Monthly Archive April 2018

Three stages to building a robust defence against external threats

The news has been full of concerns that foreign powers are using state-sponsored hacking as a means to undermine the infrastructure of foreign powers. While it is irresponsible to scaremonger or imply that all UK organisations are at risk from a targeted hostile cyber security campaign by state sponsored hacking, it is worth every organisation taking a moment to imagine how it might fare if it were indeed attacked and use these principles to guide their defence strategy.

At the outset, however, we must consider what we are being told. In an unprecedented joint statement last week the US Department of Homeland Security, the FBI and the UK National Cyber Security Centre warned of malicious cyber activity orchestrated by state-sponsored Russian hackers who are targeting everything from network infrastructure devices to social media and even small businesses.

In November 2017, in a speech in the defence resource debate in the House of Lords, dot com entrepreneur Martha Lane Fox, who now sits in the Lords as Baroness Lane-Fox of Soho and recently joined the Joint Committee of National Security, quoted the academic John Naughton. His theory of modern warfare discusses the use of hacking as a weapon against an enemy society, identifying Russia, China and to a lesser degree North Korea as the nations most threatening to our security.

Of course, for most organisations, it is not an international super power that threatens their security, but reward-orientated hackers looking for financial gain or valuable intelligence. The same principles, however, apply whether defending against a Russian state-sponsored hacking campaign, an organised criminal hacking outfit or a lone individual.

Firstly, the only way to build a robust defence is to identify an organisation’s weaknesses and vulnerabilities. This is done through advanced penetration testing, using a synergy of automated testing, to identify potential vulnerabilities, and manual testing to exploit and develop those weaknesses so the gaps can be plugged.

Secondly, to go a level deeper, organisations should consider Red Team engagement. This is where highly skilled and trained ethical hackers get into the mind-set of a potential adversary, using a range of tools and strategies. This enables organisations to not only identify where a potential attack might take place but also builds in a level of resilience because the Red Team will identify where future vulnerabilities may lie.

The third level of defence is perhaps counter-intuitive: it is to plan for a successful attack. Where a Retained Forensics team has been engaged, through the process of developing robust defences, they will be completely familiar with a system and, as an aspect of this, will be able to develop a strategy in the event of defences being breached. This will include the preparation and testing of Incident Response, Business Continuity and Disaster Recovery plans to ensure they are up to date and ready to swing into play at the first sign of an incident. In this way any damage and disruption will be swiftly minimised and mediated.

SRM has an unrivalled reputation in all aspects of Test and Exercise and Retained Forensics as well as delivering Red Team engagement. Our team includes individuals who are CREST ethical security testers as well as those with OSCP qualifications, having undertaken a rigorous training process to learn real-life hacking skills, helping them to think creatively and with the mind-set of a genuine hacker.

For more information on SRM’s Penetration Testing, Red Team and Retained Forensics services contact Mark Nordstrom on mark.nordstrom@srm-solutions.com or 03450 21 21 51. Or visit our website.

Read more:

How attack is the best form of defence when it comes to protecting against the rising trend in phishing and social engineering attacks

Penetration testing: man vs machine

What is Red Team engagement?

 

 

 

Cyber resilience: it’s a board level issue

The problem with cyber resilience is in the name. When it comes to managing the risk posed by potential hackers and the requirement for robust testing and defence protocols, it is often frequently parked under the responsibility of the IT department. But cyber resilience is not simply something for the IT department to worry about: it should be a cause for concern for the whole board. It is a business consideration, not simply an IT one, affecting business continuity and the bottom line as well as having the potential to damage an organisation’s reputation and the very core of its business operation.

Yet recent research by management consultancy Deloitte reveals that only one in five FTSE 100 companies share detail of their testing and online business protection plans with their boards on a regular basis. In fact, the research shows that only 21 per cent of UK Blue Chip businesses regularly share security updates with their boards.

There may be good reason for this. At first glance, providing details of their penetration testing strategy, which identifies vulnerabilities within their IT systems, may be thought to provide potential hackers with valuable information. But this outlook is simplistic. Boards and investors require the reassurance that a meticulous and robust cyber resilience strategy is in place, even though they do not, and should not, require precise detail.

A more likely reason for the low profile of cyber resilience planning is the much-publicised skills shortage of cyber expertise within organisations. Deloitte found that only 8 per cent of companies had a member of the board with specialist technology or cybersecurity experience. A similar figure applies to the number of companies that also disclose having a Chief Information Security Officer (CISO) within their executive team. But if the IT department is not equipped or does not have C-Suite influence, then there is a huge potential problem. Boards should therefore look to supplementing their resource with skilled professional expertise with the required skillset and the capability of engaging board level involvement.

This is simply applying the same resource to the IT department which other departments already have. The financial department has board level representation and external expertise in the form of professional accountancy firms. No one expects the legal department to handle all the organisation’s legal requirements; professional and specialist expertise is required. A similar level of resource should be provided when it comes to cyber security. Not only should the CISO have board-level influence, but they should be supported by experienced professionals. Cyber resilience specialists have a much wider range of knowledge and experience than just one organisation, and are able to add significant value. This is not only because they can direct expenditure to meet precise requirements, but also because they can anticipate future threats.

While IT departments may currently be adequately resourced to manage on a day-to-day basis, it is not enough to simply protect against known threats. Penetration testing must go several steps further because organisations are vulnerable to a vast range of threats which are unknown and unforeseen. Experienced professionals will use a combination of automated testing, to identify the threat areas, and manual testing to develop, explore and investigate these vulnerabilities. Only in this way can organisations have any level of defence against unknown threats.

Every member of the board has an invested interest in the development and delivery of a robust cyber resilience strategy. If in doubt, each and every member of the board should ensure that it is on the agenda at every board meeting.

SRM has an unrivalled reputation in the delivery of all types of information security, including cyber resilience. With a keen awareness of how organisations operate, our team works with minimal disruption and maximum effect, providing an outstanding level of defence. However, no one can (or should) provide total guarantees; but be assured that having a retained expert with a detailed working knowledge of an organisation’s systems, means that meticulous mitigation plans will be in place and swift remedial action taken in the event of an attack, reducing its impact and minimising its disruption.

For more information on our consultancy services see our website.

Our see our blog:

Shipping news: how to manage a ransomware attack

It’s not a question of if, but when

What is Red Team engagement?

For a no obligation discussion about how SRM can support your business, contact Mark Nordstrom on mark.nordstrom@srm-solutions.com or phone 03450 21 2151.

How attack is the best form of defence when it comes to protecting against the rising trend in phishing and social engineering attacks

The recent April 2018 Trustwave Global Security Report reveals new global trends in the world of cyber hacking; most notably a move away from smaller high volume point-of-sale (POS) hacks in favour of more sophisticated attacks on larger service providers and their corporations’ head offices, using phishing and social engineering. Attacks on corporate and internal networks increased by 7 per cent to 50 per cent. Within the corporate or franchise networks, the most common cause of compromise was phishing and social engineering which accounted for 55 per cent of attacks.

Perhaps even more alarming, however, is the reported number of breaches instigated by ‘insiders’. The latest Verizon Data Breach Investigations Report (April 2018), found that 25 per cent of all attacks are perpetrated by insiders who intentionally allow access to systems, or exploit systems themselves, for reasons of financial gain, espionage or simple misuse.

So, how can an organisation protect itself from phishing and social engineering? Or from malicious insider threats? A short term strategy would be to establish systems which regularly monitor and provide alerts in the event of attack. In this way, at least the organisation will have early warning if an issue occurs. But it is rather like bolting the stable door after the proverbial horse has already bolted, leaving a swathe of chaos, financial loss and reputational damage in its wake.

Where breaches are accidental, a strategic approach would include education. This is particularly important when social engineering and phishing attacks often target all levels within a company, including junior staff, hoping to gain data on more senior staff. This is sometimes seen as ‘CEO fraud’ which tricks senior executives into authorising fraudulent financial transactions. Everyone within an organisation must be aware of the potential risk of accidentally divulging sensitive information.

To develop a level of resilience against phishing and social engineering attacks, however, a more aggressive form of defence should be an integral aspect of any defence strategy. This would include a robust test and exercise programme, which uses a synergy of automated and manual penetration testing to identify vulnerabilities and explore these to identify specific areas of weakness. Using this approach, with the right professional guidance, an organisation will be able to anticipate and build in levels of protection.

When a breach is deliberately engineered by an organisation insider, however, these steps may not be sufficient. Given that the insider has access to privileged information about a system, they are in a unique position to develop and exploit undiscovered potential weaknesses. This is where the Red Team comes in.

Red Team engagement provides real-world attack simulations, designed to assess and significantly improve the effectiveness of an entire information security programme. This is achieved through a combination of simulated social engineering attacks; both physical and technical, as well as network and application attacks developed specifically for an organisation and delivered by highly trained ethical hackers. The benefit of this approach is that it allows organisations to validate their protection, monitoring and response solutions.

SRM has an unrivalled reputation in all aspects of Test and Exercise as well as delivering Red Team engagement. Our team includes individuals who are CREST ethical security testers as well as those with OSCP qualifications, having undertaken a rigorous training process to learn real-life hacking skills, helping them to think creatively and with the mindset of a genuine hacker.

To find out more about SRM’s Test and Exercise services (including Red Team) visit our website.

See a recording of our webinar ‘GDPR: the roles of manual and automated penetration testing’

Or see our blog:

Penetration testing: man vs machine

What is Red Team engagement?

If prevention is to be an achievable goal we cannot rely on static defences

Or contact Mark Nordstrom at mark.nordstrom@srm-solutions.com or on 03450 21 21 51.

SRM Blog

SRM Blog