Category: Cyber Mike

Password Managers, why should you use them?

1. Enhanced Security:
   • Unique, Strong Passwords: Most people tend to use weak passwords that are easily guessed or they reuse them across multiple websites. If you have to change your password you shouldn’t have to rename your dog. A password manager generates and stores strong, unique passwords for each account, reducing the risk of unauthorized access.
   • Encryption: Password managers encrypt your passwords, ensuring that only you can access them. They must follow a very strong and regulated industry standard.
2. Convenience and Efficiency:
   • Time-Saving: Beyond security, password managers streamline your online experience. They automatically log you into websites, sparing you the hassle of remembering and typing passwords.
   • Auto-Fill: In addition to passwords, they can store and auto-fill other information like addresses, phone numbers, and credit card details.
3. Centralized Management:
   • Single Vault: A password manager stores all your passwords in a single vault, accessible via a master password. No need to memorize numerous passwords.
   • Organization: You can organize and categorize passwords, making it easy to find specific credentials when needed.
4. Multi-Device Support:
   • Sync Across Devices: Password managers work seamlessly across multiple devices (computers, smartphones, tablets). Your passwords stay consistent and accessible wherever you go.
5. Security Best Practices:
   • Avoiding Reuse: By generating unique passwords, you avoid the common pitfall of reusing the same password across different services.
   • Multi-Factor Authentication (MFA): Some password managers support MFA, adding an extra layer of security.
   • Security Keys: They can also integrate with security keys for added protection.

Creating good passwords, when you need to

There will be times you need to create a password despite having a password manager (like the password to get into the password manager). Make it long, random and something you can remember. “Mike, that is impossible” – No, it isn’t and I will show you how.

1. Songs
   Song: 45 by Shinedown
   Favorite Lyrics: staring down the barrel of a 45 (45) Swimming through the ashes of another life (another life)
   Password: Sdtboa45(45)Sttaoal(al)
2. Quote
   Who: Martin Luther King Jr.
   Said: “Darkness cannot drive out darkness, only light can do that. Hate cannot drive out hate, only love can do that.”
   Password: Dcdod,olcdt.Hcdoh,olcdt.*15
3. Book
   Which: The Lion, the Witch and the Wardrobe by C.S. Lewis
   Line: Once there were four children whose names were Peter, Susan, Edmund, and Lucy.
   Password: Otw4cwnwP,S,E,L
4. Movie
   Title: The Holy Grail
   Line: “Your mother was a hamster and your father smelt of elderberries, I fart in your general direction”.
   Password: YmwaHayfsoE,Ifiygd%12
5. Personal Association
   My thought: “cybersecurity is awesome and making password posts will help the world get safer, Cheaaa Boyy #Flavor Flav
   Password: Cia&mppwhtwgs-CB#FF

When the threat actors break down your door, make sure you have another door.

Defense in depth is a security approach that involves deploying multiple layers of security tools, mechanisms, and policies in tandem. The goal is to create a robust defense system where if one layer fails, others will step in to protect against threats.

Analogies:

• Imagine a medieval castle with multiple moats, walls, and parapets. Each layer adds an additional barrier for attackers.
• In military terms, it’s akin to a defending army strategically retreating into its homeland’s interior, trading space for time.

Example:

PERIMETER SECURITY
Firewall, Penetration Testing, IDS/IPS, DDoS Protection

NETWORKING SECURITY
VPN, Wi-Fi Security, Secure DMZ, MDR, Continuous Monitoring

ENDPOINT SECURITY
NGAV/EDR, Asset Tracking, Rogue Device Monitoring, Patch Management, MFA, Endpoint Encryption

DATA SECURITY
PAM, MFA, Email Encryption, Data Backups, Database Monitoring, SIEM

BUSINESS OPERATIONS
Service Desk, SOC, Business Continuity, Disaster Recovery, Policies & Procedures, Governance, User Training, Vulnerability Management

PHYSICAL SECURITY
CCTV Security System, Access Control System, Guest Management, Alarm System, Power Backup, Fire Suppression

Defense in depth isn’t about relying on a single tool it’s about creating a resilient fortress where attackers face relentless obstacles. If you environment, account, resource, application is defeated by one single point of failure you need better defense in depth.

Massachusetts Standards for the Protection of Personal Information of Massachusetts Residents.

Created by Massachusetts to ensure the confidentiality and security of customer information. It applies to all persons who own or license personal information about a resident of Massachusetts.

What it means for you:

Organizations must anticipate threats to protect against malicious actors obtaining protected information. Unauthorized access to protected information or the use of such information should be prevented to avoid harm or inconvenience the consumer.

Why is it important to you:

Failure to comply may result in legal penalties as it is a mandate. Complying also demonstrates you commitment to protecting customer data to your customers. Breaches can damage your companies reputation and trust, implementation helps you reduce the risk of a breach. These proactive measures also prevent substantial harm to consumers.

What you need to do:

1. Create a COMPREHENSIVE Written Information Security Plan (WISP).
2. Make sure it applies to all protected data.
3. Include administrative, technical and physical safeguards (Security in Layers).
4. Designate an Information Security Manager (ISM), congrats, this is probably you.
5. Know the risks associated to paper records.
6. Regularly audit the WISP, actually do this.
7. Limit the data you collect to the data you need wherever possible.
8. Store the records for the proper time.
9. Ensure any data you get rid of is properly disposed of and destroyed.
10. Properly terminate the access of terminated employees.
11. Ensure third-party service providers with any data access are properly vetted.
12. Ensure any third-party service providers are contractually required to protect the protected data.
13. As always, trust then verify.

What else should I know:

1. Massachusetts requires organizations to PROMPTLY detect and report any security incidents or breaches involving personal information.
2. You MUST notify the affected individuals and the Massachusetts Attorney General’s Office.
3. The Massachusetts Attorney General’s Office will investigate the reported incident, you better have an updated WISP!
4. Severity, Impact and Circumstances of the data breach will be investigated.
5. If they don’t like what they find you could face fines, corrective measures, injunctions and legal proceedings.

Compliance with 201 CMR 17.00 is essential to protect personal information and avoid legal consequences. Organizations should prioritize security measures to prevent breaches and demonstrate due diligence.

There are many different compliances and regulations happening in the United States. Some have been federal mandates but most have been state level. I expect this to be wide spread and happen more often as more attacks on personal data are happening year over year.

---

Creating a great and effective Incident Response plan is very critical. There are many reasons why people struggle to get one properly implemented despite a lot of different materials out there.

Challenges:

1. Lack of Comprehensive Planning:
   DO NOT rush into this, it will be different for every organization based on different factors. This is not a “check box” activity. DO NOT rush to put an Incident Response Plan and Procedure in place to fulfill a requirement.
   
2. Limited Resources and Budget Constraints:
   I get it, you are a small organization or an organization that hasn’t put much value into cybersecurity or incident response. “We are too small of a company to be targeted”, “We have nothing they want”. Get something together from a high level, keep working to get it better. Cybersecurity is about continuous improvement, this will take genuine effort to make this process better and from multiple people, communication will be a key factor in success.
   
3. Skills Shortage and Training Gaps:
   Are you the lead? Train thru practice. Get your baseline created and then test the users that you will need to communicate with during an Incident Response scenario. Your lessons learned after the scenario will better prepare your team and get them to think about “what ifs” and “how can I better prepare”.
   
4. Complexity of IT Environments:
   Not only is this a common obstacle but it is also a huge reason why preparation is key. Know your environment, the better you know and the better it is documented the easier it will be to notice when something is wrong. Identify your critical assets or “crown gems”, doing that will help you understand what needs to be done to create better Defense in Layers.
   
5. Effective Communication and Coordination:
   This is the most common obstacle I find and the most important thing I want everyone to work on. If something bad happened right now and you wanted to alert your Incident Response Team how would you do it? If you message in Teams or Slack and don’t have a dedicated place to do this, good luck getting their proper attention that it is an emergency. Have an Incident Response area so that users know “If I post here I need your immediate attention because it is a RED LEVEL EMERGENCY”.

PICERL Incident Response Framework

PICERL is a well-structured framework for incident response that guides organizations through the process of handling security incidents.

PREPARE
Fail to Prepare, Prepare to Fail. When not actively responding to an incident, you are in this phase. Strive to get better with continuous improvement and attack surface reduction. System hardening, vulnerability management, patching, monitoring, documentation, training and practice are some things you should focus on.

IDENTIFY
Something has happened, act quickly and accurately to assess the situation and properly determine if it really is in incident. Make sure to categorize the incident and prioritize the incident based on severity, risk and impact. Make sure to escalate if needed to ensure the proper incident responders are working any confirmed incidents.

CONTAIN
The goal here is to stop the attack from spreading. Do not rush into this to ensure there are no holes in your containment. You need to prevent things from getting worse by being decisive with your actions.

ERADICATE
Get the attacker completely out and keep them out in the future. This should be the more permanent fix that happens after the threat has been contained. Complete any hardening, patching and additional configuration required. Make sure to continue monitoring.

RECOVER
Restore affected systems back to their previous state with additional measures in place to ensure the incident or a similar incident cannot happen again. Test monitor and validate your systems as they are restored. Get things back to normal.

LESSONS LEARNED
Document and Learn. What happened in the incident? How did the incident happen? How was the incident dealt with? What went well with the incident response? What went bad with the incident response? What needs to be changed in the incident response plan?

Stop reading this, go plan your Incident Response!