Reading Time: 11 minutes

Introduction

Encryption is a type of technology that is embedded in all online activities these days and is the fundamental aspect of all privacy and confidentiality in today’s computerized and electronic society. Without encryption we have no privacy nor confidentiality, so to say that it is extremely important is a gross understatement. The equivalence of having no encryption in our electronic world would be like having no locks on anything in the physical world. No door locks, no safes, no pad locks, etc. So you can see why it matters and just how critical strong encryption is.

Just like safes and locks in the physical world, encryption along with something called access control list and authentication, keep people out of places they aren’t supposed to be and keep them from having access to documents and other data they aren’t supposed to have access to or even know existing while allow access to those that have a need to know.

The base concept of all forms of encryption is to apply a formula of some sort to the text to render it unreadable until you reverse the formula. These formulas are called ciphers and can be very simplistic or a highly complex mathematical formula that take immense computational power to solve. The more complex the formula the more secure the encryption is. In other words the complexity of the cipher the stronger the lock. Just like physical locks, ciphers take a key to lock and unlock. These locks can be simple or complex, just like physical keys. More on this later.

Before we dive further into encryption lets touch on something called the CIA triad which is the base concept for all online access models these days.

The CIA triad

No the CIA triad has nothing to do with the USA Central Intelligence Agency. Here it stands for Confidentiality, Integrity and Availability. For any document to be secure and useful it needs to be accessible to those that have the right to use it when they need it and in its original form. If you burn a document, it is very secure, no unauthorized people can read it, neither can authorized people. By burning the document you ensured confidentiality of the document but eliminated both the integrity and the availability of the document.

Let’s break this down

Confidentiality

Can it only be viewed by those that should be viewing it. It’s locked in the safe, so only those who have the combination to the safe can read it.

Integrity

Maintaining integrity of a document is of course always of paramount importance. If you put a document in a safe, and when you go get it again it is all moldy and unusable then it has lost all integrity. If the document has no integrity you might as well burn it and safe you the trouble. In the electronic world, unauthorized changes to a data file violate the integrity of the file.

Availability

Can the file be accessed by those that have right to access it when they need it? Someone puts a document in a safe in a locked room. They give the safe combination to folks that need access to that document, but not everyone has a key to the room. In this case the availability is degraded.

Ciphers

The very first known form of encryption is traced back to Julius Caesar, where he used what we now refer to as the Caesar Cipher to secure his correspondence with his army. The basis of this cipher is to shift each letter by a certain number of positions in the alphabet. To encrypt using the Caesar Cipher using a key of “right 3” you would substitute every A with a D, E with an H, and so on. For example, “RETURN TO ROME” would become “UHWXUA WR URPH.” Knowing that that was encrypted using the Caesar Cipher using a key of “right 3” makes reversing the encryption easy.

If you don’t know what cipher was used or the key, you will need to do some analysis and try to figure that out. This is referred to as cracking the encryption. First you need to figure out what cipher was used, then you need to figure out the key. Knowing “UHWXUA WR URPH” was encrypted with Caesar Cipher doesn’t do you much good until you figure out what the key was. This often is a matter of trial and error or educated guesses. For example the fact that the string seems to be broken into words can lead you to surmise that this is a Caesar Cipher, so you look at the two letter word and start trial and error because there aren’t that many two letter words. You will also note that W and R are 5 positions a part, and you realize that T and O are also 5 positions a part and T and W are 3 position a part. So you conclude that this was Caesar Cipher right 3 and you apply that to the string and get the original text.

People skilled in this area can crack a Caesar Cipher in their head in a matter of minutes if not seconds; modern computers can crack it in a fraction of millisecond. So obviously we need something stronger and harder to crack.

Modern encryption is based on elliptical curve mathematics, which mathematicians tell me is very complex and hard to solve. All I know is that sort of mathematics is way above my head. As I said above the more complex the key is the more secure is the lock. These days the key is a random string of characters, usually thousands of characters long. Kind of like a really long and complex password.

No lock is uncrackable, but the stronger the lock the longer it takes to pick it. For modern encryption with a suitable long key, it could take the fastest computer dozens if not hundred of years to crack it and this is typically more time than most criminals are willing to put into the effort.

Encryption Types and Categories

Encryptions fall into one of two types: synchronous and asynchronous encryptions. Each of those can be in one of two categories. Those categories are encrypting a file or files (aka a thing) or encrypting a connection. Let me dive in and explain further.

Synchronous Encryption

Synchronous encryption is identical to your average physical lock. You have a key to a lock, and you use the same key to lock it and to open it. So if you have the same key or an exact duplication of the key that controls the lock, you can unlock it.

Asynchronous Encryption

The basic concept of asynchronous encryption is a bit more difficult to explain in simple terms as there is no direct equivalent in the physical world, so a certain amount of imagination is going to be required for this. Picture this: someone invented a lock that requires two keys to operate. One key can lock the lock; the other key can only open the lock. The key that locked the lock is not able to unlock it and vice versa. Now let’s call the key that locks the safe the public key and the key that opens the safe the private key. Since the public key is only able to lock the safe, you can hand that key out freely to everyone.

You could even open a network of stores where you can go and pick up a copy of “Joe’s Public Key.” For this analogy to work for those who are more detail-focused, a little suspension of disbelief is needed. Also imagine, if you will, that this imaginary lock I am talking about is in an unlocked state, and it will accept any public key. Once it is locked with a specific public key, only the corresponding private key will open it. That is in essence how asynchronous (or public/private key) encryption works. Just so you know, private and public keys are the actual technical terms in the world of encryption for asynchronous encryption keys. Asynchronous encryption is kind of like a re-usable inter-office envelope. Once it is sealed, it can only be opened by the recipient; once it has been opened, it can be re-used again, and you can put it in the bin of re-usable secure envelopes for anyone to use.

Encrypting Something

If you are encrypting something, you are locking up and making private something on your computer. This could be an entire drive, a folder on the drive, a document, etc. If you don’t know what a drive is, think of it as a storage container on your computer where you store your pictures and documents. You can organize the items on your drive into folders. The analogy here is that the drive is a filing cabinet in your office, and that filing cabinet has hanging folders in it.

You open a drawer in the filing cabinet, pick a folder and either get a piece of paper out or put one in. Whether this drive is built into your computer or a thumb drive is irrelevant. You can also encrypt a USB thumb drive. A USB thumb drive is a little stick you can insert into your computer’s USB port and put documents and pictures on it. If you need the contents of that stick to be private and secret, you need to encrypt it, which will turn that stick into a tiny portable document safe. Encrypting something typically uses synchronous encryption; as the user who encrypted the content is typically the user who un-encrypts it, key exchange isn’t an issue.

The skill set needed to encrypt documents and other items is beyond the skill set I expect the readers of this article to have, so I’m not going to go any deeper into this aspect of encryption. If you have an interest in it or need to use it, you know it exists and can seek training in how to use it.

Encrypted Connections

Before I can explain what an encrypted connection is, I need to explain what a connection is, along with a discussion of what happens when you are using the internet. There is a great free movie on YouTube called “Warriors of the Net” that gives a high-level overview. So if you’re up for some extra credit work, go check it out. Here is the direct link (http://www.youtube.com/watch?v=PBWhzz_Gn10). Please note that this was made in the ’90s and is fairly dated, with some terminology that’s a bit off, but none of that interferes with the explanation of the high-level concepts involved.

So, here are the basic concepts in simple terms. The internet is sometimes called the world wide web because in essence every computer is connected together like one big spiderweb. You purchase your internet service from an internet provider or local phone company, such as Comcast, CenturyLink, AT&T, Cox, Wave, etc. They connect your computer to their computers, which in turn are connected to hundreds of other computers and so on. Another way to think of this is that it is similar to the road system in your location. All roads are ultimately connected. If you need to drive from your house in Seattle WA to some house in Atlanta, GA, you need to figure out which roads connect to the roads that will ultimately get you to GA and to that house in Atlanta.

The internet works in a similar fashion; you need to know your originating address and your destination address, then you figure out the best way to get there. Now let’s get a bit more abstract and change the metaphor a bit. Let’s imagine that instead of wanting to travel to that house in Atlanta, you just want to correspond with them using old-fashioned letters you send through the postal service. You don’t care how the letter gets to Atlanta—you just need to get it there.

So you write your letter, address it, give it to the postal worker, and cross your fingers that the letter gets to its destination. Now let’s imagine that you are writing a really long letter, but to keep the size of the envelopes small, you only put a couple of pages into each envelope and split the letter into multiple envelopes. To help the recipient put everything together in the right order, you put page numbers on each page.

This is pretty much how the internet works at a very simplified level. If you want to read the news from your favorite news site, you pull up that site in your web browser. What happens in the background is that you are in a way sending that site a short letter asking them to send you a list of today’s articles. You will then receive in return a long letter split up among multiple envelopes listing the articles available. You read through that list, pick out an article of interest, and send them another short letter saying, “Please send me article X,” back and forth like that.

This back and forth is called a connection. If a postal worker can pick up one of those envelopes, open it up, and read it, that is called an unsecured connection. If you are just reading the news, who cares, right? However, what if you were doing online banking and one of those letters contained all of your checking account transactions? You might not want some random person who works at the post office to read that. This is where a secure or encrypted connection comes into play.

For an encrypted connection, each one of those envelopes is placed into its own super-secure micro safe before it is packaged, addressed, and given to the post office. Now, unless you know how to unlock that safe, you can’t see what is in it. So each one of these imaginary envelopes becomes a thing you encrypt. In other words, securing a connection is nothing more than a long string of things that are encrypted in an automated and invisible way.

Now the question becomes: do you use synchronous or asynchronous encryption? Either will technically work. Let’s look at the pros and cons of each approach.

Synchronous encryption is fine for a stationary safe example or any case where you can easily and securely exchange the key. If you tried to use synchronous encryption to secure a connection, you would quickly run into the key exchange catch-22 problem. You can’t include the key in your box because what’s the point of locking the lock if you leave your key in the lock? Putting the key in a separate unsecure envelope doesn’t make sense either, because someone could easily steal the key. So how can you get a key to someone securely without being able to lock it? Therefore, asynchronous encryption is the go-to method for securing a connection. This is because anyone can lock one of those asynchronous locks, needing only your public key, which is freely available. You are the only one who can open it, so no need to exchange keys like in the synchronous case.

You could make synchronous encryption work for a connection between, say, Seattle and Atlanta if you had a secure way to do the key exchange. Let’s say the Seattle person and the Atlanta person meet in Dallas and exchange keys in person. Then they go back to their respective locations and now they can securely use synchronous encryption to exchange information long distance, say over the internet. The technical term for this scenario is pre-shared key scenario. For most scenarios, the pre-shared key is not practical, which is why asynchronous encryption is more prevalent for encrypted connections.

There are cases where there is a hybrid implementation. In the hybrid scenario, one of the endpoints randomly generates a long, complex, and secure password that they share with the other party over an asynchronously encrypted connection. Then after they have securely exchanged the key, they will establish a new encrypted connection using synchronous encryption, encrypted with the key shared over the asynchronously encrypted connection.

Hashing

There is one other element of encryption to cover—something called a hash. I lived in Seattle, WA, for 30 years, so I feel compelled to point out that this type of hash has nothing to do with weed, and you can’t smoke this type of hash.

A computer hash is also called one-way encryption; it is a fixed-length string of numbers and letters. A hashing algorithm takes a specific computer file and then generates what’s called a hash from that file. There are multiple algorithms out there for hashing, and they all have several similarities.

• It is not possible to reverse the encryption of a hash; therefore it is called one-way encryption.
• For a given algorithm, the output is always the same length. The size or length of the inputted object has no bearing on how long the output is. The algorithm dictates the length of the output. So a hash of a single word is the same length as a hash of 100,000 words.
• For a given algorithm and a specific input file, the output is always the same. For an identical file, I’m guaranteed the same output.
• If a file has extra space in it or has been modified in any way, the output will be drastically different. Older and simpler algorithms have been found to fail in this regard in very rare conditions. The technical term for this is a hash collision. If a hash collision is a problem for your personal needs, use a newer collision-free algorithm. I would venture a guess that no one in the core demographic for this article ever intentionally uses a computer hash.

The detail behind each algorithm is beyond the scope of this article. There are two main uses for hashing. First is to validate file integrity. You run a particular algorithm against your file and note the output. Then later, if you want to know if the file has changed, you simply run the same algorithm and compare the results to the results you noted before. If they match, then the file has not changed; otherwise, the file is different. The hash doesn’t reveal what was changed, just that a change occurred.

The second use is for properly storing a password so that it is not possible for the site owner to know what your password is. How this works is that when you first provide your password, the site runs that password through a specific algorithm (or recipe), making sure to use salt and pepper and all the proper spices, then they store the results and discard the actual password. When you go to log in, the site uses the same recipe with the exact same spices in the same amounts, and if the results match the saved result, your login is validated; otherwise you are denied access.

Reading Time: 4 minutes

Ransomware is type of self-propagating malware that encrypts your files so that you cannot read or use them until you pay a ransom. Yeah, I know, I can feel how you are rolling your eyes at that unhelpful explanation full of incomprehensible technical jargon. So let me explain these terms in more detail.

MALWARE

Malware is a contraction of the term malicious software. This is a piece of software, or application, that is written with the sole purpose of being malicious and doing malicious things. Exactly what malware could do to you is wide ranging and practically anything, it is usually something destructive such as deleting files or something nefarious like stealing your files.

Malware frequently masquerades as something fun or something useful. For example, a simple computer game, while you are having fun playing the game, the game is deleting all your files. I’ve even known of malware masquerading as malware removal software. How this works is through one method or another, frequently email or web page, you are enticed to install this free tool to check for malware on your computer. While the application pretends to be scanning for malware it is scanning for files to steal/destroy. Pretty nasty stuff.

SELF-PROPAGATING

This is any software that will discover other computers nearby and install itself on all of them without any user involvement or knowledge. For example, if you have a self-propagating malware on a laptop that you take home and connect to your home network, it will discover all the other computers in your home and install itself on them. So, your spouse’s laptop, your kids’ computers, etc., all now have the same malware.

This typically happens due to un-patched vulnerability in the operating system of the computer. That is to say, for example, your version of windows might have a flaw in it that the malware is using to distribute itself to other computers with the same flaw. These types of flaws are typically fixed soon after they are discovered. These fixes are known as patches or updates. This is the reason it is important for the security of your computer to install these patches or updates when they come out. Make sure though, that you only install the authentic update from software vendor, i.e. Microsoft, and not malware masquerading as an update. If you need help with this part make sure to reach out to a trusted adviser, someone that can be trusted with the security of your computers.

ENCRYPTION

This is a rather complex topic that will require its own article. What you need to understand here is that by encrypting your file they become locked and unusable until the person or application that encrypted (i.e., locked) it, decrypts (i.e., unlocks) it.

RANSOM PART OF RANSOMWARE

OK now that I’ve explained what malware is and how it distributes itself let’s talk about ransomware itself and what makes it so dangerous.

What makes ransomware so different from other form of malware is how it holds your files (documents, pictures, etc.) hostage until you pay an outrageous amount of money to the author. This is similar to old fashion kidnapping. Bunch of criminals kidnap someone they think is loved and has a lot of money, then they keep them hostage until they are paid a lot of money for their safe return. Same thing happens here. Once the ransomware malware has been installed it starts to scan your computer and all storage devices and storage services it is connected to for files it thinks may be important enough for you to be willing to pay ransom for it, this can be every user generated file. Then they lock the files so you can’t get to them and pop up a message with the ransom demand when you try to access them. The ransom demand promises that once you pay the ransom, you will get an unlock key that will allow you to unlock the documents. Depending on the type of ransomware sometime the criminals maintain a remote connection to your computers and promise to unlock your files remotely once you pay the ransom. Now the topic of whether to pay the ransom or not and whether their promises are to be believed are hotly debated topics. Suffice it say that the prevailing advice regarding ransomware is very similar to prevailing advice regarding paying kidnappers, that is to say don’t do it. The final decision on whether to pay should reside with data owner as they are the only ones who understand the value of the locked data.

If you have made the proper preparations ahead of time the debate of whether to pay or not tends to be moot as you can just recover your files. How all that works is the topic of the next blog in this series.

WHY THIS MATTERS

Ransomware crime is on a sharp increase and projected to become #1 internet crime. According to the US Federal Bureau of Investigation Internet Crime Complain Center, or FBI iC3, 2020 Internet Crime Report available at https://www.ic3.gov/Media/PDF/AnnualReport/2020_IC3Report.pdf, ransomware reports have increased from 1493 in 2018 to 2474 in 2020, and aggregate ransom has increased from 3,621,857 USD in 2018 to 29,157,405 USD in 2020. While 2021 numbers won’t be available until sometime in 2022, they are expected to be multiples of 2020 numbers. Therefor it is important to be aware of this threat and be able to protect yourself from it.

Reading Time: 4 minutes

HOW TO PROTECT YOURSELF FROM RANSOMWARE

Protecting yourself from ransomware falls into two main buckets, first is steps to take to avoid getting infected, second is being prepared to recover should you be so unlucky to get infected despite defensive measures. In this article I will touch on defensive measures while deferring detailed coverage on that to a separate article. The focus of this article will be how to set yourself up so that you can recover from infection.

RANSOMWARE DEFENSES

Most ransomware infection these days occurs via email attachments or links in email. Defense against that is twofold

• Ensure you have a high-quality antivirus/anti-malware software on all computers
  • Ensure it is kept up to date, updates are often daily
  • Ensure it is configured correctly
• Educate yourself and your users on how to avoid falling for phishing emails
  • Don’t open attachments or click on links in emails that are unexpected, or you aren’t absolutely 100% sure are authentic.
  • Look for other articles from us in the future with more details on this.

If you need help with these steps reach out to a trusted advisor, someone you trust to take good care of your computers and ensure their safety.

RANSOMWARE RECOVERY PREPARATION aka Importance of backups

The best way to prepare to recover from a ransomware event is to ensure you have a solid backup in place. How you do your backups makes a big difference in recoverability.

While backing up to an external hard drive or network share is great for things like failed hard drive or accidental deletion it is useless when it comes to ransomware events or other malicious events as that will get encrypted/deleted along with your local hard drive.

For smaller organizations and individuals, leveraging Microsoft OneDrive built in ransomware protection is often sufficient. Follow this link for more details on how this works.

For larger organizations, they are going to need some additional backup processes, so here are some recommendations for how to set things up for maximum recoverability. Use this guide either for your own setup or when interviewing trusted partners to host your environment to ensure they are thinking about the security of your infrastructure.

• First step is to select a reliable backup solution that stores the backup off-site and packages the files into archives that are completely separate from files that are being backed up. Additionally, ability to encrypt the backups, is an important security consideration.
• Storing the backups at a location other than the files being backed up is more important to disaster recovery than ransomware recovery. Since you are going through the effort to back up your files, it makes sense to consider all hazards, not just one. If you store the backup in the same location as the files being backed up, and something happens to that location such as fire, earthquake, tsunami, etc., you’ve lost both the original and the backup. When selecting storage location for the backup don’t pick a location in the same town even, pick a different hazard zone where the same event can’t take out both locations. This typically means storing the backup in a different region, for example if your files are stored in the south, store the backup in the north.
• Make sure to enable strict separation of duties. The account that has access to the backup system, that can restore backups or even just view or make changes to the backups, should not have access to any of the systems being backed up. Anyone with access to make changes to any documents being backed up, should have no access to the backup systems or the location where the backups are being stored. Backup operator should not be able to access any files in each backup, they can see the file names, paths, and other meta data like that but not the content. Restored system should have the exact same permissions as the backed-up system. For smaller organizations balking at needing a separate backup person note that I am talking about the accounts needed, not persons needed. Backup operator can have other duties, they will just have to use a totally separate account when doing their backup duties.
• Make sure you test your backup. The backup is not useful unless you know for a fact you can restore it. You do not know for a fact that you can restore a backup until you have in fact restored it. This is the most common failure when it comes to backups.
• Make sure your backup schedule accounts for the frequency your data is changing. In other words, think about how much work you are willing to lose and backup that frequently.
  • If you only backup once a week, you lose one weeks’ worth of changes if you need to restore a backup. Nightly backups are very common, as that means you only loose few hours’ worth of changes and getting through an entire backup set in a night is typically feasible for most cases.
  • This is usually restricted to how long it takes to perform each backup cycle.
  • Low-cost systems are typically very slow, and fast backup systems are typically very expensive.
  • So, if you are purchasing your own backup system you have to balance how frequently you want to backup with how much you are able to spend on backup systems.

Recovering from Ransomware infection

The single best step in recovering from any sort of infection is something referred to in the industry as flatten and re-image. This consists of completely erasing the infected hard drive of all data to a point where it is squeaky clean with absolutely zero on it. Then reinstalling the operating system and all applications from original installation media, followed by restoring the backup of the data on that computer.

If it is desired to understand how the infection happened, it is important to simply turn off the computer, unplug it and hand it over to a digital forensic specialist as soon as the infection is discovered. This can be a very costly process and not worth it in many cases. For most best course of action is to go straight to flatten and re-image.

Reading Time: 3 minutesI am a very sharing kind of guy and firmly believe that sharing is caring. I am happy to share absolutely anything and everything, with literally only two exceptions. I am not big on sharing my toothbrush, and I absolutely do not share my passwords under any circumstances. There are two kinds of password sharing that I am totally against. The first is sharing a password between sites. I make sure every site I have an account on has a totally unique password. This means that my password for Facebook, Gmail, Twitter, my bank, etc., have nothing in common. If there is a single character in common, it would be a random fluke.

The second type of sharing I am against is sharing passwords with anyone else. No one has any of my passwords, not even my spouse, absolutely no one.

Before you start to ask about “but what about …” I will provide a blanket answer. I am just making the rules and providing guidance. Whether you follow them is on you. I will try to explain the reasons, so you understand the risk. You understand your risk model the best and can best judge if taking that risk is worth it to you. If you need help with your risk model, I have another article on that.

You are probably thinking to yourself, that sounds like a lot of passwords to keep track of, and you would be correct in that thinking. I have several hundred passwords in active use. How do I keep track of all those passwords, you ask? Do I have them all memorized? Absolutely not. I am lucky if I can remember two passwords. I use a password manager to keep track of my passwords.

 

A password manager is an application that is specifically designed to track passwords securely. Care needs to be taken when choosing a password manager. Many applications out there that claim to be password managers and may even operate like one, but in reality, are malware design to harvest all your credentials. Make sure to choose one that fits your needs, is well respected, and well known to be highly secure. When looking for a password manager, look for the following:

• Strong data encryption, ideally using at least AES 256-bit level of encryption or stronger
• Multifactor Authentication (MFA). The best ones offer multiple options to choose from
• Is the solution monitored for access, data corruption, and operational issues?
• Can you access the password manager anytime and everywhere you need to?

One example to look at is a product called LastPass from LogMeIn.

 

I know I promised you details behind my recommendations, so here goes. When you use the same passwords on multiple sites, all the sites that use the same password are compromised if one of those sites is compromised. This can become a massive headache. While maintaining 100’s of passwords is a bit of pain, it is nowhere near the pain of changing passwords across hundreds of sites when one of those sites has a cyber incident. Also, having data from one site in the hands of cybercriminals is bad enough. Enabling them to access ten sites because they all share the same password is ten times as bad.

 

Another thing regarding password management that is important is choosing a good password. In the past, there was a lot of talk about the complexity of the password being essential. Passwords needed to have upper case, lower case, number, and a special character. This ended up everyone choosing something like Fall2020! as their password. This is a horrible password and can be breached in a fraction of a second. The US National Institute of Standards and Technology (US NIST) even recanted earlier advice on this and has totally changed course in their account management standard.

Recent research shows that length is the most important aspect of a password. Do not think of a password as a single word, instead as a phrase that is at least 15 characters long. I try to make all my passwords at least 20 characters long. Many password managers also have a password generator function that will generate just a random string of characters. This is most secure but impossible to remember. Since I am using a password manager, 99% of my passwords are randomly generated and stored in my manager.

For a more memorable phrase, think of a phrase that no one is likely to guess. Avoid site or app name and well-known aspects of you or your life. It is a plus if it is not grammatically correct or even does not makes sense. Something along the lines of “NittingCowDancesMoon!” would be a good password except for the fact that it is published here as an example. It is both strong because of length and matches complex rules for sites that are still stuck on the old advice of password complexities. Feel free to experiment with spacing, punctuation, etc. Sites and applications vary greatly in what they allow in a password. The most secure ones have no restriction, except for not allowing short passwords.

That is it for this installment. As always, feel free to reach out if there are questions.

Reading Time: 3 minutesThis article was written with companies in mind; most of this applies to individuals as well. Most security incidents happen due to phishing, and I have a sure-fire way to avoid becoming a phishing victim. Just do not click on links in email or open attachments. Yes, I do realize that this advice is about as useful as telling someone to stop smoking or not eat donuts. It is a lot easier said than done. Also, any suggestion that starts with the word “just” tends to be suspect. Hear me out, though, as I explain how this could be implemented.

This needs to start with a culture of not sending unexpected links or attachments around. There needs to be an internal document repository site, which is automatically a part of everyone’s bookmarks. Rather than attaching a file or sending a link to it, in the email, describe where it can be found on the internal site. Something like “the document can be found under documents -> ProjectX -> design.”

This way, people will fall out of the habit of clicking on links or open attachments, and it will start to become abnormal and strange to do so. Emails offering free ice cream and the like will continue to be tempting because human beings love games, contests, and most of all, free stuff. If you set up an internal contest about finding malicious emails and notifying the security team, that could satisfy that urge, especially if free ice cream is the reward.

Rather than training folks in deciphering URLs and determining if the link is valid or not, make the training situational.

• They are signing up for a service that requires providing their email address, and the sign-up process says a confirmation email is being sent, and you need to click on it to confirm the registration. If you get an email within a few minutes that looks like it is from that organization, then clicking on that link carries a relatively low risk.
• They are on a conference call. Someone on the call says they are sending a document to everyone. They explain what it is all about and why it needs to be sent around rather than posted to the document repository. When you get an email from that person that matches the description, opening it carries a relatively low risk.
• If they receive an email with a link or attachment that does not match either of those scenarios, claiming to be from an internal contact or other known contacts, look up their contact information in the internal company contact list and call them up or send them a chat message asking them what this is about and why they choose to send it in an email rather than post it on the document repository. If they get a satisfactory explanation, the risk of opening it is low. Never reply to the email or use other contact information in the email. If alternative contact information is not available outside of that email, consider the email malicious. If the explanation for the email seems off or sketchy or the sender seems sketchy, the safe move is to consider the email malicious.

Additionally, it would be a good idea to train everyone in the hallmarks of phishing attempts, which include:

• Trying to scare you
• They are playing on your emotion
• Play up extreme urgency

Ensure all internal processes specify if there is ever a legitimate internal urgent email, that it does not contain links, and simply direct the recipient to an internal site. All internal announcements should be posted on an internal website as well.

Reading Time: 3 minutesThis post is going to be more applicable to companies than individuals as it is going over how to manage vulnerabilities across all your computer systems. At a super high-level, the concept of vulnerability management is pretty simple. It is all about managing your vulnerabilities. When you dive deeper, then questions start to surface. Questions such as:

• What exactly is a vulnerability?
• How do I know what my vulnerabilities are?
• Can I management something I do not know about?

Some think that vulnerability management is all about having vulnerability scanners such as Tenable Nessus or Qualys and periodically running scans with them. Others believe it involves periodic penetration testing. Not only is this extremely flawed thinking, but it is also potentially dangerous and increases your exposure instead of reducing it. Sure, those things can add value to an already mature vulnerability management program; at best, they are a small addition to an overall program.

The purpose of a good vulnerability management program is to reduce your exposure and make it easier for you to respond when an issue comes up. To answer the questions from above, you cannot manage something you do not know about. To define the word vulnerability, turn to any English dictionary; it will give a good definition applicable here. The third question will require some discussion.

Since you cannot manage, what you do not know about a good asset and configuration management is the foundation of a good vulnerability management program. If you can only do one thing, just get your hands around what you have. This, of course, starts with knowing what computers and systems you have where, what IP addresses they have, and who is responsible for them. Knowing how big the hard drive is, how much memory it has, and what sort of NIC it has is not critical to vulnerability management, but it is useful information for other programs. Knowing the MAC addresses could come in handy, though, for this discussion. Once you have the basics covered, it is time to dive deeper, this is often called configuration management, but it is just an extension of asset management. In this stage, you collect details about what is installed on each computer. Here you capture things like

• What Operating system is installed, what version, and when was it last patches?
• What applications are installed, what version, and when was it last patched?
• What frameworks are used by what application?
• Do any of the frameworks or applications rely on external components or modules?
• Is any of this managed by someone other than the system owner?

Notice a trend there? For good asset and configuration management, all this and more should be documented in excruciating detail. If done correctly, you should be able to pull up all the systems that have a specific version of dotNet Framework, or a particular version of python, etc. You should also be able to detail the exact specs, all installed applications, frameworks, etc., for a given IP address or hostname. Make sure you capture both, along with any aliases and domain names.

Once you have all this documented, it is time to turn to the process side.

• How will you stay informed with issues that come up in the industry?
• Who is going to watch announcements from US-CERT, NIST, NVD, etc.?
• How will you go about remediating issues as they are discovered? Who will have what role? How will information flow?
• Publish a statement on your website on how a security researcher can notify you of an issue they notice externally. Then have an internal process for handling these notices, who is responsible for what, etc. This is called the responsible disclosure process.

Now you can say you have a vulnerability management program. Notice how there is no tool involved so far. The only tool you might think about so far is a Configuration Management Database (CMDB). If you are small enough org, you can do all of this with nothing more than your standard Office suite that you likely already have. If you are a little larger, a proper database will make a world of difference.

Only after you got both a solid Configuration Management and a firm policy & procedure should you even think about bringing in a vulnerability scanner. At this point, you can start to look at products like Tenable, Qualys, Tripwire IP360, etc., and find a product that suits your needs. Feel free to reach out if you need advice in this space. Then amend your existing Vulnerability program with details around what should get scanned when and who is responsible for what. Make sure you specify who is responsible for making sure scanning happens, who is responsible for disseminating the scanning results, and who is responsible for remediation.