Pwned: The Information Security Podcast

Sponsor: https://www.nuharborsecurity.com Contact Me: https://justinfimlaid.com/contact-me/ Twitter: @justinfimlaid LinkedIn: https://www.linkedin.com/in/jfimlaid/ All the notes: https://www.nuharborsecurity.com/exim-server-vulnerabilities/ Interesting Tid-bits: Known C&C: http://173[.]212.214.137/s Firewall Addresses: https://an7kmd2wp4xo7hpr.tor2web.su https://an7kmd2wp4xo7hpr.tor2web.io https://an7kmd2wp4xo7hpr.onion.sh

Sponsor: https://www.nuharborsecurity.com Contact Me: https://justinfimlaid.com/contact-me/ Twitter: @justinfimlaid LinkedIn: https://www.linkedin.com/in/jfimlaid/

Sponsor: https://www.nuharborsecurity.com Contact Me: https://justinfimlaid.com/contact-me/ Twitter: @justinfimlaid LinkedIn: https://www.linkedin.com/in/jfimlaid/

Sponsor: https://www.nuharborsecurity.com Contact Me: https://justinfimlaid.com/contact-me/ Twitter: @justinfimlaid LinkedIn: https://www.linkedin.com/in/jfimlaid/ IOCs: APT10/Operation Cloud Hopper - Indicators of Compromise v3.csv

Important Links: More Info: https://www.nuharborsecurity.com/4-things-to-know-about-the-ohio-data-protection-act/ State of Ohio Data Protection Act Law Text: https://www.legislature.ohio.gov/legislation/legislation-documents?id=GA132-SB-220 IAPP Analysis (by Katelyn Burgess): https://iapp.org/news/a/analysis-ohios-data-protection-act/ What is the Ohio Data Protection Law (by Jenna Kersten): https://kirkpatrickprice.com/blog/what-is-the-ohio-data-protection-act/ Sponsor: https://www.nuharborsecurity.com Contact Me: https://justinfimlaid.com/contact-me/ Twitter: @justinfimlaid LinkedIn: https://www.linkedin.com/in/jfimlaid/

Important Links: SHA-1 Collision Explanation Page: https://shattered.io/ Malicious Hashing: Eve’s Variant of SHA-1 https://link.springer.com/content/pdf/10.1007%2F978-3-319-13051-4_1.pdf Finding SHA-1 Characteristics: General Results and Applications: https://link.springer.com/chapter/10.1007%2F11935230_1 Sponsor: https://www.nuharborsecurity.com Contact Me: https://justinfimlaid.com/contact-me/ Twitter: @justinfimlaid LinkedIn: https://www.linkedin.com/in/jfimlaid/

Show Notes: https://www.nuharborsecurity.com/building-a-vulnerability-management-program-with-the-end-in-mind/ Sponsor: https://www.nuharborsecurity.com Contact Me: https://justinfimlaid.com/contact-me/ Twitter: @justinfimlaid LinkedIn: https://www.linkedin.com/in/jfimlaid/

Show Notes: https://justinfimlaid.com/quickstart-building-a-security-program-with-the-nist-cybersecurity-framework/h Sponsor: https://www.nuharborsecurity.com Contact Me: https://justinfimlaid.com/contact-me/ Twitter: @justinfimlaid LinkedIn: https://www.linkedin.com/in/jfimlaid/

Show Notes: https://www.nuharborsecurity.com/red-teaming-vs-penetration-testing/ Sponsor: https://www.nuharborsecurity.com Contact Me: https://justinfimlaid.com/contact-me/ Twitter: @justinfimlaid LinkedIn: https://www.linkedin.com/in/jfimlaid/

Sponsor: https://www.nuharborsecurity.com Contact Me: https://justinfimlaid.com/contact-me/ Twitter: @justinfimlaid LinkedIn: https://www.linkedin.com/in/jfimlaid/ My opinion of security has changed. We are not keeping up.  Companies keep getting breached. First things first, the idea and concepts of security have been around for a while.  In the most general terms, truth is we have senior industry and junior skill set.  Our collective industry is not helping us be better.  Security product companies are coming to the market with new half solutions and big marketing budgets.  Advisory companies are coming to the table with new buzzwords and hollow concepts.  And "thought leaders" and "trusted advisors" are still trying to figure this out, and probably not giving the best advice yet.  All these things take our collective eye off the ball, cause us to loose focus, and distract us from doing well at security fundamentals. For those listening to this unfamiliar with our space, here's some examples what we're dealing with: People failing to understand that IT Operations and security are completely different disciplines.  It's like building a house, you need someone to lay out the blueprint, someone to pour the foundation, someone frame house, someone to do the electricity, someone to the plumbing.  These are not the same people.  IT Operations and IT Security professionals are not the same people.  If you want your house built to code like you want good security hygiene you should hire a security professional.Accounting firms pretending internal controls translates to good security operations.  This is a problem.  Internal control is destination, but you need a map and relevant mechanism of transport to get to you destination.  While I'm sure there are some accountants who play in security, articulating the map and which vehicle to use can be a problem and due to CPA independence rules they are sometimes prohibited from providing tactical guidance.Value added resellers (VAR's) being incentivized to push one product over another. I'm pretty sure I'm going to get some hate mail from this, but I don't think anyone would disagree that vendors and resellers push products to maximize their fiscal standing versus seeking best of breed when it might not be the companies best interest.  This creates a ton of confusion in security and really muddies the water, when this happens the only objective measure is price…which is always a bad space to be. Those are some examples, but it's not all bad.  We need stay focused though. In order for our security industry to get better we need get back to basics of good security hygiene.  I admit this is easier said than done, its going to take time to get there.  Until we do this we can’t start to think about automation because if you do crappy security and automate it, security automation will allow you just do crappy security faster.  You don't need blockchain, if you don't believe it do some research in European Election Security…they use good old-fashion asymmetric encryption.  If you're getting started, or need a realignment go back the fundamentals, good policy, good security architecture, good security hygiene of accounts, etc.  When you've done this, then hopefully you have a good handle on requirements for security technology and you have the expertise on how the technology should work in your environment.

Show Notes: https://www.nuharborsecurity.com/open-banking-directive-and-securing-web-application-vulnerabilities/ Sponsor: https://www.nuharborsecurity.com Contact Me: https://justinfimlaid.com/contact-me/ Twitter: @justinfimlaid LinkedIn: https://www.linkedin.com/in/jfimlaid/ Application Security Checklist for Web Applications and API's. Also @ NuHarbor Security. I have not seen an Open Banking Web Application Checklist, so hopefully this is a good starting point for some. 1.Ensure HTTPS: This one is pretty simple but HTTPS protects authentication credentials in transit for example passwords, API keys, or JSON Web Tokens. It also allows clients to authenticate the service and guarantees integrity of the transmitted data. 2. Security Tokens:  There seems to be a convergence toward using JSON web tokens as the format for security tokens. JSON web tokens are JSON data structure containing a set of claims that can be used for access control decisions. If you are looking for more on JSON formats, here's a good starting point. 3. Access Control: Non-public rest services must perform access control at each API endpoint. Web services in monolithic applications implement this by means of user authentication, authorization of logic in session management.  To this right at scale, user authentication should be through a centralized Identity Provider which issues their own tokens. 4. Input Validation: Anyone developing for a while knows this is a requirement.  If you don't sanitize inputs your application days are numbered.  Contact me if you want the full-list on this one. 5. Restrict HTTP Methods: Apply a whitelist of permitted HTTP Methods (e.g. GET, POST, PUT) and make sure the caller is authorized to use the incoming HTTP method on the resource collection, action, and record.  Leverage 405's when rejecting all requests not matching the whitelist. 6. API Keys: API Keys can reduce the impact of denial of service attacks. However, when their issue to third-party clients, they are easy to compromise.  There are a couple things you can do to mitigate security risks including require API keys for every request to the protected endpoint. You can also returning a 429 message "too many requests" if the volume of requests are to high. Do not rely solely on API keys to protect high-value resources. 7. Validate Content Types: A rest request a response body should match the intended content type in the header. Otherwise this can cause misinterpretation at the consumer/producer side lead to code injection/execution.  Some additional things to think about: Validate Request Content TypesSend Safe Response Content Types 8. Manage Endpoints: There is a couple things you can do to securely manage your end points. Avoid exposing your management and points by way of the Internet. If your management and points must be accessible to the Internet, make sure that all users authenticate using strong authentication mechanisms such as multi factor authentication. Security by obscurity is not always a good strategy, but exposing management endpoints by way of different HTTP ports or host on different/restricted subnets can also reduce some risk.  Lastly restrict access to these endpoints by firewall ACL's. 9. Error Handling: Keep error message is generic in nature. Try to avoid revealing details of any and all failures when necessary. This will help prevent giving the potential attackers the information they need to game the system or perform a secondary attack with the new information. 10. Security Headers: This one is sometimes overlooked, but to make sure the content of the given resources is interpreted correctly by the browser, the server should always send the "content-type" header with the correct content type, and preferably the "content-type" header should include a charset.  The server should sent the "X-Content-Type-Options: nosniff" security he...

Show Notes: https://www.nuharborsecurity.com/how-does-estonias-e-voting-work/ Sponsor: https://www.nuharborsecurity.com Contact Me: https://justinfimlaid.com/contact-me/ Twitter: @justinfimlaid LinkedIn: https://www.linkedin.com/in/jfimlaid/

Show Notes: https://www.nuharborsecurity.com/building-on-people-process-and-technology/ Sponsor: https://www.nuharborsecurity.com Contact Me: https://justinfimlaid.com/contact-me/ Twitter: @justinfimlaid LinkedIn: https://www.linkedin.com/in/jfimlaid/

Show Notes: https://www.nuharborsecurity.com/pci-data-security-standard-4-0/ Sponsor: https://www.nuharborsecurity.com Contact Me: https://justinfimlaid.com/contact-me/ Twitter: @justinfimlaid LinkedIn: https://www.linkedin.com/in/jfimlaid/

Show Notes: https://justinfimlaid.com/the-cavalry-is-not-coming Sponsor: https://www.nuharborsecurity.com Contact Me: https://justinfimlaid.com/contact-me/ Twitter: @justinfimlaid LinkedIn: https://www.linkedin.com/in/jfimlaid/ I hear it all the time, security burn out is high. I wasn’t until this week that I realized that folks got the reason for burn out completely wrong.  After listening to someone tell me that a large tech company burns out their staff due to work volume and rotates the staff every 2 years I realized we have it twisted.  I don’t know about you, but most security folks I know love doing security and a 60 hour week hasn’t burnt anyone out when they do what they love.  If a 60 hour week does burn you out, then I'd recommend changing your work profession as a matter of mental health.  Go do something you love to do, then no one would have to pay you to work because you'd do for free because you love it. As a former CISO I can say first hand that the work never burnt me out.  The environment and people are what burned me out.  What I mean by that is that having accountability for security and no direct responsibility for security in a $6B organization was incredibly stressful. Most security folks I know are in this spot. They have accountability for enterprise security but the role and action of security is distributed across the organization.  Also - there should be some segregation of duties between IT and Security.   Since security is often monitoring an environment they often see mistakes make by peers in the company outside of security.  Those mistakes can make  security challenging, but those same peers often have little motivation to clean up those mistakes unless it directly impacts their job.  So, security having to feel like they are in the position of digital janitor and clean up can be exhausting.  There's only so many times you'll clean up the spilled milk before you just leave it spilled. Security leadership has become a political position, evangelizing for security, educating you work colleagues on security all so those same company peers when faced with a security decision will self-select the correct decision related to security when no one is looking. To amplify matters, you don’t have all the budget you need or want to do your job. Nor likely do you have all the actual authority to make that decision you want to.  The threat landscape is also shifting so tomorrow is always a new type of cyber attack. All this is to say that it's a tough job.  Not because of work load only, but the surrounding intangibles of working in organizations who probably are excited to pass off security can be draining. I've got news for you, the Cavalry is NOT Coming.  You are on your own. For those of you listening to this maybe not grasping the challenge, let me propose an analogy.  We’ve all been out to dinner at a restaurant. Let’s say being a CISO is like being the chef of the restaurant. In this analogy the chef is accountable for your meal, but not responsible for preparing it or delivering it.  The chef has a partial budget, and needs to convince other kitchen staff to pool their budget to buy the food needed to serve the menu.  The kitchen staff, however, also have other department chefs they work for that diverts their attention.  To make matters more complicated, the kitchen is consistently invaded by rodents and kitchen hygiene is hard to keep up with. Our chef also has limited say as to the quality of food prepared, presentation of the food, and delivery of the food. Now, if you went to a restaurant and knew your chef had limited budget, they chef was not directly responsible for the kitchen staff, the kitchen staff also served other department chefs (so they have limited attention to your meal), the chef had no say on how your food was plated or served, and the kitchen was occasionally raided by rats, how good do you think your meal would be?

Show Notes: https://justinfimlaid.com/soc2-report-quickstart/ Sponsor: https://www.nuharborsecurity.com Contact Me: https://justinfimlaid.com/contact-me/ Twitter: @justinfimlaid LinkedIn: https://www.linkedin.com/in/jfimlaid/ Looking for information on SOC2, read more here: https://www.nuharborsecurity.com/do-i-need-a-soc2-report/

Show Notes: https://justinfimlaid.com/not-invented-here-syndrome-for-security Sponsor: https://www.nuharborsecurity.com Contact Me: https://justinfimlaid.com/contact-me/ Twitter: @justinfimlaid LinkedIn: https://www.linkedin.com/in/jfimlaid/ Have you ever had an idea to advance your company or another companies security posture?  And it's a really good idea.  Like really good.  You do you your homework and dot the "I's" and cross the "T's" and your propose a superior solution that sets your organization up for, what you think, is long term success?  When you propose your idea, someone passionately proposes an alternative weaker solution.  Or worse, people take shots at your idea trying to make it look like swiss cheese for the apparent purpose of making an alternate idea better? If yes, you might have seen and experienced the "Not Invented Here Syndrome". One of the more concise definitions of Not Invented Here Syndrome (NIHS) I've heard come from Techopedia: "Not invented here syndrome is a mindset or corporate culture that favors internally-developed products over externally-developed products, even when the external solution is superior. NIHS is frequently used in the context of software development, where a programmer will overlook all the attributes of an existing solution simply because it wasn't produced in-house." Another variant to NIHS is the micro variation comes when the security department or CISO is accountable for security but doesn't have responsibility for security.  So if you are security professional recommending products/solutions that are always "shot down" by those with budget authority there could be a few reasons and Not Invented Here might be the cause.  NIHS can take a couple forms (this list adapted from Techopedia): The other teams don't value the work of others.  They have pride in a negative way.They don't understand or unwilling to try to understand the benefits and lack confidence.Fear that their previous ideas aren't valued.Territorial battles, e.g. internal "turf wars".Fear of having to learn something new.Wanting to control the process.  Would rather "reinvent the wheel" to maintain control.Jealousy that they didn't think of the idea first.Belief that they can do a better job.The other teams don't value the work of others and believe they can do better.  They have pride in a positive way. There's always the counter argument that the Security team always makes sub-tier recommendations and IT rather keeps the proverbial security train on the tracks. Anyway, NIHS is a real thing and can really be barrier to completing an annual plan.  For organizations that don't foster innovation NIHS can really be present in the way the company operates day to day.  There's some great articles on Not Invented Here and how some of the worlds longest standing companies foster innovation and work with external ideas to make their business grow. Some interesting links you might check out... https://hbswk.hbs.edu/item/the-benefits-of-not-invented-here https://www.forbes.com/sites/haroldsirkin/2017/03/09/not-invented-here-not-at-the-most-innovative-companies/#1d85172c1e35

Show Notes: https://www.nuharborsecurity.com/red-teaming-vs-penetration-testing/ Sponsor: https://www.nuharborsecurity.com Contact Me: https://justinfimlaid.com/contact-me/ Twitter: @justinfimlaid LinkedIn: https://www.linkedin.com/in/jfimlaid/

Show Notes: https://justinfimlaid.com/without-wax:-the-quest-for-perfection/ Sponsor: https://www.nuharborsecurity.com Contact Me: https://justinfimlaid.com/contact-me/ Twitter: @justinfimlaid LinkedIn: https://www.linkedin.com/in/jfimlaid/ I had an English Teacher in  High School that was big on Etymology.  If you aren't familiar with Etymology, its history of how certain words came to be. What I like about Etymology is the stories behind certain words.  This teacher was one the few teachers I actually liked in High School, and I hated English classes so I guess that says a lot.  One word, and one his lessons has always stuck with me.  That word in Sincere.  Sincere is from the Latin words Sin Cera.  In Latin Sin is “without” and Cera is “wax”. The story of Sin Cera dates back to ancient Roman times.  The artistry from that time period was seen in statues and ornate marble pillars.  What was significant about that time period is that artists were appreciated for their perfection.  An apprentice could work for most of their life in a specific craft, trade, or artistry…they’d only do that one thing.  An apprentice might spend years learning how to pick the right type of marble, or they'd spend years learning how to carve a specific type of statue, or spend years learning how to polish a statue.  The best artists were PERFECT. Whats interesting about the best artists from Roman Times and the ones that sculpted Marble is that they embodied perfection in their craft.  They would carve perfect sculptures or perfect marble pillars.  For All the other artists trying to make a name for themselves, who cut corners in their trade and lacked experience used wax to cover their mistakes.  They would use wax to fill holes, cracks and mistakes.  The nice thing about wax is it could be smoothed and polished to look like marble.  It could be plastered over and it could be painted over.  For most buyers they could not determine which was artificial Sin Cera or with out wax.  And in some cases they’d never know until the artist was long gone.  Today when we say we are Sincere, it generally means we’re honest.  But origins of Sincere also means you are without wax and perfect in your craft. The reason I bring this up, it seems to be relevant as of late.  I see more folks and companies trying to capitalize on the Security market.  I understand the push, it’s capitalism in full-swing.  However, I see folks working in the security space who are really confused and are granted trust because of a title, position, or certification.  If you are in Security as a buyer or supplier, whether inside your own company or a third party…and you claim to do security, you need to actually do it.  Let me clarify what I mean by that. What I mean by that is you have an obligation to continuously learn because the threat landscape is constantly shifting.  I realize every subject matter expert started with 0 experience.  But what makes someone sincere in their craft isn’t the fact they have a job in the field, it’s the fact they’re a student of the craft and continually strive to be perfect.  This means always learning and helping others bridge the security knowledge gap. This means you can’t just dabble in security, it’s not a bullet item on a website or on a resume.  We can do this, but we all have to put in the work and make everyone better. We have an obligation to get this right, if not for us then for the future generation so they have a solid foundation to make things better.

Show Notes: https://justinfimlaid.com/quickstart-building-a-security-program-with-the-nist-cybersecurity-framework/h Sponsor: https://www.nuharborsecurity.com Contact Me: https://justinfimlaid.com/contact-me/ Twitter: @justinfimlaid LinkedIn: https://www.linkedin.com/in/jfimlaid/ Hey Everyone - I'm starting to feel a little bad that the Government has been shutdown for so long.  I've hit the NIST site at least 10-15 over the last couple weeks looking for a reference only to be met by a we're closed frowny face.  Anyway - as soon as I recorded this the government opened up…figures.   By the time this goes live NIST will be open again.  If you're looking to build or enhance your security program.  The NIST Cybersecurity Framework might be a good place to start. I see a lot of companies looking to build their security or compliance programs around PCI-DSS, HIPAA, or FFIEC guidance to name a few.  It's good guidance but these regulations fail to recognize an organized security capability.  Meaning - there's no categorization that exists that says if you do these group of security tasks you'll be better protected, or if you focus on these groups of tasks you'll be better positioned to recover from a cyber event. The NIST Cybersecurity framework is organized exactly that way.  In absence of any regulation or compliance requirement this framework might provide a nice step into budget conversations or even establishing a common way to talk about cybersecurity within your organization or institution. To read more about the NIST Cybersecurity Framework, check out my post at NuHarbor Security.