Skip to main content

Cyber Security


By Cyber Security, Risk Management No Comments

The recent Log4J exploit seems to have taken many companies by surprise. The team at Cyber Self-Defense, LLC has heard many horror stories about it, and we have heard that companies were not prepared for it.

For years, I have been preaching that cybersecurity is cybersecurity (it is the same, for the most part, for all companies) and that a properly built cybersecurity program should allow you to run your business as usual. While I will be the first to tell you there is no such thing as perfect cybersecurity and that a determined hacker can get in, I will also tell you that you can make it very difficult and quickly detect their presence once they do get in. Building a strategy to enable the business’ success through a risk-based and strategic process is the only effective way to know that your company is investing the right resources.

What is Log4j? Apache systems have a logging utility to log events and configure various features. This utility was created for many practical purposes and has been implemented into various Apache systems. Unfortunately, criminals are always looking for code (software) flaws that can be exploited, leading to a system or data breach. In this case, some of the Log4J instances have flaws that can be exploited to leak data and allow remote code execution. Essentially, hackers can gain access to systems and/or data. The first fix would be to determine if any of your internal or external systems (don’t forget shadow IT: external systems or solutions that are not known to IT and IT Security or are minimally understood) are vulnerable, test to see if they can be patched and patch them. If they cannot be patched, mitigate the risk through various other techniques.

Having said all of this, I think we need to talk about the main problem; Companies tend to build checkbox-based cybersecurity programs. For instance, a company might download a policy from the internet, perform a find and replace, and then tell the security auditor they have a policy. Unfortunately, they might not have appropriately deployed the policy. We have seen such situations lead to data breaches. A company might have a policy requiring their staff to patch all systems within ten days after testing. They fail if they don’t patch the systems strategically and per the policy. Furthermore, if they don’t test for vulnerabilities regularly, they also fail.

We need to build comprehensive cybersecurity programs based on the business’ needs. Here are my takeaways for what went wrong with companies who were victims of Log4J:

1. The companies we have talked to did not have an enterprise-wide, risk-based, strategic, and fully-implemented program. Many of them had checkbox security.

a. Along these lines, they did not have leaders who understood both the administrative and the technical aspects of cybersecurity. Many fall under IT leadership, where it is challenging to balance security needs with the need to have easy to configure and deploy computing assets.

b. FULL Executive buy-in and support.

c. Communications up and down the chain of command were lacking.

d. The companies did not have accountable cybersecurity professionals thinking about the business, not just cybersecurity. The business must strike a balance between having a solid technologist, a person with real-world cybersecurity experience (NOTE: Cybersecurity and IT are NOT the same things), and a person who understands the business needs to lead the program. I could spend hours on this part of the discussion; you need a balanced leader; not an IT or IT Security Analyst).

2. Many did not have a risk management program that was comprehensive and effective. The company often had a document or program that was too high-level but could not drive the security efforts; so no return on investment could be calculable.

3. Training for all staff should be done in a manner that shows that the company is engaged in the cybersecurity process. Haphazard “check the box training” does not help, nor does “one size fits all” training. If the training is not important to you, it will not be important to your employees.

a. Secure Code Training is not widely enforced and included in the creation of code and the integration of libraries.

b. System or job role-specific training is not occurring or not comprehensive enough.

c. ALL STAFF, including your executives and the Board of Directors.

4. Vigorous code testing. In our world today, code is developed very rapidly, and quality testing of the code package is not widely enough done.

5. Vendor management:

a. We need specific contract language that requires the vendor to provide:

i. Rapid response to issues.
ii. Strong SLAs for security.
iii. Fast communication.
iv. Regulatory requirements.
v. Anything else you require to ensure a solid partnership between the two companies. Again, this could be an article in and of itself; We spend large amounts of time with our customers ensuring that this is covered.

b. Vendor vetting processes:

i. Many IT Departments had no clue that Log4J was a risk; they did not know that they had shadow IT.
ii. Controls to prevent shadow IT. There must be a method of bringing vendors in, while ensuring that they have been thoroughly vetted and meet all of the organization’s needs, not just the department bringing the vendor in.

6. Technologies and processes (in no particular order; your risk assessment should drive the correct order). The following controls should be considered (note this is not meant to be an all-inclusive list, it is intended to push you back to your risk assessment and policies and see if they are appropriately guiding you):

a. DNS firewalls to filter malicious domains out.

b. Web Application Firewalls to detect and prevent inappropriate traffic.

c. Multifactor authentication makes it more challenging to gain access to systems and data.

d. SIEM and SIEM-like tools should be available, properly configured, and tuned to prevent alert fatigue.

e. Complete endpoint protection. Our network boundaries are all over; we need all systems to speak for themselves.

f. PROPER and strategic vulnerability MANAGEMENT:

i. Patching should be prioritized.
ii. All systems should be in scope (including external systems).

g. VPN and other remote access tools that validate the system meets the minimum requirements.

h. Encryption of data at rest and in transit.

i. Data leakage protection/prevention.

j. Network segmentation, based on need:

i. No system should talk to another one unless it is appropriate and reasonable.
ii. Corporations should consider blocking traffic from outside their operating areas. This should be planned for and strategically deployed.

k. Least privilege should be enforced:

i. Users SHOULD NOT be local admins.
ii. Administrators should NEVER log in with administrative credentials. They should log in as a normal user and elevate.
iii. Privileged Access Management and Identity Management solutions should be employed.

7. Internal audit processes.

8. Incident Response PROGRAMS.

a. You should have a comprehensive incident response program that contains playbooks and guide your team. I see many IRPs that allow you to check the box saying you have a plan but cannot be used during an incident.

b. You should train your team!

c. You should equip your team!

d. You should ensure that you conduct drills, tabletop exercises, etc., to practice.

9. Business Continuity planning and management.

As a busy Executive or business leader, you need to know that your program is running effectively and that your team is making risk-based decisions. You need to know that they program is built around the needs of the organization. You also need to know that the program is built correctly, so knee jerk reactions are not the standard; pre-incident preparedness is the norm. Let us know if we can help you to have a solid understanding of your program!

Cyber Self-Defense is a premier cybersecurity organization that is focused on the success of our customers. Our approach is different from most companies as we have been in many of your roles and understand how to achieve success with limited resources and the need to allow the company to operate at a profit. If you have questions about anything related to cybersecurity or want some help getting on track, give us a call or send us an email. We’re passionate about what we do and are always happy to help!

Happy New Year! More CMMC News!

By Cyber Security, Risk Management No Comments

December was a great month for us, here are Cyber Self-Defense. As always, we had some amazing opportunities to work with a number of the best customers in the world and on some exciting projects. OUR CUSTOMERS ARE THE REASON WE EXIST!

Our CEO, Michael Meline, was able to become selected as one of the first 100 Provisional Assessors for the CMMC (Cybersecurity Maturity Model Certification) program and a CMMC Registered Practitioner. Toward the end of the month Nelson Wenner became a CMMC Registered Practitioner. Congratulations Nelson! The Registered Practitioner course is a difficult, but very rewarding course.

Cyber Self-Defense became one of 224 companies in the world authorized to help companies prepare for CMMC with our certification as a “Registered Provider Organization”. Cyber Self-Defense also became one of 18 companies in the world authorized to conduct provisional Assessments.
Here are our badges/certifications related to the CMMC:

You can go here, to see our status and validate our certifications;

Moving forward, we hope to be able to help answer some of the questions people/companies have about the requirements of CMMC. Please contact us for a non-sales presentation of the CMMC process. Please do not wait until it is too late, to become ready; the CMMC is here and it is NOW!

Here are some links that will help you, if you are contracting with the DoD;

SolarWinds Orion Data Breach

By Cyber Security, Risk Management No Comments

Hello everyone. As many of you know, SolarWinds just suffered a significant data breach. Our CEO, Mike Meline, spent quite a bit of this week researching the compromise and have gathered some details to aid you in your response. We, at Cyber Self-Defense, will continue to monitor and update you.

There is some information available on the breach, that shows that in March (or perhaps before), a nation state injected a trojanized DLL into the SolarWinds.Orion.Core.BusinessLayer.dll (with a file hash of [b91ce2fa41029f6955bff20079468448]) into the update CORE-2019.4.5220.20574-SolarWinds-Core-v2019.4.5220-Hotfix5.msp. After a dormant period (that seems to differ for each compromised system; but around two weeks), the trojan attempts to resolve a subdomain of (I placed a generic link of into the previously listed link, to prevent someone from accidentally clicking on it and going to the website). The ensuing DNS response returned, points the system that was compromised to a command and control network.

Good morning, As many of you know, SolarWinds suffered a significant data breach. Our CEO, Mike Meline, spent quite a bit of this week researching the compromise and have gathered some details to aid you in your response. We, at Cyber Self-Defense, will continue to monitor and update you.

There is some information available on the breach, that shows that in March (or perhaps before), a nation state injected a trojanized DLL into the SolarWinds.Orion.Core.BusinessLayer.dll (with a file hash of [b91ce2fa41029f6955bff20079468448]) into the update CORE-2019.4.5220.20574-SolarWinds-Core-v2019.4.5220-Hotfix5.msp. After a dormant period (that seems to differ for each compromised system; but around two weeks), the trojan attempts to resolve a subdomain of (I placed a generic link of into the previously listed link, to prevent someone from accidentally clicking on it and going to the website). The ensuing DNS response returned, points the system that was compromised to a command and control network.

a. Identification of vulnerability
i. This affects “SolarWinds® Orion® Platform software builds for versions 2019.4 HF 5 and 2020.2 with no hotfix or 2020.2 HF 1.”
1. Known affected products: Orion Platform versions 2019.4 HF 5 and 2020.2 with no hotfix or with 2020.2 HF 1, including:
a. Application Centric Monitor (ACM)
b. Database Performance Analyzer Integration Module (DPAIM)
c. Enterprise Operations Console (EOC)
d. High Availability (HA)
e. IP Address Manager (IPAM)
f. Log Analyzer (LA)
g. Network Automation Manager (NAM)
h. Network Configuration Manager (NCM)
i. Network Operations Manager (NOM)
j. Network Performance Monitor (NPM)
k. NetFlow Traffic Analyzer (NTA)
l. Server & Application Monitor (SAM)
m. Server Configuration Monitor (SCM)
n. Storage Resource Monitor (SCM)
o. User Device Tracker (UDT)
p. Virtualization Manager (VMAN)
q. VoIP & Network Quality Manager (VNQM)
r. Web Performance Monitor (WPM)
2. I recommend that you determine if you have SolarWinds.Orion.Core.BusinessLayer.dll
a. with a file hash of [b91ce2fa41029f6955bff20079468448];
b. [C:\WINDOWS\SysWOW64\netsetupsvc.dll] (unknown hash)
c. If you have Tenable Nessus installed, you can use plugin 62117 to detect SolarWinds Orion and 144198 To detect the specific version believed to have been affected.
b. Actions to take
i. There is an update that should be applied, which came out yesterday and one that will come out today. See
ii. It is recommended that if you have these products, that you;
1. Review logs, to ensure that there are no indicators of compromise.
iii. Forensically image system memory and/or host operating systems hosting all instances of SolarWinds Orion versions 2019.4 through 2020.2.1 HF1].
1. Analyze for new user or service accounts, privileged or otherwise. (from
2. Analyze stored network traffic for indications of compromise, including new external DNS domains to which a small number of hosts (e.g., SolarWinds systems) have had connections. (from
iv. Block all traffic to and from any devices that have SolarWinds installed
v. Monitor traffic
c. For more information;
i. please review the SolarWinds advisory at;
ii. see the guidance provided by DHS at;
d. Assistance
i. We do have Tenable Nessus and forensic tools and can run tests for you; please let us know if you need help or further guidance.

If you have any questions or would like to discuss this further, don’t hesitate to reach out to us. Stay safe!

UPDATE: Cybersecurity Maturity Model Certification

By Cyber Security, Risk Management No Comments



We have all been hearing about Cybersecurity Maturity Model Certification (CMMC).  Cyber Self-Defense has been posting quite a bit about this program as we want you to be well-informed.  As we begin preparations for 2021, I thought I would write another article that answers two of the questions we are asked by everyone who calls us; and we have been receiving plenty of questions.


The first question I receive most often is, “Do I have to be compliant with CMMC?”  My initial response is that as business leaders, it is our responsibility to protect our company and customers.  Cybersecurity is another business risk that MUST be addressed.  This theory does not take into account whether or not you have a legal requirement to do so, so let me dig in some more. A NON-CMMC question I receive often is, “What standard for cybersecurity should I follow?”  My answers vary, based on the needs of the company.  Having looked at many companies, I think a middle of the road approach is the CMMC.  This standard is laser focused and one that allows for certification, without the heavy overhead required by many of the standards.  It is well mapped out and provides a realistic approach to cybersecurity, while being adaptable to the needs of the organization.


Let’s now discuss the “legal” stuff.  I am not an attorney, nor do I play one on television.  What I keep hearing is that the Department of Defense has the ability to hold companies accountable for three times the cost of the contract plus per claim in accordance with the False Claims Act.  If you are currently doing business with the DOD, you are already accountable for compliance.  If you plan on doing business with the DOD, you will (eventually) have to achieve compliance.  In addition, your employees have an incentive to report your non-compliance; they receive between 15% and 30% of any award under the False Claims Act.  I have read that the Department of Justice has already obtained over $3 Billion dollars in settlements and judgements in fiscal year ending September 30, 2019.  Based on this, I recommend the certification.


Another question/statement we receive is something to the effect of “I am going to wait and see if the DOD will enforce it, I don’t have to be complaint right now, do I?”  On November 23rd, 2020, I received a communication from Idaho PTAC that stated, “Idaho’s PTAC has been made aware of a fast-approaching deadline for prime and sub-contractors working with the Department of Defense (DoD). All contractors must complete and submit a NIST SP 800-171 cyber self-assessment to the DoD Supplier Performance Risk System (SPRS) through their approved vendor, Project Spectrum, in compliance with CMMC requirements. The deadline for this self-assessment is Monday, November 30, 2020. Those who do not complete and submit this initial self-assessment are at risk of losing their contracts with the DoD.”  In every circle I belong to, I am hearing that this WILL be enforced.  If you wait until the last minute, you will not make it!!!  The CMMC is based on maturity, so if you think you will be able to put a plan together, last minute, and pass the certification; you are incorrect!!!  This program is designed to ensure that you are mature, not that you threw something up overnight.

As this is a program that we care about and REALLY want to help you with, please reach out to us for answers to your questions.  We have put together a PowerPoint with key information and this is a free service we offer, to help you with your decision as to whether you should prepare for the certification. Just give us a call at (866) 292-3796 to start the conversation!


CALL TO ACTION: Can you be a part of the SOLUTION?

By Cyber Security No Comments


Today, a meeting of the United States Senate Committee is holding a hearing on “Big Tech Censorship”.  Over the last several months, this has become a very big issue.  With the internet being a primary source of information for many people, it is critical that people have accurate, complete, and accurate data.  WITHOUT getting into political aspects of this; as we all have our own opinions; I would like to see if we, as a community, can help to make suggestions and recommendations regarding this issue.  I believe that as Privacy and Security professionals, one of our roles is to ensure that data integrity and privacy is appropriate across the internet.


At the center of this discussion, is Section 230 of the Communications Decency Act.  As I am not an attorney, I will not attempt to interpret the law.  What I will do is provide some of the details and a link to a legal resource I use frequently, Cornell Law School.  It is my understanding that Section 230 is a reference to 47 U.S. Code § 230 – Protection for private blocking and screening of offensive material (


This law opens with the following.

(a) The Congress finds the following:

(1) The rapidly developing array of Internet and other interactive computer services available to individual Americans represent an extraordinary advance in the availability of educational and informational resources to our citizens.

(2) These services offer users a great degree of control over the information that they receive, as well as the potential for even greater control in the future as technology develops.

(3) The Internet and other interactive computer services offer a forum for a true diversity of political discourse, unique opportunities for cultural development, and myriad avenues for intellectual activity.

(4) The Internet and other interactive computer services have flourished, to the benefit of all Americans, with a minimum of government regulation.

(5) Increasingly Americans are relying on interactive media for a variety of political, educational, cultural, and entertainment services.”

(b) Policy

It is the policy of the United States—

(1) to promote the continued development of the Internet and other interactive computer services and other interactive media.

(2) to preserve the vibrant and competitive free market that presently exists for the Internet and other interactive computer services, unfettered by Federal or State regulation.

(3) to encourage the development of technologies which maximize user control over what information is received by individuals, families, and schools who use the Internet and other interactive computer services.

(4) to remove disincentives for the development and utilization of blocking and filtering technologies that empower parents to restrict their children’s access to objectionable or inappropriate online material; and

(5) to ensure vigorous enforcement of Federal criminal laws to deter and punish trafficking in obscenity, stalking, and harassment by means of computer.”


This law goes on to talk about.

(c)Protection for “Good Samaritan” blocking and screening of offensive material

(1) Treatment of publisher or speaker

No provider or user of an interactive computer service shall be treated as the publisher or speaker of any information provided by another information content provider.

(2) Civil liability

No provider or user of an interactive computer service shall be held liable on account of—

(A)any action voluntarily taken in good faith to restrict access to or availability of material that the provider or user considers to be obscene, lewd, lascivious, filthy, excessively violent, harassing, or otherwise objectionable, whether or not such material is constitutionally protected; or

(B)any action taken to enable or make available to information content providers or others the technical means to restrict access to material described in paragraph (1).[1]

(d)Obligations of interactive computer service

A provider of interactive computer service shall, at the time of entering an agreement with a customer for the provision of interactive computer service and in a manner deemed appropriate by the provider, notify such customer that parental control protections (such as computer hardware, software, or                  filtering services) are commercially available that may assist the customer in limiting access to material that is harmful to minors. Such notice shall identify, or provide the customer with access to information identifying, current providers of such protections.

(e)Effect on other laws

(1) No effect on criminal law

Nothing in this section shall be construed to impair the enforcement of section 223 or 231 of this title, chapter 71 (relating to obscenity) or 110 (relating to sexual exploitation of children) of title 18, or any other Federal criminal statute.

(2) No effect on intellectual property law

Nothing in this section shall be construed to limit or expand any law pertaining to intellectual property.

(3) State law

Nothing in this section shall be construed to prevent any State from enforcing any State law that is consistent with this section. No cause of action may be brought, and no liability may be imposed under any State or local law that is inconsistent with this section.

(4) No effect on communications privacy law

Nothing in this section shall be construed to limit the application of the Electronic Communications Privacy Act of 1986 or any of the amendments made by such Act, or any similar State law.

(5) No effect on sex trafficking law

Nothing in this section (other than subsection (c)(2)(A)) shall be construed to impair or limit—

(A)any claim in a civil action brought under section 1595 of title 18, if the conduct underlying the claim constitutes a violation of section 1591 of that title.

(B)any charge in a criminal prosecution brought under State law if the conduct underlying the charge would constitute a violation of section 1591 of title 18; or

(C)any charge in a criminal prosecution brought under State law if the conduct underlying the charge would constitute a violation of section 2421A of title 18, and promotion or facilitation of prostitution is illegal in the jurisdiction where the defendant’s promotion or facilitation of prostitution was                           targeted.”


The sections of the law are directly copied from the Cornell Law School site that I cited above.

In the spirit of being great cybersecurity professionals, I would like to ask each of us to weigh in on this concern and issue in a nonpolitical manner and a judge free mentality (without attacks and offensive responses).

In your response, I ask that we all answer the following questions.

  1. Is this a cybersecurity/privacy professional concern?
  2. Is this an issue that we face in the world today?
  3. Should private organizations have the responsibility or authority to control the messages that are being delivered to the world?
  4. How do we, as a community of security and privacy professionals, come together and help to ensure the integrity of free information, while ensuring that everyone is safe and free of offensive material?


I would also ask that you tag your US Senator and your US Congress member


Lets become part of the SOLUTION and show our value!


Are you a U.S. Government Contractor (or Planning to be) and Do You have Questions About the CMMC Certification Process?

By Cyber Security No Comments


Cyber Self-Defense has been receiving a large number of calls regarding the CMMC process for Government (especially DOD related contracts). Many of the questions involve the following:

  • Do I need to get certified?
    • Starting in 2021 the DOD will phase in RFI’s that require companies to achieve a level of CMMC certification.
  • How do I get certified?
    • Assessments will be performed by Licensed Certified Assessors who work for licenses CMMC Third Party Assessment Organizations (C3PAOs).  These C3PAOs will be listed on the CMMC AB website when available.
  • How hard is it to build a program?
    • The CMMC is based on NIST 800-171, and most of the practices have been available for years.  Depending on level it could be fairly simple (level 1) or more complicated (level 3+).  “Hard” is dependent on current state.
  • Who can get us certified?
    • A Licensed C3PAO will manage the entire process
  • What is the cost?
    • It’s dependent on size and complexity.  A level 1 for a small company is estimated at 1 day, but size, number of networks, level of complexity, whether a company handles CUI, etc. all require more time to assess.

If you are doing government contracting, you likely have a ton of questions and need them answered. The reality is that there are still many unknowns. Cyber Self-Defense has done a considerable amount of research and we are following the CMMC process VERY closely, as we hope to be one of the first companies to become certified in this process.  It is something we highly support and believe in.  We have believed in such a process since well before CMMC was officially established!

Here are our interpretations, based on our research, of some key aspects of the CMMC process.

  • Currently, there are NO COMPANIES OR AUDITORS who can certify you! We know that the CMMC board is working hard to get companies and auditors trained, but this is a time-consuming process and one that will not happen overnight.
    • We have received MANY claims from MANY companies saying that they can get you certified; this is FALSE! While we are working towards certification, we (nor anyone else!) can claim the ability to certify anyone.
    • There are Provisional Assessors; they have a defined scope and our understanding is that they will NOT be able to immediately conduct audits outside of their current scope. We have heard that this is still being negotiated, but currently, nobody and no person cam conduct these audits for anyone outside the current scope.
  • The DOD is planning to migrate to the new CMMC framework in order to assess and enhance the cybersecurity posture of the Defense Industrial Base (DIB). The CMMC is intended to serve as a verification mechanism to ensure appropriate levels of cybersecurity practices.
  • Initially, the CMMC pertains only to DoD contracts. We have heard rumors that many other government entities are looking to adopt this process.
  • We KNOW that the CMMC WILL be based on 48 CFR 52.204-21, NIST SP 800-171 (the framework says revision one, we believe it will be version 2), and the Draft of NIST SP 800-171B (the framework says NIST SP 800-171B, we believe it will be version NIST SP 800-172).
    • This means that you CAN and SHOULD begin building your program. We recommend that you begin now; when we build programs for companies, it takes time. Training must be done, policies written, risk assessment completed, identity and access reviews completed, etc. There is a great deal of work that goes into this and waiting until the last minute will not be to your advantage.
    • Another point we would like to make is that these requirements are based on good business practices; we recommend these preparations to ensure the success of your business. What is being asked (at least in the first three stages) is the minimum that ANY company should achieve. Many have talked about the high cost of CMMC.  It’s really the potential for costs related to basic cyber security that are at issue.

If you or your executives would like a one-on-one presentation of what we KNOW or can reasonably assume, we would be happy to discuss this with you. This would not be a sales presentation and would be free, simply a way to help you started in the right direction.  Please send an E-Mail to in**@cy**************.com



Ransomware in The News Again: Why Are You Not Prepared?

By Cyber Security No Comments

Most of us are sick of seeing ransomware in the news.  Ransomware continues to plague our world and cause major issues for companies of every size and shape and for companies in every industry.  Every time I read about or investigate these attacks, I ask “why?”! Why did the company not prepare themselves?

A Forbes article written by Bob Zukis in June of this year, points out that “Ransomware is a rapidly growing cyber threat, and attacks overall were up 25% in Q1.”

Bob Zukis adds; “The average ransomware payment is up 33% from Q4 of 2019 to $111,605. But the real cost is the impact on business, such as lost revenue or employee productivity or the impact to public services. The average business downtime due to a ransomware attack is 15 days.”

This morning, I came across an article that discusses the Lazarus (Hidden Cobra, MATA, ZINC) ransomware that appears to have been written by the North Koreans.  While this ransomware is primarily being used in non-US countries, I believe that it is common sense that the virus will be seen in US Companies. Japanese CERT personnel have been able to analyze Lazarus and have identified some key features of the malware and the Command and Control communication between an infected system and the criminal Command and Control systems.

The article states,

“The communication is performed in the mostly same format as mentioned earlier. It is confirmed that the module offers multiple functions including the following: (See Appendix C for details.)

  • Operation on files (create a list, delete, copy, modify time created)
  • Operation on processes (create a list, execute, kill)
  • Upload/download files
  • Create and upload a ZIP file of arbitrary directory
  • Execute arbitrary shell command
  • Obtain disk information
  • Modify system time”

The bottom line is that this ransomware can be used to do anything the criminals program it to do; including searching databases, network and local shares, and anything not properly locked down for information and then exfiltrate the information.  Since the malware can also delete files, all log files can be destroyed, and it could become extremely difficult to investigate.

This is a very timely article; last night I spoke to Jeff Longo from Fortinet and heard that Fortinet is hearing from many people; asking for assistance in preventing these attacks.  Jeff explained their sandboxing tools and several other tools to mitigate the risks.  In May of 2019, I wrote an article called, “Ransomware Attacks Are Out to Get You!!”


You have the information you need to significantly reduce your risk; why would you risk falling victim?

Please reach out if you have questions, comments, or concerns.

Cyber Self-Defense’s Input into a Well Written Article by Jeff Elder of Business Insider

By Cyber Security No Comments

Last week, I talked about risk management.

This morning, Business Insider presented an article that was of immense value to most companies.

During this pandemic, we are seeing more people online.  This presents some real concerns for IT and security staff in EVERY organization.  If it does not cause concerns, there is likely something wrong with the program.  The question, is how do I build a world class cybersecurity program, while keeping costs low?  The answer was discussed in the article I presented last week.  Any good cybersecurity or executive will tell you that risk management is critical to the success of the business.

In this article, Jeff Elder, presents the idea that all companies are talking about “Zero Trust”, a concept that alludes to the fact that nobody is trusted.  While I agree with the concept, I think that the technology is still just a concept.  The reality is that people MUST be trusted.  We can and should limit their access, we can and should force multifactor authentication, we can and should validate their security controls when accessing the network, and we should employ all of the other security tools, processes, training, controls, etc.  The reality though, is that for me to say that I do not trust a high-ranking person like a CEO and have tools to enforce this model/concept is not complete.  The first time I allow the CEO access to any system, application, document, etc., I am trusting him/her! I used to present the idea when publicly speaking that I can place a computer into a room with infinitely thick walls, ceilings, and floors, post armed security around it, ensure that the computer is not connected to ANY external source and has no wireless signals; as soon as a person enters the room (trusted or not) we have the potential for a security breach.

So, what does this all mean?  It means that we have to find a way in which we can balance the needs of the business through the enablement of the business, keep costs manageable, and build quality security.  The ONLY way this is possible is through a formal risk management process.

The Microsoft poll in this article presents the idea that “…while more than half of the business leaders (58%) reported budget increases for security and 65% for compliance, 81% also reported feeling pressure to lower overall security costs.”  I believe that these pressures come from security teams making educated guesses, following the advice of salespeople who sell “a magic button” that stops security breaches, and who fail to properly assess and manage risk.  If you are spending the right amount of money on your program, your risk assessment should help you to show your executives that your program is fine-tuned and operating efficiently.


COVID-19 Has Created Cybersecurity Issues for My Company; HELP!!

By CISO/Management, Cyber Security, Defensive Tactics, Risk Management One Comment

Cybersecurity is always a balancing act.  Good security personnel find ways in which to implement security controls that enable business users and the business.  Good Security leaders make decisions based on quality risk management techniques, ensuring that costs are managed.  What happens when we identify risk that cannot be appropriately mitigated?

With COVID-19, our world has changed, and we have been forced to make decisions.  I have heard from security professionals who say that they are ready to quit their jobs because COVID-19 has opened up a world of insecurity and that “the execs don’t care”.  I submit to you that the executive teams DO care, these professionals simply have not presented the information in a manner that allows for an appropriate decision.

This article is not one that is designed to have people migrate from any specific device or to create stir in the Android community, it is one of finding ways in which to balance risk.  The Android platform is a great example.

Before I get into the risk management part, let’s use an example that you are likely facing;

Some years back, we (the company I worked for and myself) implemented a Mobile Device Management (MDM) solution.  We then allowed select users (a small test group) to connect their (company owned) devices to segregated parts of the network.  My SIEM quickly lit up, telling me that many (almost all) of the Androids were compromised and communicating with nefarious servers.  I also began to receive complaints from end users that ranged from data being overwritten, to their phones not ringing, after the MDM encrypted the company data on the phones.  Needless to say, we began to investigate and identify problems.  We had to conduct a large amount of research and ultimately concluded that we could not use the MDM solution if our users could not receive great service.  We also could not allow these devices to connect to our network as the data we were accountable for would be placed at risk.

We discovered that applications (apps) were being downloaded from the App store that were wrought with malware.  We also found that the devices were almost all different with different parts, different versions of Android, and a variety of problems.  Here is an example story about hacked apps;

This morning, I read a Wired article about Qualcomm releasing a fix that will affect around 90% of US user’s Android devices.  The article presents the idea that “A BILLION OR more Android devices are vulnerable to hacks that can turn them into spying tools by exploiting more than 400 vulnerabilities in Qualcomm’s Snapdragon chip, researchers reported this week.”  The article can be found here;

Risk Management

In this situation, we have some choices that MUST be made;

  1. We can ignore the issue, citing the fact that users have to be able to perform their jobs.
  2. We can ban the devices.
  3. We can add compensating controls (which must be tested and validated).
  4. We can limit the user experience and lock the devices down.
  5. We can elevate our concerns to management and ask for guidance.

What is the correct answer?  Often, we make assumptions about what other people think that are wrong.  Those Cybersecurity people who are ready to quit can breathe a sigh of relief; so can your executives!

As we deal with this situation, or any other situation, it is critical that we follow basic risk management techniques because the answer is going to depend upon the company, culture, type of data, and a variety of other factors.

As security professionals, we have an obligation to ensure that the company is successful and that the business is enabled through the use of cybersecurity.  With COVID-19, this becomes a widespread concern.  I hear this from customers and other decision makers daily.  They ask me about how they should build secure home environments as their users are working from home.  My answer is ALWAYS, “Consult your risk assessment!”  If your risk assessment does not help you with an answer, I would recommend that you conduct a more mature risk assessment.

Proper risk management begins with discussions about the definitions of risk; each company is different.  This flows into a process of understanding the risk tolerance of the organization.  We then look at the business and determine the risks (this is a lengthy process that should be pages, not lines).  We identify the likelihood and criticality of the risk being realized (I like to score the areas of Compliance Risk, Confidentiality Risk, Integrity Risk, Availability Risk, AND Company Image Risk).  We then calculate the effectiveness of the controls we have in place that mitigate the risk to determine the residual risk.

Here is where it gets fun.  We now must put together a comprehensive plan to address the risks.  This should include multiple options for treating the risk, including the acceptance of risk.  As security professionals, we are accountable to treat the risks we identify when they are within our ability to treat them.  When they fall outside of our reach, we escalate them to management; not with a story of how we will be hacked, but with a discussion about the true concerns surrounding the risk.  We then allow them to make an informed decision.  We document their decision and move on; readdressing the risk when changes occur or upon agreed upon intervals.  This is a cyclical process that must be done anytime something changes and at least annually.

When this process is followed, your risk assessment will guide you.  Security practitioners will be relieved to know that they are not accountable with risk outside their control and executives will know that the security program is not just a money pit, it is a tool for the successful enablement of the business.

FBI Releases Guidance on Social Engineering: Email Phishing

By Cyber Security No Comments

As we all (hopefully) know, Phishing is one of the most prevalent and likely risk to compromise for ALL organizations. The FBI just released the following information about a major threat;

This has some great information! We, at Cyber Self-Defense would like to help you further mitigate risks like this. We offer the following suggestions;

1.      It is no longer an option to conduct security awareness training. Your company should be talking to staff about cybersecurity and enabling your employees’ success through knowledge. Sorry to say, in our experience, online training alone does not work. People do not get excited about sitting at their computer and watching/interacting with a monotone computer. Employees want and need to be energized through real world experiences. They want to hear stories, they want to ask questions. We recommend at least an annual in-person training session. This can be supplemented with additional training but cannot replace the in-person training.

2.     Your training should include a section on how to identify phishing and social engineering (con-man/woman schemes).

3.     Use to test links and attachments.

4.     Consider (based on your risk assessment) web and email proxies.

5.     Test your employees; hire a company to conduct phishing and social engineering testing. Our experience shows that hacking systems (overall) is about 20% effective. Social engineering is 80% effective.

6.     Reward employees for quickly reporting issues; their early reporting can save your company.

7.     Have policies that require non electronic approval for ANY money movement. We see a ton of companies hit by wire transfer schemes that are “coordinated” through email.

8.     Encourage staff to send suspicious emails to IT for proper review.

9.     Establish a second look process where employees are encouraged to ask for a second person review of any suspicious telephone calls, emails, or visitors.

10. Validate anyone who wants access to your facilities and accompany them at all times.

As business people, we tend to treat people really well.  I pride myself on trying to treat everyone well. Unfortunately, we don’t often receive the education and knowledge to learn where and when to stop. We do not always understand that we can say “No” in a polite manner.