Sometimes Simple is Better – Biswanger Consulting Group

Sometimes Simple is Better

We all want to find the silver bullet to solve our cybersecurity problems, but it doesn’t exist. No matter what the vendors tell you, theirs isn’t the only product addressing a problem. And “best in class” is almost never “best for me” unless you have hundreds of people on your cyber team to manage a bunch of disparate tools and a lot of false positive alerts.

Then there is Thinkst Canary. A tool that is simple, addresses a specific problem, really sets up in minutes and has the lowest false positive rate I have seen. At its root the solution is a honey pot, but without the care and feeding complexity that usually comes with such solutions. You sprinkle “Canarytokens” in your environment and if they every trigger, you know someone is up to no good.

This isn’t intended to be an ad for Thinkst’ but a celebration of their simple and effective approach. Too many cyber vendors try to shoehorn features into a product for “brochure points.” Whoever has the most checkmarks in an RFP must be best right? Not if you are only using 20% of the tool! I am a strong believer that you need to understand your business and technical environment, your risk profile and appetite and design a corresponding cyber approach. Know what you need and when the vendor comes calling you can compare their list of capabilities against your list of needs. Don’t get fooled by Magic Quadrants, brochure points and market growth projections. Find the right tool for the job, that meets your business and operational needs. Your business customers and your budget will appreciate it.

https://mybroadband.co.za/news/security/557130-the-south-african-hacker-who-revolutionised-cybersecurity-around-the-world.html

26 Jan 2025

Comment 0

Categories

Artificial Intelligence (AI)

Cyber Security

DevSecOps

Governance

Hacking

Operational Technology (OT)

OpSec

People

Ransomware

Regulations

Vulnerability Management

Leave a Comment Cancel reply

News & Blog

Related Posts

20 September

Beakerhead 2024!

This weekend is Beakerhead in Calgary. For those unaware, now in its 12th year, Beakerhead is the second largest STEAM (science, technology, engineering, art and mathematics) event in the World. If you have been in Calgary in past Septembers you may have seen some of the art installations around town (giant octopus tentacles creeping out of a building, another building covered with balloons, a series of seesaws that emit different tones as you go up and down to create music (if you are so inclined) and so much more.

We often think of the “hard sciences” as different from rest of the University disciplines, but in the “real world” you cannot get by with any singular skill. You may be the best physicist, but without creative writing skills you won’t be able to excite the people who will invest in your research. You may be an amazing researcher, but how will you communicate your findings without some form of marketing. And if you are an amazing artist, it helps pay the bills when you exercise your skills in the marketing department.

Success in the real world comes when people work together. A diverse team brings a combination of skills and perspectives that creates an outcome exceeding the abilities of any one person. We may think of diversity as defined by gender or ethnicity, but it is the unique experiences that shape our perspectives and develop our skills. You want a team that not only makes room for different individuals, but provides an environment that allows them to thrive. When it works, it is magical — just like Beakerhead.

If you have a chance, check out the Beakerhead experience this weekend. It is an immersive experience that showcases the magic that happens when a bunch of enthusiastic and creative individuals are given an environment to thrive.

Homepage

26 January

Do We Need Better Coding or Vulnerability Management?

Last week was a big week for vulnerability teams:

Microsoft’s monthly Patch Tuesday covered 72 vulnerabilities including 1 zero-day exploit actively being exploited in the wild,
Adobe patches cover 160 vulnerabilities across 16 products,
CISA released 10 advisories for industrial control systems,
Apple released security patches for nine products / operating systems addressing 46 different vulnerabilities,

plus a variety of patch releases from various other vendors like Linux, Ivanti, Siemens, Schneider Electric, Rockwell!

Now IT and security teams across the World spring into action, confirming whether they have any of the products affected, testing applicable patches to understand if they break more than they fix, attending Change Advisory Board meetings to justify the planned outages, communicating to users which of their applications will be interrupted in the coming weeks all while hoping the patches can be applied before the threat actors can reverse engineer the patches and deploy exploit code. It is an expensive and arduous part of managing IT systems.

I suppose we should be thankful that the vendors put the efforts in to create these patches to keep us protected, but wouldn’t it be better if the vulnerabilities didn’t make it into the products in the first place? Imagine a world where vendors are held accountable for the crappy code they sell to us. If you could charge the vendors for the cost of your vulnerability program, they would be incented to minimize those costs and write better code. As it is, we pay the licensing fees to use the products AND we pay the bulk of the costs to manage, maintain and patch those systems. Pretty sweet deal for the vendors, pretty crappy deal for the customers. Technology companies make record profits, customers have chronically underfunded security and vulnerability management teams. This doesn’t seem like a winning formula, and doesn’t seem like it is going to change any time soon.

20 February

Is IoT The Gateway to your Enterprise?

As we continue to connect everything to the Internet, we continue to find authentication challenges. VoIP phones, smart TVs, AI-powered webcams, smart HVAC controls, AI-enhanced motion sensors are just some of the IoT devices you may have connected to the network in your office. Behind the scenes you are using systems that are integrated with a range of different API methods (e.g. REST, SOAP, GraphQL.) All of these non-human assets should be authenticated to guard against rogue devices on your network, but not even your authorized devices will all work with whatever authentication systems you have. It is a complex mess to try and wrangle.

For your users you diligently implemented a central directory to authenticate users (probably Microsoft Active Directory or Entra ID.) Then you added something for multifactor authentication because it is a dangerous World out there. Some of your users still log in to other directories for specific purposes or applications that don’t integrate with your primary one. In the course of a regular day, your users are entering (hopefully) different credentials into different systems all with different interfaces. As we add user behaviour analytics to our security controls, it appears to users that we are randomly prompting them for credentials again. We haven’t made it easy for the users. But they are trained to enter credentials when prompted because “it keeps things secure.”

The threat actors have found a novel way to take advantage of the cracks in the modern business environment — the smart TVs! Not directly through the TVs themselves, but taking advantage of the simplified authentication method created for these devices and applying tried and true phishing techniques. The linked article has a good explanation of the process if you want the details.

Technology integration has always been a bumpy evolution. There are periods of sprawl where different systems require different protocols and IT struggles to manage the complexity. This is followed by a period of consolidation where the number of systems are reduced and the remaining ones are configured on standards. This is inherently limiting. Eventually business demands push exceptions and the period of non-standard sprawl begins again.

Anything “smart”, “AI”, or “IoT” is not yet standardized. The period of complex sprawl is well underway again. This time though, the users aren’t just users of the systems, they are “implementing” systems (cloud SaaS) and we expect them to participate in securing systems (use authentication methods properly, be wary of suspicious messages.) We used to try and hide IT complexity from users, but if we are going to rely on them to help manage the technology, we need to give them the tools and knowledge to do it effectively.

https://www.tripwire.com/state-of-security/microsoft-teams-storm-2372-exploit-device-codes