26 May
SWAT Assessment for Cybersecurity

SWAT Assessment for Cybersecurity

by Albert E. Whale, CEH CHS CISA CISSP
Founder & CEO

Attacks are running full speed ahead

Static Testing reviews above the waterline
Figure 1 – Static Testing reviews above the waterline.

Everyday new attacks are reported in organizations of various sizes.  Some of the attacks are recent, most are attacks that occurred months earlier, and are just recently being discovered.  What makes these events so difficult to discover?  There are several reasons that these attacks are undiscovered.  Most of these are focused on existing People, Process and Technology (PPT).  Even though the intent is to secure the organization, there are several faults in utilizing the existing strategy.

What we have discovered, is that PPT Service offerings are exclusively focused on known attacks and threats.  This excludes the unknown activities, and the existing exploits that have been successful already.  There are other reasons why many tools do not identify, because they are focused on the Static Network[1]. This is great but misses opportunities which are present when the employees are using the network.

The static review essentially reviews the exposed tip of the iceberg.  This is only 10% of the iceberg, the other 90% of the environment is not reviewed.  This includes the use of Third Party Vendors and their Applications (think SolarWinds breach), active users (current attacks of the environment from the Internet), as well as attacks from personal devices[2]

Can you see now why Firewalls and Virus Scanners are not effective?

While the use of SIEMs improve coverage, they require the configuration of events.  SIEMs only discover the activities after the event has already occurred. Both the lack of configured events, and backlog of manual review lead to more activities going undiscovered.

With 90% of the environment not being reviewed, it’s clear why attacks are not detected for months later (if at all).

SWAT – Secret Weaknesses in Applications & Technology

Figure 2 – SWAT Analysis

The SWAT Analysis is our Proprietary assessment for businesses, which identifies the cyber secret faults which are left undetected by today’s security tools.  Think about it, all of the testing tools are focused upon the CWE and CWE rankings for information. Their detection is solely based on understanding what has already been detected.  That leaves a huge gap in understanding what is occurring within the environment. Our SWAT Analysis is based on several attack strategies, as well as the NIST Zero Trust Architecture. We take into account all of your current activities, including the Third Party Vendors, the activities of the Users, and the personal devices in your environment.  This is totally different than existing testing activities, and better yet, it fully automated to support your organization’s needs.

I want to get started with the SWAT Analysis – Please contact me

Taking it to the next level

Everyone thinks that they are secure until they are proven! There are so many hacks in the news lately, the Colonial Pipeline (Ransomware – $5M), US Insurer – CAN Financial (lost – $40 Million), Ubiquiti, Parler, Experian[1], Microsoft Build Engine[2] and Many more.


[1] I was recently interviewed by CSOnline.com – https://www.linkedin.com/posts/albertwhale_how-api-attacks-work-and-how-to-identify-activity-6801611480853807104-2JKr

[2] Hackers use Microsoft Build Engine to Deliver Malware Filelessly – https://thehackernews.com/2021/05/hackers-using-microsoft-build-engine-to.html

We are confident our SWAT Assessment will find activities.  Here is an assessment we performed on a WiFi Network.  

Figure 3 – Countries found inside the WiFi network

The point of the video is that the network was considered secure, before the SWAT Analysis.  The video shows that traffic of Laptops, Personal devices and other equipment on the WiFi have compromised activities during the review period.  With the amount of activity taking place, it appears that a significant amount of malicious activity exists in and out of the network. 

Everyone understands that there is no need for 46 countries to be active inside their network.  If you don’t know who is already inside, how can you develop a protection plan to support your business?

Tell me about ITS SafeTMset up a 10 minute call.

Seeing the activity inside

The SWAT Analysis examines the network traffic, the configuration of the devices, and assesses the security of the environment.  The SWAT analysis tests the use of the network with activity.  This analyzes the active devices, and their security as well.  In the case of WiFi we easily identified the infected devices that were connected to the environment and permitted to communicate with the organization.

The traffic we discovered did not trigger any sensors or activities with the security tools already in place.  This is further outlined in recent blog posts

Why do you need a SWAT Analysis?

Everyday new exploits are detected in the equipment we use which were not previously identified.  Additionally, more manufacturers are connecting back to their organizations from the equipment you are installing inside your networks.  Imagine the equipment inside your network offering a backdoor into your environment.  That includes connections inside and outside of the continental USA.  Every time we discover connections to outside locations, we are informed that they were not authorized, and also not identified.  Imagine the equipment that you have providing a back-door connection to China.  Is that what you wanted?

I developed the SWAT Analysis to uncover the activities which go undetected inside networks every day.  Some of these include:

  • Misconfigured security controls
  • Obsolete communication protocols
  • Deprecated encryption technology
  • Malware activity undetected in the network
  • Identify the origin of the breach
  • Abuse of existing Protocols
  • Use of protocols for other activities
  • Connecting to malicious DNS
  • Requesting your IP Address for access
  • Connecting to Malicious websites
  • Unauthorized backdoor connections to external sites

Just to name a few.  We look at how the Network reacts with activity from within.  This is totally a different perspective.

Next Steps

We have seen all Organizations at risk.  Mature organizations as well as new organizations have opportunities for malicious activities which are not normally discovered, until it is too late. Failure to detect the unwanted activities costs organizations Millions[5] at that time.

What can organizations do?

  • Backups will recover data to a certain extent,
    • but they will also include the problems which the tools you are using cannot see
  • Testing with the same tools will lead to the same results
  • Insurance does not fix the problem; in fact, it gives the organization a false sense of security
    • Insurance does not fix the security problem
    • Insurance does not pay to fix the security issues which caused the attack
  • Wait for the Breach to occur, and then pay the ransom
    • Fixing the problem may take from 6 to 18 months

SecOps

SecOps stands for Security Operations.  Security Operations sole purpose is to increase the operational security within an organization.  It does this by assuring that operational changes are implemented as soon as there is a change in the environment.  This completely trumps the Annual Scanning of the network, because operational changes are made almost every week, traditionally known as patch Tuesday.

If your organization is running Logfile analysis to see things that have already occurred, then you need our SWAT Analysis combined with the power of continuous monitoring to get ahead of the attackers.  Logfile analysis takes activities which have occurred within the network and recorded it.  This is a historical record of events that were successful[6].  With ITS Safe we can deploy the basis for Zero Trust in your environment and utilize the ability of Machine Speed to intercept and block malicious activities, BEFORE they can complete.

Let’s get started! –  Contact me

IT Security Solutions recommends at least an annual Security assessment to determine the security posture and formal detection of internal activities. While this is the minimum recommendation, even doing the Minimum does not detect the activities as well as our continuous monitoring solutions for our clients.

IT Security Solutions, Inc. is a Pittsburgh based technology company with 25+ years of cyber security domain expertise catering to businesses of all sizes. The solutions offered range from technology security audits and penetration testing to continuous network scanning. The company recently launched ITS Safe™, a proprietary managed security solution that blocks hackers from attacking networks – the largest IT security threat facing businesses today.

Contact IT Security Solutions to discuss how a SWAT Analysis will benefit your company today.

www.IT-Security-Solutions.com w www.ITS-Safe.com

412-889-6870 – info@IT-Security-Solutions.com

                 


[1] The Static Network is the network without any users active already.

[2] Personal devices normally have less security, and are either being used outside of the office, or connected to equipment in the office network (WiFi).

[3] I was recently interviewed by CSOnline.com – https://www.linkedin.com/posts/albertwhale_how-api-attacks-work-and-how-to-identify-activity-6801611480853807104-2JKr

[4] Hackers use Microsoft Build Engine to Deliver Malware Filelessly – https://thehackernews.com/2021/05/hackers-using-microsoft-build-engine-to.html

[5] In many cases the business closes from the weight of the breach, fines, ransom and loss of revenue.

[6] This is the reactive approach for cybersecurity, let it happen, then try to fix it.  Whereas, ITS Safe takes a proactive approach to blocking the unwanted activity, and not permitting it to occur.

07 Feb
Its time for a Paradigm Shift for cybersecurity

ITS Safe™ Security Appliance

Seeing the Unseen

A shift in the security paradigm needs to address the Unseen attacks in the environment. Detecting the Unseen activities in the environment explains why there are so many attacks being reported on a daily basis.  The unseen attacks depend on the ability of the attackers to hide in plain sight.  We will outline several of them here to uncover the unseen activities within almost every network[1].

Security tools and their visibility

Figure 1 – Scope of security Testing

The image above describes the current state of Security Tools, Techniques and Practices. While the traditional tools and techniques are all point in time application of practices, we can also classify them as reactionary practices as well. Let’s examine the methods outlined above.

Security Assessments (review of security for a host, a network, software or other asset) are only valid up to the time the report is generated.  As soon as the observer generates the report, the Assessment of the environment ends, and it becomes stale[2].  This is a point in time observation.

Today’s Security Tools look for tomorrow’s attacks. Tools that security researchers and network testing teams all use to assess the activities inside the network are based on testing for Known threats[1], and how the environment will respond to the next attack.  These tools test the environment for detecting known threats[2] on potentially new attacks.

The ITS SafeTMsecurity appliance is designed to Detect, Defend against, and Destroy IntrudersTM. While other tools and testing activities look for the future state of security in the organization, the ITS Safe appliance examines all activities to uncover and detect unwanted connections that were completed before you began the observation of environment[3].

Everyday around the world, new activities are discovered in new and existing equipment, software, and third parties to organizations.  Firewalls are breached[4], Vendors we use are hacked[5], software we create is breached[6] and app we use on our phones are backdoors for attackers as well[7].

A comprehensive review of the cyber security digs deeper than reviewing the exposed 10-20% of the network, and actually reviews the active network as a comprehensive ecosystem.

Figure 2 – The visible network is a static view of the environment

IT Security Solutions recommends at least an annual Security assessment to determine the security posture and formal detection of internal activities.

IT Security Solutions, Inc. is a Pittsburgh based technology company with 25+ years of cyber security domain expertise catering to businesses of all sizes. The solutions offered range from technology security audits and penetration testing to continuous network scanning. The company recently launched ITS Safe™, a proprietary managed security solution that blocks hackers from attacking networks – the largest IT security threat facing businesses today.

As you can see there is much more than meets the eye when it concerns the security within your network. Call IT Security Solutions today, and let us help you protect your organization today!

www.IT-Security-Solutions.comwww.ITS-Safe.com

412-889-6870

info@IT-Security-Solutions.com

https://its-safe.it-security-solutions.com/contact-me


[1] Known threats are used in Virus scanners, network scanning, software analysis, and logfile monitoring tools.

[2] Security Tools cannot test for unknown threats because these events are currently not known.

[3] Think of this as reviewing the activities that are already active, that are not detected as tomorrow’s threats, because they are considered as part of the current environment.

[4] https://www.zdnet.com/article/sonicwall-says-it-was-hacked-using-zero-days-in-its-own-products/

[5] https://www.wired.com/story/solarwinds-hack-china-usda/

[6] https://www.nytimes.com/2021/01/06/us/politics/russia-cyber-hack.html

[7] https://www.helpnetsecurity.com/2020/03/06/hackers-target-consumers/


[2] The Security Assessment becomes stale because the users in the network add additional threats from their use of the environment.


[1] Every network we have examined include several of these activities, if not all of them.

15 Dec
Can you TRUST your vendors?

The FireEye and Solarwinds breach.

I was drinking my coffee this morning and I read that FireEye was Breached.  What?  I read that a second time.  This time I also found out that their testing tools were also stolen.  This is bad, I thought, because FireEye is used in many industries, but to suffer a Breach and lose your testing tools will certainly compromise their reputation.

How did this happen?

According to FireEye’s website, this came as part of a Global Campaign[1]. More importantly, they are indicating that users of the SolarWinds Orion network monitoring product was the source of the Breach.

The issue here is that they gained access to the internal resources and utilized these resources internally to hide and disguise their activity. They indicated that these activities occurred earlier this year, sometime in the Spring of 2020.

When was the last time your company had a formal security assessment?  How about an assessment for the software you use internally as well?  While you cannot be everywhere all at the same time, mandating security assessments for the vendor tools you use is a good way to delegate.   Don’t forget to have an assessment performed on the network, your design, and security policies and procedures.

Everyone thinks that they have it covered, until they don’t. It’s what they are missing that causes the Breach.

Everyone thinks that they have it covered, until they don’t. It’s what they are missing that causes the Breach.  While we understand that no one wants to be told that they missed something.  

Which is better

  • Finding a problem and fixing it before a Breach,
  • Announcing it to the world that you’ve had a Breach?

… the cost of a Breach is very costly usually $200k to $3.8M or more.  These are also known as Business ending events.

The cost of a Security Assessment is generally a fixed priced and is easily absorbed by the business.  However, the cost of a Breach is very costly ($200k to $3.8M or more), and it is shared by the business and all of its clients.


Security is our Business

There are many ways to effect change in the organizations.  The most beneficial are the ones that are driven from the top down.  While organizations were built to support the business internally, the advancement of the attackers to gain access to the internal resources has changed the way we need to work on Cybersecurity.

Here are a few quick hits that will move the needle for you more in your favor.

  • Make time for a Security Assessment as recommended
  • Develop your company’s Policies and Procedures
  • Employ a comprehensive monitoring appliance to maintain your company’s security.

As we have seen in the FireEye Breach and other Breaches, the attacks are from the inside – out.  Meaning that they were able to get past the Firewalls, and not get detected by Virus scanners or other current technologies. These tools are all based on their ability to identify new attempts with the current Known threats.  That leaves all of the previously successful Breaches, and attacks using unknown threats exposed.

The ITS SafeTM security appliance includes out of the box capabilities to start working right away.  ITS Safe is built to Detect, Defend against and Destroy Intruders.  We are shifting organizations from a traditional security approach to continual assurance.

By implementing ITS Safe, the detection of activities inside allows us to eliminate the threats that other tools miss entirely.  Get ITS Safe Today to keep your business safe.

Minimizing the threats of attacks on employees and businesses are the basis for the development of the ITS SafeTM Managed Security Appliance.  Because attacks can happen anytime, the ITS Safe appliance continually monitors activities inside the network for both Inbound and Outbound traffic.

Sign up today to get a complimentary consultation

https://its-safe.it-security-solutions.com/managed-security-service-for-your-organization

https://IT-Security-Solutions.com –   Contact me now

We are your trusted cyber security partner.

[1] A Global Campaign makes sense because they are all connected to the Internet, and that’s still a Global network, if my memory serves me right.

02 Feb
What is ITS Safe (TM) and why you should be considering it for your business.

Cyber Security conversation with Brad Stoller and Albert Whale

Many organizations are overwhelmed with today’s efforts to secure the organization.  Whether they are a small to mid-sized business, or a global organization.  Today in the US we are short more than 3.5 Million experienced Cyber Security professionals.

If we think of a Computer Virus as something similar to a virus that you can catch (like the flu), how effective are the tools you are using currently?  The typical organization using both Firewalls and Virus Scanners, has less than a 40% chance of discovering the infection.

The premise of the Virus Scanner is a reactive tool which is attempting to discover the initial infection, after the breach has already occurred.  These tools are used as a reactionary tool, and are less than 40% effective.  

The ITS SafeTM security appliance works differently, because we are reviewing the traffic BEFORE it reaches the end point destination.  That makes our ITS SafeTM appliance a differentiator, because we are being proactive, and stopping the malicious attacks before they reach your computing environment.

IT Security Solutions, Inc. is a cyber security organization which wants to improve and protect your organization with the latest tools and services for improving your organization’s security.  The first question we want to ask you, when was your last security assessment?  How often do you have an assessment performed?  Would you consider that Constant monitoring could benefit your organization?

Let’s start with a conversation today.  You can reach us at info@it-security-solutions.com or at 412-889-6870.

http://traffic.libsyn.com/ironcityriskavengers/ITS_Safe_Product_discussion..m4a

21 Jan
A positive change, with Albert Whale and Jim Loeffler – Episode 8

This is the second episode for 2019, and what we are focusing on today is focusing on the positive effects for your business.  Are you the Weakest link? How do the attackers are get past your Firewall and Virus Scanners.

Here are two reasons:

• Hackers have the same tools.

• They know how to evade them.

  •  

Using the Internet allows attackers to follow you inside the firewall.

Facebook

Redit

Yahoo

Hotmail

Gmail

Read More “A positive change, with Albert Whale and Jim Loeffler – Episode 8”
  • 1
  • 2
Sidebar: