Magazine menu Close Magazine menu

Author

David Strom

David Strom is an experienced computer industry journalist with a body of work that includes two computer networking books and running the US editions of Network Computing and Tom’s Hardware magazines. He currently curates the Inside Security newsletter and writes for CSOonline.com

Get in touch with David

Latest stories by David

great collaborations

Despite all the cool tools, tech collaboration is still missing something

  • Leadership
  • min read
    • Since the pandemic began, organizations have been working hard on how they collaborate. But something's still missing, and it's to do with people. Looking at successful tech and creative collaborations of the past, common trends emerge. Any organization can use these to kickstart better collaboration within and between their teams. 1.   Make partnerships bigger than their parts Perhaps the most impactful partnership right now involves big pharmaceutical companies working together to create COVID-19 vaccines. Harvard Business Review also looked at lessons learned from thousands of Chinese companies adopting more open data architecture to help scale up medical supplies production. There are other examples too. Rival payment vendors Alipay and WeChat worked with the Shanghai government to develop a QR-code based tracking system adopted by 10 million users in just six weeks. 2.   Look for driven and imaginative leadership The Unabomber was a terrorist who bombed some 16 targets across the US from the 1970s until his capture in 1996. The recent Netflix series on the hunt for the Unabomber shows how driven and imaginative leadership allowed the FBI to organize the huge investigation that ultimately identified and caught the perpetrator. A crucial piece in the puzzle was the decision to use a little-known investigative tool at the time, forensic linguistics, to profile the killer and link a suspect to the bomber's messages through his writing. 3.   Combine people with complementary skills A remarkable feature of the collaboration of the UK's famous Bletchley Park World War II code-breaking group is they worked together without knowing what each other did. The set of computers known as Colossus flawlessly executed a complex and precise series of steps. And while the Enigma machines get much publicity, the real challenge was a more complex German High Command code called Lorenz. The innovative team was assembled by recruiting civilians through difficult crossword puzzles placed in newspapers. Another great example is the team that created the Ford Mustang, as chronicled in 2015 documentary A Faster Horse. It's all about a group of engineers and designers working together to solve a specific problem. 4.   Involve everyone in generating and executing ideas Member of surreal British comedy group Monty Python, Eric Idle, says the whole Monty Python team wrote their skits before they cast them. It meant no one would be personally invested in an idea before the group could fine-tune it. Many collaborative efforts depend on a solid process of idea creation and development. Real-time online writing and editing tools like Google Docs can facilitate these efforts when you're not working face-to-face. 5.   Use active learning and group training The US Army now recognizes soldiers must protect their digital networks and repel cyber invasions. They recently created a cyber workspace near Augusta, Georgia, called Tatooine. The name refers to the planet where Star Wars' Luke Skywalker spent time in the early movies. Initially, it will focus on drone detection, active hunting of cyber threats on Department of Defense networks and designing better training systems for cyber soldiers. They're also building great partnerships between military and civilian resources, for example, the successful Hack the Army bug bounty program. 6.   Use communication and collaboration tools effectively Many of these teams worked together before the digital age, using basic communication tools. We're now blessed with email, real-time messaging apps, video chats and more. But these blessings are also a curse if misused. I've previously written about the signs you're not using communication tools effectively. The history of collaboration has been one of fits and starts. While we keep making the same mistakes, there are signs of hope as new digital collaboration tools help us over some of the hurdles. I hope you'll find these examples an inspiration for your future collaborations.
inhouse vs outsource SOC balls boat

What to consider before launching a security operations center

  • Business
  • min read
    • You have some big decisions to make if you're thinking about launching a security operations center (SOC). Some you can easily scope out in advance, but others need further thought. Let me take you through the process and highlight the potential outcomes. How does a security operations center differ from a network operations center? First, you should understand the difference between a SOC and a traditional NOC (network operations center.) NOCs are mostly concerned with keeping the packets flowing through the digital pipes and finding and removing blockages. SOCs extend this basic "plumbing" and ensure that the right packets end up in the right places, and look for inappropriate situations. For example, A NOC would be concerned about abnormal network latency reports, while a SOC might see a rogue endpoint obtain elevated access rights and use lots of network resources that could be causing poor latency. A SOC and a NOC may display a different response to seeing a false positive: Within a NOC, it isn't usually triggered as an issue as its purpose is to send alerts about whether the network is working or not. With a SOC, it could show your infrastructure has been penetrated. Decide whether to build or outsource your SOC The biggest decision in launching a SOC is to decide whether to buy or outsource. Both scenarios have lots of complexities in the decision process and eventual outcome. To build, you can create a physical SOC that sits inside your facilities. For buying, you can use a SOC-as-a-service (SOCaaS) vendor. Sitting in between these two positions is the option to use a managed security solution provider (MSSP). Some MSSPs provide equipment for you to install on-site, others manage everything from their SOC using cloud services. This middle ground could be a good starting place to evaluate your experience before transitioning entirely into a SOCaaS. This can be a good option as you may not understand the entirety of what you have to outsource. Having an MSSP can give you a "SOC-lite" with some managed services and some feedback on security issues without having to completely outsource everything from the start. If you don't yet know the right questions to ask, the MSSP route can give you more context. The origins of SoCaaS vendors Part of the reason for the complex picture: SOCaaS isn't defined consistently from vendor to vendor. It's partly because of the different origins of these vendors: some started as MSSPs, others as specialized managed detection and response vendors, or event or endpoint management providers. Some SOC vendors began life as the services group and subsidiary for a major computing firm or telecoms company selling managed NOCs (e.g HP, IBM and Dell) before moving into the SOC world. In other cases, cybersecurity consultants and solutions providers are developing SOC-like services and frameworks. These origin stories matter because they create an expectation as to the strengths and proprietary technologies that each vendor uses, and also for you to characterize them when you start shopping around. And shop you must – it's a highly fragmented market. Gartner reports that the top MSSPs are IBM, AT&T/AlienVault, Atos, Dell Secureworks and DXC Technology – yet none of them have greater than five percent market share. How to evaluate SOC-aaS vendors The first question you need to define is also the hardest – what are your requirements? From this you can work out your budget and what you will need to purchase first. It's hard, partly because the cloud-based providers always have complex usage-based cost calculations (think pricing an AWS server.) And many of them don't provide any details on their pricing before you engage them for services, or at least sign a non-disclosure agreement. Some of the smaller vendors have fixed monthly fee contracts based on the number of services you consume. When I reviewed a collection of providers, estimates were all over the place, differing by several orders of magnitude. Vendors should be more transparent on costs up front. If you are considering building your own SOC, first compare what the outsourcers will charge, then see if you can make a business case for using that investment to host your SOC in house. Part of the pricing problem: you might not know how many servers or endpoints (or whatever you're protecting) you will initially need with your SOC vendor. You could start small, with a proof-of-concept, and see how the vendor produces reports and interacts with your staff on problems or traffic issues. Planning what services you need Once you get beyond the fee calculation, your next issue is understanding your resources, including the people and tools they need to do their jobs to manage your security and the SOC itself. You might not have the skilled staff to handle incident response, threat hunting and operations management. This might tip the scales towards having a SOCaaS rather than building your own. You'll also want to understand what kind of coverage you'll need. If you operate a global online business, you'll need 24/7 monitoring, and you'll also have to have your staff available at all hours too. You might want a vendor that has multiple physical SOCs on different continents so you can ensure there will be someone somewhere in the world who will be watching your networks from different parts of the world. This multi-zone approach can also expose difficulties that may be faced with latency or accessing your website. Part of your resource evaluation is also in understanding who is staffing the outsourced SOC? What kind of training is required to work there? How many people are on duty on the overnight shifts? Do you have a lead analyst at your provider that you can contact in case of an emergency? Is the vendor's staff managing alerts or are they doing the actual nuts-and-bolts security analysis and providing recommendations on your response and remediation? You'll also want to consider what you're trying to accomplish: Do you want timely breach notifications? Are you deciding to forgo any full-time staff hires or trying to save on new capital equipment? Then comes geography. Where is your equipment, staff, and the actual SOC physically located? If your offices are mainly in a metropolitan area, you may want a SOCaaS vendor who has a secondary office located elsewhere in case of a major disaster (like earthquakes, hurricanes or a tsunami) that could take down your local area's connectivity. Finally, you'll want to define the various component services for your SOC, such as security event management or threat monitoring and detection. Log analysis, vulnerability management and incident response are all necessary and you'll need them eventually, so plan accordingly to be able to scale. Look out for these warning signs It's a good idea to do a proof-of-concept before a full rollout of your SOC. Before you choose your vendor, be alert to these warning signs from a study about improving the effectiveness of SOCs. No similar customers The vendor isn't aligned with your business or doesn't have other customers of similar size, market penetration or type of business. Incompatibility Your legacy event management and service desk systems are compatible with what your SOC vendor provides, and you have to switch to some other system. No visibility You don't have visibility or control over your essential network functions and conditions. Staff frustrations You have high turnover with your security staff and low job satisfaction and high-stress levels. False positives Your SOC is chasing too many false positives and not closing these cases. How to get started With increasing volume and severity of threats on the doorstep of companies of all sizes, now is the time to start planning if your current NOC is going to be enough or if it's time to upgrade to a SOC. According to Artem Karasev from Kaspersky: Good luck with establishing your SOC!
picking right tech

When there’s too much choice in tech, get your focus right

  • Business
  • min read
    • We have too much tech and too much choice. Many of tech's challenges are in choosing the product, and only afterward realizing its limitations and the consequences of our choice. I understood this only recently, after working in tech nearly 40 years. I don't know why it's taken me so long to make this brilliant deduction. I enjoy helping others make these choices. Almost every day, I'm either writing, researching or discussing tech choices for others. But just as the shoemaker's children go barefoot, my own tech choices are often fraught with indecision, or worse, no decision. It all rests on human foibles Yesterday, I was on a phone call with a friend who is as technical as they come. He helped create some of the internet's early protocols – ways transferring data between networks that more or less create the internet. We were commiserating about the quirkiness of the video conferencing application Webex when trying to support a hundred-person conference call. It's fine for the video conference itself. The video and audio quality are usually solid. But the 'soft support' rests on the foibles of how humans use tech, like holding a practice session for the conference, notifying everyone of the call and sending out the slide deck. It's real work to explain what to do to organizers and how to create standards to make the call go smoothly. Learn from the 1980s' portable PC wars Let's draw a dotted line back to when I worked in the bowels of the end-user IT support department of Gigantic Insurance in the early 1980s. We bought PCs by the truckload to place on the desks of thousands of IT staff who, until then, had a telephone and, if they were lucky, a mainframe terminal. We bought IBM PCs because back then because that was the only choice for corporate USA. Then Compaq came along with something IBM didn't yet have: a portable PC. Well, sort of portable. It was enormous. It weighed about 30 pounds (14 kilograms) and didn't quite fit into airplane overhead lockers. When Compaq announced their portable PC, selling for more than $5000, our executives felt conflicted. Our IBM sales reps, who had invested many years in golf games with them, were trying to convince us to wait for a year until the IBM portable PC would come to market. But once we got our hands on the IBM prototype, we could see the Compaq was superior. It was already available. It was lighter, smaller and ran the same apps. We recommended Compaq and started buying them in droves. That was the start of the 'clone wars' that unleashed a new era of technology choices on the corporate world. By the time IBM finally came out with their portable PC, Compaq had improved theirs again, so they kept ahead of IBM. It's why we get frustrated when we finally choose our technology and then live with the consequences. Knowing which questions to ask How does this apply to buying business cybersecurity products? Many of us are still looking at the wrong things when deciding what to buy, or don't know which questions to ask. Know what problem you want to solve, and you'll choose your tech differently. Here are some common examples. Have you picked an email encryption product or VPN based on something other than ease of use? Don't be surprised when your staff rebel against using them. Are you running regular phishing awareness programs and cybersecurity training across your business? Phishing is one of the most destructive attacks, and getting users to understand their behavior is risky is the best prevention. Have you recently tested your disaster recovery procedures to find out why your backups don't protect key data elements? Don't wait until you have a ransomware situation to find out you missed a collection of files. Spend the time now to find these and ensure they're well protected. Can you find out if your cloud storage is secure enough? Do you even know which clouds you're using? Do the hard work now rather than waiting for something bad to happen. Have you examined your whole software supply chain? It's easy to overlook a few spots and then suffer data loss, ransomware or denial of service attacks. You might find personal Github pages, or resellers running tools whose security you can't easily verify. The time to work this out is now. Going beyond the specs means taking a step back and throwing out assumptions. Before you start looking at solutions, do the hard work of understanding the problem you really need to solve. This article reflects the opinion of the author.

How can we solve the crisis in trust in business?

  • Opinions
  • min read
    • "There is a crisis of trust in American democracy." So begins a 2019 report from the Knight Commission on Trust, Media and Democracy organized by the Aspen Institute. It lays blame on the nation's political discourse, racial tensions, and the technology that gives people greater access to commentary and news. The report concludes that since 2018, "unwelcome facts are labeled as fake." Rising cybercrime reduces trust Part of the problem with trust in the technology industry has to do with the ease cybercriminals now have to ply their trade. Once relegated to a dark corner of the internet, now many criminals operate in the public view. On the dark web, you can buy various pieces of technology such as ready-made phishing kits to seed infections, carders to collect credit card numbers, botnets and web stressors to deliver DDoS attacks, and other malware construction kits that require little to no technical expertise beyond clicking a few buttons on a web form. A 2019 report from CheckPoint shows that anyone who's willing to pay can easily obtain these tools. Forget 'software-as-a-service': we're witnessing the growth of the 'malware-as-a-service' industry. At a recent RSA forum in London, UK, I interviewed numerous experts who've spent their careers examining cybercrime and understanding how to combat fraud. It was a somewhat sobering picture, to be sure. RSA's president, Rohit Ghai, spoke about how the largest facet of risk today is digital risk, and how businesses need to better integrate risk management and cybersecurity methods. "This is a team sport: security, IT, operations and risk groups all need to work together," he said. "Our goal is not just about protecting apps or data, but about protecting our trust assets. We trust strangers to share our homes and cars because tech brings us together and drives the sharing economy." Ghai believes we need to replicate this trust system in the B2B world, just as Airbnb and Uber have done for consumer-based businesses. Trust at an all-time low? Ghai agrees with the conclusions of the Knight Commission report: trust is at an all-time low. Some have become so distrustful of our digital lives that we now have a new acronym, LDL ('let's discuss live'). But we can't, and shouldn't, turn back the clock to the analog era: we need to be able to trust each other again to fuel our growth. He mentioned that to be trustful, "an ethical company should do the right thing, even if no one is observing them." I liked that idea: too often, we hear about corporations that are causing damage, like polluting our environment, before denying any responsibility, or worse, covering up the details when they get caught. Part of the challenge for IT professionals is that cybersecurity is really a business problem, not a failure of technology. "Breaches and intrusions will occur," says Ghai. "We have to move beyond the shame of admitting a data intrusion and understanding its business impact. Our goal should be maintaining 'cyber-wellness', not trying to totally eradicate threats." Taking better care of customers' privacy is also good for business, as numerous reports have concluded recently. Almost half of the consumers surveyed believe there are ethical ways companies can use their data. How much do you value your data? Another issue is that what we say and what we actually do about maintaining our digital privacy is often at odds with each other. In a 2017 MIT privacy experiment, they found that student participants would quite readily give up personal data for very small incentives, such as a free pizza. And the same casual value exchange played out when Kaspersky offered up freebies in exchange for personal data in this storefront stunt. This dichotomy is seen even with IT security pros. Another survey by Yubico found that more than half of IT managers who have been phished have still not changed their password behavior. If they don't change to improve their own personal security, who will? The same dichotomy can be said about transparency: sadly, there are few companies who are actually as transparent as they claim, either by wilfully misleading the public (Facebook is top in this regard) or by just doing a poor job of keeping their IT assets under appropriate controls (British Airways is a prime case study here). Trust is fragile Where do we go from here? Security expert Bruce Schneier says that trust is fragile, and transparency is essential to trust. The Knight Commission report carries a series of recommendations for journalists, technology vendor managers and ordinary citizens. Recommendations include being better at practicing radical transparency, for journalists to disclose information sources as a rule, and making social networks step up and take responsibility for protecting their users. I hope we can implement many or all of them to make for a better, mutual and trusted future. All of us need to work together if we want to turn this around and improve customers' trust in business. This article represents the personal opinion of the author.
janitor cleaning an office

If we do our job, nothing happens

  • Trends
  • min read
    • There is a line in a 2019 keynote speech by Mikko Hypponen, the CRO of F-Secure that goes something like this: "If we do our job in cybersecurity, then nothing happens." It's so true and made me think of the times when various corporate executives challenge their investments in cybersecurity, wanting to see something tangible. Hypponen made this point by asking the audience to look around at the conference room where these conversations are taking place, asking them if it's cleaned to their satisfaction. If so, perhaps they should fire their cleaning staff, because they're no longer needed. Cleaning up the virtual dirt Now, the difference between your security engineering staff and your cleaners is obvious. You can't see all the virtual dirt and digital clutter that's building up across your network, the cruft of old software that needs updating and polishing, and the garbage that your users download onto their PCs that will leave them susceptible to attack. And that's part of the problem with cybersecurity: most things are invisible to mere mortals, and even specialists can't always agree on the best cyber-hygiene techniques. Most of us have an innate sense that mopping the floor before dusting the shelves above is the wrong way to go about cleaning the room. That's because we all understand (at least on a basic level) how gravity operates. But when it comes to cybersecurity, should we be changing our password regularly (some say yes, some say nay)? Or using complex strings of a certain length (some say 10 digits is fine, others say longer ones are needed)? Be prepared for a breach Hypponen ends his talk by saying that we must assume that we're all targets for someone, whether they're a hacker who's still in high school, or an international spy that's eager to get inside our company's network. He says: I agree completely. We must get better at seeing the virtual dirt on our networks. Building a better or bigger wall won't stop everyone and will just foster a false sense of cyber-immunity. And just because nothing happens, this doesn't mean that cybersecurity folks aren't hard at work. They're the cleaners we don't ever see, unless one day they fail to clean up. This article represents the personal opinion of the author.
how to ransomware factory

Ransomware: The common attack you can stop in its tracks

  • Cybersecurity
  • min read
    • Holding a business's systems and information for 'ransom' is an increasingly common form of cyberattack. Kaspersky research shows this type of malware attack has risen 25 percent in the past three years. Verizon's investigations agree. Their 2019 Breach Investigations Report notes, "Ransomware has become so commonplace that it is less frequently mentioned in the specialized media unless there is a high-profile target." This 'so common it's boring' phenomenon means ransomware can slip off the radar. Now's the time to plan for what your business will do to prevent and handle these common attacks. What is business ransomware? It's not those spam messages that claim to have your personal data. Ransomware is a sophisticated attack that involves a series of steps. First, a cybercriminal finds a way into an endpoint, usually using social engineering or phishing to get account credentials, or by infecting a USB memory stick. Next, they insert malware, which encrypts files and directories. Finally, the malware warns the user their machine is infected and demands a ransom to decrypt data. The attacker has often studied the target's infrastructure to understand which databases and directory services are most critical. They tie together malware products and hack in a determined order. Attackers not immediately paid now sometimes publicly post data they've taken. Industries especially vulnerable to ransomware Breach by ransomware is not usually an isolated incident. Often, there have been a series of IT security errors or less-than-ideal practices. If your business isn't offering enough cybersecurity awareness training or you have delays in patching and system updates, your risk may be higher. High-profile ransomware attacks Cybercriminals have used ransomware to attack some prominent organizations in recent years. Worming the data away Estimated to be the most costly ransomware attack to date, NotPetya (also known as ExPetr) hit both Maersk and FedEx, taking down their systems for weeks. It worked by way of a worm that wiped data, causing hundreds of millions of US dollars of damage. Now you see it; now you don't File-encrypting ransomware LockerGoga attacked Norwegian aluminum and renewable energy company Norsk Hydro. The malware had advanced features such as deleting itself when it detected virtual machines to prevent researchers analyzing it. Norsk Hydro said their good backups meant the attack wasn't as bad as it could've been, but it still cost them around 90 million US dollars. A tale of 174 cities, and counting Ransom attacks on city governments are on the increase. In 2019, cybercriminals attacked some 174 municipal organizations with ransomware – about 60 more cities than the year before. The City of Baltimore suffered two attacks in 2018 and 2019 that together cost an estimated 18 million US dollars. One of the Baltimore attacks took down the city's emergency response dispatch system. Not all patients recover Californian healthcare provider Wood Ranch Medical announced it was going out of business in late 2019, as a direct result of a ransomware attack. The ransomware had encrypted both patient records and backups. How to avoid a ransomware attack 1.  Have the right tools to understand your vulnerabilities Your IT security practice needs tools to investigate what happened in an attack and what parts of your infrastructure need updating or replacing. Are you running a rogue app or access point? Do you have unmonitored and open network ports? Are privilege escalations being tracked? Are they expected and appropriate? Understanding root causes like these means you can know your defensive posture (the security status of your networks and information, and your capability to defend it and react to changes) and monitor your incident response. 2.  Be vigilant about patching and installing updates Attackers now scour the internet looking for outdated servers and applications. Many ransomware attacks happen within days of discovering a vulnerability. To delay is to invite exploitation. Make sure your patching program covers all endpoints, both on-premises and in the cloud. 3.  Regularly test your data recovery and emergency response procedures Back up critical data and ensure backups are intact and recoverable. Practice recovery and develop the correct order for restoring data. Identify your most valuable assets and make sure they're backed up. Regularly review the list to make sure you haven't missed something. Data backups and recovery drills should be the start of an overall emergency response plan. The plan should include regular, scheduled practice exercises, both 'table top' (organized meetings with role-playing) – to iron out organizational issues, and attack simulations – to find weak links and show-stoppers that could prevent infrastructure coming back online. 4.  Start or improve your cyber awareness program and improve your overall password portfolio Weak passwords might have caused a third of 2019's ransomware attempts. Conducting regular cybersecurity awareness training helps users improve their password hygiene. Install a business-wide password manager or single sign-on tool, and put in place multi-factor authentication (MFA) for users handling private data and money-related tasks. What to do if ransomware hits your business By strengthening your cybersecurity, you'll make it harder to be held to ransom. But you can do your business a favor by planning for if it happens. 1.  Plan alternative communications Ransom victims are often immobilized because communications like corporate email, phone calls or texts may not be available. Include using alternative communication such as WhatsApp, Skype and group SMS as part of recovery drills, but bear in mind these systems may be less secure. 2.  Decide if you will pay a ransom The case for paying In the US, the FBI has softened its earlier "don't pay, ever" position in its most recent guidelines. Two cities in Florida voted to pay ransoms of 500,000 to 600,000 US dollars – likely less than the cost of restoring its systems. The case against paying Your attacker may not honor their promise. You may receive further demands. The virus may already be installed in your system. While the term 'ransom' suggests physical threat, unless you're operating critical care facilities, it's unlikely ransomware will lead to loss of life. And it may be cost-efficient the first time, but it increases the likelihood you'll be hit again. The No More Ransom project, whose members include Europol and Kaspersky, advises those attacked with ransomware not to pay. It works to reduce ransomware's impact by providing free decryption tools. Despite the growing threat, with tight security and planning, you can avoid the worst impacts of ransomware, or even getting hit in the first place. Understanding ransomware's dimensions and having regular planning exercises will mean you'll know your protective measures are up to scratch. This article was published in March, 2020.
by Innovating leaders.
Innovative tech.
About Secure Futures

Secure Futures magazine is your go-to business guide for opinions, trends and insight into the world of technology and cybersecurity. We help your business to bring on the future. Brought to you by Kaspersky, the global cybersecurity experts.

  • For all other countries