Skip to content

When the Target is Also the Threat

In my last post, I took that LastPass attack as inspiration to write about how security tools can not only be less secure than advertised but can actually become threats in and of themselves. LastPass password vaults were supposed to keep all user’s passwords safe in one place – instead, the vaults allowed hackers to steal all those passwords at once. The defense caused the damage, as much or more than the attackers did.


I began thinking about this concept again today as flights across America were canceled due to an outage in a Federal Aviation Administration (FAA) computer system. The obscure but essential system, called Notice to Air Missions (NOTAM), provides pilots with information about potential flight hazards such as icy runways, high-elevation construction, or migrating birds. NOTAM went down, pilots couldn’t get this data, and thousands of flights had to be grounded as a result. It would have been a huge risk to fly otherwise.


The situation is only a few hours old at this point, so the cause of the outage hasn’t been reported. Officials have said it wasn’t a cyber attack – but whether they could know that for certain already is questionable, as is whether officials would admit to an attack being the true cause of the outage. Officials have the means and motive to obfuscate the cause, especially if a foreign government was somehow behind the outage. But even if the outage was not the result of an attack, as reported, it does not bode well, either for the FAA, the airline industry, or for any of us, frankly.


Watching a Trend Emerge


The airline industry is known for sudden, large-scale problems. It’s almost a cliché. But recent events still feel remarkable. Today’s FAA outage comes shortly after a technical glitch forced Southwest Airlines to cancel hundreds of flights at the peak of the holiday travel season.


That glitch happened in their staffing system. When a major winter storm hit the East Coast, forcing many Southwest staffers to call out, the airline had to scramble to redirect resources and reroute flights. Unfortunately, the staffing system couldn’t keep up with making changes on that scale and collapsed under the pressure, leaving Southwest without a way to send staff where they were sorely needed.


In the wake of the staffing system going down, blame has been pointed at aging technology that couldn’t keep up with the speed, scale, or sophistication of today’s computing requirements. We don’t know the cause of the NOTAM outage, but FAA insiders have suggested that decades-old technology may be responsible. There hasn’t been a similar flight stoppage since 9/11, so the NOTAM technology has a history of reliability. If it wasn’t a cyber attack that brought it down, the next most logical conclusion is that the system itself is starting to show its age.


That can only mean one thing: what happened today will start to happen more often. We can already see the trend in progress. Unfortunately, I think we will start to see it progress even further, accelerating and extending to other industries because the problem of expired technology controlling key systems is hardly reserved for the airline industry only.


System at Risk of Collapse


Look deep enough into just about any system, structure, or supply chain and you will find a piece of legacy technology controlling a critical process. They have persisted longer than anyone anticipated. And at this point, they are so deeply entrenched that some (or maybe even most) seem impossible to root out and replace.


It has been well documented that legacy systems are harder to make secure and keep secure, consuming more security resources while still creating more security risk. Less discussed, however, is that no amount of security can prop up a system that is approaching or past the brink of collapse. And when that point arrives, the damage is as bad (or worse) as any attack. Just look at what’s happened to airlines in recent weeks – massive damage to revenues and reputations all because old software started to act its age.


I think we will start to see similar collapses happen more often, more disruptively, and more unexpectedly in the near future. In so many areas, we have not so much replaced the old with the new as balanced the latter on top of the former. And now the foundation is crumbling.


As with my piece on the LastPass attack, my point is not to be defeatist about the future of technology. Rather, I want to take a more expansive view of cybersecurity – one focused less exclusively on defense and more on risk and resilience. How we get there is a massive question (leave your thoughts in the comments). But if there’s any silver lining to today’s airline apocalypse, it’s that maybe it pushes us one step closer to making change.

#cybersecurity #airline #FAA #Mainframe #Legacy

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About VRX
VRX is a consolidated vulnerability management platform that protects assets in real time. Its rich, integrated features efficiently pinpoint and remediate the largest risks to your cyber infrastructure. Resolve the most pressing threats with efficient automation features and precise contextual analysis.

The Uncomfortable Implications of the LastPass Attack

Several weeks ago, one of my news feeds served me an article about how people continue to pick the very worst passwords possible: everything from ABC123 to their own first and last name. Considering how easy it is for hackers to guess, buy, or break passwords, the bar for picking strong passwords is getting higher than ever – meaning the difference between bad and very bad passwords is non-existent.


Password strength wasn’t what was interesting about this article. What stuck out for me was how persistent the password problem has been – years of training, explaining, pleading, and sometimes even incentivizing haven’t done much to get people to use stronger passwords.


A password manager like LastPass was supposed to be the solution. It offered a streamlined way to turn every password into a strong password, enter the login details automatically, and keep everything safe inside an encrypted vault. LastPass seemed like a win-win: stronger security plus streamlined access. But then we learned through a story that’s been unfolding in recent weeks that attackers managed to steal some of those vaults. And if they manage to crack them open, they will have access to the login credentials for many thousands of personal accounts.


I had originally planned to write about the LastPass attack as a sign that passwords are on their last legs and woefully in need of replacement. But I think most people held that opinion even before the LastPass attack. What’s more, alternatives to passwords have never been more numerous or viable, so I’m confident the era of password protection is coming to a close (whether or not I write about it).


Something besides the password angle stood out to me as I read more about the LastPass attack. Specifically, I was struck by how much LastPass bungled things at every turn, first with their own security, and then with their response to the attack. The problem was not passwords (they were the victim, really). Rather, the problem was LastPass, which promised to protect passwords and then failed at the one thing it was supposed to excel at.


Which leads to an uncomfortable but unavoidable line of inquiry: What other protections are less secure than they seem? Have other vendors made promises that they can’t or won’t honor? Is there any way to know for sure whether you’re as safe as you think? Can anyone really count on cybersecurity?


Vendors are a Weaker Link Than You Think


There has been growing awareness that the IT products a company uses could get weaponized as part of supply chain attacks, which have received a lot of attention lately. And while companies understand that some vendors are stronger than others and some products are weaker than alternatives, we tend to see any protection as better than nothing. The LastPass attack reveals that’s a dangerous line of reasoning.


Reports suggest that security standards and practices at LastPass have been slipping for years, but the extent of that was not apparent until the attack (plus another attack 6 months prior) forced the company to make disclosures. Effectively, the company spent years cultivating trust, then used its positive reputation to let security slide without people noticing.


If it can happen at LastPass, it can conceivably happen anywhere. And with the pandemic and its aftereffects putting so many companies through internal turmoil, who knows where else has become a shell of its former self, waiting for an attack to expose formidable security measures as brittle defenses. And if it can happen to something as fundamental to security as a password vault (the crown jewels for attackers), logically any asset could currently be exposed because of the potentially bogus defenses around it.


If that sounds hyperbolic, take a quick mental review of the security stack. Can you be confident that all of the vendors included therein are taking security as seriously as necessary, particularly when it may conflict with the bottom line? My point is that strong defenses can turn into weak ones without anyone noticing.


Of course, SLAs and other contractual obligations can help mitigate this. But even with those obligations in place, sometimes companies go south – suddenly, swiftly, and surprisingly. And when they are involved with cybersecurity, users often get caught up in the collapse.


The possibility that you’ve surrounded yourself with paper tigers is certainly a frightening thought. But, I must admit, it’s remote (LastPass is an outlier). And there’s a silver lining: it takes less time to vet and review vendors than it does to detect and respond to threats.

#Cybersecurity #Authentication #LastPass #Vendor #Password






About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About VRX
VRX is a consolidated vulnerability management platform that protects assets in real time. Its rich, integrated features efficiently pinpoint and remediate the largest risks to your cyber infrastructure. Resolve the most pressing threats with efficient automation features and precise contextual analysis.

Navigating the Changing Landscape of OT Security in the New Year

It’s become somewhat of a ritual at the beginning of every year, (almost) every company comes up with a review of the past year, and an attempt to forecast what the next 12 months will bring. This year is more challenging than ever. Not only are geopolitical tensions and conflicts at an all-time high but there’s a lot of uncertainty due to the bear markets and the almost inevitable recession that is lurking.

2022 was a year of incredible growth and evolution for OT cyber security. If there is one word that sums up the past year in my mind, it is “change.”

Continue reading

Why runZero is the best way to fulfill CISA BOD 23-01 requirements for asset visibility – Part 1

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) recently published the Binding Operational Directive 23-01 for Improving Asset Visibility and Vulnerability Detection on Federal Networks. CISA’s asset visibility requirements are doing a big part in moving the industry forward and evolving our approach to asset inventory while also highlighting the importance of asset inventory in relation to national or organizational security.

The directive covers both vulnerability management and asset inventory. This blog post only focuses on the relevant parts for asset inventory. However, there are some important areas where the two disciplines interact and asset inventory is better suited to fulfill the requirements.

CISA recommends unauthenticated scanning for asset discovery

Many organizations are using data sourced from authenticated vulnerability scans and installed EDR agents to derive asset inventory. CISA’s directive demonstrates that while this is a viable way to augment the data set, it is no longer sufficient:

“Asset discovery is non-intrusive and usually does not require special logical access privileges.”

“No special logical access privileges” translates to either unauthenticated active discovery or passive collection, which is confirmed in the following statement:

“Discovery of assets and vulnerabilities can be achieved through a variety of means, including active scanning, passive flow monitoring, querying logs, or in the case of software defined infrastructure, API query.”

API queries are only recommended for software defined infrastructure, such as cloud-hosting other virtualized environments, but not for your physical network.

Log files can be a helpful way to augment breadth of asset inventory but they do not yield depth. DHCP and DNS logs don’t yield much more information than IP addresses, hostname, and MAC addresses. This misses the essence of what a device is: you know it’s there but you don’t know what hardware and operating system it’s running or what ports and services are active.

CISA directive solves for unmanaged devices

When talking to security teams about challenges with their asset inventory, they frequently cite unmanaged devices as the biggest headache. The CISA directive seems to optimize for unmanaged devices since these are the hardest to cover.

Many asset inventory vendors, particularly those in the CAASM (Cyber Asset Attack Surface Management) space, claim that you can magically solve for unmanaged devices via integrations with existing tooling. That is a great pitch, but it ignores the fact that security teams have tried to use the data from vulnerability scanners and EDR agents for asset inventory for a long time and failed. They do not provide the right data–we’ll get to why in part two of this series.

CISA is well aware of this fact and recently published a binding directive that requires more than just integrations for solving asset inventory.

We’ll take a deeper look into why that is throughout this blog series. Stay tuned for more details and subscribe to our blog so you don’t miss out.

Follow the story

Part two of this story was published on Tuesday, January 18, so be sure to follow the story. Also, don’t forget to subscribe for regular blog notifications.

Try runZero for free

See how you can comply with CISA BOD 23-01 using runZero.

Get started
Learn more about runZero

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About runZero
runZero, a network discovery and asset inventory solution, was founded in 2018 by HD Moore, the creator of Metasploit. HD envisioned a modern active discovery solution that could find and identify everything on a network–without credentials. As a security researcher and penetration tester, he often employed benign ways to get information leaks and piece them together to build device profiles. Eventually, this work led him to leverage applied research and the discovery techniques developed for security and penetration testing to create runZero.

Fostering a culture of kindness at runZero

Our world today is so fast-paced that sometimes kindness can take a back seat. At runZero, kindness is in the front seat, guiding how we work together as a company.

For us, it was really important for kindness to be one of our core values–not only because it aligns with how we work–but because it makes all of us successful as a result of it. We really believe that a kind environment cultivates meaningful work experiences that help drive greater success for our customers, employees, and partners alike.

To really deliver on instilling kindness throughout our company, we really focus on:

  • Always assuming good intentions
  • Being kinder than necessary
  • Working at sustainable levels
  • Hiring based on attitude and aptitude and promote accordingly
  • Being fair and respectful of the candidate and employee experience

Always assume good intentions

When we talk about kindness, we start with a shared understanding that everyone has good intentions. Oftentimes, even when someone makes a decision that seems a bit miscalculated, they do it with good intentions. That’s why we strive to assume kindness before anything else.

Instead of going into a conversation on the defense, it’s more productive to come prepared to have an open discussion. Asking questions demonstrates that you truly want to understand someone. For example, if a teammate has taken a different approach on a project, rather than making a statement, ask, “Can you help me understand why you chose this approach?” This kind of communication helps to build trust and kindness, as well as communication, in the workplace.

Be kinder than necessary

It’s not always obvious what someone is going through, so we genuinely ask people how they are doing. Whenever I’ve gone into a situation with guns-a-blazing, I’ve always regretted it afterward. It’s better to keep in mind that there might be something more going on. After all, there may be other things going on in their lives, including family, personal, and medical issues.

Compassion has a profound impact on people and can help create a supportive environment for everyone to thrive. For leaders and managers, it’s important to be compassionate and ask questions when an employee is significantly underperforming compared to their baseline. Try something like this: “I’m getting the feeling that I’m not getting your best work lately. Is there something going on in your life that I should be aware of? Is there any way I can help?”

This kind of warmth not only creates goodwill between both parties, it also indicates you are a more attentive leader. One study, which tracked more than 50,000 leaders, found that those in the top-quartile of performance ranked high on levels of warmth. As it turns out, the nice ones do finish first.

Work at sustainable levels

Some people have trouble believing this, but taking time off makes you a good employee. As leaders, it’s important to set this example.

Having down time allows us to take care of ourselves, our loved ones, and our colleagues. I recognize that it can be difficult to do in startup environments when there’s not enough people to go around to handle all the tasks. However, it’s crucial to make rest a priority for all. Otherwise, you may end up with a different set of problems when conflict inevitably arises inside your teams due to stress.

If your company has a PTO policy of “take whatever you need,” it can be helpful to track your days off in a spreadsheet. Research shows people actually take less than they should, so this is a good way to hold yourself accountable. As a leader, check in with your teams and make sure they are taking the time off they need to be productive.

Hire based on attitude and aptitude and promote based on merit and company needs

When it comes to hiring, we focus on more than just experience. We place a high value on attitude and aptitude, so that everyone has an equal opportunity to join our team and grow their career.

Just because someone has been doing their job for a long time doesn’t mean they are the best at it. We are trying to encourage more diversity in the technology sector, and if we rely mainly on years of experience, then we are dipping into the same talent pool as everyone else. We focus more on demonstrable skills and an attitude that is in line with our cultural values as a company.

We also strongly believe in promoting from within where possible, based upon merit and what best aligns with the needs of the company. This helps minimize regrettable attrition and reduces the amount of time onboarding new employees.

In order for our culture to thrive, positivity is essential. Negativity can spread like wildfire, so we take it seriously.

Be honest about the job

As much as we’re screening a candidate, the candidate is screening us as an employer. We are both trying to discover if we’re the right fit, so it’s important for both of us to be honest.

As an employer, we strive to be transparent with our prospective candidates by publishing salary range data so they can make an informed decision. We are also candid about the challenges of the role and our company, which helps build trust in our relationship. We ask all our candidates to be honest in their assessment of their skills, values, and concerns they may have about the role. We want everyone to start off on the right foot.

Another way we demonstrate kindness to employees is by compensating fairly. We pull benchmark data and compensate at the 75th percentile, meaning we pay better than 75% of employers hiring for comparable roles.

Our employees form the backbone of our company and we want to show how much we value their contribution.

Be fair and respectful to candidates and employees

Rejection is tough, no matter the circumstances, but kindness goes a long way in alleviating the sting of rejection. We try to be as empathetic as possible when dealing with departures of any kind–whether they come from a job application or within the company.

When a prospect has been in the late-stages of interview rounds and we feel we have helpful feedback, we offer to share it. We let them know it’s honest, constructive feedback, but we also also give the candidate the option to decline, as we understand that feedback can be hard to receive, depending on what’s going on in their life at the moment.

For outgoing employees, our company culture works hard to ensure kindness and respect during these transitions. Even when legal best practices restrict our ability to share details, we always strive to uphold our reputation of kindness and understanding at all times. We understand that people sometimes just don’t fit into roles and don’t take it as an indication that someone is a bad person or employee.

Why kindness = success

Kindness isn’t just so people feel good about their work. It’s also for the success of your company. A kind, fair, and just culture sets a strong foundation for employees to feel secure in their environment which increases productivity. A healthy company culture reduces conflict amidst employees so they can focus their energy on collaboration and productivity. Hiring is easier because you screen for candidates that share the same values and you create a positive reputation with candidates and recruiters.

Frankly, it’s also just the right thing to do. Companies are made up of people who deserve kindness from others.

Want to join our team?

Explore our open positions and find the perfect fit for you. Discover why runZero is the best place to build your career.

View open roles
Join our team

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About runZero
runZero, a network discovery and asset inventory solution, was founded in 2018 by HD Moore, the creator of Metasploit. HD envisioned a modern active discovery solution that could find and identify everything on a network–without credentials. As a security researcher and penetration tester, he often employed benign ways to get information leaks and piece them together to build device profiles. Eventually, this work led him to leverage applied research and the discovery techniques developed for security and penetration testing to create runZero.

×

Hello!

Click one of our contacts below to chat on WhatsApp

Social Chat is free, download and try it now here!

×