Troublemaker CISO

The Troublemaker’s Guide to EVM: A Real-World Perspective

Published

3 months ago

December 2, 2024

Let's cut to the chase. Vulnerability management is a never-ending battle. Sure, we could spend all our time patching every single vulnerability, but let's be real, that's not practical or cost-effective.

Here are some harsh truths about EVM:

The Time Crunch: We don't have infinite resources or time. Maintenance windows are limited, and downtime is costly. Balancing security with business needs is a constant struggle.
The Development Dilemma: Developers are under pressure to deliver features fast. Security often takes a backseat to speed and efficiency.
The Prioritization Puzzle: Not all vulnerabilities are created equal. We need to prioritize based on risk, not just severity scores.
The Network Nuances: Different networks have different vulnerabilities. A one-size-fits-all approach won't work.

So, how do we navigate this complex landscape?

Embrace a Risk-Based Approach: Prioritize vulnerabilities that pose the greatest threat to your organization.
Automate Where Possible: Use tools to streamline vulnerability scanning, patching, and configuration management.
Foster a Culture of Security: Educate your employees about the importance of security and empower them to report suspicious activity.
Collaborate with Business Leaders: Work with business leaders to understand their priorities and align security efforts with business objectives.

Remember, cybersecurity is an ongoing battle. Stay vigilant, stay informed, and don't let the bad guys win.

So, if you need more guidance on EVM, here you go. This is based off solid academic research and experience, references included. The guidance does not provide detailed steps as each will be unique to your environment and risk tolerance.

Foundational Principles for successful EVM

Risk-based approach: EVM must be grounded in a comprehensive understanding of the organisation's unique risks and opportunities. This involves identifying critical assets, assessing threats and vulnerabilities, and evaluating the potential impact of exploitation.
Continuous monitoring: The threat landscape is constantly evolving, so EVM must be an ongoing process. Organisations need to continuously monitor for new vulnerabilities, assess their potential impact, and implement timely remediation measures.
Prioritisation: Organisations face a constant influx of vulnerabilities, making it impossible to address them all immediately. Effective EVM requires prioritising remediation efforts based on the severity of the vulnerability, the likelihood of exploitation, and the potential impact on the organisation.
Collaboration: EVM is not solely the responsibility of the security team. It requires collaboration between security professionals, IT staff, developers, and business stakeholders to effectively identify, assess, and remediate vulnerabilities.
Human factors: People are often the weakest link in cybersecurity. EVM should consider the human element, including potential insider threats, the need for security awareness training, and the cognitive load associated with managing vulnerabilities.

Key Practices

Asset management: A comprehensive inventory of all hardware, software, and data assets is essential for effective EVM. This enables organisations to understand their attack surface and focus remediation efforts on critical systems.
Vulnerability scanning: Regular automated scans help identify known vulnerabilities in systems and applications. Organisations should leverage a combination of internal and external scans to get a complete picture of their vulnerability landscape.
Patch management: Timely patching of known vulnerabilities is crucial for mitigating risk. Organisations should establish processes for evaluating, testing, and deploying patches promptly, prioritising critical systems and high-severity vulnerabilities.
Secure configuration: Misconfigurations are a major source of vulnerabilities. Organisations should implement secure configuration standards, leverage hardening guides, and employ automation to enforce secure configurations.
Vulnerability scoring and prioritisation: Various frameworks and tools help organisations prioritise vulnerabilities based on their severity, exploitability, and potential impact. The sources highlight the limitations of relying solely on the Common Vulnerability Scoring System (CVSS) and recommend considering additional factors such as the availability of exploits, known attacks, and business context.
Threat intelligence: Integrating threat intelligence into EVM enables organisations to focus on vulnerabilities that are actively being exploited or are likely to be targeted by attackers. This helps prioritise remediation efforts and reduce the overall risk.
Vulnerability chaining: Attackers often exploit multiple vulnerabilities in sequence to achieve their objectives. EVM should consider the potential for vulnerability chaining and implement mitigations to break these chains.
Reporting and communication: Effective communication of vulnerabilities and remediation efforts is essential for informed decision-making. CISOs should provide clear and concise reports to executive management and the board, highlighting key risks, remediation progress, and areas requiring further investment.

Frameworks and Standards

The following frameworks and standards provide foundational guidance for EVM:

NIST Cybersecurity Framework: This framework offers a comprehensive set of guidelines for managing cybersecurity risks, including vulnerability management.
ISO/IEC 27002: This standard provides best practices for implementing information security controls, including vulnerability management.
CIS Benchmarks: These provide detailed configuration guidelines for hardening systems and applications, reducing vulnerabilities.
DISA STIGs: These offer security technical implementation guides for securing specific systems and applications used by the U.S. Department of Defense.
CISA Known Exploited Vulnerabilities (KEV) Catalog: This catalog lists vulnerabilities that are known to be actively exploited, helping organisations prioritise remediation efforts.
Exploit Prediction Scoring System (EPSS): This data-driven model helps predict the likelihood of a vulnerability being exploited in the next 30 days, aiding in prioritisation.

Tools and Technologies

The following tools and technologies can support EVM efforts:

Vulnerability scanners: These tools automate the process of identifying known vulnerabilities in systems and applications.
Patch management systems: These tools automate the process of deploying patches, ensuring timely remediation of vulnerabilities.
Configuration management tools: These tools help enforce secure configurations and automate the process of hardening systems.
Threat intelligence platforms: These platforms provide access to real-time information about threats and vulnerabilities, enabling organisations to prioritise remediation efforts.
Security information and event management (SIEM) systems: These systems collect and analyse security logs from various sources, helping identify potential attacks and vulnerabilities.
Endpoint detection and response (EDR) solutions: These solutions monitor endpoint activity and help detect and respond to attacks, including those that exploit vulnerabilities.

By implementing the guidance provided, organisations can establish a robust EVM programme that effectively mitigates risk, enhances resilience, and protects critical assets.

References:

Books and Reports:

Alleman, G.B. and Quigley, J.M., 2024. Risk Management: Managing Tomorrow's Threats. Auerbach Publications.
Baker, D., 2024. A CISO Guide to Cyber Resilience: A how-to guide for every CISO to build a resilient security program. Packt Publishing.
Brown, A.R., 2024. Taming Your Dragon: Addressing Your Technical Debt. Apress.
Chaput, B., 2024. Enterprise Cyber Risk Management as a Value Creator: Leverage Cybersecurity for Competitive Advantage. Apress.
Chaput, B., 2021. Stop the Cyber Bleeding: What Healthcare Executives and Board Members Must Know About Enterprise Cyber Risk Management (ECRM). Clearwater.
Centre For Cyber Security Belgium, 2015. Cyber Security Incident Management Guide. Centre For Cyber Security Belgium.
Hampton, J., 2014. Fundamentals of Enterprise Risk Management: How Top Companies Assess Risk, Manage Exposure, and Seize Opportunity. AMACOM.
Herrmann, D.S., 2007. Complete Guide to Security and Privacy Metrics: Measuring Regulatory Compliance, Operational Resilience, and ROI. Auerbach Publications.
Hyslop, M., 2007. Critical Information Infrastructures: Resilience and Protection. Springer Science+Business Media.
Küfeoğlu, S. and Akgün, A.T., 2023. Cyber Resilience in Critical Infrastructure. CRC Press.
National Research Council, 2014. Leveraging Two Decades of Experience in Cybersecurity. The National Academies Press.
National Research Council, 2009. Technology, Policy, Law, and Ethics Regarding U.S. Acquisition and Use of Cyberattack Capabilities. The National Academies Press.
Steinberg, R.M., 2011. Governance, Risk Management, and Compliance. (Publisher information needed for complete citation).

Journal Articles and Websites:

Brooks, A.W. and John, L.K., 2018. The Surprising Power of Questions. Harvard Business Review Magazine, [online] Available at: https://hbr.org/2018/05/the-surprising-power-of-questions
Clinton, L., Higgins, J. and van der Oord, F., 2022. 2023 Director's Handbook on Cyber-Risk Oversight. National Association of Corporate Directors (NACD), [online] Available at: https://nacdonline.org/insights/publications.cfm?ItemNumber=74777
Deloitte, 2015. Tone at the top: The first ingredient in a world-class ethics and compliance program. [online] Available at: https://www2.deloitte.com/content/dam/Deloitte/us/Documents/risk/us-aers-tone-at-the-top-sept-2014.pdf
Drew, C., 2023. 25 Negativity Bias Examples. Helpful Professor, [online] Available at: https://helpfulprofessor.com/negativity-bias-examples/
Dunn, G., 2023. 2022 Year-End Securities Enforcement Update. [online] Available at: https://www.gibsondunn.com/2022-year-end-securities-enforcement-update/
Lipton, M. et al., 2018. Risk Management and the Board of Directors. Harvard Law School Forum on Corporate Governance, [online] Available at: https://corpgov.law.harvard.edu/2018/03/20/risk-management-and-the-board-of-directors-5/
McCoy, K., 2017. Target to pay $18.5M for 2013 data breach that affected 41 million consumers. USA Today, [online] Available at: https://www.usatoday.com/story/money/2017/05/23/target-pay-185m-2013-data-breach-affected-consumers/102063932/
Mendro, J.J., Tulumello, A.S. and Hilborn, J.H., 2019. Recent Application of Caremark: Oversight Liability. Harvard Law School Forum on Corporate Governance, [online] Available at: https://corpgov.law.harvard.edu/2019/08/16/recent-application-of-caremark-oversight-liability/#more-120953
Micheletti, E.B. and Lindsay, R.M., 2021. The Risk of Overlooking Oversight: Recent Caremark Decisions From the Court of Chancery Indicate Closer Judicial Scrutiny and Potential Increased Traction for Oversight Claims. Skadden, Arps, Slate, Meagher & Flom LLP, [online] Available at: https://www.skadden.com/insights/publications/2021/12/insights-the-delaware-edition/the-risk-of-overlooking-oversight
Needleman, S.E., 2022. Twitter's Ex-Security Head Files Whistleblower Complaint on Spam, Privacy Issues. WSJ, [online] Available at: https://www.wsj.com/articles/twitters-ex-security-head-files-whistleblower-complaint-on-spam-privacy-issues-11660422044 .
Seets, C. and Niemann, P., 2022. How cyber governance and disclosure drive business value. Harvard Law School Forum on Corporate Governance, [online] Available at: https://corpgov.law.harvard.edu/2022/10/02/how-cyber-governance-and-disclosure-drive-business-value/.

Standards and Regulations:

American Bar Association, 2020. Model Business Corporation Act Annotated (fifth ed.).
CIS Benchmarks. (Publisher and date information needed for complete citation).
CISA Known Exploited Vulnerabilities (KEV) Catalog. Cybersecurity and Infrastructure Security Agency (CISA), [online] Available at: https://www.cisa.gov/known-exploited-vulnerabilities-catalog [Accessed 17 October 2023].
DISA STIGs. Defense Information Systems Agency (DISA), [online] Available at: https://public.cyber.mil/stigs/ [Accessed 17 October 2023].
Exploit Prediction Scoring System (EPSS). Cybersecurity and Infrastructure Security Agency (CISA), [online] Available at: https://www.first.org/epss/ [Accessed 17 October 2023].
Federal Information Security Management Act (FISMA) of 2002.
Food and Drug Administration 21 Code of Federal Regulation Part 11.
Health Insurance Portability and Accountability Act (HIPAA) of 1996.
Homeland Security Presidential Directives (HSPDs).
ISO/IEC 27001:2022.
ISO/IEC 27002:2022.
ISO/IEC 27034-1:2011.
ISO/IEC 27036.
ISO/IEC 29147:2020.
ISO/IEC 30111:2019.
ISO/IEC 30111:2020.
ISO/IEC TS 27034-5-1:2018.
NIST Cybersecurity Framework. National Institute of Standards and Technology (NIST), [online] Available at: https://www.nist.gov/cyberframework [Accessed 17 October 2023].
NIST Special Publication 800-30, Revision 1. Guide for Conducting Risk Assessments. National Institute of Standards and Technology (NIST), 2012.
NIST Special Publication 800-37, Revision 2. Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy. National Institute of Standards and Technology (NIST), 2018.
NIST Special Publication 800-39. Managing Information Security Risk. National Institute of Standards and Technology (NIST), 2011.
NIST Special Publication 800-53, Revision 5. Security and Privacy Controls for Federal Information Systems and Organizations. National Institute of Standards and Technology (NIST), 2013.
NIST Special Publication 800-61, Revision 2. Computer Security Incident Handling Guide. National Institute of Standards and Technology (NIST), 2012.
NIST Special Publication 800-137. Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations. National Institute of Standards and Technology (NIST), 2011.
NIST Special Publication 800-207. Zero Trust Architecture Standard. National Institute of Standards and Technology (NIST), 2020.
New York State Department of Financial Services 23 NYCRR 500, Cybersecurity Requirements for Financial Services Companies. New York State Department of Financial Services, 2023.
Sarbanes-Oxley Act of 2002.

Court Cases:

In re Caremark International Inc. Derivative Litigation, 698 A.2d 959 (Del. Ch. 1996).
Marchand v. Barnhill, 212 A.3d 805 (Del. 2019).

Other:

The People’s Law Dictionary.

Related Topics:CISO leadership Troublemaker

Up Next

Commentary from the Troublemaker CISO: The Australian Cyber Security Act – A Step Forward or Just Another Layer of Red Tape?

Don't Miss

The CISO’s Dirty Little Secrets: Common Mistakes and How to Avoid Them

Click to comment

CISO Blog

Season 2 Episode 5 of The Troublemaker CISO: Black Basta Unmasked – A Chat Log Reveal

Buckle up, folks! The notorious Black Basta ransomware gang just took a major hit as their internal chat logs got spilled online. This isn’t just your average leak—it’s a treasure trove revealing their dark secrets, shady tactics, and the infighting simmering among the ranks. Want to know how they operate, who’s running the show, and how you can fortify your defenses against these digital pirates? Dive into the chaos of Black Basta with us and discover how even the murkiest corners of cybercrime can get shed light on!

Published

2 weeks ago

February 25, 2025

Ian Keller

Hold onto your hats, folks, because in a twist likely to make even the most seasoned hackers cringe, the infamous Black Basta ransomware gang just got hit with a dose of exposure. In February 2025, their internal chat logs spilled onto the internet, lifting the veil on their clandestine operations and potentially outing some key players behind the digital mayhem.

Who is Black Basta?

If you want the full backstory check out our deep dive into Black Basta, available here

Black Basta Ransomware Group: A Deep Dive

Here is the short version: Emerging in April 2022, Black Basta quickly burst onto the scene as a formidable Ransomware-as-a-Service (RaaS) operation. By targeting sectors ranging from healthcare to entertainment, this gang’s reputation precedes them—over 500 organizations globally can attest to their wrath. Their calling card? The notorious double extortion play: encrypt the system and filch sensitive data, then demand a ransom with the threat of public leaks if unpaid.

Word on the street suggests Black Basta might be the unholy offspring of the now-defunct Conti ransomware and FIN7 threat actor groups. Whether a fusion or a reincarnation, they're built on a foundation of bad intentions and digital crime prowess.

Digging Into Their Methods

With a toolbox full of advanced techniques, Black Basta crafts their attack strategy like a maestro:

- Starting Point: They breach defenses with spear-phishing, insider help, or buying network access. Recently, they even resorted to misusing Microsoft Teams, impersonating IT help desks to trick employees into opening their networks wide open.

- Onward and Upward: Once inside, they move laterally, scooping up credentials with tools like QakBot and Mimikatz. Vulnerabilities like ZeroLogon and PrintNightmare? They exploit those like kids in a candy store.

- Keeping Tabs: Using Cobalt Strike Beacons and SystemBC, they maintain a firm grip on compromised systems.

- The Double Hit: Before encrypting files and appending their signature ".basta" extension, they disable security measures and exfiltrate data with tools such as Rclone and WinSCP, leaving a ransom note as the cherry on top.

The Chat Log Leak Bombshell

Enter the catalyst for chaos: a character named ExploitWhispers unleashed reams of the gang's internal chat messages via the Matrix platform, covering conversations from September 2023 to September 2024. The logs unveil more than just tactical playbooks—they expose friction and deceit within Black Basta’s ranks.

PRODAFT, keen-eyed cyber defenders, suggest this leak might stem from discord following alleged attacks on Russian banks—a tale not too dissimilar from the notorious Conti leaks. Leaked messages hint at some operators double-crossing victims by taking ransom without decryptors. Some top dogs ditched for rival groups while the rest grappled with the realization that Black Basta’s punch was getting weaker.

And guess what? Names emerged in the chats:

- Lapa: An admin.

- Cortes: Linked to QakBot.

- YY: The prime administrator.

- Trump (aka GG and AA): Allegedly Oleg Nefedov, the head honcho.

Security researchers are scrutinizing the logs, eager to piece together the digital puzzle, with Hudson Rock even rolling out an LLM to delve deeper.

Ladies and gents, as we peer through this unexpected window into the underworld, remember: even the darkest recesses of the internet can be dragged into the light. Keep eyes peeled, ears to the ground, and let’s keep giving troublemakers like Black Basta a run for their crypto.

CISO Blog

Season 2 Episode 4 of The Troublemaker CISO: Salt Typhoon – An Unrelenting Storm on Telecoms

In the relentless digital battleground of 2025, Salt Typhoon is churning up a storm that telecoms can’t ignore. This state-sponsored cyber squad is at it again, infiltrating networks and dodging detection with their infamous espionage tactics. Targeting telecom giants worldwide, they’re exploiting vulnerabilities faster than you can say “patch it!” How do we defend against this relentless assault? By building robust, multi-layered defenses and staying one step ahead. Ready to weather the storm, troubleshooters? Dive in to uncover the strategies that can fortify our digital fortress against Salt Typhoon’s unyielding deluge.

Published

3 weeks ago

February 18, 2025

The Troublemaker CISO

Ladies and gentlemen, buckle up, because Salt Typhoon is back at it, causing a ruckus in our digital playgrounds. This Chinese state-sponsored APT group is no stranger to controversy, and February 2025 has them splashed across headlines once more. Their playground? Telecommunications and critical infrastructure. Their game? Cyber espionage for world domination, or at least to gather intelligence and strategic advantage.

How It All Began

Salt Typhoon blustered onto the scene around 2020, quickly turning into a high-priority headache for cybersecurity pros everywhere. They cut their teeth by:

Nabbing holes in public-facing servers like Microsoft Exchange to break in.
Spying on hotels, governments, and law firms, trying to catch influential figures off guard.
Crafting sneaky backdoors like SparrowDoor and Demodex to stick around on breached systems.
Dodging detection with top-notch anti-forensic shenanigans.

Over the years, their style evolved, adding "living off the land" tactics and honing in on juicier targets.

Read the full Threat report on Salt Typhoon

The 2025 Storm Surge

Fast forward to the chaos of 2025, and Salt Typhoon is back under the spotlight:

Busting into U.S. telecom bones through unpatched Cisco IOS XE devices. Ouch!
Attacking over 1,000 Cisco network gadgets worldwide, hitting the U.S., South America, and India hard.
Compromising telecom giants like a U.S. ISP, U.K. affiliate networks, a South African provider, an Italian ISP, and a major player in Thailand.
Deploying GhostSpider malware to weave their web.
Exploiting well-trodden vulnerabilities in Cisco gear—CVE-2023-20198 and CVE-2023-20273—to snag admin access.
Probing universities for their sweet research in telecom, engineering, and tech.

Their focus? Espionage, persistence, and staying ahead of geopolitical showdowns by intercepting data flows whenever it suits them.

The Fallout

Salt Typhoon's actions ripple far beyond just cybersecurity headaches:

National security risks: Breaching surveillance systems jeopardizes law enforcement and national operations.
Data privacy violations: Personal and sensitive info is laid bare, compromising organizations and individuals.
Threats to critical infrastructure: Telecommunication disruptions can snowball, impacting countless sectors.

Batten Down the Hatches

What’s a savvy guardian of cyberspace to do? Here’s how to withstand the storm:

Roll out robust security frameworks like zero-trust architectures and keep vigilant with continuous monitoring.
Patch those vulnerabilities, stat! Quickly seal any discovered holes to keep your defenses tight.
Boost network visibility and keep an eagle eye on unusual behavior.
Fortify infrastructure with segmentation, access controls, and souped-up VPN gateways.
Share the wisdom: Stay in the know about Salt Typhoon’s latest tricky tactics.
Bolster those Cisco devices.

Taking a hands-on, multi-layered approach is the only way to stay ahead of Salt Typhoon and other nefarious state-sponsored groupies. Let's keep the umbrella of preparedness over our heads in the fast-moving digital storm. Stay sharp, troubleshooters—the world depends on it!

CISO Blog

Season 2 Episode 3 of The Troublemaker CISO: Trusting Third-Party Security Promises – The Risks We Forget

Published

3 weeks ago

February 16, 2025

Ian Keller

In today's digital reimagining, where digital is king and cyber threats are the court jesters causing chaos, we've placed a precarious trust in third-party promises to shield us from scammers and ne'er-do-wells. But guess what? These promises too often teeter like a house of cards, leaving us exposed when the wind blows wrong. This tale, sponsored by Bitdefender, unravels the shaky reality we’ve woven with telco strategies for consumer security in 2025.

Telcos worldwide are ramping up spending on consumer security software, set to hit $606 million by 2030. Despite healthy growth forecasts, what's more important to note is the increase in high-impact, multi-platform scams. Scammers are evolving like they just binged on a tech-advancement series, and it’s up to us to keep pace.

Here's a harsh dose of reality: as much as 70% of telcos' spending goes into endpoint security, yet large-scale destruction like Windstream's 600,000 router obliteration in 2023 sounds the alarm against complacency. With AI enhancing scams, from phishing emails to identity spoofing, the threat is more pervasive and personal than ever.

But let's not put all the security eggs in the telco basket. As consumers, we've got a role to play too. Here’s a guide for you to stay a step ahead of scammers:

Educate Yourself: Knowledge is your first layer of defense. Familiarize yourself with common scam tactics. Don’t blindly trust caller IDs and do learn to recognize phishing attempts.
Use Strong, Unique Passwords: Trust me, “1234” is not a password, it’s an invitation. Use complex passwords and change them regularly, or better yet, use a password manager.
Enable Multi-Factor Authentication (MFA): Add another hurdle for bad actors. If one factor is compromised, a second can prevent unauthorized access.
Be Skeptical of Unsolicited Communications: If a bank, telco, or other service provider contacts you out of the blue asking for personal info, be skeptical. Verify the legitimacy of the request through official channels.
Regularly Update Software: Ensure all devices, from your smartphones to your smart fridges, are current. Updates often include patches for newly-discovered vulnerabilities.
Consider Dedicated Security Apps: Use apps like Bitdefender's 'Scam Alert' which provide pop-up notifications of suspicious activity across messaging platforms. These supplements can offer an added layer of scrutiny against scams.
Beware of Fake Identity Red Flags: AI-generated lures are getting more convincing, so question authenticity—even the quick glance at a familiar email domain isn’t enough. Always double-check for discrepancies.

While telcos and tech companies like Bitdefender work tirelessly to innovate defense frameworks, it's crucial we arm ourselves with awareness and active participation. Remember, in this interconnected landscape, your vigilance is as potent a defense as any firewall. Scammers never clock out—and neither should your focus on personal security.

So, folks, let’s keep our shields up and minds sharper. In this game of digital survival, staying one step ahead is not just an advantage—it’s essential. Prepare yourselves, maintain skepticism, and keep those cybersecurity layers thick and many. Stay safe out there, troubleshooters—the world needs your digital resilience.