Cracking the Code to Explain Encryption Keys

When an executive asks about security keys because of a recent publicized attack or request by security to upgrade, it's a great opportunity to educate. Although the encryption process is complex, part of our job as security professionals is to demystify it so executives and stakeholders can better support the organization’s security.

First, provide context as to why that is an insightful and timely topic. If your organization is like most, there are probably some weak keys / algorithms still in-use given legacy systems. This could be a good time to shine a light on those systems with the aim to encourage business and tech owners to get those updated.

If your organization is already using strong encryption tools, perhaps the keys are not changed as frequently as recommended. Even if doing well operationally, as hackers improve techniques and have access to faster computers, there will come a time for the organization to update its defenses. If the executive gains a better understanding of the encryption process, it will make it easier for you to request resources for upgrades.

Second, explain the goal of encryption process: Force the hacker to guess the key by systemically trying each combination such that the time required to try each combination is longer than the time the key is in-use. 

Basically, it’s a relay race between your organization and the hackers. Your organization wants to enter a racehorse and not a donkey. And you want to change out to a new racehorse once it has become exhausted (cracking time is reached).

Third, dive into the methods to achieve the security goal and win the race:

1.   Make the key random – Since executives have experience with personal passwords, you should explain that robust keys are randomly assigned to eliminate a dictionary attack. A dictionary attack takes seconds to crack the password and the organization loses the race immediately. (This also reinforces the best practice for personal passwords should also be randomly selected.)

2.      Use a long and random key to create many combinations. A lottery analogy may be useful to illustrate. The odds increase dramatically for each additional number added.  Approximate odds for:

·        2 numbers -> Odds are 1 in               10

·        3 numbers -> Odds are 1 in             100

·        4 numbers -> Odds are 1 in          2,000

·        5 numbers -> Odds are 1 in      145,000

·        6 numbers -> Odds are 1 in 45,000,000

3.      Consider other contributors to a strong encryption process such as the algorithm and block size. Unlike the lottery, an encryption process has more complexity. A car analogy may be helpful. A lighter and aerodynamic car contributes to faster speed. So, making the engine smaller and less powerful can achieve faster acceleration by making the car lighter. (AES-128 is better than Blowfish even though Blowfish offers a longer key because of the AES block size.)

4.      Review performance, specifically speed for the good guys to unencrypt. Robust security can’t get in the way of achieving the organization’s mission. Executives will appreciate that business interests really are considered by us security geeks.

5.      Determine cracking time for your selected encryption process. Remind executives that even solo hackers (the proverbial guy in his mother’s basement) have access to powerful and cheap computing available from Amazon or other cloud services. If your organization is using a donkey (days to crack), then you must change the key more frequently. Since changing keys can be disruptive to business systems, upgrading to a racehorse provides business benefits.

6.      Change the key regularly based on cracking time. Remember it’s a race and the time the key is useful has an expiration date.

7.      Review cracking time at least annually because cracking time is constantly reduced with computer advances. You can mention that the organization checks NIST or other trusted source for guidance.

Keep the executive team updated on regular basis, such as including this topic on your security scorecard and addressing in the annual risk report. Any security professional worth his salt (pun intended) will make the effort to educate your executives, business partners and tech leaders. An informed organization is one of your best security tools.

Risk Template: Availability & Performance (Part 3)

MaBell (Bell Telephone Company and legacy AT&T) with her always available dial tone is still the role model for availability. The proverbial five 9's (99.999%) goal is more challenging today given the complexity and risks of modern computer systems. 

As pat of the risk assessment, it is critical to understand your organization's availability goal. Before committing to five 9's, you should consider all the service providers that must be available to achieve your organization's availability goal. 

This is the third in a series of articles to cover risk areas (e.g., compliance, breach, availability). If you read the previous articles, the Goal and Process sections are identical. The Template section has been updated for the availability and performance risk.

Goal

Although there are many great resources that can help you complete a risk analysis (such as ISO31000 and NIST), there are limited resources on examples on how to put together your risk report. The template below provides a starting point with verbiage for you to edit for your organization's requirements.

Process

The template below suggests the order of how to document your findings. (Please reorder to work best for your situation.) However, the analysis steps are different then shown in the template. Check the template for more detailed directions for each step below.

1. Determine scope - What data and what data owners are handled by your organization. Please note that even if you do not retain the data, you are still subject to the regulations. See sections labelled "Scope: Business Functions" and Scope: Solution Providers".
2. Review each sub-risk to uncover your vulnerabilities. Consider the various threat actors See Sub-risks Section for Sub-Risk 1 - Sub-Risk 11.
3. Determine the risk ranking. See Risk Ranking Section.
4. Complete the template

Once you have completed your annual security risk assessment, distribute it to the Board of Director members and executives. Resolve risks found focusing on highest risks first. Keep leadership apprised of progress with regular updates throughout the year.

Finally, remember to complete risk assessments throughout the year when there is a significant change planned for the technical, physical or administrative environment.

REPORT TEMPLATE WITH SAMPLE VERBIAGE

Risk Description

Here is some verbiage that you may edit for your risk report. 

 

The organization is unable to generate revenue or perform other critical business functions (list critical functions) due to a system outage or degradation in systems operated by the organization and third party service providers. These issues may adversely impact customers and business partners.

Context

The purpose of this section is to provide compelling examples that an investment in reducing the organization's breach risks is warranted.

• Highlight the most egregious risks found during your analysis
• Provide statistics and illustrations of challenges your organization faced throughout the year. For example, ransomware has increased x% in our sector.
• Add case studies from other organizations in your space that experienced a performance issue that caused significant impact. For example: Company Z was compromised and a bitcoin mining operation stole resources needed for peak loads. The root cause was xxxxx, which is a security capability that is not mature at our organization.
• The annual Verizon Data Breach Investigations Report (DBIR) produced by the Verizon Threat Research Advisory Center (VTRAC) is an excellent resource for compelling statistics to add to your report.
• An internet search by Sub-Risk and your industry will also uncover interesting case studies.

Risk Ranking

Once your analysis is complete (see sub-risk section), then describe the range of risks. Settle on consolidated risk.

• Likelihood - Low, Medium, High. Select one.
• Typically performance and availability likelihood varies depending on the organization's vulnerabilities and activities of threat actors. Provide examples of different likelihood events.

• Impact - Low, Medium, high. Select one.

• The impact will vary depending on the line of business and business activity. The business stakeholders should provide a cost per minute, hour or day for an outage. Your corporate risk management function may have already defined criteria for losses and their ranking. For example a $1 million loss is low while $50 million is high impact. 

Threat Actors

The threat actors to consider are listed below.

T1. Unaware insider including BPO

T2. Malicious insider including BPO

T3. Cybercriminal

T4. State actor

T5. Physical Hazard

T6. Activist

Sub-Risks

The list below defines the multiple potential ways availability and performance issues may occur. The examples (vulnerabilities) are just a starting point for your analysis. Also, remember to consider your service providers. 

Sub-Risk 1: Ransomware locks critical resources or data. Ransomware can be considered a BCP type event.

 

Examples:

·        Poor malware defenses lead to an attack where many resources are locked. Correcting ransomware can be more challenging in the remote work environment.

Sub-Risk 2: Insufficient resources are available during high volume usage that leads to degradation or outages. 

 

Examples:

·        Poor resource planning and stress testing do not uncover weaknesses in the architecture. 

·       Software performs poorly. e.g., Does not release resources, consumes excess resources 

·       Monitoring does not detect changes in traffic patterns

 

Sub-Risk 3: Critical components are not redundant (i.e. single points of failure) Technical, facility and  personnel resources need to be reviewed. 

 

Examples:

·        3rd party Runtime or other service is unavailable

·        3rd party service provider (cloud, ISP, telco, etc.) is unavailable 

·        A single hardware device is used in a critical process and fails

·        Multiple aging hardware devices fail - Had redundancy but based on devices that are obsolete. 

·        Critical network expert quits.

 Sub-Risk 4: Changes to the system cause availability or performance issues.   

 

Examples:

• Change accidentally breaks a component. Cable is left unplugged. New device malfunctions. Configuration settings are incorrect. 
• Configuration changes that may not be tested since considered simple cause an issue. (Firewall rule change, accidentally drop index to database, application timeout change)
• Change has wider scope than realized and causes issues to unexpected components. Service password updated and downstream access points are not updated.  
• Change has compatibility issues with existing components. Upgraded OS requires more resources.
• Software change introduces errors. 

Sub-Risk 5: An authorization issue causes availability issues. 

 

Examples:

• password expires, 
• token expires, 
• service account changes and applications services are not updated, 
• fire wall rule conflict, 
• SSL incompatibility where requestor still using outdated protocol and host will not accept, 
• timeout causing more reconnections that degrade performance and does not balance user needs and security 

 Sub-Risk 6: Natural or man-made disaster that impacts the organization’s facilities, systems, data or personnel.  

 

Examples:

• Earthquake, hurricane, fire, flood, global pandemic, etc.
• Power outages, rolling black-outs 

 Sub-Risk 7: Distributed Denial of Service (DDoS) Attack is launched.

 

Examples:

·        DDoS attacks are used to shut down an internet-based services

·        In addition, DDoS attacks are also used as a smokescreen to distract an organization from a data breach attack. 

 Sub-Risk 8: Computer resources are hijacked and used for the hacker's purposes and degrades performance for organization. These hackers will try to use limited bandwidth to remain undetected. Peak loads may uncover this illicit usage.  

 

Examples:

·        Crypto-jacking or VOIP hijack

·        Employees use network bandwidth for personal use

 

 Sub-Risk 9: The organization’s website is defaced

 

Examples:

·        DNS for website may be hijacked

·        Content is removed or replaced

 

 Sub-Risk 10: The organization is categorized as malicious by 3^rd party gatekeepers 

 

Examples

·        An email marketing campaign is categorized as SPAM, 

·        An organization’s systems access to a third-party service behaves like a DDoS attack and is blocked. 

 

 Sub-Risk 11: Use of third-party tools and services do not satisfy license agreements

 

Examples:

·        Open source or other third parties require the organization to stop using its components until licensing or terms of service is satisfied.

 

Scope: Business Functions

Below are list of typical business functions that your organization considers critical and deserving of availability and performance goals. If you have already completed your BIA (Business Impact Analysis) as part of your organization's Business Continuity Plan, there should be significant overlap. 

• Sales (line of business. may have different systems/processes for physical and online. 
• Payroll
• Ordering and Inventory (if applicable)
• Accounts Receivable / Payable
• Financial reporting SEC

Scope: Solution Providers

After you have determined the business process you want to establish availability and performance goals, then inventory service provides such as your ISP, cloud, third party application services, third party resource providers. Application services are often not considered including open source during availability planning. Some application teams link real time to the open source code which adds an unnecessary risk to availability.

During the inventory process also document the contractual commitment as to uptime. You should assume that each service provider will have a distinct outage. So if you have just five service providers that commit to 99.999% then you should plan on achieving no more than 99.994%. (Don't forget to add in your organization's  potential downtime. In this calculation, 0.00001% outage was assumed.) 

Of course, your organization may be lucky and achieve higher availability. Risk planning though is based on likelihood and not luck. If key service providers are committing to much lower availability or not committing to any uptime goal then you should negotiate better terms, find new service providers, or make other contingency plans.   

The risk exercise should be completed for each major business function. For example, if you are a public company and systems to report quarterly earning are unavailable is also a significant issue. 

Risk Template: Data Breach (Part 2)

Data breaches continue to be a significant risk factor that must be considered in your organization’s risk analysis. There were nearly 1,500 reported data breaches in 2019 accounting form more than 160 million sensitive records exposed. A data breach risk Template with sample verbiage is provided to help you analyze, document, and communicate your organization’s risks.

This is the second in a series of articles to cover risk areas (e.g., compliance, breach, availability). If you read the previous article, the Goal and Process sections are identical. The Template section has been updated for the data breach risk.

Goal

Although there are many great resources that can help you complete a risk analysis (such as ISO31000 and NIST), there are limited resources on examples on how to put together your risk report. The template below provides a starting point with verbiage for you to edit for your organization's requirements.

Process

The template below shows the order of how to document your findings. However, the analysis steps are different. Check the template for more detailed directions for each step below.

1. Determine scope - What data and what data owners are handled by your organization. Please note that even if you do not retain the data, you are still subject to the regulations. See section labelled "Scope: Data Assets".
2. Review each sub-risk to uncover your vulnerabilities. Consider the various threat actors See Sub-risks Section for Risk A - Risk F.
3. Determine the risk ranking. See Risk Ranking Section.
4. Complete the template

Once you have completed your annual security risk assessment, distribute it to the Board of Director members and executives. Resolve risks found focusing on highest risks first. Keep leadership apprised of progress with regular updates throughout the year.

Finally, remember to complete risk assessments throughout the year when there is a significant change planned for the technical, physical or administrative environment.

TEMPLATE WITH SAMPLE VERBIAGE

Risk Description

Here is some verbiage that you may edit for your risk report. 

• The organization is exposed to financial, reputational, business, and legal consequences due to a confirmed incident in which protected data has been accessed and/or disclosed in an unauthorized fashion.
• A significant breach may result in multimillion-dollar fines, greater regulatory oversight, terminated carrier contracts, loss of consumer confidence, brand erosion, reduced revenue, a shift in focus from business growth to remediation.
• A breach that is caused by a lack of basic security controls would only exacerbate these poor outcomes.

Context

The purpose of this section is to provide compelling examples that an investment in reducing the organization's breach risks is warranted.

• Highlight the most egregious risks found during your analysis
• Provide statistics and illustrations of challenges your organization faced throughout the year. For example, compared to last year there was an x% increase in accidental forward of data to the wrong entity.
• Add case studies from other organizations in your space that experienced a data breach that caused significant impact. For example: Company Z was breached and lost x records. The root cause was xxxxx, which is a security capability that is not mature at our organization.

Risk Ranking

Once your analysis is complete (see sub-risk section), then describe the range of risks. Settle on consolidated risk.

• Likelihood - Low, Medium, High. Select one.
• Typically compliance risks vary where some are more likely such as inconsistent use of controls and less likely that there are no policies. Provide examples of different likelhood events.

• Impact - Low, Medium, high. Select one.

• An example of a lower impact incident is: If an employee inadvertently emails protected data to the wrong customer or business. Although this incident is lower impact, it is not inconsequential:

  • Most business partners require reporting of such incidents. This will likely lead to in-depth review of the organization's cyber and privacy program.
  • Sometimes the customer who received data inappropriately will report the event to the government or social media. 

Threat Actors

The threat actors to consider are listed below.

T1. Unaware insider including BPO

T2. Malicious insider including BPO

T3. Cybercriminal

T4. Property thief

T5. Industry spy

T6. Nation state

Sub-Risks 

The list below defines the multiple potential ways a data breach may occur. The examples are just a starting point of potential root causes. 

Sub-Risk A. Accidental leakage of electronic data

Examples:

• Moving of data to less secure zone given the data's categorization including inappropriate use of personal accounts is likely since poor access controls and no DLP. 
• Forwarding data to the wrong recipient is likely when poor manual procedures exist.
• A configuration or other human error where data is posted without authentication controls. Department shared drives often have poor access controls.

Sub-Risk B.  Viewing data when not necessary for job role or current activity

Examples:

• Employees look up records of family and friends. 
• Production data is used in non-production environments. 

Sub-Risk C. Stolen electronic data

Examples:

•  Limited deployment of basic security controls.

Sub-Risk D. Stolen / lost portable devices containing electronic data

 Examples:

•  Laptop is stolen from employee’s vehicle that was not properly encrypted
•  Disposal of decommissioned hardware does not follow required standards.

Sub-Risk E.  Stolen / lost paper documents

Examples:

•  Paper documents are not recycled securely

•  Paper documents are left unsecured on desk or file cabinet.

 Sub-Risk F.  Accidental leakage of verbal conversations

Examples:

•  A malicious roommate of a remote employee overhears credit card information and uses it to commit fraud

•  A malicious employee (without a need to know) overhears a conversation and protected data 

Scope: Data Assets 

The asset list below covers typical assets handled by organizations. Delete those not applicable to your organization. See Risk Template: Compliance post for more details about regulations referenced below; specifically types of data and organizations covered. 

Asset 1: High value client data e.g., SSN, Medicare, credit card, other financial account data, other government ID

Regulations: Basic state breach regulations. GDPR, NY Cyber, NAIC states, CCPA. 

If credit card data, then PCI.

Asset 2:  Employee / contractor tax data

Regulations: Basic state breach regulations. GDPR, NY Cyber, NAIC states, 

Asset 3: Client health data

 Regulations: HIPAA/HITECH for health providers and insurers, GDPR, NY Cyber, NAIC states, CCPA 

Asset 4: 3rd party marketing data

 Regulations: GDPR, NY Cyber, NAIC states, CCPA, Business partners who provided contractual agreements

Asset 5:  Other personal data

Regulations: GDPR, NY Cyber, CCPA, business partners

Asset 6: Contract details

Regulations: Business Partners 

Asset 7: Material nonpublic information that could be used to inform stock trades.

Regulations:  U.S. Security and Exchange Commission Rules

 

How to Optimize Your Performance by Reconnecting to Your Biological Rhythms

It is 2:22 A.M. and I am working. I am not on a deadline nor did I procrastinate. I often find myself writing, reading or thinking in the wee hours of the morning.

Middle-of-the-Night Awakening is Normal

Historical research and scientific studies on sleep patterns found that I am not an anomaly. After years of believing I was suffering from insomnia, I now learn I am normal.

As reported recently in the New York Times, a history professor A. Roger Ekirch noticed references to a “first sleep” and a “second sleep” in numerous historical documents. On the scientific front, a psychiatrist, Dr. Thomas Wehr, conducted sleep experiments on subjects by depriving them of artificial light. The subjects would settle into a new sleep pattern. The new / ancient sleep pattern consisted of 2 shifts of sleep punctuated by a few hours of wakefulness.  [1]

Why Did We Stop Sleeping in 2 Shifts?

 Unlike my ancestors and the sleep guinea pigs, my schedule forces me to be up at a certain time. When I am tired and ready for my second shift of sleep, it is close to my “get ready for work” time. So I usually stay up.

As a systems thinker, I wondered why we stopped following our built-in biological clock.

My research found that it happened during the industrial revolution. Factories were huge capital investments. To get the most out of these investments, plant owners and investors used the plant as much as possible. Relatively cheap and unskilled workers were needed to serve the machinery and keep it running. 

It is at this juncture that we started to obey the tyranny of the mechanical clock. The mechanical clock was identified by the U.S. historian Lewis Mumford as  “the key machine of the modern industrial age.” Mumford considered the clock more important than the steam engine. [2]

While we have since upgraded to a digital clock, unfortunately, our sleep habits are stuck in the machine age.   

What's The Problem: 1 in 3 Workers Sleeps Too Little 

Much of our economy has shifted to knowledge-based work. Ours is an age where plant capital is less costly than highly skilled human capital.

And much of that human capital is not getting enough sleep to perform optimally.  30% of employed U.S. adults or nearly 41 million workers sleep too little. [3]

We Are Missing The Huge Benefits of Restorative Rest

More frequent deep sleep is beneficial, reports the previously referenced New York Times article, since each session of deep sleep allows the brain to recharge and “function at a higher level, identify patterns faster, recall information more accurately, store new learning in long-term memory, make connections that were hidden in a jumble of information” [1].

Napping is not only good for the head, it is good for the heart. "Subjects who reported napping systematically" states a study in the Archives of Internal Medicine, "had a 37% reduction in coronary mortality compared to participants who did not nap." Naps reduce bodily stress. Diseases that are susceptible to stress, such as heart disease, benefit from naps.[4]

High-performance Organizations Are Promoting the Nap

Some organizations recognize the link between sleep and performance. The 3PM power-nap is so common in the NBA that everyone in the league office knows not to interrupt the players’ restorative rest. [5] The U.S. military is exploring how to monitor soldiers' sleep and enforce nap times. Google provides nap rooms. And the Chinese, no slouches in worker productivity or hours worked, encourage and often mandate a nap.[1]

How Can We Fix It: Shift Back to Our Body Clock 

If we want to maximize our human capital we need to adjust our practices to biological rhythms and stop the unnatural and grueling machine pace. We wouldn't overwork a piece of equipment for long periods, so why do we exceed the biological capacity of humans?

There is historical precedent to make accommodations to our clock-based schedules. First proposed by Ben Franklin and implemented during WWI, daylight savings time was established to provide more light in the evening hours and less in the morning. Since our schedules are no longer governed by the sun, the amount of daylight falling at times when we are typically sleeping expands and is wasted. By shifting our clocks in the fall and spring each year, we harvest more daylight for our personal use

Remember to sleep when you are feeling grumpy, muddled or filled up with new information. And work when inspired. You may find, as I did, that the Sandman may vacate in the wee hours of the morning to allow the creative Muse to visit and inspire.

We are such stuff
As dreams are made on, and our little life
Is rounded with a sleep.

William Shakespeare in The Tempest 

Notes and References

1. New York Times Article on napping – "Rethinking Sleep". Read more at  NYTimes >>

2. Lewis Mumford and the clock. Read more at Wikipedia >>

3. Employee sleep patterns were analyzed by the Center for Disease Control using data captured by the National Health Survey. Read more at the CDC >> 
4. Midday napping benefits. Read more at Healthline >> 
5. NBA Napping. Read more at NYTimes >>

Encouraging Robust Passwords

 As InfoSec professionals, we understand that a robust password is still an important first line of defense. Password dumps continue to prove that the user community has not fully embraced robust passwords. 

The following communication examples will help reinforce the "strong password" message. The guidance provided recommends long, random passwords and that a tool be used to help create such a password. 

THEME #1 – Password obsolescence 

Is your password keeping up with technology?

                        Your password may have been strong last year, but it is now hacker-bait. 

Endless technology advances make it cheaper and easier for hackers to crack your password. 

Upgrade your password by using this tool [link] to

Generate a strong password of at least 12 random characters.

THEME #2: Humans are poor password generators

                                       Perfectly Evolved for Creating Poor Passwords

  Our brains inevitably create passwords with patterns. 

Understanding those patterns and then using automation gives hackers the advantage. 

To stop hackers, use this tool [link] to 

Generate a strong password of at least 12 random characters. 

A Clever Password is Like a Dumb Password

Hackers have invested enormous effort to understand how we create passwords; whether dumb (password1) or clever (cmli&OCMLM01).

Using analytics and powerful computers, hackers are then able to crack our passwords quickly; even the clever ones.  “cmli&OCMLM01” is a phase phrase “Challenges make life interesting and overcoming challenges make life meaningful”.

To stop hackers, use this tool [link] to generate a strong password of at least 12 random characters. 

THEME #3: Benefits of a tool. 

Would you try to beat a chess master teamed with a computer?

                                      

Hackers use computer analytics plus their years of experience to beat you at the password game.  

Win the password game by using this tool [link] to

Generate a strong password of at least 12 random characters.