Posts

NIS-2: 10 common misconceptions about the regulation

/in

We wrote here about NIS2 and we will continue to add more content about it.

Because we are getting closer to October 17th, many people are getting more and more nervous about NIS2.

Despite its significance, there are numerous misconceptions and misinterpretations circulating about the scope and implications of this regulation.

This article aims to clarify some of the misconceptions,  which I collected mostly from LinkedIn and articles about NIS-2.

 

Note:

“NIS2” and “NIS-2” are exactly the same thing. I am using both in this article only because of SEO.

 

 

1. NIS2 starts being applied in the EU starting 17.10.2024

Truth is that the regulation is already applicable in the EU since it was approved. This deadline applies to the individual countries of the EU to convert and apply the NIS2 requirements in local laws.

If national authorities fail to properly implement EU laws, the Commission may launch a formal infringement procedure against the country in question. If the issue is still not settled, the Commission may eventually refer the case to the Court of Justice of the European Union.

 

2. Limited scope of application

Contrary to the belief that NIS-2 only applies to large tech companies, the directive significantly broadens its scope compared to its predecessor, NIS.

NIS-2 extends beyond just critical infrastructure sectors like energy and transport, encompassing a wide array of sectors such as digital services, public administration, and healthcare.

It mandates a security and incident reporting framework that applies to both Essential and Important Entities, significantly expanding the list of sectors and services affected.

3. NIS-2 Is Just About Cybersecurity

While cybersecurity is a core component, NIS-2 is not merely about preventing cyberattacks. The directive emphasizes a comprehensive approach to security, which includes resilience against a wide range of threats.

This includes but it is not limited to:

  • supply chain security,
  • incident response, and
  • crisis management.

It establishes a baseline for security measures and incident notifications that entities must adhere to, ensuring a uniform level of security across member states.

4. NIS-2 compliance is the same across all EU countries

Although NIS-2 sets a framework for cybersecurity across the EU, member states have some flexibility in implementation. This means that there can be variations in how directives are enforced from one country to another, depending on local laws and regulations.

Companies operating across multiple jurisdictions need to be aware of and comply with local variations to ensure full compliance.

5. Heavy penalties are the main compliance driver

While it is true that NIS-2 can impose hefty fines for non-compliance, focusing solely on penalties misses the broader objective of the directive.

NIS-2 is designed to cultivate a culture of security and resilience. It encourages entities to proactively manage their cybersecurity risks and to collaborate with national authorities.

This cooperative approach is fundamental to enhancing the overall cybersecurity posture of the EU.

6. NIS-2 does not affect third-party suppliers

NIS-2 places explicit requirements on the security practices of third-party suppliers. Entities covered under the directive are required to ensure that their supply chains are secure.

This includes mandatory risk assessments and incident reporting requirements that extend to service providers, reflecting an understanding that security is only as strong as the weakest link in the supply chain.

 

7. NIS-2 contains rules for AI, IoT, Industry 4.0.

NIS-2 sets a framework for cybersecurity and it does not address anything in particular. However, the rules described can be very well applied to companies in the fields like those mentioned that fall under the regulation applicability.

The companies active in Digital Infrastructure Services (Internet Nodes, DNS Service Providers, TLD Registries, Cloud Providers, Data Centers, Content Delivery Networks, Trust Services, Communication Networks, Communication Services ) and in

ICT Service Management (B2B only) (Managed Services (IT, Networks/Infrastructure, Applications), Managed Security Services (Risk and Cyber Security) ) are potentially directly affected by the regulation. However, there are clear criteria about which companies are affected.

 

8. Any company with activity in the domains marked as Important and Essential is affected by NIS-2

Although the domains are under the NIS-2 regulation, a company is affected if it meets the criteria:

  • Essential Entities (EE):
    • at least 250 employees and
    • 50 Mil € revenue
  • Important Entities (IE):
    • at least 50 employees and
    • 10 Mil € revenue

If a company doesn’t have these characteristics, then, in general, it is not affected by the regulation directly. It is highly recommended that even in such cases the companies follow the regulation’s requirements, since it will increase their resilience against cyber attacks.

However, an entity may still be considered “essential” or “important” even if it does not meet the size criteria, in specific cases such as when it is the sole provider of a critical service for societal or economic activity in a Member State.

 

9. All affected companies must certify for NIS-2

A the time of writing this post there is no certification for NIS-2. This might change in the future, especially when because we don’t know at this time how the regulation will be implemented in each of the EU member states.

There are consulting companies that sell consulting services and guarantee that a company will get the “NIS-2  certification” if they bus their services. While buying consulting is in general a good thing, the only thing that can be obtained is help in meeting the requirements of the regulation.

I recommend to stay away from offers that promise things that don’t exist.

 

10. Companies can buy software/hardware products to become conform with NIS-2

Although conformity is sometimes made easier by using specialized software and hardware products, there is no requirement or recommendation to purchase anything.

Some security providers and consulting companies are offering On The Shelf  (OTS) products that promise immediate conformity with NIS-2 (or guarantee obtaining a “certification” – see point 9 above).

If you look at the series of articles in the NIS2 area of this website, you will see that actually quite a lot of  steps involve an ISMS, a cybersecurity framework, cybersecurity products and so on.

These can be implemented with commercial or open source products, but there is still need to know where and how to install them in order to become conform.

I can very well imagine that there will be soon commercial offerings with sets of templates for implementing the NIS-2 requirements, just like there are with ISO 27001, TISAX and other certifications.

The post NIS-2: 10 common misconceptions about the regulation first appeared on Sorin Mustaca on Cybersecurity.

Understanding ISO 27001:2022 Annex A.14 – System Acquisition, Development, and Maintenance

/in

We started the ISO 27001:2022 series with the promise of explaining how the 14 categories of controls can be implemented.

Today we address ISO 27001:2022 Annex A.14, “System Acquisition, Development, and Maintenance”, which addresses the importance of ensuring the security of information systems throughout their lifecycle, from acquisition and development to maintenance and disposal. This annex provides guidelines for implementing controls to manage the security of information systems and software applications.

 

 

Importance of System Acquisition, Development, and Maintenance

System acquisition, development, and maintenance are critical stages in the lifecycle of information systems and software applications. Annex A.14 underscores this importance by:

  1. Security by Design: Integrating security considerations into the acquisition, development, and maintenance processes helps identify and mitigate security risks early in the lifecycle, reducing the likelihood of vulnerabilities and security incidents.
  2. Secure Development Practices: Implementing secure coding practices, testing methodologies, and vulnerability management processes helps ensure the integrity, confidentiality, and availability of software applications and systems.
  3. Change Management: Managing changes to information systems and software in a controlled manner helps prevent unauthorized modifications, configuration errors, and disruptions to services.

Implementing Annex A.14 in Practice

To effectively implement Annex A.14, organizations can follow these practical steps:

  1. Security Requirements Analysis: Conduct a security requirements analysis during the system acquisition phase to identify security requirements and considerations for information systems and software applications.

    Example: Include security requirements such as authentication mechanisms, access controls, encryption, and audit logging in the procurement specifications for new information systems or software applications.

  2. Secure Development Practices: Adopt secure coding guidelines, frameworks, and best practices during the development phase to minimize the risk of security vulnerabilities and weaknesses in software applications.

    Example: Implement input validation, output encoding, and proper error handling to mitigate common vulnerabilities such as cross-site scripting (XSS), SQL injection, and buffer overflows in web applications.

  3. Vulnerability Management: Implement vulnerability scanning, penetration testing, and code reviews to identify and remediate security vulnerabilities and weaknesses in information systems and software applications.

    Example: Conduct regular vulnerability scans and penetration tests of network infrastructure, web applications, and databases to identify security vulnerabilities and prioritize remediation efforts.

  4. Change Control: Establish change management procedures to control and document changes to information systems and software applications in a controlled and auditable manner.

    Example: Implement a change management system to track and manage changes to software code, configurations, and configurations, ensuring that changes are reviewed, approved, and tested before deployment.

  5. Patch Management: Implement patch management processes to identify, assess, and apply security patches and updates to information systems and software applications in a timely manner.

    Example: Establish a patch management schedule to regularly assess and apply security patches and updates to operating systems, software applications, and firmware to mitigate security vulnerabilities and risks.

Audit of Compliance with Annex A.14

Auditing compliance with Annex A.14 is essential for evaluating an organization’s adherence to system acquisition, development, and maintenance requirements. Here’s how the audit process typically unfolds:

  1. Audit Preparation: Gather documentation related to system acquisition, development, and maintenance policies, procedures, and controls. Appoint an audit team to facilitate the audit process.
  2. Audit Planning: Define the audit scope, objectives, and criteria. Develop an audit plan outlining activities, timelines, and responsibilities of auditors and auditees.
  3. On-site Audit: Conduct on-site visits to assess implementation of system acquisition, development, and maintenance controls. Review documentation, inspect development environments, and observe change management practices. Use checklists or assessment tools to evaluate compliance.
  4. Audit Findings: Analyze findings and identify areas of non-compliance or improvement opportunities. Document observations, including strengths and weaknesses in system acquisition, development, and maintenance implementation.
  5. Reporting: Prepare an audit report summarizing findings, conclusions, and recommendations for corrective actions. Share with senior management and stakeholders for review and action.
  6. Follow-up: Address audit findings by implementing corrective actions and improvements as recommended. Conduct follow-up audits to verify effectiveness of corrective measures and ensure ongoing compliance.

Conclusion

ISO 27001:2022 Annex A.14 emphasizes the importance of ensuring the security of information systems throughout their lifecycle. By implementing controls and best practices for system acquisition, development, and maintenance, organizations can minimize security risks, vulnerabilities, and incidents. Regular audits help assess compliance with Annex A.14 requirements and drive continuous improvement in system security practices.

The post Understanding ISO 27001:2022 Annex A.14 – System Acquisition, Development, and Maintenance first appeared on Sorin Mustaca on Cybersecurity.

Understanding ISO 27001:2022 Annex A.13 – Communications Security

/in

We started the ISO 27001:2022 series with the promise of explaining how the 14 categories of controls can be implemented.

Today we address ISO 27001:2022 Annex A.13, “Communications Security”, which addresses the importance of securing information during its transmission over communication networks.

This annex provides guidelines for implementing controls to protect the confidentiality, integrity, and availability of information exchanged between parties.

 

 

Importance of Communications Security

Communications security is crucial for safeguarding sensitive information transmitted over communication channels, such as networks, internet connections, and wireless technologies. Annex A.13 underscores this importance by:

  1. Confidentiality: Encrypting communications prevents unauthorized parties from intercepting and eavesdropping on sensitive information transmitted over unsecured networks.
  2. Integrity: Implementing integrity checks and digital signatures ensures that transmitted data remains intact and unaltered during transit, protecting against tampering and unauthorized modifications.
  3. Availability: Securing communication channels helps maintain the availability of information services and prevents disruptions caused by network attacks, denial-of-service (DoS) attacks, or transmission errors.

Implementing Annex A.13 in Practice

To effectively implement Annex A.13, organizations can follow these practical steps:

  1. Encryption: Encrypt data transmitted over insecure communication channels using encryption protocols such as Transport Layer Security (TLS), Secure Sockets Layer (SSL), or Virtual Private Network (VPN) tunnels.Example: Configure email servers to use TLS encryption for encrypting emails in transit between email clients and servers, preventing eavesdropping on email communications.
  2. Digital Signatures: Use digital signatures to verify the authenticity and integrity of transmitted data and messages. Implement digital signature algorithms and certificate authorities to ensure the validity of signatures.Example: Digitally sign electronic documents, such as contracts or reports, using a digital signature certificate issued by a trusted certificate authority to verify the authenticity and integrity of the documents.
  3. Secure Protocols: Use secure communication protocols and standards, such as Secure Shell (SSH), Hypertext Transfer Protocol Secure (HTTPS), and Internet Protocol Security (IPsec), to protect data transmitted over networks.Example: Configure web servers to use HTTPS protocol for secure transmission of sensitive information, such as login credentials or financial transactions, over the internet.
  4. Access Controls: Implement access controls to restrict access to communication channels and network resources to authorized users only. Use strong authentication mechanisms to verify the identity of users accessing network services.Example: Configure network routers and firewalls to enforce access control lists (ACLs) restricting inbound and outbound traffic based on source and destination IP addresses, ports, and protocols.
  5. Monitoring and Logging: Deploy monitoring and logging mechanisms to track communication activities, detect anomalies, and identify potential security incidents or unauthorized access attempts.Example: Set up network intrusion detection systems (NIDS) or intrusion prevention systems (IPS) to monitor network traffic for suspicious behavior, such as port scans or packet sniffing attempts.

Audit of Compliance with Annex A.13

Auditing compliance with Annex A.13 is essential for evaluating an organization’s adherence to communications security requirements. Here’s how the audit process typically unfolds:

  1. Audit Preparation: Gather documentation related to communications security policies, procedures, and controls. Appoint an audit team to facilitate the audit process.
  2. Audit Planning: Define the audit scope, objectives, and criteria. Develop an audit plan outlining activities, timelines, and responsibilities of auditors and auditees.
  3. On-site Audit: Conduct on-site visits to assess implementation of communications security controls. Review documentation, inspect network configurations, and observe communication practices. Use checklists or assessment tools to evaluate compliance.
  4. Audit Findings: Analyze findings and identify areas of non-compliance or improvement opportunities. Document observations, including strengths and weaknesses in communications security implementation.
  5. Reporting: Prepare an audit report summarizing findings, conclusions, and recommendations for corrective actions. Share with senior management and stakeholders for review and action.
  6. Follow-up: Address audit findings by implementing corrective actions and improvements as recommended. Conduct follow-up audits to verify effectiveness of corrective measures and ensure ongoing compliance.

Conclusion

ISO 27001:2022 Annex A.13 emphasizes the importance of communications security in protecting sensitive information transmitted over communication networks. By implementing robust controls and measures to encrypt data, verify authenticity, and enforce access controls, organizations can mitigate risks and safeguard against unauthorized access or interception of communications. Regular audits help assess compliance with Annex A.13 requirements and drive continuous improvement in communications security practices.

The post Understanding ISO 27001:2022 Annex A.13 – Communications Security first appeared on Sorin Mustaca on Cybersecurity.

Understanding ISO 27001:2022 Annex A.12 – Operations Security

/in

We started the ISO 27001:2022 series with the promise of explaining how the 14 categories of controls can be implemented.

Today we address ISO 27001:2022 Annex A.12, “Operations Security”, which focuses on ensuring secure operations of information systems and assets. This annex provides guidelines for implementing controls to manage day-to-day operations, protect against security incidents, and maintain the integrity, availability, and confidentiality of information assets.

 

Importance of Operations Security

Operations security is critical for maintaining the effectiveness and resilience of information systems and assets. Annex A.12 underscores this importance by:

  1. Risk Management: Implementing operational controls helps identify, assess, and mitigate risks to information assets, ensuring business continuity and protecting against security incidents.
  2. Incident Response: Establishing incident response procedures enables organizations to detect, respond to, and recover from security incidents effectively, minimizing the impact on operations and data integrity.
  3. Change Management: Managing changes to information systems and assets in a controlled manner helps prevent unauthorized modifications, configuration errors, and disruptions to services.

Implementing Annex A.12 in Practice

To effectively implement Annex A.12, organizations can follow these practical steps:

  1. Risk Assessment: Conduct regular risk assessments to identify potential threats, vulnerabilities, and risks to information assets. Assess the likelihood and impact of identified risks to prioritize mitigation efforts.Example: Perform a comprehensive risk assessment of IT systems, networks, and applications to identify vulnerabilities, such as outdated software or misconfigured settings, that could expose assets to security threats.
  2. Incident Management: Establish incident response procedures to define roles, responsibilities, and actions to be taken in the event of a security incident. Develop incident response plans, escalation procedures, and communication protocols.Example: Develop an incident response playbook outlining steps to be followed in case of a security breach, including incident detection, containment, eradication, recovery, and post-incident analysis.
  3. Monitoring and Logging: Implement monitoring and logging mechanisms to track user activities, detect anomalies, and identify potential security incidents. Collect and analyze log data from information systems, networks, and security devices.Example: Deploy security information and event management (SIEM) systems to aggregate and correlate log data from various sources, enabling real-time monitoring, alerting, and analysis of security events.
  4. Change Control: Establish change management procedures to control and document changes to information systems, applications, configurations, and infrastructure. Define change request processes, approval workflows, and testing requirements.Example: Implement a change management system to track and manage changes to IT assets, including software updates, patches, configuration changes, and infrastructure modifications, following a structured change control process.
  5. Backup and Recovery: Implement backup and recovery procedures to protect against data loss, corruption, and unauthorized access. Regularly back up critical data and systems, and test backup restoration procedures.Example: Configure automated backup schedules for critical databases, files, and systems, ensuring that backup copies are stored securely and can be restored in the event of data loss or system failure.
  6. Protection against malware: Implement detection, prevention and recovery controls to protect against malware, combined with appropriate user awareness training.

Audit of Compliance with Annex A.12

Auditing compliance with Annex A.12 is essential for evaluating an organization’s adherence to operational security requirements. Here’s how the audit process typically unfolds:

  1. Audit Preparation: Gather documentation related to operational security policies, procedures, and controls. Appoint an audit team to facilitate the audit process.
  2. Audit Planning: Define the audit scope, objectives, and criteria. Develop an audit plan outlining activities, timelines, and responsibilities of auditors and auditees.
  3. On-site Audit: Conduct on-site visits to assess implementation of operational security controls. Review documentation, interview personnel, and observe operational practices. Use checklists or assessment tools to evaluate compliance.
  4. Audit Findings: Analyze findings and identify areas of non-compliance or improvement opportunities. Document observations, including strengths and weaknesses in operational security implementation.
  5. Reporting: Prepare an audit report summarizing findings, conclusions, and recommendations for corrective actions. Share with senior management and stakeholders for review and action.
  6. Follow-up: Address audit findings by implementing corrective actions and improvements as recommended. Conduct follow-up audits to verify effectiveness of corrective measures and ensure ongoing compliance.

Conclusion

ISO 27001:2022 Annex A.12 emphasizes the importance of operational security in maintaining the effectiveness, resilience, and integrity of information systems and assets. By implementing robust controls and procedures for risk management, incident response, change control, and backup and recovery, organizations can mitigate risks, protect against security incidents, and ensure business continuity. Regular audits help assess compliance with Annex A.12 requirements and drive continuous improvement in operational security practices.

The post Understanding ISO 27001:2022 Annex A.12 – Operations Security first appeared on Sorin Mustaca on Cybersecurity.

Understanding ISO 27001:2022 Annex A.8 – Asset Management

/in

 

ISO 27001:2022 Annex A.8, “Asset Management,” addresses the importance of identifying, classifying, and managing information assets within an organization. This annex emphasizes the need for organizations to establish processes for inventorying assets, assessing their value, and implementing appropriate controls to protect them. In this technical educational article, we’ll explore how to implement Annex A.8 in practice, highlight its significance, and discuss the audit process for assessing compliance.

 

 

 

 

What is an Asset ?

In the context of ISO 27001:2022, an asset refers to anything that has value to an organization and needs to be protected.

This includes not only tangible assets such as

  • Physical assets:
    • hardware and equipment
    • buildings
    • vehicles
  • People
    • Employees
    • Customers
    • Suppliers
  • Software
  • Intangible
    • Data
    • Intellectual property
    • Proprietary information
    • Reputation
    • Market Share

ISO 27001:2022 recognizes that assets come in various forms and play a crucial role in achieving an organization’s objectives.

What makes an asset worth to be added to the list?

Here are some key points to consider regarding assets in the context of ISO 27001:2022:

  1. Identification: Organizations need to identify and inventory all their assets, including both tangible and intangible ones. This involves understanding what assets the organization possesses, where they are located, and who has ownership or responsibility for them. If this can be done, then the asset is worth enough to be considered to be managed.
  2. Classification: Assets should be classified based on their value, sensitivity, and criticality to the organization. This classification helps prioritize protection efforts and allocate resources effectively. For example, sensitive customer data may be classified as high-value assets requiring stringent security measures. If an asset is classified with a category that makes it important for the company, then it should be definitely managed.
  3. Risk Management: Assets are subject to various risks, including cybersecurity threats, natural disasters, and human error. Organizations need to conduct risk assessments to identify and mitigate threats to their assets effectively. This involves evaluating the likelihood and potential impact of risks and implementing controls to reduce risk to an acceptable level.
  4. Protection: Based on the risk assessment for an asset, organizations must implement appropriate controls to protect their assets from unauthorized access, disclosure, alteration, or destruction. This includes measures such as access controls, encryption, backup procedures, and physical security measures. Based on the measures identified, an asset can be quite expensive to be protected, but losing it or damaging it might prove to be even more expensive.

 

Importance of Asset Management

Effective asset management is crucial for organizations to safeguard their information assets, optimize resource allocation, and mitigate risks. Annex A.8 underscores this importance by:

  1. Risk Reduction: Identifying and classifying information assets helps organizations prioritize security measures and allocate resources effectively to mitigate risks.
  2. Compliance: Maintaining an accurate inventory of assets and implementing appropriate controls ensures compliance with regulatory requirements and industry standards.
  3. Cost Savings: Efficient asset management practices enable organizations to optimize resource utilization and avoid unnecessary expenses associated with redundant or underutilized assets.

Implementing Annex A.8 in Practice

To effectively implement Annex A.8, organizations can follow these practical steps:

  1. Asset Identification: Begin by identifying all information assets within the organization, including hardware, software, data, and intellectual property. Establish criteria for identifying assets, such as ownership, criticality, and sensitivity.Example: Develop an asset inventory list categorizing assets based on their type, location, owner, and importance to business operations.
  2. Asset Classification: Classify information assets based on their value, sensitivity, and criticality to the organization. Define classification levels or categories to differentiate between assets requiring different levels of protection.Example: Classify data assets as public, internal use only, confidential, or restricted based on their sensitivity and impact on the organization if compromised.
  3. Asset Ownership: Assign ownership responsibilities for each information asset to designated individuals or departments within the organization. Clearly define roles and responsibilities for managing and protecting assigned assets.Example: Assign data ownership responsibilities to business units or functional departments responsible for creating, accessing, or managing specific types of data.
  4. Risk Assessment: Conduct risk assessments to identify threats, vulnerabilities, and potential impacts on information assets. Assess the likelihood and impact of potential risks to prioritize mitigation efforts.Example: Perform a vulnerability assessment to identify weaknesses in IT systems and applications that could expose information assets to security threats.
  5. Control Implementation: Implement appropriate controls to protect information assets from unauthorized access, disclosure, alteration, or destruction. Select controls based on the results of risk assessments and compliance requirements.Example: Implement access control mechanisms, such as user authentication, role-based access control (RBAC), and encryption, to safeguard sensitive information assets from unauthorized access.

Audit of Compliance with Annex A.8

Auditing compliance with Annex A.8 is essential for evaluating an organization’s adherence to asset management requirements. Here’s how the audit process typically unfolds:

  1. Audit Preparation: The organization gathers documentation related to asset management policies, procedures, and controls. An audit team is appointed to facilitate the audit process.
  2. Audit Planning: The audit team defines the audit scope, objectives, and criteria. They develop an audit plan outlining the audit activities, timelines, and responsibilities of auditors and auditees.
  3. On-site Audit: Auditors conduct on-site visits to assess the implementation of asset management controls. They review documentation, interview personnel, and observe asset management practices in action. Auditors may use checklists or standardized assessment tools to evaluate compliance.
  4. Audit Findings: After the on-site audit, auditors analyze their findings and identify areas of non-compliance or improvement opportunities. They document their observations, including strengths and weaknesses in the organization’s approach to asset management.
  5. Reporting: Auditors prepare an audit report summarizing their findings, conclusions, and recommendations for corrective actions. The report is shared with senior management and relevant stakeholders for review and action.
  6. Follow-up: Management addresses audit findings by implementing corrective actions and improvements as recommended. Follow-up audits may be conducted to verify the effectiveness of corrective measures and ensure ongoing compliance with Annex A.8 requirements.

Conclusions

ISO 27001:2022 Annex A.8 highlights the importance of asset management in safeguarding information assets and mitigating risks. By implementing robust processes for identifying, classifying, and managing information assets, organizations can optimize resource allocation, ensure compliance, and enhance their security posture. Regular audits help assess compliance with Annex A.8 requirements and drive continuous improvement in asset management practices. Prioritizing asset management is essential for organizations seeking to protect their valuable information assets and maintain trust in their operations.

The post Understanding ISO 27001:2022 Annex A.8 – Asset Management first appeared on Sorin Mustaca on Cybersecurity.

Understanding ISO 27001:2022 Annex A.6 – Organization of Information Security

/in

We started the ISO 27001:2022 series with the promise of explaining how the 14 categories of controls can be implemented.

We start today with ISO 27001:2022 Annex A.6, “Organization of Information Security”, which outlines requirements for establishing an effective management framework to govern information security within an organization. This annex emphasizes the importance of defining roles, responsibilities, and processes to ensure the confidentiality, integrity, and availability of information assets.

In this technical educational article, we’ll explore how to implement Annex A.6 in practice and elucidate the audit process for assessing compliance.

 

Importance of Organization of Information Security

A well-organized approach to information security is essential for maintaining the confidentiality, integrity, and availability of organizational assets. Annex A.6 helps organizations achieve this by:

  1. Defining Responsibilities: Clearly delineating roles and responsibilities ensures accountability for information security tasks across the organization.
  2. Establishing Processes: Formalizing processes for risk management, incident response, and access control streamlines security operations and enhances responsiveness to security incidents.
  3. Ensuring Compliance: Implementing a structured framework for information security governance helps organizations meet regulatory and compliance requirements.

Implementing Annex A.6 in Practice

To effectively implement Annex A.6, organizations can follow these practical steps:

  1. Define Information Security Roles and Responsibilities: Identify key stakeholders responsible for information security governance, including senior management, IT personnel, data owners, and end-users. Clearly define their roles and responsibilities in safeguarding information assets.Example: Establish a Security Steering Committee comprising senior management representatives and department heads to oversee information security initiatives and decision-making.
  2. Develop Information Security Policies and Procedures: Create comprehensive policies and procedures covering areas such as access control, risk management, incident response, and asset management. Ensure alignment with organizational objectives and regulatory requirements.Example: Develop an Incident Response Plan outlining the steps to be followed in the event of a security incident, including incident detection, containment, eradication, and recovery.
  3. Implement Security Controls: Deploy technical and administrative controls to mitigate security risks and protect information assets. These controls may include firewalls, intrusion detection systems, encryption mechanisms, and user access controls.Example: Implement role-based access control (RBAC) to restrict access to sensitive information based on users’ roles and responsibilities within the organization.
  4. Provide Training and Awareness Programs: Educate employees about their roles in maintaining information security and raise awareness about common security threats and best practices. Conduct regular training sessions and awareness campaigns to reinforce security protocols.Example: Offer cybersecurity awareness training to employees covering topics such as phishing awareness, password hygiene, and social engineering tactics.
  5. Establish Security Incident Management Procedures: Develop procedures for reporting, investigating, and responding to security incidents promptly. Define escalation paths and communication channels to ensure swift resolution of incidents.Example: Establish a Security Incident Response Team (SIRT) tasked with coordinating incident response efforts, conducting forensic investigations, and implementing remediation measures.

Auditing Compliance with Annex A.6

Audits play a crucial role in evaluating an organization’s compliance with Annex A.6 requirements. Here’s how the audit process typically unfolds:

  1. Audit Preparation: The organization gathers documentation related to information security policies, procedures, and controls. An audit team is appointed to facilitate the audit process.
  2. Audit Planning: The audit team defines the audit scope, objectives, and criteria. They develop an audit plan outlining the audit activities, timelines, and responsibilities of auditors and auditees.
  3. On-site Audit: Auditors conduct on-site visits to assess the implementation of information security controls. They review documentation, interview personnel, and observe security practices in action. Auditors may use checklists or standardized assessment tools to evaluate compliance.
  4. Audit Findings: After the on-site audit, auditors analyze their findings and identify areas of non-compliance or improvement opportunities. They document their observations, including strengths and weaknesses in the organization’s approach to information security.
  5. Reporting: Auditors prepare an audit report summarizing their findings, conclusions, and recommendations for corrective actions. The report is shared with senior management and relevant stakeholders for review and action.
  6. Follow-up: Management addresses audit findings by implementing corrective actions and improvements as recommended. Follow-up audits may be conducted to verify the effectiveness of corrective measures and ensure ongoing compliance with Annex A.6 requirements.

Conclusion

ISO 27001:2022 Annex A.6 underscores the importance of establishing a structured framework for organizing information security within an organization.

By following best practices for defining roles, responsibilities, processes, and controls, organizations can strengthen their security posture and mitigate risks effectively. Regular audits help assess compliance with Annex A.6 requirements and drive continuous improvement in information security governance.

The post Understanding ISO 27001:2022 Annex A.6 – Organization of Information Security first appeared on Sorin Mustaca on Cybersecurity.

Building Resilient Web Applications on AWS: A Comprehensive Approach to Security

/in

 

I have been asked by friends and customers what is the best way to implement a web based application with minimum costs and good security. Of course, the best way is to define exactly what you want to achieve and let professionals do it, while keeping an eye on the Secure Software Development Lifecycle.

But, this article is not about SSDLC, it is about how to start web application development having also security as a top priority. Securing a classical web application involves a multi-layered approach, addressing the presentation, business logic, and database layers.

Most important thing to keep in mind when engaging into such an enterprise is: don’t try to do everything by yourself – use existing tools and services, which come with a more than decent security built-in.

This article explores how to architect a secure web application on AWS, but it can be applied very well to other cloud based services provider,  and conduct a thorough risk assessment at each level.

A good security approach is to practice defense in depth, meaning that you should check and validate the security of the components used as well. This means that we need to perform at least a high-level risk assessment of these components as well.

 

 

Securing the Presentation Layer

At the forefront of user interaction, the presentation layer demands robust security measures. Amazon CloudFront serves as a reliable content delivery network, ensuring low latency and protection against DDoS attacks.

AWS Identity and Access Management (IAM) steps in to control access to resources at this layer, while AWS Web Application Firewall (WAF) safeguards against common web exploits and secures APIs.

The Presentation layer hosts the UI of the application, typically a website written in HTML5 or a combination of HTML, php, JS, or some high level programming languages that can produce HTML as output.

Such web UIs must be uploaded on a AWS S3 bucket read accessible to everyone and then configure the CloudFront to distribute it.

Risk Assessment at the Presentation Layer

  • Regularly review and adjust IAM policies to mitigate the risk of unauthorized access.
  • Conduct penetration testing on the web application to identify and address vulnerabilities.
  • Monitor CloudFront logs for unusual patterns indicative of a security threat.
  • Make sure nobody has unrestricted access to your S3 bucket hosting the web content

Security practices

  • If you collect data, make sure it is encrypted using AWS Secrets Manager;
  • Do not encrypt using your own keys, hardcoded in your application.
  • Do not invent yourself some “encryption” mechanism, which in the end is just an obfuscation.

Securing the Business Logic Layer

The business logic layer is the heart of a web application, where critical processes take place. Containerizing application logic using AWS Elastic Container Service (ECS) or AWS Fargate ensures enhanced isolation.

AWS Lambda, offering serverless computing, executes sensitive business logic securely. AWS Secrets Manager manages and rotates sensitive API keys and tokens.

Risk Assessment at the Business Logic Layer

– Regularly audit and review AWS Lambda functions to maintain the security of business logic.
– Conduct static and dynamic code analysis to identify vulnerabilities in the application logic.
– Implement AWS CloudWatch for real-time monitoring and alerting on anomalous Lambda function behavior.

Securing the Database Level

The database, housing crucial data, requires robust security measures. Amazon RDS provides secure and scalable relational databases with automatic backups and encryption.

Fine-grained access control through IAM roles and policies is essential for secure database access. AWS Key Management Service (KMS) handles encryption of data at rest within the database.

 

Risk Assessment at the Database Level

– Regularly audit and review database access controls and IAM roles to prevent unauthorized access.
– Implement automated vulnerability scanning tools for the database to identify potential weaknesses.
– Set up AWS CloudTrail to log and monitor all database-related API activity.

 

Continuous Monitoring and Response

Ensuring the ongoing security of a web application involves continuous monitoring and a robust incident response plan. AWS Security Hub acts as a centralized monitoring tool, while AWS Config rules automate the assessment and remediation of non-compliance.

An incident response plan with specific procedures for each layer of the web application architecture ensures a swift and effective response to security incidents.

 

In the next post: risk assessment for the Amazon services used in this article:

  • AWS IAM
  • AWS Elastic Container Service (ECS)
  • AWS Fargate
  • AWS Key Management Service (KMS)
  • AWS Lambda
  • AWS CloudTrail
  • AWS Secrets Manager
  • AWS CloudFront
  • AWS S3

Conclusion

By adopting a comprehensive security strategy across the presentation layer, business logic, and database levels, small organizations can build resilient and cost aware web applications on the AWS platform.

This approach, coupled with regular risk assessments, establishes a solid foundation for web application security, safeguarding against common cybersecurity threats.

The post Building Resilient Web Applications on AWS: A Comprehensive Approach to Security first appeared on Sorin Mustaca on Cybersecurity.

Evolving beyond your core expertise: it’s time to add security

/in

This post is for creators of digital services like optimization tools,  VPN solutions, Backup and Disaster Recovery tools, Parental control tools, Identity protection tools, Privacy tools, Email clients, Browsers and many others.

Your products are doing a good job in the dynamic landscape of digital services, and it is amazing of how much commitment and work is invested in providing top-notch tools. However, in this era of escalating cyber threats, there’s a pivotal evolution taking place —a shift that you have seen it coming already : it is time to integrate robust security measures into your existing offerings.

Are you curious why? Read on …

 

Threat landscape evolved way beyond your core expertise

The digital world is witnessing an unprecedented surge in cyber threats. Malware, ransomware, data breaches—the risks are multifaceted and affect your users’ security and privacy. Your customers, while benefiting from your solutions, now seek a more comprehensive shield against these threats, ideally coming from the same producer or from a single product.

 

Customer expectations are higher

Your customers are discerning individuals who are continuously looking at the market. They expect a comprehensive approach to their digital safety. Strengthening your service portfolio with robust cybersecurity measures aligns with their evolving needs and fortifies their trust in your brand.

 

Competitive Edge Through Diversification

By diversifying into the security space, you’re not merely meeting customer demands; you’re cementing your competitive position in the market. Companies that offer a holistic suite of security solutions distinguish themselves as leaders in a crowded market.

 

Value of Integrated Solutions

Integrated security solutions that seamlessly blend with your services create an all-encompassing safety net for users. Presenting a unified platform that prioritizes both speed and security establishes a compelling value proposition, attracting customers seeking efficiency without compromising on safety.

 

In conclusion, embracing the integration of cybersecurity measures into your existing services isn’t just an option; it’s a strategic decision that must be taken.

This evolution ensures not only meeting customer expectations but also securing a more competitive edge in an industry that demands continuous innovation and adaptability.

 

The post Evolving beyond your core expertise: it’s time to add security first appeared on Sorin Mustaca on Cybersecurity.

Balancing functionality and privacy concerns in AI-based Endpoint Security solutions

/in

The integration of Artificial Intelligence (AI) in endpoint security has revolutionized the way organizations protect their devices and data.

Ok, let’s take a break here: have you read the article about Artificial Intelligence vs. Machine Learning ?

 

By leveraging AI and machine learning models that analyze user behavior on devices, organizations can detect anomalies and potential security threats more effectively.

However, this advanced approach to endpoint security raises significant privacy concerns, as it necessitates the collection of user activity data, sometimes in real time.

One thing needs to be clear: if you want to do anomaly detection, you need to train your ML model with what “normal” is first – this is called “baseline”. And this means that data needs to be collected from the user.

Now the question remains, how can we reduce the privacy concerns?

This short article explores the privacy challenges I think are associated with using AI models that require user data(behavior), discusses potential solutions, and suggests ways to deploy AI on devices while minimizing privacy concerns.

What are the privacy concerns when data is collected for training an ML model?

Data Collection and Usage


Collecting user data for AI-driven endpoint security involves monitoring and logging user activities on devices.

This process includes:

  • capturing information about the applications used (URLs accessed, CPU usage, memory usage),
  • websites visited and items clicked
  • files accessed
  • applications installed
  • applications started
  • time of login, logout, inactivity
  • webcam usage
  • microphone usage
  • biometrics

This data is essential for creating baselines of normal behavior and identifying deviations that might indicate security threats.

This extensive data collection raises concerns about user privacy, as it creates a comprehensive profile of a user’s digital activities.

AI-based endpoint security solutions can infer or predict sensitive information from non-sensitive forms of data, such as user preferences, interests, or behaviors.

This can enable the systems to provide personalized or customized services or recommendations, but it can also violate the privacy or autonomy of the users or the owners of the devices or networks.

For example, someone’s keyboard typing patterns can be analyzed to deduce their emotional state, which includes emotions such as nervousness, confidence, sadness or anxiety

 

Data Security

Safeguarding the collected user data is critical, as it contains sensitive information about an individual’s online behavior.

The risk of data breaches or unauthorized access to this information poses a significant privacy threat.

Where is this data stored, how long, how is it stored, who has access to it, how is it going to be used/processed and by who, are just a few questions that need to be asked.

GDPR has made clear which are the responsibilities of the controller and processor(s) of the data.

 

Transparency and Consent

A good user experience of a security product means that users will be as unaware as possible that their activity data is being collected for security purposes.

Ensuring transparency and obtaining explicit user consent for data collection is critical. Without clear communication, users may feel their privacy is being violated.

 

Data Retention

Storing user data indefinitely can compound privacy concerns. Organizations should establish clear data retention policies, specifying how long the data will be retained and under what circumstances it will be deleted.

 

User Profiling and Discrimination

The detailed user activity data collected for AI analysis can lead to user profiling, which may be used for purposes beyond cybersecurity, such as targeted advertising.

AI-based endpoint security solutions can make automated decisions or recommendations based on the data they analyze, such as blocking access, flagging anomalies, or prioritizing alerts.

Discriminatory decisions and practices can arise from the insights drawn from user behavior data. However, these decisions or recommendations can be discriminatory, unfair, inaccurate, or biased, if the data or the algorithms are flawed, incomplete, or skewed.

For example, people can be misclassified, misidentified, or judged negatively, and such errors or biases may disproportionately affect certain demographics.

 

Solutions to address privacy concerns

The solutions to address these concerns are actually not new, they are covered pretty good by the GDPR and other privacy laws world-wide.

They are :

Data Minimization

Organizations should adopt a data minimization approach, collecting only the data necessary for security purposes.  This is definitely not as easy as it sounds.

In Security, you usually collect as much as possible, because the more you know about your target, the better it is for the ML model (better detection, less false positives).

However, the Compliance dept. should be involved from the early stages of developing the product in order to control what is being collected.

 

Anonymization

Anonymizing user data can be a privacy-enhancing technique. By removing personally identifiable information from collected data, the risk of individual users being identified is reduced.

This works good when data is collected from many computers, but when the solution works on a single computer, it usually needs time to “learn” the user’s behavior.

There is nothing anonymous there and this is usually OK, as long as this data is not sent to the backend for further processing and analysis.

 

Encryption

Encrypting the data collected for AI analysis ensures that even if a breach occurs, the information remains unreadable and inaccessible to unauthorized parties.

When “cleaned up” data needs to be sent, it is mandatory to send it encrypted and keep it at rest encrypted all the time.

 

Informed consent

Transparently informing users about data collection and obtaining their explicit consent is a fundamental step in addressing privacy concerns.

Users should have the option to opt in or out of data collection at any time. It is mandatory for the ML models to be able to cope without any datasets, because they could disappear at any time.

 

Data deletion

After the data is no longer needed for security analysis, organizations can ideally erase the data, and if this is not possible, then it should remove any direct or indirect associations with individual users.

Balancing Security and Privacy

Balancing AI-based endpoint security and privacy is essential. Organizations can adopt the following strategies to minimize privacy concerns:

  • Implement Strong Privacy Policies

Establish comprehensive privacy policies that clearly define data collection, usage, retention, and disposal procedures. These policies should adhere to legal and regulatory requirements for the region where the users reside (GDPR, CPA, etc.).

This can by itself be a challenging task, because no company is willing to block access to potential customers.

 

  • Regular risk assessment and impact analysis

Conduct periodic risk assessment and impact analysis to ensure that data collection and analysis practices align with privacy policies and legal requirements and correct any deviations promptly.

The audits should be first performed internally, in order to have time to fix any deviations. If an external audit body finds any irregularity, the company can be fined with large sums of money.

 

  • Third-Party Vetting

When using third-party AI solutions, organizations should thoroughly vet the security and privacy practices of these providers.

 

  • Ongoing Monitoring

Continuously monitor the effectiveness of privacy protection measures and adjust them as needed to address emerging privacy concerns.

 

Conclusion

AI-based endpoint security is a powerful tool for protecting devices and data from cyber threats. However, it should not come at the cost of user privacy or well-being.

Organizations must strike a delicate balance by implementing privacy-enhancing measures, obtaining informed consent, and adhering to transparent data collection and usage practices.

 

 

PS: The image of the post was generated using DALL-E.

 

The post Balancing functionality and privacy concerns in AI-based Endpoint Security solutions first appeared on Sorin Mustaca on Cybersecurity.

Thoughts on AI and Cybersecurity

/in

Being an CSSLP gives me access to various emails from (ISC)2. One of these announced me that there is a recording of a webinar about AI and Cybersecurity held by Steve Piper from CyberEdge.

Very nice presentation of 1h, and I found out that there is a sequel to that on November 1st.

So, following Steve’s article, I did some research, read a lot and used ChatGPT to summarize some of my findings.

This article explores the multifaceted ways AI is transforming cybersecurity, from threat detection to incident response and beyond. It also looks into What it means actually to use AI in some of these fields. What is the impact on privacy and confidentiality?

Important to keep in mind that any AI must first learn (trained) in order to be able to understand the system and then potentially predict what is happening.

 

  1. Threat Detection

One of the primary applications of AI in cybersecurity is threat detection. Traditional rule-based systems are no longer sufficient to identify and combat sophisticated attacks.

AI-driven technologies, such as machine learning and deep learning, can analyze massive datasets to detect anomalies and potential threats.

Here’s how:

a. Anomaly Detection: AI algorithms can establish a baseline of normal behavior in a network or system. Any deviation from this baseline can trigger an alert, indicating a potential security breach.

b. Behavioral Analysis: AI can analyze user and entity behavior to detect patterns that may indicate malicious activity. This is particularly useful for identifying insider threats.

c. Malware Detection: AI can scan files and code for patterns consistent with known malware or recognize behavioral patterns of malicious software.

We’ll talk more in the future on this topic.

 

  1. Predictive Analysis

AI-driven predictive analysis enhances cybersecurity by identifying potential threats before they become full-blown attacks.

By crunching vast amounts of historical data, AI systems can predict emerging threats, trends, and vulnerabilities. This early warning system allows organizations to preemptively shore up their defenses.

It would have to gather huge amounts of data, crunch them (preprocess, normalize, structure), creating an ML model and then based on the chosen technology train the system.

Here we can think of supervised (pre-categorized data, requiring feature to be defined) and unsupervised learning (non categorized data, basically being restricted to Anomaly detection).

There is a huge warning here, because :

a) such huge amounts of data has to come from somewhere and

b) predictions can be influenced by specially crafted training data, for unsupervised training models.

 

  1. Automation and Orchestration

AI can automate routine cybersecurity tasks and workflows, reducing the workload on human analysts and minimizing response times. AI-driven systems can:

a. Automatically quarantine infected devices or isolate compromised areas of a network to prevent lateral movement by attackers.

b. Investigate and analyze security incidents, rapidly categorizing and prioritizing alerts.

c. Initiate predefined incident response procedures, such as patching vulnerable systems or resetting compromised user accounts.

 

Automation:

Automation involves the use of technology, such as scripts, workflows, or AI-driven systems, to perform routine and repetitive tasks without human intervention. In the context of cybersecurity, automation can significantly improve efficiency and response times by handling various operational and security-related processes automatically. Here’s how it works:

a. Incident Response: When a security incident is detected, automation can trigger predefined actions to contain, investigate, and mitigate the threat. For example, if a system detects a malware infection, an automated response might involve isolating the affected device from the network, blocking the malicious IP address, and initiating a forensic investigation.

b. Vulnerability Patching: Automation can be used to deploy security patches and updates to systems and software as soon as they are released. This reduces the window of vulnerability and helps prevent attacks that target known vulnerabilities.

c. Log Analysis and Alerts: Automation can continuously monitor logs and events from various systems. It can detect and respond to predefined security events, generating alerts or triggering specific actions when unusual or malicious activity is detected.

 

Orchestration:

Orchestration is a broader concept that focuses on integrating and coordinating various security tools, processes, and workflows into a unified and streamlined system. It enables organizations to create end-to-end security workflows by connecting different security solutions and ensuring they work together cohesively. Here’s how it works:

a. Workflow Integration: Orchestration systems allow the creation of predefined security workflows that link multiple tools, such as firewalls, intrusion detection systems, antivirus software, and incident response platforms. For example, when a malware alert is triggered, orchestration can coordinate the response by isolating the affected system, collecting forensic data, and alerting the incident response team.

b. Information Sharing: Orchestration enables the sharing of critical information among security tools. This ensures that all relevant security solutions have access to the latest threat intelligence, allowing for more effective threat detection and mitigation.

 

  1. Phishing Detection

Phishing attacks remain a prevalent threat. AI can help identify phishing attempts by:

a. Analyzing email content and sender behavior to identify suspicious emails.

b. Scanning URLs for malicious domains or suspicious patterns.

c. Inspecting attachments for known malware signatures.

d. Recognizing social engineering techniques and language used in phishing emails.

 

  1. Network Security

AI-driven intrusion detection systems (IDS) and intrusion prevention systems (IPS) monitor network traffic for anomalies and threats.

They can identify and block malicious traffic in real-time, protecting the network from various attacks, including DDoS attacks and data exfiltration.

 

  1. Threat Intelligence

AI can be used to aggregate and analyze threat intelligence from various sources, including open-source feeds, dark web monitoring, and industry-specific data.

This aggregated intelligence can help security teams stay informed about emerging threats and vulnerabilities.

 

  1. Endpoint Security

AI-driven endpoint security solutions provide real-time protection for individual devices.

They can identify and mitigate threats at the device level, even when the device is not connected to the corporate network. This is especially crucial for remote workers and mobile devices.

This raises another red flag for me: complete monitoring of user’s actions on the device. What happens to the data gathered, is the model trained locally on in the cloud? And many other such concerns.

I will write a dedicated post about AI and Privacy very soon.

The post Thoughts on AI and Cybersecurity first appeared on Sorin Mustaca on Cybersecurity.