Lately we have seen a lot of focus on security in social media – professionals, companies, organizations trying to increase security awareness. A lot of the information out there is about “control” and “compliance”. The downside of a risk management regime based on strict rules, controls and compliance measures has been demonstrated again and again throughout history, and I’ve also written about it before in terms of getting users on board with the security program. My background is from the oil and gas industry – an industry that has seen several horrific accidents. Two of the more well-known and dramatic ones are the Piper Alpha accident 30 years ago this year, and the Deepwater Horizon blowout in 2010. In both of these cases, investigations pointing to “root causes” concluded with a degraded safety culture, lack of attention to real risks and partially blamed a prescriptive approach to safety. The same arguments are equally valid for security incidents. The goal should be to find a balance between security and operational flow.

Some examples of potentially unhelpful helpfulness

If you are looking for security advice online, it is easy to find. A lot of it will tell you to “trust nobody, lock down everything”. From a traditional security point of view this makes sense – but it does not take the risk context into picture, nor does it balance measures against operational needs (such as keeping your store open, or being able to try new things to innovate and create new products).

Here’s Dr. Eric Cole (he knows a lot about security but sometimes I think his advice is a bit draconian)

Change control is important – but gathering a “change control board” for every change you do may be overkill – if you want ot stay “agile” and able to respond to changing demands.

Another common “rule” that actually does make a lot of sense is not to give end-users admin rights to their work computers. But…. needs will vary. If you are trying to develop new technology but your developers have to go through a lot of red-tape to try out a new technology, it will certainly have some ill effects on your teams ability to innovate. On the other hand, giving developers all free reigns in the name of the “sacred innovation gods” is also not a very good idea. The whole thing is about balance.

Risk acceptance and balance

Security controls are often cumbersome for people. Airport security, nightclub bouncers, two-factor authentication, no admin rights. Security leads to limitation of access in a large number of cases. This obviously has a downside when it comes to how fast we can innovate, how quickly we can produce. The benefit is reduced probability and impact of a major incident – and such incidents are very expensive. The amount of security cumbersomeness people are willing to accept and live with will normally depend on how bad it can get if someone hacks you. If your system controls nuclear weapons, a power plant, or perhaps the production at a chemical plant, incidents can cause real disasters leading to financial and environmental ruin, as well as a large number of fatalities. In this case, you will probably accept a lot of security controls to minimize the chance of something like that happening.

On the other hand, if you are selling some new hot service online, you still need people to trust your service, and you need to comply with privacy laws. This means your security must still be good – but you may nevertheless adopt a slightly higher risk acceptance than in the nuclear weapons case.

The trick is to find a good balance between acceptable risk performance, and good operational flow. This in itself will contribute to greater security performance overall, as the human factor side to cyber risk is very large, something that is often undervalued when designing security controls. To do this in a coherent manner we bring you the mighty tool of the…. risk based threat model.

Threat models for a balanced security strategy

A threat model is best made for a specific system or subsystem. The system can be everything from “the company network” to a specific application or a small software component. The thinking remains the same but the details in your model will change. The whole purpose of it is to understand how and Adversary can perform an Action on a Target to achieve an Objective. There are many ways to model this explained in the literature, but we won’t go into details about them here. If you want the details you can search for attack trees, STRIDE, cyber kill chain.

Context. You need to understand 3 things about the risk context:

• Who are the stakeholders and what is their interest in the system? Owners, employees, users, customers, suppliers, attackers, insiders
• What does the system itself do?
• Who are the threat actors? Use threat intelligence to understand how adversaries approach the system and the supply chain you are a part of.

Inventory and data flow. Create a data flow diagram on the architectural level. Include relevant information such as protocols and main technologies. Describe what each asset is used for, and make a list of what data is being processed and transferred. Make trust boundaries visible in your diagram. For the inventory, consider the potential impact of confidentiality, integrity or availability losses.

Abuse cases. Consider how the various processes and data transfer operations can be abused by an adversary with sufficient access. Access can be physical access, stolen credentials, through malware or direct use of software vulnerabilities. The abuse case is your primary tool for understanding how controls can stop the adversary’s actions.

Detection and mitigation. Your system is probably not wide open to attack. List the most important controls you have in place already. The main purpose of this is to check if you are missing something obvious that you probably should be doing to stop attacks.

Evaluate and prioritize. Evaluate the threats according to the estimated risk. Prioritize controls that will help you reduce the risk of unacceptable actions being taken by adversaries to your most important assets and operational capabilities. Make sure you do not over-stretch the organization’s capabilities – focus on what matters the most first.

Thinking through your context and what you value brings you a long way alone, in particular with solid baseline controls. Maintaining a threat model that is kept up to date regularly with new threat intelligence and other context changes also allows you to ensure you do not fall behind how the world moves. Taking risks is fine, but know what risks you can afford to take – when you do that, you can choose the point for balancing security and performance.

Consider this: internet is down. Power is out. And the water in the tap is no longer safe to drink. The stores are basically out of groceries. And the banking sector is not working. No mobile payments. No credit cards accepted. And no ATM’s are working. Scenarios like this may be dystopia but are perhaps less far-fetched today than a few years ago. Some recent reports hinting of this have come out of the Ukrainian conflict as well as more recent events of cyber attacks targeting the utility sectors in the United States, Europe and the Middle East. There is no other way to put it than this: we are as a society vulnerable.

Sweden is taking steps to increase the population’s preparedness for a major crisis, up to and including invasion by a foreign power. Norwegian authorities are planning a similar move. This type of communication was common during the cold war but feels chilling today. We are no longer used to thinking about disasters that target society at this scale.

A major conflict today would for sure include cyber domain operations, and most likely not only for information gathering. Availability of key services would be hit, and this could lead to power outages, water supply failure and payment system collapse. How do we cope in this situation?

Most people are not prepared for the “usual channels” to be unavailable. Most organizations are unprepared for disasters like this. This further exacerbates the challenges individuals would be faced with in the event of a crisis, because many businesses are essential for providing services and goods. When these businesses cannot deliver, it means power is unavailable, hospitals close, food is not available in the store and the fancy autonomous public transport systems grind to a halt.

Because of this, it is a civic duty for businesses to plan not only for a rainy day, but for long-term hurricane conditions. When the economy fails to produce the services and goods people depend on, we all suffer. Here are five bullet points for building resilience from the individual level, to our workplaces, and to society as a whole.

1. Do like the Swedes: keep an emergency supply of food, water, and other necessities at home. Have a plan for how to act in the case of a crisis.
2. At the workplace, do not stop at a risk assessment for “normal operations”. Identify business continuity challenges, and abnormal situations that can occur, including natural disasters, nationwide cyber attacks, terror attacks and a state of war. What services should the organization be able of supplying under such conditions? How can a plan be put in place to be able of doing so?
3. Planning is smart, but without training its value is very limited. This is why businesses run stress tests, table-top exercises, red-team simulations and the like. We do, however, focus on risks under “normal conditions”. Have you tested your business continuity handling plan the same way? You probably should. Exercise emergency response with no network access, with phone lines down and your staff dispersed.
4. Do not get paranoid, but also do not be afraid to mention what people typically would see as “black swans”. Only by acknowledging that disasters do happen, we can prepare to restore functionality to the level we have defined necessary.
5. Engage in conversations and organizations that keep you on top of societal risks, and how you can contribute. Contributing to the security of society as a whole is the essence of social corporate responsibility.

If we keep contributing during a crisis, we will increase our collective ability to handle adversity. This is why business continuity needs to be part of our thinking around social corporate responsibility.

Business continuity and emergency preparedness have become familiar concepts for many businesses – and having such risk management practices in place is expected in many industries. In spite of this, apart from software companies, inclusion of cybersecurity and preparing for handling of serious cyber attacks and security incidents is far from mature. Many businesses have digitized their value chains to a very high degree without thinking about how this affects their overall risk picture. Another challenge for many businesses that have seen the need to include their digital footprint in their risk management process, is that they don’t know where to start. That is what this post is about: how do you start to think about emergency preparedness for cyber incidents? If you have a robust process for this in place, this post is not meant for you. This is a “how-to” for those who stand bewildered at the start position of their crisis management planning process.

Know what you have

Before planning your incident response, or emergency preparedness plan, you should have a clear overview of what assets you have that is worth protecting. Creating a detailed asset inventory can be a daunting task. However, for most organizations, it is sufficient to identify the key information and organizational assets without aiming for completeness.

• What are your main business processes? Identify all of the main processes you need to work in order for your organization to serve its purpose. The breakdown can be of different granularity, but here’s an example for an e-commerce business:
  • Management and leadership
  • Sales and marketing
  • Procurement and logistics
  • Software development
  • Customer support
  • Accounting
• For each of the main business processes you have, there will be various types of assets that are necessary to make that process work. Think about what you need in various categories:
  • Key personnel
  • Software you need to get the job done
  • Data that is needed to support the function (if you know what software you depend on, this is often easier to identify)

Why are we mentioning people here? Often people have knowledge that cannot easily be replaced within the organization, or that would require considerable effort and investment. If such a person disappears, the situation can be hard to deal with. That is why, also from an information security point of view, it is important to know who your key employees are, and put down a plan for what to do if they are not available.

When you have identified these assets, it is a good idea to group them into two categories: critical and non-critical (you can use more than 2 categories if you want to, but a binary division is usually sufficient). Critical assets would lead to serious consequences if the security is breached: if data is leaked, or changed in an unauthorized manner, or made unavailable. It is unfortunate if non-critical assets are breached too, but not at a level where the business itself can be threatened. The critical assets are your crown jewels – the assets you need to protect as good as you can.

Baseline defense: do the small things that matter

Before planning how to respond to a cyber attack, we should introduce some baseline practices that do not depend on criticality or risk assessments. These are practices all organizations should aim to internalize; they significantly reduce the likelihood that a cyber attack would be successful, and they also prepare you to respond to an attack when it happens.

• Introduce a security policy and make it known to the organization. Work systematically to make sure the policy is adhered to.
• Maintain the data register (using the process described above for “knowing what you have”). This way you make sure critical assets do not get overlooked.
• Include security requirements when selecting suppliers. Do not get breached because a supplier or business partner has weak security practices.
• Take regular backups of all critical data. This way, you can restore your data if they should become unavailable or destroyed, whether this happens because of a hacker’s malicious actions or due to a hardware failure.
• Use firewall rules to deny all traffic that is not needed in your business. Deny all incoming requests, unless there is a specific reason to keep a service available.
• Run up-to-date endpoint protection such as antivirus software on all computers.
• Keep all of your software up-to-date and patched. Do not forget appliances and IoT devices.
• Do not give end users administrative access to their computers.
• Give security awareness training to all employees.

With this in place, 80% of the job is done. Now you can focus on the “disaster scenarios”; those where you crown jewels are at risk.

Prepare to defend your assets

You know what assets you have. You know what your crown jewels are. You have your baseline security in place. Now you are ready to take on the remaining risk – responding to attacks and more advanced incidents. Here’s how you prepare for that.

Threat modeling

Before you develop your incident response plan, it pays off to create a simple threat model. Your model should describe credible attack patterns. In order to identify such attack patterns, you should think about who the attacker would be, and what their motivation would be. Is it a script kiddie, a person without deep technical knowledge hacking for fun using tools downloaded from the internet? Is it a cyber crime group hoping to earn money on extortion or by selling your intellectual property? Is it a nation-state actor, hoping to use your company as a foothold for attacking government assets? Or perhaps it is an insider threat, a dishonest or angry employee attacking his own employer? Likely scenarios depend on your assumptions here.

You don’t need a very detailed threat model to gain understanding that can aid your incident response planning. You should think about phases of the attack?

• How is the initial breach obtained? In most cases this would be some form of social engineering, like phishing.
• How do they get a foothold and gain persistence? Malware based? Using built-in functions?
• How do they get access to the crown jewels? What actions will they perform on the object?
• What are the consequences of the attack for your organization and its stakeholders?

Having this down, you should start to prepare an incident response plan. Thinking about this in phases too is helpful:

• Preparation
• Incident detection and escalation
• Containment
• Eradication
• Recovery
• Lessons learned

During preparation you should get down who is responsible for incident handling, who should be communicated with and how suspected incidents should be reported. Include a budget for training and running exercises. Cyber threat incident response needs to be tested the same way we do fire drills.

Incident detection is difficult. Various reports all indicate the average time from compromise to detection of advanced attacks is somewhere between 3 months and 2 years. There are many ways to detect that something is wrong:

• A user notices strange behavior of lack of access
• Monitoring of logs and security systems may report unusual signals
• A hacker contacts you for a ransom or to state demands

In all cases the company should have a clear process for categorizing potential incidents, verifying if it is a real incident or not, and making a decision to start incident response.

Containment is about stopping the problem from spreading throughout the network, and gathering evidence. Be aware that cutting access to the internet can sometimes set off pre-programmed destructive routines. Therefore containment should be based on observation of the hacker behavior within the network on a case by case basis.

Eradication is about removing the problem: taking away the persistent access, removing malware, patching security holes. The right way to do this is to format all disks, clean all data, and then restore from original media and trusted backups.

Recovery is about getting back to business: recovering the service at an acceptable level. It is not uncommon to see malware reappear after recovery, so testing in a controlled environment is always good practice, before connecting the restored system to the business network again.

Lessons learned is important. In this phase an after action review is done: how could this happen, what was the reason? Do a root cause analysis. Summarize what worked well in response, and what did not. Make recommendations for changes in practice or policy – and follow up on it.

If you have this down: knowing what your crown jewels are, a solid baseline security system and a risk based incident response plan your organization will be much more robust than before. The risk exposure of your organization to cyber threats will be greatly reduced – but do not forget that security is a continuous process: as the threat landscape changes, your security management should too. This is why you need to maintain your threat model, and update your response plan.

Phishing is still the most common initial attack vector. Mass mailed spam is now taking cues from targeted campaigns, improving conversion rates through personalization and the use of seemingly authoritative content.

Scammers are getting better at targeting. Sharpen your defenses today – including your awareness training!

Here are some indicators that can help identify phishing:

• Sender: the name and the email address don’t match. Your colleague is probably not emailing you from someone else’s Gmail account or a Mexican car dealership (unless you are in the car sales business in Mexico)
• The link in the email leads somewhere else than the text of the link. Hover over to see the real url- or press an hold on a touch device. Here’s an example: https://bbc.co.uk
• The logo in the email is hosted on a different domain than the email address of the sender, and it is not a CDN or cloud storage bucket.

Training people to look for these indicators will help reduce damage from the more advanced phishing campaigns!