ZenGRC

Simply Powerful GRC

Technology

Tiphaine Romand-Latapie: Wednesday’s Women in Infosec

· ·

Thiphaine Romand-Latapie

Photographer: Gilles Cohen

Tiphaine Romand-Latapie is leading a team of hackers at Airbus. Tiphaine’s first love is cryptography. She previously worked as a telecommunications operator Orange, where she was in charge of new product security. Tired of meetings full of misunderstandings, she decided to 1) record the most absurd quotes she heard,  and 2) design a role playing game to teach people about the basic principles of infosec that she published in 2016 at BHUSA. She likes to be the translator between the highly technical security team and the rest of the world.

If you had to choose one event that led you to work in information security, what would it be and why?

Tiphaine Romand-Latapie: I studied Mathematics applied to Computer Sciences, and during those studies, I discovered Cryptography. It was really my first glance at infosec, and I loved the technical challenges and the cat and mouse game that you find in infosec.

Why do you like working in the information security environment?

Tiphaine Romand-Latapie: There are so many reasons. First, you are in a position to help people. Second, you work with everyone, discovering so many different jobs or technology in the process. This leads to the third reason which is the “puzzle” aspect, discovering the way to answer a challenging issue. Finally, I love that you are forced to always put yourself in others’ shoes (what will the attacker do ? Why my business is asking me that? Will my user follow this recommendation? etc.)

If a n00b to the infosec world asked you for a piece of advice, what would it be?

Tiphaine Romand-Latapie: To a n00b entering the professional infosec world, I’d say: the rest of the world doesn’t care about the technicalities (even if they are beautiful and important), your job is to understand those for them. Most of practitioners come in infosec for the technical aspects and find themselves disappointed with their management/client for not caring about them. This makes them feel undervalued when it is not the point at all.

What is the most important issue facing professionals in the information security landscape today? Why?

Tiphaine Romand-Latapie: The gap between what infosec experts consider basic facts and what the rest of the world actually understands. And I am not talking about basic technical facts, but “life facts” like who are the attackers, the diversity of their profiles, what is sensitive information etc. The consequence is that we don’t speak the same language most of the time. It is frustrating for everyone. This is why I have created my role playing game, to make non security-practitioners aware of what we consider basic facts.

What is the most important issue facing consumers in the information security landscape today? Why?

Tiphaine Romand-Latapie: I’ll answer the same than for the previous question. When you don’t really understand why you need security, all infosec seems scary, or useless. The FUD communication doesn’t help at all. We need to teach people to ask themselves the rights questions: what do I want to protect? Against whom? So they feel empowered instead of crushed.

What are your three “guilty pleasures” that have nothing to do with information security?

Tiphaine Romand-Latapie: 1) Reading (I don’t feel very guilty about it) SciFi, Fantasy or Thrillers 2) Taking naps 🙂 3) Taking a day off to be all by myself to regroup (no husband no kid, just me and a book)

What’s your favorite book-to-movie adaptation and why?

Tiphaine Romand-Latapie: Outch, very hard question … the first that came to my mind (maybe because it is recent) is “Arrival”: the film is changing some elements of the story but do not betray at all the spirit of the book in my opinion. And for once, the end was not rewritten in favor of a “happy ending “ .

iPhone X and Security: Becoming James Bond and Protecting Your Organization

· ·

iPhone X and Security

When Apple announced its high tech facial recognition software, the iPhone X and security suddenly stepped out of the dark and into the light. For many, the ability to hold up a phone and unlock it with your face seems like something out of a James Bond movie or a science fiction spy book. We may not have Marty McFly’s hoverboards on our sidewalks, but we will have James Bond-esque biometrics in our hands.
 
Where do iPhone X and security overlap? Looking at the compliance landscape, the reasons for the iPhone X FaceID are the same reasons you need to secure your password management program. If you’re looking for the compliance equivalent of smartphone technology‘s ease, complete this form to schedule an appointment with one of our GRC experts.
 

How the iPhone X and Security Concerns Correlate

 
Two-factor and multi-factor authentication requirements are rapidly becoming business norms. Protecting data means finding as many ways as possible to thwart malicious intentions.
 
Security analysts have long noted that facial recognition isn’t that safe. In fact, Samsung even admitted that the Galaxy S8’s recognition software was flawed in the early stages. Many security professionals have therefore been wary about Apple’s FaceID.
 
Unlike others facial recognition programs, however, the Apple model uses 3D scanning to create the saved image. This means that it looks at more data points and angles to make its recognition as precise as possible.
 
For everyday users, the available information is contentious. Apple argues that FaceID is safer. News outlets argue that there could be better options. Some even argue that it would be safest to require passcodes, so why move on to face scanning if that isn’t actually a security upgrade?
 

Why You Need to Promote Security Awareness

One of the largest security flaws in any organization is its employees. Human error and human laziness are two of the largest reasons that Apple is moving to facial recognition technology. The same problems plague your organization.
 
Why not continue to unlock smartphones with passcodes? Because people don’t make strong passwords. They use easy-to-remember passcodes or default passcodes. In fact, in the wake of the Equifax breach, news outlets noted that the company used “admin” as the password for one of its non-US databases.
 
Technology companies created facial recognition and fingerprint identification in response to ongoing security awareness problems. These are precisely the problems that put your organization at risk. If employees don’t understand the value of protecting their own information, they may not understand the value of protecting yours.
 

How to Incorporate Security Awareness into Your Information Security Management System

 
Just because an organization understands the value of security awareness, it might not easily incorporate that understanding into its information security management system (ISMS). The goal of any ISMS is to mitigate security risks.
 
Training employees is the cornerstone of that mitigation. The problem is that trainings need to occur more than once a year. They need to be ongoing and engaging—if people don’t see the value, they tune out.
 
Security awareness needs to be more than a top-down mandate governed by your IT department. Employees need to understand that just as others are protecting them, they need to help protect you.
 

Why an Effective Information Security Awareness Program Needs You to Be James Bond

 
To promote security awareness, you need intelligence on employee habits. Though you’re not walking around in a tuxedo carrying your stirred martini, you’re still sleuthing.
 
Understanding employee habits and weaknesses requires documentation of your compliance standards and controls. Whether you’re reviewing user authentication settings or creating a password management program, you need to go undercover to understand how employees are engaging with your systems.
 
Gaining intel doesn’t mean looking over employees’ shoulders. If you send out fake phishing emails to test employee savvy and employees still click through, then your trainings aren’t working.

Why Automating GRC Is the iPhone X of Infosec Compliance

GRC automation and the iPhone X FaceID fulfill the same ease of use function. Where FaceID intends to ease the consumer burden of passcode strength, GRC automation eases the burden of security documentation, reporting, and tracking.
 
Documenting security awareness training means engaging in metrics that involve all employees. To do this, you need to track new employees as well as current employees. You may have to follow up with employees who did not take the training. You have to make sure that they pass the training with the grade required by your policy.
 
Moreover, employee education may be an objective for more than one program. You need to be able to map that objective easily across the different programs and standards. Then you need easy access to reports that show your compliance.
 
With the ability to incorporate multiple standards into your program, you have the ease of one-touch reporting capabilities. Instead of having to review multiple pages of spreadsheet documentation, you can more easily compile the data for your auditor. With a single source of truth, you can easily and seamlessly prove your compliance. Just as consumers simply need to look at their phones to turn them on, you simply need to push a button to prove your compliance.
 
Whether you like your martinis shaken or stirred, what you undoubtedly will like is the ability to meet audit documentation requirements easily.
 
To see how you can become James Bond, book a demo, tuxedo optional.

Christine Bejerasco: Wednesday’s Women in InfoSec

· ·

Christine Bejerasco

Christine Bejerasco started her career at Trend Micro working as an antivirus engineer. Fourteen years later, she is F-Secure’s senior manager and service lead for SAFE PC. Currently, she leads the team that is in charge of the client-facing components of F-Secure’s flagship SAFE PC. Planning with product owners and researchers from various departments, she helps design a product/feature that generates the best ROI for the company. Christine Bejerasco works to bridge the threat landscape knowledge between F-Secure Labs and the client teams to generate cross-functional engagements and build stronger protection features.

ZenGRC: If you had to choose one event that led you to work in information security, what would it be and why?

Christine Bejerasco: I started working in Infosec (with Trend Micro) right after University. I am a Computer Science graduate and was looking for jobs in my field. At that time, I had several offers already, ranging from technical support jobs to software development jobs. Then TrendLabs (under Trend Micro) had an opening for antivirus engineer trainee. If I passed that program, I would then be able to build solutions that protect users against malware. I thought that was quite cool. It was not the highest-paying offer then, but I definitely thought that it was the most meaningful. I was young and idealistic and had some illusions about saving the world, so I went for it. That was 2003, and I have not left the security industry since.

ZenGRC: Why do you like working in the information security environment?

Christine Bejerasco: What’s not to like? It has the element of complexity which gives exciting technical challenges, and it makes you feel that your work has meaning. The work is all about protecting people. In the early 2000’s, it was all about protecting the users’ machines. Nowadays, it’s hard to detach the person from the machine as more and more of our assets are getting digitalized. This, in turn, just makes me feel that the job is just becoming more and more important today.

ZenGRC: If a n00b to the infosec world asked you for a piece of advice, what would it be?

Christine Bejerasco: Think twice before opening that attachment or clicking that link. Always stop and think twice.

ZenGRC: What is the most important issue facing professionals in the information security landscape today? Why?

Christine Bejersasco: For me, this is the increasingly closed operating systems that security products can interface with legitimately. In order to protect from attacks that go deep in the OS, security products would need deep access to the OS. Since the OS is also increasingly trying to limit their attack surface, they are keeping even the security products away from hooking the OS too deeply. So we are now at a stage where protecting the customers is increasingly becoming challenging because of the limitations that the OS has set. But also, this makes the OS less prone to exploitation. It would be interesting to see down the road how the threats are going to evolve with these changes as well.

ZenGRC: What is the most important issue facing consumers in the information security landscape today? Why?

Christine Bejerasco: We have our life’s profile stored and available to different companies online. At the moment, the main effect that we can see from all this profiling is giving us targeted advertising. But beyond this, what then? What could be the next thing that can happen when all of this valuable information is just becoming more and more fine-grained and easily associated to the users? Privacy laws are also increasingly becoming more strict. When will they keep up? Will they be enough? There are just too many uncertainties in the area of privacy. As a user, the future looks a little uncertain.  I feel like at the moment, the burden of protecting my privacy lies only with me. It becomes quite a challenge when a user has many devices with different methods of tracking.

ZenGRC: What are your three “guilty pleasures” that have nothing to do with information security?

Christine Bejerasco: Beer. Travel. Food.

ZenGRC: What’s your favorite book-to-movie adaptation and why?

Christine Bejerasco: Not a movie but series. At the moment, it’s probably the Game of Thrones. It’s not because of the story itself, but the evolution of the series. I liked the realization that an onscreen adaptation does not have to be exactly like the story in the book and to give the story a room to evolve on its own. That was interesting. During the time when the series was quite religiously following the book, it was dragging and quite boring. However, when changes were introduced to the story in order to make it more viable to the onscreen audience, it became more dynamic and exciting.

Defcon 2017 Roundup: 7 Lessons for Information Security Professionals

· ·

The country’s biggest annual hacker meeting is over, and the DEFCON 2017 roundup stories are filtering across the internet. DEFCON first opened its doors in 1993. What started as a farewell celebration for a network that was going to shut down has, twenty-four years later, turned into the premier gathering of hackers. After the best in the hacking business, black hat or not, showed up in Las Vegas this year, lessons for the information security world abound.

Defcon 2017 Roundup Lesson 1: Malicious Hackers Will Exploit Old Stuff

The most important general news item coming out of DEFCON 2017 is that hackers can exploit voting machine vulnerabilities in under two hours. The hacks included everything from taking apart machines to turning them into music players. Though international hackers won’t be coming to the United States to take apart machines, this ability shows a level of vulnerability that could lead to ongoing hacks.

More concerning for many readers, voting machines are less protected than the average laptop. Although the majority of the devices were purchased on eBay, only one was ever decommissioned. As concern grows over interference in the 2016 election, DEFCON showed us how interference could happen quickly.
Many of the hackers used Google to find the machines’ information. The big lesson for the information security community is that outdated WiFi security is a huge vulnerability. As malicious hackers become more advanced, everyone—government or not—needs to be more in tune with the dangers of remote hacking.

Defcon 2017 Roundup Lesson 2: Physical Safety Is Just as Vulnerable

Just when we thought our homes were safe, Nathan Seidle of SparkFun Electronics proved everyone wrong. After buying a Sentry Safe you can buy at Home Depot, he set his robot to the test of cracking it.

Seidle’s robot cost approximately $200 to build. Controlled remotely using an Arduino microcontroller, the robot uses magnets that attach to the outside of the safe. According to the Mashable article,
“No matter how much money you spend on a safe, nothing is impervious,” noted Seidle. Which, well, was basically music to the crowd’s ears.

For those in the security world, the real lesson here is that physical safety needs to be a concern as much as electronic safety. As physical locks become increasingly reliant on technology, and as technology itself advances, dangers to location safety increase. While information security professionals need to focus on their system controls, they cannot ignore the implications for physical security.

Defcon 2017 Roundup Lesson 3: Your Processor May Be Your Vulnerability

Premiered at Defcon, Sandsifter reviews the instructions executable by a PC. Created by Batelle cyberscientist and white-hat hacker Chris Domas, Sandsifter reviews the instruction set architectures of the x86.

Since the x86 instruction set has been around since 1976, the ongoing updates build a lot of backwards compatibility into current models. In his whitepaper, Domas notes that being able to create a comprehensive search of this hardware can help locate flaws built into the hardware.

Domas’s whitepaper continues, Whereas the techniques for finding bugs, secrets, backdoors in software are well studied and established, similar techniques for hardware are non-existent. This is troubling, in that it is the processor that enforces the security of the system, and is ultimately the system’s most trusted component. It seems necessary to stop treating a processor as a trusted black box for running software, and instead develop systematic tools and approaches for auditing processors, in much the same way that we can audit software.

Due to the wide array of options for system controls integrity, hardware often gets left behind. Security professionals, however, need to be more aware of the vulnerabilities inherent in their hardware. The x86 is one of the most prevalent processing chips, so the ability to exploit it has large repercussions for businesses.

Defcon 2017 Roundup Lesson 4: Your Health IoT Can be Deadly

On Friday, Daniel Regalado presented “Inside the Alaris Infusion Pump, Not Too Much Medication Por Favor!” Infusion pumps provide patients with necessary medications, fluids, blood, and blood products, helping to save the lives of adult, pediatric, and neonatal patients. As the market share for infusion pumps increases, they become increasingly important to hackers.

Regalado shared that infusion pumps not only offer access to personally identifiable information, but are vulnerable to a ransomware attack that can hold pump users’ lives in the balance. For example, as Regalado demonstrated, an attacker can change the device’s PIN number and make the pump do whatever the attacker wants it to do. Hospitals have anywhere between 400 and 1,000 pumps, so this could endanger a lot of lives at the same time.

Moreover, even if attackers chose to focus on information, they could use the pumps to get into hospital networks, where they could access patient information or even destroy files.

Although Regalado’s demonstration required physical access to the pumps, he was adamant that remote access is the next logical step. In fact, with the rise of the Internet of Things, this progression may not be that far off.

In light of the impact that WannaCry had on the UK’s health services community, compromising medical IoT might be the biggest threat facing the security industry. Information security professionals in the health industry need to make sure that they’re working towards better protections.

Defcon 2017 Roundup Lesson 5: Artificial Intelligence Can Make Us More Accurate and Efficient

Gerry Kasparov, the world chess champion who lost to IBM’s Deep Blue computer, tried to allay fears that AI would be taking over the world and ruining humanity. In his speech, he stated that Deep Blue was “as intelligent as an alarm clock though losing to a $10m (£7.6m) alarm clock did not make me feel any better.”

More importantly, he clarified that while intelligent machines have begun to replace human jobs, it doesn’t mean the end of a human workforce. He argued that technology kills jobs before it creates them. He also noted that this means that people’s skills will be used more efficiently going forward.

In the long term, AI will require people to help it reach its maximum productivity. Smart machines can be smart only when there are people working with them. This means that AI will allow us to be not only more efficient but also more accurate.

For security professionals, this means embracing the help technology can provide. Using AI and machine learning can protect our systems more efficiently. 

Defcon 2017 Roundup Lesson 6: Everyday Products Are Risky

Between a car wash that can be hacked to destroy a car and a Tesla that can be disabled, IoT and AI are risky propositions from a security standpoint. In their demonstration, Billy Rios and Jonathan Butts hacked an automated car wash. Their hack, done with the owner’s permission, closed the door on a car’s hood multiple times.

Beyond doing this remotely to a specific car wash, they used the internet to find 150 other similarly situated locations. Their demonstration showed that they could not only guess the usernames and passwords used by the car wash owners, but also override the security features that keep the robotic arms from touching the cars. This meant that they were able to remotely shut both doors to the car wash and hijack the robotic arm to demolish a car. Though they did not demonstrate this ability with a driver in the car, the hack certainly could be used against both a car and driver.

Moreover, though Tesla provided patches to cover security issues in its model S, the cars are not foolproof. Last year, Tencent’s Keen Labs found a way to access the brakes through a WiFi hotspot. Tesla provided instant patches to protect drivers. At Defcon, the same team took the same model S Tesla and showed how the car could be hacked by using a cellular signal.

For the information security professionals, this suggests taking a deeper look into the seemingly innocuous things around you. While the Tesla is clearly cutting edge, car washes are not. Instead of focusing only on the complex issues, all areas of an organization should be double checked for safety.

Defcon 2017 Roundup Lesson 7: Hackers Can Be Hacked

A good offense has always been considered the best defense. In the case of hacking, this means understanding not only your own vulnerabilities but also how to exploit your attackers’ weaknesses.

There are many tools available to hackers, but the majority tend to use a few common “remote administration tools.” For better or for worse, this means that security professionals have a strategic advantage for exposing vulnerabilities. Hacking the hackers can provide information such as their targets and the types of information they’re seeking.

More importantly, however, it shows that these malicious attackers are using tools that are as flawed as what they’re trying to access. In other words, hackers are just as prone to security flaws as everyone else. They’re not any more secure than our businesses and aren’t an “untouchable group.”

That said, if we’re going down the road of cliches, two wrongs don’t really make a right. The real lesson here for information security professionals is that while hackers may be assaulting our systems, they’re not that much more sophisticated than us. Being paralyzed by fear is one of the main distinctions between legitimate industry and malicious attackers.

Defcon 2017 is over, but the lessons it brought the security world will continue to mold our activities into 2018. For many organizations, understanding how to protect themselves against malicious attackers is the best way to create a safer world of information. A strong compliance stance is one way to meet these evolving needs.

See how consolidating your objectives can help strengthen your compliance landscape while lessening your vulnerabilities in “6 Time Saving Steps to Simplifying Your GRC Strategy.”

Cybersecurity Management and GRC Automation

· ·

As wave after wave of cyberattacks threatens international security, cybersecurity management becomes more pressing. Although it has always been on business’s radar, the recent barrage brings the impact of cyberattacks to the forefront. With this in mind, a recent study from Crowd Research Partners found that 54% of cybersecurity professionals anticipate successful attacks within the next twelve months.

Moreover, the research found that 62% believed threat detection needed to be improved. Meanwhile, 43% wanted better analytical capabilities, and 39% wanted to focus on threat blocking.

How to Use GRC Automation for Cybersecurity Management and Threat Detection 

Cybersecurity management focuses on knowing your threats and understanding your risk profile. Security Magazine noted that there were seven steps to automating cyber threat detection and analysis. Before you can take those steps, however, you need to determine what threats your business faces. In order to do this, you need to know the value of your information and the probability of a breach—both of which can be computed with automation.

Determine Value

Determining value means understanding not only the inherent value of information, but also the monetary value of your assets and why a cybercriminal would want your them. With automation, these values are clearer because you have a single tool that visualizes your organization’s standards, regulations, and therefore the types of assets.

Probability of a Breach

Once you define your assets, you can also take a look at the probability that someone will try to attack you. While some attacks may be unrelated to specific targets, others are looking to attack critical sources, so you should determine where you sit on the spectrum of information value and critical service.

To understand your compliance stance, it is vital to see the overlap of your information assets and the probability of a breach. With spreadsheets, this can become muddled. Having to flip back and forth from one sheet to the next means that you can lose track of controls or assets. In addition, since spreadsheets can be changed or reverted to older versions, it may be difficult to keep track of the information.

ZenGRC offers a centralized repository of standards and regulations to help you find where you need to be compliant. This extensive visibility into your compliance stance provides you with an understanding of where potential vulnerabilities exist and allows you to shore up those areas.

Why Use Risk Analysis Capabilities to Support GRC?

GRC automation and risk analysis capabilities come in different packages. Combining security analytics with GRC can produce a stronger security profile than either of the two alone. By using security analytics to monitor your GRC processes, you create a common language throughout the organization. This helps establish risk appetites and allows you to build a stronger compliance stance.

Meaningful automation not only can protect you from a cyberattack, it can make your organization more resilient when, not if, the attack happens. As information security programs mature, they need to be agile in order to continually map risks to operations. An Information Systems Audit and Control Association (ISACA) journal article notes,

Information security programs seek to protect the confidentiality (access, use, and disclosure), integrity (modification or destruction) and availability of information and systems from unauthorized users, including external adversaries such as criminals, hacktivists or governments. Information security programs must identify and respond to risk in a rapidly evolving technology landscape characterized by increasing complexity, volume and variety of data and all of the associated threats to business processes, applications, and networking layers.

To effectively use your analytics, you need to match business objectives to security objectives. When you have insight into how your key performance indicators (KPI) align with the organization’s business goals, you can more effectively assess the time it will take for your company to recover from an incident. GRC automation allows you to clearly map your analytics to your risk and controls for meaningful KPI.

If you can easily update controls across multiple frameworks when your threat analytics show a weakness, you will produce both better audit outcomes and stronger security as a whole. Automating your GRC program means increasing transparency in your compliance stance to create consistency across frameworks, producing a single source of truth for your organization.

How GRC Automation Helps with Threat Blocking

Cybersecurity management needs to focus on security information and event management (SIEM) when blocking threats. Your current SIEM solution collects and logs all your data for analysis. This includes threats, which are recognized and then blocked. The purpose of a SIEM system is to act as a single point of view across systems so that trends or patterns are visible. Meanwhile, the goal of your GRC program is to define the controls that lead to these trends and patterns.

Think of your compliance program like an army fighting a war. Your GRC program acts as the War Room where all the plans are made. This is where you define your strategy and objectives. Meanwhile, your SIEM acts as the boots on the ground, or code in the cloud, getting the nitty gritty work done. To manage your cybersecurity portfolio appropriately, you need to enforce consistent controls across various platforms and frameworks.

A single source of truth provides a quick reference guide to locate where controls broke down once an event occurs. When your SIEM flags something, you want quick access to all the places that control may have failed. With controls mapped consistently across systems, you can compare one area of vulnerability to similarly situated vulnerabilities more rapidly. This allows you to block threats more effectively.

The onslaught of cyberattacks highlights the importance of cybersecurity management. In today’s environment, any company can be a target. Having an agile compliance platform offers you a clearer view of your portfolio and provides a way to make control changes efficiently across all systems and business lines. Integrating GRC automation into your compliance stance strengthens it while also protecting your assets from cyber threats.

To read about the benefits of using ZenGRC to protect against the ever-evolving risk of cyber threats, read our eBook, “The Insider’s Guide to Compliance: How To Get Compliant and Stay Agile.”