Cyber Security stats from Surveys (I found them shocking)

Survey from EiQ Networks: (sample size not as big as I would hope.)

Some startling statistics, just 15% of IT people think they are prepared for a security breach. Just 21% think that what they have in place can mitigate the risk.

Only 80% about use a firewall (Another survey put this at 87%.) Only 28% are using host based firewalls. (You have to use both or one system being compromised suddenly becomes every system is compromised.) Only 2 thirds use anti-virus. Only 60% use some type of intrusion detection, mostly just watching logs.

Only 60% have even a partial process to respond to an attack and only 30% think that process is solid.

http://www.cioinsight.com/security/most-it-pros-ill-prepared-to-deal-with-breaches.html

Another survey from ISACA (bigger sized survey) shows that 67% of it professional have heard of APTs but half of those think they can protect against them. And the people who think they are ready to protect their networks from an APT are relying on the things that don’t work against APTs, Firewalls and Anti-virus. Like the keys to your house these things only work against the regular run of the mill threats and are practically useless to an APT threat. We still need them but they are nowhere near enough. (They don’t get it, even seasoned professionals in the cyber security industry don’t seem to get it.)

http://www.infoworld.com/article/2613636/security/companies-think-they-re-prepared-for-apt-cyber-attacks--but-they-aren-t.html

Couple this with Cisco’s survey 75% of CIO’s think that their security tools are effective but less than half of them patch their systems regularly. Also don’t really get it. What else are they not doing if they don't patch their systems?

http://www.computerweekly.com/news/2240238466/Delusion-about-cyber-security-growing-says-Cisco-report

There is also some noise in cyber circles about companies that think that since they were already attacked once (Sony for instance) they won’t be attacked again.

So sum that up to this; Most companies are not even doing the basics right. Not patching, poor firewall use, hoping that outdated technology like antivirus will help but they don’t even get that the threat they face has changed and even when presented with examples think it won’t happen to them or that since they have already been attacked are somehow immune. And they don’t have a proper plan to deal with it and I bet they also don’t have a plan of how to recover from it afterward either.

So what to do.

Cyber Security must do all of the motherhood stuff, firewalls (both perimeter and host), patching, anti-virus (even on Linux), etc. Segment your network so that the important stuff (Point of Sale, production, software development, whatever your company does) is not on your main network and that outside access is also on it's own network (like hvac and pepsi machines) and that access from the main network is controlled if allowed at all. If the only thing required is access out don't let access in.

And then if your line of business is at all a target for an APT then assume you are already compromised. If you could be a target you are a target and if you think you can't be a target prove it don't just think it.

You have to teach your employees how to recognize spam and phishing emails and not to open them. If you have employees that are not learning switch them to Linux with only user privileges. Better yet switch as many users as you can, without affecting their job function, to Linux. It's just safer and more secure. (Based on that there are so few malware for Linux and so many for Windows. and that the user access rights on Linux are not administrator level where on Windows so often it is.) Having a mixed network is more work but your IT people may complain but if they are good they will be fine. And put more money into IT. The biggest issue with cyber security is not that people can't do it but that companies are failing to fund it properly. Use open source tools, use free Linux firewalls and security tools like IPFire. Take the money you save and hire IT people. free tools with more people is better than paid tools (which are mostly based on the free tools and packaged to make them pretty) and not enough IT staff.

Also listen to your staff, regular and IT when they say there is something wrong. Most security breaches are not caught by IT but by sufficiently empowered users.

You need to do intrusion detection, something like snort but also honeypots: Fake systems that are not used for anything real on your network but if they get activity means someone is checking out your systems from the inside. Your systems are compromised and the attacker is looking for stuff to steal. Make them obvious and tempting and fill them with fake data. More on this another time perhaps. For now just do the motherhood issues and get enough IT staff to do their jobs.

Another rambling about malware, some history and impact

In the history of the personal computer there have been instances of malware that have been notorious firsts for affects and compromises we thought would never happen. Starting with the first viruses that spread from system to system by attaching themselves to other programs. The early viruses were clunky and easy to spot and remove. Most of the early viruses just did things like take over your screen and make noises.
It didn't take long for them to start causing damage, deleting files or wiping hard drives. AV programs were new and quickly became popular. And then viruses not only were terminate stay resident and copying from system to system but they became stealthy. They started to hide in places like the MBR of a hard drive and start themselves before the OS did and became root kits but also self modifying to change their signature to stay one step ahead of the AV and OS companies.
Some of the first root kits were for Windows NT, the aptly named NTRootKit for instance.
Then malware started to spread by attaching to documents and worms were born. These were macros and not "real" programs but the damage was just as severe. The love bug was an early example of this. These Macro viruses spread faster and further than anything before them, love bug was thought to have caused $10 billion before it was finally defeated.
For a while malware got boring. Not a lot of new stuff happened until we got word of a virus that put itself into the Bios. We thought that the bios was safe, flashing a bios was an arduous process that you had to be very careful to do and if you messed it up you bricked your computer. But an unnamed virus in CHina was found that when the virus was detected the owners cleaned he hard drive and it came back, then removed the hard drive and it came back. Finally they checked the bios and there it was. Apparently it was a company competitor that knew what brand and model computor  was being used in one company and made a virus to cause them damage and be a competitive advantage.
Next Stuxnet. They did a few things we thought no-one could do. They were the first notorious air gap jumping virus. With new information we can now say they did this by infecting the updates being delivered to the computers from the manufacturer as Stuxnet attacked those manufacturers first. They found a hole, a supplier that had privileged access and used that supplier to gain access to the air gapped network. new techniques for communicating with air gapped systems developed in the last year mean that if an air gap is breached then updating the malware is no longer impossible.
Malware then morphed into distributed computing to birth the botnet. Hundreds or thousands of infected computers all taking orders from a central set of command and control computers to send spam, do denial of service attacks (DDoS) and spread themselves even further. The bane of Windows XP and Windows Server.
The same family of malware as Stuxnet also produced some other firsts, the first time an industrial system was attacked on that large of a scale and they also used flaws in Microsoft's Windows Update to put viruses on computers using certificates to make the malware look like a legitimate patch through the OS update system. Flame/Duqu also were used to not just get information from computers but also information of the surroundings and people around those computers. They listened with microphones, used the cameras and wireless/bluetooth to find people, figure out their schedules and may have been used to target Iranian politicians and scientists for assassinations.
New malware happens all the time but for years a "real" virus, one that is binary, not a script, passes itself from machine to machine by infecting programs and is self replicating into different programs is rare. It is also rare to have a virus attack more than one operating system but last year there was one that while it was small in infections size and looked to me like a trial was detected. It infected Windows, Linux and reportedly Mac as they all use the same CPU family.
And then there are the hardware/malware attacks. When you plug a USB device into a computer the device and the computer talk so that the computer knows how to work with the device. But any USB device can be any type of device or even more than one at the same time. The first instance of this was not even looking like a USB device but an IPod dock. It was not only a dock and a set of speakers but also carried malware and infected the IPod/IPone and then installed malware. But any USB deice can do this. You could have a keyboard with a USB memory component and carry malware or a usb stick that is a regular stick and if there was malware in the memory could be cleaned but also in the USB firmware there could be a virus that cannot be cleaned. Or the firmware could also connect as a keyboard and issue commands or include a wireless wifi hub with no password required or just pulled data from the computer and broadcast it indiscriminately.
There are also reports of many devices with backdoors, extra hardware added by countries after things are shipped from companies either from within the country or as it passes through.
Malware can be firmware now.
A story we have been following is a German steel works that someone took control of the computers away from the staff and it caused the smelter to be completely damaged. They lost control of the computer and they were unable to shut down the smelter in a safe way. I just imagine that it just kept getting hotter and hotter until something broke and a flood of molten metal swept through the building. I still want to see pictures.
Then there are some notorious hacks. Sony has been hacked a number of times (you would think they would learn) and we can learn a few things from them. (Sorry Sony but I have to)
From the lulz-sec hacks we learned that a widely distributed company has som many different divisions that they can't keep track of them all so when lulz-sec found a sony network with no firewall they just couldn't resist. Yes one of the ways they got into PS Network was through credentials they got from a completely unprotected network. When the doors are thrown open and everything shared (they had windows shares with no security and rights set to everyone read) is that really a hack or is it authorized access when the access rights are everyone read? yes honest people would not have gone in but all firewalls are for now is keeping honest people honest. We all know that most "honest" people will still pick up the money dropped on the sidewalk. But I digress...
What we have learned from the latest Sony Pictures hack is even if you are doing most of all of the things you should do you can and probably will get compromised so you had better have a recovery plan in place. Sony Pictures scrambled to recover and even operate after their network was "burnt to the ground" and this is a new level. What is built into your network and procedures and culture to allow you to rebuild after everything is wiped clean. And if you have manufacturing or other processes what if your equipment is damaged or out of control.
Target showed us that you must segregate your networks. Don't put your must protect stuff on the same network as your general business network and certainly not on a network that external contractors/suppliers can get to.

All of these things have happened, the ways we protect things cannot possibly take all of them into account. Motherhood processes like patching have been turned against us. Air gaps don't even work so just keeping the system off of the network is not enough and may even be setting you up for a bigger crash.
Anti-virus hasn't worked for years, the new malware changes by the hour some times and signature files can't keep up. It does however allow us to stop all of the older versions of things so we still need to use it but don't rely on it.
Firewalls help keep out the lulzsec types and anonymous, mostly. But they are useless in the face of social engineering and driveby downloads.
A lot of people would say that most/all of the attacks above involved Windows (and they did) but switching to Linux or Mac would also switch the malware there once everyone switches but having a fair number of Linux systems on a network will make it more resilient.
Intrusion detection should work but none of the big attacks were ever caught by it until after the fact. IDS can't stop the Windows update attacks or any other new and evolving attack as they are again rule and or signature based.
There is no magic bullet for Cyber Security. There is only doing the things we all must do, perimeter protection, segregation, AV, patching, IDS (including honeypots and other diversionary tactics), running a firewall on every system, educating your users, vigilance and being prepared for when you will eventually be compromised.
Defense in depth and vigilance and be safe out there.

So have you been hacked yet, hopefully it was you doing it but probably not

I do cyber security research, lately more than ever. As most companies have lately, there is an uptick on attacks, some because of recent bugs being published, others because cyber is both big business and sadly, seems to be what governments all over are doing.
It's an open secret that everyone is hacking everyone in terms of spying and trying to get or keep the upper hand in trade. While I am not involved in that I see it all the time. Typically when someone gets attacked it is some user or contractor or supplier that opens the door to the wrong email or link or attachment. We say we have to teach the users and we do.
But then a user clicks the wrong thing and people start pointing fingers. "Why did you do that", implying the user is an idiot or something. Anyone who knows me knows I do not advocate blaming users. They just want to do their jobs and get work done. Sometimes they have to chill and read email or whatever and most of the time, 99.9999% of the time (completely made up but you know what I mean) they don't click the link and trash phishing emails. But the one time in thousands of emails they get and they slip up once they get pointed to as 'the guy'.
It's not fair or even helpful to blame them so we have to stop it. The blame stands only on the people doing the attack, not the user who clicked the link, not the researcher who found the flaw in your program or product, not the people who wrote the software or the OS (sorry no Microsoft jokes today) but the guy who made the attack and the people who back him.
Yes all of those people, the user, programmers, cyber techs, systems admins do have a role to play in making the attackers life harder but it's the attackers who hold 100% of the blame.
I write software. I want the software to just work for users and not be a pain to use, pleasant even, but I also have to consider the security issues and I wish I didn't have to, but I do. It makes programming slower and it makes software slower. I can't see us getting out of this. I do see that we need to make our defenses stronger, always practice defense in depth, segregate our networks, use decoys, honey and tar pots a lot more.
With world events and history as our guide I don't see any of the governments (all of the governments) ever being brave enough to admit they have been doing this or forward thinking enough to use that admission to pressure others to do the same and get started breaking the cycle. The current thoughts seem to be we have to do it because everyone else is.
With the current trend of breaking into control systems of industrial systems, scada or otherwise, at some point someone will get into the wrong thing. Something big and dangerous that should never have been connected anyway but it was easier to do it this way, you know how it is. And once connected they will experiment with it and something horribly goes wrong and people get killed or worse. At that time it becomes a physical attack and then what happens?
None of us want this to happen but it will.
In the time being we all hear the talking heads. The head of some US agency telling people that there are two types of big businesses in the US (and I suspect of every country) "the ones who have been hacked by china, and the ones who don't know they have been hacked by china". In Canada the boogyman, rightly or wrongly is Russia at the moment with people all talking of "sandworm." And yet there is evidence that the malware being used is attacking everyone, Russia included and maybe the top target. Whoever it is seems to also be attacking Ukraine as well so I really don't see who would attack both sides in that conflict except maybe newspapers or TV news.
If we believed everything in the news you would think the west was perfect but as we saw in the leaks by Ed Snowden the west, especially the group of five my own country is in, is just as bad if not worse. Probably not worse, but maybe.
I stand with the users, ordinary people and ordinary companies that just have a job to do and want to feed their kids, make the world a bit better etc. We just want to be able to do our jobs, play a few games and be sociable. Maybe the governments of the world should all just go and make their own network (not the one we took from you) and leave the rest of us alone. Is it to much to ask?
Until then, invest in open source, it seems to be more secure and we can at least find the back doors, turn on your firewall and change the default passwords (to keep the media out), put your must be secure stuff on it's own network segment with another (open source) firewall that is not the same segment that external entities can log into and use a decoy/honeypot to confuse attackers.
Use vpns internally between secure segments. Your switched network is just too easy to spoof but a secure tunnel makes it just that much harder for the attackers. Use two, and only use encrypted protocols on all of your servers all the time, mixing it up and using real certificates and passwords.
Crack your user password database, teach your users when to use secure passwords and when not to, otherwise you end up with password stickies everywhere. 
Educate your users but quit blaming them, let them work.
All of that stuff you put in place to better control your users use of your company computers, it's making it easier for you to be attacked. Diversity is strength, both in people and in computers. You can still use Windows if you want (and you turn on the firewall) but embrace Mac and Linux and Everything. A diverse network confuses hackers to no end.
Learn what your attackers know. Personally learn it. It's way too easy to learn about your company on line without alerting you to the fact you are being stalked. (That also goes for the attackers, they are not as smart as they think they are, and neither am I apparently, amazing how the most views on my various accounts have swung to mostly from Russia lately, they topped the Chinese this month. What I get for baiting them on line I guess, Hi Guys.)
Use the tools they use. Set up a test network in your office (even the CIO should try this once) and hack the hell out of it. Put computers (I use a virtual network populated with virtual machines behind a virtual firewall/router virtual machine and I update it all the time. On there I have a virtual machine running Kali Linux and I also added some new tools for PLCs and snmp and one of my virtual machines is a virtual plc/virtual sensors) using your chosen company os and software. Then search for exploits.
If you have time try fuzzing your network and then start reverse engineering the malware that has worked against your company. I am sure you have something somewhere that was compromised. Hack the software the hackers used to hack you. It will teach you. There are many good tools for reverse engineering code. be careful, hacker code is obfuscated and poorly written for the most part. It can make your brain hurt to see some of the coding used. Also don't believe everything you read. If it includes a language, for instance, that language is used in a lot more than one place in the world. Russian does not mean Russia any more than English means England. IP addresses do lie, just like the cake.
Do all of this and you give yourself a better chance but don't stop, security is a journey not a destination.
You dear reader have most likely already been hacked or compromised in some way or another. If you don't think you have look harder. If you have, look for more. Stopping the attackers from getting in is one thing, stopping them from getting out is the other.
I love fake data. Something that looks real but if used will not work. Fake systems (honey pots), false leads and looking for that false information to show up somewhere have to be part of the deal. Finding the error in your false lead code out there in the wild allows you to connect the dots. There was a company released its own fake version of a game to people to pirate. When people started asking questions about the error message that only showed up in the pirated version it was funny. Do the same to malware users. It's satisfying.
Look at me go on, sorry. But there you have it my advice today on what to do to be secure, basically, open source, diversity and go hack yourself, have fun.