Black Hat USA 2014 Will Again Stress Need for Security Basics with Glimpse of What May Lie Ahead
Black Hat has become the go-to convention where black hats and white hats collide, with hackers showing off their ingenuity and prowess by openly defeating popular security measures, and security professionals demonstrating all of their latest tools and methods in their never-ending battle to keep up. The founder of Global Digital Forensics discusses how covering cybersecurity basics and getting the right emergency incident response plans in place can keep organizations on point for whatever threats may lie ahead.
Black Hat 2014 offering some FUD
When the Black Hat conventioneers descend on Las Vegas every year, starting today August 2nd this year, one thing can be always counted on, plenty of FUD will be on the menu - also known as fear, uncertainty and doubt. The run-up has already made its share of FUD inducing headlines, like this article published by Reuters on July 31st about how hackers could use a USB device like a computer mouse or keyboard to successfully infect a system with malware, completely undetected, by leveraging the unfiltered way operating systems read and process the firmware on the device once it’s plugged in. “And that is scary stuff,” Joe Caruso, founder and CEO/CTO of Global Digital Forensics (GDF) , a premier cyber security solutions provider, said. “But the way the cyber threat landscape is today, I would much rather see businesses use their resources, often very limited resources, in covering the basics like raising social engineering awareness for every employee across the board, having regular vulnerability assessments, penetration tests and deep scans performed, and putting together an effective emergency incident response plan, before directing any real concern or resources towards much more remote possibilities like these.”
New attack methods making headlines doesn’t necessarily mean they’re new, or likely
“It’s not like it’s a new concept. It was widely reported that late last year at the G20 Summit in Russia there was a little something extra in the gift bags handed out to the high ranking political officials in attendance, USB sticks and phone chargers, emblazoned with the summit logo, with spyware pre-loaded which would deploy their payload once the stick or charger was plugged into a system or device, like an tablet or smartphone," recalls Caruso. “But stunts like that take a decent amount of coordination and trust to pull off, but a well-crafted phishing or spear phishing campaign can cause exactly the same problems, are a lot easier to execute, and have a lot less overhead for the attackers, making it a cheap and easy attack to launch, making them a hacker’s dream on the risk-cost-and-reward scale. When you look at the biggest and most successful headline-making attacks, well over 90% of them started with a single employee dropping the ball by falling for a phishing or spear phishing email. So yes, that’s where the focus should be for every business with valuable ESI (Electronically Stored Information) and/or digital assets to protect. Covering the basics first and sweating the highly remote possibilities last; that’s how we structure and perform our professional vulnerability assessments and pen-testing (penetration testing), with a strong focus on social engineering. When we we’ve taken care of a client, they are in a much stronger position as far as their overall defensive cyber security posture is concerned, because we will have we’ve identified their weaknesses, from the technology to the human element, and we’ve eradicated any nasty hard-to-detect malware existing on the system or network. But there is one also one more piece to the puzzle which may be the most important of all, emergency incident response.”
When, not if, an attack occurs, an effective emergency response plan is crucial
“If any cyber security professional tells you there is such a thing as perfect cyber security protection, aside from dropping everything electronic and going back to paper and filing cabinets, don’t walk away, run!,” warns Caruso. “Cyber threats are evolving every day, threats no one ever saw coming will pop up, or someone will slip up and leave an opening an attacker is just waiting for. The difference between survival and total demise will all come down to how an organization responds. One of our biggest strengths in the security industry are our 24/7 emergency incident response teams, strategically positioned across the country and the globe to ensure we can have boots on the ground within hours, not days, to almost any metropolitan area. But most of the time we work even faster than that, with remote response options, in many cases, which allow us to be instantly on the job. Anyone can call us in an emergency, but clients that use us for our vulnerability assessments and pen-testing have some big advantages; we’ll already know the lay of the land relating to their requirements, regulatory compliance issues, data flow and digital architecture, and we will have already helped them devise and/or improve their emergency response policies and procedures so they have an easy-to-follow roadmap and escalation matrix ready to be executed at the first sniff of trouble. Our clients can also have us waiting in the wings with the “no-retainer” response services we offer our pen-testing clients. If something happens, we’re a phone call away and can jump right in knowing exactly what’s what so we can respond as efficiently and cost-effectively as possible, and if nothing happens, having us on call won’t cost them a thing. And that’s as close as you can get to a no-lose scenario in today’s digital world. Black Hat 2014 undoubtedly will offer a lot of FUD again this year, but we’re here to get you through whatever you actually encounter in the real world.”
To thrive in this digital world, only trust proven cyber security experts
*Global Digital Forensics is a recognized industry leader in the fields of computer forensics , cyber security and emergency incident response , with years of experience assisting clients in the government, banking, healthcare, education and corporate arenas. For a free consultation with a Global Digital Forensics specialist, call 1-800-868-8189 about tailoring a cost-effective plan which will meet your unique needs, without wasting resources on solutions you simply don’t need. Emergency responders are also standing by 24/7 to handle intrusion and data breach emergencies whenever and wherever they arise. Time is critical if a cyber incident has occurred, so don’t hesitate to get help. For more information, visit our cyber security page.