Podcasts

Q&A: The troubling implications of normalizing encryption backdoors — for government use

By Byron V. Acohido

Should law enforcement and military officials have access to a digital backdoor enabling them to bypass any and all types of encryption that exist today?

We know how Vladmir Putin, Xi Jinping and Kim Jung-un would answer: “Of course!”

The disturbing thing is that in North America and Europe more and more arguments are being raised in support of creating and maintaining encryption backdoors for government use. Advocates claim such access is needed to strengthen national security and hinder terrorism.

But now a contingent of technology industry leaders has begun pushing back. These technologists are in in full agreement with privacy and civil rights advocates who argue that this is a terrible idea

They assert that the risk of encryption backdoors ultimately being used by criminals, or worse than that, by a dictator to support a totalitarian regime, far outweighs any incremental security benefits. I had an invigorating discussion with Jeff Hudson, CEO of Venafi, about this at Black Hat USA 2018.

Venafi is the leading provider of machine identity protection. Machine to machine connection and communication needs to be authenticated to access systems, so this technology is where the rubber meets the road, with respect to this debate. For a full drill down, please listen to the accompanying podcast. Here are excerpts edited for clarity and space:

LW: What’s wrong with granting governments the ability to break encryption?

Venafi: It has been established over a long period of time that the minute you put a backdoor in, and you think it’s secure, it almost immediately will fall into the wrong hands. Because it’s there, the bad guys will get to it. This makes backdoors the worst possible things for security.

The government wants to be able to surveil network traffic and They want backdoors so they can see everything. If they can see all the traffic all the time, they can just sit back and surveil everything. …more

MY TAKE: Poorly protected local government networks cast shadow on midterm elections

By Byron V. Acohido

In March 2018, the city of Atlanta fell victim to a ransomware attack that shut down its computer network. City agencies were unable to collect payment. Police departments had to handwrite reports. Years of data disappeared.

The attack also brought cybersecurity to the local level. It’s easy to think of it as a problem the federal government must address or something that enterprises deal with, but cybersecurity has to be addressed closer to home, as well.

I spoke to A.N. Ananth, CEO of EventTracker, a Netsurion company, about this at Black Hat USA 2018. His company supplies a co-managed SIEM service to mid-sized and large enterprises, including local government agencies.

EventTracker has a bird’s eye view; its unified security information and event management (SIEM) platform includes – behavior analytics, threat detection and response, honeynet deception, intrusion detection and vulnerability assessment – all of which are coupled with their SOC for a co-managed solution. For a drill down on our discussion, give the accompanying podcast a listen. Here are key takeaways:

Local risks

Security of local and state government agencies takes on a higher level of urgency as we get closer to the midterm elections.

“State and local governments are not immune to the digital transformation so their dependence on IT is as high as it’s ever been,” says Ananth. “Consequently, the security of these kinds of systems has become paramount.”

If all politics are local, elections are even more so. According to the National Conference of State Legislatures, security for elections is in the hands of local election administrators, overseen by the state’s chief election official, but protection has been lacking.

During 2016, 39 states were hacked. At least one state saw an attempt to delete voter rolls; …more

MY TAKE: Here’s how diversity can strengthen cybersecurity — at many levels

By Byron V. Acohido

Of the many cybersecurity executives I’ve interviewed, Keenan Skelly’s career path may be the most distinctive. Skelly started out as a U.S. Army Explosive Ordnance Disposal (EOD) Technician. “I was on the EOD team that was actually assigned to the White House during 9/11, so I got to see our national response framework from a very high level,” she says.

Today, Skelly is Vice President of Global Partnerships and Security Evangelist at Circadence®, a distinctive security vendor, in its own right.

Circadence got started in the 1990s as a publisher of one of the earliest massively multiplayer online games. It adapted its gaming systems to help the U.S. military carry out training exercises for real life cyber warfare. That led to a transition into what it is today: a leading supplier of immersive “gamification” training modules designed to keep cyber protection teams in government, military, and corporate entities on their toes.

I met with Skelly at Black Hat USA 2018 and we had a thoughtful discussion about a couple of prominent cybersecurity training issues: bringing diversity into AI systems and closing the cybersecurity skills gap. For a drill down, please listen to the accompanying podcast. Here are key takeaways:

Diversifying AI

Discussions are underway in the technology sector about how Artificial Intelligence could someday eliminate bias in the workplace, and thus engender a more meritocratic workplace

“We’re starting to see Artificial Intelligence and machine learning in just about every space and every tool,” Skelly observes.

Diversity in emerging AI-infused security systems – or, more specifically, the lack of it – is a rising concern. Here’s why: The experts with the knowledge to tweak the algorithms for automated detection systems, at this moment, comprise a very narrow talent pool. The concern is that this could constrain the development of broadly effective security-focused AI.

“The problem is that if you don’t have a diverse group of people training the Artificial Intelligence, …more

NEW TECH: Critical Start applies ‘zero-trust’ security model to managed security services

By Byron V. Acohido

All companies today are exposed to intense cyber-attacks. And yet the vast majority simply do not have the capability to effectively defend their networks.

That’s where managed security services providers, or MSSPs, come in. MSSPs monitor and manage cybersecurity systems as a contracted service. This can include spam filtering, malware detection, firewalls upkeep, vulnerability management and more.

Companies are gravitating to MSSPs in a big way. The global market for managed security services is expected to rise to $48 billion by 2023, up from $24 billion in 2018, according to ReportLinker. That’s a hefty compound annual growth rate of 14 percent.

But not all MSSPs are created equal. And, in fact, it can sometimes be a challenge for a company to find a good fit with a MSSP.

Critical Start, a new MSSP on the scene, is striving to advance the tradition MSSP model. I had the chance to visit with Jordan Mauriello, Critical Start’s Chief Technology Officer, at Black Hat 2018. He told me an interesting tale about his role in helping launch Advanced Threat Analytics, the underlying technology for Critical Start’s MSSP service.

For a full drill down, please listen to the accompanying podcast. Here are the key takeaways:

Rethinking the platform

Five years ago, Mauriello was working at a large global credit bureau, managing the credit monitoring giant’s in-house Security Operations Center. He went shopping for a MSSP to come in and help to reinforce certain security functions. Try as he might, Mauriello couldn’t find precisely what he was looking for.

In 2014, Mauriello joined Critical Start, Inc., a Dallas-based value-added reseller. …more

MY TAKE: The amazing ways hackers manipulate ‘runtime’ to disguise deep network breaches

By Byron V. Acohido

There is a concept in computing, called runtime, that is so essential and occurs so ubiquitously that it has long been taken for granted.

Now cyber criminals have begun to leverage this heretofore innocuous component of computing to insinuate themselves deep inside of company networks.

They’ve figured out how to manipulate applications while in runtime and execute powerful and stealthy attacks that bypass conventional security tools.

This is a big leap forward for elite threat actors, who have long targeted static files, storage, and executable code, either at rest on disk or in transit. What they’re doing is intricately technical. But it’s happening on an increasing basis in the Internet wild to exploit vulnerabilities, spread ransomware, steal valuable data and to usurp control of industrial plants.

I asked Willy Leichter, vice president of marketing at Virsec, a supplier of data security systems, to dissect how runtime is essentially being weaponized to support advanced network compromises. We met at Black Hat USA 2018. For a full drill down, please listen to the accompanying podcast of our conversation. Here are key takeaways:

Runtime defined

Runtime refers to the period of time between opening a software program and quitting, or closing, it. During runtime, pieces of the application get loaded into the RAM (random access memory) of the computing device’s CPU (central processing unit) allowing the app to do its thing.

Runtime occurs continually in our digital world. It comes into play any time software applications get executed “on premises” in a company network and across any mobile app or cloud-delivered service. This includes when you use email, a productivity tool, a mobile app, social media, or an Internet of Things device.

Here’s the rub: threat actors have discovered how to slip benign-looking snippets of data into application servers, that then get transformed into malicious code during runtime. …more

MY TAKE: Can ‘Network Traffic Analysis’ cure the security ills of digital transformation?

By Byron V. Acohido

If digital transformation, or DX, is to reach its full potential, there must be a security breakthrough that goes beyond legacy defenses to address the myriad new ways threat actors can insinuate themselves into complex digital systems.

Network traffic analytics, or NTA, just may be that pivotal step forward. NTA refers to using advanced data mining and security analytics techniques to detect and investigate malicious activity in traffic moving between each device and on every critical system in a company network.

A cottage industry of tech security vendors is fully behind NTA. I recently visited with Jesse Rothstein, co-founder and Chief Technology Officer of ExtraHop, a leading NTA vendor.

It was one of the more fascinating conversations I had on the floor at Black Hat USA 2018. For a full drill down, please listen to the accompanying podcast. Meanwhile, here are key takeaways:

Data ingestion advances

Traditionally, security analytics has revolved around assessing flow data and log data – a record of the movement of data between systems and shorthand notes about activity on a system. SIEM-based detection systems and earlier network-focused security products developed along these lines.

This unfolded, in part, because capturing and storing much richer data sets really wasn’t feasible 10 years ago, Rothstein told me. Then along came advances in data ingestion and processing, or obtaining and preparing data for immediate use.

Advanced data ingestion techniques made it possible to move beyond just monitoring flow data; …more

MY TAKE: As phishers take aim at elections, why not train employees to serve as phishing police?

By Byron V. Acohido

If there is a data breach or some other cybersecurity incident, a phishing attack was probably involved. Over 90 percent of incidents begin with a phishing email. One of the more infamous hacks in recent years, the DNC data breach, was the result of a phishing attack.

Phishing is the number one way organizations are breached, Aaron Higbee, CTO and co-founder of Cofense, told me at Black Hat USA 2018 in Las Vegas. Even though phishing has been a problem for years and most people are aware of what a phishing email looks like, we still fall for them.

Higbee and I discussed why phishing remains so effective and how organizations can improve their anti-phishing defenses. For a full run-through of our conversation, please listen to the accompanying podcast. Here are a few major takeaways:

Targeting the DNC

The Democratic National Committee is like other grassroot organizations. While there are some professional staff at the top, most of the organization is made up by volunteers, juggling their time doing committee work with their day jobs. Most of them are using their own smartphones, tablets and laptops. These organizations don’t operate under IT security controls you find in enterprise.

Yet, Higbee points out, the DNC was following at least one recommended security protocol: Multi-factor authentication (MFA) was enabled through Office 365. …more

« Newer Articles

Older Articles »

The Last Watchdog

Podcasts

Q&A: The troubling implications of normalizing encryption backdoors — for government use

By Byron V. Acohido

MY TAKE: Poorly protected local government networks cast shadow on midterm elections

By Byron V. Acohido

MY TAKE: Here’s how diversity can strengthen cybersecurity — at many levels

By Byron V. Acohido

NEW TECH: Critical Start applies ‘zero-trust’ security model to managed security services

By Byron V. Acohido

MY TAKE: The amazing ways hackers manipulate ‘runtime’ to disguise deep network breaches

By Byron V. Acohido

MY TAKE: Can ‘Network Traffic Analysis’ cure the security ills of digital transformation?

By Byron V. Acohido

MY TAKE: As phishers take aim at elections, why not train employees to serve as phishing police?

By Byron V. Acohido