Ransomware is set to boom [0] and cyber-security is now part of our National Security Plan.
Upd: Gartner has a report on CyberInsurance. Mandiant will give you complimentary copy.
Businesses now have to secure their computers and data just as they secure their premises and goods.
Ask yourself this: "If my computers were destroyed, how long could I continue the business? At reduced capacity or at all?", then act accordingly.
The Internet is defined by its explosive growth: A few For-Profit hackers have noticed Business Ransomware is an ideal way to monetise remote computer attacks & exploits.
Expect these attacks to double every few months now. In a year they will be endemic.
Every business that can raise $5,000 and relies on its systems and data for daily operations is now in their sights.
If you haven't taken adequate steps to protect your computer systems and data, your general insurance company may refuse claims of damage now, certainly in the near future. Expect Data Insurance and Computer Security Assessment businesses to come knocking on your door looking to sign you up.
Vendors will promise "golden bullets" to solve all problems, but you, as the owner of the business, have ultimately responsibility for opening the doors and trading, they don't. It's your business, not theirs, on the line: act accordingly.
The Prime Minister has released a new Security Policy and cyber security, for both Government and Private sectors, is seen as a crucial on-going activity. [1] [2][3]
At least 70% of the cyber intrusions the Defence Signals Directorate [DSD, responsible for Govt. cyber-security standards & some operations] responded to in 2012 could have been prevented if organisations had implemented the top four of the mitigation strategies (listed below), up from 70% in 2009 [4].
The government also neatly divides cyber-attackers into four categorises, but in business your focus has to be on the money: For-Profit attackers. [5]
If you read and apply DSD's "top 35 mitigation strategies", noting nothing is 100% safe from all attacks, there are still some things you need to be doing. Good Security is never "static" but active, you have to be doing more than put in place "protection". [4]
- Your Business is Your Data.
- Don't just do backups, practice restores and actively check your data is complete, correct and consistent.
- Hardware is Cheap.
- Have some laptops pre-built as replacements for all operational systems. Slow service is far, far better than no service.
- Not Everything should be connected to the Internet.
- For-Profit hackers won't bother trying to get past "air-gaps" onto isolated networks. Traffic segregation and Network segmentation are cheap, powerful security techniques.
The Gold Coast medical practice that lost its records had been compromised two weeks before their files were encrypted and a ransom demanded. The hackers turned off the daily backups and nobody noticed.
Otherwise, they were a model business. They had just upgraded their firewall, ran separate servers, had security experts setup and administer their systems and religiously did backups. They definitely would've complied with the "top 4" DSD recommendations, probably all in the "top 35".
Nobody had thought to tell them that "whilst backups are done, only restores are ever requested". They, like most businesses, didn't actively check their precious data, just assumed "it worked once, so what could possibly go wrong?".
Here is a simple strategy for small businesses, especially Healthcare-related high-value targets:
- Add another layer to you backups, snapshots over the network. Never rely on just one method or copy of your data.
- Find someone that cares about the business and integrate checking backup data into their daily schedule. Checks can never be "make work", they have to be real, useful tasks. [6]
- Practice your Business Continuity procedures regularly and completely in Drills.
- Perform regular Post Drill Reviews to Refine your Process and Documents [7][8].
A friend whom I convinced to run his practice on an isolated computer did his backups to a rotating set of USB Flash drives. The only extra step he needed was to have his partner, not himself, restore a backup onto a spare laptop and check totals and summaries.
But wait, there's more...
Having done all this you will have a reasonably secure systems and very robust Business Continuity processes to take Internet exploits in your stride.
There are three other important strategic areas of Security you need to consider and address.
- Monocultures [9]
- If everyone runs the same O/S and Software, it's Nirvana for attackers.
- Insider Attacks
- Attacks from the Internet are a rising threat and not to be ignored, but people already working for you, doing their authorised work have more potential for fraud and damage.
- Vendor Compromise: if attackers plant "backdoors" in your software, you're gone. [10]
- If Sony can foul up and send out compromised software, anyone might if they aren't actively checking.
- Now is a good time to ask all your Software Vendors if they are covered for Contingent Liabilities caused by their negligence or inadequacy in releasing compromised software.
If your current I.T. support doesn't agree or can't supply those services, you need to be seeking a second opinion.
After all, what have you to lose but your entire livelihood and investment?
Appendix 1.
A simple Backup/Continuity strategy for small businesses, especially Healthcare-related high-value targets:
- Add another layer to you backups, never rely on just one method or copy of your data:
- store critical data on a network device with automatic, continuous or periodic backups (or "snaphots") to an off-site device.
- For extra-credit, provide a dedicated link and very restrictive firewall for just this purpose at both ends.
- Find someone that cares about the business and integrate checking backup data into their daily schedule. Checks can never be "make work", they have to be real, useful tasks.
- Nobody cares more about a business than an owner.
- Nor can risk be delegated or outsourced.
- Print or view from the backup daily summary reports of all accounting and line-of-business transactions (sales, consults, patients, work dispatched).
- Look for and investigate small errors, they are meaningful. Computers don't "just make mistakes", one of the best documented international hacking/espionage cases came from a diligent administrator looking into a minor discrepancy. [6]
- Practice your Business Continuity procedures regularly and completely in Drills.
- Safely turn-off or disconnect all your regular systems and equipment, then try to restore normal operations.
- For many people, stopping and restarting normal operational systems is a challenge in itself.
- You need to time how long individual things take.
- You need a meticulous, independent "note taker" in every main area of activity, because later on you'll construct an exact timeline as part of your Post Drill Review.
- You have to assume "9/11" conditions:
- assume "the experts" along with all the equipment are unavailable.
- only ordinary staff run the Data Drill and only from the written instructions.
- Phone support is allowed, just not to "the I.T. expert".
- After you're back on-line, collect all notes and hold for the Review.
- Perform regular Post Drill Reviews to Refine your Process and Documents [7]:
- Owners need to be present, but not necessarily for the whole exercise.
- The outcome of the review is for the benefit of the Owners.
- If the Owners aren't committed to the process and willing to personally pursue the changes needed, the Drills and Reviews should be skipped.
- Review leaders have to be independent and skilled to encourage full and frank disclosure.
- Staff must be able to speak openly, critically and without fear of consequences.
- Even the best Employer-Employee relationship has "no go" areas that you need to find a way around to discover important information.
- After the first one or two Reviews, you might run them yourself, only having paid Consultants back every year or two to keep you on-track and refresh your process.
- What worked?
- What didn't work?
- Use the classic Ishikawa categories to help.
- People, Management, Method, Machines, Materials, Maintenance, Measurement and Environment. [8]
A friend whom I convinced to run his practice on an isolated computer did his backups to a rotating set of USB Flash drives. When one failed, he replaced the set. The only extra step he needed was to have his partner, not himself, restore a backup onto a spare laptop and check totals and summaries. With his low turnover, weekly or monthly would've sufficed. I looked for storage appliances that supported encrypted "snapshots" and secure access for him, so he and a business peer could be off-site backups for one another, but at the time none were available. He was interested and willing if I could find him something in the $500 bracket.
Appendix 2.
Three additional important strategic areas of Security you need to consider and address.
- Monocultures [9]
- It wasn't a virus that caused the 5-year long Irish Potato famine in the mid-1800's, but the lack of diversity. Only one variety of potato was planted, when an infection arose, it spread everywhere, quickly.
- Most PC's and servers in small business are Microsoft based. Because they're popular, this is what hackers target. If you arrange to run your software on other systems, even as Virtual Machines, you will immediately reduce your desirability for attackers and increase the tools at your disposal for Intrusion Prevention and Detection.
- Pharmacies and Medical Practices in Australia overwhelming run the same practice software. Practices that choose other software immediately greatly reduce their chances of being compromised: For-profit attackers make sensible commercial decisions on where to use their resources and what/whom to target.
- Insider Attacks
- Attacks from the Internet are a rising threat and not to be ignored, but far from the only threat.
- The highest impact and value attacks come from people within the system, doing what they are trained and authorised to do.
- Sometimes these people may not be on-site or even work for you: the staff of consultants, supplier, database suppliers and vendors may all potentially defraud you.
- It could be as subtle as a common database of claimable items and values being manipulated.
- Proof of this is the all too frequent media reports of Bank employees being detected and charged with significant fraud/theft, often going back many years.
- What we never hear of are those thieves the Banks detect but don't charge.
- There is extensive anecdotal evidence that large institutions prefer to learn from successful exploits and theft: perpetrators can be given indemnity if they teach the full exploit to the corporation, along with how to detect and prevent it.
- In the mid-70's, their were rumours that operations/administration staff who discovered and exploited security flaws would move from Bank to Bank running the same exploit. Because corporations aren't required to release or share Security information, even anonymised and historical, this attack is entirely plausible and hence has to be assumed effective and done.
- There is no defence against this sort of attack, only vigilance and good systems that will detect it sooner rather than later. This is why Accounting does Audits and normal practice is to require two independent people be needed for payments and authorisations.
- Vendor Compromise: if attackers plant "backdoors" in your software [10]
- If your Vendor has inadequate security processes and procedures and is compromised, attackers can use them to get access to your systems.
- Done well, you and they might never know, or at least only find out on "Zero Day" when everyone has their bank accounts drained at once and hard disks wiped.
- Vendors with dominance in any market segment are prime targets for these attacks.
- Why would a For-Profit attacker attempt to compromise 3500 Medical Practices individually when they can just take over one Vendor and own everyone else.
- This isn't a theoretical risk. In 2005 Sony released a new feature on CD-ROM drives to automatically delete pirated music. Unfortunately, they'd let a virus, a rootkit, get into their software, presumably undetected. [11]
- While all attacks can't be defeated, Vendors need to take extraordinary measures to prevent and detect backdoors being silently inserted into their code.
- In the current environment, I'd expect all Healthcare and related Software Vendors to supply statements by Independent Security Testers and Auditors on their Policies, Procedures and Practices.
- And proof of some sort of Indemnity Insurance against Contingent Liability claims from all clients.
- If your working Bank Account is drained
- and you're off the air for a week or two,
- and you've had to pay for teams of consultants to recover and clean your systems,
- that's a lot of money per individual claim.
- If they have 3-4000 clients each demanding $1-5M are they insured for that and can the Insurer cover the full amount?
- Now is a good time to ask all your Software Vendors if they are covered for Contingent Liabilities caused by their negligence or inadequacy in releasing compromised software.
Links
[0] My previous piece on Healthcare-related businesses as "soft" targets.
[http://stevej-on-it.blogspot.com.au/2013/01/security-healthcare-systems-are-soft.html]
[1] Strong and Secure: A Strategy for Australia's National Security [http://www.dpmc.gov.au/national_security/national-security-strategy.cfm]
PDF 3.44MB: Strong and Secure: A Strategy for Australia's National Security
[2] Australian Cyber Security Centre. January, 2013.
[http://www.pm.gov.au/press-office/australian-cyber-security-centre]
A new Australian Cyber Security Centre will be established in Canberra to boost the country’s ability to protect against cyber-attacks.[3] Gillard vows to fight 'malicious' cyber attacks
Already around 73 per cent of Australians use the internet more than once a day. Australians’ use ;of cyberspace is estimated to be worth $50 billion to our economy, with the rollout of the NBN only expected to accelerate these changes.
Yet Australia’s cyberspace is subject to threats:
Securing and protecting our networks, and ensuring confidence in the online environment, is pivotal to Australia’s economy.
- In 2011-12, there were more than 400 cyber incidents against government systems requiring a significant response by the Cyber Security Operations Centre.
- In 2012, 5.4 million Australians fell victim to cyber crime with an estimated cost to the economy of $1.65 billion.
[http://www.abc.net.au/news/2013-01-23/gillard-national-security-strategy/4480448]
- 2011-12 saw a 27 per cent increase in the number of 'cyber incidents requiring a significant response'.
- The Federal Government spent 80 million on cyber security in 2011-12.
[http://www.dsd.gov.au/infosec/top35mitigationstrategies.htm]
PDF: 700KB http://www.dsd.gov.au/publications/Top_35_Mitigations_2012.pdf
At least 85% of the targeted cyber intrusions that Defence Signals Directorate (DSD) responds to could be prevented by following the first four mitigation strategies listed in our Strategies to Mitigate Targeted Cyber Intrusions:[5] Speech by Director Defence Signals Directorate, 26 February 2010
- use application whitelisting to help prevent malicious software and other unapproved programs from running
- patch applications such as PDF readers, Microsoft Office, Java, Flash Player and web browsers
- patch operating system vulnerabilities
- minimise the number of users with administrative privileges.
[http://www.dsd.gov.au/speeches/20100226_nsa_ddsd.pdf]
We judge that the cyber threat comes from a wide range of sources, representing a broad range of skills and varying levels of sophistication. They include:[6] The Cuckoo's Egg: Tracking a Spy Through the Maze of Computer Espionage , by Clifford Stoll.
- individuals working alone;
- issue-motivated groups;
- organised criminal syndicates, as well as
- state-based foreign intelligence services.
[http://www.amazon.com/Cuckoos-Egg-Tracking-Computer-Espionage/dp/1416507787]
Summary of "The Cuckoo's Egg" on Wikipedia. Broad strokes only. The book is well-written and very readable, if a little idiosyncratic as you might expect from an Academic Astromoner-turned-Administrator.
[http://en.wikipedia.org/wiki/The_Cuckoo's_Egg]
[7] Project Retrospectives: A Handbook for Team Reviews, by Norman L. Kerth
[http://www.dorsethouse.com/books/pr.html]
This is the definitive guide to running the many types of "Reviews" and makes a case as to why what happens after a Project (or Event/Drill) is more important than anything: you get to learn and develop a corporate memory.[8] Wikipedia has a very basic overview of Ishikawa "Fishbone" diagrams. They may or may not be useful, but his Quality Improvement questions are as good as it gets.
Many might first think this approach is too "touchy-feely".
Quality Improvement and its twins, Performance and Cost/Efficiency Improvement, are solely based on People Learning and Changing what's done. If People are involved, then at some point Change will require "touchy-feely" work, something many people find confronting or uncomfortable.
[9] The Dangers of a Software Monoculture, By Bruce Schneier. November 2010
[http://www.schneier.com/essay-331.html]
In 2003, a group of security experts -- myself included -- published a paper saying that 1) software monocultures are dangerous and 2) Microsoft, being the largest creator of monocultures out there, is the most dangerous. Marcus Ranum responded with an essay that basically said we were full of it. Now, eight years later, Marcus and I thought it would be interesting to revisit the debate.
The basic problem with a monoculture is that it's all vulnerable to the same attack. The Irish Potato Famine of 1845--9 is perhaps the most famous monoculture-related disaster. The Irish planted only one variety of potato, and the genetically identical potatoes succumbed to a rot caused by Phytophthora infestans. Compare that with the diversity of potatoes traditionally grown in South America, each one adapted to the particular soil and climate of its home, and you can see the security value in heterogeneity.
[10] Reflections on Trusting Trust, Ken Thompson. You can't trust code that you did not totally create yourself.
[http://cm.bell-labs.com/who/ken/trust.html]
This wasn't a piece of speculative writing, but a research report on what works in practice.
[11]Wikipedia on the Sony BNG copy protection rootkit scandal
[http://en.wikipedia.org/wiki/Sony_BMG_copy_protection_rootkit_scandal]
No comments:
Post a Comment