Cybersecurity is one of the most in-demand and rewarding fields in the IT industry. As cyberthreats continue to evolve and pose challenges to individuals and businesses, cybersecurity professionals need to have a diverse set of skills to protect data, networks, and systems.  

We understand that each organization and security operations team will vary somewhat, and that some of these skills may be of more or less importance depending on the roles within each organization. That is to say, there’s not a one-size-fits-all set of skills. 

However, given the trends of the increasing complexity and sophistication of cyberthreats, the ongoing shortage of cybersecurity talent, and the expanding scope of cybersecurity domains, these diverse skills are more valuable than ever. 

Here are 8 skills that are essential for modern cybersecurity professionals: 

1. Fundamental technological skills: A solid understanding of fundamental concepts and principles of information technology forms the bedrock of cybersecurity professionals' expertise. This encompasses a range of essential competencies, such as network configuration and management, firewall installation and configuration, administration of various operating systems, encryption, antivirus, VPN, and more. These skills can help them understand how systems work and how to secure them. They can also acquire these skills through certifications or courses. 

2. Programming and scripting languages: Proficiency in various programming and scripting languages, such as JavaScript, Python, C++, and SQL will be required for most cybersecurity roles. These languages enable professionals to write, test, and deploy secure code, automate tasks, analyze data, and create solutions. Depending on the purpose and scenario, different languages can offer different advantages and functionalities. For example: JavaScript for web development and security; Python for data analysis and automation; C++ for low-level programming and reverse engineering; SQL for database management and injection attacks. 

3. Verbal and written communication: Verbal and written communication are crucial skills for cybersecurity professionals. Explaining technical concepts to non-technical audiences, writing clear reports and documentation, and collaborating with others are key tasks in most security roles, from analyst to C-suite. By having excellent communication skills, professionals can present their ideas and insights effectively and persuasively. This is essential when considering timely communication in the event of an incident. By having excellent communication skills, professionals can build trust with clients and stakeholders, proliferate knowledge among users and employees, and positively influence senior management and decision makers when reviewing cybersecurity solutions. 

4. Logical thinking and troubleshooting: Cybersecurity professionals need to have strong analytical and problem-solving skills. They need to be able to analyze problems, find root causes, apply solutions, and troubleshoot technical issues to improve their security performance. By using logical thinking and troubleshooting skills, professionals can solve complex and challenging problems in a systematic and efficient manner. They can also use various examples of the common problems or challenges they face and how they solve them. For example: using the OSI model to troubleshoot network issues; using debugging tools to fix code errors; or using root cause analysis to identify the source of a security breach. 

5. Risk identification and management: Risk identification and management is a crucial skill for cybersecurity professionals. It involves assessing vulnerabilities, creating solutions, and implementing security policies and practices. By identifying potential threats and risks posed by internal and external sources, professionals can devise appropriate countermeasures to protect their assets and operations. Moreover, by monitoring and evaluating the effectiveness of their security systems and processes, they can ensure continuous improvement and compliance. Cybersecurity professionals can also use various frameworks or methodologies to perform risk identification and management effectively, such as NIST 800-171, ISO 27001, ARS v3.1.  

6. Threat intelligence: Remain knowledgeable of the latest threats, attack vectors, and techniques used by threat actors. The ability to collect, analyze, and disseminate threat intelligence from various sources and apply threat intelligence to their security operations and strategies is key. This includes, but is not limited to, tasks such as threat hunting, vulnerability management, and incident response. By having threat intelligence skills, professionals can improve their situational awareness and visibility, enhance their detection and prevention capabilities, reduce their response time and costs, and support their strategic planning and decision making. They can also use various tools, platforms, or frameworks to collect and analyze threat intelligence data, such as threat intelligence feeds, threat intelligence frameworks like MITRE ATT&CK, and Threat Intelligence services.

7. Incident response and forensics mindset: Cybersecurity professionals need to be capable of effectively responding to and investigating security incidents by collecting and analyzing digital evidence, identifying the root causes, and recommending appropriate remediation actions. They need to be able to use various tools and methods, such as network forensics, malware analysis, memory forensics, and log analysis. By having an incident response and forensics mindset, professionals can handle complex and sophisticated security incidents, such as advanced persistent threats (APTs), ransomware attacks, or data breaches. They can also follow some of the best practices or standards to handle security incidents effectively, such as NIST 800-171.  

8. Desire continuous learning and adaptability: Last, but certainly not least, cybersecurity professionals need to have a growth mindset and a passion for learning new technology. They need to stay updated on the latest trends and developments in cybersecurity, learn new tools and techniques, and adapt to changing environments. By having a passion for learning, professionals can enhance their knowledge and skills, and keep up with the fast-paced and dynamic nature of cybersecurity. They can also use various sources or channels to stay informed and updated on new technological developments, such as blogs, podcasts, newsletters, webinars and pursue professional development opportunities, such as certifications, courses, or conferences throughout their career. 

Additional Skills that are helpful for cybersecurity: 

• Information security standards: Cybersecurity professionals should be familiar with various information security standards, such as ISO 27001, NIST Cybersecurity Framework, and PCI DSS. These standards provide guidelines and best practices for cybersecurity management and compliance. They also help them align their security objectives with their business goals and requirements. 

• Security control assessments and audits: Cybersecurity professionals should be able to perform security audits, test controls, and evaluate compliance. They need to be able to measure the performance and effectiveness of their security systems and identify areas for improvement. They also need to be able to provide recommendations and feedback based on their findings. 

• Governance, regulatory structures, and strategy: Cybersecurity professionals need to understand the legal and ethical aspects of cybersecurity, such as data protection laws, privacy regulations, and cybercrime legislation. They also need to be able to develop security strategies that align with their organization’s vision, mission, values, and objectives. They also need to be able to communicate and collaborate with senior management, stakeholders, customers, and partners. 

These are some of the top skills for modern cybersecurity professionals that can help you succeed in this dynamic field. By developing these skills, you can not only protect your organization’s data but also advance your career prospects. 

If you’re aiming to improve your organization’s threat detection and incident response (TDIR) capabilities, I’m willing to bet you’re annoyed and frustrated by trying to navigate the managed cybersecurity market that’s rife with imprecise terminology and vendors willing to bend definitions to fit their solutions. As a result, you have an extremely difficult job in trying to find the right solutions, let alone pick the best one.

So, in short, if you are looking for wider attack surface coverage, deeper threat detection, and faster incident response, I hope this article gives you some clarity and confidence in your evaluation process.

Step 1: Untangle the Market Categories

Unfortunately, cybersecurity market analysts and vendors invent a new solution category every time they simply improve a feature or introduce a new approach. As a result, to improve threat detection and incident response, you have to sift through the following market categories. I’ll explain my take on what actual nuances matter in each category.

• Managed SIEM (Security Information & Event Management): Let’s start here. If a vendor ever says “SIEM is dead”, walk away. It’s not. Cybersecurity starts with visibility. And visibility starts with effective data collection, normalization, and correlation. But also, SIEM is hard. Disparate data sources across endpoints, on-prem networks, cloud infrastructure, and SaaS applications has only made it harder. A vendor that says SIEM is dead is one that simply can’t do it well. But also, while SIEM is a fundamental capability, ask yourself if you need a more comprehensive solution.
• SOCaaS (SOC as a Service): Oh boy, an acronym within an acronym. You’ve outdone yourself cybersecurity market analysts! The SOC (Security Operations Center) should be a functional team of security experts with the right tech and robust processes to handle continuous monitoring, threat detection, and incident response. A vendor offering SOCaaS may have their own SOC technology, or they may be using third-party vendors; and their SOC staff may be employees, or they may be contractors.

• MSSP (Managed Security Service Provider): Taken at face value, this category sounds straight forward, but there is so much to be defined in terms of security scope. You can bank on one thing – it will be a managed service. But will it be 24x7x365 monitoring? Will it cover your entire attack surface? Is the MSSP a cybersecurity generalist that manages your firewall configs, performs penetration testing, conducts cybersecurity awareness training; or is the MSSP truly a threat detection and incident response specialist?
• MDR (Managed Detection & Response): This trips up a lot of people because of the ambiguity of coverage. The problem is there’s a missing word between “Managed” and “Detection”. What does the MDR cover? Endpoints? Networks? Cloud? What? Be aware that the answer is very different per MDR provider. Historically speaking, most MDR providers rely on EDR (Endpoint Detection & Response) platforms.
• Managed XDR (Extended Detection & Response): First and foremost, XDR refers to the technology platform and implies it covers a wide range of telemetry sources across endpoints, network, cloud, etc. But to what degree is of course the important question. How big is their data source integration library? Does it include your data sources? And what response? Ask the XDR vendor about extended response as well. What workflows can it trigger to expedite successful incident response? And lastly, consider the marriage of MDR service and XDR tech – Managed XDR – and investigate closely the vendor’s service level and flexibility to accommodate your needs.

Step 2: Consider Attack Surface Coverage

Once you understand the nuances of the categories and can articulate what scope of technology and service are important to you, next is to evaluate which vendors have the wherewithal to protect your environment. This is a great way to quickly pare down the field of contenders. Look for an online library of data source integrations or similar terminology. Disqualify any platform that doesn’t cover your IT estate, especially vulnerable legacy systems that might not always be fully patched.

Protect more than your “Digital Front Door”
Your business has many points of cyber-attack vulnerability

Step 3: Inspect the Detection

So, you’ve shortlisted the type of provider and shortlisted those that cover your assets. Now, it's time to inspect that coverage as not all data source integrations are created equal. Watch out for really weak integrations that may collect data but not really mine intelligence and serve up actionable alerts. Ask your vendor to explain their Common Indexing Model (CIM) which is what makes it possible for their system to identify Indicators of Compromise (IoCs) across multiple assets. A vendor’s integration is much more than ingesting data. Ask to understand these five (5) elements – Parsing Rules, Correlation Rules, Alerts, Dashboards, and Reports. A common requirement is in-depth Microsoft 365 integration.

Step 4: Be Skeptical About Response

This is where the rubber meets the road as they say. Because of the multiple stages and hands-on activity involved, Incident Response requires particular attention. Reality is you and the vendor should accept a shared responsibility (or “shared fate”) mentality to truly have a successful outcome. Ask your vendor about how much involvement you have in shaping the SecOps Runbook and IR Playbook. Ask about Automated Response as well as Guided Remediation support. Both machine and human involvement should be expected. Speaking of humans, throughout the tuning, monitoring, detection and response stages, insist on a full understanding of their SOC’s dedication to your environment and specialized roles in malware analysis, threat intelligence, threat hunting, incident response, and customer success management.

BONUS: Consider an MSP

Because of their intimate knowledge of the IT environment and advantages of an existing relationship, IT managed service providers (MSPs) are taking on more managed cybersecurity responsibilities including threat detection and incident response. A winning cybersecurity combination for many organizations is to work with an MSP that is a cybersecurity generalist but brings a Managed XDR specialist into the SecOps picture. Such vendors must be MSP-ready and account for multi-tenant management, flexible pricing models for continuous scaling up and down, and simple deployment.

A common dysfunction in many companies is the disconnect between the CISO, who views cybersecurity as an everyday priority, versus top management who may see it as a priority only when an intrusion is detected. The seesaw goes something like this: If breaches have been few and far between then leaders tighten the reins on the cybersecurity budget until the CISO proves the need for further investment in controls. On the other hand, if threats have been documented frequently, leaders may reflexively decide to overspend on new technologies without understanding that there are other, nontechnical remedies to keep data and other corporate assets safe.

Does your organization suffer from any of these?

Myth: More spending equals more security

McKinsey says, “There is no direct correlation between spending on cybersecurity (as a proportion of total IT spending) and success of a company’s cybersecurity program.” Companies that spend heavily but are still lagging behind their peers may be protecting the wrong assets. Ad hoc approaches to funding (goes up when an intrusion is reported, goes down when all is quiet on the western front) will be ineffective in the long term.

Myth: All threats are external

Too often, the very people who are closest to the data or other corporate assets are the weak link in a company’s cybersecurity program. Bad habits — like sharing passwords or files over unprotected networks, clicking on malicious hyperlinks sent from unknown email addresses, etc. — open up corporate networks to attack. In this study by Intel Security, threats from inside the company account for about 43 percent of data breaches. Leaders must realize that they are actually the first line of defense against cyberthreats, which is never the sole responsibility of the IT department.

Myth: All assets are equally valuable

Are generic invoice numbers and policy documents that you generate in-house as valuable as balance sheets or budget projections? If not, then why deploy a one-size-fits-all cybersecurity strategy? Does leadership understand the return they are getting on their security investments and associated trade-offs? Leaders must inventory and prioritize assets and then determine the strength of cybersecurity protection required at each level. McKinsey cites the example of a global mining company that realized it was focusing a lot of resources on protecting production and exploration data, but had failed to separate proprietary information from that which could be reconstructed from public sources. After recognizing the flaw, the company reallocated its resources accordingly.

These three myths are common, but the list goes on…Now it’s time to decide what to do about it. Research is a great start, but time is of the essence. According to a 2017 Forbes survey, 69% of senior executives are already re-engineering their approach to cybersecurity. What’s your next step?

EventTracker reviews billions of logs daily to keep our customers safe. See what we caught recently and view our latest demo.

Threats and threat actors continue to evolve and morph, creating advanced and even more dangerous tactics to mitigate. October is National Cybersecurity Awareness Month (NCSAM). NSCAM 2019 centers on the theme of Own IT. Secure IT. Protect IT., advocating a proactive approach to enhanced cybersecurity in the workplace and at home.

Your online web presence is the crown jewel of your business or government organization. Your website conveys your brand to prospective customers and often facilitates e-commerce and citizen services. It is also a doorway into your business, servers, and valuable financial data, as well as links you to a global supply chain network. Good website security is vital for data protection and even disaster recovery and resiliency.

Facts to Know

• 49% of small businesses have experienced a web-based attacks
• Over 75% of cybersecurity attacks are financially motivated, according to the 2019 Verizon Data Breach Investigation Report
• If a company has a password policy, 65% of small businesses say they do not enforce it
• Ransomware volume is up 50% globally in 2019, according to the Identify Theft Resource Center

Impacts and Motivations of Website Attacks Threats and attacks against your website or portal can lead to reduced revenue, dissatisfied visitors, compliance fines, and a lack of trust by valuable customers, e-commerce buyers, and business partners. Hackers have a wide range of motivations for website attacks:

Regardless of the hacker’s initial motivation, website threats are real and require a range of countermeasures to deter these attacks. Build cybersecurity into your site technology and staff practices from the start, don’t bolt it on after it’s too late.

Simple Website Protection Steps to Own IT. Secure IT. Protect IT.

Use authentication best practices. Eliminate credential compromise and account takeover by requiring strong passwords, implementing role-based access controls (RBAC), and eliminating logins immediately for departing employees and vendors. System admins with their privileged access to data centers and servers are especially targeted. Don’t make it easy for hackers to buy and sell your organization’s logins on criminal forums.

Disable unnecessary accounts and web plug-ins. You can’t manage and patch assets that are long forgotten and sitting unused. Hacker tactics, techniques, and procedures (TTPs) actively exploit legacy applications and systems with known security gaps that provide low hanging fruit to attack.

Implement regular vulnerability assessments. Avoid website attacks by identifying vulnerabilities, malware, and configuration gaps that leave you exposed. Think like a hacker with a systematic approach to vulnerability scanning and remediation.

Maintain good cyber hygiene. Don’t forget cybersecurity basics that are low hanging fruit for attackers: use network segmentation to partition your network to limit the “blast radius” and ease restoration after a cyber attack. Avoid vendor default settings that represent the first path that threat actors will attempt. Rapidly apply security patches when they are released, especially for website software and tools.

Automate data backups. Ensure regular data backups and store them separately from your operating network and servers. A robust backup strategy is crucial for data security as well as disaster recovery and continuity requirements for frameworks such as PCI DSS (Payment Card Industry Data Security Standards). Organizations with current backups who were impacted by malicious ransomware have been able to recover and return to operations with minimal impacts.

Add advanced endpoint protection.  Always-on tablets, laptops, and mobile devices make soft targets for attackers. It only takes a single user or misconfigured device for attackers to gain malicious access. Managed services such as EventTracker SIEM with Endpoint Detection and Response (EDR)  fortify your security and reduce attack surface that can make your organization and sensitive data vulnerable.

Enable visibility with full logging and monitoring. Today’s threat landscape demands more than a “set it and forget it” approach. Continuous monitoring 24/7 by cybersecurity experts provides early detection of targeted attacks as well as insider threats.

Our Approach

We understand that your website is crucial, representing your brand, building community trust, facilitating citizen services, and generating online revenue. Hackers are actively targeting websites with advanced tools that require advanced security to remain protected. A proactive approach to website security ensures compliance with regulatory mandates such as HIPAA (Health Insurance Portability and Accountability Act) and Protected Health Information (PHI). SOC-as-a-Service (SOCaaS) provides 24/7 visibility from security experts with an award-winning Security Information and Event Management (SIEM) that strengthens your website defenses, controls costs, and optimizes your existing IT and Security teams.

Conclusion

Constant internet connectivity provides opportunity for innovation and modernization, but also presents an opportunity for potential cybersecurity threats that can compromise your most valuable asset: customer and financial information. Your website is vital for brand visibility and to conduct business. It is crucial to maintain site security and access to the rest of your organization’s data and valuable assets. While there is no silver bullet, we covered some practical countermeasures to help you Own IT. Secure IT. Protect IT. and reduce the likelihood of website attack. 

Yet another recent report confirms the obvious, that SMBs in general do not take security seriously enough. The truth is a bit more nuanced than that, of course—SMB execs generally take security very seriously, but they don’t have the dollars to do enough about it—although it amounts to the same thing.

This year, though, SMBs are going to have to look at security differently. Why? That is because enterprise execs are repeatedly seeing their own networks hurt because of less-than-terrific security from SMB partners that do distribution, providing supplies or handling anything from backup to bookkeeping. Faced with their own security mandates—whether from PCI, HIPAA, European Union or any other external body—they are going to crack down on SMB partners.

Hence, unless you want those enterprise-level contracts to take a walk, your security return-on-investment (ROI) calculation just got a lot messier.

What new actions can SMBs expect from their enterprise-level partners in 2016? Until now, most have satisfied their obligations and kept their corporate counsels at bay through contractual agreements. In short, they put in their partner contracts that the partner is obligated to comply with a laundry list of security measures. Write it down, make SMB partners sign it and they’re all done.

The problem with enterprises going solely with the contractual obligation route is that the proverbial stick (as in carrot and stick) is limited to reactive situations. If something bad happens with the enterprise operation’s security and a forensic investigation eventually points the finger at the SMB partner and that probe specifically concludes that the SMB had violated the contract’s obligations, that SMB partner doesn’t merely lose the contract. They will also certainly be sued for the resultant damages, which could easily bankrupt some SMBs. That’s sufficient incentive/deterrent, right?

Not anymore. From the enterprise’s perspective, that stick only kicks in after a breach and only if enough evidence exists to tie it back to the SMB partner. Given the ever-increasing talent of many cyberthieves to hide and delete their trails, it’s a gamble that many cash-strapped SMBs are willing to take. What are the odds of both of those things happening, those SMB execs think, given the vast security arsenal deployed by their multi-billion-dollar enterprise partner?

Therefore, to up the real—as opposed to merely pledged—compliance with its SMB-partner security rules, enterprises are going to start surprise snap inspections and demanding access to sensitive IT systems. Some might even go so far as to try and entrap partners by creating fake sub-suppliers to respond to the SMB partner’s RFPs and see if they follow the rules and demand what they are supposed to demand.

Why would enterprises go through this effort, seemingly to hurt partners? Because that’s what will be required. If XYZ enterprise doesn’t loudly and publicly expose and punish a couple of SMB partners, a sufficient deterrence won’t exist.

The whole point here is to change that SMB exec’s ROI calculation. By increasing the number of ways an SMB partner’s lack of security compliance can be caught/detected, they want that ROI to force those partners to invest the security dollars. The rationale is essentially: “If you won’t invest in security because you need to for your own company’s protection, or because you have signed a contract that you will, then do so because we need to make an example of somebody and you don’t want that to be you.”

Next Step: how to deliver the most cost-effective security. Once you have conceded to the new ROI calculations and have decided that you must increase your security budget, the natural inclination—especially in an SMB environment—is to calculate the absolute minimum dollars to comply.

This is also known as checklist security, which is frowned upon. That said, it’s a step-up from rolling the dice that you won’t get caught. Here’s a trick: Guarantee your safety by having your people work with the enterprise partner’s IT security people on what your options are.

You may be surprised at how reasonable they can be. The best part is that by doing so—in e-mail as much as possible, to create a powerful paper trail—you are protected. Despite the bogus reputation of enterprise IT that they don’t sweat pricing details, they do. No one is better at squeezing a contractor nickel than a Fortune 500 IT security manager.

Not only will they steer you to the most cost-effective options, but they might even make a referral for you, so that you can benefit from a small taste of your partner’s volume-purchasing pricing. They might even help you out by participating directly in those vendor calls. After all, you are a partner.

And because you are working with them—and don’t forget that paper trail—you can’t be blamed for choosing whoever the enterprise IT people suggested.

OK, in reality, you can be blamed for anything.

The 5 W’s of security management

I’ve seen it happen about a thousand times if I’ve seen it once. A high profile project ends up in a ditch because there wasn’t a proper plan defined AHEAD of time. I see this more often in “squishy” projects like security management because success isn’t easily defined. It’s not like installing a web application firewall, which will be deemed a success if it blocks web attacks.

Security management needs a different set of drivers and a more specific and focused discussion of what is “success,” before solutions are evaluated. Before vendors are consulted. Before you do anything. I know it’s hard, but I want you to take a deep breath. If you can’t answer the following questions about your project, then you have a lot of work to do before you are ready to start thinking about specific solutions.

First and foremost, you need to have a clear understanding of your goals and your budget and make sure to line up your executive support. Ultimately someone is going to have to pay the check for whatever it is you want to buy. So you will be a lot better off if you take a bit of time up front and answer all these sticky questions.

A favorite tactic of mine is to ask the 5 W’s. You remember those, right? It was a grade school thing. Who, what, where, when and why? Pretty much anything you need to do can be clarified and distilled by isolating the issues into the 5 W’s. I’m going to kick start your efforts a bit and walk you through the process I take with clients as they are trying to structure their security management initiative.

Why?
The first thing to understand is WHY you are thinking about security management? What is the driver for the project? Are important things falling through the cracks and impacting your operation efficiency? Did an incident show a distinct lack of data that hindered the investigation? Maybe an auditor mandated a more structured approach to security management? Each of these (and a ton of other reasons) is a legitimate driver for a security management project and will have a serious impact on what the project needs to be and accomplish.

Once you have a clear understanding of why, you need to line up the forces for the battle. That means making sure you understand who has money to pay for the project and who has the final approvals? If you don’t understand these things, it’s very unlikely you’ll drive the project through.

Who?
After you have a clear idea of which forces will be at your disposal, you can determine the WHO, or which folks need to be part of the project team. Do the network folks need to be involved, the data center folks and/or the application folks? Maybe it’s all of the above, although I’d push you to focus your efforts up front. You don’t want to be in a position where you are trying to boil the ocean. You want to be focused and you want to have the right people on the team to make sure you can achieve what you set out to achieve. Which brings us to the next question…

What?
This gets down to managing expectations, which is a blind spot for pretty much every security professional I know. Let me broaden that. It’s an issue for everyone I know, regardless of what they do for a living. If you aren’t clear and thus your senior team isn’t clear about what this project is supposed to achieve, it’s going to be difficult to achieve it.

Any organization looking at security management needs to crisply define what the outcomes are going to be and design some success metrics to highlight those outcomes. If it’s about operations, how much more quickly will issues be pinpointed? What additional information can be gathered to assist in investigations, etc? This is really about making sure the project has a chance of success because the senior team (the ones paying the bill) knows where it’s going ahead of time.

Where?
This question is all about scope. Believe me, defining the scope effectively is perhaps the most critical thing you can do. Get it wrong on the low side and you have budget issues, meaning you don’t have nearly enough money to do what your senior team thinks is going to get done. Budget too high and you may have an issue pushing the project through or getting the approval in the first place.

Budgeting is much more of an art, rather than a skill. You need to understand how your organization gets things done to understand how you can finesse the economic discussion. A couple of questions to understand are: Is this an enterprise deployment? Departmental? Regional? Most importantly, is everyone on board with that potential scoping?

When?
The last W is about understanding the timeline. What can/should be done first? This is where the concept of phases comes into play, especially if your budget is tight. How do you chunk up the project into smaller pieces that can be budgeted for separately? That usually makes a big number go down a bit easier.

The key is to make sure you have a firm understanding of the end goal, which is presumably an enterprise-wide deployment of a security management platform. You can get there in an infinite number of ways, depending on the project drivers, the budget, and the skill set you have at your disposal.

But you certainly can’t get there if you don’t ask these questions ahead of time and determine a logical strategic plan to get to where you need to be. Many projects fail from a lack of planning rather than a lack of execution. As long as all of your ducks are in a row when you start the process, you have a much better chance to get to the end of the process.

Or you can hope for a good outcome. I heard that’s a pretty dependable means of getting things done.

Industry News

Cyber-crime bigger threat than cyber-terror

Although the threat of cyber-terrorism exists, the greatest risk to Internet communication, commerce and security is from cyber-crime motivated by profit. Attacks have evolved from cracking passwords into vast coordinated attacks from thousands of hijacked computers for blackmail and theft.

This holiday season will be like no other with the continued use of remote work, greater online sales, third-party sourcing from across the globe, and employees taking much-needed time off. Cyber criminals will take advantage of these seasonal distractions to steal sensitive data, hold it for ransom, or use you as a stepping-stone to more lucrative victims. Hackers often strike when businesses let their guard down, gaining access to networks but laying low to strike later. Once centered on key shopping days like Black Friday and Cyber Monday, cyber attacks are now extending across all of November and December and into the new year, making comprehensive vigilance and 24/7 visibility even more challenging. It’s time to fight back against cyber criminals with defense-in-depth resiliency for proactive protection at this crucial time of year.

Here’s a list of 8 threats to watch for and best practices to defend against them:

• Step Up Vigilance During the Holidays. Knowing that businesses will be short-staffed or even preoccupied at the end of the year, cyber criminals intentionally target businesses in Q4. As a first step, keep systems patched and remind employees about cybersecurity risks like phishing and preventative measures. Look for suspicious behavior such as access from countries where you don’t have any operations or customers.

• Protect Data in POS Environments. Point-of-Sale (POS) devices enable consumers to complete purchases and transactions safely. These devices access critical infrastructure and assets as well as communicate with payment processors and banks. POS threats can include file-less attacks, ransomware, zero-day attacks, and skimmers placed physically on devices. Use PCI DSS compliance standards as the starting point to identify POS risks and best practices. However, it is critical to realize compliance alone is not enough for adequate security.

• Don’t Overlook Work-from-Home Security: Your customers will continue to encounter more cybersecurity vulnerabilities as laptops remain outside the IT perimeter of headquarters. Employees may use work devices for online shopping or charity donations during the holidays, or conversely, use less-protected personal laptops for work tasks. Layered defenses can help you stay current on remote work threats to rapidly mitigate persistent and well-funded adversaries.

• Boost Endpoint Security. With over 70% of threats starting on network endpoints like laptops and mobile devices, it’s clear that traditional endpoint security tools like anti-virus are insufficient. Endpoint Protection Platform (EPP) capabilities can block and even prevent threats in real time before damage occurs.

•  Use Multi-Factor Authentication (MFA). Increased authentication protection with Multi-Factor Authentication (MFA) is an easy way to strengthen your security posture. MFA provides an additional layer of security that can compensate for weak or easily-guessed passwords.   
• Limit Access to Data. Access to sensitive information should always be on a need-to-know basis. Today’s security platforms offer Role-Based Access Control (RBAC) that restricts users from viewing sensitive data outside their job functions. Remember to take proactive steps to automatically remove access when no longer needed.

• Conduct Vulnerability Scanning. Think like a hacker and understand where your vulnerabilities lie. Managed vulnerability scanning identifying, prioritizing, and remediating security gaps before attackers find and monetize them. Many compliance regulations such as HIPAA and PCI DSS require vulnerability assessments.

• Maintain Comprehensive Visibility and Monitoring. A crucial foundation for security teams, a Security Information and Event Management (SIEM), begins with the collection, standardization, and storage of security event data to analyze and offer real-time alerts. Examples of suspicious activity that a SIEM detects include excessive or failed logins, authentication attempts that bypass privileged access management, and unusual increases or decreases in traffic or geographies. Managed Threat Protection by Netsurion includes a SIEM managed by a 24/7 security operations center (SOC) purpose-built to the needs of mid-sized businesses.

We’ve Made Your List. Now, Check It Twice!

‘Tis the season to be wary of cyber crime, as hackers don’t just attack larger enterprises. Cyber criminals also use advanced persistent threats (APTs) to target MSPs and mid-sized businesses. Adversaries often target mid-sized businesses because they are supply chain partners of larger firms or may have security gaps that are easy to exploit. Hackers are continually reinventing their tactics, techniques, and procedures (TTPs) to catch you off guard and evade detection, so it’s important to stay on top of vulnerabilities and real-world attacks. And as you look towards the future, ensure cybersecurity is a year-round priority. 

I found out how quickly a brand could change from being a favorite of mine to becoming an entity I would never trust again. The result was a new sense of awareness the hard way, and my last visit to our favorite food joint.

I was sitting in my office at work and decided to take a break to balance my credit card with my checking account. I went to my personal email to catch up as well, and saw an alert for a card. But the odd thing was, the alert was for a card I had recently closed and should have been at a zero balance.

The email notification showed it over $5,000!

This caused some feelings I don’t wish to recall. Had my identity been stolen? Who was to blame?

My eyes opened to this vulnerable position for the first time 10 years ago, and then shut indefinitely to the brand that happened to be part of this experience.

As a consumer, I decide what brands to purchase from or invest in based on my gut feelings about them.

I search for bargains, but I am also willing to pay more for quality, peace of mind, atmosphere, and how the experience of the brand makes me feel. Once I find a brand I like, I stick with it, loyally, unless something goes very wrong.

I go through a number of checkpoints all at once when making buying decisions, automatically. Things run through my head like: Do I like the packaging, the atmosphere, the product, the service, the price, and most of all do I trust them?

This applies to all industries, from food, hotel, and travel, to healthcare and retail.

Setting the scene

We frequented this wonderful place often. It was a micro-brewery with an amazing menu, nice atmosphere, great service, and best of all, it was a newer restaurant close to home.

By the time I was expecting my second child, our visits became weekly occurrences. I loved the healthy options they offered and my husband reveled in the sweet treats and savory fare.

This restaurant was a sit-down establishment, with wait staff. I would never have dreamed that our credit card data would be compromised there.

I hadn’t even thought about it being a possibility at small retail locations or large brand-name establishments for that matter.

Here's the deal:

Taking a step back, there is something you should understand about me. I am a Type A personality and completely in control of our finances. I love to save, I have a very high credit score, and have never in my life paid interest on a credit card, as I pay them off in full every month.

I earned my credit score by being responsible, which also came easy. I not only bought only what I could afford, I often passed on buying things that I could afford, and do this even more today. I used credit cards then, and now, because of the convenience, the points, and the sense of security in them over a debit card or cash.

So, what happened?

It all started with a peculiar email notification from my past credit card company, showing thousands of dollars in recent purchases on a card that was not in use. I picked up the phone and called the card’s customer service line immediately.

I told them the scenario: My card had been closed weeks prior, it should have shown a zero balance, and it showed that it not only had over $5,000 on it, the purchases were made overseas!

The customer service rep asked me if I lost the card because the purchases were made with a physical card on location. No, I had not. In fact, I had cut it up when I closed it.

That’s when a sense of loss, vulnerability, violation, and anger set in.

It felt very creepy too.

The card company of course took care of this right away for me and ensured the card was not used any longer. It did not impact me financially, but it did impact me emotionally.

After some research, I discovered that people can steal magnetic strip information from your card with a special tool, and sometimes there could even be servers at restaurants who might do this. They accept your card and take it with them for a few minutes, which is part of protocol, so we never noticed anything strange at first.

Once they have the magnetic strip, they can make a new physical card and sell it!

We narrowed it down to this scenario being the culprit, at our favorite place. This theft halted our weekly visits and in 10 years, we haven’t returned.

Is the customer king nowadays?

I think about this scenario from time to time, and realize how important it is for me to be able to trust the place that I’m doing business with.

Although the restaurant brand itself didn’t steal from me, their employee did, and so their brand was ruined.

This particular experience I shared was 10 years ago. Cyber criminals have been on the rise for years, continuing to find new ways to steal. My experience was a singular one. Imagine the implications of thousands or millions or consumers like me, experiencing a full breach of data. A brand is only as strong as the people who support it.

Today, I focus on protecting myself with security measures that include card monitoring services, on top of the fact that I review my accounts weekly and check every line item.

When I think of this, it begs the question: If a restaurant, hotel, doctor’s office, etc. decides to accept credit cards as payment, then why don’t they all want to protect themselves, let alone their customers?

This customer holds companies and brands collecting my data to high standards.

The Bottom Line?

The bottom line is that royalty leads to loyalty. The customer is king and always right. When a brand operates under this assumption, their business thrives.

This story was written by a consumer, based on a real-life scenario she experienced a few years back.

In the wake of the most recent terrorist bombing in Boston, it is easy to understand why some people would be willing to sacrifice a few liberties to the government in favor of more security.

A common train of thought is that an honest person does not have anything to hide, so the intrusion into our private lives is really a minor thing.

In a Utopian society, I would tend to agree with that sentiment, but we live somewhere else.

Privacy vs. Security

When it comes right down to it, think about what makes up our government. There are the buildings, the laws, and even the history, but in essence, our government is a collection of people.

For the most part, they are our friends and neighbors dedicated to servicing our needs and keeping our great country running. When you have a group of people, you can expect most of them to be upstanding citizens, but it would be naive to think that none of them would be unscrupulous. When the dishonest ones are given access to power, especially intruding into our lives, the results can be catastrophic.

Recently, a New York police officer was arrested for his part of hacking into his ex-girlfriends e-mail and abusing his access to police data.

While I hope he is proven innocent and that there has been some kind of misunderstanding, Edwin Vargas (a government representative), has been charged with paying a hacking firm to break into approximately 40 e-mail accounts (21 have been reported to be from fellow officers).

Also, he is accused of illegally accessing the National Crime Information Center database, which he is allowed to access because of his status as a police officer. There are rules governing the use of this database, and Mr. Vargas allegedly ignored them.

According to published reports, this activity had been going on between 2010-2012.

This kind of behavior is neither unique to Mr. Vargas nor surprising when you consider that some people just have a tendency to abuse power when they obtain it. With a quick search on the Internet, you can find thousands of cases where government officials abused their offices.

Ben Franklin got it right in 1775 when he said, “They who can give up essential liberty to obtain a little temporary safety, deserve neither liberty nor safety.”

We need to remember that the freedoms we give up to the “government” are being put into the hands of real people who may not have our best interests at heart.

“You see, but you do not observe. The distinction is clear.” Sherlock Holmes said this to John Watson in “A Scandal in Bohemia.” Holmes was referring to the number of steps from the hall to the rooms upstairs. Watson, by his own admission, has mounted those steps hundreds of times, but could not say how many there were. The same can be said in the world of IT cybersecurity. A lot of data, an overwhelming amount actually, is available from hundreds of sources, but rarely is it observed. Having something and getting value from it are entirely different.

This is also underlined in the story, “Peace Health employee accessed patient info unnecessarily.” On Aug. 9, a Vancouver medical center, Peace Health, discovered that an employee accessed electronic files containing protected health information, including patient names, ages, medical records, account numbers, admission and discharge dates, progress notes, and diagnoses. An investigation revealed that the employee accessed patient information between November 2011 and July 2017.

What? This had been going on for 5 years and was just discovered? It would seem this is another case of “You see but do not observe,” and indeed the distinction is clear. Log data showing what this employee was doing had been accumulating and faithfully archived, but it was never examined.

What was the impact? There was reputational damage, plus the costs incurred (letters, call center expenses, etc.), and possible fines by HHS for the HIPAA violation. Plus, there was disruption of regular tasks to investigate the extent and depth of this incident and related incidents that may have occurred.

Ben Franklin observed that an ounce of prevention is worth a pound of cure. The same is true in cybersecurity. We at EventTracker know that it’s hard to pay attention given the volume of security data that is emitted by the modern network. Therefore, we provide security monitoring as a service, so that you don’t just get more technology thrust your way, you gain the actual outcome you desire.

Businesses are always looking for ways to deliver increased value to clients while optimizing efficiency, and this year is no exception. Digital transformation, remote work, and economic uncertainty are just some of the challenges impacting organizations today. As you plan next year’s budget, it’s a good idea to assess current operational successes and opportunities to increase efficiency and effectiveness. Here are some practical recommendations to increase cybersecurity effectiveness and help you optimize finite budgets and time.

1. Simplify Your Tech Stack

Recent security breaches and ransomware attacks have led to a proliferation in point products that can add complexity and cost. Organizations have an average of 75 security tools, and “tool bloat” requires more experts to hire, train, and operate the technology. You can minimize cyber sprawl in order to enhance security and operational efficiency. According to Ponemon Institute’s “Cost of a Data Breach 2022” report, security system complexity was the top item of 25 that increased data breach costs.

While there’s no silver bullet or single vendor covering the entire threat chain, streamlining your technical infrastructure saves time and money. First, evaluate whether your organization has unused or even unsanctioned applications that create risk and can be jettisoned. Second, lo ok for cybersecurity solutions that improve attack surface coverage and address the broadest vulnerabilities and risks, all tailored to your security posture. Finally, consider integrated solutions like Netsurion’s Managed Open XDR that offers defense-in-depth with single-pane-of-glass visibility and a predict, prevent, detect, and respond approach to advanced threats.

2. Augment Your Staff with Managed Open XDR

The global shortage of over 3 million security professionals has created a cybersecurity staffing crisis. Almost 60% of organizations state that the staffing shortage impacts their risk posture. If you could hire a cybersecurity expert, retaining them over time becomes an even more significant challenge as larger enterprises woo staff away. Managed XDR offers an affordable and flexible approach to enhance your existing staff and technical skills and scale up and down instantly.

With Managed XDR, you receive the Security Operations Center (SOC) “function” in a SaaS model along with cybersecurity experts, comprehensive technologies like SIEM and Endpoint Protection, and managed services like vulnerability assessments and network flow scanning. Our research shows that an in-house SOC requires 9-12 months to implement, involves 12 dedicated professionals for 24/7/365 coverage, and can cost anywhere from $1.5 to $5 million/year. On the other hand, Managed XDR accelerates your security maturity without CAPEX and the challenge of hiring and retaining technical experts. You can rapidly onboard your users with Managed XDR that scales with you.

3. Cloud-Deployed Security Controls Without Hardware

Managed Open XDR can include SaaS-based cloud deployment options. With no hardware to purchase or maintain, cloud-based security controls reduce total cost of ownership (TCO) with a pay-as-you-grow model. The platform is already implemented, provisioned, tested, and often paired with a managed service that speeds up onboarding and time-to-value. SaaS solutions make Work-from-Home (WFH) easy with its anytime, from anywhere access. In addition, a centralized cloud console lets you focus on your business and not on managing hardware. Also, log storage in the cloud scales with your customers to simplifying meeting compliance requirements. To deter today’s financially motivated threat actors, it’s crucial to protect sensitive data with comprehensive visibility across endpoints, mobile devices, and cloud.  

Next Steps

Security complexity is increasing in the face of exploding cyber threats. But there are ways to streamline IT operations and spend, all without sacrificing compliance, data security, and customer engagement:

• Adopt integrated defense-in-depth solutions to predict, prevent, detect, and respond to threats; and reduce the devices and tools you need to manage
• Minimize false positives and empower your existing IT team with Managed Open XDR
• Protect cloud data and SaaS solutions without hardware to buy and sustain

Staying competitive and profitable in this challenging environment requires a unified blend of people, processes, and technology. Whether you are implementing a SOC for the first time or augmenting to add weekend and after-hours coverage, 24/7 cybersecurity analysts in a managed service work as an extension of your in-house team. 

This post got me thinking about a recent conversation I had with the CISO of a financial company. He commented on how quickly his team was able to instantiate a big data project with open source tools. He was of the view that such power could not be matched by IT security vendors who, in his opinion, charged too much money for demonstrably poorer performance.

The runaway success of the ELK stack has the DIY crowd energized. Why pay security vendors for specialist solutions when a “big data” project that we already have going on, based on this same stack, can work so much better, the thinking goes. And it’s free, of course.

What we know from 10+ years of rooting around in the security world is that solving the platform problem gets you about a quarter of the way to the security outcome. After that comes detection content, and then the skills to work the data plus the process discipline. Put another way, “Getting data into the data lake, easy. Getting value out of the data in the lake, not so much.”

In 2017, it is easier than ever to spin up an instance of ELK on premises or in the cloud and presume that success is at hand just because the platform is now available. Try using generic tools to solve the security problem and you will soon discover why security vendors have spent so much time writing rules and why service providers spend so much effort on process/procedure and recruitment/training.

For the past several months, there have been numerous stories about major retailers that have been breached by hackers. The result is that millions of credit cards have been stolen.

In the case of Target, so far it is reported that 40 Million customer credit cards have been exposed, and 70 Million total records with personal information have been stolen. The customers who are affected in such a breach feel let down by the merchants who lost their data, and the merchants feel like victims because thieves stole data from them, but they are being blamed.

So what happens after the breach is announced?

Inevitably, a big retailer like Target makes some generic announcement talking about the efforts they are making to boost their security, and usually some kind of free credit monitoring service is offered.

In the case of Target, the website that was supposed to handle this service was so inundated by requests, that for several days, it was nearly impossible for their customer to sign up. This caused quiet a negative rash of social media backlash, and people in general seemed dissatisfied with Target’s response.

Compounding the issue is the fact that Target is facing huge lawsuits, so it is obvious that every announcement is being screened by both public relations personnel and their legal team.

What is Target to do?

I propose that Target and other large retailers who have been victimized use their capital resources to greater effect. Not only can they win back the hearts and minds of their customers who have had their credit cards stolen, but they will also cause other hackers to pause before attempting something as brash as stealing 40 Million credit cards.

Think about what would happen if Target offered $1 Million to anyone who provides information that leads to the arrest and conviction of the party (or parties) who were responsible for the breach.

When hackers launch attacks of this nature, rarely can they do it without assistance from multiple sources who have specific knowledge or skills as it relates to security. Programmers for example rarely also have skills to penetrate firewalls. Therefore, a team of people is usually assembled to pull off a major breach like the one that happened at Target. The thing is, groups of people rarely have the ability to keep everyone completely silent.

Also, this culture is ruled by the almighty dollar, and $1 Million is enough of a reward, that if someone let critical information out, it is likely the person they told would be swayed to turn them in rather than keep their confidence. Despite the old saying, there really is no honor among thieves, and it has been our experience that they will turn on each other when a profit is to be made.

Of course, it is easy from our perspective to spend Target’s money for them, and they have teams of people whose job it is to monitor and improve their image.

On the other hand, if you saw a full-page ad this weekend in the Wall Street Journal announcing that Target was offering this reward to help catch the thieves who have caused them so much trouble, would your opinion of the brand go up? Especially if Target went on a campaign talking about how we are all victims.

The idea would be that Target would spend its money to bring the criminals to justice so that we can all sleep better at night. Maybe it would have no affect, but the people we have polled thought that it would do wonders for Target’s image. All retailers might want to consider this kind of response instead of hiding behind a legal barricade.

It’s just a thought, but remember, ID theft is an attack that people take personally, so showing victims something that makes them feel better is the first step to helping them move on.

In 2005, the Department of Homeland Security commissioned Livermore National Labs to produce a kind of pre-emptive post-mortem report. Rather than wait for a vengeful ex-KGB hacker agent to ignite an American pipeline until it could be seen from space, the report issued recommendations for preventing an incursion that had yet never happened, from ever happening again.
 
Recommendation Number 1: Know your perimeter.
"The perimeter model is dead," pronounced Bruce Schneier, author of The New York Times' best seller Data and Goliath, and the CTO of IBM Resilient. "But there are personal perimeters. It doesn't mean there exists no perimeters. It just means it's not your underlying metaphor any more. So, I wouldn't say to anyone running a corporate network: There are no perimeters, zero."

"The traditional fixed perimeter model is rapidly becoming obsolete," stated the CSA's December 2013 white paper,” because of BYOD and phishing attacks providing untrusted access inside the perimeter, and SaaS and IaaS changing the location of the perimeter. Software defined perimeters address these issues by giving application owners the ability to deploy perimeters that retain the traditional model's value of invisibility and inaccessibility to ‘outsiders’, but can be deployed anywhere – on the internet, in the cloud, at a hosting center, on the private corporate network, or across some or all of these locations."

This reality invalidates the model of safeguarding the corporate network via the fortress model, one where all assets are inside and a well-defined perimeter exists, which can be defended. Instead, each asset requires a micro-fortress around it, regardless of where it is located. The EventTracker sensor enables a micro-fortress around and near the endpoint on which it operates. It provides host-based intrusion detection, data leak protection and endpoint threat detection. While the sensor itself operates on any Windows platform, it is able to act as a forwarder for any local syslog sources, relaying logs over an encrypted connection.
 
Welcome to your software defined perimeter.

Red teams attack, blue teams defend.
That’s us – defending our network.

So what attack trends were observed in 2015? And what do they portend for us blue team members in 2016?

The range of threats included trojans, worms, trojan downloaders and droppers, exploits and bots (backdoor trojans), among others. When untargeted (more common), the goal was profit via theft. When targeted, they were often driven by ideology.

Over the years, attackers have had to evolve their tactics to get malware onto computers that have improved security levels. Attackers are increasingly using social engineering to compromise computer systems because vulnerabilities in operating systems have become harder to find and exploit.

Ransomware that seeks to extort victims by encrypting their data is the new normal, replacing rogue security software or fake antivirus software of yesteryear that was used to trick people into installing malware and disclosing credit card information. Commercial exploit kits now dominate the list of top exploits we see trying to compromise unpatched computers, which means the exploits that computers are exposed to on the Internet are professionally managed and constantly optimized at an increasingly quick rate.

However, one observation made by Tim Rains, Chief Security Advisor at Microsoft was, “although attackers have accumulated more tricks and tactics and seem to be using them in a more focused, fast paced way, they still focus on a relatively small number of ways to compromise computers.” These include:

• Unpatched vulnerabilities
• Misconfigured computers
• Weak passwords
• Social engineering

In fact, Rains goes on to note: “Notice I didn’t use the word ‘advanced.’”

As always, it’s back to basics for blue team members. The challenge is to defend:

• At scale (every device on the network, no exceptions)
• Continuously (even on weekends, holidays etc.), and
• Update/upgrade tactics constantly

If this feels like Mission Impossible, then you may be well served by a co-managed service offering in which some of the heavy lifting can be taken on by a dedicated team.

Time is money. Downtime is loss of money. The technological revolution has introduced a plethora of advanced solutions to help identify and stop intrusions. There is no shortage of hype, innovation, and emerging trends in today's security markets. However, data leaks and breaches persist. Shouldn't all this technology stop attackers from gaining access to our most sensitive data? Stuxnet and WannaCry are examples of weaknesses in the flesh-and-bone portion of a security plan. These attacks could have been prevented had it not been for human mistakes.
 
Stuxnet is the infamous worm (allegedly) authored by a joint U.S.-Israeli coalition, designed to slow the enrichment of uranium by Iran's nuclear program. The worm exploited multiple zero-day flaws in industrial control systems, damaging enrichment centrifuges. So, how did this happen?

• The Natanz nuclear facility, where Stuxnet infiltrated, was air-gapped.
• Somebody had to physically plant the worm. This requires extensive coordination, but personnel in Natanz should have been more alert.
• Stuxnet was discovered on systems outside of Natanz, and outside of Iran. Somebody likely connected a personal device to the network, then connected their device to the public Internet.
• While Stuxnet went from inside to outside, the inverse could easily have happened by connecting devices to internal and external networks.

 
If human beings had updated their systems, we may never have added "WannaCry" to our security lexicon. WannaCry and its variants are recent larger-scale examples. Microsoft had issued patches for the SMBv1 vulnerability, eventually removing the protocol version from Windows. Still, some 200,000 computer systems were infected in over 150 countries worldwide to the tune of an estimated $4 billion in ransoms and damages.
 
The lesson here? We care too much about gadgets and logical control systems, and not enough about the skilled staff needed to operate this technology. Gartner estimates that 40 percent of mid-size enterprises don't have a cybersecurity expert in their organization. A labor shortage for security professionals will prevent you from filling this talent gap for at least three years. A logical solution is to assess which security functions can be effectively delivered as a service to minimize internal staffing requirements.

Services (such as EventTracker Enterprise) solve popular use cases including:

• Operational tasks such as log monitoring, vulnerability scanning, and firewall management
• Delivering 24/7 security monitoring when there is not enough staff to accomplish this internally (a minimum of eight to 12 dedicated security analysts are required for 24/7 monitoring)
• Security monitoring for public cloud environments to ensure users are not placing sensitive data in the cloud in ways that are insecure or non-compliant
• Building out advanced attack detection capabilities by employing advanced analytics to identify threats through statistical or behavioral anomalies in security events, IT logs, network behavior, network forensics, payload analysis, endpoint behavior, and endpoint forensics

The cost of doing nothing is significant.

The PCI Security Standards Council is an open global forum, launched in 2006, that is responsible for the development, management, education, and awareness of the PCI Security Standards, including the Data Security Standard (PCI DSS), Payment Application Data Security Standard (PA-DSS), and PIN Transaction Security (PTS) requirements.

The Council's five founding global payment brands - American Express, Discover Financial Services, JCB International, MasterCard, and Visa Inc. - have agreed to incorporate the PCI DSS as the technical requirements of each of their data security compliance programs. Each founding member also recognizes the QSAs, PA-QSAs and ASVs certified by the PCI Security Standards Council.

All five payment brands, along with Strategic Members, share equally in the Council's governance, have equal input into the PCI Security Standards Council and share responsibility for carrying out the work of the organization. Other industry stakeholders are encouraged to join the Council as Strategic or Affiliate members and Participating Organizations to review proposed additions or modifications to the standards.

On this website you'll find useful information about the PCI Security Standards Council, the PCI DSS requirements for merchants, vendors and security consulting companies, and the Council's certification and merchant support services, all created to mitigate data breaches and prevent payment cardholder data fraud.

Note that enforcement of compliance with the PCI DSS and determination of any non-compliance penalties are carried out by the individual payment brands and not by the Council. Any questions in those areas should be directed to the payment brands.

The Netsurion team was lucky enough to attend the RetailNOW 2016 conference last week, hosted by the Retail Solutions Providers Association (RSPA) in Grapevine, Texas.

The event, aimed at connecting the point-of-sale (POS) technology ecosystem, was extremely successful because it gave us the perfect platform to further connect with our existing partners—and to meet and interact with industry leaders.

Cybersecurity and breach prevention were some of the hottest topics at the conference—and we were able to share our expertise in these areas through breakout sessions and presentations.

Our “What’s up breaches!” tee shirts were also a great way to get the word out, with plenty of attendees sporting them throughout the week.

There have been many high profile breaches at well-known, big-budget chain restaurants and hotels recently. This just shows that even companies with expansive, big-budget security are still being targeted.

During our speaking sessions, we emphasized network security as the most important first line of defense.

It all comes down to this:

A well segmented network can be the difference between a successful business and a business in the headlines of the latest data breach.

According to the National Cyber Security Alliance:

96 percent of data breaches target the payment card industry. Such breaches can be caused by POS malware, employee mistakes, and internal or external hacking.

Not to mention that as businesses protect themselves from these threats, new technologies, such as EMV, biometrics and mPOS, arise. Technology gets better; hackers get smarter…so what are businesses doing to keep their brands and data secured?

Sure, it’s important for businesses to embrace technology for the convenience of their customers and to stay competitive in the market. However, also important to remember the security risks that new (and more) technology brings.

This threat landscape and new technologies should ultimately push retailers to embrace network security as a first line defense strategy. Data security and PCI compliance should be the priority of any business in today’s market.

And businesses of all sizes deserve a chance to achieve enterprise-level data and network security.

Netsurion’s goal is to provide multi-location businesses with affordable but equally effective alternatives to self-managed security solutions—keeping the burden off the owners’ shoulders and away from their brand reputation.

Post-RetailNOW, Jim Roddy, reseller & ISV business advisor at Vantiv, posted this excellent conference roundup.

In the write-up, he stated:

“Managed services is no longer a far-off concept for POS providers. Many resellers I talked with have fully embraced the recurring revenue business model and are looking to expand it even further in their business. There are now model resellers you can pattern your business after if you want to move to the as-a-Service model.”

Mark Bartig, our senior vice president of Sales & Marketing, actually appeared on a panel discussion carried by Vantiv called “Security as A HUGE revenue opportunity.” The panel of experts offered best practices and tips around how providers can position security products and managed services to monetize security recurrently.

And we’re lucky enough to have extremely supportive resellers who see the value in making their customers more secure. They’re a major factor in making our ultimate network and data security goals for all businesses a reality.

We are honored that they feel our support for them in return. To wrap up a productive and educational few days at the conference, we were thrilled to learn that we were selected as the ‘Reseller Support Services’ winner at the 2016 RSPA Vendor Awards of Excellence.

The annual awards are honors given to RSPA vendor members in recognition of their outstanding achievements in service, quality and channel engagement.

Netsurion was nominated by our partners and voted as the winner by the RSPA members. Our award was the last one introduced by RSPA. They mentioned it received an "overwhelming" response from the RSPA reseller community and that Netsurion was the only company worthy of being nominated for this category. This was truly a tribute to the entire Netsurion team, as it shows that our partners appreciate us as much as we appreciate them.

Thank you to everyone who helped make RetailNOW an overall success for Netsurion—we look forward to talking security with you all next year!

Symptom

Account Lockouts in Active Directory

Additional Information

“User X” is getting locked out and Security Event ID 4740 are logged on respective servers with detailed information.

Reason

The common causes for account lockouts are:

• End-user mistake (typing a wrong username or password)
• Programs with cached credentials or active threads that retain old credentials
• Service accounts passwords cached by the service control manager
• User is logged in on multiple computers or disconnected remote terminal server sessions
• Scheduled tasks
• Persistent drive mappings
• Active Directory delayed replication

Troubleshooting Steps Using EventTracker

Here we are going to look for Event ID 4740. This is the security event that is logged whenever an account gets locked.

1. Login to EventTracker console:
2. Select search on the menu bar
3. Click on advanced search
4. On the Advanced Log Search Window fill in the following details:

• Enter the result limit in numbers, here 0 means unlimited.
• Select the date, time range for the logs to be searched.
• Select all the domain controllers in the required domain.
• Click on the inverted triangle, make the search for Event ID: 4740 as shown below.

Once done hit search at the bottom.

You can see the details below. If you want to get more information about a particular log, click on the + sign

Below shows more information about this event.

Now, let’s take a closer look at 4740 event. This can help us troubleshoot this issue.

Resolution

Logon into the computer mentioned on “Caller Computer Name”  (DEMOSERVER1) and look for one of the aforementioned reasons that produces the problem.

To understand further on how to resolve issues present on “Caller Computer Name”  (DEMOSERVER1) let us look into the different logon types.

How to identify the logon type for this locked out account?

Just like how it is shown earlier for Event ID 4740, do a log search for Event ID 4625 using EventTracker, and check the details.

Logon Type 7 says User has typed a wrong password on a password protected screen saver.

Now we understand what reason to target and how to target the same.

Applies to

Microsoft Windows Servers
Microsoft Windows Desktops

Contributors

Ashwin Venugopal, Subject Matter Expert at EventTracker
Satheesh Balaji, Security Analyst at EventTracker

Most merchants who have been validating their PCI compliance for a few years now probably know which SAQ type applies to them.

In PCI 2.0, it has been fairly simple. And now we are facing PCI 3.0. My, how things have changed.

There are several new SAQ types, and a major change has occurred with one of the old standards that we all came to know. SAQ C looks nothing like its previous incarnations.

Merchants should be prepared to increase their security measures to comply with the PCI 3.0 standard.

Let’s start with the most basic change in SAQ C. Which type of merchants should now use SAQ C to validate their compliance?

It used to be any merchant who processes over the Internet, did not store credit cards, and whose point of sale environment was isolated from other payment networks. The 2 most common environments to which this applied were IP based stand alone terminals, and Integrated POS systems that did not store credit cards.

With the advent of PCI 3.0, a new SAQ was developed, SAQ B-IP. Now, IP based terminals have their own standard, which is extremely similar to the 2.0 version of SAQ C. This means that integrated POS systems that do not store credit cards are alone in their usage of SAQ C, and that would be the end of the story if SAQ C had not been so radically altered.

Many merchants invested in various security products so that they would not store credit cards in their POS systems and thus eliminate several of the PCI requirements that they would otherwise face. Such technologies may include end to end encryption systems or tokenization processes that render stored data useless to cyber thieves if it is compromised.

In previous version of PCI, SAQ C merchants would not need to have a logging program (requirement 10 was omitted completely); nor would they need to implement file integrity monitoring; and lastly, a penetration test was not a requirement.

In PCI 3.0 all three of these requirements are in SAC C, and merchants who previously managed to comply with PCI will need to implement many new security measures before they will be compliant again.

While SAQ C is still less onerous than SAQ D, the gap between them has been closed significantly. If you were to poll merchants about which elements in PCI consistently give them the most grief, they would probably name logging, file integrity monitoring, and a penetration test.

Previously, SAQ C merchants were not burdened with these requirements, but those days have passed. It is our concern that merchants have not been properly educated about these changes, and it will be a rude awakening when they discover that they are required to implement them.

If you are a merchant and want to review SAQ C for yourself, you can find it on the PCI Security Standards Council’s website at: https://www.pcisecuritystandards.org/documents/SAQ_C_v3.pdf

I have fond memories of playing a board game called Hungry Hungry Hippos in my younger days.  Children would drop small white marbles onto a game board while furiously slamming their fists on a small, plastic, hippo-shaped lever. The hippos’ mouths would chomp at rapid speeds in attempts to capture as many marbles as humanly possible. 

Today’s medical practices mirror the chaos of the game. Each day seems more hectic than the previous with visiting patients, emergency calls, demanding doctor schedules, medical billing and coordinating with insurance companies…all while trying to maintain a timely waiting room experience.

And each aspect of this chaos creates real-life white marbles—little snippets of personal data that need to be captured and secured…credit card details here, personal medical histories there; social security numbers and health insurance policy details collected a moment later…

Despite all of the confidential data medical organizations house compliance, and security are never top of mind in the field.

The harsh reality is that these offices and hospitals just aren’t ready to secure those white marbles and win the game against their sneaky opponents—the hackers. Cybercriminals are more than ready to swoop in, click the lever a few times and collect all of the marbles when the organizations’ backs are turned from the game board.

I recently had the opportunity to attend a social event with some of the top surgeons in my local community. My wife works in the medical device field and scheduled a networking event with her most established clients, and of course, I volunteered (was forced) to attend.

I jumped at the chance to rub elbows with top surgical talent, but I also had another agenda…I wanted to take this one-on-one time to pick their brains on HIPAA, compliance, and security and see how’d they’d fare in the fight against hackers.

Now, face time with a neurosurgeon is slim so I had to pitch my opening line to gain their attention and keep them engaged.

My brilliant opening line:

“How do you protect your patients’ personal data?”

It’s a simple question at the core— but the responses were astonishing:

“We have antivirus.”

“We take a HIPAA training course every year.”

“We don’t store personal data.”

“I think we have an IT guy for this.”

These answers don’t even scratch the surface of everything I heard, but it was all equally surprising and telling of the importance of protecting patient data—and how little medical professionals really know about today’s threat landscape.

When I asked if they were worried about a breach of said data, the majority replied:

“We are just a small office. We’re not a target.”

I was talking with an orthopedic surgeon that has around 60 employees and roughly 40-50 patients that pass through his office daily. Even he had the “Breaches happen, but they won’t happen to us” mindset.

Sure it’s usually the healthcare giants like Anthem, Excellus or Premera that make the breach headlines. But just because hackers can mine larger troves of data from the big guys doesn’t mean smaller practices are in the clear.

Cybercriminals know these offices are often barely secured (or left completely unprotected)...and that they still house sensitive medical, financial and personally identifiable information.

In fact, only 33 percent of healthcare organizations agree they have sufficient resources to prevent or quickly detect a data breach. This means that hackers don’t have to try very hard to compromise almost 2/3 of medical practices in order to pocket their marbles.

So, what can you do to protect your patients’ data and comply with regulations such as PCI and HIPAA?

Here are the most essential tips to help you stay ahead in the security game:

• 1. If you interact with credit card data, personal health information (PHI)/ePHI, you need to be HIPAA and/or PCI compliant.

  It’s as simple as that.

• 2. If you accept any form of credit card, you will be required to be PCI compliant.

  PCI compliance is based on the number of transactions processed annually along with processing methods; this will dictate what level of compliance you require.

  Most merchants will be required to complete a self-assessment questionnaire, which is used to set a standard level of security.

• 3. Purchase a commercial grade firewall.

  Do not rely on your local Best Buy associate to recommend the latest off-the-shelf option.

• 4. Create a network segmentation security plan

  Create a network segmentation security plan at your office/hospital that segments credit card information, patient data, security cameras, etc. Each segment should not be accessible and should maintain a secure Wi-Fi connection.

• 5. Lock down external-facing websites such as Facebook and Gmail.

  The weakest link in the security chain is, and will always be, humans.

• 6. Invest in high quality antivirus.

  Do not be fooled by free versions. Spend the additional fees and implement a quality solution.

A good security plan can be overwhelming at first, but with the right knowledge and expertise, it can be simplified and managed to reduce the exposure of your practice or hospital and limit the amount of risk.

No matter how small your organization is, you should still stand up against the hackers. Stay hungrier. Don’t let them come in and win the whole game.

No security plan is foolproof, but ignoring HIPAA, compliance standards, and security posture is foolish.

This fundamental tradeoff between security, usability, and cost is critical. Yes, it is possible to have both security and usability, but at a cost, in terms of money, time and personnel. While making something both cost efficient and usable, or even making something secure and cost-efficient may not be very hard, it is however  more difficult and time consuming to make something both secure and usable. This takes a lot of effort and thinking because security takes planning and resources.

As a system administrator, usability is at the top of their list. However, as a security administrator, security will be on top of their list – no surprise here really.

What if I tell you that the two job roles are orthogonal? What gets a sys admin bouquets, will get a security admin, brickbats and vice versa.

Oh and when we say “cheap” we mean in terms of effort – either by the vendor or by the user.

Security administrators face some interesting tradeoffs. Fundamentally, the choice to be made is between a system that is secure and usable, one that is secure and cheap or one that is cheap and usable. Unfortunately, we cannot have everything. The best practice is not to make the same person responsible for both security and system administration. The goals of those two tasks are far too often in conflict to make this a position that someone can become successful at.