cybersecurity

Risk treatment options parody

The orginal meme on risk analysis is around for a while on the internet.

But risk management is only complete with risk treatment.

(original quality below)

risk_treatment_options.png

Advertisements

Please be aware of EUDT. BE unethical and dirty domain sales tricks (EN version)

fraudwarning

For the last 2 months I have been receiving some fraudulent, unethical and threatening mails from a company named “European Domains & Trademarks”, with the e-mail domain EUDT.BE, registered company name “Domeinnaam Register”.

The company is linked to: http://www.domeinnaamregister.com/ en http://www.nederlandsdomeinregister.nl/
In the Netherlands the company is registered as KVK: 64626679 and VAT: NL201158802B01. (as published on their website, the commerce register and DNS registrar).

The company is making false claims and is using unethical practices, and scaring people to extort money and scamming people into ridiculous expensive and fraudulent contracts.

The official registration owner of this URL and company is a Dutch company that is a very well known for very bad scamming practices.
And also the Belgian domain registration authority is warning for this company:
https://www.dnsbelgium.be/en/news/watch-out-domain-name-offers-domeinnaamregistercom

This is not their first warning, it already was reported in 2013 and 2016 (see below).

Also in the Netherlands, this organization is known and has been reported for the same malpractices before, like:

What it is about?

See full text at end of this post.

In short, he company contacts people, entrepreneurs, company owners pretending that they received a request to register a domain name (like company.nl) similar to the company domain you already registered (like company.com) and that they are legally forced to contact you to offer the first registration.

Next they say that they are obliged to register and protect the domain name for 10 year for €19.75 (ex VAT!) per year. And you need to pay this in one shot.

And a lot more bullshit in the mail…

What should you do?

  • DO NOT react to the mail, and ignore the mail,
  • before deleting the mail: report these practices to the authorities (eg Ministry of Economic Affairs)

If you really want that domain

  • DO NOT react to the mail, ignore the mail, delete the mail
  • contact your favorite, official and trusted registrar and by the domain via the regular / official channel

Why is this bullshit?

Please be aware that

  • domain registration is on a “first come, first serve” basis (unless it’s a malicious registration to harm a target company)
  • domains like .BE,  .NL, EU… cost about €6, €8, … 12 EUR per year.
  • Some registrars offer decent discounts, so it can be even cheaper.
  • You can renew domains YEARLY, no need to pay 10 years upfront.

See also

(BE-NL) Verkooptrucs met domeinnamen (*) (Credits: Dries Van Giel op 15 juni 2018)

More information

Credits: Dries Van Giel (*)

Belgium

Official warnings by DNS.BE

Official registrars

Warnings from official domain registrars and site hosters (no strings attached!)

Log a complaint at

If you’re already been caught by these #holes, you can register a complaint at: https://meldpunt.belgie.be/meldpunt/nl/welkommeldpunt.belgie.be

Netherlands

Full text (NL)

(Source: Happywebsites)

Geachte heer/mevrouw ,

Recent hebben wij telefonisch contact met u op proberen te nemen. Dit is tot op heden nog niet gelukt. We sturen u dus een email met daarin informatie over het volgende:
We hebben een aanvraag binnen gekregen om de website http://www.questforsecurity.eu te laten registreren. We zien in ons systeem dat u de eigenaar bent van http://www.questforsecurity.be. Helaas kan dit voor u in de toekomst verstrekkende gevolgen hebben. We zijn daarom dus wettelijk verplicht om contact met u op te nemen om u het eerste registratierecht te bieden. Dit houdt in dat wij de aanvraag van de derde partij afwijzen en de website:

http://www.questforsecurity.eu

Na een akkoord zullen doorlinken naar:

http://www.questforsecurity.be

Het komt er op neer dat u de eerste optie op de domeinnaam krijgt, dit om eventuele problemen in de toekomst te voorkomen. De aanvraag is gedaan vanuit de regio Antwerpen.
Doorgaans zijn wij verplicht om de domeinnaam voor 10 jaar vast te leggen en te beschermen. De jaarlijkse prijs voor de .EU extensie is € 19,75 per jaar. Dit betekent dus een eenmalig bedrag van €197,50. Wanneer de doorlink voltooid is, zal al het verkeer wat naar de .EU extensie gaat, automatisch op uw .BE extensie terecht komen. De verwerking hiervan duurt maximaal 24 uur. Deze domeinnaam is dan wereldwijd bereikbaar. De derde partij wordt afgewezen en deze kan niks met uw domeinnaam doen.
Overige informatie:

U ontvangt een eenmalige factuur van €197,50 exclusief BTW voor een looptijd van 10 jaar.

Na een jaar kan het ten alle tijden geannuleerd worden. U krijgt dan het resterende aantal jaren op uw rekening teruggestort.

Indien u hiermee akkoord gaat, stuur dan binnen 24 uur na ontvangen van deze email een akkoord per mail naar met daarin uw naam, en factuurgegevens naar; bart@eudt.be
Hierop volgend gaan wij de derde partij afwijzen en de doorlink in orde maken. U krijgt dezelfde dag nog alles per mail toegestuurd met alle informatie die u nodig heeft.

Met vriendelijke groeten,

Bart Mulder
European Domains & Trademarks
http://www.eudt.be
bart@eudt.be

And also

…
Reynaud Laurent
European Domains & Trademarks
http://www.eudt.be
reynaud.laurent@eudt.be

Better be smart.
Be safe.

And I hope these ### will be stopped sooner than later.

Note-to-self: prepping for CSA CCSK v4 upgrade

Note-to-self: extended reprint of a LinkedIn post…

I might have mentioned it already, but if you have passed the CCSK exam before, better logon to your CCSK profile on the CSA website and check if you still have an exam token left.

By default you get 2 tokens each exam registration, so…

If you pass your exam the first time, the “second try” backup token is left unused in your profile.

And (if not yet expired) you can use it to upgrade your CCSK to v4.

Tokens stay valid for 2 years after purchase.

More info: https://ccsk.cloudsecurityalliance.org/en/faq

On that page you can also find the required study material for the exam.

You can download the CCSK v4 prep kit from : https://downloads.cloudsecurityalliance.org/ccsk/CCSKv4_Exam_Preparation_Kit.zip

It’s an online exam and thus open book exam, using the below reference guides.

But realise:  60 questions in 90 minutes still is hard work, so better do some prep work up front to maximize your chances.

Once you pass this one, you can go for the (ISC)² CCSP with more confidence…

Useful resources for GDPR starters

I realise, this braindump will never be finished, so come back once in a while to check for updates. Work in progress…

But let’s turn around the thing a bit, you certainly must have smart ideas or articles on GDPR for starters that belong on this list! Let me know and I’ll add it to the list.
Of course, with the proper credits!

DISCLAIMER: These resources are provided / authored by different people, companies, vendors, each of them copyrighted by the original owner.
The resources below are just a collection or interesting documentation, need to have, without any preference or commercial interest for any party.

Table of contents

First of all, before you start with GDPR you must have read the GDPR text.
It’s not as bad (you mean: legalese) as you might suspect.

GDPR official text

You might want to have it a bit more condensed to start.

Vocabulary / Grammar

Do not get confused: European Council vs Council of the European Union vs Council of Europe

More info at:

– http://www.caneurope.org/publications/blogs/1295-what-is-the-european-council-or-the-council-of-the-european-union%C2%A0

– https://www.coe.int/en/web/about-us/do-not-get-confused

GDPR Table of contents

Once you get through the legal texts… you’ll quickly understand that the GDPR text itself at least lacks 1 important thing: A table of contents (TOC).

This TOC by Intersoft Consulting might help: bookmark https://gdpr-info.eu/

It provides a nice overview of the GDPR Recitals (= reasons the articles of the GDPR have been adopted).

There are 173 recitals, the and the TOC provides a quick topic overview at https://gdpr-info.eu/recitals/.

Also the site provides an overview of the GDPR structure

  • 11 Chapters
  • Sections per chapter
  • 99 Articles (spread over sections / chapters

GDPR Library by EC

https://ec.europa.eu/commission/priorities/justice-and-fundamental-rights/data-protection/2018-reform-eu-data-protection-rules_en

GDPR Adequacy decisions

Working Party 29

http://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:31995L0046

“The composition and purpose of Art. 29 WP was set out in Article 29 of the Data Protection Directive, and it was launched in 1996.”

https://en.wikipedia.org/wiki/Article_29_Data_Protection_Working_Party

The European Data Protection Board (EDPB) will replace the Article 29 Working Party under the EU General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679).

WP29 articles

Newsroom overview: http://ec.europa.eu/newsroom/article29/news.cfm
Guidelines: http://ec.europa.eu/newsroom/article29/news.cfm?item_type=1360

WP 29 Advisory

The Article 29 Working Party Issues Final Guidelines on Data Protection Officers (“DPO”) is available here.

More info

  • Bird & Bird article, explaining
    1. Accountability means that DPO assessments need to be kept up-to-date and can be requested at anytime
    2. No “a la carte” DPO appointments
    3. Big data now an example of ‘regular and systematic monitoring’
    4. Preferably, the DPO should be located within this EU
    5. There can only be one DPO, but supported by a team
    6. Duty to ensure the confidentiality of communications between the DPO and employees
    7. Senior managers including Head of HR, Marketing or IT individuals are barred from serving as the DPO
    8. The GDPR does not prevent the DPO from maintaining records of processing
  • For a redline comparison with the earlier draft, click here.

ISO Standards related to GDPR

ISO29100 (Privacy Framework)

PIA: ISO 29134

Get the ISO29100 privacy standard for free at:

http://standards.iso.org/ittf/PubliclyAvailableStandards/c045123_ISO_IEC_29100_2011.zip

ISO27001 (Information Security)

Mandatory ISO27001 documents: ISMS mandatory documentation checklist

Mapping GDPR to ISO27001 schema

Implementing GDPR with ISO27001

https://pecb.com/oldwebinar/26-may-2018-from-gdpr-to-sustainable-gdp

GDPR at a glance

https://www.twobirds.com/~/media/pdfs/gdpr-pdfs/bird–bird–guide-to-the-general-data-protection-regulation.pdf (Credits for Moritz Anders).

Data access request

As published on LinkedIn: The Nightmare Letter: A Subject Access Request under GDPR (By: Constantine Karbaliotis)

You can download the docx Word version in EN (here) and in NL translated version (here).

Useful Tools

Open Source

Monarc – Risk Assessment: http://Monarc.lu

CNIL – DPIA Tool 

CNIL guides for PIA: https://www.cnil.fr/en/PIA-privacy-impact-assessment-en

 

Visualisation sheet

Have a look what Jonas Holdensen has published, a marvelous sheet to provide a visualization on GDPR.

Also he has provided a nice overview on the DPO requirements & tasks under GDPR.

If you prefer the file in pdf or word, then download the file here: www.kortlink.dk/rhpx

GDPR Privacy Courses (work in progress)

Region Provider Course URL
WW IAPP CIPT, CIPP/E, CIPM, https://iapp.org/train/gdprready/
WW PECB PECB Certified Data protection Officer https://pecb.com/en/education-and-certification-for-individuals/gdpr
BE DP Institute Data Protection Officer Certificatie Training https://www.dp-institute.eu/nl/opleidingen/
WW IT Governance GDPR https://www.itgovernance.co.uk/data-protection-dpa-and-eu-data-protection-regulation
WW Cranium GDPR & Privacy

And some more

Legislative background

 

Microsoft resources for GDPR

The page below is a (growing) overview of resources for GDPR info and compliance by Microsoft. The page is updated with other sources I find on my quest for GDPR.

General Resources

Trust Center

Microsoft 365 Enterprise

Online

Assess your readiness for GDPR now

MS partner network

https://partner.microsoft.com/en-us/marketing/details/gdpr#/

Compliance manager

Learn more about Compliance Manager.  Read the Tech Community blog

Sign up for the Compliance Manager public preview program

Blogs

Videos

Tools

Downloads

Note-to-self: MVA Learning Path – Security for the Chief Security Officer (CSO)

From a LinkedIn connection (thx Jeff and congratz on the achievement) I received an interesting pointer to a set of courses on MVA, Microsoft Virtual Academy.

An MVA ‘learning path’ is a combination of learning courses.
Just recently MVA published the ‘Security for the Chief Security Officer (CSO)’ learning path.

Check it out at : https://mva.microsoft.com/learning-path/security-for-the-chief-security-officer-cso-21

It combines 6 courses (better make sure to access them from the learning path):

  1. How to Harden Your Enterprise in Today’s Threat Landscape
  2. Cybersecurity Reference Architecture
  3. Planning for a Security Incident
  4. Cloud Security from the Field
  5. Securing Privileged Access
  6. Introduction to Azure Security Center

BTW: have a look on the ‘security’ based content on Microsoft Virtual Academy, you’ll be surprised how much you can (continue to) learn.

See: https://mva.microsoft.com/search/SearchResults.aspx#!q=security

That alphabet of Security starts with I of “Identity”

It’s an understatement to say security is moving fast, it’s changing very rapidly and the pressure to keep up with it, increases too.

From various angles, people in IT (as in Information Technology), are under fire to keep the infrastructure secure. Cloud is getting mature, new features pop up every week.
It’s almost a contradiction, but also legislation is catching up to close the holes regarding the protection of people’s security and privacy.

In many cases, the first reaction of customers, management, ITPros, Developers, DevOps,… is to look for the ultimate and ideal tool that will help to plug the security hole.

But if you only focus on the tooling, you’ll discover rather sooner than later, it is not sufficient to get your security watertight.
One of the basic reasons is that tools can’t be implemented properly without involving people and processes. I don’t need to explain the PPT (people-proces-technology) or PPP (people-proces-products) triade, right?

Lots of security management approaches and certifications handle this triad (ISO27001, CISSP, … I’ll cover that another time.

(credits: smart picture of ITGovernance.co.uk)

Rather than diving into the search for a tool, you better take a step back and consider first.

What’s the primary function of security?
Protecting an item that you want to keep (safe), right?

[The reason (“why”) for keeping it safe = the CIA triad, Confidentiality, Integrity and Availability]

When you think about the processes (“how”) to secure  an asset (anything that is worth securing), there are 3 basics actions you need to define

  • authorization: what you can do with the asset (the CRUD stuff, create/read/update/delete)
  • identification: who needs the authorization?
  • authentication: the method to proof your identity (using passwords, passes, cards, 2FA, MFA, …)

This is essentially the foundation of my credo “no security without identity”

Just by interpreting the basic components of security, you directly hit the “PROCESS” part of the PPT triad.
Now, here’s were most technical people get into trouble… not knowing how to put this in practice.

But let me ask you a simple question: within the normal, usual businesses or companies, where does the identity process typically start?
Yes, correct, HR (Human Resources)

The second question: can you name at least 2 typical high-level HR processes (for people).
Answer: something like “hire” and “fire”, or synonyms like “onboarding/off-boarding”, “termination”, “end-of-life” (but that sounds pretty dramatic when talking about people…).

These 2 events announce the beginning and the end of a lifecycle, the identity lifecycle.
And to make it complete, you also need to define the life-in-between as people change over time.

BTW, just a small side step here: this does not apply to humans only, but any other asset in your environment has pretty much the same cycle and it does not matter if it’s considered “IT” or not… computer, certificates, smart cards, disks, tapes, … but also cars, documents, …

This idea to consider the lifecycle as universal, is a great approach to explain the “identity lifecycle” to non-techies that get involved in the identity lifecycle processes.

This is the common ground you can use to talk to HR people, business managers, Executive level, …

Now, if you look on the internet for pictures on identity lifecycle management, you’re smashed with a lot of complex schemas…

google_identitylifecycle

Many of results are variations of 3 essential processes

hire-change-fire1

Depending on your background you might name them differently, like:

1AA.png

For the sake of simplicity, when teaching IDM and security workshops I usually only keep the keywords “Hire”, “Change” and “Fire”.
Short and easy to remember for most people.

For your understanding, the circle approach  would assume you start over again after the “Fire” block, but that’s not always the case. The cycle might stop.
So, the approach below is easier to visualize for most people.

Clockwise:

  1. Starting the cycle at (1),
  2. updating the identity at (2),
  3. exiting the cycle at (3)

hire-change-fire2

As I mentioned, earlier, virtually any IT or asset related proces is basically working like this.

Now, let’s take it a step further… How does identity management control security?

A first thing to consider is the typical length of the hire-change-fire modules.

How many tasks/steps does it usually take to complete each of the 3 steps?
Keep the asset in mind and keep it simple…

Typical actions in a hire process:

  • signing contract
  • getting an network/AD account
  • getting an email address
  • getting building access
  • IT stuff (laptop, …)
  • …

Pretty straight forward…
How much time would it take, in simple cases to start working?  Hours if not days.

What about the change process? For example, you get promotion to team lead or head of department…

  • hand over your tasks to peers
  • get ramped up on new job
  • in some cases, there is segregation of duties, getting rid of existing rights permissions
  •  getting access to new environment
  • changing communications channels (notifications to stakeholders of change)
  • …

In reality, this usually takes a few weeks.

And what are the typical things your consider for the “fire” process?

  • informing stakeholders/customers
  • disabling the account
  • changing password
  • lock account
  • removing access
  • extracting documentation form personal storage
  • move documents to manager or team
  • handing over ownership
  • knowledge transfer
  • data backup/archiving
  • cleaning the mailbox
  • deleting the account (* not always allowed for various reasons)
  • sending legal / tax documents
  • and more…

As you can understand, this entire termination process might take months… In many situations the termination process must be executed in different steps, like:

  • Disabling the account till x+30 days (for example, revert in case the person gets a renewal)
  • Removing access on x+60 days
  • Kill mailbox on X+90
  • Remove the account on X+1y (or even: never)

In some cases accounts must be kept for legal reasons or tracking/cybersecurity reasons…

The further you go in the lifecycle, you need to combine more tasks, and tasks or decisions get more complex.

Overall you can distinguish 2 properties of these processes: duration and complexity. Both go up.

complexity

procesduration

Now, when considering security, why is this important?
Instead of discussing the impact of successful processes, it’s easier to find out what happens if it fails.

WHAT IF… (the process fails)??

Let’s run through the cycle again….

What if the “Hire” process fails?

  • you can’t access the building
  • you do not get an account
  • you can’t logon
  • you can’t access documents
  • …

Basically, on your first (few) day(s) you can’t work. Sorry!
But what’s the balance for security: just great, because the risk is nearly 0, except for a bad start and a bit of reputation damage..
At the end: you can’t do any harm, essentially.

In case of the “change” process, a larger part of the tasks and operations will impact the security posture.

When your “change” process fails,  for example

  • you can still access your old documents
  • you get more access (eg collecting access of your old and new role)
  • you start collection sensitive accesses over time
  • managers don’t know
  • user profiles get copied from existing colleagues in the same team (no ‘reset’ or the permissions before the new ones are assigned)
  • …

So for this second piece of the circle, the impact might be significant, over time.

But for the “end-of-life” the story is completely different, a failing “deprovisioning” scenario has major impact on the business and IT process

  • accounts stay active
  • accounts not being disabled
  • access not removed
  • active accounts not detected
  • account with highly privileged access still active
  • accounts being deleted too soon
  • unauthorized users that have access to critical resources
  • hackers go undetected for a long time, using sleeping accounts
  • hardware not returned,
  • data stolen,
  • over-use of budgets to software licenses that are not revoked
  • access badges allow unauthorized access to your building and environment
  • failure to ‘deprovision’ old hard disks properly expose your company data to interested (unauthorized) parties…
  • …,

It’s clear that a failing deprovisioning/end-of-life process has major impact on your enterprise security.

risk.png

And hackers or disgruntled employees like that.

Of course you can imagine the benefits of an efficient and effective end-of-life process. It’s the opposite.

Does that require you implement an automated identity management?
No.

That’s where ISO27001 and eg GDPR surprises a lot of people.

Once you’ve got the basic processes in place you can discuss tooling, not the other way around.

questforsecurity

You have
no security without managing your identity.

you want
no identity without security.

Did I mention  that I’ll be presenting more of this fun stuff on TechoRama 2017.
Check it out here: http://sched.co/9M94

I’m very proud to present a session on the ABC of identity: Maximizing security with 10 simple processes.