Special Episode - EliteCast Episode 1

Hello everyone, John here. So this is not a new episode of Purple Swat Security. That show has ended and I don't plan on making any more episodes for that, so sorry for all of you tabletop D&D hardcore fans. We're just not going to get around to making new episodes of that.

But as the proverbial old saying goes, you can take the man out of the podcast, but you cannot take the podcast out of the man. What I've decided to do is actually start a new podcast, which is going to be slightly different in terms of audience and content. This one is called EliteCast, and I've actually created it in support of my cybersecurity consultancy. Yes, I'm going to be using the term cybersecurity quite a lot.

The focus is actually towards business managers, decision makers, executives, that sort of thing. And unfortunately, cyber resonates better than InfoSec. So don't hate me. Send all hate mail to DevNull.

And yeah, this is the premiere episode. It's a little painful. As I was editing it, I realized, man, I am really out of practice. Apparently spending nine months without doing a podcast episode can make you a tad rusty.

But anyway, I hope you enjoy. If you do, I will have links for the proper show in the show notes as well. And yeah, it should be available on all the major platforms. So do have a listen.

And if they're not there yet, you know, just give it a day or two. I just literally just finished submitting everything. So hopefully that will get get done soon. So please enjoy.

And without further ado, here is EliteCast. Hello, and welcome to the EliteCast, EliteSec's podcast for business leaders and decision makers seeking cybersecurity insights for their organizations. From penetration testing to virtual CISO offerings, EliteSec is your source for pragmatic advice with candid discussion for all your cybersecurity needs. My name is John Svazic, and I'm the founder and principal consultant here at EliteSec.

Welcome to Episode 1 for January 5th, 2021. In today's episode, I'll be discussing building a security program for an organization, its benefits, and how it can help to increase your cybersecurity posture. On December 14th, 2020, the world was made aware of a security compromise of the SolarWinds Orion product, which potentially impacted 18,000 of their 300,000 customers. There's been an awful lot of discussion, news, and advice on this topic already, so I'm not going to repeat any of that here.

Instead, what I want to do is tackle a different topic, shoring up your own security defenses by focusing on a security program. The reason I want to focus on a security program is this is actually one of the things that can help when you're evaluating your own security posture when a large breach like the one at SolarWinds happened. And this is the general advice that we give here at EliteSec to our customers when they're looking for how do I shore up my own defenses. So my opinion is really quite simple.

You don't make an organization more secure by only focusing on whatever the latest breach was in the news. There's always going to be some lessons to be learned from these types of breaches, but the lessons should be used to supplement an existing security program or posture, not necessarily create something from scratch. A program built piecemeal in this way is pretty much guaranteed to have holes and blind spots that will cause issues for you later because they'll give you a sense of security that isn't really existent, a false sense of security, if you will.

When executives ask me how to better protect against attacks like the ones that we see in the news, like the solar winds breach, for example, the answer I always give is to make sure that you are solid with your fundamentals. What do I mean by that? The fundamentals to me are having a solid security program in place, and then once you've got that in place with all the necessary bells and whistles, start building upon that and see how you can improve it by taking lessons learned from these types of attacks.

This advice is fairly standard. This is the same advice that I would give to an SMB as well as anyone running a Fortune 500. The SolarWinds hack was launched by a nation-state, which had an unlimited budget, but the truth is that not all attacks are from a nation-state. Criminal groups, curious teenagers, and hacktivists are far more likely to be the cause of an attack at your organization than a nation-state by the likes of China, Russia, North Korea, or Iran.

These other attackers often go after targets of opportunity. Targets that are easy to attack because their cyber defenses are either simple or non-existent. If you have a solid foundation for your cybersecurity defenses, you're raising that bar to attack for your organization, and because that bar is being raised, most of these opportunistic attackers will pass by you simply because you're not worth the effort. So this is one of the reasons why I say stick to the fundamentals If you have a solid security program and you got those preliminary defenses in place unless they are specifically targeting you for a very specific purpose they're probably going to pass on by.

And the good news is if they do target you specifically, you should have enough defenses in place to be able to detect them early and kick them out sooner than later. But what exactly is a cybersecurity program? Is it having a few corporate policies written down and making sure that your employees read through them? Is it just having some annual computer-based training on phishing?

Does that meet the need? Sadly, no, it doesn't. That doesn't meet the need. Don't get me wrong, these are a good start, and policies are important and are often asked for, especially when you're selling to a larger organization.

They want to know, do you have things like a password policy in place? Do you have things like an acceptable use policy in place? That sort of thing. And it's a good place to start, but again, policies are only as good as the paper they're written on.

The one thing you have to remember about a policy is that it is acting as a type of law for the organization. The policies are there to ensure that you have defined a set of rules that you expect all employees to follow. However, if the only thing that you're doing with these policies is writing them down and forcing your employees to read and sign off on them, they're not really doing much else. They're not actively protecting you.

If you don't have some means of ensuring that those policies are being followed by, well, first and foremost, making sure you're detecting policy violations, but also preventing accidental violation. So for example, do you have a password policy that says, hey, I require you to have a minimum password length of, say, 12 characters. Do you have controls in place to prevent your users from using an eight-character password? What about bad passwords, the short ones, like 1, 2, 3, 4, 5, 6, 7, 8.

If you don't have these, you can have all the policies in the world, but if you're not actually enforcing them, they're not really that helpful. When it comes to security awareness training, I'm 100% for it. I think security awareness training is one of the quickest wins an organization can have. But the question is, how often do you do it?

Do you have an annual training program? How many of you are excited to sit down for an hour to watch a couple of videos about phishing and then answer a couple of questions once a year? I don't know about you, but I'm in the industry and I can't stand having to sit through hour-long videos. I never could.

Even before I was in the security space, it was just one of those things that I honestly thought we could do better. And we can. And we'll actually be covering that in a future topic on the show. But for now, let's just say that level of training is just not enough.

So let me go back to the topic of cybersecurity programs and what exactly a good program should be and what it should have. So a good program should help you perform a few functions. You should be able to identify your assets as well as the data that's stored on them. Where is the sensitive data located?

Where is the data that's maybe not so sensitive, but sitting on a server that you don't necessarily have a lot of exposure to? What else is it connected to? Have a plan for vulnerability and patch management. Are you up to date on operating system patches?

What about your browser? What about your email client? What about that server, again, sitting off in that corner that doesn't have a lot of sensitive information, but nobody really bothers to check on it very often. That might be the weak link that's going to let someone into your network that could potentially cause a catastrophic issue.

Do you have a defined security configuration for laptops, servers, et cetera? We used to call these gold images back in the day, but that terminology seems to have more or less died out. most people will just say have a secure baseline for these systems. Do you have something along those lines?

What about this end user awareness training? We talked about phishing, but what about things like social media usage and acceptable use and what to do when somebody does see something suspicious? Who do they report it to? How do they report it?

What is the process for that? Do you have an incident response plan to deal with issues when they do arise? Do you know what to do? Do you know who to call?

Do you know how to record the information that you're going to need? Do you have someone on speed dial that you can reach out to or someone that you have a retainer with that can assist you in case of an actual issue? These are the types of things that should be part of a cybersecurity program. Now this is a short list and to be honest it's actually inadequate for a full and proper security program.

It's a good start, but we can do better. Thankfully, starting up a security program isn't actually as hard as it seems, as there are options available to get your organization started. Some examples would include the NIST cybersecurity framework, ISACA's COBIT-5 framework, are both valid options, and more people generally lean towards the NIST cybersecurity framework But again ISACA COBIT framework is an acceptable choice as well However what I going to discuss today is one that we actually recommend at EliteSec and one that I personally just absolutely love, and that is the Center for Internet security's CIS controls.

The CIS controls is a collection of 20 different controls, and those 20 controls are then further broken down into sub-controls, and then those sub-controls are then likewise grouped into what are called implementation groups. These implementation groups are essentially maturity levels. So it goes from implementation group one all the way through implementation group three, with one being the most immature collection, so to speak. So if you were a small to medium-sized business which has not established a security program ever, you would start with implementation group one.

And if you were a Fortune 500 that has a well-thought out security team and perhaps you have a full-fledged SOC or security operations center, then you'd probably go with implementation group three and then work out all those controls. The way the implementation groups work is the expectation is you're doing everything in the previous level. So if you're at level three, you're expected to have done everything in implementation groups one and two before moving on. So the CIS controls are fantastic.

They're also free. So I'm going to have a link in the show notes where you can read more about the actual individual controls and take a look for yourself. There are some free tools available on the Center for Internet Security's website as well. One of my favorites is the CSAT tool, C-S-A-T, and I will again have a link for that in the show notes as well.

There's a lot of documentation out there that says if you implement the first six controls from the CIS controls framework, then that should be sufficient to stop about 80% of the attacks that you're going to face. I would disagree with that. I think the first six are definitely fundamental controls, but I wouldn't necessarily ignore the others or only focus on those first six right off the bat. I would definitely take a look to see what you can do for some of the other controls, And the reason I say that is simply because the first two sets of controls in that list are to build out a hardware and software inventory, as well as making sure that you have policies around what you do when you discover something that isn't expected to be part of your inventory.

That's fantastic, but traditionally that's difficult to do. If we go further down the list, we see something along the lines of, I think it's Control 17, where we talk about having a security awareness training program. And specifically, we call it things like how to handle sensitive data, how to handle malicious emails, how to handle social media accounts. These types of things, I think, have a lot of benefit, and especially with the changing landscape where we're starting to see majority of initial breaches start with a phishing attempt.

While it is important to ensure that you do have a strong inventory, I wouldn't necessarily put off doing some work on a security awareness training program for your teams before finishing that inventory, because chances are that inventory is going to take a while. Having a framework brings structure. And it helps to provide a metric that can be used to determine how far along your organization is when you're discussing how well you're doing at securing yourself against an attack by an outside party.

A lot of people really like the NIST cybersecurity framework, especially if you're in the U.S. federal government space or dealing with federal offices, because again, NIST is a US federal agency. It's a fantastic framework, but my experience has been it's somewhat difficult to implement.

If you have something like the Center for Internet Security's CIS controls, then it's easier to implement. And the best part is you can actually map those controls to the NIST cybersecurity framework. So you can actually get the best of both worlds. But again, because you're using a framework that has a predefined set of controls, you can actually measure your implementation and you can see how far along you are, allowing you to have a metric that is traditionally difficult to have within an organization when it relates to cybersecurity initiatives.

So by having a type of framework that has predefined goals, it has predefined controls and an ability to map how far along you are with all of these things, now all of a sudden we have something you can hold people accountable for. Most times when we're dealing with cybersecurity initiatives, we often, very much like insurance, say we need it in case something happens. But sometimes it's very hard to judge how well are we actually doing. By having something we can work towards, we can actually start answering those types of questions.

So this is one of the main reasons why it is important to have a good security program defined for your organization Now some of you may be scoffing at this idea saying you already have something like a SOC 2 or an ISO 27001 or a PCI DSS audit done annually and that good enough I'm sorry to say, actually, it's not. Compliance does not equal security, no matter how much you want that statement to actually be true. Compliance frameworks such as these generally have a predefined list of checks and balances to make sure that you're doing things the right way based on this set of guidelines that have been come up by some external organization.

I'm going to pick on PCI for a second because this is the one that's probably the most common that's out there. PCI comes from the payment card industry and it is intended to check to ensure that any systems that are handling credit card transactions and any sort of financial data, payment data specifically, is done on a secure system that meets the requirements as outlined by the payment card industry as part of this compliance framework. What a lot of organizations will do is they will limit the systems that actually have access to the payment card information and thereby limiting the scope of the compliance checks themselves.

That's fantastic, but it doesn't actually solve the problem of securing your organization. What it's doing is ensuring that a subset of your organization meets these requirements. ISO and SOC do a better job, but again, a lot of these are looking at processes and techniques that you have in place, not necessarily meeting all the necessary nooks and crannies, for example, that you would have with a dedicated security framework. Now, I'm not saying there's anything wrong with this.

In fact, quite the opposite. I think that compliance frameworks and security programs have more of a symbiotic relationship and actually work well together. It's just that one doesn't necessarily replace the other. Larger organizations are probably well aware that when you start dealing in the enterprise space, enterprise clients often require something like a SOC 2 or ISO 27001 audit to be done regularly to ensure that their vendors are actually doing the right thing.

But again, to ensure that you don't become a headline, it is vitally important to actually have a dedicated security program. And again, having something that you can work towards is probably a huge benefit for sure. Cybersecurity as a whole is an investment in your organization's ability to perform to the best it can in the face of constant and ongoing threats. Like all good investments, you're going to want to make sure that you're getting the best return for your money.

Going piecemeal and focusing on one threat at a time because it happens to hit the news is not a great way to get that ROI that you're looking for. Again, starting with fundamentals and then building on that is the better approach here. You will be able to get a wider range of techniques and tools and processes to defend your organization and potentially minimize the cost as well because you won't necessarily be purchasing six or seven applications that pretty much do the same thing, albeit slightly differently.

Focusing on these fundamentals can help you essentially get that ROI that everyone is looking for, especially when we're talking about cost centers like a cybersecurity program. Over the next few episodes of the podcast, I will be going through the different controls in the CIS control framework and explain how they can help your business in terms of increasing a cybersecurity posture. From understanding what each of the controls mean to how that can impact your business, as well as what you can expect to protect against, we'll take a look at each one and see exactly how you can make smart investments within your own organization when it comes to this implementation plan.

I know this is a very high-level episode, but again, this is kind of the initial kickoff. We just want to get everyone onto the same page and say, hey, you know what? There are going to be breaches that are going to hit the news and the questions are always going to be asked. What about us?

What are we doing to prevent something like this from happening? And again, a lot of the time people will chase after what was happening in the news, what happened to that particular organization, and kind of miss the point that are we even doing the fundamentals properly. By building out fundamentals, we can start getting that return on investment. And let's be clear, security is an investment, but we want to make sure that we're investing wisely.

We're doing the right thing. And from my perspective and the perspective of the lead sec, we want to make sure that everyone's on the same page, which is let's stick to the fundamentals. Once we can get those fundamentals working properly, we can start getting a better return on investment for our organizations. And at the end of the day, that's beneficial for everyone.

If you have any questions or would like to learn more about how EliteSec can help your organization with its cybersecurity needs, please feel free to visit our website, EliteSec.io, or email us at info at EliteSec.io. We look forward to helping you and your organization through pragmatic advice and candid discussion, whatever your cybersecurity questions happen to be.

Thank you for tuning in, and I'll talk with you all again next time.