STE WILLIAMS

Steven Grossman, Bay Dynamics’ vice president of strategy enablement, sat down recently with CenturyLink VP Chief Security Officer David Mahon in a thoughtful discussion about why CISOs are moving from the IT corner into a more operational role, managing the risks that threaten to harm their company’s most valuable data.

This QA is part of a Dark Reading interview series with cybersecurity experts by cybersecurity experts.

Decades ago, a new executive-level role emerged in the enterprise – the Chief Information Security Officer (CISO). The original CISO sat in the IT corner, mainly managing firewalls and other fundamental security technologies. Due to the person’s technical expertise, the CISO reported to the Chief Information Officer (CIO), the leading technical expert in the enterprise.

Fast forward twenty years, the CISO has become a more business-centric, board member go-to expert -and no longer reports to the CIO. Today’s CISOs are increasingly reporting to the chief risk officer (CRO) as cybersecurity has transformed into a risk management issue, viewed alongside, if not above, other operational risks to the business.

To get an industry veteran’s point of view on this transformation, I spoke with David Mahon, vice president and chief security officer at CenturyLink. David is responsible for designing and implementing a global security program that includes cybersecurity, critical infrastructure protection, enterprise risk management, physical security, network fraud and abuse, industrial security, international travel security, global threat intelligence, work place violence prevention, executive protection and investigations. In many enterprises, such as CenturyLink, the CRO and CSO roles are interchangeable. Both involve centering their strategic objectives around risk, and both are seeing more CISOs move under their wing.

Steven Grossman: Thank you for taking the time to chat with me, David. Why do you think CISOs should be reporting to CSOs/CROs vs. CIOs?

David Mahon: The main reason is that the CISO profession and industry responsibilities have changed. The CISO profession started in the IT department when cybersecurity was emerging as a core competency. CISOs were mainly called IT security professionals. Over time, as more high profile data breaches came to surface, CISOs increasingly interacted with other C-level executives who were outside of technology such as chief privacy officers and chief legal officers. The cybersecurity ecosystem transformed, going from a primarily technical to a risk management discipline.

Because of that shift, the CIO isn’t the best executive to oversee cybersecurity. The CIO doesn’t have risk management functions, such as Governance, Risk Management and Compliance (GRC), which is a key component of an effective enterprise-wide risk management program.

Steven Grossman: So, in other words, CISOs shouldn’t be making absolute security their goal but instead, effective risk management.

David Mahon: Our role as CSOs, which essentially carries the same responsibilities as CROs, is to enable strategic objectives and risk posture as approved by the board of directors. When a CSO signs off on a project, it’s not about the technology; it’s about what the project will do for the business.  CSOs manage all security and risk functions for the company, which oftentimes blend together, to achieve the risk posture established by the board.

Steven Grossman: Based on what we have seen working with our clients, CISOs who report through the CIO to the board often present technical information from a messaging point of view while those reporting through the CSO/CRO present a more balanced, risk-orientated point of view. As CenturyLink’s CSO how do you work with your CISO, who is on your team, and how do you implement a risk-orientated approach to security?

David Mahon: First, you must understand the strategic plan approved by the board of directors. Visit with each business unit to understand how their tactical plans roll up into the larger strategic plan.  For example, the CTO may have a strategic roadmap that you know will need cybersecurity engineers on the front end. You can start deploying those resources to support the CTO rather than waiting until the CTO launches a project. You need visibility into what each business unit is doing so that you can enable them to also achieve the overall cyber risk mitigation objectives set by the board.

It’s critical to assess where your most valuable data is located and what is the value associated to the applications and systems that store that data. Identifying where your highly valuable assets live will enable you to risk-rank those assets. What is your most sensitive data down to data that is less sensitive? What are the security controls you have in place to protect your highly valuable data? Are they working properly? Where are the gaps? If business units are outsourcing work, who are they outsourcing it to, and how are those users interacting with your valuable data? Identify the top risks for the company and map those with each business unit’s objectives.

Since many information security programs are designed by technical solution-based thinkers, it’s also better to turn to regulatory standards and frameworks like NIST, ISO or HIPPA as a baseline for your risk management program.

These are just some of the steps; there are many others in-between. The key is to broadly look at the risk posture of the company, map those risks to your (and the board’s) objectives and define how to decrease risk incrementally.

Steven Grossman: It is unfortunate that so many enterprises do not know where their valuable information assets are located. In the physical world, that’s like an operations manager not knowing where his/her company’s critical buildings are located. Understanding where your valuable assets live is central to risk management.

David Mahon: When there are thousands of employees, vendors, contractors and assets, understanding your valuable assets – including where they exist and how people interact with them – and being able to measure your risk along with appropriate response and recovery plans for various potential incidents, is a sign of a mature risk management program.

Steven Grossman: What do you think are the biggest challenges CISOs face if they report to CSOs/CROs vs. CIOs?

David Mahon: One challenge is that CISOs are not adequately prepared to address the questions that a CSO/CRO will ask. CSOs/CROs tend to ask global questions to which CISOs respond with technical answers. CISOs lean on their technical acumen and therefore are challenged to look more broadly at such things as threat intelligence, adversaries, and business objectives.

In the end, CISOs who embrace a risk-based approach to security will have a broader view of their enterprise’s objectives and know how to strategically and tactically use their resources to achieve them. They will get a horizontal view of the enterprise, instead of a swim lane, which will enable them to deliver shareholder value and enhance customer experience.

R. David (Dave) Mahon was named chief security officer in April 2011 for CenturyLink, the third-largest communications provider in the U.S. In addition to his CSO role, McMahon is also the company’s liaison with the National Security Telecommunications Advisory Council (NSTAC), National Cybersecurity and Communications Integration Center (NCCIC), as well as federal and state law enforcement and homeland security agencies.

Prior to joining CenturyLink, Mahon was a supervisory special agent with the FBI responsible for investigating violations of federal statutes in which the Internet, computer systems, and networks were exploited as the targets of terrorist organizations, foreign government-sponsored intelligence operations or criminal activities.

Related Content:

• How ‘Agile’ Changed Security At Dun Bradstreet
• Building A Winning Security Team From The Top Down
• Security Leadership The Art Of Decision Making

Steven has over 20 years of management consulting and industry experience working with technology, security and business executives, driving solutions to their most critical and complex problems. At Bay Dynamics, Steven is responsible for ensuring that clients are successful … View Full Bio

Article source: http://www.darkreading.com/careers-and-people/talking-cybersecurity-from-a-risk-management-point-of-view/a/d-id/1328050?_mc=RSS_DR_EDT

The Internal Revenue Service (IRS) is warning that the infamous Form W-2 phishing scam that traditionally has targeted corporations now is being used to dupe school districts, tribal organizations, restaurant chains, temp agenices, healthcare, shipping and freight firms, and non-profits.

In addition, attackers are adding wire transfer schemes to the mix, according to the alert from the IRS.

“This is one of the most dangerous email phishing scams we’ve seen in a long time. It can result in the large-scale theft of sensitive data that criminals can use to commit various crimes, including filing fraudulent tax returns. We need everyone’s help to turn the tide against this scheme,” said IRS Commissioner John Koskinen.

The phony emails come in the form of business email compromise (BEC) attacks, where the sender poses as an organization executive, sending phishing emails to payroll or human resource department employees asking for their employees’ Forms W-2.

“In the latest twist, the cybercriminal follows up with an ‘executive’ email to the payroll or comptroller and asks that a wire transfer also be made to a certain account. Although not tax related, the wire transfer scam is being coupled with the W-2 scam email, and some companies have lost both employees’ W-2s and thousands of dollars due to wire transfers,” the IRS alert explains.

The IRS alert and information on how to protect your employees from these attacks is here.

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: http://www.darkreading.com/attacks-breaches/irs-warns-of-new-w-2-phishing-attacks/d/d-id/1328055?_mc=RSS_DR_EDT

US-CERT and other organizations Friday warned of a zero-day memory corruption bug in several versions of Microsoft Windows that could allow a remote attacker to cause a vulnerable system to crash and reboot.

Proof of concept code for exploiting the vulnerability has already been released on GitHub and is now publicly available for anyone to use. As of mid-day Eastern Time on Friday, no patch was available for the vulnerability, which poses more of threat for home and small businesses than enterprises.

The bug exists in the way certain Windows versions handle Server Message Block (SMB) traffic, Carnegie Mellon University’s CERT division said in an alert. By sending a specially crafted message from a malicious server, an attacker can trigger a buffer overflow condition in a vulnerable Windows system and cause it to crash, the alert noted. Several methods are available to attackers to get a Windows client system to connect to a malicious SMB server, sometimes with little to no user interaction, it added.

The Microsoft SMB file sharing protocol allows Windows clients to request services and to read and write files from Windows servers in a network. It has been the source of several security issues over the years.

A Microsoft spokesperson downplayed the severity of the issue. “Windows is the only platform with a customer commitment to investigate reported security issues, and proactively update impacted devices as soon as possible,” the spokesperson said in a statement. “Our standard policy is that on issues of low risk, we remediate that risk via our current Update Tuesday schedule.” 

Johannes Ullirch, head of the Internet Storm Center at the SANS Institute, said he tested the issue on a fully patched Windows 10 system using the proof of concept code and immediately got a blue screen of death. All Windows clients that support SMBv3 including Windows 2012 and 2016, appear vulnerable to the exploit, he said.

“The bug is a denial of service bug,” Ullrich told Dark Reading. “If a system is hit by the exploit, then it will reboot.” The bug does not appear to give attackers a way to execute code or do anything beyond triggering a denial of service condition.

Exploiting the vulnerability is easy, Ullrich says. The attacker can use the exploit to implement an SMBv3 server and then trick the victim into connecting to it. “The easiest way to accomplish this is by inserting a URL linking the server to a Web page,” he says.

The URL might look like \192.0.2.1ipc$, where 192.0.2.1 is the IP address of the server. “An image tag like img src=”[malicious url]” will trigger the exploit.”

The vulnerability is another reminder why it is necessary to block outbound SMB connections by blocking ports 445, 135 and 139, Ullrich says. “Many networks do not close these ports outbound, which opens up a number of attack possibilities, not just this one.”

Home and small business users are more likely affected by the issue than enterprise users as small business and home firewalls usually do not block these connections by default, he notes.

In its advisory, CERT said it was currently unaware of a “practical solution” to the problem and urged organizations to block outbound SMB connections from the local network to the WAN on TCP ports 139 and 445 along with UDP ports 137 and 138.

Related Content:

• New SMB Relay Attack Steals User Credentials Over Internet
• Google Warns Of Windows Zero-Day Under Attack
• Microsoft Fires Back At Google For Windows 0-Day Disclosure

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year … View Full Bio

Article source: http://www.darkreading.com/attacks-breaches/windows-smb-zero-day-exploit-on-the-loose-/d/d-id/1328056?_mc=RSS_DR_EDT