Infosec? What Country Is That?

Article originally published by The Analogies Project

By Alina Stancu (Marketing Coordinator, Titania)

About the Author

In this comparative article, Alina Stancu, Marketing Coordinator at Titania, talks about the struggles of discussing information security to outsiders and the similarities she experiences discussing her country of origin, Romania. Alina joined Titania whilst completing her final year studying; Advertising, Marketing and Public Relations at the University of Worcester. Alina has since become a valued member of the marketing team and during her time at Titania has developed an enviable amount of knowledge about the industry and the importance of cyber security.

I am familiar with the pains of discussing information security with “outsiders”, thanks to my Romanian origins. Explaining my country to non-Romanians is not much different to talking to non-technical people about security. Everyone has a vague idea of what it is, everyone knows a couple of standard stereotypes (thank you, Hollywood!), everyone has some expectations of what its inhabitants should look like.

Note: All the questions below have been posed to the author at one point or another, by various friends, acquaintances, strangers on the bus. You always start the conversation with the premise that no one will know what you are talking about, so you must accommodate the interlocutor and provide some context about the information security industry, clarify it’s a self-standing profession, and not to be confused with the more generic IT-support.

Interlocutor 1: So, is Romania a part of Russia?

Alina: No. Part of the former eastern European communist bloc of countries, but that ended in 1989, with the revolution. We’ve been aboard a merry democratic transition ever since…

Interlocutor 1: Ah… so it was part of Russia?

Alina: No

Interlocutor 1: I don’t get it. Sorry, I wasn’t very good at Geography. To be honest I don’t know much about Romania. It’s one of those places that you know they exist, but you don’t really hear much about.

Alina: That’s ok. It wasn’t ever part of Russia. We have lost Moldova (which is occupied by Romanians) to Russia, but Romania was never assimilated.

Interlocutor 1: Is it civilised? Do you have normal amenities?

Alina: What’s a normal amenity?

Interlocutor 1: Don’t know… electricity?

Alina: Mhm. We kinda need it. For, you know, essential living arrangements… like heating, lightning, Internet. Don’t get me wrong, we like living in caves heated by fire, as much as the next guy, but once in a while the iPad runs out of power.

 ***

Then, the dialogue seems to get a little more on track as people start recalling some names, or stories they may have read in the news. Hacking stories are not necessarily the most high-profile, but they do manage to draw some interest, awe or fear. Hollywood does drive some form of cyber awareness, at least. Problem is Hollywood also has a knack for exaggerating.

Interlocutor 2: Ah! Romania… I remember… Ceausescu. And that vampire… Dracula, right? He was some kind of a leader or king in your country, wasn’t he? Was he really a vampire?

Alina: Leader, yes. Vampire, not quite. Hollywood hasn’t got a great track record with sticking to facts and accuracy.

***

Then follow the natural confusions between the bad guys (cyber criminals) and the good guys (ethical hackers). Changing the perception that not all hacking is bad hacking and explaining that there is an actual need for ethical hackers (or penetration testers) to use their knowledge for good is always a challenge.

Interlocutor 3: I read that there are lots of Romanians begging on streets, in many European countries. Doesn’t make your people look very good. You see them in the news. I have to say it is a bit worrying.

Alina: Only a small proportion of the ones reported in media are actually Romanian. However, semantics, misleading information and lack of interest result in a wide-spread confusion outside of Romania’s borders.

Altogether, we have good and bad just like anywhere else, but when you’re an immigrant, you get scrutinised under microscope. Social issues get magnified to suit political agenda, and you find yourself in a very generic box with the label “dangerous” attached to your forehead.

***

Next, you explain the language. The technological lexicon can put off even the most patient, well intended ear. Most of the lack of interest towards cybersecurity stems from the intrinsically discombobulating vernacular attached to the industry. All the while, the more popular siblings such as mobile apps, web clients, social media have entered the colloquial jargon thanks to necessary integration into people’s professional and social lives. You would be hard pressed today for example, to find people not knowing what Microsoft Office is, or how to operate Skype.

Interlocutor 4: What kind of language do you speak in your country?

Alina: Romanian

Interlocutor 4: Is it like Russian, Polish? It sounds a little like it.

Alina: Haha! More like Spanish and Italian rather. Romania is part of the countries speaking 

Romance (or Latin) languages

Interlocutor 4: What did you say it’s called?

Alina: Romanian

Interlocutor 4: I don’t believe you.

Alina: …

***

Finally, gently break the expectancies of what the information security professional should look like. These particular stereotypes are a direct result of media portrayal of “geeks” as socially awkward people, mostly men (which in turn reflects the gender imbalance the industry deals with), that have little else in their lives aside from computers and gizmos. Is there any wonder that future generations may not want to be associated with these negative portrayals?

Interlocutor 5 (knowledgeable in ethnic physiognomy): I like Romanian girls. You don’t really look Romanian.

Alina: What does a Romanian look like?

Interlocutor 5: More blonde, with paler skin… I mean you obviously have a light skin, but you are not blonde, are you?

Alina: No. Neither is a large proportion of my co-nationals. But go on, what else should a Romanian look like?

Interlocutor 5: Don’t know, but they are usually very pretty. Alina leaves pondering over her national identity… and over her hair colour.

***

Much like a state, the information security industry has a different language, interesting people, its own pet hates, achievements, heroes and villains. That is not to say that it should remain marginalised and isolated from the rest of the society. Ignoring computer security is no longer a choice anyone can afford to make.

A country’s need for tourism, foreign policy and defence drives the national brand marketing. For an industry, bridging the communication gap means patience, cutting through the jargon and breaking stereotypes through education.

There is another problem that plagues the industry, and that is the “tired professional”. The IT professionals that after many years spent working with IT illiterates have got fed up with explaining and prefer to keep the strangers outside. Putting this in the same perspective of encountering people from all over the world, should you stop explaining to people where you come from just because they don’t know? Should they stop explaining to you about things you don’t know? Is there any point in harvesting knowledge, if it can’t be shared with others?

Network Security Is In The Details

Article originally published in Today's CIO

By Ian Whiting (CEO, Titania)

About the Author

Ian has been working with leading global organisations and government agencies to help improve computer security for more than a decade. He has previously been accredited by CESG for his security and team leading expertise for over 5 years. In 2009 Ian Whiting founded Titania with the aim of producing security auditing software products that can be used by non-security specialists and provide the detailed analysis that traditionally only an experienced penetration tester could achieve.

THERE ARE A GREAT DEAL OF SECURITY LESSONS HIDDEN in the plots and sub-plots of Star Wars – data security, hackers-for-hire, user error etc. However, what better suits the information security industry other than the striking moment that saw the Death Star exploding into glittery stardust? A chain of vulnerabilities and risk mismanagement ultimately lead to the unthinkable, the destruction of the Empires’ superweapon due to an exhaust vent vulnerability.

There is a case to be made that network security lies in the detail, especially with the rise of the advanced persistent threat and the development of cyberespionage worldwide. Criminals acting in the virtual space have long renounced the generic approach and have instead adopted a highly targeted crime deployment. Security measures must come to reflect this shift. For this, Star Wars shows us how attention to detail can be equally applied to your organisation for a more efficient defence of the network.

Advanced persistent threat: operation “Death Star”

The Death Star was an impressive military and political superweapon designed to annihilate entire planets. Yet in spite of its mightiness, the Death Stars’ defence was surprisingly vulnerable to attacks – one small weakness led to a devastating end result. An assessment of its vulnerabilities was long overdue and it may have been a chance to re-write Star Wars history.

 1. Network reconnaissance

Rebel spies led by Princess Leia manage to get possession of the Death Star’s plans, but their ship falls to the Imperial forces. Leia alone cannot analyse the information she retrieved. Instead she finds a way of transmitting the data back to her father’s home planet of Alderaan for further investigation, by storing the plans in the memory of R2-D2.

At this stage, Leia is captured by the Empire. For the time being, the Empire is unaware of Leia’s mission purpose. The princess insists they are there on a diplomatic mission.

Malware with backdoor capacities can infiltrate a network and remain undetected for years, while leaking information. For example SEDNIT infectors in operation Pawn Storm contained mainly backdoors designed to steal system information and send it to remote C&C servers.

Another example is the highly modular Snake (aka Uroburos) operation which indicates that the rootkit had gone undiscovered for at least 3 years, with a great ability to hibernate for a number of days, which made it untraceable even to professional eyes.

2. Outsourcing – “Hacking-as-a-Service”

Leia’s stolen plans reach the hands of Luke and Obi-Wan Kenobi who decide they must follow Leia’s instructions and reach Alderaan. Luke and Obi-Wan need extra assistance so they contract the services of mercenary Han Solo, who can transport them on his ship, the Millennium Falcon.

A coordinated cyberattack can involve multiple actors taking part, to accomplish various roles along the way. The underground forums of criminal activity are rife with hackers of various skills and knowledge that offer their services. Off-the-shelf tools are also popular either on a one-off basis or as a contractual service, including updating and maintenance work. The Silver Spaniel uncovered in 2014, shows a relatively simplistic campaign which did not build any software, but outsourced commodity tools available on hacking forums instead. The attack required little technical skill, yet it provided scam artists with a prosperous business.

Death Star - Shutterstock

3. Response SIEM – quarantine and counter-attack

The Millennium Falcon has to re-route, in order to reach the rebel base Yavin 4, as Alderaan was destroyed by Grand Moff Tarkin in a demonstration of the Death Stars’ capabilities. However, the Millennium Falcon gets captured by the Star’s tractor beam and brought into its hangar bay. When escaping, the ship manages to evade the Death Star, but at this point it carries a tracking device which enables Tarkin and Darth Vader to monitor them all the way back to Yavin 4.

Network defence approaches focused on threat identification and event management (SIEM) would at this stage identify a breach and trigger security alerts. An alert system would provide the CISO with the choice of further monitoring or ignoring the threat. We see that the Tarkin and Vader choose to monitor the Falcon and track it back to base. Yet, without a comprehensive risk management view of the Death Star’s vulnerabilities, they ignore the possibility that the rebels would “dare” target the core of the Star and fail to secure the ports.

4. The attack vector

The Falcon finally reaches its destination and they hand the plans over for analysis. The examination reveals a vulnerability in the exhaust port that connects to the station’s main reactor. Once the weakness was identified, an attack mission is set up and Luke joins the assault squadron.

In 2014, The Mask (El Careto) was revealed as one of the “elite” APTs. Its deployment against carefully selected targets included monitoring infrastructure, shutting down operations, avoiding detection by wiping instead of deletion of log files and others. Its purpose was cyberespionage, but the attack vector was a combination of social engineering and rare exploits for Java, Chrome, Firefox and other browsers.

Campaigns like The Mask show us that the wide range of tools and the extensive pre-planning work conducted before setting up the attack vector remain the most unpredictable part of the threat. Security and risk managers are often unaware of the “open ports” and struggle to discern between critical and minor threats.

An auditing process with clear flags for threat level is the only way to ensure that malicious actors do not achieve a more efficient assessment of your network than you.

 5. Exploit

After a number of battles, Luke assisted by the Force and under Obi-Wan’s spiritual advice is able to fire proton torpedoes into a small thermal exhaust port along the Death Star’s equatorial trench. This leads to the memorable image of the Death-Star exploding into space.

The BlackPOS family that ultimately led to the breach imposed on Target is a good example to the destructive effects that an undetected vulnerability can have to the security of a network, and finally to the reputation of an organisation. It is now known that the BlackPOS campaign operated through 3 different strains of malware, all following a similar behaviour: infiltration, memory scraping and exfiltration.

Target did have a security team in place to monitor its systems around the clock. Hackers managed to avoid detection while setting up their malware, but when they proceeded to the final stage – uploading the exfiltration malware – alerts went off in Target’s security department and then…nothing happened. The alarm was triggered early enough, before any data got leaked, yet the security operations centre chose to ignore it at that stage. The reasoning has never been disclosed.

 As we see earlier in the film, despite being aware of the thermal exhaust port, the Empire decidedly had not taken steps in securing it. The reasoning can be inferred from their conversations: too insignificant and too dangerous for the rebels to target it.

There is an important point to make here that regardless of a networks security system and even quarantine or counter-attack measures, there is also a great need for a healthy auditing practice, in order to identify your weaknesses before attackers get chance to exploit them. The final facilitator that led Princess Leia and then Luke Skywalker to succeed in their mission was the Empire having failed to design a correct risk management framework.

The accounts of many breaches provide sobering lessons in how organisations can have wide ranging “big picture, big budget” defences but leave vulnerabilities in everyday housekeeping. With the Death Star it was an exhaust vent, with your organisation it might be an out of date firewall, or a default password that had not been reviewed during your last pen-test. Monitoring the details can make the difference between a secure empire and an embarrassing and very public explosion.

 The words of General Dodonna, upon analysing the smuggled plans, can be the words of any hacker assessing the entry points of your network: “Well, the Empire doesn’t consider a small one-man fighter to be any threat, or they’d have a tighter defence.”

Cybersecurity: What the U.S. Can Teach Europe

Article originally published in FCW magazine.


By Edwin Bentley (Senior Software Developer, Titania) 

About the Author

Edwin joined Titania in 2011 and has since become a key member of development team, having primary involvement in advancement of both the Nipper Studio and Paws Studio software. He has a keen interest in Information Security and the role that the industry will play in the future advancement of technologies.


Having attended two reputable information security conferences this year, one on each side of the Atlantic, a few observations emerged on the differences and similarities of opinion on cybersecurity issues in the U.S. and Europe.

Although similar questions were raised at both conferences, the response manner was notably different. Europe took a reactive stance by signaling problems and bringing them to the attention of government agencies and legislators. The U.S., however, had a top-down approach, with industry searching for viable solutions in response to already adopted government directives.

The first event was Infosecurity Europe. The 2014 edition was hosted in London and attended by more than 11,000 information security professionals. With a 20-year tradition, the event is considered a reference point for the cybersecurity industry to find out about the latest trends and tools and keep up-to-date with European laws and compliance policies.

This year, the discussion focused on big data, the accelerated increase in organized cybercrime, the need to stay ahead of threats and an honest admission from Europol that cybercrime is best mitigated or disrupted because law enforcement lacks the resources to prosecute all crime. Staying ahead of threats was high on the agenda. Finally, there were comments on security issues in the cloud, which just like the bring-your-own-device trend, needs to be accommodated in its own right from a protection point of view.

Similar points were made at FOSE. (Editor's note: FOSE is owned and produced by FCW's parent company, 1105 Media.) As an industry event, FOSE is recognized as an official source for voicing the latest concerns in government IT. Among the issues discussed at the conference, cybercrime and cyber terrorism figured high on the agenda for defense and policy.

Continuous Diagnostics and Mitigation

In terms of security tools and trends, automation and continuous monitoring were held in high regard at the U.S. conference. The conversation on the FOSE floor focused on the Department of Homeland Security's Continuous Diagnostics and Mitigation (CDM) program. It comes on the heels of the National Institute of Standards and Technology's Cybersecurity Framework and is part of achieving the last step of that directive: monitoring security on an ongoing basis with the use of automation tools.

Released as a best-practice guidance document, the framework was embraced by the federal sector. After the latest high-profile breaches in the retail industry, a wide range of other companies have started to look at the framework as a template for assessing security practices.

In order to understand why CDM is seen as the best solution by IT professionals, below are a few well-debated problems it answers:

• Top of the agenda for information security experts is how best to integrate security with business processes. Reducing user disruption and enabling business innovation will be more easily addressed with the introduction of automated security.
• Although CDM does not guarantee that its users will stay ahead of threats, it does offer a near-real-time state of security with risk-based assessments reported and analyzed at network speed to ensure ongoing awareness and protection.
• A challenge for chief information security officers and CIOs everywhere is the compliance versus security conundrum. CDM implies moving away from layer upon layer of compliance in favor of perpetual alertness and security.
• The other issue in compliance is log aggregation and reporting. Continuous monitoring would produce automated event logs that can be filed for audits or analyzed for patterns in forensic investigations.

Continuous monitoring does not promise to answer every cybersecurity problem, but it offers a practical way forward. The voluntary adoption within the U.S. business community reflects that its advantages have been recognized.

Cyber directives in Europe and U.K.

Source: fcw.com

Meanwhile, that shift in security perception has yet to happen in Europe. The latest European Union cyber directive -- Network and Information Security (NIS) -- has been taken with a pinch of salt by the industry, and some organizations fear that the stick of compliance will come down hard on their budgets while doing very little for the state of their security.

In a similar way to the NIST framework, the U.K. government released a Cyber Essentials Scheme as a best-practice guide for organizations. Operating in a less intrusive manner with smaller, more practical steps, the scheme has been received with cautious but definite approval by the business spectrum.

Although a promising start, neither the Cyber Essentials Scheme nor the NIS directive alone is sufficient to bring forward the visionary changes the industry needs. The European efforts are moving in the right direction, but compared to the older, more experienced industry in the U.S., they need further development. The Cyber Essentials Scheme might be too small, while NIS could be seen as too complicated and faces an uncertain fate amid changes to the European Parliament.

If the cybersecurity industry is to address the issues raised at Infosecurity Europe 2014 such as staying ahead of threats, mitigating cyber crime, transforming security into a business enabler and dissipating the predicament of compliance versus security, then Europe needs to continue to move in the right direction and could be inspired by the top-down approach to security in the U.S.

Cyber Security at the NATO 2014 Summit

Titania delegate, Andy Williams attended the NATO Briefing to the Industry yesterday at the Farnborough International Airshow.

Source: bbc.co.uk

FIA 2014 is a great opportunity for a day out with the family. The acrobatic demonstrations from renowned aircrafts such as the Breitling Wing Walkers, Aerostars and the RAF Red Arrows, made for a memorable spectacle.

Source: gov.uk

However, Farnborough is not only hosting a public airshow for aviation enthusiasts, but also one of the most recognised trade exhibitions for the aerospace and defence industries. In the run up to the NATO Summit taking place in Wales in September 2014, ADS and UKTI Defence and Security Organisation have jointly offered UK industry the opportunity to connect and engage with the Alliance’s two main agencies: NATO Communications and Information Agency (NCIA) and NATO Support Agency (NSPA).

Source: rocketroute.com

The purpose of the briefing was to showcase the NATO market to the UK industry by bringing together the two agencies involved in budget spending and strategic operational activities, together with the UK defence and intelligence industry. The event is consistent with a previous declaration, by President Barack Obama, where he along with NATO’s Secretary General Fogh Rasmussem would identify the host country for the 2014 Summit, which will look at building up NATO’s ability to address cyber threats and “lock in” commitments by members. The “lock in” reference is a reminder of the message that US has sent before to NATO members, that cyber security is a shared responsibility.

Currently the agenda for the Summit revolves around: Afghanistan troop withdrawal; adapting the Alliance’s existence in the 2014 post era to respond to emerging threats - where cyber defence, intelligence cooperation and special op forces are discussed; budgetary concerns.

Previous meetings establishing the agenda have increasingly discussed cyber issues as an emerging challenge which should enter NATO’s defence strategy. So does this mean will see a grounded cyber security strategy at the 2014 Summit, in Wales? According to Chatham House, inside sources have been quoted saying to expect ‘more of the same’ – a focus on exercises, enhanced training, standard and greater work with partners.

The Alliance is confronting serious criticism from within. The first question on cyber issues has been about the defence of the organisation itself before taking over more ambitious projects. In response, the Alliance has hired Finmeccanica and Northrop Grumman to install cyber security equipment and Incident Response Capability programs across NATO headquarters, in 28 countries. In addition, the organisation also set up two Rapid Reaction Teams to protect its networks against cyber attacks.

Another discussion concerns whether the Alliance should leave cyber security policies to the EU. An enhanced long-term dialogue is needed in order to avoid duplicating efforts with the European Union and this seems to be a recognised concern for NATO leaders this September.

Source: nato.int

Finally, the most pressing question of all is who foots the cyber security bill and from that perspective, the members appear to be fairly reluctant to an offensive cyber strategy, which would put further strain on the already undercut budget. But as indicated in this research paper published by the NATO Defence College, Rome, ultimately there is pressure for the Alliance to justify its presence in the post 2014 era. Perhaps the answer lies in different prioritization over what constitutes a threat in 2014, with new budgets reflecting it appropriately. The Farnborough ‘Briefing to the Industry’, involving the relevant bodies of NATO and emphasizing strategic capacity and budget allocation, indicates the Alliance is already taking steps in the right direction. 

Cyber Security Challenges Conference - Titania Discusses Experiences in the US Market

On Tuesday the 24th of June, Titania's CSO Andy Williams, joined a panel of speakers at the half day Cyber Security Challenges conference held at the BIS Conference Centre in London.

Cyber Security Challenges - panel session

Organised by UK Trade & Investment (UKTI), techUK and the Fairfax Country Economic Development Authority (FCEDA) speakers discussed the opportunities for UK companies in the US cyber security market in the public and private sectors. 

Having supplied to over 60 countries worldwide, with around 60% of revenue coming home from the US, Titania's Andy Williams delivered a talk outlining the experience Titania have of the US cyber market and advice on how to do business. 

Other speakers included Lockheed Martin who outlined opportunities in the US market, plus FCEDA and UKTI discussing the support they offer to UK companies looking to supply to the US government and cyber industries. 

The event concluded with a networking lunch and a chance for 1-2-1's with attendees and speakers. 

Andy Williams said: "We know from experience that the cyber security sector in the US is receptive to highly innovative British products. This event was a perfect opportunity to hear from companies who have already achieved success in the market, as well as Government and industry experts who can offer support and insight into doing business in the US."

Andy Williams speaking about cyber security challenges in the US market

Titania at the Official Cyber Essentials Scheme Launch

Andy Williams (Titania's CSO) was present yesterday, at the invite of the office of Rt. Hon. David Willetts MP, Minister of State for Universities and Science, for the official launch of the Cyber Essentials Scheme. The event was hosted by the ICAEW (Institute of Chartered Accountants for England and Wales) and it was aimed to educate companies on the benefits of adopting the scheme and how best to apply it to businesses. 

Cyber Essential Scheme Launch. Credits: @ICAEW

The scheme, which stands as a guidance and certification reference point, will work alongside other cyber security accreditation bodies (such as the Information Security Forum or British Standards Institution). As such, businesses will be granted the opportunity to qualify for badges that would display how security conscious they are. 

Although the government announced it does not intend to impose legal requirements, it has stated that starting on October 1st, all suppliers bidding for information that handles personal and sensitive contracts in the public sector will need to be Cyber Essentials certified. Early adoption by a few high-profile names such as BAE Systems, KPMG and Barclays show that the scheme was received with enthusiasm. Also, the insurance industry is keen to support the integration of the scheme into their standards.

The scheme is overseen by CREST, the not-for-profit organisation that represents and certifies the information security industry, who collaborated alongside CESG to develop the assessment framework for the scheme. For those interested, badges are already accessible: IASME offers self-assessment path and CREST has a 2-level accreditation available. 

Among information security professionals reactions were positive, but at times reserved. The general consensus was that while the scheme is great for getting the basis of cyber security into place, sustained efforts are needed. 

Peter Wood observes that this is certainly ‘better than nothing at all’ as it addresses the lack of cyber security education for small to mid-sized businesses, which could really benefit from governmental help. Other experts agree that while it is a good starting measure, it shouldn't be seen as a complete solution and as in order to achieve noticeable results, the scheme needs continuous refinement in the long-term. 

Andy Williams thinks that "building on the government's '10 Steps to Cyber Security' launched in 2012, the Cyber Essentials Scheme is an useful next step in raising awareness of basic cyber hygiene standards that, if met, can help businesses protect themselves against cyber attacks. It will be interesting to see how many companies pursue the certification. The government's stated intention to ultimately require all of its suppliers to be CES certified will certainly help to encourage the adoption of the scheme across the UK."

It has been reported that the framework does not yet include guidance around business orientated issues such as business management, IT governance or employee awareness. Organisations would find it useful to have one source that is trusted to be up to date and reliable in these areas to help curb confusion. 

The Cyber Essentials Scheme lays down a good basic foundation and the legislative side gives it a more determined approach, suggesting that the Government is starting to recognise cyber security as a major national issue. The Queen’s Speech in the Houses of Parliament saw the proposal of 11 new laws, including a ‘Serious Crime Bill’ which suggests appropriate jail sentences for cyber crime in order to fully reflect the damage inflicted by a cyber attack. 

How to Inculcate a Cyber Security Culture Throughout an Organisation

By James McDonagh (Technical Services Manager, Titania)

About the Author

James joined Titania with a background in both project and personnel management in various organizations, including blue chip companies. He has technical experience across various sectors, and is currently responsible for managing the development, testing and support functions of the company. Outside of work he recently completed his first sky dive!


Recently on a train, I overheard a conversation about herbal cigarettes. At an unspecified time in the past, a lady was quitting smoking. She used these as a substitute. They look and smoke just like a regular cigarette, but contain no tobacco. You can buy them at a chemist.

She had been smoking one of these things in a pub, and was asked to leave because the pungent odour led the manager to believe the ‘herb’ in question was the kind defined by the Urban Dictionary.

I was surprised by this story. Of course, in the UK it is now illegal to smoke indoors. It only transpired later that this incident occurred before the ban.

The very thought of smoking inside these days is culturally anathema. The legislation preventing smoking in enclosed spaces came into force on 1st of July 2007. Backed up by advertising and warning labels, it seems to have become a social norm.

Cyber security as a cultural norm, or at least a thorough appreciation of the issues, is surely something to strive for. The easiest opportunity will be the one attacked, and any organization is only as secure as those in its supply chain.

PwC 2013 Information Security Breaches Survey

The 2013 Information Security Breaches Survey conducted by PwC tells us that:

• 87% of small businesses had a security breach in the last year (up from 76% a year ago);
• 36% of the worst security breaches in the year were caused by inadvertent human error;
• 57% of small businesses suffered staff-related security breaches in the last year (up from 45% a year ago);
• 42% of large organizations don’t provide any on-going security awareness training to their staff (and 10% don’t even brief staff on induction);
• 93% of companies where the security policy was poorly understood had staff-related breaches (versus 47% where the policy was well understood).

Amongst (most) IT professionals there is a fundamental understanding of IT security practices. We would not click on every link we see, nor plug just any USB drive into a machine. There is already a culture of this embedded in our clique.

But how do we go about establishing this and other security practices as normal behaviour in the wider user community? In the earlier example of the smoking ban, there has been a shift from a ‘top-down’ legislative imposition to a widely accepted social rule. Peer pressure is as likely to prevent smoking indoors as much as the threat of a fine.

Similarly, rules and technical solutions will only take you so far in preventing security breaches and data loss. A good social engineering attack can gain ground no matter how well locked down your network is.

Some of us are old enough to recall a time when PCs were a rarity in the office outside of a thinly staffed IT department. We now live in a world where we are all in ‘The IT Crowd’ to some degree. However cyber security continues to be a niche area. While no one would expect everyone in an organization to possess the skills of PenTest Magazine readers, we are at a point where a basic understanding of cyber security needs to spread throughout the workforce. Indeed, one would argue that it is more important than the skills which are more often prioritized, such as MS Office.

The starting point is a workplace policy. You can create one from scratch, based on what the priorities are in your business. Alternatively, there are numerous policy templates that can be downloaded from the Web.

Of course, most of the organizations using Pen Testing will already have a policy in place, but how do they go about ensuring that is understood and implemented by all members of staff? And better yet, how do you reach the point where it is embedded into the culture of your organization, where one employee will challenge a colleague over poor IT hygiene practices?

As the PwC survey indicated, both induction and regular on-going training should be scheduled in as a starting point. Once you have decided upon your workplace security policy, you could use a policy checking tool such as Titania’s Paws Studio.

Paws Studio will help you enforce and check that your work machines are compliant.

Paws Studio, just like Nipper Studio, is very easy to use. You will also find a more detailed walk through elsewhere in this issue.

While the software naturally comes with pre-installed policies for PCI and many other compliance standards, the user generated\customizable policy option is the ideal tool to appeal to users in this arena.

Customizing your policy could hardly be more straightforward.

While readers of PenTest magazine will generally like to edit the XML themselves, there is an editor which allows a further two ways of editing the policy file.

For, say, a small business owner with limited IT knowledge, the most convenient tool is probably the Wizard.

This maintains the hierarchical requirements of the XML while providing a more user friendly method of creating or customizing your Policy.

Once you have installed and started Paws Studio, select the Policy Editor from the bottom right of the home screen (see Figure 1).

Figure 1. Paws Studio main screen

When the initial screen opens, select the Wizard button on the left (see Figure 2).

Figure 2. Policy Editor wizard selection

In this example, I have chosen to use the supplied Titania template, which comes as a sample pre-defined policy. Opening it provides some summary information (see Figure 3).

Figure 3. Policy Editor

At the top of this screen, you can see the three levels of the hierarchy in the policy file, which are: Requirement, Group and Check. In the next screen shot (see Figure 4), I am at the Requirement level and choose to add a Group.

Figure 4. Selecting requirement

I call this Group ‘Antivirus check’, and add the Check in at the next stage (see Figure 5).

Figure 5. Adding AV Check

In the next section, you are able to add the details of your specific Check. I give it an ID and 

a Title, and then I am able to choose from one of the supported checks. For example, Manual Checks are Checks where the user needs to perform some kind of check themselves – for example, ensuring that a suitable lock is fitted to the server room door and that it is used. Naturally, Paws Studio can also automatically check for various issues on an individual machine. In the example here I am looking for suitable antivirus software, but other examples include (but are not limited to) password policy, system updates and installed software (see Figure 6).

Figure 6. Check

On the final screen, you can review all the checks in your file and save it for later use during Paws Studio audit (see Figure 7).

Figure 7. Review and Save

So with both the training and the regular checks on your machines using software like Paws Studio, you can go a long way in terms of both explaining and enforcing your security policy.

But we can do more. Of course, for the readers of this magazine, we certainly hope that organizations will regularly engage the services of a Pen Testing company. However it is also worth considering setting up a method to regularly check the response of your employees to some of the most common types of attack.

At Titania, we set up a webserver and used it to run mock phishing attacks against our employees. It was very straight-forward, we just used a virtual machine, an Apache web server and a variety of email accounts to run some attacks. It was then simply a matter of checking the logs to see who had responded. I am very happy to say that we had no responses from our employees – they are obviously very well trained!

Of course, once you have the web server, you can use it in the future to run more ‘attacks’.

It is worth doing it often to both judge how aware your staff are of your policy, and to keep it fresh in their minds.

This is a simple method of testing your training methodologies and generating debate

amongst staff. There are probably many similar techniques you can use.

For example: Insert a point in your policy document that USB drives found on or near work premises should be handed to a nominated person in your organization, then liberally

sprinkle a few cheap USB drives around the area.

If, when you check the drive locations they have disappeared but have not been handed in, then it can perhaps be raised at the next staff meeting. If, for some reason, USB drives are

not locked out on your company hardware, you could perhaps have a text file on the drives with something like: ‘Oops, you have breached security policy point X’.

One very important point that needs to be made here: this is not about punishing or

tripping up employees. It’s about lighting those metaphorical cigarettes in the workplace,

and seeing who responds appropriately. Those who do can be used as good examples or

torch-bearers for the rest of the team.

So, this gives you – or your clients – a simple three pronged approach to building the IT

aware culture we should be aiming for:

• Codify a policy;

• Enforce it [regularly];

• Test it [regularly].

The fourth important ingredient is, of course, time for the policy to permeate and percolate until it becomes normal behaviour.

Perhaps the more businesses that use this or a similar approach, then the more often such businesses will be more exacting during their interactions with other organizations. If that happens, then such a culture might start to spread exponentially.

Poor cyber security, like smoking, is an expensive bad habit. Unlike smoking, it can have very bad consequences for more than just the user and those near to them.