computers, apps like Outlook, websites, and FTP sites. This makes it easier to authenticate as you don’t have to type in the username and password every single time. But it does pose a risk of those credentials getting misused.

Where are Windows 10 credentials stored?

Active Directory credentials. Domain credentials (usernames and passwords are stored on the local computer’s registry as salted hashes. This is under HKEY_LOCAL_MACHINE\Security\Cache, found in the %systemroot%\System32\config\SECURITY file.

Generic credentials. You can view Website and Windows credentials by launching the Credential Manager (credwiz.exe).

Internet credentials. You can view Internet usernames and passwords in the Internet Control Panel (inetcpl.cpl). Run inetcpl.cpl, go to Content, scroll to Autocomplete, click Settings, and click on Manage Passwords.

When do Windows 10 cached domain credentials expire?

Unfortunately, Windows domain credentials don’t expire in the cache. Within Active Directory, expiration is set on the user object. But if the credential is still valid in Active Directory, the cached copy will still work.

It is possible to control how many credentials are cached using the group policy: Interactive logon: Number of previous logons to cache (in case domain controller is not available)

Designing CyberSecurity | Weekly Blog Series

Designing and architecting security? Join our weekly conversation on what hackers can learn from artists and designers.

How to reset Windows 10 credentials? How to remove Windows 10 credentials?

Active Directory credentials. Open the registry to HKEY_LOCAL_MACHINE\Security\Cache, grant your user account read/write access. Close and reopen the registry to have the access control take effect. Zeroing out the NL$x binary value will clear the cached credential.

Generic credentials. Open the Credential Manager (credwiz.exe to view Website and Windows credentials. Select and remove the passwords you wish to clear.

Internet credentials. Open the Internet Control Panel (inetcpl.cpl), go to Content, scroll to Autocomplete, click Settings, and click on Manage Passwords. Select and remove the passwords you wish to clear.

Outlook email. To view and clear Outlook passwords on Windows 10, first use the Credential Manager instructions above. Then, download the SaveCredentials.exe tool and follow the directions here.

Windows Live Essentials. To view and clear Windows Live Essentials passwords on Windows, first use the Credential Manager instructions above. Find the SSO_POP_Device. This credential provides Single Sign-On (SSO) access for the Post Office Protocol (POP) when accessing a variety of Microsoft email platforms (@hotmail.com, @msn.com, @outlook.com, etc).

Why bother clearing Windows 10 credentials?

The main reason people follow this article is to troubleshoot cached Windows credentials, Active Directory credentials, domain issues, or problems with apps like Internet Explorer and Outlook. Removing the passwords from Windows allows it to reset and fix authentication issues.

The other reason? Well, security. A common tactic from penetration testers to red teamers to criminals is to gain access to cached credentials. From there, they may be replayed to connect to IT systems, or cracked and reused as part of a larger attack. To prevent this, minimize the data stored on your computer and minimize the likelihood of it being stolen or copied.

Securing Food Production

Posted by Wolf Goerlich

As a rule, I like to work out an idea over year. Explore this aspect. Explore this other aspect. Have discussions with folks in the know and folks who are learning, and come up with yet another take. And I do this, year after year, getting a firmer grasp on the theory and strategy behind a particular security problem.

This year? It’s been the operational technology behind food production. I’ve explored this three ways:

Food Fight. The first few Food Fights were interactive question-and-answer sessions at BSides events. These described the problems we see in the food production industry, and explore how to assess them technically. I gave these sessions at BSides Indianapolis, BSides Chicago, BSides Cleveland, and BSides Detroit. Then, at CircleCityCon, I gave Food Fight on the main stage. To get a sense of this talk, watch BSides Cleveland’s recording.

Food for Thought. While Food Fight is more technical, Food for Thought is more governance. The talk explores operational technology from the perspective of risk management. It’s describes shining a light on the OT risks and integrating the findings into an overall security program. I gave Food for Thought at the Central Ohio InfoSec Summit and the North American International Cyber Summit.

Guarding Dinner, or, Lunch. There’s technical vulnerabilities. There’s cyber security risks. So, now what? The Guarding talk covers several steps organizations can follow the prevent attacks on industrial controls, such as those found in food production. I use a threat model as the foundation and walk through the defense. I gave this talk at MCRCon and as the lunch talk at GrrCon. Watch the GrrCon Lunch talk here.

I’m retiring the series of talks. It was a good way to have conversations around industrial control systems. And we’ve used the lessons learned, both in the original case study and in creating these slide decks, with several manufacturing clients. With that up and running and the knowledge out there, I’m moving onto my next area of interest.

Sneak peek: it’s strategically using encryption, building on past work with threat modeling and business analysis. Stay tuned.

Tower Defense

Posted by Wolf Goerlich

This was originally posed on The Analogies Project and co-written by Claus Houmann. Please visit The Analogies Project for more IT security analogies and ideas. 

Enterprise defense today is hard. Anyone reading the news regularly will have noticed a never-ending stream of attacks, breaches, and data lost to cyber criminals that either attack for financial gain or to cause a company harm.

The companies taking this threat seriously appoint someone to coordinate enterprise defense, and that someone usually receives a job title resembling Chief Information Security Officer, Information Security Director, or Manager. These very people then work to maximize the limited budgets companies have for security. And these very CISOs are also often the ones to take the blame when and if something happens. It is a tough position to be in, and one that warrants a new approach.

One such approach is to consider the job of the CISO analogous to playing tower defense games.

What is a tower defense game? Well, first off we have a map and a mission of protection. The attacks come in a predictable path that can be planned for, similarly to threat modelling and threat intelligence. When attacks come, in waves or over time, we have to choose among a number of different defenses to counter/shoot down these attacks.

Defenses have attributes in common with cyber security. Each defense has a cost, so we’ll have to start with cost effective defenses. Each defense has a likelihood of success or failure, so we’ll have to stack defenses to ensure success. And as the attack progresses, some defenses are successful for some tactics and ineffective for others. Careful planning, then, is needed to create an effective deployment of defenses along the path the attacks take.

As an example, suppose we start with the most cost-effective defense such as a laser tower. The laser tower will shoot down attackers, and as more and more attackers come, we’ll deploy more laser towers in strategic locations on the map. This resembles the CISO building an enterprise defense. However, the attackers will then evolve and start using flying attacks which your ground-facing laser tower cannot counter, at which point you’ll have to add to your laser towers or replace with anti-aircraft missile batteries. This is the CISO deploying new processes, people and tools to counter new attack vectors that were getting through in unacceptable numbers. And so it goes, with each round escalating the attacks and defenses.

In the tower defense game, you actually earn money by beating the earlier stage attacks, potentially giving you enough budget to build new defenses for the later stage attacks. For the CISO, this is analogous to using past successes and proper planning to build the business case for investing in the security program. The messaging becomes one of sustainably developing controls along established attack paths, understanding that programs must be maintained and developed to keep pace with crime.

In sum, let’s make real life a bit more like tower defense games. Let’s understand the path the criminals take, understand that no one defense is completely effective, and that no defensive strategy survives beyond a couple of rounds. We promise not to build an expense-in-depth defense (thanks again, again for this phrase, Rick Holland). Instead, playing tower defense is a way to build a capacity for defense proactively – and justify the security budget.

Channel 9: An Interview with Wolf Goerlich

Posted by Wolf Goerlich

Join Technical Evangelist, Annie Bubinski, for an interview with Wolf Goerlich (@jwgoerlich), who presented this year at CodeMash 2016 about Security Culture in Development.

CodeMash has educated developers on current practices, methodologies, and technology trends in a variety of platforms and development languages for 10 years in a row. In honor of the 10th anniversary of CodeMash and the launch of Windows 10, Microsoft Academy College Hires teamed up to record interviews with 10 different CodeMash Speakers.

https://channel9.msdn.com/Blogs/raw-tech/Security-Culture-in-Development-An-Interview-with-Wolf-Goerlich

 

Why You Should Work in Information Security

Posted by Wolf Goerlich

Rasmussen College reached out for advice on why information security is a great field to be in. My response is below. Click through to read more thoughts.

 

Expert Advice on Why You Should Work in Information Security … NOW
http://www.rasmussen.edu/degrees/technology/blog/expert-advice-why-work-in-information-security/

 

1. Working in information security is exciting, challenging and never-ending

“Information security is new unexplored territory … and this creates exciting and challenging work,” says J. Wolfgang Goerlich, vice president of consulting at VioPoint.

Information security professionals work on teams to develop tactics that will help find and solve unauthorized access as well as potential data breaches. A crucial part of the job in information security is keeping companies from having to deal with unwanted exposure.

The best information security teams, Goerlich says, are those that provide “consistent mentoring and cross-training.” He says professionals in this field must be constantly learning and sharing what they know.

“As the technology is shifting and the attacks are morphing, the career effectively is one of life-long learning,” Goerlich says.