Cyber Security stats from Surveys (I found them shocking)

Survey from EiQ Networks: (sample size not as big as I would hope.)

Some startling statistics, just 15% of IT people think they are prepared for a security breach. Just 21% think that what they have in place can mitigate the risk.

Only 80% about use a firewall (Another survey put this at 87%.) Only 28% are using host based firewalls. (You have to use both or one system being compromised suddenly becomes every system is compromised.) Only 2 thirds use anti-virus. Only 60% use some type of intrusion detection, mostly just watching logs.

Only 60% have even a partial process to respond to an attack and only 30% think that process is solid.

http://www.cioinsight.com/security/most-it-pros-ill-prepared-to-deal-with-breaches.html

Another survey from ISACA (bigger sized survey) shows that 67% of it professional have heard of APTs but half of those think they can protect against them. And the people who think they are ready to protect their networks from an APT are relying on the things that don’t work against APTs, Firewalls and Anti-virus. Like the keys to your house these things only work against the regular run of the mill threats and are practically useless to an APT threat. We still need them but they are nowhere near enough. (They don’t get it, even seasoned professionals in the cyber security industry don’t seem to get it.)

http://www.infoworld.com/article/2613636/security/companies-think-they-re-prepared-for-apt-cyber-attacks--but-they-aren-t.html

Couple this with Cisco’s survey 75% of CIO’s think that their security tools are effective but less than half of them patch their systems regularly. Also don’t really get it. What else are they not doing if they don't patch their systems?

http://www.computerweekly.com/news/2240238466/Delusion-about-cyber-security-growing-says-Cisco-report

There is also some noise in cyber circles about companies that think that since they were already attacked once (Sony for instance) they won’t be attacked again.

So sum that up to this; Most companies are not even doing the basics right. Not patching, poor firewall use, hoping that outdated technology like antivirus will help but they don’t even get that the threat they face has changed and even when presented with examples think it won’t happen to them or that since they have already been attacked are somehow immune. And they don’t have a proper plan to deal with it and I bet they also don’t have a plan of how to recover from it afterward either.

So what to do.

Cyber Security must do all of the motherhood stuff, firewalls (both perimeter and host), patching, anti-virus (even on Linux), etc. Segment your network so that the important stuff (Point of Sale, production, software development, whatever your company does) is not on your main network and that outside access is also on it's own network (like hvac and pepsi machines) and that access from the main network is controlled if allowed at all. If the only thing required is access out don't let access in.

And then if your line of business is at all a target for an APT then assume you are already compromised. If you could be a target you are a target and if you think you can't be a target prove it don't just think it.

You have to teach your employees how to recognize spam and phishing emails and not to open them. If you have employees that are not learning switch them to Linux with only user privileges. Better yet switch as many users as you can, without affecting their job function, to Linux. It's just safer and more secure. (Based on that there are so few malware for Linux and so many for Windows. and that the user access rights on Linux are not administrator level where on Windows so often it is.) Having a mixed network is more work but your IT people may complain but if they are good they will be fine. And put more money into IT. The biggest issue with cyber security is not that people can't do it but that companies are failing to fund it properly. Use open source tools, use free Linux firewalls and security tools like IPFire. Take the money you save and hire IT people. free tools with more people is better than paid tools (which are mostly based on the free tools and packaged to make them pretty) and not enough IT staff.

Also listen to your staff, regular and IT when they say there is something wrong. Most security breaches are not caught by IT but by sufficiently empowered users.

You need to do intrusion detection, something like snort but also honeypots: Fake systems that are not used for anything real on your network but if they get activity means someone is checking out your systems from the inside. Your systems are compromised and the attacker is looking for stuff to steal. Make them obvious and tempting and fill them with fake data. More on this another time perhaps. For now just do the motherhood issues and get enough IT staff to do their jobs.

Another rambling about malware, some history and impact

In the history of the personal computer there have been instances of malware that have been notorious firsts for affects and compromises we thought would never happen. Starting with the first viruses that spread from system to system by attaching themselves to other programs. The early viruses were clunky and easy to spot and remove. Most of the early viruses just did things like take over your screen and make noises.
It didn't take long for them to start causing damage, deleting files or wiping hard drives. AV programs were new and quickly became popular. And then viruses not only were terminate stay resident and copying from system to system but they became stealthy. They started to hide in places like the MBR of a hard drive and start themselves before the OS did and became root kits but also self modifying to change their signature to stay one step ahead of the AV and OS companies.
Some of the first root kits were for Windows NT, the aptly named NTRootKit for instance.
Then malware started to spread by attaching to documents and worms were born. These were macros and not "real" programs but the damage was just as severe. The love bug was an early example of this. These Macro viruses spread faster and further than anything before them, love bug was thought to have caused $10 billion before it was finally defeated.
For a while malware got boring. Not a lot of new stuff happened until we got word of a virus that put itself into the Bios. We thought that the bios was safe, flashing a bios was an arduous process that you had to be very careful to do and if you messed it up you bricked your computer. But an unnamed virus in CHina was found that when the virus was detected the owners cleaned he hard drive and it came back, then removed the hard drive and it came back. Finally they checked the bios and there it was. Apparently it was a company competitor that knew what brand and model computor  was being used in one company and made a virus to cause them damage and be a competitive advantage.
Next Stuxnet. They did a few things we thought no-one could do. They were the first notorious air gap jumping virus. With new information we can now say they did this by infecting the updates being delivered to the computers from the manufacturer as Stuxnet attacked those manufacturers first. They found a hole, a supplier that had privileged access and used that supplier to gain access to the air gapped network. new techniques for communicating with air gapped systems developed in the last year mean that if an air gap is breached then updating the malware is no longer impossible.
Malware then morphed into distributed computing to birth the botnet. Hundreds or thousands of infected computers all taking orders from a central set of command and control computers to send spam, do denial of service attacks (DDoS) and spread themselves even further. The bane of Windows XP and Windows Server.
The same family of malware as Stuxnet also produced some other firsts, the first time an industrial system was attacked on that large of a scale and they also used flaws in Microsoft's Windows Update to put viruses on computers using certificates to make the malware look like a legitimate patch through the OS update system. Flame/Duqu also were used to not just get information from computers but also information of the surroundings and people around those computers. They listened with microphones, used the cameras and wireless/bluetooth to find people, figure out their schedules and may have been used to target Iranian politicians and scientists for assassinations.
New malware happens all the time but for years a "real" virus, one that is binary, not a script, passes itself from machine to machine by infecting programs and is self replicating into different programs is rare. It is also rare to have a virus attack more than one operating system but last year there was one that while it was small in infections size and looked to me like a trial was detected. It infected Windows, Linux and reportedly Mac as they all use the same CPU family.
And then there are the hardware/malware attacks. When you plug a USB device into a computer the device and the computer talk so that the computer knows how to work with the device. But any USB device can be any type of device or even more than one at the same time. The first instance of this was not even looking like a USB device but an IPod dock. It was not only a dock and a set of speakers but also carried malware and infected the IPod/IPone and then installed malware. But any USB deice can do this. You could have a keyboard with a USB memory component and carry malware or a usb stick that is a regular stick and if there was malware in the memory could be cleaned but also in the USB firmware there could be a virus that cannot be cleaned. Or the firmware could also connect as a keyboard and issue commands or include a wireless wifi hub with no password required or just pulled data from the computer and broadcast it indiscriminately.
There are also reports of many devices with backdoors, extra hardware added by countries after things are shipped from companies either from within the country or as it passes through.
Malware can be firmware now.
A story we have been following is a German steel works that someone took control of the computers away from the staff and it caused the smelter to be completely damaged. They lost control of the computer and they were unable to shut down the smelter in a safe way. I just imagine that it just kept getting hotter and hotter until something broke and a flood of molten metal swept through the building. I still want to see pictures.
Then there are some notorious hacks. Sony has been hacked a number of times (you would think they would learn) and we can learn a few things from them. (Sorry Sony but I have to)
From the lulz-sec hacks we learned that a widely distributed company has som many different divisions that they can't keep track of them all so when lulz-sec found a sony network with no firewall they just couldn't resist. Yes one of the ways they got into PS Network was through credentials they got from a completely unprotected network. When the doors are thrown open and everything shared (they had windows shares with no security and rights set to everyone read) is that really a hack or is it authorized access when the access rights are everyone read? yes honest people would not have gone in but all firewalls are for now is keeping honest people honest. We all know that most "honest" people will still pick up the money dropped on the sidewalk. But I digress...
What we have learned from the latest Sony Pictures hack is even if you are doing most of all of the things you should do you can and probably will get compromised so you had better have a recovery plan in place. Sony Pictures scrambled to recover and even operate after their network was "burnt to the ground" and this is a new level. What is built into your network and procedures and culture to allow you to rebuild after everything is wiped clean. And if you have manufacturing or other processes what if your equipment is damaged or out of control.
Target showed us that you must segregate your networks. Don't put your must protect stuff on the same network as your general business network and certainly not on a network that external contractors/suppliers can get to.

All of these things have happened, the ways we protect things cannot possibly take all of them into account. Motherhood processes like patching have been turned against us. Air gaps don't even work so just keeping the system off of the network is not enough and may even be setting you up for a bigger crash.
Anti-virus hasn't worked for years, the new malware changes by the hour some times and signature files can't keep up. It does however allow us to stop all of the older versions of things so we still need to use it but don't rely on it.
Firewalls help keep out the lulzsec types and anonymous, mostly. But they are useless in the face of social engineering and driveby downloads.
A lot of people would say that most/all of the attacks above involved Windows (and they did) but switching to Linux or Mac would also switch the malware there once everyone switches but having a fair number of Linux systems on a network will make it more resilient.
Intrusion detection should work but none of the big attacks were ever caught by it until after the fact. IDS can't stop the Windows update attacks or any other new and evolving attack as they are again rule and or signature based.
There is no magic bullet for Cyber Security. There is only doing the things we all must do, perimeter protection, segregation, AV, patching, IDS (including honeypots and other diversionary tactics), running a firewall on every system, educating your users, vigilance and being prepared for when you will eventually be compromised.
Defense in depth and vigilance and be safe out there.

The Cyber Security Mess, a primer

Headlines across the planet are decrying the state of Cyber Security. From major companies being compromised, from the largest banks, to retail chains to government departments to ordinary people. Even police and security companies have been made targets, infiltrated and data taken. There have even been estimates that of companies with over 3000 computers 80% are currently being actively attacked and are compromised. Of these 80% only 20% are aware of it.

The average length of time between a company being compromised and determining this is three months. Most find out by a third party telling them they found data that had been extracted and for sale on the dark side of the Internet.
If your company thinks it has never been compromised then you probably are right now and don't realize it.

The  attackers are varied and have many different motives and targets. There are the cyber criminals, only in it for the money. The state actors, US, China, every other country including the ones who deny it. The hacktivists, political or freedom motivated who hack to bring their cause and the freedom of the web to every one, and then the "script kiddies" who hack because they can and the "lulz".

The current situation is bad, very bad. The criminals have so much information they can't use it all. The governments of the world are hoarding data into huge data warehouses with millions of square feet of server space and can't process it all. Law enforcement cannot keep up with the amount of hacks happening. So they go after the low hanging fruit, the easy to catch script kiddies with the hope of deterring the other actors by giving the ones they catch such long sentences they don't fit the crime committed.

How did we get to this point? How does this happen and happen and happen and yet no-one seems to be able to stop it?
The leading way to break into a network is to get someone else to do it for you. This can be by getting an insider to download malware through social engineering, or a watering hole attack or find an outside company that has access to the target company but is less secure. Once inside attackers have it easy since most companies don't properly segregate their networks into zones with access controls between them. Yes it makes getting at data harder, especially for the attacke

So there you go, make sure you have the minimum defenses in place at least, firewalls, antivirus and intrusion detection with someone who is monitoring them 24/7. Use segementing, a VPN, honeypots, heterogeneity and education to keep your network safe.
rs.

It's not expensive. Most of the tools out there to make a network secure are either open source or based on the open source tools in some way. Open source means free and as a bonus you get the source code so you can, if you know how and want to, verify that the software does what it says and has no back doors. And the extra bonus of you can make it better and give back to the open source project. If you come to rely on them a donation to keep them going is appreciated.

So what do you need to have. I thought everyone knew you needed a good firewall at the perimeter of your network. A single entry point that only lets through authenticated traffic. It stops random entry into your network. Add to that a VPN (Virtual Private Network) where your staff who are not inside your firewall can get in securely. Then filter all outgoing traffic to stop people from going to places where they can bring malware back in.

If you have any external entity accessing your network they must be segregated from the rest of your network. Your HVAC contractor doesn't need to be on the same network segment as your employee records or your client records or your point of sale network. These sensitive data networks should also be segregated from your run of the mill data network and if possible each other. If one part of your network is compromised make sure it isn't the important parts of the network.

Next anti-virus just to stop the threats we already know about. Anti-virus/anti-malware software works by knowing what known malware looks like and if it finds that signature blocks and removes it. But what about the stuff we don't know about? Intrusion detection works on analysing traffic patterns. If something abnormal is happening then someone gets alerted and they check it out. Other forms of intrusion detection include honeypots and tarpits. These are computers on your network who are sitting there to not do any work but be tempting targets for malware. And if they get any activity it is likely someone trying to break in. You get an alert and go see what the attacker is trying to do.  There are public honeypots at honeynet.org and they have a lot of info.

If your company is industrial with computers running machines there are also honeypots for that. Put one up where you think attackers might be looking and see if they are. Try Conpot from honeynet.org.

You also need to educate your users and continuously refresh their skills. For social engineering your users are either your weakest link or you line of defense. If you don't teach them they won't be very defensive.

Another problem we seem to have in almost every computer network is that to make things simple for IT we make every computer on the network exactly the same with the exact same software and access controls. It sure makes things easy for IT and the hackers. Now your IT is a smart but lazy bunch of people, who like to script everything. SO are hackers and your 'make it easy for IT' policy is also making it easy for hackers.  Networks with lots of different computers, heterogeneity, break most hackers tools. Malware that expects everything to be exactly the same breaks down when presented with many different systems all set up with different software and the software not always in the same places. A network full of carbon copy systems is a hackers playground.