Acquisition & Diversification Time for Cyber is Here

 Times are a changing, Bob Dylan said...

Look for acquisitions in this economic malaise, as well as entering new markets, to be the march of the Cyber/software orgs in the Fortune 1000....

More to come shortly...

GitOps, DevSecOps, & AppSec

 As GitHub & GitLeaks rollout additional functionality more orgs will rely upon those offerings for traditional one-off DevSecOps/AppSec solutions (SAST, SCA, IAST).

Furthermore, CSP (PaaS) offerings will certainly eat into on-prem/subscription models as well. 

So, expect consolidation/divestitures for AppSec tool vendors in the near future.    

Cyber Needs to Walk the Walk

 Cyber orgs need to embrace the same governance they advocate/demand for IT/Ops/Dev tms.  You have to do things right & hold yourself accountable...

Personal Loss & Professional Perservance in Cyber

My dad succumbed to COVID-19 a year ago today on 4/1/2020.  He had other health challenges; however, Coronavirus was his last great fight.  I lost my mom 10 months before him to cancer on 6/1/2019.  They were together for 50+ years....

My folks instilled in me both a work ethic & a sense of pride to persevere in hard times, as well as how to make the most out of this life.  I miss them, very much...

As a Cyber professional, I feel that sometimes our work may be both unforgiving and thankless; but it is our chosen profession, and speaking for myself, our calling.  While people may not always understand our actions/reasoning; ultimately, if your heart & head are in the right place, they will give you the benefit of the doubt.

So keep fighting the good fight, for we are doing good....

 

Third-party Governance for DevSecOps

For orgs that rely heavily upon outsourced development/technical resources (IT Outsourcing: ITO), it's important to ensure that contracts include covenants for the vendor to provide cyber (security) education, training & awareness (SETA).

Furthermore, a right to audit clause should be included as well that allows for the client to review SETA content, as well as attendance & scoring.    

Why are big data tools so darn expensive...?

 As we build out our web endpoint security scorecard (WESSy) I am in awe of the price points I see for data tools.

I get that these are enterprise-level tools; however, for smaller shops (like mine) that need this functionality it comes off as cost prohibitive.  

Crypto(graphy) will Change - Drastically, I dont know...

With the SolarWinds Cyber event, Quantum Computing, & advances in Artificial Intelligence (AI) all in mind, cryptography will evolve in the 2020's.  To what degree, I don't know.

Geopolitical events & circumstances, IMHO, will be a key factor.

As events unfold, the international community will have to determine, with the private sector contributing, where we go from here.

You need a Cyber strategy

 https://devops.com/the-best-iam-practices-for-devops/

Most orgs fail to have an internal IAM policy, a partner IAM strategy (B2B), as well as a customer (B2C) strategy.  Due to that, the orgs is all over the place.

Furthermore, the article discusses unstructured data (cloud storage) that is often an issue for orgs as the lack of a strategy leads to a lack of data governance (classification, access controls, etc).  

SolarWinds breach will drive enhanced transparency & tracking mechanisms

https://threatpost.com/cloud-king-software-security-trends-2021/162442/

This article touches upon the need to have better tracking mechanisms between product teams, divisions, lines of business, & supply chains.  Couple this need with the Cybersecurity Maturity Model Certification (CMMC), & a dip in the US economy, & executives will want better tracking mechanisms to identify return on investment (ROI).

We're working on an AppSec/DevSecOps answer to this equation. 

https://www.csoonline.com/article/3535797/the-cybersecurity-maturity-model-certification-explained-what-defense-contractors-need-to-know.html

Securing Event-Driven Architecture (EDA)

 While reading this enumeration of EDA software patterns I had to think of the need for available Cyber reference architectures (RAs) and minimum security baselines (MSBs) to complement misuse test cases, especially for logic.

With cloud-native and FaaS gaining ground, as well as no/low code, Cyber will need to collaborate even closer with QA to determine any confidentiality, integrity &/or availability (CIA) issues. 

Assessing/Threat Modeling No/Low Code Applications

I'll always remember looking at a 4GL (fourth generation language) telecom app in late 2012 at an insurance company.  It was used to route, via prompts, the caller to the right service desk.

So, I embarked on an informal security assessment/threat model by handwriting on my notepad "sources | sinks" then enumerating my perceived/observed of each.  After that we walked through the business logic, error/exception handling & misuse cases.  It was not the most thorough affair, but it was a value-add to the Cyber folks.

As the industry embraces more no/low code solutions (Power Apps, Honeycode, AppSheet) it behooves Cyber professionals to use a methodology to assess these solutions.  Here's a take on such a methodology that I'll pronounce DASL:

D for Data: classification/sensitivity/compliance requirements/retention

A for Application: underlying platform (Cloud Service Provider: CSP) & security/risk/SRE/DR posture

S for Sources/Sinks: ecosystem/supply chain

L for Logic: ruleset, QA testing, misuse cases      

Discipline = Focus on Minimum Viable Product (MVP)

While orgs want to deploy a finished product immediately, that isn't practical.  From a Cyber, as well as Ops perspective, it's better to incrementally develop & deploy a solution.

Edison didn't succeed overnight; so, why should enterprises....

Separation of Duties for DevOps

Continuous integration / delivery / deployment / verification (CI/CD/CV) all need to be segmented in org's processes.  

While this may be more difficult for on-premise deployments (Jenkins / Bamboo), most cloud PaaS offerings make this easier, especially AWS with their Code* portfolio (CodePipeline / CodeBuild / CodeDeploy).

 

Cloud-Native Threat Modeling & Alignment with Design Patterns

 https://techbeacon.com/enterprise-it/7-container-design-patterns-you-need-know

When performing a threat model for cloud-native environments I advocate for a comparison to the design patterns articulated above, especially how security-centric services are deployed.  To execute on segregation of duties one must abide by said best practices.

Add D(ata) to 4C's of Cloud Native Security for Completeness

https://kubernetes.io/docs/concepts/security/overview/

The 4C's described above do not explicitly include securing the data.  Orgs need to secure their data (crytpo, masking) before it goes to the cloud, onsite, or otherwise...

Cyber Snake Oil

While some Cyber solutions certainly deliver as promised, there is a multitude of solutions that seem to be wanting.

Namely, cloud security posture management (CSPM) and secure access service edge (SASE) solutions.

Akin to first-generation web application firewalls (WAFs), CSPM and SASE solutions seem to promise a lot while skeptically delivering value.  Like WAFs, I believe organizations will see these as a tool in the Cyber toolbox that can COMPLIMENT solid hygiene versus SUPPLEMENT said governance. 

Control Frameworks - Use a Hybrid

Many orgs use a control framework (NIST 800-53, HITRUST CSF, COBIT, SIG, ISF SoGP, ISO 27002, CSA CCM) that doesnt completely express that orgs security/privacy/risk mgmt posture.

It behooves those orgs to use a hybrid mapped back to those frameworks.    

Risk Management for Vendor Ecosystem

Many orgs focus too long on assessing the risk before deciding to onboard a vendor.

Multiple control frameworks (COBIT, ISF, ISO, NIST, HITRUST) include hundreds of questions that are often redundant.

Furthermore, these assessments couple the vendor governance witht the actual solution.  Hence, orgs spending weeks on evaluating each vendor.

The solution here is a laser-focused framework that includes a base for the vendor, along with specific questions for the solution.  I would also advocate for a vulnerability scan of the solution by the specific org doing the assessment. 

Vendor (Security) Reviews are not Solution Security Reviews

 A vendor's (security/privacy) holistic governance is not the same as the security/privacy posture of the solution a larger organization is looking to procure.

The reality is that many startups/SMBs have solutions that are (considerably) different, from a cyber perspective, then their general posture.  Many (startup/SMB solutions) are based/hosted with cloud service providers (CSPs), and.therefore, require a separate level of review.

Third-party risk management (TPRM) processes and teams are prevalent in corporate organizations; however, experience shows a generic coupling of the solution with the vendor that seems inadequate.

So, it is advocated that larger organizations focus on high-level governance for the vendor-at-large, coupled with low-level verification of the solution at hand. 

How is this accomplished?  Well, focus on control frameworks (NIST, ISO, SIG, HITRUST, ISF, COBIT) for the vendor, coupled with specific deep-dives on the solution at large.  Deep-dives should include recent vulnerability scans/penetration tests/risk assessments of the specific solution from an objective third-party, with a control mapping of said solution back to organizational governance, as well as benchmarks against CSP well-architected frameworks (that are prevalent these days). 

 

Dont Replicate Your Data Center Setup in the Cloud

 A multitude of corporate IT/Cyber departments attempt to replicate their network architecture in the cloud.  Unfortunately, that is not the way to go regarding cloud transformation.  When organizations use the cloud it makes the most sense to leverage native solutions as much as possible.

While trusting cloud service providers (CSP) completely is not prudent, many CSPs have matured their services, especially security-centric solutions.  With that said, if there are any doubts/concerns, the most pragmatic choice is to leverage enterprise data protection solutions before data is migrated to the cloud.  Said solution could negate concerns about a CSP's data handling procedures.