14 Sep
Cybersecurity – Do You Think You’re Really That Secure?


NEW PODCAST EPISODE

Cybersecurity – Do You Think You’re Really That Secure?

In this episode, Jennifer talks with Albert Whale from IT Security Solutions about cybersecurity and Albert shares some really scary information about security and how we may feel we’re safe but the hackers are out there watching and waiting for us to do something stupid.

Listen in as Albert goes through some of the best ways to avoid running into a problem and what you can do RIGHT NOW to keep yourself from being a victim. Albert has also graciously offered a free eBook, “The TOP 10 Things to Improve your Cybersecurity” (a value of $97) when you go to https://its-safe.it-security-solutions.com/podcast

About Albert: Mr. Whale has 30+ years of experience with Reducing the Risk for Business and Asset owners, minimizing their Liabilities and Overall risk. Mr. Whale is well experienced in the techniques that the Hackers are employing, enabling them to exploit their victims. While some organizations will work on everything, Mr. Whale develops a comprehensive plan to identify the Probabilities that Risks have and eliminate the Liabilities for the business. Mr. Whale is an Author, Public Speaker, and is frequently interviewed about security issues Internationally.

25 May
You are not alone!

You are not alone!

99% of all networks have already been breached.

by Albert E. Whale, CEH CHS CISA CISSP
Founder & CEO

A shift in the security paradigm needs to address the Unseen attacks in the environment. Detecting the Unseen activities in the environment explains why there are so many attacks being reported on a daily basis.  This includes the recent Colonial Pipeline, Solarwinds and so many other breaches.

The unseen attacks depend on the ability of the attackers to hide in plain sight.  We will outline several of them here to uncover the unseen activities within almost every network[1].  Here is a look at the use of today’s People, Process and Technology (PPT). 

As you can see from the chart below, today’s tools are only looking forward, to the next attack.  They are focused on the next attack because they can only detect Malware which has been previously defined and observed.  The security methods employed include security scans (assessments), the deployment of security tools, and compared with our ITS SafeTM security appliance.  It should be clear why ITS Safe maintains better coverage to protect your organization.

Figure 1- Scope of Security Testing

Security Assessments (review of security for a host, a network, software or other asset) are only valid up to the time the report is generated.  As soon as the observer generates the report, the Assessment of the environment ends, and it becomes stale[2].  This is a point in time observation.

Today’s Security Tools look for tomorrow’s attacks. Tools that security researchers and network testing teams all use to assess the activities inside the network are based on testing for Known threats[3], and how the environment will respond to the next attack.  These tools test the environment for detecting known threats[4] on potentially new attacks.

The ITS SafeTMsecurity appliance is designed to Detect, Defend against, and Destroy IntrudersTM, or MD3. While other tools and testing activities look for the future state of security in the organization, ITS Safe examines all activities to uncover and detect unwanted connections that were completed before you began the observation of environment[5].

Everyday around the world, new activities are discovered in new and existing equipment, software, and third parties to organizations.  Firewalls are breached[6], Vendors we use are hacked[7], software we create is breached[8] and app we use on our phones are backdoors for attackers as well[9]

The problem is that today’s tools only identify what other people have found.  After the attackers succeed at penetrating an environment, do you think that they would keep the tools that they used in place, so that they could be identified after the Zero Day threats become known threats?  Of course not!  After they have given themselves sufficient access to survive a reboot, they have cleared their tracks.

A comprehensive review of the cyber security digs deeper than reviewing the exposed 10-20% of the network, and actually reviews the active network as a comprehensive ecosystem.  If you compare the use of today’s tools to examining only the tip of the iceberg, then you will begin to understand why they are ineffective at discovering the unseen.

Can you expect to detect the unseen activities using tools which only scratch the surface?

Like an Iceberg, the visible part is tested, and the 90% below the waterline is unobserved.

—–

Visible Network structure (Static View)

—–

Invisible Operation of the network, and how it responds with people using it.  (Dynamic view)

IT Security Solutions recommends at least an annual Security assessment to determine the security posture and formal detection of internal activities. While this is the minimum recommendation, even doing the Minimum does not detect the activities as well as out continuous monitoring solutions for our clients.

IT Security Solutions, Inc. is a Pittsburgh based technology company with 25+ years of cyber security domain expertise catering to businesses of all sizes. The solutions offered range from technology security audits and penetration testing to continuous network scanning. The company recently launched ITS Safe™, a proprietary managed security solution that blocks hackers from attacking networks – the largest IT security threat facing businesses today.

Contact IT Security Solutions to discuss how a paradigm shift will benefit your company today.

www.IT-Security-Solutions.com w www.ITS-Safe.com

412-889-6870 – info@IT-Security-Solutions.com


[1] Every network we have examined include several of these activities, if not all of them.

[2] The Security Assessment becomes stale because the users in the network add additional threats from their use of the environment.

[3] Known threats are used in Virus scanners, network scanning, software analysis, and logfile monitoring tools.

[4] Security Tools cannot test for unknown threats because these events are currently not known.

[5] Think of this as reviewing the activities that are already active, that are not detected as tomorrow’s threats, because they are considered as part of the current environment.

[6] https://www.zdnet.com/article/sonicwall-says-it-was-hacked-using-zero-days-in-its-own-products/

[7] https://www.wired.com/story/solarwinds-hack-china-usda/

[8] https://www.nytimes.com/2021/01/06/us/politics/russia-cyber-hack.html

[9] https://www.helpnetsecurity.com/2020/03/06/hackers-target-consumers/

10 May
Ransomware is costing Millions of dollars per day.

Ransomware is costing Millions of dollars per day.

Written by 

Albert E. Whale, CEH CHS CISA CISSP BSEE
May 9, 2021

Ransomware is costing Millions of dollars per day. Maybe you think that I’m exaggerating, I’m not. The cost in the Healthcare industry alone in 2020 was over $21 Billion, that’s only in Healthcare.  What happens to your business after the Ransomware breach?  Your costs go up, people lose their jobs, and your clients seek other businesses to deal with, right?

Recently ‘Hackers Exploit SonicWall Zero-Day Bug in FiveHands Ransomware Attacks’


You’ve probably seen Disaster Girl before, haven’t you?

IT Security Solutions has reported issues with many different Routers, Wireless Access Points, and other devices inside the networks.  This is the big problem because traditional tools are unable to discover the Built in Malware, the Configurations deployed, or any number of other factors.  

What are you doing to protect your business environment?  If your plan is the Legacy Firewall or Virus Scanners on the end points, then you are only looking for tomorrow’s attack.  

What happened yesterday?  Did you or your staff report issues inside the environment which may be the start to Ransomware?  I’m guessing, probably not.  Please don’t expect the SIEM that you invested in to identify the security issues either.  These devices are typically programmed from internal teams, and they don’t have 100% coverage on the logfiles they are reviewing.  

At best, they can tell you about the activities which already occurred, they stopped nothing.  Is that the plan?  Review the logs to determine what could have happened?  In the meantime, the average breach costs approximately $4 Million dollars, takes MONTHS to identify and 6 to 18 months to fix.  Can your business hold its breath for that long?  Can our Country hold its breath?

Recently the Colonial Pipeline breach force the shutdown of country’s Oil, Gas & Diesel distribution network.  

Cyberattacks Against U.S. Infrastructure Are ‘Here To Stay’ After 100-Gigabyte Colonial Pipeline Hack, Biden Official Warns – forbes.com

I’ll bet you thought that your backups would protect your business.

No Timeline for Massive Oil Pipeline Restart Has Traders Worried – Bloomberg.com

Hot Backups are not the answer.  If they were, Ransomware would not be as effective as it already is.  These issues outline serious cybersecurity matters in our businesses and our National Critical Infrastructure.  If we continue to the same thing over and over again, we will continue to have the same results.


Insanity, doing the same thing over and over again and expecting different results. – Albert Einstein

If your business hasn’t changed the strategy for your organization, we can help.  Today can be the first day, for your organization’s stability.  Let us have a conversation together and develop the strategy that will work for you.

IT Security Solutions recommends at least an annual Security assessment to determine the security posture and formal detection of internal activities.  While this is the minimum recommendation, even doing the Minimum does not detect the activities as well as out continuous monitoring solutions for our clients.

IT Security Solutions, Inc. is a Pittsburgh based technology company with 25+ years of cyber security domain expertise catering to businesses of all sizes. The solutions offered range from technology security audits and penetration testing to continuous network scanning. The company recently launched ITS Safe™, a proprietary managed security solution that blocks hackers from attacking networks – the largest IT security threat facing businesses today.

Contact IT Security Solutions to discuss how a paradigm shift will benefit your company today.

www.IT-Security-Solutions.com  www.ITS-Safe.com

412-889-6870  

info@IT-Security-Solutions.com

14 Feb
5 Reasons that your Business is at Serious Risk

What you may have inside your Businesses

Here are just a few of the situations IT Security Solutions has encountered when performing an assessment.

All of the comments are focused on organizations with more than 2 computers in their network, a Firewall and Virus protection on each computer.  If this describes your organization, then your business could be at serious risk

  1. If your organization has ever had a Virus or Malware in your computer or personal device.  Today’s intruders deliver more than one piece of malware.  In fact each piece of malware also includes the ability to scan your network, and find how many other computers, printers and other devices there as well. 

    Also, the malware only resides on your computer as long as it’s needed to update the computer to include a backdoor for the attackers to return.  That means that the chance for a Virus scanner to see the malware on the computer is seriously limited.

    More than likely, the Malware succeeds in the attack of your computer, and you will not ever know that your computer was effected, until it’s too late.
  • If your office has an internet connection which is used for business activities during the day, what else is permitted?

    This about the activities on Social networks like Facebook, Instagram, Snap Chat, here is a list of 65+ Social Networking Sites –

    https://makeawebsitehub.com/social-media-sites/

Attackers exploit the distribution of Social Media channels to connect and control tens of thousands daily. To the intruders, this is like shooting fish in a barrel.

  • If your organization uses a generous work policy, that includes any of the following.  Remote Access, Remote Offices, Laptops which are permitted outside of the office, remote workers.

    Each of these are issues which require additional care and security needs.  All of them introduce their own threats into your environment.

The above was written before the Pandemic put all of us in a Work from Home effort.  

Before Pandemic    
Business Security During the Pandemic    

Before the Pandemic, there was a definite definition of security protecting the organization. This was how the security of the organization looked. However, the security of organizations evaporated during the Pandemic, see the figure just below.

Even the VPNs that connect back to the Office, bypass the firewall and are permitted directly.  Think about the security at your employees’ homes.  Is there any wonder why the attacks are concentrating now at home?

VPN Connections proceed past the firewall.

 

The part that is missing above is the lack of screening from employees and the use of VPNs.  The VPN is intended to Mask the communications from one endpoint to the other while connecting over the Internet. VPNs do not protect the connection or the business. The Firewalls permit the VPNs to connect internally and do not filter any information. You may expect that the VPN protects your business, but this is not the case.

The VPN permits direct communications to the office and repeats the same situation that was exposed during the Target breach.  The Target breach permitted the infected computer of the HVAC Vendor to get access to the entire network, and the credit card information.  That was a recipe for disaster.

  • Does your organization permit personal devices to connect to your network, or have business email on them?  (this could be considered two different issues)

    Give this a moment to sink in.  On your personal devices (iPhones, Tablets …), where are the Firewalls or Virus Scanners?  You should realize that these devices do not have one unless you have installed something yourself.  Even if the device has a firewall or scanner on it, what level of protection do you expect that this provides?

  • How long ago was your last Security/Risk Assessment?  These activities are recommended at least annually, and normally within 30 days of making a change to the network.

    The important thing to remember here is that the Security Assessment is performed by certified individuals that are interested in protecting your business.  Ultimately you can choose not to perform the assessment, in which case the intruders will be performing the assessment, and they are constantly doing that. 

    When the Intruders perform the assessment, you won’t be told the results of the assessment.  You may not be aware of what they have discovered until they want you to.  That’s right, they don’t need to let you know, and you may not know just how much of the company that they have accessed.  Your current tools are not able to detect the intrusion or stop it. 

    In fact, today’s security tools can only partially detect the next attack.  Firewalls and Virus Scanners are reported to be only 4% effective.

How many of the above items can you relate to?  Do you have the tools we describe above?  Do you want to prevent the attacks on your computers, or allow the Intruders to continue to have access to your environment?  (prevention is the cure).

Bonus

Your network has likely evolved beyond the initial PCs, and Printers.  Many networks have added WiFi, personal Devices, and many other Internet of Things (IoT) devices which have no protects either.

Our personal devices (cell phones, tablets) are never off of the Internet, and we insure that they have sufficient power at all times.  We are now so dependent on these devices, that we also allow Business Communications on them as well.

This presents the opportunity for attackers to engage in our want for information, as well as the convenience of connecting to everyone (including high value targets), to get the access and information that they are seeking.

The critical problem here is that you cannot stop, what you cannot see.  We have the tools and experience to highlight the unseen activities, and stop the attackers before they can succeed.

_______________________________________

IT Security Solutions, Inc. is a Pittsburgh based technology company with 25+ years of cyber security domain expertise catering to businesses of all sizes. The solutions offered range from technology security audits and penetration testing to continuous network scanning. The company recently launched ITS Safe™, a proprietary managed security solution that blocks hackers from attacking networks – the largest IT security threat facing businesses today.

Year after the year, the Pittsburgh business community recognizes IT Security Solutions, Inc. for their domain expertise and thought leadership in the cyber security space.

Contact IT Security Solutions to discuss how you will benefit by reviewing your security today.

www.IT-Security-Solutions.comwww.ITS-Safe.com

412-889-6870 – info@IT-Security-Solutions.com

07 Feb
Its time for a Paradigm Shift for cybersecurity

ITS Safe™ Security Appliance

Seeing the Unseen

A shift in the security paradigm needs to address the Unseen attacks in the environment. Detecting the Unseen activities in the environment explains why there are so many attacks being reported on a daily basis.  The unseen attacks depend on the ability of the attackers to hide in plain sight.  We will outline several of them here to uncover the unseen activities within almost every network[1].

Security tools and their visibility

Figure 1 – Scope of security Testing

The image above describes the current state of Security Tools, Techniques and Practices. While the traditional tools and techniques are all point in time application of practices, we can also classify them as reactionary practices as well. Let’s examine the methods outlined above.

Security Assessments (review of security for a host, a network, software or other asset) are only valid up to the time the report is generated.  As soon as the observer generates the report, the Assessment of the environment ends, and it becomes stale[2].  This is a point in time observation.

Today’s Security Tools look for tomorrow’s attacks. Tools that security researchers and network testing teams all use to assess the activities inside the network are based on testing for Known threats[1], and how the environment will respond to the next attack.  These tools test the environment for detecting known threats[2] on potentially new attacks.

The ITS SafeTMsecurity appliance is designed to Detect, Defend against, and Destroy IntrudersTM. While other tools and testing activities look for the future state of security in the organization, the ITS Safe appliance examines all activities to uncover and detect unwanted connections that were completed before you began the observation of environment[3].

Everyday around the world, new activities are discovered in new and existing equipment, software, and third parties to organizations.  Firewalls are breached[4], Vendors we use are hacked[5], software we create is breached[6] and app we use on our phones are backdoors for attackers as well[7].

A comprehensive review of the cyber security digs deeper than reviewing the exposed 10-20% of the network, and actually reviews the active network as a comprehensive ecosystem.

Figure 2 – The visible network is a static view of the environment

IT Security Solutions recommends at least an annual Security assessment to determine the security posture and formal detection of internal activities.

IT Security Solutions, Inc. is a Pittsburgh based technology company with 25+ years of cyber security domain expertise catering to businesses of all sizes. The solutions offered range from technology security audits and penetration testing to continuous network scanning. The company recently launched ITS Safe™, a proprietary managed security solution that blocks hackers from attacking networks – the largest IT security threat facing businesses today.

As you can see there is much more than meets the eye when it concerns the security within your network. Call IT Security Solutions today, and let us help you protect your organization today!

www.IT-Security-Solutions.comwww.ITS-Safe.com

412-889-6870

info@IT-Security-Solutions.com

https://its-safe.it-security-solutions.com/contact-me


[1] Known threats are used in Virus scanners, network scanning, software analysis, and logfile monitoring tools.

[2] Security Tools cannot test for unknown threats because these events are currently not known.

[3] Think of this as reviewing the activities that are already active, that are not detected as tomorrow’s threats, because they are considered as part of the current environment.

[4] https://www.zdnet.com/article/sonicwall-says-it-was-hacked-using-zero-days-in-its-own-products/

[5] https://www.wired.com/story/solarwinds-hack-china-usda/

[6] https://www.nytimes.com/2021/01/06/us/politics/russia-cyber-hack.html

[7] https://www.helpnetsecurity.com/2020/03/06/hackers-target-consumers/


[2] The Security Assessment becomes stale because the users in the network add additional threats from their use of the environment.


[1] Every network we have examined include several of these activities, if not all of them.

Sidebar: