Libby Bevin

One of the things I love most about working in security is that things are constantly changing. Yup, you read that correctly. I love changes! Learning new things, challenging past assumptions, and expanding my understanding and abilities are profoundly satisfying. I once heard myself referred to as a life-long learner and thought, isn’t everyone? And with the vast landscape of disciplines-like network vulnerability management, access controls, or mobile device encryption-there is no shortage of learning opportunities in security!

How to Keep Up With Rapid Change

What is the right level of protection? Are we vulnerable to that latest exploit? How can we better protect our assets? To answer some of these questions, many organizations utilize security maturity models. Most commonly utilized by organizations that do business with the US department of defense, maturity models document various levels of security capabilities to show progression within your security program.

When I was an Information Security Manager, I was a fan of security maturity models. I love organized, straightforward steps to reaching a goal and believed they were a good indication that I was “doing my job.” After all, if all of our controls meet the highest level of maturity, we must be doing something right! Right?

Unfortunately, no. Security maturity models are about the implementation of controls and provide graduating steps to showcase change over time. And while this is excellent information to have as a security leader, it represents a false sense of security to your C-suite, Board and other non-security stakeholders.

Shortcomings of a Security Maturity Model

Security maturity models focus on climbing a ladder or reaching the peak of security, which simply isn’t how security should work. Further, because these maturity models aren’t tied to the business’s ability to operate or meet its objectives, the context is lost. And when leadership doesn’t understand the context, it can be difficult to “sell” the value of improved security without sounding like a fearmonger.

A Better Option Than a Security Maturity Model

Instead, organizations should shift towards security health. Unlike security maturity models that document what you’re doing (or not doing), security health focuses on how well you’re doing it. Your security program becomes less about achieving the highest maturity level and more about guiding your organization to healthier cybersecurity decisions.

I was recently reading the book Reinventing Cybersecurity published by Jupiter One, and was particularly intrigued by one of the authors, Carlotta Sage. Their open-source security health model (available in a GitHub repo under Creative Commons) aligns perfectly with how we approach cybersecurity within the Reciprocity® ROAR Platform. Their model includes the shift from ad-hoc or compliance-driven security to a risk-focused approach, communicating security in a collaborative way that empowers your organization to make smarter decisions, and the necessity of scalable risk management to support rapid change and growth.

To demonstrate this concept, I will borrow an analogy from Sage. Let’s say you’re planning your dinner.

If you’re using a maturity scale, it might look like this:
Tier 1- Hamburger
Tier 2- Hamburger with Fries
Tier 3- Hamburger, Fries and a Drink

Looking at this list, it’s understandable that most of us would want tier three since it is a more ‘mature meal.’ If you don’t get the whole meal, you might be hungry later, so logically you select tier 3. When you present your leadership with options like this and cannot contextualize them, it’s difficult for them to understand or make appropriate decisions.

However, if you’re using a health scale, it would look like this:

Tier 1- Candy Bar
Tier 2- Granola Bar
Tier 3- Turkey Sandwich

With all three options, you can achieve your goal of filling your stomach so you won’t be hungry later. Regardless of what you select, you can still meet your objectives. However, this method demonstrates that consistently making less healthy security choices (or consistently eating candy bars for dinner) will only lead to increasingly less positive results over time. Adopting a security health model allows you to offer levels of protection and enables your board to align its security investments with its business objectives.

Putting This Into Practice

Are you looking to start assessing your security health? With the Reciprocity ROAR platform, we integrate your compliance activities with your risk register to automatically adjust your risk scores as controls are assessed. Unhealthy controls automatically increase your residual risk! And because we contextualize that risk to your business objectives, you’re able to point them towards healthier security decisions, thus allowing them to tie their investment to a tangible increase in their overall health.

And with that, security shifts from being a “climb the mountain” activity to a “steer the ship through the rocks to keep the boat afloat” activity.

Why not give it a try? Register for a FREE live demo to see ROAR in action.

Many organizations believe that if they comply with cybersecurity and governance regulations, they are safe from attackers. Nothing could be further from the truth. Cybercriminals don’t care if you’re compliant or not. They are highly motivated and focused on making money by accessing your high-value information, profiting from ransomware payments and disrupting your business. And unfortunately, they’re usually a few steps ahead of you.

Instead of focusing on how you’re protecting your organization, it’s time to focus on how well you’re doing so. That requires a shift from a compliance-centric approach to a risk-centric one.

In this white paper you’ll learn how to:

• Become more strategic with risk management
• Better influence, protect and secure your organization
• Use technology to improve your risk management program
• Assess provider risk
• Communicate risk across your organization

In 2017, Equifax, one of the largest credit bureaus in the United States, suffered a data breach that exposed the personally identifiable information (PII) of 147 million consumers and the credit card information of more than 200,000 more.

Following the incident, Equifax spent almost $1.6 billion to strengthen its cybersecurity defenses. The company also agreed to a global settlement of $425 million (with the U.S. Federal Trade Commission) to help breach victims.

Even five years later, the Equifax breach remains one of the largest data-related security breaches ever. It offers valuable lessons for companies that manage consumer data.

In this article we will highlight five such lessons. If your organization collects, processes, stores, or shares consumer data, these points will help you implement appropriate security practices and controls to secure your data from hackers.

Data Privacy Regulations Around the World

In recent years, regulatory agencies worldwide have implemented laws and regulations to safeguard consumers from data breaches and protect their data privacy. These consumer protection laws regulate how organizations collect consumer data and how much control consumers have over their own information.

Some well-known privacy laws and regulations are:

• The U.S. Health Insurance Portability and Accounting Act (HIPAA)
• California Consumer Privacy Act (CCPA)
• Canada: Consumer Privacy Protection Act (CPPA)
• Singapore: Personal Data Protection Act (PDPA)
• EU: General Data Protection Regulation (GDPR)

These laws apply to organizations depending on their location and industry, and consumers’ location. For example, the GDPR applies to all companies collecting the information of EU residents, even if the companies themselves do not operate within the EU. Other privacy laws are aimed at protecting certain types of data. For example, HIPAA aims to protect the personal health information (PHI) of U.S. consumers.

Other privacy regulations aren’t enforced by government, but companies must adhere to them anyway as part of doing business with other entities. For example, the PCI DSS standard was created by large credit card companies to protect personal financial information; if retailers want to process credit card transactions, they must meet PCI DSS standards.

Data breaches increase the risk of identity theft and fraud for affected individuals. They can also be financially crippling for many organizations due to lost business and reputational damage.

Regulatory agencies also impose huge fines on breached organizations, especially if it’s later proven that a company didn’t have appropriate safeguards in place to protect consumer data.

You can avoid all these consequences by properly securing consumer data. The next section will show you how.

5 Best Practices to Protect Your Consumer Data

Usually it’s companies with weak data controls that experience data breaches. You can avoid joining their ranks and safeguard sensitive consumer data by following the five strategies given below.

1. Regularly Scan for Vulnerabilities

   In a majority of data breaches, attackers compromise or steal sensitive customer data because the organization failed to find and fix security vulnerabilities.

   The Equifax breach is one example of this weakness. Criminals exploited a vulnerability in the popular Apache Struts open-source development framework. Equifax knew about the vulnerability and also knew that a patch was available, but didn’t apply the patch – which allowed the hackers to get into Equifax’ systems and compromise massive quantities of data.

   Don’t make this mistake. Regularly scan all data systems for vulnerabilities. Use an automated vulnerability scanner to perform scans quickly, regularly, and with minimal human intervention.

2. Patch All Software

   Hackers constantly look for ways to exploit security vulnerabilities in software, so it’s vital to fix these vulnerabilities as soon as they are detected. Software vendors usually release security patches fairly regularly. Make sure to implement all these patches and on all your software assets, including operating systems and enterprise applications.

3. Limit Access to Data

   Strong data governance practices are essential for protecting sensitive customer data. One practice is to limit access to authorized personnel only. Giving general access to any “trusted” user will create openings for attackers to steal credentials, control user accounts, and cause serious damage to sensitive information.

   Also implement reliable and proven authorization and authentication practices (such as multi-factor authentication, or “MFA”) for authorized users. Control access levels and permissions, especially for privileged accounts, with identity and access management (IAM) tools.

4. Encrypt Sensitive Data

   Encrypting data protects and secures it across multiple environments and devices, both in transit and when at rest. It also minimizes the risk of malware, phishing, ransomware, and other cyberattacks targeting your data environment.

   When encrypting data, use strong AES 256-bit keys and keep the keys secure so they don’t fall into the wrong hands. If possible, encrypt data in layers and use hierarchical key models and regular key rotation for ongoing data security.

5. Create Risk Management and Disaster Recovery Plans

   Strong risk management and disaster recovery plans will help you identify the various risks to your customer information and develop mitigation strategies to avoid or address these risks.

   When preparing your plans, detail the playbooks and security measures you will use to respond to breaches and protect data. For example, you may mandate MFA for all access requests or implement a Data Security Fabric (DSF) to implement enterprise-wide security controls. Whichever technologies or tools you use, include them in the plan.

   Also communicate these plans to all stakeholders so everyone is on the same page at all times, and the organization is better prepared to respond quickly to a crisis.

Manage and Secure Your Consumer Data with Automation and ZenGRC

Data security automation platforms can help you overcome data protection challenges and boost data security across your organization. The ZenGRC from Reciprocity provides a single source of truth so you can see exactly where your data is at risk.

Then leverage its automated workflows, built-in content library, and expert-provided guidance to implement smart data security controls and protect consumer data. ZenGRC’s contextual insights and powerful features will also enable you to meet your compliance responsibilities and goals with ease. Get a free demo of ZenGRC today!

“Reconnaissance” (recon) is a military term that refers to observing a target (usually in a clandestine way) and gathering information about it. The term and its meaning have also found its way into cybersecurity. Cyber attackers use a number of recon techniques to gather sensitive information about a target organization – which would be you.

Such recon attacks often seem harmless at first, and are often overlooked by security administrators. This can be a dangerous mistake because attackers use the information gained in reconnaissance for subsequent ransomware attacks, denial of service (DoS) attacks, advanced persistent threats (APTs), and other malicious purposes.

On the positive side, security teams can likewise perform reconnaissance during penetration testing to understand the attacker mindset and improve the company’s security strategy.

What Is Cybercriminal Reconnaissance?

Cyber attackers use reconnaissance techniques and tools to “stake out” an organization’s security environment and identify weaknesses. The attackers’ goal is to exploit these weaknesses to bypass security controls so that they can:

• Sabotage or damage devices
• Encrypt systems and demand a ransom
• Steal sensitive or confidential data
• Prepare for later or longer-term attacks (such as advanced persistent threats, or APTs)

Attackers usually perform recon in multiple stages to gather more information about the target, identify exploitable open ports or vulnerable services, and gain unauthorized access to enterprise resources – all while evading security alarms. These phases are as follows.

1. Open Source Intelligence (OSINT) Gathering

   Attackers use search engines, financial databases, domain name registries, business reports, and other readily available data mining tools to learn about the company’s:

   • DNS names
   • Organizational structure
   • Business partners
   • Brands and divisions

2. Footprinting

   After collecting information about the target, the adversary mines and translates DNS host names into IP addresses or IP address ranges. To achieve these aims, the attackers may use data mining tools, a domain information groper (DIG) command-line tool, or the WHOIS Internet record listing.

3. Human Recon

   Humans are often the weakest link in cybersecurity; that’s why this is an important phase in criminal recon. The adversary gathers intelligence about the people associated with the organization, such as employees, senior managers, and third-party service providers. The information may include:

   • Names
   • Job titles
   • Contact information
   • Other personal details

   To collect this data, the attacker may use sources such as email lists, social media and website posts, public records, and search engines.

4. Information Verification

   In this phase, attackers confirm the validity of collected information using WHOIS or DIG. To this end, they remove invalid or duplicate data and gather additional information to support verification.

5. More Information Verification

   In the final phase, the threat actor confirms the reachability of the IP addresses identified in previous phases. They use mapping tools, port scanners, or packet internet groper (PING) tools to compile a list of reachable IP addresses.

   There is no typical timeframe for reconnaissance. Depending on the target, the attacker’s skills, and the type of information the attacker seeks, a recon mission may take anywhere from a few days to several months.

   In a well-protected enterprise network, the attacker may not gain any useful information. In weaker networks, however, the attacker may gather enough information to exploit the environment, install harmful malware and trojans, or exfiltrate sensitive data.

What is a Reconnaissance Attack?

Recon may appear to be a simple information-gathering mission or a precursor to a “real” attack. As a practical matter for CISOs, however, it’s useful to see recon as just another type of attack that requires a response from you, even if recon doesn’t damage enterprise resources or data.

A reconnaissance attack allows criminals to prepare for subsequent DoS attacks, ransomware attacks, APTs, and so forth. There are three main types of recon attacks:

1. Software Recon Attacks

   The adversary uses software tools, such as debugging or troubleshooting utilities, to gather information about the target network and resources. For example, the attacker might use the nslookup command to investigate a DNS and find a reachable IP address from the domain name. The attacker can then use WHOIS to find more information about the organization, such as its mail servers, DNS servers, personnel contact information, and the like.

   The hacker may also use the ping command to confirm that a target host is live, or the tracert command to create a visual map of the target network. Some attackers also use network scanners to detect running services, operating systems, firewalls, and other exploitable resources on the target host.

2. Public Recon Attacks

   This attack involves collecting information about the target from public sources such as company websites, business reports, web archives, domain name registrars, and financial databases. These sources allow the attacker to determine:

   • The target’s location
   • The target’s IT infrastructure
   • Vulnerabilities in enterprise systems
   • Confidential information such as intellectual property, blueprints, or business plans

3. Social Recon Attacks

   A social recon attack exploits human weaknesses like greed and the tendency to trust others. The attacker uses social engineering methods such as phishing, scareware, pretexting, and baiting to fool or threaten a person into revealing information about the target organization. The attacker may also look at employees’ social networking accounts to gather information about the company’s employees, partners, M&A plans, and more.

Common Reconnaissance Tools

Attackers can use many techniques and tools to perform reconnaissance on a target. For example, they may use ICMP ping sweeps to scan a network and find a range of IP addresses that map to live hosts. Or attackers might leverage SNMP walking techniques to gather information about network maps and device configurations.

Some attackers also use application-level scanners to search for vulnerabilities in web server common gateway interfaces (CGI) or application code. Other popular recon tools and techniques include:

• Google dorking
• Shodan search engine
• CVE (Common Vulnerabilities and Exposures) database
• Wireshark network analysis tool
• Maltego OSINT and forensics application
• Nmap port scanner
• OpenVAS vulnerability scanner

How Reconnaissance Helps Organizations With Strategic Security Planning

Many organizations, even those that are cyber-prepared, rely on attack detection and response tools (for example, endpoint detection and response, or EDR) to identify cybersecurity threats and mitigate attacks.

While these tools are important for cybersecurity, they are reactive. That means they cannot identify reconnaissance activities or prevent reconnaissance attacks; recon is so low-profile and unobtrusive, there’s hardly anything for those tools to react to.

Most EDR tools also produce a high volume of alerts and false positives. Amid all this noise, serious reconnaissance-related threats can easily get lost. These high alert volumes also overwhelm security teams and keep them from performing security tasks such as software patching or system hardening.

Knowing these facts of security life helps with effective security planning and implementation. Security teams that understand the risk of recon attacks can implement appropriate tools and controls to:

• Build a deeper understanding of the enterprise network
• Identify vulnerable ports or applications that could be exploited by an attacker
• Detect security blind spots
• Update security policies

These tools may include anti-malware and antivirus software, EDR platforms, next-generation firewalls (NGFWs), Security Information and Event Management (SIEM), and digital risk protection services (DRPS) to counter reconnaissance attacks.

In addition, the team can determine whether the organization needs more advanced solutions enhanced with artificial intelligence (AI) or machine learning to detect recon attack patterns and intercept threats in real-time.

Companies can also perform reconnaissance as part of penetration testing and red team exercises. These exercises can help them determine their security posture and find security weaknesses that must be fixed on priority.

Additionally, recon helps security teams to understand the tactics, techniques, and procedures (TTPs) potential hackers may use as part of their recon missions. For the latter, it’s useful to use widely accepted frameworks like MITRE ATT&CK or Lockheed Martin Kill Chain.

Then the team can:

• Take steps to harden networks and systems
• Implement appropriate controls to keep data safe
• Audit existing security systems
• Implement monitoring and threat intelligence to detect in-progress recon
• Train staff to recognize the signs and dangers of recon attacks

Security admins may also deploy deception campaigns to lure attackers into the network and track their activity. Implementing deception tactics into the security strategy is an active way to stop reconnaissance attacks before they happen and protect the organization.

Strengthen Enterprise Security with ZenGRC

Be more strategic about your cybersecurity, to prevent recon attacks and keep attackers out of your enterprise network – and to do this, you need the right technology. Try ZenGRC.

ZenGRC, a comprehensive cybersecurity risk management platform, provides a unified, real-time view of risk. Leverage this view to understand the risk implications of various processes, distinguish between strategic versus operational risk, and mature your risk program.

Get a demo to know how ZenGRC’s advanced functionality can support your anti-reconnaissance efforts.