Cyber resiliency engineering intends to architect, design, develop, implement, maintain, and sustain the trustworthiness of systems with the capability to anticipate, withstand, recover from, and adapt to adverse conditions, stresses, attacks, or compromises that use or are enabled by cyber resources. From a risk management perspective, cyber resiliency is intended to help reduce the mission, business, organizational, enterprise, or sector risk of depending on cyber resources.
NIST has published Special Publication (SP) 800-160 Volume 2, Revision 1, Developing Cyber-Resilient Systems: A Systems Security Engineering Approach. It presents a cyber resiliency engineering framework to aid in understanding and applying cyber resiliency, a concept of use for the framework, and the engineering considerations for implementing cyber resiliency in the system life cycle. The framework constructs include goals, objectives, techniques, implementation approaches, and design principles. Organizations can select, adapt, and use some or all of the cyber resiliency constructs in this publication and apply the constructs to the technical, operational, and threat environments for which systems need to be engineered.
The guidance helps organizations anticipate, withstand, recover from, and adapt to adverse conditions, stresses, and compromises on systems – including hostile and increasingly destructive cyber-attacks from nation-states, criminal gangs, and disgruntled individuals.
Quantum computing, the next generation of computing, has been in development for the past several years and most likely will reach its full potential in the next several years.
Quantum computing harnesses the laws of quantum mechanics to solve problems too complex for today’s computers. It uses qubits (CUE-bits) to run multidimensional quantum algorithms. It is capable of solving certain computational problems substantially faster than today’s computer, such as integer factorization, which is the underlying technology of RSA encryption.
RSA encryption, alongside elliptic-curve cryptography are widely used today to encrypt our financial transactions on the web and keep intellectual property, military, and medical data secret. When quantum computers become available, these defenses will fail and data will be exposed. It will only take several hours for quantum computers to decrypt the current RSA encryption standard.
To this end, computer scientist have been working hard towards creating a “post-quantum cryptography” (PQC) encryption protocols that should outpace the capability of quantum computers. The National Institute of Standards and Technology (NIST) researchers have been working for years and recently have given their stamp of approval to some mathematical equations that quantum computers would struggle to hack. In 2016 it launched a competition to find algorithm for PQC, receiving 82 submissions from 25 countries. After three rounds of sifting and analysis, four winning techniques and four backup approaches have emerged.
NIST recommends two primary algorithms to be implemented for most use cases: CRYSTALS-KYBER (key-establishment) for general encryption and CRYSTALS-Dilithium for digital signatures. In addition, the signature schemes FALCON and SPHINCS+ will also be standardized.
More information on these PQC algorithms can be found on NIST website:
Zero Trust security is an IT security framework that requires all users and devices, whether in or outside the organization’s network perimeter, to be authenticated, authorized, and continuously validated before being granted or keeping access to applications and data. In a traditional IT network, it is hard to obtain access from outside the network, but once inside the network, everyone is trusted by default whereas a Zero Trust model trusts no one and nothing. The problem with traditional IT network is that once an attacker gains access to the network, they have free rein over everything inside.
The main principle of Zero Trust security are the following:
Least privilege access. Give users only only the bare minimum level of access necessary to perform job-specific tasks. This will minimize each user’s exposure to sensitive parts of the network.
Continuous monitoring and validation. Verify users and devices identity and privileges continuously and time out logins and connections periodically once established.
Device access control. Ensure that every device in the network is authorized, and assess all devices to make sure they have not been compromised.
Terminate every connection. Allow an inline proxy architecture to inspect all traffic, including encrypted traffic, in real time — before it reaches its destination — to prevent ransomware and malware.
Microsegmentation. Break up security perimeters into small zones to maintain separate access for separate parts of the network.
Multi factor authentication (MFA). Require users at least 2 sources of evidence to identify themselves. For example, in addition to entering a password, users must also enter a code sent to another device, such as a mobile phone, thus providing two pieces of evidence that they are who they claim to be.
Prevent lateral movement. “Lateral movement” is when an attacker moves within a network after gaining access to that network. Zero Trust is designed to contain attackers so that they cannot move laterally. Once the attacker’s presence is detected, the compromised device or user account can be quarantined and cut off from further access.
These principles will reduce the organization’s security risk by minimizing or even eliminating the attack surface.
A green data center is a “service facility which utilizes energy-efficient technologies. They do not contain obsolete systems (such as inactive or underused servers), and take advantage of newer, more efficient technologies.” All the components of a green data center including mechanical, lighting, electrical and computer systems are designed to maximize energy efficiency and minimize environmental impact.
Some technologies and strategies used in green data center include:
Low-power servers. They are more energy-efficient than conventional servers in data centers. They use the technology of smartphone computing, which tries to balance performance with energy consumption.
Modular data center. It is a portable data center which can be placed anywhere data capacity is needed. Compared with traditional data centers, they are designed for rapid deployment, energy efficiency and high density.
E-waste recycling. Re-use servers and components.
Free air cooling systems uses outdoor air instead of traditional data-center computer room air conditioner (CRAC) units.
Hot and cold aisle containment
Reusing waste heat.
Minimized building footprint
Low-emission building materials, carpets and paints
Alternative energy, such as photovoltaic technology, heat pumps, ultrasonic humidification, and evaporative cooling technology
With the exponential growth and usage of the Internet, power consumption in data centers has increased significantly resulting in huge environmental impact. The creation of green data centers has become essential to mitigate climate change.
AWS has 20+ security tools and services that you can use to secure your data and applications in AWS cloud. These tools and services cover your data protection needs, identity and access management, network and application protection, threat detection and monitoring, and compliance and data privacy.
The following ten security tools are the most useful services that you should start using to improve your security posture:
AWS Security Hub is a cloud security posture management service that performs security best practice checks, aggregates alerts, and enables automated remediation. It quickly assesses your high-priority security alerts and security posture across AWS accounts in one comprehensive view.
AWS Identity and Access Management (IAM) provides fine-grained access control across all of AWS. With IAM, you can specify who can access which services and resources, and under which conditions. With IAM policies, you manage permissions to your workforce and systems to ensure least-privilege permissions. AWS IAM also has multi-factor authentication and supports single sign-on (SSO) access to further secure and centralize user access.
AWS GuardDuty is a threat detection service that continuously monitors your AWS accounts and workloads for malicious activity and delivers detailed security findings for visibility and remediation.
AWS Macie is a fully managed data security and data privacy service that uses machine learning and pattern matching to discover and protect your sensitive data in AWS. Macie automatically provides an inventory of Amazon S3 buckets including a list of unencrypted buckets, publicly accessible buckets, and buckets shared with AWS accounts, then it applies machine learning and pattern matching techniques to the buckets you select to identify and alert you to sensitive data, such as personally identifiable information (PII).
AWS Config is a service that enables you to assess, audit, and evaluate the configurations of your AWS resources. Config continuously monitors and records your AWS resource configurations and allows you to automate the evaluation of recorded configurations against desired configurations. With Config, you can review changes in configurations and relationships between AWS resources, dive into detailed resource configuration histories, and determine your overall compliance against the configurations specified in your internal guidelines. This enables you to simplify compliance auditing, security analysis, change management, and operational troubleshooting.
AWS CloudTrail monitors and records account activity across your AWS infrastructure, giving you control over storage, analysis, and remediation actions. You can view and search these events to identify unexpected or unusual requests in your AWS environment.
AWS Shield is a managed Distributed Denial of Service (DDoS) protection service that safeguards applications running on AWS. AWS Shield provides always-on detection and automatic inline mitigations that minimize application downtime and latency.
Amazon Inspector is an automated vulnerability management service that continually scans AWS workloads for software vulnerabilities and unintended network exposure. These assessments include network access, common vulnerabilities and exposures (CVEs), Center for Internet Security (CIS) benchmarks, and common best practices such as disabling root login for SSH and validating system directory permissions on your EC2 instances.
AWS WAF is a web application firewall that helps protect your web applications or APIs against common web exploits and bots that may affect availability, compromise security, or consume excessive resources. AWS WAF gives you control over how traffic reaches your applications by enabling you to create security rules that control bot traffic and block common attack patterns, such as SQL injection or cross-site scripting. You can also customize rules that filter out specific traffic patterns.
AWS Audit Manager helps you continuously audit your AWS usage to simplify how you assess risk and compliance with regulations and industry standards. Audit Manager automates evidence collection to reduce the “all hands on deck” manual effort that often happens for audits and enable you to scale your audit capability in the cloud as your business grows.
A cybersecurity framework is a system of standards, guidelines, and best practices to manage cyber risks. The three most popular cybersecurity framework are:
The US National Institute of Standards and Technology (NIST) Framework for Improving Critical Infrastructure Cybersecurity (NIST CSF)
The Center for Internet Security Critical Security Controls (CIS)
The International Standards Organization (ISO) frameworks ISO/IEC 27001 and 27002.
NIST cybersecurity framework is intended to be used to protect any organization’s infrastructure from cyberattacks. The framework’s core is a list of cybersecurity functions that follow the basic pattern of cyber defense: identify, protect, detect, respond, and recover. The framework provides an organized mechanism for identifying risks and assets that require protection.
Identify
The Identify Function assists in developing an organizational understanding to managing cybersecurity risk to systems, people, assets, data, and capabilities. Understanding the business context, the resources that support critical functions, and the related cybersecurity risks enables an organization to focus and prioritize its efforts, consistent with its risk management strategy and business needs. Examples of outcome Categories within this Function include:
Identifying physical and software assets within the organization to establish the basis of an Asset Management program
Identifying the Business Environment the organization supports including the organization’s role in the supply chain, and the organizations place in the critical infrastructure sector
Identifying cybersecurity policies established within the organization to define the Governance program as well as identifying legal and regulatory requirements regarding the cybersecurity capabilities of the organization
Identifying asset vulnerabilities, threats to internal and external organizational resources, and risk response activities as a basis for the organizations Risk Assessment
Identifying a Risk Management Strategy for the organization including establishing risk tolerances
Identifying a Supply Chain Risk Management strategy including priorities, constraints, risk tolerances, and assumptions used to support risk decisions associated with managing supply chain risks
Protect
The Protect Function outlines appropriate safeguards to ensure delivery of critical infrastructure services. The Protect Function supports the ability to limit or contain the impact of a potential cybersecurity event. Examples of outcome Categories within this Function include:
Protections for Identity Management and Access Control within the organization including physical and remote access
Empowering staff within the organization through Awareness and Training including role based and privileged user training
Establishing Data Security protection consistent with the organization’s risk strategy to protect the confidentiality, integrity, and availability of information
Implementing Information Protection Processes and Procedures to maintain and manage the protections of information systems and assets
Protecting organizational resources through Maintenance, including remote maintenance, activities
Managing Protective Technology to ensure the security and resilience of systems and assets are consistent with organizational policies, procedures, and agreements
Detect
The Detect Function defines the appropriate activities to identify the occurrence of a cybersecurity event. The Detect Function enables timely discovery of cybersecurity events. Examples of outcome Categories within this Function include:
Ensuring Anomalies and Events are detected, and their potential impact is understood
Implementing Security Continuous Monitoring capabilities to monitor cybersecurity events and verify the effectiveness of protective measures including network and physical activities
Maintaining Detection Processes to provide awareness of anomalous events
Respond
The Respond Function includes appropriate activities to take action regarding a detected cybersecurity incident. The Respond Function supports the ability to contain the impact of a potential cybersecurity incident. Examples of outcome Categories within this Function include:
Ensuring Response Planning process are executed during and after an incident
Managing Communications during and after an event with stakeholders, law enforcement, external stakeholders as appropriate
Analysis is conducted to ensure effective response and support recovery activities including forensic analysis, and determining the impact of incidents
Mitigation activities are performed to prevent expansion of an event and to resolve the incident
The organization implements Improvements by incorporating lessons learned from current and previous detection / response activities
Recover
The Recover Function identifies appropriate activities to maintain plans for resilience and to restore any capabilities or services that were impaired due to a cybersecurity incident. The Recover Function supports timely recovery to normal operations to reduce the impact from a cybersecurity incident. Examples of outcome Categories within this Function include:
Ensuring the organization implements Recovery Planning processes and procedures to restore systems and/or assets affected by cybersecurity incidents
Implementing Improvements based on lessons learned and reviews of existing strategies
Internal and external Communications are coordinated during and following the recovery from a cybersecurity incident
Due to the rampant cyber attacks on private and public companies as well as government institutions, the President of the United States issued an Executive Order 14028 on May 12, 2021 to improve the nation’s cybersecurity.
To comply, companies must implement the five best practices from the Executive Order of the President:
Back up data, system images, and configurations; regularly test them, and keep the backups offline.
CyberEdge Group has been conducting yearly surveys to IT security professionals all over the world. The latest one – 2021 Cyberthreat Defense Report – is a comprehensive review of the perceptions of 1,200 IT security professionals representing 17 countries and 19 industries.
The report has become a staple among security leaders and practitioners, helping them gauge their internal practices and security investments against those of their peers across different countries and industries.
Here are the key insights from the 2021 report:
A record 86% of organizations suffered from a successful cyberattack last year
A record 69% of organizations were compromised by ransomware
57% of ransomware victims paid ransoms last year, but one-quarter (28%) of them failed to recover their data
Low employee awareness and lack of skilled personnel inhibit IT security’s success
87% of organizations are experiencing a shortfall of skilled IT security personnel
The typical enterprise IT security budget increased 4% last year, but the rate of budget growth slowed for the first time in years
Four out of five respondents prefer security products that feature machine learning (ML) and artificial intelligence (AI) technology
The percentage of IT security applications and services are delivered from the cloud climbed from 36% to 41%
Software developers are the backbones of creating secure software. The recently found vulnerability in Apache Log4j underscores the importance of developing secure software. Securing critical software resources is more important than ever as the focus of attackers has steadily moved toward the application layer. It is much less expensive to build secure software than to correct security issues after the software package has been completed, not to mention the costs that may be associated with a security breach.
One of the most adopted security frameworks is the CIS Controls (formerly known as Critical Security Controls). It has been updated in May of 2021 to keep up with the ever changing cybersecurity landscape. CIS Controls are a prioritized set of safeguards to mitigate the most prevalent cyber-attacks against systems and networks. They are recommended set of actions for cyber defense that provide specific and actionable ways to stop today’s most pervasive and dangerous attacks. Compared to the other security frameworks such as the NIST CSF (Cybersecurity Framework), CIS Controls are more prescriptive.
CIS Controls v8 has been enhanced to keep up with modern systems and software. Movement to cloud-based computing, virtualization, mobility, outsourcing, work-from-home, and changing attacker tactics prompted the update and supports an enterprise’s security as they move to both fully cloud and hybrid environments.
Here are the updated 18 CIS Controls:
Inventory and Control of Enterprise Assets – Actively manage (inventory, track, and correct) all enterprise assets (end-user devices, including portable and mobile; network devices; non-computing/Internet of Things (IoT) devices; and servers) connected to the infrastructure physically, virtually, remotely, and those within cloud environments, to accurately know the totality of assets that need to be monitored and protected within the enterprise. This will also support identifying unauthorized and unmanaged assets to remove or remediate.
Inventory and Control of Software Assets – Actively manage (inventory, track, and correct) all software (operating systems and applications) on the network so that only authorized software is installed and can execute, and that unauthorized and unmanaged software is found and prevented from installation or execution.
Data Protection – Develop processes and technical controls to identify, classify, securely handle, retain, and dispose of data.
Secure Configuration of Enterprise Assets and Software – Establish and maintain the secure configuration of enterprise assets (end-user devices, including portable and mobile; network devices; non-computing/IoT devices; and servers) and software (operating systems and applications).
Account Management – Use processes and tools to assign and manage authorization to credentials for user accounts, including administrator accounts, as well as service accounts, to enterprise assets and software.
Access Control Management – Use processes and tools to create, assign, manage, and revoke access credentials and privileges for user, administrator, and service accounts for enterprise assets and software.
Continuous Vulnerability Management – Develop a plan to continuously assess and track vulnerabilities on all enterprise assets within the enterprise’s infrastructure, in order to remediate, and minimize, the window of opportunity for attackers. Monitor public and private industry sources for new threat and vulnerability information.
Audit Log Management – Collect, alert, review, and retain audit logs of events that could help detect, understand, or recover from an attack.
Email and Web Browser Protections – Improve protections and detections of threats from email and web vectors, as these are opportunities for attackers to manipulate human behavior through direct engagement.
Malware Defenses – Prevent or control the installation, spread, and execution of malicious applications, code, or scripts on enterprise assets.
Data Recovery – Establish and maintain data recovery practices sufficient to restore in-scope enterprise assets to a pre-incident and trusted state.
Network Infrastructure Management – Establish, implement, and actively manage (track, report, correct) network devices, in order to prevent attackers from exploiting vulnerable network services and access points.
Network Monitoring and Defense – Operate processes and tooling to establish and maintain comprehensive network monitoring and defense against security threats across the enterprise’s network infrastructure and user base.
Security Awareness and Skills Training – Establish and maintain a security awareness program to influence behavior among the workforce to be security conscious and properly skilled to reduce cybersecurity risks to the enterprise.
Service Provider Management – Develop a process to evaluate service providers who hold sensitive data, or are responsible for an enterprise’s critical IT platforms or processes, to ensure these providers are protecting those platforms and data appropriately.
Application Software Security – Manage the security life cycle of in-house developed, hosted, or acquired software to prevent, detect, and remediate security weaknesses before they can impact the enterprise.
Incident Response and Management – Establish a program to develop and maintain an incident response capability (e.g., policies, plans, procedures, defined roles, training, and communications) to prepare, detect, and quickly respond to an attack.
Penetration Testing – Test the effectiveness and resiliency of enterprise assets through identifying and exploiting weaknesses in controls (people, processes, and technology), and simulating the objectives and actions of an attacker.
