So You Wanna Be A CISO

Welcome to episode #3 of the webcast. A weekly livestream, video feed and podcast from Cybersecurity Growth. A show for aspiring and existing cybersecurity leaders. Hosted by Shawn Valle, Exec Director and CISO of Cybersecurity Growth.

In this third cast/steam, Shawn shares his personal approach for building a “cyber” security strategy and organization. This deep dive, circulates around the early days of being hired into a security leadership role, and what steps are/should be taken within the first 100 days in the role. Maybe there is something in here that you’ll find valuable.

Watch on YouTube:

Listen right here:

Tune in live weekly by following the account at Twitch.tv/CybersecurityGrowth

Subscribe in your favorite podcatcher: https://feeds.captivate.fm/cybersecurity-growth/

Practical uses of the Secure Controls Framework (Part 2)

Welcome to the all new webcast. A weekly livestream, video feed and podcast from Cybersecurity Growth, A show for aspiring and existing cybersecurity leaders. Hosted by Shawn Valle, Exec Director and CISO of Cybersecurity Growth.

In this second cast/steam, Shawn dives deeper into how the SCF creators suggest the Secure Controls Framework could be used in practical applications; plus Shawn’s commentary.

Watch on YouTube:

Listen right here:

Tune in live weekly by following the account at Twitch.tv/CybersecurityGrowth

Subscribe in your favorite podcatcher: https://feeds.captivate.fm/cybersecurity-growth/

Secure Controls Framework, an introduction (Part 1)

Welcome to the all new webcast. A weekly livestream, video feed and podcast from Cybersecurity Growth, A show for aspiring and existing cybersecurity leaders. Hosted by Shawn Valle, Exec Director and CISO of Cybersecurity Growth.

In this first cast/steam, Shawn learns and shares an overview of (possibly the most important framework you should learn) the Secure Controls Framework.

Watch on YouTube:

Listen right here:

Tune in live weekly by following the account at Twitch.tv/CybersecurityGrowth

Subscribe in your favorite podcatcher: https://feeds.captivate.fm/cybersecurity-growth/

The World of Online Platform Abuse and Fraud

Initially posted at: https://www.nisos.com/podcast/know-your-adversary-episode-3/

I had the privilege to (virtually) sit with my industry colleague, Landon Winkelvoss (co-founder, Nisos) to discuss cyber adversaries I have encountered, and lessons learned.

Excerpt from the initial post:


In Episode 3 of Know Your Adversary, our discussion takes a look into the world of online platform abuse and fraud. We explore threat actors’ use of bots to make bulk purchases online. We also tell the story of a security researcher on the wrong side of the law. Learn about the path he took from disclosing a breach to demanding a ransom payment. Shawn tells us about two major threats he faced prior to taking on his current role. Each of those threats warranted different levels of attribution. In the first case, he was faced with bot programmers who abused the platform to “cut in the digital line” when major retailers were having online sales. In the second case, he was faced with a security researcher who compromised a third-party supplier, exfiltrated sensitive data, and threatened to go public if a ransom payment was not made. Our guest is former Chief Information Security Officer at Rapid 7, Shawn Valle.

Here are some of the key takeaways from the episode:

Different types of fraud, but similar techniques. While fraud on technology platforms differs from fraud against other industries, many of the techniques used to combat the abuse is the same. This is especially true when it comes to threat actor engagement.

Whether we are discussing “Trust and Safety” issues related to online platforms or fraud related to scams against employees, applications, or customers, both types of exploits result in reduced consumer confidence. In both cases, as Shawn explains, organizations must take aggressive steps to engage directly with threat actors to stop and attribute the fraud and ensure confidentiality, integrity, and availability of services.

Not all levels of e-crime require attribution and unmasking. The extent to which a victim will pursue threat actors varies. Many fraud prevention programs exist simply to identify the tactic being used to commit the fraud and ensure the fraud stops so the product or service can function properly. In many cases, the effort necessary to identify, pursue, and arrest the fraudsters is simply not worth expending resources.

Many levels of loss and reputation impact do require the attribution. As we discussed in last month’s episode with Randy Pargman, when security researchers or insider threats make contact with a victim and threaten a sizable payment or face public disclosure, attribution that goes beyond tactics and techniques is necessary. Shawn discusses another real-world example.

M&A and Cybersecurity

[updated April 12, 2021]
You’re a cybersecurity leader at a growing company. [or information security leader — I’ll just say security from here on out]. You learn that your company is in conversations to acquire a smaller company, to include the people, products, and locations. What do you do?

making mistakes

You likely make a lot of mistakes…at least at first. M&A and security are oftentimes, not a top line consideration for executive teams. Yet, not considering the risk implications of integrating two companies, could lead to disastrous consequences. Consider if your IT team on-boarded a start-up 3rd party vendor that connects to much of your distributed network infrastructure, but neglected to identify that this vendor doesn’t have a dedicated security team. You now have inherited all the risk of that 3rd party, since their product is now integrated into your environment. Now, picture the similar scenario, but your company is integrating every piece of a companies fabric into yours.

ask all the questions

Do their employee desktops have basic endpoint protections?

Is multifactor authentication everywhere? Is it anywhere?

What are their highest priority risk items? How did those risks get scored and prioritized?

Who has access to production systems? How is least privilege determined?

What is their history with security incidents based on business email compromise?

This list can go on and on. Oftentimes, in a security leaders first M&A event, many of these (and many more) questions will go overlooked. All may be fine. Though, without creating a risk profile, you are merely rolling the dice, hoping not to inherit an active security incident (or worse, integrate an active security incident into your current environment).

create a plan, now

The time to draft a security M&A due diligence plan is now. Well, it should be a core document to have, alongside companywide security policies, incident response plan, and 3rd party risk assessment plan. In fact, if you have a 3rd party risk assessment process, you can borrow a large part of that plan/process to copy/paste into your security due diligence M&A plan. If you are wondering why, read this Ponemon Institute study from 2018, that states “59 percent of companies said they have experienced a data breach caused by one of their vendors or third parties”. You need to think of your acquisitions, as you would a very sensitive third party.

Let’s get back to why you should have a plan at the ready. I have real-world examples of my own poor due diligence that allowed an undetected, actively exploited vulnerability of a company we acquired, to be integrated into our infrastructure, and allowed for pivoting from that environment into ours. There are also plenty of studies that highlight the time it takes to locate a sophisticated adversary in your network. FireEye’s 2020 M-Trends report provides some sobering numbers.

When you get your M&A due diligence plan in place, please consider the multiple stages of the event. (1) Pre-announcement, (2) acquisition, (3) Post-acquisition, (4) Integration.

Why creating an M&A Security plan (not dissimilar to a combination of a 3rd party risk assessment plan and an incident response plan) is critical to do in the early stages of a security leaders role.

….in the next update…

What should go in a plan, to start, and iterate on.

If you have a 3rd party vendor security assessment plan, may I suggest you make a clone of that plan, and rename it “M&A Security Due Diligence”? If you don’t have a 3rd party vendor security assessment plan, stop reading now, and focus on that. (Maybe I’ll write an article on that topic next…that would be a good linkable item).

The plan should have, at least three core sections titled: (1) Pre-acquisition Diligence, (2) Post-acquisition Diligence, (3) Integration Requirements.

With these three sections, create a checklist for each. There is a possibility that some of the checklist items will be “N/A”, though you should expect whomever is going to be your designated manager of the due diligence, should consider each item on the checklist as a “must have” requirement. (I do realize that it may very likely be you, the security leader, who is ultimately going to manage the security due diligence process. Though, as teams mature, you are likely going to want to have another team member be accountable for a due diligence project. More on that later).

How to prepare and staff for an acquisition, when they happen very infrequently.

Cloud IAM Webinar with DivvyCloud

Securing the Resources, Accounts and Permissions of the Cloud Identity Perimeter

The dynamic and ephemeral nature of cloud environments makes traditional security perimeter approaches insufficient for managing risk. To reduce risk, companies must view identity in the cloud as a new perimeter. Strong cloud IAM governance is the key to preventing data breaches and limiting the blast radius should a security incident occur.

Watch the recording to hear Doug Cahill, VP and Group Director of Cybersecurity at ESG Global, Shawn Valle, CSO of Rapid7, and Chris Hertz of DivvyCloud by Rapid7 discuss why managing cloud IAM is so complex, what challenges this creates for IT and cybersecurity professionals, and how companies are governing cloud IAM to reduce risk and the chance of a data breach.

https://divvycloud.com/iam-webinar-reg/

Keeping A Security Mindset

During the very early days of the COVID-19 pandemic, I took every opportunity I could, to get cybersecurity thoughts out for the newly minted, global WFH workforce. Not just my teams, but any/every team across the world. This is one of those opportunities, where I got together with colleagues to get some raw ideas out to the world, as we all navigated the new WFH world.

Colleague virtual roundtable, discussing how to stay safe online from home

Stay home, stay safe, and keep your organizations secure with our #RemoteWork webcast series. Join Rapid7’s Eric ReinersShawn Valle, and Katie Ledoux tomorrow as they answer the question: How can you ensure that security remains a top priority, while maintaining business continuity?

How to WFH and Keep Your Digital Self Safe

I was thinking end of last week, “what I would tell my friends and family about being safe online while being forced to work from home”. I started writing a few ideas (nothing Earth shattering), and then released those thoughts this morning in a blog post. If you find it useful at all, please share with those who may get value out of it.
#cybersecurity #rapid7 #onlinesafety

Article from Rapid7 Blog: https://blog.rapid7.com/2020/03/16/how-to-wfh-and-keep-your-digital-self-safe/

We have rapidly entered a new era of living with a global pandemic. As a result, many are working from home – at kitchen tables, sitting on the sofa, or typing at a desk next to the bed. With very little notice, our work and personal lives have changed, and we don’t know how long this will last. Without any talk of FUD (fear, uncertainty, doubt), it got me thinking about how we can stay safe online in this new world.

BE ON HIGH ALERT FOR ONLINE SCAMS

In times of uncertainty, we should anticipate bad actors looking for an opportunity to capitalize. This could be through phishing emails, financial scams, or other tactics that prey on human nature. Fortunately, the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA) is monitoring and notifying the general public on cybersecurity scams related to COVID-19 and has provided the following guidance:

While at home, it may be a good time for you to review your company’s security awareness communication regarding remote working and stay up to date with any new guidance as company plans and protections are likely to evolve over the coming days and weeks. Although it may be tempting or seem appropriate to “fast track” or “bypass” some of the processes or controls laid out, I advise against it. Internal controls and processes are in place for a reason and must be followed to avoid scams and in some cases, ensure compliance with external regulations.

MAKE SURE YOUR CORPORATE PASSWORDS ARE NOT ABOUT TO EXPIRE

Everyone’s experienced some challenges when it comes to changing passwords and it can get even more difficult and complex to change your password when you are NOT in the office.  Check to see if your password is expiring in the near future and make sure you know how to change it. Also consider checking with your IT team beforehand to ensure all systems for remote password changes are in order. The risk here is that your password expires while you are out of office. Once you’re locked out from the corporate network, it can be difficult to get yourself back online while remote.

CHECK YOUR WIFI CONNECTION

As many of our work laptops or mobile devices auto-connect to WiFi networks, check to ensure that you are connected to your home network (or intended hotspot). You might be surprised that you are connected to a public hotspot offered by a broadband provider, or a nearby neighbor’s WiFi network. To ensure you have the utmost privacy, just check your WiFi settings and ensure you are on the network you intend to be on.

CHECK YOUR VPN CONNECTIONS

Everyone does remote work a little differently, but most of us have some kind of VPN solution that gets us to critical internal systems we need to do our jobs. Please resist the urge to rig up your own RDP, VNC, or ssh tunnel (okay, maybe that last one, but only if you *really* know what you’re doing). Those solutions tend to mean poking holes in your firewall, exposing stuff you don’t mean to, and you probably haven’t instrumented your endpoints with logging, brute force resistance, or otherwise hardened them for the wild and wooly internet. Even if it’s “just temporarily” open, there’s nothing quite so permanent as a temporary fix. I promise, your IT department is there for you, and probably has a few extra licenses for a professionally managed VPN solution. And, if you haven’t exercised your VPN in a while, now is a great time to test it out. Better to find out that your VPN is busted now rather than later when the support requests really start to pile up.

If you have any questions about any of the above, I strongly recommend you reach out to your IT or security teams, who will be seeking ways of making remote working more practical for the organization during this difficult time. By being aware of the factors above and vigilant for malicious activity, you should be able to embrace remote working with confidence, hopefully reducing one area of stress relating to the COVID-19 pandemic.

Transforming the SOC: Building Tomorrow’s Security Operations, Today

Shawn is a participating member of the Cyber Resilience Think Tank. The Cyber Resilience Think Tank is an independent group of industry influencers dedicated to understanding the cyber resilience challenges facing organizations across the globe, and together, providing guidance on possible solutions.

Excerpts from eBook: “Transforming the SOC: Building Tomorrow’s Security Operations, Today”

Introduction

“The Cyber Resilience Think Tank gathered at RSA Conference to explore building out security operations center strategies. Read the report to get more insight on the four main trends they uncovered.”

Cyber Resilience Think Tank Report, Feb 2020

“When you think of a security operations center (SOC), what
comes to mind? Is it an organized team of security analysts and
engineers who detect, analyze, and respond to incidents, always
working in lockstep with business managers to execute on the
security strategy? Or, is it a few analysts who spend their days
reactively responding to unprioritized security issues with a
variety of point tools at their fingertips?”

The human element

“The skills gap in cybersecurity is well documented; a 2019 study by (ISC)2 showed the cybersecurity workforce gap in the U.S. is approximately 500,000, and by estimating workforce gaps in 11 major economies around the world, it is believed that we have a cybersecurity talent shortage of just over 4 million.”

The idea of mapping cybersecurity threat trends is certainly not new, but it can be difficult to achieve when the number of incidents is too high for humans to manage. According to Shawn Valle, Chief Security Officer at Rapid7, the amount of times he’s heard that an external SOC is three or four hours late to report an incident is unacceptable.

“We all know that if it’s ransomware or some other malicious code,” Valle said. “It’d take milliseconds to spread across your entire network. Usually I hear that lack of manpower is the culprit, but it’s akin to having a home alarm system that goes off after the police file their report and leave your house.”

The argument for zero, partial, or a fully outsourced SOC staff may never be resolved, but experts agree that when SOC analysts and engineers are tuned into your organization’s cybersecurity strategy, business processes and overall business, the relationship is no longer transactional. Instead, the relationship and the outcomes of the SOC are directly tied to the security needs of the business.

Full report here: https://www.mimecast.com/globalassets/cyber-resilience-content/transforming-the-security-operations-center.pdf

Literal Cybersecurity Rockstars

Here’s something you don’t often hear of someone in the role of CSO/CISO do; coordinate a concert for the entire company, made up solely of employee musicians, from locations across the globe, and perform for their peers in full rock star fashion at the company’s annual kick-off. But, that is exactly what happened earlier this month.

The idea to take my background in music performance (dates back well before my tech and infosec days), and find a unique way to bring people together from all across the company (infosec, engineering, sales, marketing, it, customer success, ux, and consulting), and then bring the whole company together to be part of a grand performance….well, the post from Jennifer Gregorio below is an example of how we demonstrate our core values (Impact Together, Bring You, Challenge Convention) at Rapid7. #rapid7 #ciso #cso #infosec #rockstars

Jen’s post: https://www.linkedin.com/feed/update/urn:li:activity:6625785654473211904/