Asymmetric Defense Failures

No. I'm not talking about the cost of an attack vs. the cost of defending the network. I'm talking about traffic flows. Communications are bidirectional, ingress and egress, yet many still focus on only ingress protection mechanisms.

You need both. For example, your firewall and intrusion prevention system (malware, etc.) may do a fantastic job at identifying incoming attacks. However, you also need egress detective and protective controls. For example, your DLP system can help identify data exfiltration – egress – and your network behavior anomaly detection appliance can help identify potentially compromised hosts communicating to command and control servers.

There's actually much more to write about on this topic. But for now, suffice to say that intelligent context and control of communications are important from both perspectives.

NIST SP 800-53 r4 to CJIS v5.4 Control Mapping

Reverse mapped CJIS control set into NIST 800-53 controls as the new baseline.

Download here.

Spreadsheet: FBI Cloud Control Catalog – Appendix A

Here's the spreadsheet version, cleaned up, of the FBI Criminal Justice Information Systems (CJIS) Security Policy - CJIS Cloud Control Catalog.

► Download spreadsheet version here.

HIPAA Technical Control & Assessment Links

Go to the documents tab to find spreadsheet versions of the below.

• NIST HIPAA Security Rule Toolkit
  http://scap.nist.gov/hipaa/
• Security Risk Assessment Tool (SRA Tool)
  https://www.healthit.gov/providers-professionals/security-risk-assessment-tool
• Technical Safeguards [DOCX - 240 KB]
  https://www.healthit.gov/sites/default/files/20140320_sratool_content_-_technical_volume_v1.docx
• Top 10 Tips for Cybersecurity in Health Care
  https://www.healthit.gov/providers-professionals-newsroom/top-10-tips-cybersecurity-health-care

Recent discussions… Capturing some of that here. Some of the more important links to technical assessment information is above. Services are actually easy to build, as long as you simplify the approach. Has everything to do with scope, stating assumptions, and setting expectations.

By the way – yes, I downloaded and reviewed the current version of the HITRUST framework.

On another note, HITECH  has nothing to do with technical controls and is an unfortunate name. It's confusing, but it's entire focus is enforcement – putting teeth into HIPAA using financial penalties as an incentive. Please do not use it out of context.

Your Number One, Gotta-Have-It, Top Priority, Most Important, Critical Control

Security Awareness. 
Right. You know this. Or you've heard it enough that you accept it. Or perhaps you've heard this and think it's a bunch of hungry capitalists creating a new market opportunity to feed in perpetuity like the leeches clinging to the flesh of their unassuming victims...

Intelligent Agents.
One of the more interesting subjects I've studied that has given me a perspective on the complexity of organizations was Organizational Behavior/Managing Complexity at the McCombs School of Business with Dr. Reuben McDaniel. With the basis of my military experience on submarines as a backdrop, I listened as Dr. McDaniel wove stories together of chaos theory, change agents, and the unbelievable complexity of launching an aircraft off of an aircraft carrier in the middle of the ocean. There are hundreds of people involved at different points in the process to launch a single aircraft. There are thousands of actions. Yet there are so few accidents. The structure and organization shape the direction of each individual's affect on the system to execute the singular complex action of launching a plane off the ship. Each individual is a change agent. These people are among the best trained in the world at what they do.

How does it work? 
No expense is spared to ensure these men and women are equipped with the skills to execute the expected routine actions... and... These men and women are equipped with the skills to execute on the unexpected, respond to the deviations from the norm - to analyze and correct with situational awareness.

It's with similar experiences during complex submerged operations that I related to his stories. It's with that understanding that I have always stood by security awareness as the number one control for any organization. If I can't break your perimeter, then I will shift tactics and social engineer my way into the organization. Your last line of defense? Well trained, expectant, alert, aware, intelligent agents. 

VMware Compliance Checkers

How about something for FREE!

Some people were asking about this today and I thought I would share here.

There are hundreds of compliance tools and checkers on the market. How about these two gems from VMware? Do you have concerns with PCI and environment compliance with the Data Security Standard? How about a free tool from VMware that checks this for you? How about another free tool that checks your environment against their VMware vSphere Hardening Guidelines? Free.

• PCI-DSS Compliance Checker: http://www.vmware.com/products/datacenter-virtualization/pci-compliance-checker/overview.html
• VMware Hardening Guidelines: http://www.vmware.com/products/datacenter-virtualization/vsphere-compliance-checker/overview.html

Common Audit Regulations, Standards, Practices, and Guides

These link to the original information sources.

The Abbreviated List

• Common Regulations and Standards SOX | GLBA | FFIEC | Basel II| FCRA | HIPAA | NERC | NRC | CFAA | FISMA | FRCP | FISCAM |Privacy Act of 1974 | Safe Harbor | NYSE  | PCI-DSS | COSO 
• Audit Practices and Guides | ISO 27001:2005 | ISO/IEC 27002-2005| OGC ITIL | BCI | CobiT | ISACA | AICPA | ISACA | OECD

Circling Back: Repeatable Processes

Do you have any doubt - whatsoever - that a well-coached sports team with good talent can beat a loose gathering of the world's best talent? It takes more than talent to have repeatable success. Effective leadership and management provide purpose, methods and metrics for performing consistently at the top of your game. The fundamentals are taught early and revisited often in sports. Coaches want their players to master and lean into the basics under the stress of physical and mental exhaustion. It's what drives the extra effort in the last seconds, driving towards the goal, to square up your shot and follow through.


Mastering Fundamentals Take Time. 
Malcolm Gladwell, in his book Outliers: The Story of Success, illustrates the strong correlation between the amount of time invested in a particular skill and the outcome. Mastery, according to his research, typically occurs after 10,000 hours (e.g. ~20 hours/week over 10 years). Examples included the obvious, such as athletes and musicians. Examples also included the not-so-obvious, such as Bill Gates programming for 10,000 hours prior to his break starting Microsoft.

Now - I'm not suggesting that developing an effective IT GRC program is going to take 10 years. However, I am suggesting that developing a strategy aligned with your business purpose, goals, and constraints is difficult to create, audit, and effectively manage. Also, it will take you longer than 10 years if you never start.


The Manager Administers; the Leader Innovates.

Warren Bennis wrote a list of differences between leadership and management in his book On Becoming a Leader. Read through some of them here in the context of the three cycles we discussed in the previous blog postings. Each cycle has to be managed to function, and each cycle requires leadership to innovate and respond to changing conditions.

Here's what happens when a system breaks down from a lack of experience and maturity that develops over time, working through difficult challenges. It's a flash back to the 2004 Olympic Men's Basketball team fielded by the inventors of the sport. Basketball and Apple Pie are about as American as it gets. That, and sweet tea in the South.

The individual parts in this particular system are among the best the world has ever seen. But they failed miserably as a team. They didn't know how to work together, and they hadn't worked together long enough to infuse corrective feedback into their operations. For my friends that love American football... Love or hate the Dallas Cowboys, the insane sync between Tony Romo and Jason Witten emerge when they are under pressure. The same should happen with your own operations.

The 2004 Men's Olympic Basketball Team. [From Wikipedia]

The revamped 2004 team consisted of some young NBA  [super]stars early in their careers, such as Carmelo Anthony and LeBron James, and also included recent Most Valuable Players Tim Duncan and Allen Iverson. The team was coached by Larry Brown.

After struggles in several exhibition matches, the vulnerability of the 2004 team was confirmed when Puerto Rico defeated them 92–73 in the first game of the Olympic tournament in Athens. The 19 point defeat was the most lopsided loss for the USA in the history of international competition.

After winning close games against Greece and Australia, The USA fell to Lithuania, dropping to 2–2 in the Olympic tournament. Even after an 89–53 win over Angola, the Americans entered the knockout rounds in fourth place due to goal average, the lowest seed of their group. The Americans faced undefeated Spain in their quarterfinal game, winning 102–94.

The semi-final match saw the team defeated by Argentina, 89–81, ending the United States' hold on the gold medal. ... Before 2004, American teams had only lost two games in all previous Olympic tournaments, whereas in this one the American team lost three.

VMware vCloud Director Segmentation: PCI and HIPAA Firewall Controls

This came up last week and I thought I would post here to keep the information easily accessible.

Yes. You can use vCD to segment environments that are required to comply with HIPAA and/or PCI.

The firewall functions in vCD in no way preclude you from using vCD to host production Primary Account Number (PAN) or electronic Private Healthcare Information (ePHI) as long as you comply with all of the other controls required to host the information. Here are the details from the requirements along with specific comments.

PCI has an entire section devoted to firewall controls (Requirement 1: Install and maintain a firewall configuration to protect cardholder data), of which the most restrictive requirements are [1] the ability to implement ACLs, and [2] SPI/Dynamic Packet Filtering.

Link to Data Security Standard | Link to Navigation Document 

Requirement 1.3.6 

Verify that the firewall performs stateful inspection (dynamic packet filtering). (Only established connections should be allowed in, and only if they are associated with a previously established session.) 

HIPAA has specific segmentation requirements for health care clearinghouse functions found here. Although they are specifically called out as Administrative Controls, the definition for this bill is defined as:

Link to 45cfr164.304 

Sec. 164.304  Definitions 
Administrative safeguards are administrative actions, and policies  and procedures, to manage the selection, development, implementation, and maintenance of security measures to protect electronic protected  health information and to manage the conduct of the covered entity's workforce in relation to the protection of that information. 

Note the lack of any detailed requirements – intentionally – to allow a broad range of solutions to fit the requirement.

Link to 45cfr164.308 

164.308(a)(4)(ii)(A)

(ii) Implementation specifications:

    (A) Isolating health care clearinghouse functions (Required). If ahealth care clearinghouse is part of a larger organization, the clearinghouse must implement policies and procedures that protect the electronic protected health information of the clearinghouse from unauthorized access by the larger organization. Sec. 164.304 Definitions 

The Circle of Trust - Cloud Audit Assurance

Assurance is the grounds for confidence that the set of intended security controls in an information system are effective in their application. 
(NIST  SP 800-37 and SP 800-53A)  

Cloud Audit Assurance. 

What can you do to provide assurance that your cloud infrastructure serves the purpose for which it was designed while protecting the data? Where do you start? Where does trust begin? Let's discuss three cycles that may help frame the discussion and an approach that may work for you. There's truth in the effectiveness of simple models that are easily understood and that can deliver repeatable results.

Start with the Business: Solution Alignment Cycle.
A previous post discussed GRC in the context of the business. We have to understand the objectives of the business and how the infrastructure and workloads align and support the objectives, in the context of risk, while managing compliance concerns. One of the great values of GRC tools is their ability to continually monitor and measure the effectiveness of your GRC program. A governor, or speed limiter, is a device used to measure and regulate the speed of a machine, such as an engine (wikipedia..). The important analogy is the feedback mechanism to regulate the effectiveness of the mechanical engine to perform as expected. The illustration below shows a simple cycle that is intended to be self governing.

Governance (alignment to business objectives) greatly affects how Risk (probability and impact) and Compliance (authorities, contracts, policies) are managed. Frameworks (COBIT, etc) may be used to help drive the GRC program, whose effectiveness is measured using GRC Tools. The workflow of the GRC Tool helps to continuously regulate the cycle.

Manage the Technology: Solution Delivery Cycle.
The Storage, Network, Compute, and Hypervisor (infrastructure) and Solutions (work loads), deliver a service. The effectiveness of a solution (capacity, performance, alignment/ability to meet needs/applicability) continually drives the selection and amount of technology assets required to deliver the solution. Put differently, the measurement of the effectiveness of the solution drives the hardware and software requirements.

Add Secure Operations Processes.
The PCVMR cycle was discussed in the previous post using the mission of a submarine. Provision the technology assets. Configure in accordance with your authorities, best practices, and policies. Validate against your checklists and using (as risk appropriate) additional tools, scanners, or third party resources. Monitor for deviations from your baseline. Accurately Respond and improve your processes based on what you learned.

Mission Operations - PCVMR Cycle

Reminiscing About the Past

Assurance.

Leading off the previous post, let's delve deeper into the processes that helped provide mission assurance to the crew taking the boat down to operational depth. We spoke of submarines and the mature operational approach that allowed a crew barely out of high school, most with no formal education, to not only function in these demanding environments, but excel and push themselves and their equipment to the extremes. 

Why were we successful? 

It was more than top-notch training. It was more than engineering and equipment superiority. It included a deep knowledge of operational processes that work in orchestration with the equipment and a firm understanding of the mission objectives and risks. The effectiveness of everything was measured and fed back into the processes and equipment.

Provision | Configure | Validate | Monitor | Respond

The PCVMR process cycle provides insight into how we were able to attest to the assurance of our boat to keep us safe and deliver on her mission. Here's how it works.

Provision: Equip yourself with the right systems for your mission. Submarines are equipped with systems appropriate for accomplishing their mission. Ballistic missile and attack submarines have very different missions and very different equipment... and crew and training. The highly specialized Submarine NR-1 was outfitted with equipment and capabilities not found in other subs because that's what her missions required. 

Configure: We sometimes laughed at a few of the Standard Operating Procedures (SOPs), but we respected them. Some would say, "Rules are written in blood." That's because somebody paid a heavy price for that stupid rule to check that breaker or valve lineup twice. Every system had a checklist for every operational lineup. These lineups are thoroughly tested by smart engineers, and every effort is made to follow the book. It's one thing if you're throwing your leftover litter into a McDonalds wastebasket. It's another to dump or pump it overboard underwater. One is casual. The other is very carefully handled. 

Validate: Everything was checked twice before getting underway. Every critical system was reviewed. Every change. Anyone that's spent time underway will recall the repeat-backs required on the phones as you read from a procedure to senior operator. The senior operators then repeated the same requests to watch officers for final permission. Everyone backed each other up to validate actions. Important actions were verified formally by a second person and signed off by all parties involved. Some critical actions required multiple validations and checks based on the affect of the system to the ship's mission. Once everything is known, you have entered an operational steady state, or a known state of operations. 

Monitor: Despite the best intentions to engineer flawless equipment and set everything up correctly, things go wrong. Systems are heavily monitored, automatically and manually, many both, to identify state deviations, or changes in the known state of operations. These may be intentional by the crew and known. These may be intentionally malicious from an external source, or changes could exist because of an inexperienced operator. The monitoring systems (some of which are redundant) help identify the early state of changes to give operators the most time to respond appropriately. Monitoring occurs across many complex related systems, and you need to identify issues as quickly as possible to minimize their impact. 

Respond:  It is the operator's experience and well-rehearsed drills that helps lead the best response. Realistic drills are part of every day life underway in preparation for when something bad happens. You expect something bad to happen. And it does. It's the workflow, methodical analysis, and rapid response that make the difference between "that was close!" and a new SOP. Rules are written in blood. Responses to incidents are debriefed for details that could could have managed the incident better than what was done. After Action Reviews. Post Incident Reviews. The outcomes of these meetings completes the PCVMR Cycle as they affect the Provisioning, Configuring, Validating, Monitoring, and Responding. 

Can you see how this translates to cloud security and audit? We'll dig into that next. It's time to walk out of the bubble and back into the cloud:).