Security

Image by mohamed Hassan from Pixabay

Note-to-self: KopieID (to blur your ID card fotocopy)

Source:

As explained here (in Dutch) and here (Dutch), it’s a terrible ID (sorry, idea), to copy your identity card and hand over the unprotected copy to someone….

Therefore it’s highly interesting to protect the photocopy against abuse, in the ultimate case you need a photocopy of your identity card…

KopieID NL

In the Netherlands the government has provided an app for your mobile phone, to take a photo of your ID and then blur the redundant information and to add a remark / watermark to indicate the purpose limitation.

Check it out here:

They also provide an interesting video explanation:

KopieID BE

In Belgium, there is a website (without app) that does the same, see here:

References

Source articles:

Reference material from the articles:

Picture credits: Image by mohamed Hassan from Pixabay 

Image source: https://pixabay.com/illustrations/hack-fraud-card-code-computer-3671982/

Note-to-self: SOC2 mapping to ISO27001

Just in case you get into SOC2 and want to know how to map it to existing information security implementation, whatever it may be, GDPR, ISO27001, NIST, … check this page

https://www.aicpa.org/interestareas/frc/assuranceadvisoryservices/mappingsrelevanttothesocsuiteofservices.html

It includes:

These links have nice XLS format sheets, with a bidirectional comparison between the frameworks.

Info on SOC1/SOC2/SOC3

https://www.aicpa.org/interestareas/frc/assuranceadvisoryservices/sorhome.html

SOC and SOX?

 SOC reports refer to an audit of internal controls to ensure data security, minimal waste, and shareholder confidence; SOX relates to government-issued record keeping and financial information disclosure standards law. In other words, one is about keeping information safe, and the other is about keeping corporations in check.

https://immedis.com/blog/what-are-the-key-differences-between-soc-and-sox/

https://www.logicgate.com/blog/a-comparison-of-soc-and-sox-compliance/

Also

https://linfordco.com/blog/soc-2-security-vs-iso-27001-certification/

(braindump article, still in progress)

CCSP and CCAK, not versus: build your cloud security expertise path based on your needs.

Last week (ISC)² published a blog post on the choice between CCSP and CCAK.

You can find it here: https://www.isc2.org/articles/CCSP-versus-csa-ccak.

“What is the right certification for you?”

The main title of the (ISC)² article on CCSP vs CCAK is “CCSP Certification vs. CCAK Certificate: What Are the Distinctions?”

That’s exactly what you get. A list of technical differentiators between CCSP and CCAK, but according to (ISC)².

But if you hope to get an actual answer to what the right certification is, for you… they forget to ask …you.

What do you think would be the conclusion, if you ask that question to either one of the contestants while you compare 2 certifications? Of course each party will simply draw the conclusion that their own certification is the best choice.

To answer the most important question, the dilemma CCSP or CCAK, is simple: do you need technical or audit skills for cloud security?

The answer

In essence, the answer is simple:

  • if you need cloud audit skills, dive in to the Cloud Security Alliance (CSA) and ISACA Certificate CCAK.
  • if you want to have architect level technical cloud expertise and knowledge, choose CCSP
  • if you want cloud security knowledge, in basic or advanced hands-on, there are other choices to start with (more about it below)

So, if you ask the question “what is the right certification for you”, you immediately know that there is no right answer, but there are many options.
Options for a multi level expertise roadmap in cloud security, based on your current skills and your future goals.

If you like a tough challenge: why not jump into the CCAK or CCSP, CCSP or CCAK, whatever, right away.

But if you would like to boost your chance of success… take a deep breath and better plan smartly.

And don’t start with CCSP/CCAK, but prepare your track towards CCSP/CCAK first.

First some background to plan your roadmap

Setting expectations

Just to set expectations, this article only focuses on the personal education and certification options, offered by (ISC)², ISACA and CSA. Including other education provider would lead us too far.
There are way more other (cyber)security certifications available, but we focus on the cloud security track, which limits the options…

Feel free to comment with other options for cloud security training. I’ll update the article where relevant.

CSA CCSK

The Cloud Security Alliance launched the CCSK in 2011. And as they explained here, “the CCSK was quite literally the industry’s first examination of cloud security knowledge when it was released back in 2011. “

The CCSK is an easy entry, high level introduction to Cloud Security, and it doesn’t require you to have deep technical cloud security expertise.

But it still is a nice baseline for the cloud security essential knowledge.

(ISC)² – CCSP

In short: CCSP = CISSP [by (ISC)²]+ CCSK [by CSA]

The long version is explained in the (ISC)² article comparing CCSP and CCAK.

  • CCSP = Certified Cloud Security Professional
  • You need at least five years of cumulative, paid work experience
  • CCSP is pretty much the same level of difficulty as CISSP, but has focus on cloud security.

The CCSP was launched in 2015, as a cooperation between (ISC)² and CSA. (see CSA press release here), a couple years after the CCSK launch in 2011.
The CCSP is the bigger brother of the CCSK, more advanced, and as CSA rightfully mentions in there CCSK-CCSP comparison blog, the CCSP is on the level of CISSP with a major cloud flavor.

That’s where the dummy math description comes from…

CCSP = CISSP + CCSK.

But CCSP certainly is not an entry level exam.

More information:

ISACA & CSA – CCAK

CCAK = CISA [ISACA] + CCSK [CSA]

CCAK (Certificate of Cloud Auditing Knowledge) is cohosted by ISACA and CSA.
And then you immediately know the approach is different than the approach of (ISC)².

ISACA (Previously known as the Information Systems Audit and Control Association®) stems from audit.
CSA focuses on cloud security.

That’s exactly what CCAK is about : cloud security audit.

See here:

As ISACA mentions on their product page: “The Industry’s First Global Cloud Auditing Credential”.

CISSP

For completeness, I mentioned the CISSP ( Certified Information Systems Security Professional).
I don’t think it needs a lot of explanation, it’s pretty much the reference standard for IT Systems security. (ISC)² references it as “The World’s Premier Cybersecurity Certification”.

It’s a pretty heavy exam, and it does require at least 5 years professional security experience. This is not an entry level exam.

More info: https://www.isc2.org/Certifications/CISSP

SSCP (Systems Security Certified Practitioner)

Due to the experience requirements, CISSP might be a tough credential to start with, although you can pass the exam, and continue to build your experience to grab the CISSP title…

If you want the plan your credentials the smart way, or you’re fresh in cyber-, information or IT-security, you better start with SSCP.

That the little brother of CISSP, and it’s an excellent way to step up to CISSP. More info: https://www.isc2.org/Certifications/SSCP

Where to start?

Cybersecurity & Information security essentials

As explained earlier, for tech skills in cyber-, IT and information security: look into SSCP first.

(Then step up to CISSP.)

Cloud security essentials: CCSK

Now it’s obvious what your first step in cloud security education should be: CCSK.

The CCSK is the perfect introduction to cloud security essentials.

Although it’s very helpful to have some technical IT basic knowledge, the CCSK is very accessible for general audience.

To prepare for the CCSK, you can follow classes or self-study via a completely free preparation toolkit.

Source: CSA CCSK v4 exam (https://cloudsecurityalliance.org/artifacts/ccskv4-exam-prep-kit/)

You can buy a double-try access ticket for the CCSK online exam (60 questions, 90 minutes), so if you would fail the first attempt, study again and retry the exam.

Then plan your track: only technical (no interest for audit) or audit, or both

Only technical

If you focus on technical expertise in cloud security, CCSP is a reference standard (at least, on of them…) .

As mentioned: CCSP = CISSP + CCSK.

So the track is clear

  • After passing the CCSK exam,
  • Take the CISSP exam
  • then take the CCSP

This is the easier route if you already have 5yr+ experience. It’s not the cheapest route, as you pass the CISSP first, but it’s worth the effort. (you only need to pay 1 yearly fee at (ISC)², so after 1 certification, … no extra cost in yearly membership fee)
For junior, less experienced, security engineers, start with SSCP before jumping into CISSP, and then CCSP.

Audit

When you target IT security audits, you need to take a different route depending your background.
Having the CCSP/CISSP background is extremely useful to boost your career in audit.

But for the CCAK, the core audit baseline is CISA.

Keep in mind, similar to CISSP and CCSP, CISA has the same requirements regards professional experience, 5 years.

But if you’re a ISACA CISA, you can add CCSK to the track and land on the CCAK.

Both?

Then it’s obvious, first tech, then audit, meaning a smart combination of

  1. CCSK
  2. (SSCP > ) CISSP
  3. CCSP
  4. CISA (or alternative)
  5. CCAK

Alternative routes

ISO27001 Implementer & Auditor

And alternative route to the auditing experience is ISO27001 auditing, but you’ll need some implementation experience before you can audit.

CISM

Within the ISACA portfolio, the CISM (Certified Information Security Manager), covers the same areas as most ISO27001 (lead) implementer courses.

Which can be helpful to ramp up for the CISA audit part, to gain some hands-on in IT & Infosec governance.

Visualizing your cloud security education roadmap

Lots of blah for a simple choice?

Allow me to visualize the options…

The difference between “certification” and “certificate”, does it really matter?

In it’s blog post (ISC)² tries to put CCSP above CCAK by saying “CCSP is a certification; CCAK is a certificate.”

And they continue “A certification recognizes a candidate’s knowledge, skills, and abilities, typically framed by a job role, while a certificate’s scope is narrower and only documents training course completion. A certification often requires continuing professional education (CPE) to stay in front of trends, while a certificate’s body of knowledge does not evolve over time or require CPE credits to maintain.

And their explanation is at least flawed and cutting corners to benefit CCSP.

There are many explanations and interpretations of “certification”, depending the context.
But in essence, “certification” is a process and a certificate is a document (the result).

When you certify for “CCSP” at (ISC)², you need to comply with the CCSP condition and then get a document, your CCSP certificate.
Idem for CCAK, you need to comply with their conditions.

Both the certification process for CCSP as the process for the CCAK are used by other similar education providers.

Eg, PECB, ISACA, EC-COUNCIL, … and others require to pay a yearly fee, keep CPE/CPD (continous professional education or development). Some yearly fees are cheaper as others.

Like CSA, Microsoft and others ask for a 1 time exam fee, and then update the exam on longer term, not yearly, and do not require a yearly maintenance fee.

It’s a choice of the certificate owner, how the evaluation and exams are done.

Some of them comply to the ISO17024, and education standard. There are huge benefits to comply (like increased credibility, compatibility with other certifications, …). But it’s not mandatory.

(ISC)² uses an exam, with experience requirement and continuous education once you pass the exam, but you do not need to pass the exam again, unless it’s upgraded to a new build or major version.

But CSA does exactly the same, for example when CCSK was upgraded from v3 to v4, you needed to pass the exam again.

Not on a yearly basis, but the program is updated, the exam is updated… on a regular basis, without yearly fee.

It’s rather a (small) financial effort, not of significance for most companies paying the bill. (Although as an individual, the cost of certification can become a serious burden…)

And it’s certainly not relevant when choosing between CCSP and CCAK. CCAK is cheaper, as referenced in the (ISC)² comparison chart.

References

(ISC)²: CCSP Certification vs. CCAK Certificate: What Are the Distinctions?

Cloud Security Alliance (CSA)

CSA Certificate of Cloud Security Knowledge (CCSK)

CSA & ISACA CCAK

CCAK learning material

CCSK vs CCSP

Vocabulary (alphabetical)

CCAK: Certificate of Cloud Auditing Knowledge (https://cloudsecurityalliance.org/education/ccak/)

CCSK: Certificate of Cloud Security Knowledge (https://cloudsecurityalliance.org/education/ccsk/)

CCSP: Certified Cloud Security Professional (https://www.isc2.org/Certifications/CCSP)

CSA: Cloud Security Alliance (https://cloudsecurityalliance.org/)

(ISC)²:  International Information System Security Certification Consortium (https://www.isc2.org/)

Is “not paying” THE solution against ransomware?

The discussion and opinions on paying ransom in case of cyber-ransomware is very alive and vivid.

Many people have strong opinions, but the actual victims of ransomware are seldom heard. They mostly keep silent.

This article is the English translation and adaptation of an article, originally published in Dutch, earlier.

(Source) Initial article in Dutch : https://identityunderground.wordpress.com/2021/07/30/de-oplossing-tegen-ransomware-volgens-brian/

In Trends magazine, Brian Schippers published an opinion article a few days ago with a very easy and simple solution against ransomware: don’t pay. (Source: Trends)

I must admit, it’s a great opinion article to get a nice discussion going with companies. At least it helps to raise awareness of ransomware and ransom payments. But unfortunately the article is not a Greek ancient-wise talk [σοφςς].

But he’s right about the reprehensible statements made by some of the ransomware victims. It is outrageous that a company dares to claim that ‘only’ 300K has been paid.

(translated quote) “We understand that we are suffering reputation damage, but we can’t be blamed,” the company manager told reporters. That statement in the press will haunt him for a while.

And it’s not the first time we’ve witnessed such statements. For another company from the Westhoek (Western Belgian Region, near the coast) , it was “less than 1 million”…

It’s very meaningful, how little business leaders worry about ransomware or how careless they can be to protect their business.

And Brian puts forward a very nice theory how to stop ransomware, … in the ideal world.

But unfortunately, the article does not show in any way that the opinion-maker, in real life, has ever been on the side of a defenseless victim who is completely under the control of some remote criminal.

Because the choice to (NOT) pay a ransom is only available if you have a well-functioning and thoroughly tested backup and restore system.

At that moment, when it happens, all preventive measures have clearly failed already. Way too late to have regrets…

Prevention only works BEFORE the criminal strikes. Or when he has left again, to avoid repetition.

People do not choose to pay ransomware. It’s the last resort.

They just have no choice. All other means are already exhausted or unavailable.

You don’t pay a ransom if your backup/restore system works properly.

Without a guaranteed recovery function, mathematics is very simple

If you

  • DO NOT pay =  100% GUARANTEE that you LOSE your DATA and you’re almost certain that your company will also be dead very quickly, or at least suffer long-term or irreparable damage.
  • PAY = there is SOME chance that you may see (something) of your data again. That’s always better than the previous option, no matter what it costs.

The third option in between is that the cost of the ransom is lower than the real cost of restoring your data. If you run into a cheap criminal, you can only try to talk him out of it and limit the damage. Pure math.

What if…?

It’s very easy to imagine: if a good-looking homejacker just rings the doorbell at your home. And your dearest opens the heavily armed front door.

A few seconds later, the robber asks you to clear your bank account completely with a gun to your dearest one’s head.

Are you going to pay or not?!

Do you have a choice?!

Replacing your dearest… is not an option, I would think.

With ransomware, the situation is exactly the same.

Well, Brian Schippers apparently doesn’t think so.

In his article Mr. Schippers is very convinced that you should certainly not pay a ransom. But the article does not offer any concrete, useful solution or practical suggestion as alternative.

He talks about a “security solution”… and reading between the lines you easily know where it should come from.

But there is no mention of decent and continuous training of people, thorough awareness training and thorough backup/restore or even better offline backup, even in the current age of cloud.

Because with “wise” software alone, it won’t work.

Even with the best technical security you have, people remain the weak point.

And the stronger the security, the more crime will target people directly.

And people make mistakes. People make software. Each software contains errors.

And mistakes will always be exploited.

And you only need just one employee who is fooled by a cleverly designed, but infected mail or a noble unknown on the phone.

It happens in no time, there are more than enough statistics in practice.

Because the hack or phishing is so well designed these days, that even cyber professionals can’t easily detect fake mails.

“The budget should not be a problem.”

Yes, yes, of course it shouldn’t, Brian! Nice slogan.

NOT.

Because the practice proves something completely different:

cyber protection < a very small percent of the IT budget < a small percent of the company budget.

Well, now what?!

It would be quite different if business leaders and managers were personally held liable for a pertinent lack of “state-of-the-art” (i.e. up-to-date) security that aligns both people, processes and technology very well.

Only THAT would solve the whole ransomware problem, very quickly. Deprive the criminal from his leverage.

Don’t look too far. Just look at how the insurance companies are doing in real life.

See how they implement car, fire, liability or other insurance. If it is shown that you are negligent, knowingly refuse to implement sufficient security … then the insurance will not pay or will claim back the refund.

Easy and simple, isn’t it?

Not so in cyber insurance, that’s the wild west. For a couple a thousand Euros in insurance, you get a bag of money of a couple millions to pay the criminal.

You bet on hackers to give up.

And if you bet hackers will give up soon, start by giving a “tournée générale” (buying a beer to everyone).

Because cybercrime and ransomware is big business. They make a lot of money with crime, so they won’t give up. Not now, not ever.

[BTW, it’s not because known ransomware groups suddenly disappear that they’re gone too. We don’t know the facts about that yet…]

But criminals don’t respect any law or rule. And they certainly don’t have ethical principles. It’s just a business that makes a lot of money.

So they are always have a head start and they are very motivated. And they will twist your arm even harder… or worse.

Finally

We must keep repeating that state-of-the-art security is all about security solutions at different layers and levels, which look beyond technology.

When you keep claiming you should not pay for ransomware, you’re running after the facts. In practice, it doesn’t solve anything… People in distress and panic will ignore law and ethical guidelines.

Also in physical life, many authorities officially declare that they do not give in to ransom demands. Is paying a ransom prohibited by law? But in many cases, money is paid clandestinely. Reality check.

So?

Make sure that the liability for implementing poor security measures hurts the right person, in the right place. Not the employees, but their boss.

And consequently:

So make sure that cybersecurity is sponsored at the top management level.


Dé oplossing tegen ransomware volgens Brian

In Trends magazine, heeft Brian Schippers een paar dagen geleden een opinie artikel gepubliceerd met een poepsimpele oplossing tegen ransomware: niet betalen. (Bron: Trends)

Toegegeven, het is een geweldig opinie-artikel om een lekkere discussie met bedrijven op gang te trekken. Het helpt tenminste om de bewustwording van ransomware en losgeld aan te wakkeren. Maar het artikel is jammer genoeg geen Griekse oude-wijzen praat [σοφός].

En hij heeft wel gelijk over de laakbare uitlatingen van sommige slachtoffers. Het is schandalig dat een bedrijf durft beweren dat er ‘maar’ 300K betaald is.

Herinnert U het nog: “We begrijpen dat we imagoschade lijden, maar ons valt niks te verwijten.”, zei de bedrijfsverantwoordelijke in de pers. Die uitspraak in de pers zal ‘m nog wel een tijdje achtervolgen.

En het is niet de eerste keer dat we dergelijke uitspraken mogen noteren. Voor een ander bedrijf uit de Westhoek, was het “minder dan 1 miljoen”… 

Het zegt heel veel, hoe weinig zorgen bedrijfsleiders zich maken over ransomware of hoe nonchalant ze kunnen zijn om hun bedrijf te beschermen.

En Brian heeft een heel leuke theorie om ransomware te stoppen in de ideale wereld. 

Maar de tekst toont jammer genoeg op geen enkele manier dat de opiniemaker ooit met praktijkkennis aan de zijde heeft gestaan van ‘n weerloos slachtoffer dat volledig onder controle is van een of andere crimineel op afstand.

Want de keuze om losgeld (NIET) te betalen, heb je ENKEL EN ALLEEN als je een goedwerkend en grondig getest backup en restore systeem hebt.

Op zo’n moment hebben alle preventieve maatregelen duidelijk al gefaald. Dus dat zijn vijgen na Pasen.

Preventie werkt alleen VOOR de crimineel toeslaat. Of als ie weer vertrokken is, om herhaling te voorkomen.

Mensen kiezen niet om ransomware te betalen. Het is het laatste redmiddel.

Ze kunnen gewoon niet anders. Alle andere middelen zijn dan al uitgeput.

Je betaalt geen losgeld als je backup/restore systeem goed werkt.

Zonder gegarandeerde herstelfunctie is de wiskunde heel simpel

  • NIET betalen = 100% GARANTIE dat je je DATA KWIJT bent en zo goed als zeker dat je bedrijf ook heel snel kapot is, toch tenminste langdurige of onherstelbare schade lijdt.
  • BETALEN = enige kans dat je mogelijk nog (iets) van je data terug ziet. Da’s altijd beter dan vorige optie, wat het ook kost.

De derde optie hiertussen is dat de kost van het losgeld lager is als de reële kost om je data terug te zetten. Als je een goedkope crimineel tegenkomt, kan je maar proberen om ‘m om te praten en de schade te beperken. Pure wiskunde.

Wat als…?

Het is héél gemakkelijk voor te stellen: als een goedogende homejacker gewoon aanbelt bij je thuis. En je allerliefste doet de zwaar bewapende voordeur open. 

Een paar seconden later vraagt de overvaller jou om je rekening volledig leeg te maken met een pistool tegen het hoofd van je allerliefste.

Ga je betalen of niet?!

Heb je keuze dan?!

Jouw allerliefste vervangen… is geen optie, zou ik denken.

Met ransomware is de situatie net hetzelfde.

Nou, Brian Schippers vindt dus blijkbaar van niet.

Mr. Schippers roept in z’n opinie artikel hoog van de toren dat je zeker geen losgeld mag betalen. Maar enige concrete, bruikbare oplossing of praktische suggestie biedt het artikel anders niet echt.

Hij spreekt volop over “security oplossing”…het schemert anders wel duidelijk door waar die vandaan moet komen.

Maar er wordt echter geen woord gerept over goede en continue opleiding van mensen, doorgedreven awareness training en doorgedreven backup/restore of beter nog offline backup, zelfs in het huidige cloudtijdperk.

Want met “wijze” software alleen, zal het niet lukken.

Zelfs met de beste technische beveiliging die je hebt, mensen blijven het zwakke punt.

En hoe sterker de beveiliging, hoe meer de criminaliteit zich op de persoon zelf richt. 

En mensen maken fouten. Mensen maken software. Elke software bevat fouten.

En er zullen altijd fouten uitgebuit worden.

En je moet maar 1 medewerker hebben die om de tuin geleid wordt door een slim ontworpen, maar besmette mail of een nobele onbekende aan de telefoon. 

Het is zo gebeurd, meer als genoeg cijfers in de praktijk.

Want de hack of phishing is tegenwoordig zo goed ontworpen dat zelfs cyberprofessionals vals en echt moeilijk kunnen uit elkaar houden.

“Het budget mag daarbij geen probleem zijn.” 

Ja ja, tuurlijk mag dat niet, Brian! Mooie slogan.

NOT.

Want de praktijk zegt helemaal iets anders: cyberbescherming < een heel klein percent van ‘t IT budget < een klein percent van het bedrijfsbudget.

Nou, wat dan wel?

Het zou helemaal wat anders zijn als bedrijfsleiders en managers persoonlijk aansprakelijk zouden zijn voor een pertinent gebrek aan “state-of-the-art” (dus up-to-date) beveiliging die zowel personen, processen als technologie goed op mekaar afstemt.

DAT zou pas het hele ransomware probleem oplossen, heel snel.

Heel ver moet je niet kijken. Kijk maar hoe de verzekeringen het aanpakken in het fysieke leven.

Kijk wat toegepast wordt in auto-, brand-, aansprakelijkheids- of andere verzekering. Als aangetoond wordt dat je nalatig bent, willens en wetens weigert om voldoende beveiliging te spenderen … dan vordert de verzekering het terug.

Simpel toch?

Niet in cyberverzekering, dat is het wilde westen. Voor een koppel duizend Euro aan verzekering, zit je op een zak geld van een koppel miljoen Euro.

Wedden dat hackers het opgeven?

En als je erop wedt dat hackers het snel zullen opgeven, begin dan alvast maar met een tournée générale te geven.

Want cybercriminaliteit en ransomware is big business. Ze kunnen met misdaad veel geld verdienen, dus die geven niet op. Nu niet, nooit niet.

[BTW, het is niet omdat gekende ransomware groepen plots van de aardbol verdwijnen dat ze ook weg zijn. Daar weten we het fijne nog niet van…]

Maar criminelen houden zich aan geen enkele wet of regel. En ethische principes hebben ze al helemaal niet. Het is gewoon een business, die veel opbrengt.

Dus ze zijn altijd in het voordeel en erg gemotiveerd. En ze zullen je arm nog harder omwringen… of erger.

Tot slot

We moeten blijven herhalen dat goede beveiliging draait om beveilingsoplossingen op verschillende lagen en niveaus, die verder kijken als alleen maar technologie.

Je kan nog lang roeptoeteren dat je geen ransomware mag betalen. Dan loop je achter de feiten aan. Dat lost niets op in praktijk.

Ook in het fysieke leven, roepen heel wat staten officieel dat ze niet toegeven aan losgeldeisen. Is daar losgeld betalen bij wet verboden? Maar er wordt op veel plaatsen clandestien toch geld over tafel geschoven. Realiteit.

Dus?

Zorg dat de aansprakelijkheid voor gebrekkige veiligheid pijn doet, bij de juiste persoon, op de juiste plaats. Niet bij de werknemers, maar bij hun baas.

En bijgevolg,

Zorg dus dat cybersecurity gesponsord wordt op topmanagement niveau.

2021 Updated cybersecurity threat and data breach reports

Just a quick note, but always interesting to use as reference in security discussions with management teams or in security workshops: cybersecurity threat and data breach reports.

I’ve collected them on this blog page: https://identityunderground.wordpress.com/interesting-links/useful-cybersecurity-data-protection-breach-reports/

When new versions are released, I’ll keep the page updated.

Feel free to notify me if you noticed other interesting threat and data breach reports, or updates to the reports posted earlier.

Whatsapp security dichttimmeren: stap voor stap (NL)

English version here: https://identityunderground.wordpress.com/2021/06/07/whatsapp-security-lockdown-step-by-step/

Gebruik je WhatsApp, of overweeg je om het te gebruiken (of ben je uitgenodigd door contacten)?

Dan kan de onderstaande checklist je stap-per-stap in detail uitleggen om

  • te evalueren of het de moeite waard is om WhatsApp te gebruiken, en
  • de beveiliging van je WhatsApp dicht te timmeren, om zo veilig mogelijk te blijven als je Whatsapp wil gebruiken.

Download dit article

At the end of this article, you can also find the download link for an offline version of this article.

Als je echt om privacy geeft en het is van het grootste belang…

Zoals hieronder uitgelegd, kun je WhatsApp zeker beveiligen, maar ze hebben nog steeds je gegevens en metadata en ze definiëren de regels waarmee WhatsApp de show uitvoert. En dat kan veranderen, wanneer ze maar willen.

En je moet weten dat WhatsApp eigendom is van en wordt beheerd door Facebook. En Facebook heeft al bewezen dat ze een echt slechte reputatie hebben als het gaat om privacy …

Als je echt niet wilt toegeven qua privacy, kijk dan eens naar alternatieven die niet zijn gebouwd door bedrijven die geld verdienen met je persoonlijke gegevens… (zie einde van dit artikel).

Het is aan jou om te beslissen welk risico je wilt nemen. Als je het gebruik van WhatsApp en je privacy wilt afwegen tegen de best mogelijke beveiliging, lees dan verder.

Als je om privacy geeft en toch Whatsapp wilt gebruiken

End-to-end encryptie

Het goede nieuws is dat WhatsApp een end-to-end encryptie gebruikt.

En hoewel Facebook of andere partijen mogelijk niet meeluisteren met uw gesprekken, kunnen de contactgegevens, de metagegevens (de gegevens over uw gesprekken) worden onderschept en eigendom zijn van / worden beheerd door Facebook / WhatsApp.

Verder is het belangrijk om te weten dat encryptie NIET van toepassing is op de WhatsApp back-ups.

Zoals hieronder wordt uitgelegd, kunt u dus overwegen whatsApp-back-up uit te schakelen om uw gegevens te beschermen.

En als je er toch voor wilt kiezen om WhatsApp te gebruiken, kun je de privacy en beveiliging in alle lagen van de applicatie beter vergrendelen.

Algemene beveiligingsregels

Minimaliseer uw gegevens

Over het algemeen is het altijd slim om uw gegevens in de applicatie te minimaliseren.

  • Geef geen persoonsgegevens weg
  • houd uw profielgegevens tot het minimum dat nodig is

Ga naar het WhatsApp status tabblad (rechts naast chats)

This image has an empty alt attribute; its file name is whatsapp_settings1.png

en klik vervolgens op “Instellingen” (Settings)

This image has an empty alt attribute; its file name is whatsapp_personal-info-1.png

Ook, heel belangrijk, beperk het delen van persoonlijke gegevens, er is een specifieke set opties in het gedeelte Privacy.

  • uw profiel alleen delen met vertrouwde contactpersonen
  • De publicatie van
    • “laatst gezien” tijdstempel
    • profielfoto
    • status
    • groepen
    • live locatie

Stel voor elk van deze opties de juiste keuze in om delen uit te schakelen.

Kies “Alleen delen met…” (Only Share with…) > geen contactpersonen selecteren (of enkel een beperkte set vertrouwde contactpersonen)

This image has an empty alt attribute; its file name is whatsapp_status-privacy.png

Resultaat

This image has an empty alt attribute; its file name is whatsapp_settings_privacy.png

Zorg er ook voor dat u het “Vingerafdrukslot” (Fingerprint lock) inschakelt, indien beschikbaar op uw smartphone.

Koperstip: voor de volgende smartphoneaankoop moet u rekening houden met de beschikbaarheid van een vingerafdrukscanner op uw telefoon.

Houd de app up-to-date

Werk uw apps continu bij, incl. WhatsApp, naar de nieuwste versie, om ervoor te zorgen dat alle beveiligingsfouten of beveiligingsproblemen meteen worden opgelost.

De meeste beveiligingsinbreuken of hacks richten zich specifiek op verouderde software.

Hoe u uw WhatsApp-beveiliging kunt vergrendelen, de controlelijst

Zonder beveiligingsconfiguratie is het vrij eenvoudig om een WhatsApp-account te kapen, omdat de eerste registratie alleen is gebaseerd op mobiele nummerregistratie en / of sms (kort bericht).

Dit maakt de eerste WhatsApp-gebruiker extreem gevoelig voor accountovername. Wees niet het volgende slachtoffer en vergrendel WhatsApp vanaf het eerste gebruik.

This image has an empty alt attribute; its file name is whatsapp_settings_account-2.png

Whatsapp tweestapsverificatie (2FA) of multifactorauthenticatie (MFA) inschakelen

Allereerst moet je MFA inschakelen, het is een must.

Wanneer je 2FA / MFA inschakelt op de WhatsApp-instellingen, voorkom je dat iemand anders gewoon je telefoonnummer of WhatsApp-account kan overnemen.

Gebruik de sterke authenticatie van je telefoon

This image has an empty alt attribute; its file name is whatsapp_settings_2fa.png

E-mailadres registreren voor je account

This image has an empty alt attribute; its file name is whatsapp_settings_2fa_mail.png

Een pincode instellen

Houd er rekening mee dat de pincode in WhatsApp geen inlogmethode is, maar een herstel- / herinstallatiefunctie.

Meer info: https://faq.whatsapp.com/android/security-and-privacy/adding-a-password/?lang=en

Maar u kunt de smartphonebeveiliging gebruiken om toegang tot toepassingen in te schakelen.

Het wordt sterk aangeraden om 2FA of MFA (multifactorauthenticatie, zoals uitgelegd in eerdere paragrafen) in te schakelen.

This image has an empty alt attribute; its file name is whatsapp_settings_2fa_pin.png

Whatsapp-tweestaps- of multifactorauthenticatie inschakelen

Gebruik telefoon sterke authenticatie

Vingerafdruk

Binnen de privacy-instellingen vindt u de optie “Vingerafdrukvergrendeling” (als uw smartphone de vingerafdrukscanner aan boord heeft).

This image has an empty alt attribute; its file name is whatsapp_fingerprint.png

Ga naar Instellingen > Account > Privacy om de vingerafdrukvergrendeling in te schakelen

This image has an empty alt attribute; its file name is whatsapp_settings_privacy_fp.png

Selecteer vervolgens de laatste optie (Vingerafdrukvergrendeling)

In dit vingerafdrukvergrendelingsmenu kunt u de ontgrendeling inschakelen en de time-outperiode kiezen. Hou het kort.

(Misschien is “meteen”/”immediately” een beetje lastig, zet ‘m dan op 1 minuut bijvoorbeeld…)

This image has an empty alt attribute; its file name is whatsapp_privacy_fingerprint.png

De beveiligingsmeldingen inschakelen

In de account settings

This image has an empty alt attribute; its file name is whatsapp_settings_account.png

er is een beveiligingsoptie

This image has an empty alt attribute; its file name is whatsapp_settings_security.png

Zorg ervoor dat u de optie “Beveiligingsmeldingen weergeven” inschakelt.

Dit zorgt ervoor dat u meldingen ontvangt wanneer de beveiligingscode van uw contacten verandert.

De privacy-instellingen vergrendelen

Verwijder overbodige persoonsgegevens uit uw profiel

Er is niet veel informatie die u zelf aan uw profiel kunt toevoegen.

Houd het tot het strikte minimum, en ik stel ook voor om geen persoonlijke foto toe te voegen, maar eerder een algemene foto.

This image has an empty alt attribute; its file name is whatsapp_settings_account-1.png

Schakel in de privacyinstellingen alle publicatie van uw profielgegevens uit.

This image has an empty alt attribute; its file name is whatsapp_settings_privacy-1.png

Locatietracking stoppen

Een belangrijke optie in de vorige lijst is ook het uitschakelen van locatietracking (“Live locatie”).

Back-up uitschakelen

Hoewel WhatsApp end-to-end-codering gebruikt voor zijn berichten, wordt de codering niet gehandhaafd wanneer de gegevens in de back-up worden opgeslagen

Als u zich echt zorgen maakt over privacy en beveiliging, schakelt u de back-up uit.

Trouwens, als u het verlopen van het bericht activeert, is de back-up toch overbodig…

This image has an empty alt attribute; its file name is whatsapp_settings_account2.png

Select de “Chats” optie

This image has an empty alt attribute; its file name is whatsapp_chats.png

Kies in de chatoptie de optie “Chat back-up”

This image has an empty alt attribute; its file name is whatsapp_backup1.png

In de Google drive settings (tenminste voor Android devices), selecteer “Backup to Google Drive” en selecteer dan “Nooit/Never”.

This image has an empty alt attribute; its file name is whatsapp_backup.png

Berichtvervaltijd inschakelen (berichten verdwijnen)

Als u het verlopen van berichten wilt inschakelen, moet u dit instellen op accountniveau van uw contactpersoon of op groepsniveau

Er is geen algemene beveiligingsinstelling en u kunt deze ook niet instellen op berichtniveau.

Waarschuwing

Houd er rekening mee dat het verdwijnen van berichten in WhatsApp enkele problemen kan hebben: https://www.androidauthority.com/whatsapp-disappearing-messages-feature-1173692/

Op contactniveau

This image has an empty alt attribute; its file name is whatsapp_contact_group_setting.png

Berichtvervaltijd op groepsniveau inschakelen

You can set the same options on group level too.

It’s highly suggested to enable these group options, and make sure information is not kept longer as needed.

Andere operationele beveiligingstaken

Verouderde leden uit groepen verwijderen

Het is heel belangrijk om groepen die u beheert te bewaken en overbodige leden zo snel mogelijk te verwijderen.

Zo voorkom je dat er gegevens ‘lekken’ naar deelnemers die die informatie niet nodig hebben.

Groepen verlaten die u niet meer gebruikt

Controleer groepen waarvan u lid bent en sluit deze groepen af/afsluit deze groepen als u ze niet meer nodig hebt, als u geen informatie meer wilt delen of als u niet wilt dat leden uw informatie/berichten zien.

This image has an empty alt attribute; its file name is whatsapp_leave-group.png

Zo voorkomt u dat u gegevens ‘lekt’ naar deelnemers om u te zien of te volgen.

Verzoek om toegang tot gegevens

Als je de informatie wilt controleren die WhatsApp over je weet, kun je een kopie van die infromation aanvragen

Ga naar je accountinstellingen

This image has an empty alt attribute; its file name is whatsapp_settings_requestinfo.png

En klik vervolgens op de optie “Informatie aanvragen”

Overweeg om andere tools te gebruiken, enkele alternatieven

Source:

Als je echt niet wilt toegeven aan privacy, kijk dan eens naar alternatieven die niet zijn gebouwd door bedrijven die geld verdienen met je persoonlijke gegevens…

Referenties

Whatsapp

Jezelf beschermen tegen WhatsApp-hacks

Uw gestolen account herstellen

Andere bronnen – aanvullende referenties die je kan raadplegen

Download

Dit artikel in het Nederlands kan je in PDF downloaden via deze link:

https://identityunderground.files.wordpress.com/2021/06/whatsapp-security-lockdown-step-by-step-nl-v1.pdf

Whatsapp security lockdown step-by-step

(NL versie vind je hier: https://identityunderground.wordpress.com/2021/06/07/whatsapp-security-dichttimmeren-stap-voor-stapnl/)

Are you using WhatsApp, or considering (or invited to, by contacts)?

Then the checklist below should provide you with detailed steps to

  • consider if it’s worth using WhatsApp
  • lock down the security of your WhatsApp to keep as secure as possible

Download this article

At the end of this article, you can also find the download link for an offline version of this article.

If you really care about privacy and it’s paramount…

As explained below you surely can lockdown WhatsApp, but they still have your data and metadata and they define the rules by which WhatsApp runs the show. And that can change, whenever they want.

And you should know that WhatsApp is owned and managed by Facebook.
And Facebook already has proven to maintain a really bad reputation when it comes down to privacy…

If you really do not want to give in on privacy, better check for alternatives that are not built by companies that make money with your personal data… (see end of this article).

It’s up to you to decide what risk you want to take. If you want to balance the use of WhatsApp and your privacy with the best possible security, continue to read.

If you care about privacy and still want to use Whatsapp

End-to-end encryption

The good news is, WhatsApp is using an end-to-end encryption.

And although Facebook or other parties might not listen in on your conversations, the contact data, the meta data (the data about your conversations) might be intercepted, and is owned/managed by Facebook/WhatsApp.

Furthermore it’s important to know that encryption DOES NOT apply to the WhatsApp backups.

So, as explained below, you might consider disabling WhatsApp backup to protect your data.

And if you still want to choose to use WhatsApp, better lock down the privacy and security in all layers of the application.

General security rules

Minimize your data

In general it’s always smart, to minimize your data in the application.

  • Don’t give away personal data
  • keep your profile data to the minimum needed

Go to the WhatsApp status tab

then click “Settings”

Also, very important, limit personal data sharing, there is a specific set of options in the Privacy section.

  • only share your profile with trusted contacts
  • Disable the publication of
    • “last seen” time stamp
    • profile photo
    • status
    • groups
    • live location

For each of these options set the right choice to disable sharing.

Choose “Only Share with…” > do not select any contacts (or a limited set of trusted contacts)

Result

Also make sure to enable the “Fingerprint lock” if available on your smartphone.

Buyers tip: for next smartphone purchase you must consider the availability of a fingerprint scanner on your phone.

Keep the app up to date

Continuously update your apps, incl. WhatsApp, to the latest version, to make sure that all security bugs or security issues are fixed right away.

Most of security breaches or hacks do specifically target outdated software.

How to lock down your WhatsApp security, the check list

Without security configuration it’s fairly easy to hijack a WhatsApp account, as the initial registration is only based on mobile number registration and/or SMS (short message).

This makes the initial WhatsApp user extremely sensitive to account take over. Don’t be the next victim, and lock down WhatsApp from the first use.

Enable Whatsapp Two-step (2FA) or multifactor authentication (MFA)

First of all you need to enable MFA, it’s a must.

When you enable 2FA/MFA on the WhatsApp settings, you avoid that someone else simply can take over your phone number or WhatsApp account.

Use phone strong authentication

Register email address to the account

Set a pin/password

Be aware that the PIN in WhatsApp is not a login method but a recovery/reinstallation feature.

More info: https://faq.whatsapp.com/android/security-and-privacy/adding-a-password/?lang=en

But you can use the smartphone security to enable application access security.

It’s strongly suggested to enable 2FA or MFA (multifactor authentication, as explained in previous paragraphs.

Enable Whatsapp Two-step or multifactor authentication

Use phone strong authentication

Finger print

Within the privacy settings, you can find the option “Fingerprint lock” (if your smartphone has the fingerprint scanner on board).

To enable the fingerprint lock, Go to Settings > Account > Privacy

Then select the last option (Fingerprint lock)

In this Fingerprint lock menu, you can enable the unlock and choose the time-out period. Keep it short.

(Maybe immediately is a bit inconvenient…)

Enable the security notifications

In the account settings

there is a security option

Make sure to enable the “Show Security notifications” option.

This will make sure you get notifications when the security code of your contacts change.

Lock down the privacy settings

Remove redundant personal data from your profile

There is not a lot of info you can add to your profile yourself.

Keep it to the strict minimum, and I also would suggest not to add a personal photo, but rather a general photo.

In the privacy settings, disable all publication of your profile data.

Stop location tracking

An important option in previous list is also to disable location tracking (“Live location”).

Disable backup

Although WhatsApp is using end-to-end encryption for it’s messaging, the encryption is not maintained when the data is stored in the backup

If you really are concerned about privacy and security, you disable the backup.

By the way, if you activate message expiration, the backup is redundant anyway…

Select the “Chats” option

In the chats option, choose the “Chat backup” option

In the Google drive settings (at least for Android devices), select “Backup to Google Drive” and then select “‘Never”.

Enable message expiration (disappearing messages)

To enable message expiration, you’ll need to set it on the account level of your contact or on group level

There is no general security setting, nor can you set it on the message level.

Warning

Please be aware that disappearing messages in WhatsApp might have some issues: https://www.androidauthority.com/whatsapp-disappearing-messages-feature-1173692/

On contact level

Enable message expiration on group level

You can set the same options on group level too.

It’s highly suggested to enable these group options, and make sure information is not kept longer as needed.

Other operational security tasks

Remove obsolete members from groups

It’s quite important to monitor groups you manage and remove redundant members as soon as possible.

This way you avoid ‘leaking’ data to participants who do not need that information.

Leave groups you don’t use anymore

Monitor groups you are member of, and you should quit/exit these groups if you do not need them anymore, or you do not want to share information anymore, or if you don’t want members to see your information/messages.

This way you avoid ‘leaking’ data to participants to see you or track you.

Data access request

If you want to check the information that WhatsApp knows about you, you can request a copy of that infromation

Go to your account settings

And then click the “Request Information option”

Consider to use other tools, some alternatives

Source:

If you really do not want to give in on privacy, better check for alternatives that are not built by companies that make money with your personal data…, like

Reference

Whatsapp

Protecting yourself from WhatsApp hacking

Recover your stolen account

Other sources – additional references you can check

Download

The current article is available for download here: https://identityunderground.files.wordpress.com/2021/06/whatsapp-security-lockdown-step-by-step.pdf

Note-to-self: #ZeroTrust #maturity model assessment by #Microsoft

Have you ever assessed the maturity of #cybersecurity implementation?

The #ZeroTrust #maturity model assessment by #Microsoft provides you with great insights, where to start or which part of your security needs improvement.

Easy to use, easy to understand, great results and great guidance.

You can find the assessment tool here:

https://www.microsoft.com/en-us/security/business/zero-trust/maturity-model-assessment-tool

And if you need more info, then bookmark this Zero Trust resources page: https://www.microsoft.com/security/blog/2021/05/24/resources-for-accelerating-your-zero-trust-journey

PECB MS : Building your data protection foundation by using the ISO/IEC 27701 core components

I had a great opportunity working with PECB MS, writing an article on building a #dataprotection foundation, using #ISO27701,.. perfectly fit for small business #SMB/#smebusiness.

Your data protection is a very strong #marketing tool to become the #trustedpartner of your customers.

No doubt: Get started! Doing nothing will cost you.

You can find the article over here:

Enjoy!

And even better, get in touch if you want to have a chat building your data protection.