Just in case you get into SOC2 and want to know how to map it to existing information security implementation, whatever it may be, GDPR, ISO27001, NIST, … check this page
“ SOC reports refer to an audit of internal controls to ensure data security, minimal waste, and shareholder confidence; SOX relates to government-issued record keeping and financial information disclosure standards law. In other words, one is about keeping information safe, and the other is about keeping corporations in check.“
The main title of the (ISC)² article on CCSP vs CCAK is “CCSP Certification vs. CCAK Certificate: What Are the Distinctions?”
That’s exactly what you get. A list of technical differentiators between CCSP and CCAK, but according to (ISC)².
But if you hope to get an actual answer to what the right certification is, for you… they forget to ask …you.
What do you think would be the conclusion, if you ask that question to either one of the contestants while you compare 2 certifications? Of course each party will simply draw the conclusion that their own certification is the best choice.
To answer the most important question, the dilemma CCSP or CCAK, is simple: do you need technical or audit skills for cloud security?
The answer
In essence, the answer is simple:
if you need cloud audit skills, dive in to the Cloud Security Alliance (CSA) and ISACA Certificate CCAK.
if you want to have architect level technical cloud expertise and knowledge, choose CCSP
if you want cloud security knowledge, in basic or advanced hands-on, there are other choices to start with (more about it below)
So, if you ask the question “what is the right certification for you”, you immediately know that there is no right answer, but there are many options. Options for a multi level expertise roadmap in cloud security, based on your current skills and your future goals.
If you like a tough challenge: why not jump into the CCAK or CCSP, CCSP or CCAK, whatever, right away.
But if you would like to boost your chance of success… take a deep breath and better plan smartly.
And don’t start with CCSP/CCAK, but prepare your track towards CCSP/CCAK first.
First some background to plan your roadmap
Setting expectations
Just to set expectations, this article only focuses on the personal education and certification options, offered by (ISC)², ISACA and CSA. Including other education provider would lead us too far. There are way more other (cyber)security certifications available, but we focus on the cloud security track, which limits the options…
Feel free to comment with other options for cloud security training. I’ll update the article where relevant.
CSA CCSK
The Cloud Security Alliance launched the CCSK in 2011. And as they explained here, “the CCSK was quite literally the industry’s first examination of cloud security knowledge when it was released back in 2011. “
The CCSK is an easy entry, high level introduction to Cloud Security, and it doesn’t require you to have deep technical cloud security expertise.
But it still is a nice baseline for the cloud security essential knowledge.
You need at least five years of cumulative, paid work experience
CCSP is pretty much the same level of difficulty as CISSP, but has focus on cloud security.
The CCSP was launched in 2015, as a cooperation between (ISC)² and CSA. (see CSA press release here), a couple years after the CCSK launch in 2011. The CCSP is the bigger brother of the CCSK, more advanced, and as CSA rightfully mentions in there CCSK-CCSP comparison blog, the CCSP is on the level of CISSP with a major cloud flavor.
That’s where the dummy math description comes from…
CCAK (Certificate of Cloud Auditing Knowledge) is cohosted by ISACA and CSA. And then you immediately know the approach is different than the approach of (ISC)².
As ISACA mentions on their product page: “The Industry’s First Global Cloud Auditing Credential”.
CISSP
For completeness, I mentioned the CISSP ( Certified Information Systems Security Professional). I don’t think it needs a lot of explanation, it’s pretty much the reference standard for IT Systems security. (ISC)² references it as “The World’s Premier Cybersecurity Certification”.
It’s a pretty heavy exam, and it does require at least 5 years professional security experience. This is not an entry level exam.
Due to the experience requirements, CISSP might be a tough credential to start with, although you can pass the exam, and continue to build your experience to grab the CISSP title…
If you want the plan your credentials the smart way, or you’re fresh in cyber-, information or IT-security, you better start with SSCP.
You can buy a double-try access ticket for the CCSK online exam (60 questions, 90 minutes), so if you would fail the first attempt, study again and retry the exam.
Then plan your track: only technical (no interest for audit) or audit, or both
Only technical
If you focus on technical expertise in cloud security, CCSP is a reference standard (at least, on of them…) .
As mentioned: CCSP = CISSP + CCSK.
So the track is clear
After passing the CCSK exam,
Take the CISSP exam
then take the CCSP
This is the easier route if you already have 5yr+ experience. It’s not the cheapest route, as you pass the CISSP first, but it’s worth the effort. (you only need to pay 1 yearly fee at (ISC)², so after 1 certification, … no extra cost in yearly membership fee) For junior, less experienced, security engineers, start with SSCP before jumping into CISSP, and then CCSP.
Audit
When you target IT security audits, you need to take a different route depending your background. Having the CCSP/CISSP background is extremely useful to boost your career in audit.
But for the CCAK, the core audit baseline is CISA.
Keep in mind, similar to CISSP and CCSP, CISA has the same requirements regards professional experience, 5 years.
But if you’re a ISACA CISA, you can add CCSK to the track and land on the CCAK.
Both?
Then it’s obvious, first tech, then audit, meaning a smart combination of
CCSK
(SSCP > ) CISSP
CCSP
CISA (or alternative)
CCAK
Alternative routes
ISO27001 Implementer & Auditor
And alternative route to the auditing experience is ISO27001 auditing, but you’ll need some implementation experience before you can audit.
CISM
Within the ISACA portfolio, the CISM (Certified Information Security Manager), covers the same areas as most ISO27001 (lead) implementer courses.
Which can be helpful to ramp up for the CISA audit part, to gain some hands-on in IT & Infosec governance.
Visualizing your cloud security education roadmap
Lots of blah for a simple choice?
Allow me to visualize the options…
The difference between “certification” and “certificate”, does it really matter?
In it’s blog post (ISC)² tries to put CCSP above CCAK by saying “CCSP is a certification; CCAK is a certificate.”
And they continue “A certification recognizes a candidate’s knowledge, skills, and abilities, typically framed by a job role, while a certificate’s scope is narrower and only documents training course completion. A certification often requires continuing professional education (CPE) to stay in front of trends, while a certificate’s body of knowledge does not evolve over time or require CPE credits to maintain.“
And their explanation is at least flawed and cutting corners to benefit CCSP.
There are many explanations and interpretations of “certification”, depending the context. But in essence, “certification” is a process and a certificate is a document (the result).
When you certify for “CCSP” at (ISC)², you need to comply with the CCSP condition and then get a document, your CCSP certificate. Idem for CCAK, you need to comply with their conditions.
Both the certification process for CCSP as the process for the CCAK are used by other similar education providers.
Eg, PECB, ISACA, EC-COUNCIL, … and others require to pay a yearly fee, keep CPE/CPD (continous professional education or development). Some yearly fees are cheaper as others.
Like CSA, Microsoft and others ask for a 1 time exam fee, and then update the exam on longer term, not yearly, and do not require a yearly maintenance fee.
It’s a choice of the certificate owner, how the evaluation and exams are done.
Some of them comply to the ISO17024, and education standard. There are huge benefits to comply (like increased credibility, compatibility with other certifications, …). But it’s not mandatory.
(ISC)² uses an exam, with experience requirement and continuous education once you pass the exam, but you do not need to pass the exam again, unless it’s upgraded to a new build or major version.
But CSA does exactly the same, for example when CCSK was upgraded from v3 to v4, you needed to pass the exam again.
Not on a yearly basis, but the program is updated, the exam is updated… on a regular basis, without yearly fee.
It’s rather a (small) financial effort, not of significance for most companies paying the bill. (Although as an individual, the cost of certification can become a serious burden…)
And it’s certainly not relevant when choosing between CCSP and CCAK. CCAK is cheaper, as referenced in the (ISC)² comparison chart.
References
(ISC)²: CCSP Certification vs. CCAK Certificate: What Are the Distinctions?
I must admit, it’s a great opinion article to get a nice discussion going with companies. At least it helps to raise awareness of ransomware and ransom payments. But unfortunately the article is not a Greek ancient-wise talk [σοφςς].
But he’s right about the reprehensible statements made by some of the ransomware victims. It is outrageous that a company dares to claim that ‘only’ 300K has been paid.
(translated quote) “We understand that we are suffering reputation damage, but we can’t be blamed,” the company manager told reporters. That statement in the press will haunt him for a while.
And it’s not the first time we’ve witnessed such statements. For another company from the Westhoek (Western Belgian Region, near the coast) , it was “less than 1 million”…
It’s very meaningful, how little business leaders worry about ransomware or how careless they can be to protect their business.
And Brian puts forward a very nice theory how to stop ransomware, … in the ideal world.
But unfortunately, the article does not show in any way that the opinion-maker, in real life, has ever been on the side of a defenseless victim who is completely under the control of some remote criminal.
Because the choice to (NOT) pay a ransom is only available if you have a well-functioning and thoroughly tested backup and restore system.
At that moment, when it happens, all preventive measures have clearly failed already. Way too late to have regrets…
Prevention only works BEFORE the criminal strikes. Or when he has left again, to avoid repetition.
People do not choose to pay ransomware. It’s the last resort.
They just have no choice. All other means are already exhausted or unavailable.
You don’t pay a ransom if your backup/restore system works properly.
Without a guaranteed recovery function, mathematics is very simple
If you
DO NOT pay = 100% GUARANTEE that you LOSE your DATA and you’re almost certain that your company will also be dead very quickly, or at least suffer long-term or irreparable damage.
PAY = there is SOME chance that you may see (something) of your data again. That’s always better than the previous option, no matter what it costs.
The third option in between is that the cost of the ransom is lower than the real cost of restoring your data. If you run into a cheap criminal, you can only try to talk him out of it and limit the damage. Pure math.
What if…?
It’s very easy to imagine: if a good-looking homejacker just rings the doorbell at your home. And your dearest opens the heavily armed front door.
A few seconds later, the robber asks you to clear your bank account completely with a gun to your dearest one’s head.
Are you going to pay or not?!
Do you have a choice?!
Replacing your dearest… is not an option, I would think.
With ransomware, the situation is exactly the same.
Well, Brian Schippers apparently doesn’t think so.
In his article Mr. Schippers is very convinced that you should certainly not pay a ransom. But the article does not offer any concrete, useful solution or practical suggestion as alternative.
He talks about a “security solution”… and reading between the lines you easily know where it should come from.
But there is no mention of decent and continuous training of people, thorough awareness training and thorough backup/restore or even better offline backup, even in the current age of cloud.
Because with “wise” software alone, it won’t work.
Even with the best technical security you have, people remain the weak point.
And the stronger the security, the more crime will target people directly.
And people make mistakes. People make software. Each software contains errors.
And mistakes will always be exploited.
And you only need just one employee who is fooled by a cleverly designed, but infected mail or a noble unknown on the phone.
It happens in no time, there are more than enough statistics in practice.
Because the hack or phishing is so well designed these days, that even cyber professionals can’t easily detect fake mails.
“The budget should not be a problem.”
Yes, yes, of course it shouldn’t, Brian! Nice slogan.
NOT.
Because the practice proves something completely different:
cyber protection < a very small percent of the IT budget < a small percent of the company budget.
Well, now what?!
It would be quite different if business leaders and managers were personally held liable for a pertinent lack of “state-of-the-art” (i.e. up-to-date) security that aligns both people, processes and technology very well.
Only THAT would solve the whole ransomware problem, very quickly. Deprive the criminal from his leverage.
Don’t look too far. Just look at how the insurance companies are doing in real life.
See how they implement car, fire, liability or other insurance. If it is shown that you are negligent, knowingly refuse to implement sufficient security … then the insurance will not pay or will claim back the refund.
Easy and simple, isn’t it?
Not so in cyber insurance, that’s the wild west. For a couple a thousand Euros in insurance, you get a bag of money of a couple millions to pay the criminal.
You bet on hackers to give up.
And if you bet hackers will give up soon, start by giving a “tournée générale” (buying a beer to everyone).
Because cybercrime and ransomware is big business. They make a lot of money with crime, so they won’t give up. Not now, not ever.
[BTW, it’s not because known ransomware groups suddenly disappear that they’re gone too. We don’t know the facts about that yet…]
But criminals don’t respect any law or rule. And they certainly don’t have ethical principles. It’s just a business that makes a lot of money.
So they are always have a head start and they are very motivated. And they will twist your arm even harder… or worse.
Finally
We must keep repeating that state-of-the-art security is all about security solutions at different layers and levels, which look beyond technology.
When you keep claiming you should not pay for ransomware, you’re running after the facts. In practice, it doesn’t solve anything… People in distress and panic will ignore law and ethical guidelines.
Also in physical life, many authorities officially declare that they do not give in to ransom demands. Is paying a ransom prohibited by law? But in many cases, money is paid clandestinely. Reality check.
So?
Make sure that the liability for implementing poor security measures hurts the right person, in the right place. Not the employees, but their boss.
And consequently:
So make sure that cybersecurity is sponsored at the top management level.
Toegegeven, het is een geweldig opinie-artikel om een lekkere discussie met bedrijven op gang te trekken. Het helpt tenminste om de bewustwording van ransomware en losgeld aan te wakkeren. Maar het artikel is jammer genoeg geen Griekse oude-wijzen praat [σοφός].
En hij heeft wel gelijk over de laakbare uitlatingen van sommige slachtoffers. Het is schandalig dat een bedrijf durft beweren dat er ‘maar’ 300K betaald is.
Herinnert U het nog: “We begrijpen dat we imagoschade lijden, maar ons valt niks te verwijten.”, zei de bedrijfsverantwoordelijke in de pers. Die uitspraak in de pers zal ‘m nog wel een tijdje achtervolgen.
En het is niet de eerste keer dat we dergelijke uitspraken mogen noteren. Voor een ander bedrijf uit de Westhoek, was het “minder dan 1 miljoen”…
Het zegt heel veel, hoe weinig zorgen bedrijfsleiders zich maken over ransomware of hoe nonchalant ze kunnen zijn om hun bedrijf te beschermen.
En Brian heeft een heel leuke theorie om ransomware te stoppen in de ideale wereld.
Maar de tekst toont jammer genoeg op geen enkele manier dat de opiniemaker ooit met praktijkkennis aan de zijde heeft gestaan van ‘n weerloos slachtoffer dat volledig onder controle is van een of andere crimineel op afstand.
Want de keuze om losgeld (NIET) te betalen, heb je ENKEL EN ALLEEN als je een goedwerkend en grondig getest backup en restore systeem hebt.
Op zo’n moment hebben alle preventieve maatregelen duidelijk al gefaald. Dus dat zijn vijgen na Pasen.
Preventie werkt alleen VOOR de crimineel toeslaat. Of als ie weer vertrokken is, om herhaling te voorkomen.
Mensen kiezen niet om ransomware te betalen. Het is het laatste redmiddel.
Ze kunnen gewoon niet anders. Alle andere middelen zijn dan al uitgeput.
Je betaalt geen losgeld als je backup/restore systeem goed werkt.
Zonder gegarandeerde herstelfunctie is de wiskunde heel simpel
NIET betalen = 100% GARANTIE dat je je DATA KWIJT bent en zo goed als zeker dat je bedrijf ook heel snel kapot is, toch tenminste langdurige of onherstelbare schade lijdt.
BETALEN = enige kans dat je mogelijk nog (iets) van je data terug ziet. Da’s altijd beter dan vorige optie, wat het ook kost.
De derde optie hiertussen is dat de kost van het losgeld lager is als de reële kost om je data terug te zetten. Als je een goedkope crimineel tegenkomt, kan je maar proberen om ‘m om te praten en de schade te beperken. Pure wiskunde.
Wat als…?
Het is héél gemakkelijk voor te stellen: als een goedogende homejacker gewoon aanbelt bij je thuis. En je allerliefste doet de zwaar bewapende voordeur open.
Een paar seconden later vraagt de overvaller jou om je rekening volledig leeg te maken met een pistool tegen het hoofd van je allerliefste.
Ga je betalen of niet?!
Heb je keuze dan?!
Jouw allerliefste vervangen… is geen optie, zou ik denken.
Met ransomware is de situatie net hetzelfde.
Nou, Brian Schippers vindt dus blijkbaar van niet.
Mr. Schippers roept in z’n opinie artikel hoog van de toren dat je zeker geen losgeld mag betalen. Maar enige concrete, bruikbare oplossing of praktische suggestie biedt het artikel anders niet echt.
Hij spreekt volop over “security oplossing”…het schemert anders wel duidelijk door waar die vandaan moet komen.
Maar er wordt echter geen woord gerept over goede en continue opleiding van mensen, doorgedreven awareness training en doorgedreven backup/restore of beter nog offline backup, zelfs in het huidige cloudtijdperk.
Want met “wijze” software alleen, zal het niet lukken.
Zelfs met de beste technische beveiliging die je hebt, mensen blijven het zwakke punt.
En hoe sterker de beveiliging, hoe meer de criminaliteit zich op de persoon zelf richt.
En mensen maken fouten. Mensen maken software. Elke software bevat fouten.
En er zullen altijd fouten uitgebuit worden.
En je moet maar 1 medewerker hebben die om de tuin geleid wordt door een slim ontworpen, maar besmette mail of een nobele onbekende aan de telefoon.
Het is zo gebeurd, meer als genoeg cijfers in de praktijk.
Want de hack of phishing is tegenwoordig zo goed ontworpen dat zelfs cyberprofessionals vals en echt moeilijk kunnen uit elkaar houden.
“Het budget mag daarbij geen probleem zijn.”
Ja ja, tuurlijk mag dat niet, Brian! Mooie slogan.
NOT.
Want de praktijk zegt helemaal iets anders: cyberbescherming < een heel klein percent van ‘t IT budget < een klein percent van het bedrijfsbudget.
Nou, wat dan wel?
Het zou helemaal wat anders zijn als bedrijfsleiders en managers persoonlijk aansprakelijk zouden zijn voor een pertinent gebrek aan “state-of-the-art” (dus up-to-date) beveiliging die zowel personen, processen als technologie goed op mekaar afstemt.
DAT zou pas het hele ransomware probleem oplossen, heel snel.
Heel ver moet je niet kijken. Kijk maar hoe de verzekeringen het aanpakken in het fysieke leven.
Kijk wat toegepast wordt in auto-, brand-, aansprakelijkheids- of andere verzekering. Als aangetoond wordt dat je nalatig bent, willens en wetens weigert om voldoende beveiliging te spenderen … dan vordert de verzekering het terug.
Simpel toch?
Niet in cyberverzekering, dat is het wilde westen. Voor een koppel duizend Euro aan verzekering, zit je op een zak geld van een koppel miljoen Euro.
Wedden dat hackers het opgeven?
En als je erop wedt dat hackers het snel zullen opgeven, begin dan alvast maar met een tournée générale te geven.
Want cybercriminaliteit en ransomware is big business. Ze kunnen met misdaad veel geld verdienen, dus die geven niet op. Nu niet, nooit niet.
[BTW, het is niet omdat gekende ransomware groepen plots van de aardbol verdwijnen dat ze ook weg zijn. Daar weten we het fijne nog niet van…]
Maar criminelen houden zich aan geen enkele wet of regel. En ethische principes hebben ze al helemaal niet. Het is gewoon een business, die veel opbrengt.
Dus ze zijn altijd in het voordeel en erg gemotiveerd. En ze zullen je arm nog harder omwringen… of erger.
Tot slot
We moeten blijven herhalen dat goede beveiliging draait om beveilingsoplossingen op verschillende lagen en niveaus, die verder kijken als alleen maar technologie.
Je kan nog lang roeptoeteren dat je geen ransomware mag betalen. Dan loop je achter de feiten aan. Dat lost niets op in praktijk.
Ook in het fysieke leven, roepen heel wat staten officieel dat ze niet toegeven aan losgeldeisen. Is daar losgeld betalen bij wet verboden? Maar er wordt op veel plaatsen clandestien toch geld over tafel geschoven. Realiteit.
Dus?
Zorg dat de aansprakelijkheid voor gebrekkige veiligheid pijn doet, bij de juiste persoon, op de juiste plaats. Niet bij de werknemers, maar bij hun baas.
En bijgevolg,
Zorg dus dat cybersecurity gesponsord wordt op topmanagement niveau.
End 2020 IDG published a study on Security priorities, and it provides important guidelines to the priorities of securing yourself and your company
Protection of confidential and sensitive data
End-user awareness
Corporate resilience
Enhance access control
Understand external threats
Application security
Plan for unexpected risks
This pretty much confirms that your customers, stakeholder’s and staff interest in protecting personal data is driving security from business perspective.
If you see the increase of cyberattacks and ransomware hitting the business, it’s pretty obvious that Business Continuity Management and Disaster recovery must be on top of your priority list. You need to have a tested plan against successful cyberattacks and ransomware, to avoid extended business damage and massive (ransom) costs … afterwards.
To put a plan together, you need to understand who is your adversary and what the current state of cybersecurity is. And this study is a simple but smart guide to define your priorities.
The better you prepare, the less it will cost. But you’ll only be able to tell when it goes wrong.
Have you ever assessed the maturity of #cybersecurity implementation?
The #ZeroTrust#maturity model assessment by #Microsoft provides you with great insights, where to start or which part of your security needs improvement.
Easy to use, easy to understand, great results and great guidance.
Vind zoveel mogelijk phishing-indicatoren in de e-mail die ik onlangs heb ontvangen. Screenshot hieronder.
Hoeveel indicatoren kun je vinden?
Het nummer om te verslaan is 12.
Kun je ze vinden, of kan je het beter doen? (zo ja, twijfel niet om de indicatoren die je vond te melden in een commentaar).
Tip: Stop met verder te scrollen als je de uitdaging wilt aangaan, voordat ik hieronder de oplossing verklap.
Snelle oplossing: overzicht van de indicatoren
Belangrijk: De bizarre (onverwachte) naam van de afzender
Belangrijkste: Het e-mailadres van de afzender komt niet overeen met de naam
Heel belangrijk: Spelfouten
Zeer belangrijk: Slechte grammatica
Belangrijk: Verkeerde leestekens
Belangrijke fouten in het ontwerp / de lay-out
Uiterst belangrijk: URL komt niet overeen en wijst naar een phishing-website
Belangrijk: Gevoel van dringendheid: “Wachtwoord verloopt binnen (0) dagen”
Verdachte instructies (contra-intuïtief)
Productfouten
Verkeerde bedrijfsreferenties
E-mail voettekst ontbreekt (of afmeldlink ontbreekt of privacynote ontbreekt)
En aan het einde: een bonus (die is niet weergegeven in (en niet van toepassing op) het huidige voorbeeld screenshot).
De aanpak voor een gedetailleerde analyse
Over het algemeen zijn er 4 niveaus van indicatoren waar je op moet letten
het gemakkelijke deel, duidelijke zichtbare fouten
verborgen indicatoren, gemakkelijk te vinden (bijv. muisaanwijzer over de links, ZONDER te klikken!)
geavanceerde onderdelen, waarvoor je een beetje kennis nodig hebt
deskundige kennis / ervaring vereist
Ten eerste, het makkelijke deel.
De gemakkelijkst te vinden en meest zichtbare #phishing indicatoren
1. Belangrijk: De bizarre (onverwachte) naam van de afzender
In dit specifieke geval wordt de naam van de afzender gevormd uit:
het ontvangerdomein dat als voorvoegsel wordt gebruikt (ALARM!)
onvolledig e-maildomein achtervoegsel (ALARM!)
Taak: controleer de naam van de afzender.
Evaluatie: gealarmeerd zijn, als
de naam van de afzender heeft een vreemd, abnormaal formaat (
de afzender is niet bij u bekend,
de post wordt niet verwacht, een verrassing uit het niets
2. Het belangrijkste: Het e-mailadres van de afzender komt niet overeen
Het eenvoudige deel is om te controleren of de naam van de afzender overeenkomt met het e-mailadres van de afzender.
Dit is niet altijd zichtbaar, zeker niet op smartphones.
Taak: controleer expliciet het volledige e-mailadres.
Evaluatie: gealarmeerd zijn, als
de naam van de afzender komt niet overeen met het volledige e-mailadres
3. Heel belangrijk: Spelfouten
Hoewel phisher steeds meer “professioneel” wordt, zijn spelfouten een belangrijke indicator. Marketingbedrijven besteden (meestal) enige tijd om de grammatica goed te krijgen.
4. Zeer belangrijk: Slechte grammatica
In de voorbeeldmail ziet u de instructie “Gebruik hieronder om te bewaren” (EN: “Use below to keep…”)
Wat gebruiken??
Een goed gebruik van grammatica zou zijn: “Gebruik onderstaande link om uw wachtwoord te behouden.”
5. Belangrijk: Verkeerde leestekens
Naast slechte grammatica zijn verkeerde leestekens (spaties, stippen, komma’s, …) een belangrijke indicator voor spam, hoewel spammers tegenwoordig de neiging hebben om betere zorg te gebruiken om inhoud te bouwen.
6. Belangrijke fouten in het slechte ontwerp / lay-out
Controleren op belangrijke lay-outproblemen of HTML-fouten
De gevaarlijkste
7. Uiterst belangrijk: URL komt niet overeen en wijst naar een phishing-website
Een veel voorkomende phishing-techniek om u op malwarelinks te laten klikken.
Taak: controleer zorgvuldig de bron-URL door met de muis over de koppeling te gaan en de bron-URL weer te geven. Maar KLIK NIET op de link.
Taak: Controleer ALTIJD de bron-URL.
Evaluatie, moet u gealarmeerd zijn als
de URL komt niet overeen met het e-mailadresdomein van de afzender
de URL is een volledig onbekend domein
De phisher gebruikt mentale druk om je te laten klikken
8. Gevoel van urgentie: “Wachtwoord verloopt binnen (0) dagen”
De phisher probeert je hersenen te verkorten en dringt er bij je op aan om op de phishing-link te klikken, door het bericht zeer dringend te maken, waardoor je onmiddellijk actie moet ondernemen.
Niet doen.
NIET KLIKKEN, NIET HAASTEN.
Neem de tijd, een mail NEVER is urgent (denk aan het netiquette principe van het reageren op mail binnen 24 of 48 uur…).
Volwassen, openbare systemen sturen je ver van tevoren een heleboel meldingen. En “Wachtwoord verloopt binnen (0) dagen” is de verkeerde manier om u te vertellen “Wachtwoord is verlopen”.
9. Verdachte instructies
Denkt u echt dat een bedrijf u zou vragen om uw wachtwoord???
Integendeel, u wordt vaak gevraagd om uw wachtwoord te wijzigen of extra beveiligingsfuncties toe te voegen, zoals MFA.
Deze hebben wat meer onderzoek nodig
10. Productfout
Een tijdje geleden verplaatste Microsoft de Office online suite van “Office 365” naar “Microsoft 365″… dus de gebruikte productreferentie, is verkeerd. Microsoft verwijst in de huidige communicatie niet naar ‘Office 365’.
Toch kunnen sommige meldingen verwijzen naar Office 365… dit is dus niet altijd duidelijk of gemakkelijk te detecteren.
11. Verkeerde bedrijfsreferentie
Niet altijd te gemakkelijk te detecteren, maar in de e-mailvoettekst verwijst Microsoft niet naar zichzelf als gewoon “(C) 2021 Microsoft”, maar het moet “Microsoft Corporation” zijn en heeft een link naar de privacyverklaring en / of afmeldopties
Er is meer
12. Mail footer ontbreekt
Wat u van een gerespecteerd bedrijf kunt verwachten, is een e-mailvoettekst met aanvullende instructies, zoals privacyverklaring, afmeldfunctie, raadpleeg uw profiel of open de beheerdersinterface om uw profiel en beveiliging te beheren.
Enkele voorbeelden:
E-mails van het Microsoft 365-beheercentrum eindigen op :
Wanneer het e-mailreputatiesysteem u helpt…
Mail wordt in de spam folder gestoken
wanneer de e-mail is gedetecteerd als spam, als gevolg van een slechte e-mailreputatie van het afzender- of afzenderdomein, zal uw e-mailsysteem (server/client) de e-mail markeren als spam. Ter informatie gebruikt Microsoft de e-mailclient, Microsoft smartscreen en defender intelligence om e-mails te markeren voor spam.
controleer beter de e-mails in de spammap, omdat deze vals-positief kunnen zijn (legitieme e-mails gemarkeerd als spam)
Antimalware tagt de e-mail als [spam]
veel anti-malware / anti-virus programma’s hebben een spam / phishing-controle, die de e-mail als verdacht markeert en naar spam verplaatst. Deze programma’s gebruiken de virus-/spamdefinities van de leverancier.
Wat moet je doen met phishing mail?
ZORG ER ZEKER VOOR dat
je de mail aangeeft bij lokale cyberautoriteiten (bv. in België, stuur verdachte post door naar SafeOnWeb, via suspicious@safeonweb.be)
je de e-mail markeert als spam in uw e-mailclient of antivirusprogramma’s (zodat Microsoft of uw antivirusprogramma de e-mail kan analyseren om hun spamdefinities bij te werken.)
je jouw contacten/afzenders waarschuwt als ze u spam- of phishingmails sturen. Hun systeem kan geïnfecteerd of gehackt zijn.
You’ve probably got one or more personal and professional mail addresses. Who doesn’t?
And you probably want to keep that mail address safe from spammers, scammers or data theft.
Althoug you primarily use mail to communicate (send/receive messages), many platforms also use your mail address for authentication.
Security remark: It’s not always the best option to use single sign-on with platforms like LinkedIn, Facebook, Microsoft Account, Google, …
What’s the security issue?
The main issue with single sign-on is: when your mail address is breached or hacked, the hacker can use the breached mailbox fairly easily to login to the linked platforms.
And from a practical point of view, if you use that single personal mail address to subscribe to newsletters or you use that mail address for downloads protected by a “registration” wall, you’ll quickly experience a mailbox overload because of ‘spam’, eh.. .sorry commercial messages you didn’t ask for.
Another issue is, you usually have only 1 (one) personal mail address available on your mail platform, certainly for enterprise systems, you can’t create other alternative mail addresses at free will. Unless you own the domain name, of course, but that’s rather possible for personal use or small companies…
And except for the mail overload, you’ll notice that many companies sell your mail address to address brokers. And even with the GDPR in place, many of these address brokers have bad habits to scrape mail addresses from the internet, incl. public sources, government sources…
So, the question is, how do you manage this, to protect your personal data, to protect mailbox overload and abuse of your mail address?
First option is using MFA to increase security and block illegal authentication.
But MFA does not stop mail abuse. The mail alias to the rescue!
Implementing the mail alias
What is a mail alias?
A mail alias is an alternative name for the master mailbox. Usually a mail alias is forwarding mail to the target mailbox.
In many cases, that mail alias can also be setup or used as a temporary name for the target mailbox. It’s pretty cumbersome or difficult to switch a master mailbox on or off when you need it.
Purchase a Custom domain name
The most interesting option is purchasing a custom domain name (by preference a short URL).
In most cases, local domain registrars can offer you a custom mail domain of choice for a few bucks a year. It’s worth the money, I promise. Further explanation below.
Just a practical hint: make sure to use a domain registrar that offers unlimited mail aliases.
When you control the mail domain, you can forward any mail alias of the custom domain to your mailbox (eg news@short.url to subscribe to newsletters and filter them in your mailbox in a subfolder for newsletters).
Furthermore, when you own a domain, you can enable/disable a mailbox or alias. Meaning: block mail reception without deleting the mail address (keep the address, but desactivate it.)
Using the “+” mail alias option
If purchasing a custom domain is not an option, you can check with your mail platform or mail administrator to use a “+” alias.
That’s format supported by the internet standards (RFC 5233: https://tools.ietf.org/html/rfc5233), that allows to extend a master mail address with receiver suffixes (BEFORE the @ sign), that still deliver the mail to the receiver. Google calls it “task based” variations of the mail address.
You’ll generally find it back on the internet as “+” aliases (“plus” aliases).
See the references section at the end of the article, for details how this “+” alias works for the well known mail platforms… Google, Microsoft, … and the major free mail providers support the plus-alias.
Using dummy or temporary addresses against spam and registration walls
I don’t know how you do it, but it frequently happens that I need to download a “free” white paper, which only seems to be free if you ‘pay’ with your contact details.
In most of the cases, they force you to “consent” with the requirement to send you marketing,… in GDPR terms it’s not considered consent if it’s forced… But essentially they force you to submit your personal data.
If you don’t want to disclose your data, just for that single download, or … if you want to avoid getting too much spam, what do you do?
One-time use, temporary mail domains (not your own domain)
First and easy option is to search the internet for “temp mail”, “temporary mail addresses” or “disposable mail“, … synonyms for one time use mails.
You use these addresses for quick use, one shot hit.
Samples:
mailinator.com
temp-mail.org
guerillamail.com
mail.tm
many more…
Use your custom domain
An easier, but less free, but still cheap option, is to purchase your own custom domain (on the condition you can have multiple mailbox aliases).
The quick and dirty: create an alias like download@yourdomain.url, keep it disabled by default and only enable it when you need to receive a download link. Afterwards, disable it again.
In some cases you literally need to have a mail address just once. Eg, when you want to download a “free” white paper, many companies harvest your mail, put it in a CRM system and keep spamming you afterwards. It’s fairly difficult to escape the forced consent or registration.
Then you can use a temporary mail alias:
you enable an alias or dummy address,
register for the download with the alias/dummy,
then disable the alternative mail address again.
That way the address cannot be harvested for spam or marketing you don’t need. Easy.
(When a address broker tries to use the disabled alias, they will get an NDR, non-delivery report, and delete the invalid mail registration from their farm…)
Advantages
Keep your inbox clean : Mail filtering using simple mail rules
One the most prominent advantages of using aliases is that most of the mail clients can use the receiver address (or alias) to filter and manage incoming mail.
Based on the target receiver alias, you can set simple rules to move incoming mail from your inbox to another folder.
Basically an mail alias offers a simple mailbox optimization technique to make your life easy.
Securing internet logins
Another major advantage of aliases: use it as an alternative identifier for single sign-on.
Instead of logging in to multiple platforms with the same mail address,you better use 1 unique alias address per platform.
Of course it’s quite important to use different passwords or authentication methods too (incl. MFA).
The main reasoning behind this approach is: if 1 login is breached or leaked, the other accounts are not impacted. If you don’t think you can manage this collection of passwords, there is one good tip: use a password manager to replace your memory.
Use a password manager anyway.
Detecting data breaches
When you use 1 mail address (alias) for every internet login, you can also trace very easily if a website is selling your data to partners, other companies or personal data brokers. You can simply see who sends mail, if that source domain is correctly linked to your alias… or not. If your login is used by unauthorized party you can initiate GDPR subject data access request to track how it got there (against both the original data controller and the secondary party).
And when using a custom domain (or some “+” alias mail providers), you can simple disable or remove the mail alias, so it becomes useless for the perpetrators.
On/Off Temporary mail (when using your custom domain)
In some cases you literally need to have a mail address just once. Eg, when you want to download a “free” white paper, many companies harvest your mail, put it in a CRM system and keep spamming you afterwards. It’s fairly difficult to escape the forced consent or registration.
When you can use a temporary mail, you enable an alias or dummy address, register for the download with the alias/dummy, then disable the alternative mail address again. That way the address cannot be used for spam or marketing you don’t want. Easy.
One-time use temporary mail domains
First and easy option is to search the internet for “temp mail” or “temporary mail addresses”
You use these addresses for quick use, one shot hit. No hassle, no admin. Quick and dirty.
Some more advantages
You can also link your custom domain to shortener tools like bit.ly. This way you can manage your social media and easily track your popularity or maintain statistics on your articles and views. (For Bitly, search for “bitly custom domain”)
Disadvantages
Custom domain management
Managing your own custom domain might be cumbersome, depending how user friendly the management of aliases is. Certainly managing dynamic aliases for multiple users… can time consuming. Certainly if you have a large volume of mailboxes and/or aliases to manage.
But managing a custom domain for own personal use, for a few bucks a year, is really worth the time and money.
If you cannot disable “+” aliases …
… then you might be in trouble, because you cannot stop the abuse once the senders have registered the alias in their mail system.
In many cases, you’ll need to unsubscribe or directly contact the platform owner and demand to remove your data, which can be cumbersome or time consuming… Or you need to excercise your right to be forgotten in the official way. (Ref. GDPR, …)
Temporary mail domains blocked & open access
The major disadvantage is that a lot of spam (eh sorry), marketing websites that offer these ‘free’ downloads, will recognize and block public temporary mail domains (like mailinator, guerilla mail, temp mail, …).
In most cases you’ll have to try a few options, as some of these temporary mail domains have alternative mail domain options, like dynamic domains not only hosting main on the master domain.
VERY IMPORANT SECURITY NOTICE: whatever mailbox you use on these temporary domains, anyone can read or access these mailboxes, so make sure nothing important or private is sent to these mailboxes.
Bonus: the “oh shit rule”
While I’ve been focusing on the security & data protection features of the mail alias, I still want to mention an important principle to protect your reputation: the “oh shit rule”.
The principle is simple: delay the sent articles with one or more minutes before the mails are actually sent to the receiver.
It gives you a bit of slack if you want to fix a mail, or in worst case scenario cancel the mail if you have second thoughts or regret sending the mail, to avoid embarrassment or being forced to search for a new job.
Some useful references
Below you’ll find some interesting articles on managing aliases on the well-known mail providers
Other providers, like Protonmail, … also provide the alias “+” option, sometimes by default. Carefully check if you can remove the “+” alias or not, in case the alias got listed by address brokers.
“This warning is displayed when your ESET product detects that the security certificate for a website is revoked.
ESET cannot resolve the issue because only the owner of a domain can renew their security certificate. You cannot choose to continue to the site using the insecure certificate.”
How do you double check this information?
The ESET forums point to a very interesting and eays to use tool: SSLTest at SSLLabs.com
Then you can enter the URL of the website you want to visit or check…
Depending the status of the website (good…or bad), it will take a few seconds… to minutes… to scan the website and show the quality of the certificate.
In this case, it’s fairly clear why the website was blocked:
Just for your reference if you would check a website like: https://docs.microsoft.com, you’ll get A+ (that’s the other end of the scale..)
If you want to know more about the website rating, check the SSLLabs rating guide:
The grading results in a score from A (top), (B) good, (C) average .. to (F) big fail lowest score …
So, it’s a very handy and free tool to check your website for issues.
Why are these websites not blocked by other tools or browsers?
First of all, check if you have an anti-virus or antimalware tool that checks the URL.
Because other browsers, apps or URL filters will not always check for the CRL (the certificate revocation list, containing certificates that are no longer valid…).
Or the CRL is not updated or and old CRL is cached. The ESET KB article mentioned, explains how to clear the CRL cache on your system.
Other interesting tools
The website (or mail) certificate is just one of the security indicators … If you want to check the reputation of your URL, domain, website, mail system, DNS, … there are some more interesting tools you should have at hand, like https://mxtoolbox.com/NetworkTools.aspx.
Quite a while ago I posted an article on web and mail reputation, there is some more interesting free tools you can use to check the domain reputation.
This situation show how easy it is to land on a website using revoked or unverified certificates…
Make sure to use a decent anti-malware and anti-virus tool. It’s worth to spend a small bit of money to protect your systems.
And if you combine it with some free tools to check the health of (your) websites and systems… you can achieve a decent level of security without spending a lot of money.
You must be logged in to post a comment.