Strength – Ability – Discipline

New Evidence Suggests SolarWinds’ Codebase Was Hacked to Inject Backdoor

As a Cyber Security professional for over 25 years I’ve seen a lot over the years. One thing that stands out is the hack of CCLeaner in 2017. Which appears now to have some similarities to the SolarWinds compromise. The result of the CCLeaner compromise has had lasting effects. Anyone who participates in CyberPatriot knows, CCLeaner is one of the first things to be removed from an image as it’s assumed to be compromised.

With this new evidence, will SolarWinds become the next security tool that’s considered more of a risk to run it than to not?
Source

Reflection on Risk Management Framework Security Controls Assessment

I’m sitting here in the airport after finishing a 1 week Risk Management Framework (RMF) Security Controls Assessment (SCA) and reflecting on the week. This week the team and I reviewed nearly 30 hosts and over 3000 individual controls. I remember throughout the week there were many times thinking “this is pretty basic stuff, why aren’t they (the client) following the security guidance?.” and I remember that to many system administrators security isn’t “baked in” like we’ve always claimed it should be. It also underscores the need to get more Information Technology (IT) professionals trained in cyber security. That’s why Cyber Centurion is proud to sponsor Civil Air Patrol NC-162 Squadron’s first CyberPatriot Team.

CyberPatriot is the National Youth Cyber Education Program created by the Air Force Association to inspire K-12 students toward careers in cybersecurity or other science, technology, engineering, and mathematics (STEM) disciplines critical to our nation’s future. At the core of the program is the National Youth Cyber Defense Competition, the nation’s largest cyber defense competition that puts high school and middle school students in charge of securing virtual networks.

The cadets on our team, who range in age from 13-16, began practice in April with basic computer skills and cyber hygiene concepts. Over the past several months they’ve progressed through the basic materials absorbing the information at an incredible pace. For many, this is their first exposure to managing operating systems and advanced concepts of computer security. They are excited to begin their first scored round and put their knowledge to the test.

Throughout the week, there were many times that I thought: “Gee, I wish ‘R’ was here. He could do this in his sleep” or “Wow ‘E’ would have known what to make this setting” or “I wish ‘A’ was here to explain why the system needs to be configured this way”. I highlight these examples because the cadets in this program have in most cases at least 7 years before they’re in the workforce. Regardless of what they do in their careers, many will stay close to technology and one thing I am sure of; with these cadets I know security will be baked into whatever they do!

The competition round begins this coming weekend, October 25-27, 2019. If you are so inclined, check out the Cyber Patriot website (www.uscyberpatriot.org) or your local Civil Air Patrol (https://www.gocivilairpatrol.com/) both are great organizations for engaging our youth in Cyber Security and Aerospace Engineering. If you don’t have a local team or squadron, reach out to me, most of the cyber security training I do with our cadets is virtual and I’m always looking for help!

Diversity Focus at RSA

At RSA this year there was a big focus on diversity in the workforce. There were many sessions about how to increase women and minorities in the workforce. I attended most with hopes of gaining insights on not only how to hire these demographics but ALL demographics. In my last session of the week, one of the panelists said what I’ve been thinking all week. “I’m lucky to get 2 resumes to choose from, diversity never enters my mind. I’m focused on what’s between the eyes and back of the head!”

Depending on which website you read (and when) the shortage of cyber professionals is somewhere between 500K and 3.5 million. That means that Cyber security is one of the few professions today with 0% unemployment. According to investopia.com “In 2016, there were 1 million job openings, with two openings for every available job candidate. The rapid job growth is expected to reach 1.5 million positions by 2019.” From other research, I expect we will exceed that 1.5 million and by 2021 be closer to 3.5 million.

As of 2017, there were 780,000 cyber professionals in the U.S. with about 350,000 openings. The sessions I was in this week talked about increasing the female workforce from 10% to 20% or more. So that means the speakers were advocating moving from 78,000 women in the workforce to 156,000, still leaving nearly 200K in unfilled positions. There are a lot of assumptions in these numbers, I know. That still doesn’t close the gap in positions to talent. We need to be looking at other areas and building the “pipeline” of candidates.

In my mind, one of our biggest challenges is that our career field is 100% in the abstract. If your child wants to be a Doctor, she knows she’ll be working with people, things she can touch. Or if their goal is to be a lawyer, they know they’re helping people. But let’s face it, cyber security professionals, no matter what the specialty, work in the abstract. We don’t build anything, we don’t create software or apps (that’s left to the developers), we don’t arrest people (that’s the FBI and other Law Enforcement Officers). In my daughter’s mind, all we do is sit in meetings and stare at screens all day long! Maybe we make a few phone calls. How do you attract the upcoming generation to such a boring career? We’re not Kate Libby (Angelina Jolie) and Dade Murphy (Johnny Lee Miller) in Hackers, or Neo (Keanu Reeves) and Trinity (Carrie-Anne Moss) in the Matrix. Heck we’re not even Elliot Alderson (Rami Malek) or Darlene Alderson (Carly Chaikin) in Mr. Robot. By the way, that’s one of the most realistic ‘hacker’ programs coming from Hollywood I’ve seen.

So, how do we attract new talent to such an abstract and boring profession? Part of it is the money. A friend from a long time ago told me that the only requirement she would place on her daughter going to school is that whatever the daughter majored in, she could make a living on. With Cyber Security, regardless of the discipline, the rising professionals can make a good living, with 0% unemployment. The other part is education; people think that only the smartest people on the planet can do cyber security “stuff”. Yes, you have to be smart, but we all started at the bottom and worked our way up building our knowledge. No one is born as a cyber guru; we all need to be taught and mentored.

If you’re reading this, chances are you’re a cyber security professional. I encourage everyone who sees this to get involved at the level closest to the children that you’re comfortable with. What does that mean? If you’ve got children, get involved. The Girl Scouts have a cyber badge now, your school likely has a CyberPatriot Program (if they don’t, start one), take your kids/grandkids to work, show them what you do.

If you’re a manager of people within your organization, get to know your staff. See what they’re interested in. If they’ve got the drive and desire to move up and into the cyber security profession, encourage it. One of the many success stories I’ve seen is someone who’ve moved from Administrative Assistant to Information Security Engineer. She came back to the workforce after having children and knew she wanted to do more than manage someone’s calendar. She came back into an entry-level position and got the training and certifications to move up in the organization. She took advantage of the training and education benefits of the company and is a highly successful Information Security Engineer.

The workforce problem isn’t just a one-dimensional problem; as cyber professionals, take the lead and start working with youth to “build” the pipeline. If your kids are grown, work with the local HS, College, Civil Air Patrol, JROTC, Girl Scouts, Boy Scouts, etc. Your example can help build the next generation of cyber professionals.

Cyber Security While Traveling

We’re entering one of the busiest travel weekends of the year within the US. With traveling and the stress of family, the last thing anyone wants to worry about is identity theft and cyber security. Here are a few tips that will help keep you secure while traveling.

1. Disable wireless connectivity (Wi-Fi and Bluetooth)
Your wireless devices can provide hackers with valuable information that can lead to identity theft, or even worse physical theft. Your wireless connections can beacon where you’ve been, your home Wi-Fi information, the type of headphones you use, etc. This information can help physically identify you in a crowd which could be dangerous.

2. Don’t use public Wi-Fi, if possible.
Public WiFi is easy for the public to access and use. Because of that, administrators rarely put significant security in place to protect the users connecting to their networks. The danger of connecting to public WiFi is who’s listening. The technical term is Man-in-the-Middle (MiTM) attack. A MiTM attack is where an attacker intercepts the communication between two parties and sometimes alters it or uses it (in the case of username and password) later. On your home network, you are protected by the passwords and encryption you’ve set up.

3. Disable Auto-Connect
Auto-Connect is the feature that when your wireless network is on, it automatically connects to networks you’ve connected to in the past. Hackers can impersonate global networks and trick you into connecting to their network and compromise your computer.

4. Minimize or turn off location sharing
Location sharing on your phone enables applications to report on where you’re located. This can provide bad guys with information that you’re away from home and traveling, leaving your house vulnerable to break-in or theft.

5. Install Anti-Virus Protection
This should be standard regardless of whether or not you're traveling.

6. Update Operating Systems
Operating system developers routinely develop fixes to security problems, instability, and functionality. It is always a good idea to implement patches offered by your OS manufacturer.

7. Don’t update social media with location information
Instead of uploading your photos in real-time during the vacation, upload them when you get home. Make sure you also lock down who can see and share your photos.