5 Steps to Better Cyber Risk Management

This article was originally written by Paul Konikowski, and published on Commercial Integrator on January 15, 2019

Does your company accept credit card payments?  Does your human resource department keep records of the employees’ personal data? What about third-party vendors that handle payroll, or even the folks who take the garbage out? Nearly everyone has a camera on their smart phone these days.

So, before you can protect the data of your clients and design secure audiovisual systems, you should look first at your own company’s cyber risk management framework.

There is no single cyber risk management approach that will stop all cyber crime; it varies per industry. But generally speaking, there are five elements that are common in successful cyber risk management:

  1. Start with a proper cybersecurity framework, which provide a structure for ensuring your “CIA”:
    1. Confidentiality of sensitive data – restricting access to who can view the data
    2. Integrity of the systems – controlling who can write or change or delete data
    3. Availability – ensuring that systems are up and running when they are needed

There are a number of cybersecurity frameworks readily available; the most relevant to audiovisual systems contractors are the ISO/IEC Security Control Standards, the FCC Cyber Security Planning Guide, and the NIST (National Institute of Standards and Technology) Cybersecurity Framework, which has been widely adopted across many industries.

  1. Implement a balanced distribution of responsibility. Many users think that cybersecurity is the responsibility of the IT department, but it is really everyone’s responsibility. Anyone with email access can be susceptible to a “phishing” scam where they inadvertently click a malicious link or attachment. Executives must understand the risks and their responsibilities.
  2. Take a holistic approach to security. Consider not only technical factors, but human and physical factors. It is important that companies equip their employees with the right tools to recognize phishing email and malware, or even bad actors within their organization. Develop a company culture of cyber-awareness, and provide adequate training to all users. Reward users for raising security concerns. Minimize physical access to equipment using access controls.
  3. Develop a thorough and ongoing risk assessment process. The first step is to identify and categorize your assets, including digital assets and intellectual property (IP). Next, identify the threats to your organization, which could be external, like a hacker locking up your systems using ransom ware, or someone stealing credit card or personal informational, or a hacktivist who doesn’t agree with your company’s values. Maybe a competitor wants to shut you down for a week and ruin your reputation? But there could also be internal threats: users who might accidentally delete files, or malicious employees who try to steal your trade secrets. Assume you just hired the next Edward Snowden. Consider a third party who can test and assess your systems and vulnerabilities. Like humans, most companies cannot recognize their own faults.
  4. Everyone in the organization needs to know what to do when a threat has been detected. We talked about Incident Response Plans in greater detail last month.

By developing and maintaining a cyber risk management approach for technicians, you can minimize the cyber threats and resulting impacts to your organization. You will also be prepared when your clients ask you for a copy of your cybersecurity policy or risk mitigation plan (and they will!)

If you enjoyed this article, you might like these related posts:

The Best Data Breach Incident Response Plans Require These Steps

Proofpoint ($PFPT) Releases Solution To Detect and Respond To Compromised Microsoft Office 365 Accounts

Advertisements

The Best Data Breach Incident Response Plans Require These Steps

This article was originally written by Paul Konikowski, and published on Commercial Integrator on December 10, 2018 and  My Tech Decisions on December 20, 2018.

Cybercrime is on the rise. Data breaches and cyberattacks have become more diverse and numerous, and their impact more damaging and disruptive. It feels like every other day, there is news of a large corporation getting hacked and/or losing some of your personal data. It is not a matter of “if” you will be impacted, but “when”. This is why it is so important for corporations and organizations to have a Cybersecurity Policy in place, along with an Incident Response Plan (IRP), and the right team of people who know how to react appropriately, often called the Incident Response Team (IRT).

Once a threat is detected, the IRP acts as a roadmap, allowing the IRT to take a systematic approach to solving the problem, documenting everything along the way, and minimizing human error. This reduces losses and downtime. The other big advantage is that, following an incident, evidence that the cybersecurity policy, including IRP and IRT, were in place will be useful should the attack lead to legal proceedings. Ignorance is no excuse when it comes to cybersecurity. Negligence can result in costly fines, lawsuits, and/or time in prison, all of which can negatively impact a company’s reputation.

There are many variations, but the best Incident Response Plans typically include the following steps:

  1. Analysis – Is it a false positive? The IRT should review the logs for vulnerability tests or other abnormalities. What systems have been attacked? What stage of the attack? What is the origin?
  2. Containment – Provides time to determine the next steps, while limiting the spread, and the impact. Your team should isolate the system if possible and make a backup for forensic investigation.
  3. Communication – Alert everyone on the Incident Response Team including IT, HR, Legal, Operations and Management representatives. Should law enforcement/FBI be contacted? Experts like FireEye? Third party vendors? Industry peers? How soon should you alert the public? The laws vary by state in the US. In the EU, the GDPR says within 72 hours. Your IRP should include a detailed cyber crisis communication plan, detailing who should be contacted in case of an attack, what message that will be conveyed to them, and who has the authority to communicate on behalf of the organization.
  4. Eradication – Scan all systems for malware. Isolate and disable all accounts and components that have been compromised. Remove access to systems by suspect employee logins. Change passwords, apply patches, and reconfigure firewalls.
  5. Recovery – This can take a while, so you need to prioritize what systems are most critical to resume functionality
  6. Post-event analysis – What was the dwell time? (time from breach to recovery) Are changes to policies, procedures, or equipment in order? How effective was the incident response plan? Then, test the revised IRP using simulated attack.

In conjunction with having an incident response plan, organizations need to provide adequate cyber awareness training to all employees, not only explicitly telling everyone what to do, but what not to do, in the event of a data breach or cyber-attack. Setting guidelines for communicating with outside parties regarding incidents is key. You don’t want someone in your organization tweeting “WE ARE GETTING HACKED!!!”, followed by a dozen hashtags, do you?

 

Proofpoint ($PFPT) Releases Solution To Detect and Respond To Compromised Microsoft Office 365 Accounts

Registered Trademark of Proofpoint Inc.

In a press release issued earlier today, Proofpoint (NASDAQ:PFPT) “announced the availability of Proofpoint Cloud Account Defense (PCAD) to detect and proactively protect Microsoft Office 365 accounts, preventing attackers from causing financial and data loss.”

So What Does This Have To Do With The Folks In AV Land?

Back when I was an audio/video installer (cue the instrumental music), a well-known manufacturer of AV racks would use a handful of key codes for the locking doors on the front and rear of the AV racks. Once an installer had the basic set of keys, he or she could basically unlock any AV rack made by that manufacturer. This was very helpful when troubleshooting AV racks, because the keys were often lost by clients.

Since the AV Rack enclosure keys were so common, they were more of a theft deterrent, and provided no way of truly stopping the theivery, nor was there any trace left behind indicating that someone had unlocked the front or back door.

Many AV integrators will add “security screws” which only prevent someone who was not smart enough, or just plain too lazy, to buy the associated security bit/driver. I remember some of my former coworkers taking it a step further, and hammering the mounting screw posts down until they were bent, just to stop another contractor who kept removing the integrator’s 1RU vanity plate.

About 15-20 years ago, some higher-education IT departments were the first groups that I saw to utilize the LAN ports on the data projectors for security purposes. They would ping the projectors once every minute or so, and if for some reason the projector did not respond, an email was automatically sent to the campus police department, telling them a projector thief may be in such and such room. If the police department was quick enough to respond, they might catch them in the act.

*Cough-cough* It’s All About Convergence *Cough-Cough*

Nowadays, AV rack keys and walking projectors are the least of our worries. As stated in today’s Proofpoint press release, “Cybercriminals have pioneered a new way to compromise corporate email systems, this time by using brute force attacks to steal Microsoft Office 365 login credentials of corporate users and then logging in as an imposter on the system. These new hacking techniques work even if the company has deployed single sign on or multi-factor authentication (MFA) as part of their security system. Once the hacker has logged in masquerading as a real employee, they have a wide spectrum of choices while operating within a corporation’s email instance to cause financial harm and data loss.”

Just as AV has fully converged with IT, so have our security concerns for both hardware and software. We don’t just sell projectors, flat panels, speakers, and AV racks, we sell cloud-based software solutions like Skype For Business, which will soon be a part of Microsoft Teams. Users use single-sign on or multi-factor authentication to access our conferencing and presentation systems, and collaborate with others in the cloud. We install tablet-style room reservation systems that work with Active Directory and company-wide scheduling systems like Microsoft Outlook and Exchange Server.

Having a compromised O365 account is like having a key to every AV system on the network, as well as valuable data stored in the company cloud. If our AV systems rely on a secure network, single sign-on, and active directory, then AV manufacturers, consultants, and integrators all need to be made aware of the inherent security risks.  Integrated system components need to be fully vetted on test networks that use O365 and Proofpoint’s Cloud Account Defense (PCAD) or similar cloud-security solutions, so that there are no surprises when the systems are brought online. We need to go the extra mile, and “hammer down the screw posts” of AV/IT cyber-security, so-to-speak. Constant vigilance!

For more information on Proofpoint’s Cloud Account Defense solution, click here.

If you enjoyed this article, you might also be interested in these similar posts:

Cybersecurity In Audiovisual Systems

We Used To Be Heroes

 

Registered Trademark of Proofpoint Inc.
The Proofpoint Logo Is A Registered Trademark Of Proofpoint, Inc.