Category: Cyber Security

Home / Cyber Security
Apr152024

Shift to Proactive Cybersecurity and Assurance

Shift to Proactive Cybersecurity and Assurance

Envision a future where cybersecurity breaches are as archaic as floppy disks. In this envisioned digital landscape, enterprises are not merely reactive; they preemptively anticipate and neutralize threats with exacting precision. This proactive approach to cybersecurity is not merely aspirational—it’s a transformative strategy that is redefining the protocols of digital protection. This post delves into why adopting this forward-looking approach is imperative for contemporary businesses intent on safeguarding their digital frontiers.

Why reactive measures are falling short

The traditional reactive model of cybersecurity can be likened to patching leaks on a rapidly sinking vessel—it is both inefficient and belated. Such an approach often leaves enterprises in a precarious position, scrambling to manage crises reactively rather than preventing them proactively. The consequences are severe: substantial financial losses, diminished customer trust, and irreversible damage to brand reputation. In a landscape where cyber threats are increasingly sophisticated, maintaining a purely reactive stance is a risk no prudent business can afford.

The proactive cybersecurity advantage

Proactive cybersecurity transcends mere threat mitigation; it redefines the entire cybersecurity battleground. It mandates a strategic, informed, and anticipatory response to digital threats, shifting the focus from mere survival to comprehensive resilience.

The benefits of a proactive cybersecurity mindset include:

  • Predict and mitigate: Utilizing state-of-the-art technologies such as artificial intelligence and machine learning, enterprises can forecast potential threats and formulate strategic defenses with enhanced efficacy.
  • Cost efficiency: Preventative measures significantly reduce the financial burden associated with data breaches, not only in terms of direct costs but also in operational disruptions.
  • Reputation integrity: A proactive approach signals to customers that their data is not only secure but valued, thereby reinforcing trust and loyalty.
Een afbeelding met in het middelpunt een schaakbord en twee mensen waarvan je alleen handen ziet die spelen. Er staat een tekst met ''don't just respond, anticipate. Het laat zien dat proactive cybersecurity een strategische keuze is

Assurance services form the bedrock of a proactive cybersecurity strategy.

Assurance services: the proactive pillars

Risk Management and assurance equip businesses with the necessary intelligence and tools to transition from a passive defense to an active security force. The role of assurance services includes:

  • Comprehensive Risk Management: Through meticulous assessments, enterprises can identify and prioritize both existing and emergent vulnerabilities.
  • Strategic policy implementation: Policies and protocols are dynamically crafted and continuously refined in response to evolving threats.
  • Empowered human element: A focus on training and awareness empowers employees to act as proactive agents in recognizing and addressing threats.

Securance's distinctive approach

At Securance, our role in the cybersecurity industry extends beyond participation—we aim to lead it. Our integrated approach of assurance and advisory services with cutting-edge cybersecurity solutions offers a holistic, proactive security strategy. We prepare businesses to confront and conquer future challenges, ensuring that cybersecurity measures advance in alignment with their strategic objectives.

A reactive to proactive cybersecurity approach is critical

The evolution from a reactive to a proactive approach in cybersecurity represents a critical shift in the way businesses protect their digital ecosystems. This proactive approach has transcended luxury to become a necessity in a domain where cyber threats continuously evolve. Committed to leading this shift, Securance offers strategies that not only defend but also empower businesses to innovate and grow securely.

Through fostering a culture of anticipation and prevention, Securance is redefining the standards in the cybersecurity field, ensuring our clients are not merely survivors but pioneers in the digital age.

Apr52024

Integrating Assurance and Cybersecurity for Leaders

Integrating Assurance and Cybersecurity for Leaders

In an era defined by digital transformation, the strategic integration of Assurance and Cybersecurity emerges as a crucial foundation for organizational resilience. This integration represents not just a trend but a fundamental shift in how companies approach risk management in a digitally interconnected landscape.

Understanding the imperative of integration

At its core, the imperative for integrating Assurance and Cybersecurity stems from the evolving nature of digital threats. These threats are increasingly sophisticated, targeting not just the technological infrastructure but also exploiting procedural and operational vulnerabilities. This shift necessitates a holistic approach to risk management, where assurance and cybersecurity are not isolated functions but part of a unified strategy.

The synergy of Assurance and Cybersecurity

The synergy between Assurance and Cybersecurity offers several key benefits:

  • Unified Risk Management: By bringing together these two disciplines, organizations can achieve a more comprehensive understanding and management of risks, ensuring that both compliance and security considerations are addressed cohesively.
  • Efficiency and cost reduction: A coordinated approach allows for the streamlining of audits and assessments, reducing duplication of effort and enabling more efficient allocation of resources.
  • Enhanced stakeholder confidence: Demonstrating a commitment to integrated risk management can significantly boost the confidence of clients, investors, and regulatory bodies in the organization’s ability to protect against and respond to cyber threats.

Twee vrouwen samen aan het werken achter een laptop. Ze zijn aan het overleggen

Challenges to integration

However, achieving this integration is not without challenges. Organizational silos, differing priorities between assurance and cybersecurity teams, and the complexity of coordinating across diverse regulatory standards are significant hurdles. Overcoming these challenges requires strong leadership, a clear vision for integration, and a culture that values collaboration and continuous improvement.

Strategies for effective integration

Leaders seeking to integrate Assurance and Cybersecurity can adopt several strategies:

  1. Establish a unified Governance Framework: This framework should clearly define roles, responsibilities, and processes for risk management across the organization, ensuring alignment between Assurance and Cybersecurity objectives.
  2. Leverage technology and automation: Utilizing advanced technologies can facilitate the integration of data and processes, enabling more effective risk assessment and monitoring.
  3. Foster a culture of collaboration: Encouraging open communication and collaboration between assurance and cybersecurity teams is critical. Regular cross-functional meetings, joint training sessions, and shared objectives can help bridge gaps and align efforts.

Conclusion

For CEOs and managers navigating the complexities of the digital age, the integration of Assurance and Cybersecurity is not merely a strategic advantage—it is a necessity. By embracing this integral approach, leaders can ensure their organizations are better equipped to manage the dynamic risks of the digital landscape, securing not just their data and systems but also their reputation and future.

Apr12024

Cybersecurity Threats: Easter Supply Chain Attack

Cybersecurity threats averted: the easter supply chain attack

The IT Security community had an interesting Easter weekend. Somebody very smart almost hacked 20 million internet servers, but they were found out in the nick of time by one guy from San Francisco called Andres Freund. If it was a movie plot, you’d call it far-fetched.

The incident unfolds

The situation began to unfold on Good Friday with a concerning post on Mastodon by Andres Freund, a Microsoft engineer specialising in the PostgreSQL open-source database. Freund had noticed unusual timing behaviour on one of his test servers: the SSH service, used for remote login to Linux, was using far more resources than normal.

https://mastodon.social/@AndresFreundTec/112180083704606941

Being an expert on system performance, he wanted to know why, and he knew how to pin down such problems. He found that the culprit was a common software library called XZ. It is used by many programs for data compression.

The reason for the slowdown was that a backdoor had been added to XZ, specifically targeting SSH to allow an attacker to access systems with their own private login key, without the owner of the system knowing about it.

The potential impact

Scans of the internet show 20 million IP addresses with the SSH service listening for connections. Web servers, e-mail servers, infrastructure servers, database servers, all sorts of servers. If this software had spread to all of them, the attackers would have been able to remotely make these servers do whatever they want. Delete them, quietly steal information that they handle, change data, … anything. It would not be an exaggeration to say that they would have been able to control a large part of the internet, and to listen in on a lot of confidential communications.

Fortunately, Andres runs systems with much more recent software than 99% of us. So this had only just happened, and was not yet included in any mainstream Linux releases. Huge sigh of relief all around. Very lucky escape.

How could this happen?

The backdoor was very cleverly hidden. It can’t be found by looking at the source code for XZ. Somebody added it to a release script, a small program that builds the software, packs it up and sends it off “downstream” to be included in Linux operating system releases. Only after XZ is built from source code is the backdoor code injected into the files that are sent to be run on other systems.

Also, the backdoor is built so that it is not detectable from the network. If XZ is included in SSH, it acts only when a login request is received from someone who has a specific, secret key. Then, and only then, will the backdoor run a command for its owner. If you don’t have that secret key, there is no way to know that a server is vulnerable. Only the server owner could find it, provided, of course, (s)he knows about the issue and knows where to look.

If Andres hadn’t noticed the slight timing issue, this might have taken a very, very long time to be discovered.

Whodunnit

The XZ version with the backdoor was released by somebody calling themselves Jia Tan. It is now believed that this is not a real person.

Lasse Collin is the owner and inventor of XZ. He maintained the software for free, for many years. After being pressured to work harder on his project[1], and suffering from illness, he gave a very friendly new volunteer called Jia Tan access to edit the software and to make releases, and took some well-earned vacation. We now think that the pressure campaign, which started in 2022, was orchestrated so that “Jia Tan” could become the maintainer of XZ and thus be able to release malicious software into the larger internet ecosystem.

Getting control of a widely-used project, developing a complicated backdoor, and hiding it, must have taken serious investment. Some people are saying that some of the large criminal hacking groups can afford to build something like this, but the main suspect would be a national intelligence service. We can’t be sure, of course, but who else would spend years building this, and getting it included into an important piece of internet infrastructure by finding a widely-used project maintained by only one overworked person?

[1] Look at this e-mail exchange from 2022, for example: https://www.mail-archive.com/[email protected]/msg00566.html – “Jigar Kumar” and “Dennis Ens” demanding that Lasse give control of his project to others; conveniently, “Jia Tan” then volunteers

What do I do?

We’re very lucky that this was caught in time. “Jia Tan” was busy just last week pushing Linux maintainers to quickly adopt the latest version of XZ into their main releases, but this had not happened yet. So, unless you are running “bleeding edge”, unstable testing releases of Linux, you are most probably fine. But, update just the same, to make extra sure: updates have now been released that roll back the latest, infected releases of XZ (5.6.0 and 5.6.1).

Also, a recommendation that we at Securance always give to our clients is not to expose services like SSH, that are meant to be used only by a few IT staff, to the open internet. Always limit access in the firewall to internal IP addresses, and perhaps a few home addresses of trusted staff. That way, if a new vulnerability in the service is discovered, attackers simply won’t be able to connect to your servers to exploit it.

Lessons for the future

Supply chain attacks are here to stay, because complicated supply chains will continue to exist. A well-known cartoon puts it like this:

We (internet users) need to support these “random persons” a little more, and be aware of their importance to our security. Lasse Collins was building and maintaining this critical piece of software for us in his spare time, for nothing. And there are many more Lasses out there.

We at Securance support some open source projects whose excellent software we use for free. We will look at supporting more of them with a monthly donation. No matter how small – these can really make a difference.

Feb292024

NIST cybersecurity framework 2.0

NIST cybersecurity framework 2.0

In a significant step forward to strengthen cybersecurity at all organisations, the National Institute of Standards and Technology (NIST) recently updated its Cybersecurity Framework to Version 2.0. This update marks the first major revision since the framework was introduced in 2014. It reflects a broader scope and enhanced resources for organisations looking to strengthen their digital resilience.

The NIST framework is an American standard that has been harmonized with European Union guidelines through collaborative efforts to create aligned standard assessment rules. This alignment makes NIST’s cybersecurity framework particularly relevant and applicable within Europe.

The ever-changing cybersecurity landscape

The digital age brings unparalleled opportunities for growth and innovation. However, these advances also come with a range of cybersecurity threats that are evolving at an alarming rate. From sophisticated phishing attacks to complex ransomware threats. Businesses today face a constant battle to protect their digital assets and maintain customer trust.

As a result, implementing a comprehensive cybersecurity framework has become essential. The NIST CSF 2.0 serves as a strategic guide for organisations to identify, protect, detect, respond and recover from cybersecurity incidents. Adopting this framework enables organisations to not only mitigate the risk of cyber attacks but also to cultivate a resilient infrastructure. This foundation supports long-term growth and stability, ensuring a secure and prosperous future. growth and stability.

Key updates to the NIST cybersecurity framework

Universal applicability: Unlike its predecessor, CSF 2.0 extends its reach beyond critical infrastructure sectors. From now on it provides guidance for organisations of all sizes and industries. This inclusive approach recognises the universal threat of cyber attacks and the need for a unified defence mechanism.

Enhanced focus on governance: With governance at its core, the revised framework emphasises the importance of strategic cybersecurity decision-making. It emphasises the role of senior leaders in integrating cybersecurity considerations with other critical aspects of business operations, such as finance and reputation management.

Richer resources for implementation: NIST has introduced a range of resources, including quick-start guides, success stories and a searchable catalogue of informative references. These tools are designed to facilitate adoption of the framework, providing organisations with tailored pathways to improve their cybersecurity practices.

Collaborative development: The update is the result of extensive consultations and feedback from a wide range of stakeholders. It ensures that the framework addresses current challenges and adopts best practices in cybersecurity management.

The importance of a robust (NIST) cybersecurity framework

Implementing a comprehensive cybersecurity framework is no longer optional, it has become a necessity. The NIST CSF 2.0 serves as a strategic guide for organisations to identify, protect, detect, respond and recover from cybersecurity incidents. By adopting this framework, organisations can not only reduce the risk of cyber attacks but also build a resilient infrastructure. This supports long-term growth and stability.

Implementing NIST CSF 2.0 in your organisation

Adopting the NIST Cybersecurity Framework requires a tailored approach, one that is in line with your organisation’s specific needs and challenges. It starts with an analysis of your current status quo, followed by identifying improvements and developing a plan to implement them. Involving all levels of the organisation in this process is crucial for fostering a culture of cybersecurity awareness and resilience.

Conclusion

The NIST Cybersecurity Framework 2.0 is a testament to the evolving landscape of cybersecurity threats and the need for adaptive, inclusive strategies to combat them. By embracing this updated framework, organisations can protect themselves against current and emerging threats. Additionally, they can foster a culture of cybersecurity that permeates every level of operations.

For CEOs and managers committed to protecting their organisations from digital threats, CSF 2.0 provides a strategic roadmap to achieving a robust cybersecurity posture. The journey to a secure digital future begins with understanding and implementing the principles outlined in this groundbreaking framework.

Explore how NIST’s CSF 2.0 can transform your organisation’s approach to cybersecurity.

Explore how NIST's cybersecurity framework 2.0 can transform your organisation's approach to cybersecurity

Feel free to contact us to explore how NIST cybersecurity can benefit your organisation. Our advisory and cybersecurity experts will be happy to assist you.

Contact us