It is the final task of an implementation. The stakes are high. One of your people hits a wrong button. The entire system comes crashing down. My question: Is this good luck, or bad?
For an answer and inspiration, I look to Massimo Bottura. Bottura is a chef and restauranter. At his Michelin 3-star restaurant, Osteria Francescana, a similar situation played out. The pastry chef, Taka Kondo, was platting the final course. One tart slipped. Smash! And to Kondo’s surprise and relief, Massimo Bottura burst out laughing. Good luck! The Oops! I dropped the lemon tart was born. The dessert has become legend.
You can hear Bottura tell the story himself at the video below. For now, I want to turn to the question of how to get lucky. So many things must go right when deploying technology, we can use all the luck we can get.
One factor in seeing the opportunity in accidents is associative barriers. High associative barriers lead to functional fixedness. By contrast, people with low associative barriers tend to find connections and opportunities others don’t. I’ve previously covered techniques to get beyond functional fixedness: discuss an item without naming it, and discussing what an item does rather than it is. (See Play with the spaces between the words.) Here, let’s cover building new associations.
New associations can prime us to turn accidents into good luck. It provides a larger net for catching ideas. The exercise is simple. List the assumptions. Imagine what would happen if the opposite were true. We can (and probably should) do this at multiple stages in designing security capabilities; from the vision to our assumptions about the organization, the security function, the security controls, the tools, and our assumptions about implementation. For example:
A tart from a Michelin 3-star restaurants is carefully plated and perfectly constructed.
It is messily deconstructed. Innovation: Oops! I dropped the lemon tart.
The authenticating security credential is a person’s ID and password.
A person can authenticate without a password. Innovation: passwordless.
A security perimeter is enforced by the network, that is, by a firewall.
A perimeter is enforced regardless of network. Innovation: Zero Trust.
Defense-in-depth necessarily means having deep control coverage.
Defense can be achieved with only a few controls. Innovation: attack path.
The other factor in finding the opportunity in accidents is time. Rushed people don’t get lucky. Stressed people don’t get opportunities. The psychology of stress and time shows people develop tunnel vision and repeat well-known and practiced techniques. The same is equally true for rushed and stressed projects and initiatives. The same goes for rushed and stressed teams and operations. This is an anathema to getting lucky, of course. We’re highly unlikely to see possibilities and to take them on when in this state. Buffer time and down time create the space for getting lucky.
“Leave a free space for poetry. Leave a free space from obligation. You have to be ready to see what others don’t even imagine,” Massimo Bottura says in the video below. He could be speaking directly to us about designing security capabilities. “Make visible the invisible.”
Massimo Bottura tells the story behind Oops! I dropped the tart.
This article is part of a series on designing cyber security capabilities. To see other articles in the series, including a full list of design principles, click here.
The building came into view. My vantage point was on the Chicago River. It was Valentine’s Day. Now Chicago natives had warned us about the cold February winds. But there my wife and I were, on a river tour of Chicago’s architecture. Frozen to the ship’s deck, we looked up as the IBM Plaza came into view.
Ludwig Mies van der Rohe designed the building in the 1960s. Mies came from the famed Bauhaus school, another of my favorite sources of inspiration. In fact, Mies was the last director of Bauhaus. He moved from Berlin to Chicago in 1937 to head the architecture department of Illinois Institute of Technology. There’s a direct line from Bauhaus to Second Chicago School of architecture. Specifically, in minimizing ornamentation in favor of emphasizing building materials themselves.
It was this modernism which drew IBM to Mies van der Rohe. But there was a problem. Many, in fact, with the building IBM wanted. Computing technology of that age was notoriously hot and power-hungry. Moreover, computer engineers were at a premium, which meant a large workforce with little patience for waiting on elevators. Every minute counted. Moving to the ground, the lot was an oddly shaped. Triangular. It sat partially atop of a train line which restricts the foundation needed for a skyscraper. And to top it off, the site had an agreement to provide storage for the Sun-Times. That’s a lot.
“Less is more” was popularized by Mies van der Rohe. Boil down architectural requirements to the essentials. In cybersecurity, we’ve embraced less is more. You see it in concepts like least privilege, least trust (aka Zero Trust), economy of mechanism, and limited security blast radius. You see it in my security principles; like when I discuss building Roombas not Rosies. Less is more is a reminder to take a minimalist approach.
Even from the Chicago River, you can feel the minimalism of the IBM Plaza. The exposed vertical beams, the glass and steel materials on full display. Less is more. But it’s more than it seems. The building has more than double the elevators of a comparable building. The cooling system is similarly over-powered. Designed by C.F. Murphy, the HVAC is tuned for 1970s era computing. Mies also made several floors to be taller to support raised flooring, and reinforced to support the weight. The building is subtly shifted back to make use of the lot, with weight shifted back onto a strong foundation. This feature explains the open pillars in front and allowed Meis to neatly avoid the question of the railway. Less is more? If anything, much of the IBM building is overdone.
Less is more is not a call for doing less. It is a reminder to save our energies to do more where it counts. It is a reminder to pour the savings into solutions for the problem at hand. When we save resources for priorities, less isn’t loss.
IBM moved into IBM Plaza in 1971. For more than three decades, the building was the Chicago office of the tech giant. “The building was declared a Chicago Landmark on February 6, 2008 and added to the National Register of Historic Places on March 26, 2010.” Today, the building at 330 North Wabash is known as the AMA Plaza. It stands as a testament to Ludwig Mies van der Rohe’s ability to balance less and more.
The design lesson: More of what matters is more.
The floating foundation of 330 North Wabash, Chicago. Photography by Ryan Cramer.
This article is part of a series on designing cyber security capabilities. To see other articles in the series, including a full list of design principles, click here.
For years, the Peerlyst social network has been a resource for software developers looking for a job or cybersecurity enthusiasts wanting to host meetups across the world. But on Aug. 27, the website will shut down, Peerlyst founder Limor Elbaz said Monday, citing financial pressure.
Cybersecurity professionals lamented the end of the platform. “I took the news hard,” said J. Wolfgang Goerlich, an advisory CISO at Duo Security who has posted nearly 700 times on Peerlyst. “With the Peerlyst going away, we’re losing a central watering hole. The conversations may continue over LinkedIn and Facebook groups. But the loss of a dedicated security social media site will be felt for some time.”
The site also let users plans their own offline meetups in various cities in Asia, Australia, Europe, and North America.
I was an early adopter of Peerlyst and a regular contributor. I end up the 22nd most popular user on the site which boasts of serving “70% of security professionals around the world and the site ranks higher than the majority of security companies.” Also? Peerlyst once put my face on the side of a bus during the RSA Conference. So I’m a little biased.
There is tremendous value in community. Apple itself got its start at the The Homebrew Computer Club. I spent many years and cut my teeth as a top poster in the Citrix online community, back in the early 2000s. And in the last decade, more people than I can count had their careers launched through my local security community, MiSec.
I’m sad to see Peerlyst go and am grateful to Limor Elbaz, Evgeny Belenky, and the entire Peerlyst team. My thanks to them for the memories and connections.
To you the reader, I ask this: what community will you build?
This post is an excerpt from a press article. To see other media mentions and press coverage, click to view the Media page or the News category. Do you want to interview Wolf for a similar article? Contact Wolf through his media request form.
We spend far too much time talking about defense in depth and far too little time talking about economy of mechanism.
As a design inspiration, look to Alfred Heineken. Not a designer, Heineken was a brewer and a businessman. In the 1950s, modernizing the look of the Dutch brewing company, Heineken made two changes to the beer’s logo. He dropped the upper-casing and then, to be playful, he tilted the e until it resembled a smile. Simple.
Defense in depth suggests more controls and more tools are better. However, this complexity comes at a cost. In a study performed by Cisco, the number of vendor tools was directly correlated with the downtime from a security incident. Security teams using one vendor averaged four hours or less of downtime, while teams managing more than 50 averaged more than 17 hours of downtime.
I suspect the downtime is driven by the team’s confusion when responding to incidents. It fits my personal experience, and reminds me of what Donald A. Norman wrote in Living with Complexity. “Modern technology can be complex, but complexity by itself is neither good nor bad: it is confusion that is bad. Forget the complaints against complexity; instead, complain about confusion.”
Economy of mechanism suggests implementing the fewest controls and fewest tools to mount an adequate defense. We have a finite cognitive throughput from people doing the work and people securing the work. We have a finite budget. After we have the requirements and possible tooling options, ask how we can achieve the same results with less. Ask again, and again.
Find the letter e, tilt it a bit, and smile.
Heineken’s smiling e logo, photography by Heineken.
This article is part of a series on designing cyber security capabilities. To see other articles in the series, including a full list of design principles, click here.
Artists create unique piece for a limited audience. Designers create for scale. The tension exists between creating something that works and building something that’s repeatable.
This tension came up in conversation around the article I wrote about Kenji Kawakami and the art of Chindōgu. The principle is employing playful anarchy to bring security controls from useless to un-useless to useful. People were quick to point out that quantifiable, repeatable, scalable security is jeopardized by the ad hoc chaos of creation.
For guidance, look to George Nelson who was the Director of Design for Herman Miller from 1947 to 1972. One of the first designs George Nelson brought forward was a “sculpture-for-use” table by Isamu Noguchi. Sculpture remade as a repeatable product. Nelson also managed designers such as Charles and Ray Eames, Alexander Girard, and Robert Propst. It’s a simple comparison to draw from furniture to technology, from the difficulty of managing people like the Eames to the difficulty of managing today’s cybersecurity talent.
Here is how Nelson did it for twenty-five years:
Philosophy. Reading George Nelson’s introduction to the Herman Miller catalog in light of the intrinsic motivation framework laid out in the book Drive. Autonomy, mastery, purpose. Nelson’s philosophy is finely tuned for getting the best out of innovative people. An unstated undercurrent is that designs must be producible. After all, Herman Miller is a business. The trick was to protect the playful anarchy while harnessing the results for manufacturing at scale. “There is a hint of the craftsman as opposed to the industrialist.”
Methodology. In modern times, George Nelson has been described as a meta-designer. That is, he spent more time designing the furniture design process than he spent designing the actual furniture. While he retired some twenty years before the founding of IDEO, Nelson would have been right at home in the world of design thinking. He pioneered a formal way to go from a series of conversations, to a series of prototypes, to a finished product. Along the way, capturing information and providing feedback to refine not only the design but also the lifecycle itself. Nelson’s approach was showcased in the “The Design Process at Herman Miller” exhibit in 1975.
The challenge in cyber security design is taking a successful proof-of-concept and scaling from prototype to securing the overall organization. How to balance the artist with the designer? The craftsman with the industrialist? Playful anarchy to well-defined operations? Nelson held a philosophy geared to foster those intrinsic motivations of the creative mind. He created a methodology for taking ideas to market. George Nelson combined both into his meta-design approach.
For security leadership to get meta, develop a philosophy and methodology, design a way to design, and improve based on feedback.
Philosophy drives the satisfaction of our people. Methodology drives the success of our initiatives. We need both, and both need continuous improvement.
Sculpture-for-use, Noguchi table, photography by the Isamu Noguchi collection.
This article is part of a series on designing cyber security capabilities. To see other articles in the series, including a full list of design principles, click here.
Of all the cybersecurity myths about small to midsized businesses, the most damaging is the widely held believe that SMB leadership doesn’t take security and data privacy seriously, says Wolfgang Goerlich, Advisory CISO at Cisco Duo. This myth must be stamped out immediately, he said. And while it’s myth No. 8 in a new Cisco report, “it really needs to be myth one.”
“Maybe that was true 10 years ago,” Goerlich said. “The executive teams of these organizations are taking security and data privacy very seriously. Every other myth downstream is effected by that awareness and visibility at the top.”
Cisco’s latest security report, based on a survey of almost 500 SMBs, aims to debunk myths about smaller companies’ security posture and threats. This is important because the security industry has traditionally been biased against SMBs, perpetuating the myth that they don’t prioritize cybersecurity, the report says.
To come up with the 10 myths debunked in the report, Cisco compared responses from SMBs (250-499 employees) versus larger organizations with 500 or more employees. It shows that SMBs face the same threats and potential damages from an attack and they take security preparedness every bit as seriously as their larger counterparts.
This post is an excerpt from a press article. To see other media mentions and press coverage, click to view the Media page or the News category. Do you want to interview Wolf for a similar article? Contact Wolf through his media request form.
The present caught up to the future in November 2019. The film Blade Runner takes place in 2019 Los Angeles, and watching the film says a lot about people predicting the future. Sure, they get some things right. AI assistants and smart homes? Hello, Alexa and Google. Video conference calls? WebEx all day long. But where’s our flying cars and human-like robots? (Do autonomous vehicles count?) And why wasn’t Atari neon everywhere in 2019? Turns out, people aren’t all that good at predictions.
Let’s look back to look forward.
Breached-by-Mistake Happens
In this article, we’ll consider trends seen in 2019 and forecast where these may take corporate security in 2020. Some are very predictable. For example, VeraCode’s State of Security report’s retrospective on the past decade shows that we are surprisingly predictable in introducing vulnerabilities into software. Similarly, breached-by-mistake has been a common theme the last few years. Some trends are not as predictable. For example, with DevOps, we can now consistently make those mistakes faster. And with the growing IoT (Internet of Things) market, we can now make those same mistakes in new places on new smart devices. We can count on IT to continue to be vulnerable.
Money Still Top Motivating Factor for Cyber Crime
The primary adversary for corporate cybersecurity continues to be crime. And no wonder. It’s a lucrative market. Take business email compromises (BEC), which some studies show nets on average $130,000. Compare that to the poor bank robbers who only bring in around $3,000 per heist, and we can see why criminals are turning to technology attacks. The size of the problem is anyone’s guess, due to underreporting, international differences and more. The most recent information put out by the FBI reported $2.7 billion in annual losses as one data point we can look to. With those kind of stakes, we can count on criminals to continue exploiting vulnerable IT.
With those two trends as our guiding lights, let’s peer ahead into 2020.
Future Cyber Crime in 2020
Blending of Techniques
The past was about single tactic crimes. Attackers phished for passwords. Disgruntled insider threats damaged equipment. Support scammers called for credit card information. But people began to get street smart. For example, the 2019 Trusted Access Report found that fewer people are opening phishing emails, and fewer still are providing credentials. Microsoft has reported seeing a similar drop in the success of tech support scams. Which means criminals have to get better.
Expect to see more crimes that blend techniques. For example, criminals obtaining legitimate support information from companies using insider threats, then crafting more accurate pretexts, and leveraging a combination of email and telephone communication. The current level of security awareness is sufficient to thwart a basic support scam. But if the scammers call with your actual support contract number and support dates, would you be able to distinguish them from a legitimate support request? Likely not. And inside employees have been known to resell this information to the scammers. Thus greater security awareness will drive criminals to greater sophistication in 2020.
Blending of Technologies
The past was about single purpose malware. Take Magecart, which is inserted into shopping websites as a JavaScript. The malware has been around since 2010 but it saw a significant rise in use this past year. Why? Because as point-of-sale systems are hardened, it’s become more difficult for criminals to get in and stay in. Meanwhile, the websites are outside of these hardened and monitored environments. So attackers deploy to the weaker areas where they can stay in for weeks.
Another example is Emotet. It first appeared in 2014 as a banking trojan. This year saw Emotet developed into a modular platform which other criminals can build upon. So attackers repurpose and specialize in order to maximize their existing technology. Similar to the principles of open source software. Expect malware to follow a similar trajectory that software has, towards microservices and software-as-a-service.
Shifting Targets
Criminals began with larger organizations for the obvious reason: the larger score. In recent years, with ransomware and targets of opportunity, small organizations became prime targets. But, both the very small and the very large have been shoring up defenses the past couple years. The Security Bottom Line report found that “organizations in the middle with 1,000 to 9,999 employees are struggling the most to adequately secure their environments.”
While the Verizon DBIR 2019 data does not indicate medium-sized organizations are breached more than others, there are clear differences in tactics. These medium-sized organizations see higher rates of hacking than other sized organizations (73% versus 49%) and phishing (58% versus 17%) suggesting lower IT security and overall security awareness. Expect more criminal activity as the attackers route around the stronger defended organizations.
Future Defenses in 2020
The digital transformation of most organizations is well underway. Recent surveys show over 90% of organizations using public cloud infrastructure, over 50% using containerization technology. And while previous years allowed security leadership to avoid placing DevOps and cloud teams in scope, this will all but come to an end in 2020 as sensitive workloads move to these platforms. Expect increased use of the configuration automation found in DevOps such as Ansible for prevention. For detection and response, expect more organizations to implement SOAR (security orchestration automation and response) to improve reaction times with limited staff.
Another aspect of cloud computing has been the adoption of cloud apps and software-as-a-service. The primary control security teams have over these apps is identity and access control. Duo’s 2019 Trusted Access Report found that, “cloud integrations are up 56 percent year over year based on the number of customers authenticating to cloud apps, and up a whopping 189 percent year over year in terms of the number of customers using each cloud app.” Expect this trend to continue as organizations turn to IAM (identity and access management) as a front-line defense for the cloud apps they rely upon.
Changing Technologies
There are two technologies which will have a significant impact on defense in 2020: passwordless authentication and UEBA.
Passwordless authentication. This year saw the standardization of WebAuthn protocol and the tipping point for adoption of operating systems supporting passwordless; from desktop computer to phone to tablet. Considering the threat posed by stolen credentials, and the win-win of increased security with increased ease-of-use, passwordless will be a big theme in many organization’s security roadmap in 2020.
UEBA (user and entity behavior analytics). The UEBA product market has existed for some time. But challenges remain in trying to apply analytical models to an unpredictable workforce. 2020 will see UEBA shift from being a dedicated product to being a product feature. This move enables the analytics to be placed around specific activities rather than the generalized approach taken today. For example, placing UEBA on application workloads or on authentication workflows. With such a tight scope, there will be fewer false positives. Expect purpose-built UEBA to be more common and become a cornerstone of a zero-trust architecture.
Bonus
Hacktivism has been on the decline since its peak in 2015. There are a number of factors behind this decline, including the hacktivist tactics like DDoS (distributed denial-of-service) becoming less effective, hacktivist groups like Anonymous becoming less cohesive, and increases in law enforcement against hacktivists. 2019 saw the lowest number of hacktivist activities in the past five years.
Yet in 2019, the world witnessed a number of protests across the globe. Many are ongoing at the time of this article. We are in a period of worldwide unrest that is likely to continue for the first half of 2020. This creates fertile soil for a variety of new tactics, both on the ground and over the internet. We can expect hacktivism to return with a new set of tools and targets reflective of these groups.
Conclusion
My two favorite things in Blade Runner are the payphone and the Polaroid camera. Here we have futuristic video conferencing. But the hero places the call from a payphone. These are so rare these days that people photograph them and share telephone booths on social media. This gets me to the photos, a key plot-point in Blade Runner, which are physical media from what appears to be a high-tech Polaroid camera. They have space travel but no Instagram. It’s fantastic. And it is a reminder that predictions are a tricky business.
Cross posted at Duo Security. For more science fiction inspired predictions, click to view the Predictions category.
New research shows cloud apps are climbing, SMS authentication is falling, Chrome is the enterprise browser favorite, and Android leads outdated devices.
Application integration is up across most key categories. The number of customers per cloud app is up 189% year-over-year, and the number of authentications per customer per app is up 56%.
The massive spike in cloud applications means any given employee has at least two or three cloud apps they use to do their jobs, says Wolfgang Goerlich, advisory CISO for Duo Security. “It was a big explosion of shadow IT,” he adds. “It really got away from a lot of the organizations.” Some people often use the same applications for personal and business use, driving the need for businesses to enforce their security policies for cloud-based applications and resources.
The organization moves slow to provide employees with tools and technology. Consumer tech fills in the gap outside of the office. People get savvier and more experienced with tech. People innovate with what they know, to get done what they need to get done.
The organization notices people doing things in an innovative yet ad hoc way. Work is done to standardize tech use. More work is done to secure the tech use. The wild ways of people, the wilderness of shadow IT, is tamed and brought into the light.
We’re at this point now. That’s what the numbers show. But tamed IT is slower than shadow IT. If the past has taught us anything, it is that the cycle will repeat.
This post is an excerpt from a press article. To see other media mentions and press coverage, click to view the Media page or the News category.
Microsoft has recognized my work in Cloud Computing security with a 2017-2018 Microsoft Valuable Professional (MVP) award. I’ve long relied upon the guidance and advice from MVPs. It’s a fantastic program. I’m honored to now be included, specifically under Enterprise Security.
Hybrid cloud should strengthen your organization’s security posture, not diminish it. But that doesn’t mean improved security is a default setting. While security fears are declining as cloud matures, security remains an ongoing challenge that needs to be managed in any organization. And a hybrid cloud environment comes with its own particular set of security considerations.
1. Ensure you have complete visibility.
Too often in modern IT, CIOs and other IT leaders have blind spots in their environments, or they focus too narrowly (or even exclusively) on their on-premises infrastructure, says cybersecurity veteran J. Wolfgang Goerlich, who serves as VP of strategic programs at CBI.
Now that companies and their end users can use hundreds of cloud-based apps, and multiple departments can spin up their own virtual server on an Infrastructure-as-a-Service platform, complete visibility across private cloud, public cloud, and traditional infrastructure is a must. A lack of visibility, says Goerlich, snowballs into much greater security risks than are necessary.
2. Every asset needs an owner.
If you lack 360-degree visibility, you probably lack ownership. Every piece of your hybrid cloud architecture needs an owner.
“A key tenet in IT security is having an owner identified for every asset, and having the owner responsible for least privilege and segregation of duties over the asset,” Goerlich says. “Lack of visibility results in a lack of ownership. This means, quite often, hybrid cloud environments have loosely defined access controls and often are without segregation of duties. Excessive permissions introduce risk, and unowned risk is unaddressed risk.”
