Exploring Information Security - Change Log - January 19-25, 2023 (Copy) (Copy)

This is a log of changes to the site over the last week.

New pages:

Security Certifications - Deep Dive - A page covering security certifications.

Red Team Tools - Deep Dive - A page covering tools a red team or penetration tester would use.

GDPR - Deep Dive - A page covering the EU’s GDPR regulation.

Podcast posts:

How to Hack a Satellite with Tim Folwer - Tim and I get into the nuances of space security.

Blog posts:

How to build a phishing program - Blog post on building a phishing program within a company.

How to build a phishing program

The first thing I recommend, is reading Phishing Dark Waters by Christopher Hadnagy, Michele Fincher, and Robin Dreeke. They have a lot of great insights on phishing and how to build a program and I used the book as a guide to build my own. One of the ideas in the book that really helped give me direction for building the program were the metrics. The book broke metrics down into four categories:

• Clicked and Reported

• Clicked and Didn’t Report

• Didn’t Click and Reported

• Didn’t Click and Didn’t Report

The idea of a phishing program is to reduce click rates and increase reporting rates. These metrics helped establish goals and strategies for building and running a successful phishing program. Using these metrics as a guide we were able to reduce click rates and improve reporting rates by over 50% at a company with over 6000 employees. Below we’ll get into getting started, the mindset to have, how to mature the program, and metrics and reporting.

Getting Started

Leadership buy-in

The first thing needed is leadership buy-in. The higher up the leadership buy-in the more effective the program. If buy-in isn’t at the highest level don’t fret. Once the program is started leadership will start to buy-in once they see the metrics. Metrics have a way of providing valuable insight into the risk associated with phishing attacks for the company.

Who to tell

Before sending a phish you need to inform the people that will help keep the phish from becoming a full blown incident. This can vary depending on the organization. Some will want very few people to be told. Others will want legal and HR input. The essential people that need to be involved is the person you report to and the Security Operations Center (SOC) and help desk managers.

The SOC and help desk managers will need to determine if their people need to be told. The SOC and help desk should be included in the phishing simulation, other times it might be more beneficial to let them to know. Often, they managers will want to see how their directs respond to a phishing email report. For larger phishes it’s a good idea to inform the help desk but for more targeted phishes they may not need to be told. There’s also always the option of making them a targeted phishing group.

Automation

Sending out phishes will increase the workload on other departments like the help desk, the SOC, and anyone monitoring the security inbox, if that’s not already the SOC. Automation is a friend here. Setup automated responses wherever a phishing email may be reported.

We didn’t do this for our first phish of the company and had over 500 people report the email. I responded to every single one of them because it was my miss and I wanted to acknowledge and show people appreciation for reporting a phish. If they’re not acknowledged and thanked they’ll be less likely to send in a phishing email in the future.

Recognize people who report phishing emails

To make an effective phishing program people need to be recognized and thanked for taking the time to identify and report a phishing email. If there’s a platform where employees can send other employees praise or recognition I would load anyone who reports a phish in there. People need positive feedback to continue the positive behavior.

Also, it’s okay if people tell each other about the simulated phish. We want others getting into the habit of giving their peers and co-workers a heads up that they have a phishing email in their inbox. Simulated phish or real phish people giving each others a heads up is a good thing.

Create your first phish

To start pick something super dumb that has a lot of indicators that easily identify it as a phishing email. This will provide a baseline for the overall click rate of the organization. It will help build the roadmap for future phishes. Establishing the baseline sets the starting point. As click rates go down the difficulty of the phishes can be increased and reported on. This will help show a reduction in risk to leadership.

The thing to remember about click rate and phishing emails is that there a lot of factors that go into clicking on an email. The time of day, the stress levels of people, what’s going on at work and at home, and luck. Who get’s sent a phish, time of day, and the type of phish are the only things in our control. Click rate is volatile. I’ve seen a monthly phish get a 2% click rate. I’ve also seen a monthly phish get a 14% rate. Pay attention to the time of year and what might be going on inside and outside the organization.

Deciding on whether to blast out the email or schedule it over a period of time is going to be very important. For larger groups you want to schedule the phish over a period of time. I would phish the entire company monthly. They’d get the phish at random times throughout the month. For smaller groups I had the option of sending them the phish all at once. Sending out a phish to several thousand emails in one day that will not make you any friends with the SOC or help desk, especially if automation is not set up.

What’s off limits

Even if your CEO gives you free reign, like I’ve had in the past, you do not have free reign. GoDaddy got in trouble for a phish in 2020 that the security team sent. The lure was a $650 holiday bonus. After people clicked they instead got told they were assigned extra security awareness training. While the bad guys may use this type of technique or other types of phishing emails we as the good guys should not stoop so low. That type of phish is getting people’s hopes up and then bringing it back down. This will result in an angry reaction.

Anything dealing with financial, family members, politics, religion, or sex are off limits. These topics create an extra strong emotional reaction from people. I also wouldn’t mess with anything related to marketing or other departments needing to get employees engaged. Any of these will be sure to get you in political hot water. Even if you get backed up by the CEO that group may have to accept it, but they won’t like it and will look to sabotage the program.

The phishing program is something people in the organization should understand is here to help. It’s already hard enough to get people to buy-in and feel good about security. Pissing them off won’t help the program and may even result in it being hamstrung. That’s why it’s important to remember that a phishing program is practicing for the real thing. It’s not the game of “Gotcha!” it’s practice.

It’s about practice

From Ted Lasso

The phishing program is about practicing the activity of receiving and responding to a phishing email. Getting people to get them doesn’t help and can put the phishing program in choppy political waters. That’s why the program needs to tie back to something real world.

Dig into your email gateway and look for phishes that are being caught in there. Check the security inbox to see what actual phishing emails are being reported there. Look for ones that are of a general nature for the entire company. Pay attention to the news and what are some of the latest phishing emails being sent to people. Think about the time of year. Packages are flying around during November and December. The phishing platforms do a good job of adding new templates with the latest phishing emails they’re seeing. Make it relevant.

Targeted phishes

Targeted phishes are phishes that are sent to a targeted group. The purpose should be specific to the department or group of people and related to techniques attackers may use to try and get into an organization. Again, look in security tooling to understand what certain groups are being targeted with and research phishes in the news that relate to the company’s industry.

Depending on your organization you can go outside of the parameters of making it related to outside news events. In the past I’ve seen phishes using Game of Thrones and the latest Avengers movies as lures. These were sent to groups who were aware of the phishing program and did a better job of identifying phishes. For targeted phishes like this make sure to host training afterwards to discuss and reiterate the practice aspect of the phish.

One of the most successful phishes I ever did was part of a lunch and learn session. The phish got a 50% click rate and it wasn’t even my idea. As part of the session I asked the people in attendance for ideas for a phish to send to IT. We had a praise platform that you could use to send people praise. So we decided to do a phish that used one of the notification emails for getting praise. Then we made it look like it was from the CEO. We did add several indicators that it was a phishing email such as giving them a nonexistent praise and an obvious link if you hover over it. We got clicks almost immediately during the session.

Later that day I was visited by a couple of directors in the IT department who said they had never fallen for an internal phish before at any organization. I avoided severe political backlash in this situation because they were in a group with a low click rate and they had access to the lunch and learn where we did the phish. In another organization this could have caused a lot of issues.

Despite conducting phishes as a way to gather information and reduce risk in the organization we are still going to bruise some people’s ego. Which is why we need to be thoughtful and careful about the phishes we send.

Increase the difficulty

As the click rate goes down, increase the difficulty. Determining if you can increase the difficulty should be from a reduced click rate from a period of over three or more months. Month-to-month click rate can be volatile. To increase difficulty reduce the number of indicators in a phishing email. If you started with five indicators reduce it to four. This allows the phishing emails to have levels of difficulty that can be reported on.

Indicators can be anything from reducing misspellings to making domains look a lot more legitimate. We’ve used domains that were bought to protect the company from typosquatting attacks. We loaded those into the platform and used them when we needed to increase the difficulty of phishing emails.

Reporting, Metrics, and extra training

As mentioned above, I like to use click rate and report rate. Other statistics don’t provide as much insight. The phishing platform may not have those statistics as default which means some excel jujitsu will be needed to get the metrics worth reporting up.

I never liked calling out individuals unless they were flagged multiple times as repeat clickers and put the company at a significant risk. In that case a conversation with their manager and HR is useful. One of the things I find useful was to group click rate and report rate by department. Grouping departments gives people an out but still allows large groups of people to be reported up if they’re having trouble with phishing emails. Leadership liked this grouping as it provided them with good insight into which departments were struggling with phishing emails. This also motivates departments do better because they don’t want to be in the top 10 click rate and want to be in the top 10 for report rate.

As far as training, I didn’t like assigning extra training from the phishing platform unless there was buy-in from the top and could be tied to something performance wise from an HR standpoint. If I assigned training without any sort of outcome, people could ignore the training and not have any repercussions. I do still think training is important and preferred in-person training because it allowed me to walk them through the phish and allow them to ask questions. I found that the groups I got to work with in these training sessions did a much better job with phishing emails. Those sessions can also be recorded and put into a LMS platform.

Summary

A phishing program can be a powerful security awareness tool for an organization. It should look to decrease click rate and improve report rate. The first phish should set a baseline. Increase the difficulty as click rates go down and report rates go up. Try to tie phishes to relevant phishes that is being seen in the company’s security tooling. Even with free reign certain phishes are off-limits. The CEO might be okay with it but everyone else will start to harbor bad feelings towards the phishing program and security and will look to undermine it when possible.

Identify what metrics are important and put those together to be reported up. Creating top 10 lists for departments is a great way to gamify the reporting and get people to more actively participate. Finally. remember this is about practice. Anyone can fall for a phish if the right factors line up. Taking an empathetic approach will help with making the program more engaging and effective.

Drop any questions you may have in the comment section below or reach out via the contact form.

This post first appeared on Exploring Information Security.

Exploring Information Security - Change Log - January 12-18, 2024

This is a log of changes to the site over the last week.

Updated pages:
Cloud Security - Deep Dive - Added a section for Azure Security Tools.

Podcast posts:

What are the Hiring Trends in Cybersecurity for 2024? - Erin Barry Head of Permanent Talent at Code Red Partners joins me to discuss hiring trends

Blog posts:
2024 Security Presentation Topic: Threat Modeling - My speaking topic for 2024.

This post first appeared on Exploring Information Security.

2024 Security Presentation Topic: Threat Modeling

I have been accepted to speak at two conferences this year: ShowMeCon in St Louis, MO, and the Palmetto Cyber Summit 2024 in Columbia, SC. I’m super excited to be speaking again in 2024. In 2023 I spoke on API security. This year it will be on threat modeling. Threat modeling is one of those the recommendations I’ve made in just about every talk I’ve given over the years. I figured it was time to dive deeper in.

As I prepare for the conference I will be blogging about threat modeling to help get my thoughts together. The abstract and outline are below. I’m waiting on a response for one other conference in the Spring. I will be submitting to other conferences later on this year as their CFPs open up. If you have a suggested conference please leave a comment below or reach out.

Abstract

Threat modeling is a critical process that helps organizations identify and mitigate potential security threats in the early stages of projects or when a legacy application is discovered with little to no documentation. This presentation aims to serve as a comprehensive introduction to the wonderful galaxy of Threat Modeling.

We will explore the fundamental questions: What is threat modeling? Why is it crucial for cybersecurity? How can it be integrated into your development and IT processes effectively? Why do I feel like I'm in preschool again?

This presentation will provide you with a structured approach to threat modeling, demystifying the process and breaking it down into manageable steps. We will discuss various methodologies and tools available for threat modeling.

Grab your towel and join us for "The Security Hitchhiker's Guide to Threat Modeling." Leave with a clear understanding of how to embark on your threat modeling journey.

Outline

• Introduction

• Why this talk?

• What is Threat Modeling?

• The Basics of Threat Modeling

• Key concepts and terminology

• The threat modeling process

• Identifying assets and data flows

• Establishing the security profile

• Identifying potential threats

• Assessing vulnerabilities

• Prioritizing risks

• Methodologies and Approaches

• Overview of common threat modeling methodologies

• STRIDE

• DREAD

• OCTAVE

• Attack Trees

• Pros and cons

• Choosing the right methodology

• Tools and Resources

• Demonstrations and examples 

• Best Practices and Tips

• Conclusion

This post first appeared on Exploring Information Security.

Exploring Information Security - Change Log - January 5 - 11, 2024

This is a log of changes to the site over the last week.

New pages:

Cybersecurity Communication - New page on why communication in an organization is important for security.

Typosquatting Attacks - A page talking about Typosquatting attacks

Podcast posts:

What is ShowMeCon2024? - I sit down with Dave Chronister to discuss the upcoming ShowMeCon conference in St Louis, Missouri.

Blog posts:

Favorite Moments from ShowMeCon - I blog about some of my favorite moments from ShowMeCon

DevSecOps and other security buzzwords that will make the endangered list in 2024 - Thoughts on DevSecOps and other buzzwords in the industry that are seeing a downward trend.

This post first appeared on Exploring Information Security.

DevSecOps and other security buzzwords that will make the endangered list in 2024

This all started when Tim Tomes asked for DevSecOps resources on LinkedIn:

I’ve never been a big proponent of the term DevSecOps. I believe the “Sec” is silent and that DevOps should already have security baked in. That’s a post for another time though. As I thought about it I hadn’t really heard the term in a while. Some of that may have to do with being in a broader space and no longer focused on just application security. I decided to hit up Google Trends to see what it had to say about the term DevSecOps.

Search trend for “devsecops” via Google Trends

Using ChatGPT I asked for DevSecOps resources. It provided some Microsoft, GitHub, GitLab, and a DevSecOps University. The best one is probably the GitHub project Awesome DevSecOps but that hasn’t been updated in three years. The other resources were stood up between 2022 and 2023. AI has probably over taken a lot of other conversations on the internet in the last year.

I looked at two other buzzwords Digital Transformation and Zero Trust. Both had similar trends to DevSecOps.

Search trend for “Digital Transformation” via Google Trends

Search trend for “Zero Trust” via Google Trends

I suspect AI is definitely impacting and we’re starting to see less interest in the other buzzwords.

Search trend for “AI” via Google Trends

I’d be okay if the term DevSecOps went away or was at least less used. I believe security is something that’s already baked in when done right. We don’t need to add our own flair to terms people use in other industries. I expect AI will start to ooze into buzzwords and continue to overtake buzzwords that have emerged over the last several years.

Leave your thoughts in the comment section below on other buzzwords to add to the endangered list.

This post first appeared on Exploring Information Security.

Favorite moments from ShowMeCon

The latest episode of the Exploring Information Security podcast is out. Check out Episode 171, What is ShowMeCon 2024?

I have been told I’ll be speaking at ShowMeCon 2024, which I’m super excited about because it’s a great conference that is a nice change of pace from the other conferences in the industry. The people that attend are the biggest draw. Not just the organizers and the friends I’ve made in the St. Louis area but also the attendees. They’re attentive and ask really great questions.

The conference hits that sweet spot between hacker and local chapter conference. There’s lots of great hacking personalities and talks but it also has that professional business feel. You won’t have to worry about logistics such as caffeine or food. You can just focus on the content the conference has to offer. The content is great with well known speakers such as Kevin Johnson and Jayson E. Street and lesser known ones like me! Here are some of my favorite moments from past ShowMeCon iterations.

St. Charles and St. Louis

The venue and location are fantastic. The conference is held in the Ameristar Casino Resort and Spa. The conference center is spacious and well setup. They have breakfast, lunch, and a happy and dinner. The rooms are fantastic. St Charles is a great spot to hang out and St. Louis has a lot of really great free options for family such as the zoo. The pool is a popular spot with the biggest draw being the music underwater! This is the best venue and location I’ve been to for a conference.

Speaking at showmecon

I was shocked when I went to the podium at ShowMeCon for the first time to present on How to Build a Home Lab. There were way too many people in that room for my talk. It was absolutely packed and it went really well. I even got a great laugh from the crowd which is always a great feeling for a presenter. I heard the next year when I was brought back that I had a lot of really great feedback on the talk which surprised me but it’s something I’ve always remembered and appreciated being told. I did an application security talk that I don’t remember much about. My last year there I was invited to do an Exploring Information Security panel which was great and had a lot of great interaction from the crowd.

Dave Does a talk with a guitar

One of my favorite talks from the conference is when Dave got on stage for a talk with his guitar. As he mentioned on the podcast, he did that because his talk wasn’t ready but he needed to do something so he got up on the stage with his guitar. It was a really great improvised talk on security with a guitar. Dave is a pretty good musician.

Malort

Very few people like the taste of Jeppson’s Malört. Made in Chicago it is one of the most vile things you will ever taste. Johnny Xmas, another speaker at the conference, brought a bottle to share in the speaker room. These were the results:

Hope to see you at ShowMeCon 2024!

This post first appeared on Exploring Information Security.

Change Log - December 29, 2023, to January 4, 2024

This is a log of changes to the site over the last week.

Page upates:

Podcast and Website Sponsorships - I added lists and mentions of the podcast on the internet.

Blog posts:

Cybersecurity Predictions for 2024 - My predictions for 2024 because every blog has got to have them.

Launching Exploring Information Security - I talk about my reasons for launching the company and what services I offer.

New Years Resolutions: Taking Small Steps Past January 31st - Just a random post about habits and making small progress to your goals.

Exploring Information Security Podcast Format - I talk about what I’m thinking for the new format of the podcast.

Podcast posts:

The Exploring Information Security Relaunch - It’s back!

This post first appeared on Exploring Information Security.

Exploring Information Security podcast format

First, I’d love to hear feedback from listeners on the podcast. This post is going to deal specifically with length of the podcast. In the past I’ve tried to keep episodes to around 30 minutes. The idea being that people can listen to an episode during a commute and that they have other podcasts the listen to on a regular basis. It also allowed me to split up longer conversations so i could more easily release content on a regular basis. One conversation could be three weeks of work with some extra editing.

I think I’m going to ditch that and just let the conversations run for as long as they do. A couple reasons for that: people pick and choose episodes and reduce the extra editing. Towards the end of the podcast I started getting more insights into how people listened to the podcast. I found that I had a regular listener base but also a lot of people who would pick and choose the episode to download. For example, one of the more popular episodes was on studying for the OSCP. It was downloaded a lot. Searching the internet I found it on a lot of reddit threads as a suggestion for people studying to get their OSCP. I think breaking up the podcast makes it harder for people to listen to the content they want. They have to go through multiple podcasts with an intro and an outro.

On the backend there’s a lot of work that goes into a podcast episode. One episode of 30-60 minutes is usually about three to four hours of production time not including the recording. I have to schedule guests, research the topic to make the questions, and then do post editing to clean up and put together the audio. While breaking up the podcasts gets me more episodes it adds a little complexity to the editing process and I want to simplify that. It does mean I’ll have to book more guests but I think that adds more content naturally to the podcast and site.

Thoughts are appreciated. Hit the comment section below or reach out to me via the site contact form or LinkedIn.

This blog post first appeared on Exploring Information Security.

New Years Resolutions: Taking small steps past January 31st

Not really a security topic but imagine I’m using a building a security program analogy.

I’m not a New Years resolution guy. I think January 1 is an arbitrary date and if that I’m going to make changes that stick I need to start now rather than later. I’ve started new habits in the middle of the year and on December 20th. I’ve found that I tend to be more successful when I just start. Three years ago I got a Whoop in November 2020 and it’s been tremendous for habit changes I want to make. It tracks my sleep and strain for the day using a heart rate, respiratory rate, blood oxygen, and stress levels. I fill out a journal every morning on the habits and activities that affect my recovery. I’ve discovered valuable insights that have allowed me to make adjustments for the betterment of my health.

This is one of the things to remember when making changes to your life. It’s not one month and done. It’s a journey. The Whoop has helped with my journey because it provides me the data I need to make more targeted adjustments. It wasn’t something that happened over night or even in a month and I’ve been working on some of my vices for over three years. It took my seven years to quit smoking in my 20s. I did that with small steps.

It’s the same thing for any habit change. It requires small progressive steps. Some people can quit cold turkey or make drastic changes. Good for them! I’m not one of those people, unfortunately. For me it’s small changes that help me make life changing habits. There’s been set backs. A lot of setbacks!

If you’ve set a New Years Resolution that’s great! Making changes is hard. I would advice patience and the acceptance that there will be set backs. If there is a setback work to get back on track. If you keep plugging away it you’ll get better and be healthier for it. Health is very important not only for yourself but also for your career.

This blog post first appeared on Exploring Information Security.

Launching Exploring Information Security

Starting January 2, 2023, I will be offering a set of services as Exploring Information Security, LLC. Check out the Services page for a full listing of what I plan to offer. I am offering a variety of services based on my skillset, past experience, and where I think I can be most effective helping people and organizations.

I have researched and established rates but I’m willing to negotiate lower rates based on demand.

Why the move to self-employment

I had an opportunity to start monetizing the Exploring Information Security podcast back in 2019. I was starting to have people from vendors reach out to me about hosting a guest. I had some conversations about but I still had a full time job that I enjoyed and had recently been promoted into management.

As I discussed in my final episode, I decided to shut the podcast down because management was a very stressful job. I was compensated well enough and wasn’t really looking for another source of income. I also wanted to spend more time with my family. I had spent less time with them so I could develop my career and get us to a better financial situation.

Fast forward several years, I am at a transition point in my career. I have enough money saved up that I don’t need to immediately find a job. I had planned to launch this last summer but I had an opportunity to join some friends at Antigen and see the inner workings of a startup while I helped get them through the busy season of incident response. I am very grateful for that opportunity and it gave me time to further refine Exploring Information Security.

I am still looking for a job and if you’re interested in chatting reach out to me on LinkedIn.

What are the services

Looking back over my career, I realized I really enjoyed being an educator and building out programs and processes that helped an organization be more efficient and effective. With that in mind the services I am offering are built around that. I am throwing several different services out there to see what will stick.

Sponsorships

This is for vendors who are looking to expand their brand. I’ve got several ways of doing this via the podcast and website. An existing or upcoming show can be sponsored. My podcasts are meant to be timeless and I’ve found that people don’t listen to the podcast in order. They pick and choose whatever podcasts interests them. Sponsoring a show means the ad will run for a much longer time.

Ads are short advertisements prior to or during the show. If a pre-existing show is sponsored I will edit and re-add so it gets refreshed in feeds. Another option is to produce an episode specifically for the vendor. A guest from the company comes on to discuss a topic that relates to a product or service. You can also hire me to run your podcast or webinar panels.

For the website, vendors can sponsor specific pages, blog posts, or the website overall with a banner ad. This can be things existing or I can create the page. Rates are based on effort and other factors.

Hit the contact button if you’re interested in these services.

Contact

Education

I’ve presented at several conferences and local user groups over the years but I’ve done even more inside organizations. I always like putting together presentations that are engaging and help people learn about security. The website is a reflection of that. Security Awareness is something that I think is very important for an organization but every time you bring it up to people they don’t have a good experience with it. I want to change that. I want to make content that is engaging and is something people will engage with more.

Coaching is something I’ve done a lot of as a manager and as a mentor to people in the space. This is why I’m offering Cyber Security Coaching services for individuals and organizations. I’ve had lots of conversations with people in management that are struggling to upskill there staff and I believe I can help with that problem.

Management is something I’ve done for over six years. It’s where I always wanted to be in my career and I spent a lot of time studying and consuming podcasts on the topic. It’s something I’ve been very good at as I’ve been able to retain people and get the most out of them. I knew that once I got into management I needed to shift my mindset from a doer to a delegator. My results were going to come from my team not from what I did.

There’s a talent shortage but managers can get more out of there people and do so without increasing the work week. I’ve done it and I’m happy to share how I’ve done it as part of Management and Hiring Consulting services. You can also review the management resources page on the site. It’s all my “secrets” to management. If you don’t have time for that click the contact button.

Contact

Security Consulting

I’ve built lots of programs and processes over my career. Many of them are still running today. I build programs to outlast me. My specialization is application security, vulnerability management, and security awareness.

I’ve implemented an application security program that got vulnerabilities down to zero for existing applications in 6 months. I’ve also improved security in cloud environments taking security scores in the 20% and getting them to over 90%.

I’ve built a vulnerability management program that reduced vulnerabilities in the environment by 86% in the first year. After a few years vulnerabilities in the environment were below 20 thousand after starting at over two million.

I’ve conducted security awareness training at lunch and learns, town halls, secure code training, and post incident sessions. I’ve also built a phishing program that phishing 6000+ employees monthly and reduced click rates and increased reporting rates by over 50%.

I have experience in other areas such as security engineering, pentesting, security operations, governance, risk, and compliance. I am a generalist with a wide view of security and how it can make the business better. Contact form is below.

Contact

Speaking Engagements

I enjoy taking a complicated topic and breaking it down into understandable and actionable terms. I’ve been doing this for several years both at conferences and internally at organizations. I think presenting is an art and that content can be engaging. Which is why I’m offering up my services for conferences or internal events people would like me to attend. Along with podcast services I’m willing to run a podcast or moderate a webinar panel for organizations as part of their marketing initiatives.

Contact

Donate

I’ve gotten a lot of great feedback over the years on the podcast. I’ve heard from professors who assign their students podcast episodes to listen to for homework. I’ve had co-workers let me know they listened and enjoyed the show. I’ve had people in the industry reach out to me to ask when I was bringing the podcast back. Today is that day and I’m excited to make a small impact on the industry!

For people looking to support the podcast I’ve setup a way to donate. The more donations I get the more opportunity I have to focus on developing great content for this site. Click the donate button to show appreciation and help me focus on producing content for the site.

Donate

Review

To review, I’m excited for the opportunity see if I can make Exploring Information Security a sustainable company. To this day I still meet people who used to listen to the podcast and I’m often asked if I’ll be bringing it back. That day is to day!

I want to keep this going even if I end up having to get a job. Launching it with services will hopefully make it sustainable and allow me to regularly produce content and build out the website. For individuals looking to contribute I have setup a place to support the show by donating money. I may down the road add a subscribers portal but the podcast and the content on this site will always be free. I want this site to help people grow and develop their careers and tackle the difficult problems in the information security space.

If you’re interested in services or just want to drop a note our question reach out by filling out the contact form below.

This post first appeared on Exploring Information Security.

Contact

Cybersecurity Predictions for 2024

Here are my predictions for 2024.

Exploring Information Security relaunches

I will be launching Exploring Information Security as a company in 2024. I may or may not have some insider information. I’m in a bit of a career transition and I have the opportunity to try turning this idea into a company. More details to come.

New buzzwords

I asked ChatGPT for some 2024 buzzwords. A couple of my favorites include:

Cyber Resilience: Focusing on an organization's ability to continuously deliver the intended outcome despite adverse cyber events.

Regulatory Compliance Tech: As regulations around data privacy and cybersecurity tighten, technologies and solutions to aid in compliance will be crucial.

Cyber resilience is an interesting one because I’ve worked in the Incident Response space for the last several months and the difference in backup plans for a ransomware attack varies by company in the small to medium business market. Some have a plans on how to continue to operate while others have zero ability to operate while down. This is basic disaster recovery planning and it doesn’t have to be malware it could be a natural disaster. I expect ransomware will become more of a topic in disaster recovery planning.

ChatGPT gave me plenty of AI buzzwords and I think that’s what we’ll see more of in 2024. AI will be thrown in everything even more than it was before. I imagine some form of AI defense or AI security will emerge as well because it’s a bit of a hot topic.

More breaches reported earlier and then updated later

As I recently wrote last week, Okta and 23andMe A New Public Relations Tactic in Disclosure? I suspect companies will report breaches sooner with limited information and then update later. First impressions are a hard thing to overcome. This is something companies will look to exploit as they try to control the public relations narrative.

On the less cynical side the new SEC incident disclosure rules are in effect and companies have less time to report on a breach. This could mean companies are reporting with less information and then need to update later. We’ve already seen a ransomware gang try to use this new disclosure rule to their advantage by filing a complain with the SEC because the company refused to negotiate.

Social engineering continues to make a comeback

With groups like Scattered Spider and LAPSUS$ emerging over the last couple of years I expect there to be more social engineering based attacks to get into an organization. We saw it in the second half of this past year with the MGM and Caesar and Okta hacks. The Verizon Data Breach Investigation report highlights the human element every year. We are the most susceptible systems to an organization. Everyone can be manipulated in some way.

Finally, AI will start to have a large impact on the workforce

AI is here to stay and I can tell you from experience that it is very useful. It will change society significantly over the next 10 years. Next year is going to be a big year. 70-80% of this site is built with the help of AI. I would not have been able to put up as much content without it. It’s been a great learning opportunity.

Development and documentation based professionals will be impacted the most this year. People not use it will put out more work than their co-workers. People that don’t will be let go because they won’t be needed. Developers are already using it to start code and build unit tests. GRC folks can write 10 policies in a matter of just a few hours. I did it for a company last year. Whatever field you’re in, I’d recommend starting to get familiar with it now because the next generation of professionals are already there.

What are your predictions for 2024? Leave a comment below.

This blog post first appeared on Exploring Information Security.

Change Log - December 22-28, 2023

This is a log of changes to the site over the last week.

New pages:

Services page updated

• Added Podcast and Website Sponsorship page added - details sponsorship opportunities for the podcast and website

• Security Awareness Training page added - details security awareness training the company offers

• Cybersecurity Consulting page added - details consulting services for the cybersecurity space

• Cybersecurity Coaching page added - details on services for cybersecurity coaching

• Management and Hiring Consulting page added - details what services are available for management and hiring consulting.

• Speaking Engagements page added - details services for speaking at events.

Blog posts:

Web Application Testing: Portswigger Burp Suite vs OWASP ZAP - I talk about my experiences and view on the two testing tools.

This post first appeared on Exploring Information Security.

Web Application Testing: PortSwigger Burp Suite vs OWASP ZAP

Both OWASP ZAP and Portswigger Burp Suite are exceptional tools designed to identify vulnerabilities in web applications. I’m one of those oddballs that prefer ZAP over Burp Suite. Most (95%) of penetration testers and application security engineers prefer Burp. We’ll dive into the history and differences below.

History

OWASP ZAP is an open-source web application security scanner. Ideal for beginners and intermediate users, it offers an intuitive user interface and a wide range of features. ZAP is particularly known for its active and passive scanning capabilities, spidering, and a powerful REST-based API. Being a community-driven project, it's continuously updated with new features and security tests.

I started using ZAP when I was asked to stand up an application security program for an agency I was employed at in South Carolina. I knew nothing about application security but quickly found the Open Web Application Security Project (OWASP) and a free tool for testing applications the Zed Attack Proxy (ZAP). With the tool I found my first vulnerability, blind SQL injection, which kick started the application security program at the agency. Nearly a decade later the developers are still using ZAP to test their applications prior to it going to production.

According to ChatGPT:

Burp Suite, developed by PortSwigger, is a more comprehensive suite of tools. It includes an advanced set of features like detailed manual testing tools, automated scans, and the ability to save and resume sessions. Burp Suite comes in various editions, with the free version offering basic functionalities, and the professional version providing more advanced capabilities.

This is the view of most professionals within the testing space of security that I’ve interacted with. A lot of this comes from the history of ZAP which was a fork of another open-source proxy called Paros Proxy. Development is no longer done on Paros but ZAP is still being developed and has a lot of community support.

A lot of the features mentioned about by ChatGPT ZAP has as well. The tools are 90% the same with some slight nuances in functionality. Either tool will test an application sufficiently.

ZAP vs Burp

ZAP was written by a developer named Simon Bennetts. I had the pleasure of having Simon on for the eighth episode of Exploring Information Security. I’ve used Burp throughout my career. First as part of training courses such as Tim Tomes’ Practical Web Application Penetration Testing (PWAPT). I tried it as part of my day-to-day work but I would usually fall back to ZAP. I found the interface of ZAP more user friendly and I’ve heard people who prefer Burp confirm that they liked some of the organization of the interface.

Burp is still a fine tool it just takes a little more time to get used to the interface. Having used ZAP that was just my preference. I’ve used both in assessments and found the findings very similar. The plugin ecosystem is a more robust but ZAP has plugins and they are kept up-to-date regularly. Both are well documented tools and easy to go through and learn. Portswigger offers a lot of free online resources for learning how to use the tool better and is probably a large reason why a majority of testers use it.

I like ZAP for developers because it was written by a developer and it’s free. Burp has a community version but it’s automated scanning is rate limited unless you have the paid version. You can get the testing done it just takes longer. One of the features I’ve heard proponents of ZAP appreciate is the Forced Browse feature which does a good job of finding directories in an application.

Final thoughts

Either tools is good for testing web applications. It really comes down to preference and the situation a person is in. If you’re looking to get developers more involved in testing ZAP is a great fit. If you’re looking for a specific plugin for testing Burp will probably have it. Results are going to be very similar.

What’s your preference for web application testing tools?

This blog post first appeared on Exploring Information Security.

Created with the help of ChatGPT

Change Log - December 15-21, 2023

This is a log of changes to the site over the last week.

New pages:

MGM and Casears Hack - Page giving a summary of the attack and impact.

23andMe Hack - Page giving a summary of the attack and impact.

Okta Hack - Page giving a summary of the Okta hack from October 2023

Blog posts:

Log4Shell, is it really an issue at this point? - Blog post on my experience with Log4Shell and it’s actual severity.

Okta and 23andMe a new public relations tactic in disclosure? - Blog post asking if PR firms are trying a new tactic to take the heat off a brach.

Tips to Help Build Strong Relationships Inside and Outside of Work - Blog post on techniques for building better relationships.

Other:

Services page - updated and added more of a description overview.

This post first appeared on Exploring Information Security.

Tips to help build strong relationships inside and outside of work

I love the saying from Manager Tools.

“There are three types of power? Technical power, role power, and relationship power. Relationship power is 75% of the power in an organization”

I quote it a lot to people when I’m having discussions about organizations.

Building relationships with people internally is what has allowed me to be successful in my career. We cannot do it all on our own. The techniques for building relationships apply both internally to a company as well as outside of the company at networking events. Her are some of the things I have done to build strong relationships inside and outside an organization.

How to build relationships

Ask questions

The number one thing I use to build relationships is ask questions. Then I follow that up by actively listening to the answer and asking more questions.

People’s favorite subject is themselves. Getting them to talk about themselves makes them feel good. If you are asking the questions you are the reason for that feeling. People will pick up if you’re being inauthentic, so it really helps if the questions are coming from a genuine curiosity. Look at them and hear what they’re saying and ask follow up questions to what they have just said.

When I first started doing this it was pretty hard. I liked to interject my own commentary. As I worked on it it eventually became easier. It is okay to interject here and there but talking less and listening more overall will help endear you to people quicker.

This was the tool I found most effective working with developers. Code is a developer’s baby. They create it. They nurture it. They get frustrated when it doesn’t pass tests. They may have dropped it once or twice. It’s their baby though and coming in and calling it ugly (even if it is ugly) isn’t going to make many friends.

This is where questions help. Developers lit up when you show an interest in their code (baby) and they will tell you everything about it. This helped me understand the code better. Why it was written the way it was written and allowed me to have tough conversations with them when it was causing problems. I had built that trust and they knew I was only trying to help them make the best code possible.

Spend time together

When you spend time together there’s a bonding that occurs. This builds trust and allows for people to get to know each other better. I’ll go to lunch with people if asked or I’ll ask others if they are interested in going to lunch. It’s a great way to just have a normal conversation outside of work. Asking questions gives insight into the person.

If money is tight, this can be done at work. If there’s an open spot a table ask to join (asking questions again ;). If it isn’t often people will tell you to pull up a chair and join them anyway. Worst case look for someone else to sit with. People that are sitting by themselves usually won’t mind company.

stay in touch

Make sure to stay in contact with people. This became harder with the pandemic and everyone working from home. Often I would reach out to them if we hadn’t chatted in a while and I was in a meeting with them. I’d shoot them a quick IM saying hi and asking how they were doing.

The Allen Curve is a study from the 1970s that described as distance increased between engineers communication became less frequent. If you are wondering why CEOs want people in the office it’s because of The Allen Curve (a future blog post).

Image courtesy Clutch.co

I’m surprised at how many people are not familiar with this idea. Regardless, as distance increase communication decreases. It makes sense. When you were in school you stayed in contact with your classmates more often. As people moved the communication between people became less frequent. You may have experienced this during the pandemic with coworkers. The person you got coffee with every morning and chatted about work or real world events you no longer communicate with on a regular basis. I’ve seen this apply with people just switching floors or moving to a different part of the building. The distance doesn’t need to be far for communication to drastically decrease.

If you are back in the office walking around can be a good way to stay in touch, as well as get a little exercise and a break from the computer. Working remotely is tougher. That’s why I set up reminders to connect with people every so often. This can be a week, month, months, or several months.

Reciprocity

Give without expecting something in return. First, this is a great feeling to just give without expecting something in return. Letting go of the return also helps with any frustration or anger that might occur from not getting something back. This can feel difficult because we all would like to think people will return the favor but it is something that can be practiced. Most people will want to return the favor. It might not be immediate but it will come at some point. Some people won’t return the favor. Either way we learn something about that person. Be careful to identify what people consider a favor because we’ll all have different ideas.

The five love languages is a great resource to read and understand. Some people just want help with their work. Others will want gifts or money compensation. Others will want praise. Understanding what drives people will help better understand what they may give in return.

I enjoy helping others and would rather someone help me than give me a gift. I would often look into help desk tickets for others and try to push them along if I could. This was a small effort for me but paid off when I needed something from these same people. Often, because I had helped them they would return the favor.

Be yourself

Be genuine and authentic. People can tell if you’re just there to get something out of them. If someone determines another person has or is trying to manipulate them the relationship is toast. Be who you are and don’t try to be someone else. You can work to make positive changes in your behavior and habits but ultimately we’re all who we are. I’ve struggled with being myself. I want everyone to like me but that just isn’t possible. I’ve tried being someone else for people and it doesn’t work. I have improved how I interact with people but ultimately I have to still be true to myself and accept that I won’t connect with everyone.

Easy to start habits

Two techniques I like to tell people to start with is using people’s name and saying thank you. Again, people are their favorite subject and hearing there name is a good feeling. You’ll have to identify what and how people liked to be called. Don’t just shorten people’s names because some people like being called by their first name. Some people like using their middle name or nickname. It is also a great way to start a conversation.

Say, “Thank you!” This is so easy to do and one of the least used techniques in the workplace. Say thank you to people for their work. Say thank you for getting you something. Say thank you for sharing their insights. It’s so easy to do and something people don’t hear enough.

Summary

Relationships are a very powerful thing. They can help advance a career and they can help get a job. To build a strong relationship, make it about the other person. Ask questions and spend time with them. Give without expecting something in return. This can feel very difficult because we are very transactional and want to get what’s rightfully ours. Most people will return the favor. The ones that don’t you will still learning something about them.

Finally, Be yourself and start small. Be who you are but realize you can make improvements to your behavior and habits. One of those can be by using people’s name and saying “Thank you!” for something they’ve done. Gratitude is a powerful thing and makes you and the other person feel good.

How do you go about building good relationships with people? Leave a comment below.

Resources

If you want to learn more about social engineering check out my GitHub page, Social Engineering for the Blue Team. You can also click on Social Engineering page or reach out to me directly with any questions you may have.

Social Engineering - Deep Dive

Contact

This blog post first appeared on Exploring Information Security.

Okta and 23andMe a new public relations tactic in disclosure?

I’m starting to wonder if we’re going to see a new tactic for US based companies where they report an initial breach and then report the full extent of the breach later at a more opportune time.

We’ve already seen this whether intentionally or unintentionally with the breaches of Okta and 23andMe. Both reported a small amount of their use base was impacted. Then several weeks later came out and reported it as much larger. It would be an interesting tactic especially since the new SEC rules are now in place as of December 15, 2023, requiring companies to report a material cybersecurity incident within four business days.

Public Relations (PR) departments have always looked for ways to limit the impact of a breach hitting the news wire. They’ll often release bad news on holidays or around other major events. Caesars did while the MGM breach was hot in the news cycle. They released their own breach by the same threat actor. A couple months removed and most people only remember the MGM breach.

I’m in the security news bubble so it’s hard to say if this tactic is working. Okta is a company that’s in the security space so most people outside of security don’t care about it. 23andMe is a DNA testing service for health and ancestry discovery and it’s still early to determine the effectiveness of their PR mitigation.

Looking at it from the companies perspective, we have asked for more transparency from companies on breaches. That could be what we’re getting here. They’re providing additional information for disclosure purposes and education purposes. Being honest and conscientious is not always reward in the media. There are companies who will do the right thing but are others who will not.

I think it is a new tactic and I’ll be curious to see if more companies start trying the strategy of releasing an initial compromised and then coming back later to, “correct” it. Especially, in the case of 23andMe who has decided to update their Terms of Service to include litigation protection for themselves. It just looks bad.

This blog post first appeared on Exploring Information Security.

Log4Shell, is it really an issue at this point?

I thought reading the Veracode State of Log4j Vulnerabilites: How Much Did Log4Shell Change? by Chris Eng would be a bit of FUD (fear, uncertainty, and doubt). I was pleased to see that it wasn’t. They provided some great numbers on Log4J and remediation efforts. I was also happy to see them recognize that developers fix vulnerabilities when alerted about them quickly. This is something I talk about a lot in my presentations and with security folks. Developers want to get this right and having right approach and empathy with vulnerability management will get them to buy into these efforts.

The next line though says that the data contradicts the developers response because there is so much Log4j out there. Reviewing the CVEs in the article most of the remaining Log4J is in other packages. This is a problem with packages and open source. A package can be buried in another package. This was highlighted several years ago with the left-pad incident. A disgruntled developer removed a small bit of code that added a left-pad to the side of a website from NPM. It took down thousands of website because that line of code was buried in other packages.

This is why security needs to take a balanced approach to vulnerabilities and not lean only on severity rating. We need to be building proof of concepts. The reason why Log4j was such a massive thing was because it was buried in other packages. While it might be in another package it might not be used or accessible by attacker. In the case that it was it’s important to understand what it gives an attacker.

This is where the balance comes in for security. Just because the vulnerability is an 8-10 severity doesn’t mean that’s it’s actual severity in each environment. If it’s note exploitable it’s more like a 1-3 severity. Which moves it down the priority list of vulnerabilities of which there are usually hundreds of thousands.

Don’t get me wrong you want to get those vulnerabilities addressed but the timeline for getting them addressed changes. When I was leading the effort for Log4j remediation in our environment we used the pentest team to find what was exploitable externally. After remediating those vulnerabilities we looked internally. Most vulnerabilities could be patch but internal couldn’t be updated immediately and required a larger upgrade to accomplish. This is where we established timelines with those teams to get the vulnerability remediated because we knew what needed addressing immediately and what could take more time Just a blanket patch it all now would interrupt business processes, projects, and create hard feelings.

It’s good to note that Log4j is still out there and probably extremely important for companies to patch. Security needs to identify how much of it is actually vulnerable and work with other departments and teams to figure out the best timeline. Development teams need to be focused on more immediate issues such as the Atlassian server having a vulnerability or the latest malicious NPM package. Those are more important than a two-year old vulnerability that may or may not be exploitable. If it is exploitable go patch now!

Chucking vulnerabilities over a wall to developers is never a good strategy and will waste a lot of time and effort and degrade trust between departments.

If you are in need of consulting services on vulnerability manager or application security click the contact button below and reach out. I’m happy to have a conversation about your struggles and identify how I can best help.

This blog post first appear on Exploring Information Security.

Change Log - December 8-14, 2023

This is a log of changes to the site over the last week.

New pages:

Management Resources - This is a page for management resources.

Security Policies - A page with security policy templates that can be download and used within your organization

Podcast posts:

ColaSec News - November 2023 - This is an experiment I’m toying around with as a regular segment and a return to podcasting.

Other:

Added a new open source section and tool to the API Security Resources page

Open Source:

• Swagger Jack: sj is a command line tool designed to assist with auditing of exposed Swagger/OpenAPI definition files by checking the associated API endpoints for weak authentication. It also provides command templates for manual vulnerability testing.

I am going to start up a newsletter for the site. Fill out the form below if you’re interested.

This blog post first appear on Exploring Information Security.

Free security policy templates available for download

When I started up this website last summer one of the first things I was asked about was creating security policies for a company that didn’t have any. I thought it would be a good opportunity to try out ChatGPT and the results were very exciting. Within a couple hours I had ten policies for a small business that needed them as part of a security review. I had them review and then had them sign them.

ChatGPT provided me the first draft and then I edit and customized it to the company. For large companies this isn’t a big deal but for small companies that need security policies this is a good first step. I’ve decided to release the templates I made on my website. Feel free to provide any feedback in the comment section below.

As I’ve written before, I think AI is going to have a huge impact on society similar to computers or mobile phones. Specifically, in the security space it will impact anyone that creates documents like policies.

You can click the link below to access the policies for download. If you need help with your policies or need other consulting services click the contact link below and fill out the form.

This blog post first appear on Exploring Information Security.

Security Policies

Contact