Difference in CIA Triad (Security) in Information Technology and Operational Technology

Is there any distinction in the application of the CIA Triad between Information Technology (IT) and Operational Technology (OT)? To answer this, let’s first clarify what the CIA Triad is. The CIA Triad is a foundational security model that comprises three fundamental principles: Confidentiality, Integrity, and Availability, with a specific order of importance when applied to Information Technology.

1. Confidentiality: This aspect centers on keeping information and data private, safeguarding it from unauthorized access or disclosure.
2. Integrity: Ensuring data is maintained in a correct state and that any changes are auditable. Data must remain unaltered and reliable.
3. Availability: This principle ensures that information and data are accessible as needed. It emphasizes the reliability and uptime of IT systems.

The diagram above shows a presentation of CIA Triad for Information Technology.

In the context of IT, “Confidentiality” is paramount. Protecting data from breaches and ensuring the security of both users and systems are critical. “Availability” holds the lowest priority, as it is mainly about managing data and information.

Now, let’s examine how the CIA Triad is applied in Operational Technology. In OT, the order of importance shifts slightly. The focus moves from “Availability” being the top priority, followed by “Integrity,” and then “Confidentiality.”

Mastering Passwords and Security in the Digital Age

In our increasingly digital world, the significance of passwords cannot be overstated. Nearly every aspect of our lives requires authentication to verify our identities. In this discussion, we’ll explore the world of passwords and shed light on some key aspects.

Firstly, let’s address the question of password length. Many individuals often inquire about the ideal length for a password. Can we rely solely on numbers? Is an eight-character alphanumeric combination sufficient, or should we incorporate special characters?

A study by Hive Systems provides valuable insights into password length, refer to the table below:

Based on current technology, if an attacker were to attempt cracking a password consisting of 8 alphanumeric characters (including upper and lowercase letters and numbers), it would take a mere 2 minutes! This raises a crucial question: how can we better protect ourselves? According to Hive Systems’ research, we should consider using passwords comprising a minimum of 11 alphanumeric characters, including upper and lowercase letters, numbers, and symbols. Such a combination would theoretically take 3 years to crack. Ensuring regular password changes (typically every 3-6 months or as required) further enhances security.

It’s worth noting that as technology advances, with the rise of dynamic cloud computing, faster chipsets, artificial intelligence, and machine learning, the time required to crack passwords diminishes. Consequently, we may need to periodically review and increase the length of our passwords.

In addition to length, the composition of passwords is crucial. Creating strong passwords often involves incorporating seemingly random or special symbols. One technique is the “substitution” method, where we replace normal characters with special symbols. Please see the table below:

The Cyber-Attack

A Cyber-attack is a type of risk that aimed computer networks, systems and user data. These threats can come in the form of malware, phishing and other malicious activity. Cyber-attacks have been rated the fifth top-rated risk in 2020 and have become new status quo across public and private sectors. Foremost reason for the rise of the cybercriminals is clarified by expertise as:

The Risk of Remote Working

Ever since the pandemic hit globally, most organisations are forced to shift their employees to work remotely. Despite most of us are entering post-pandemic now, research results indicate that most employees will still continue to work remotely. Working from home bearings new cybersecurity risk it is also the most cited topic in the new trend. Home offices are often are less secured than centralised offices where firewalls, routers and access management are run by IT Security teams. In order to keep up the business operational during the pandemic season security inspection was not as firm as usual. Therefore, cybercriminals took advantages while adapting to it.

The Blooming of Internet of Things (IoT) & Cloud

The vast expansion of IoT also leads to the rise of cybercrime. This growth also refers to devices other than computers, phones and servers that connect to internet and data sharing across devices. IoT devices nowadays also include wearable fitness trackers, smart watches, smart home appliances as well as voice assistance. With the current trends and the changes in living lifestyle evolving rapidly, human rely more on these devices to assist with daily activities which also lead to more devices connecting to network and increase the potential for attackers to access our data. Gartner analysts predicted that in 2023, there will be estimated 43 billion IoT devices connected in the world.

With the increasing number of crimes by the Cyber-attacks, we should work towards initiating and developing a culture of awareness around cybersecurity issues. Cyber Threats are no longer an IT department issue to handle. In fact, everyone should start creating awareness of the threats and taking basic precautions as a fundamental part of every job description in 2023.

As a fundamental steps, the most common types of cyber-attacks classified as follows:

1.  Malware

Malware is hardware, firmware, or software that is intentionally included or inserted into a system for a destructive purpose and it is usually without the victim’s knowledge. Malware is also known as malicious code or malicious software. Over the years malware has become one of the most significant external threats to the systems. Malware able to cause extensive damage and disruption, and required massive efforts within most organisations. The below image simply explains the different types of common malware programs.

Picture 1: Types of Malware

Among the malware, viruses are a type of malware that often take the form of a piece of code inserted in an application, program, or system and they’re deployed by victims themselves.

Ransomware act as its name which is a type of malware that cyber attackers used for the ransom purpose. It locks and encrypts the target victim’s device or data then demands ransom from targeted victims in order for targeted victims to restore their access.

Spyware is a type of malware that enters devices without the owner’s knowledge. This is often for the purpose of stalking on internet activity, pursuing log in and password information, or collecting sensitive information which could be used for fraudulent purposes.

2.  Password Attacks

Password attack is the act of various methods used to maliciously authenticate into password-protected accounts. Password attacks are also known as one of the most common methods of corporate and personal data breaches.

Types of password attacks include:

• Phishing attacks
• Credential stuffing attacks
• Brute force attacks
• Dictionary attacks
• Password Spraying Attacks
• Keylogger Attacks
• Man-In-The-Middle Attacks

Among all the attacks, phishing attacks are the type that most press online. Victims usually will receive fake emails or notifications that pretend it is from trustworthy sources for example from banking institutes by asking victims to perform certain actions. Once users click on the links provided by hackers, they will gain genuine access to your account. This is not the end yet if victims are using the same password for multiple accounts. Hackers will then be having access to all victim’s accounts that share the same password.

Therefore, implementing a strong and unique password solution for every account access is recommended defence that evolves alongside.

3.  Distributed Denial of Service (DDoS) Attacks

Distributed denial of service (DDoS) attacks is a family of denial of service (DoS) attacks. DDoS (Distributed Denial of Service) is a category of malicious cyber-attacks that hire cybercriminals to cause an online service, network resource or host machine unavailable to the intended users on the Internet.

Distributed denial of service (DDoS) attacks is launched from multiple connected devices that are scattered across the Internet. These multi-person, multi-device bombardments are usually harder to stop, mostly due to the total volume of devices involved. Unlike single-source DoS attacks, DDoS attacks have a tendency to target the network infrastructure in an attempt to penetrate it with massive volumes of traffic. The attacks will continue until the server crashes or stop responding. While Service disruptions can often take hours to remediate causing huge financial losses.

Some of the main reasons for DDoS attacks are due to Ransom, Hacktivism, or competition. Types of DDoS attacks include application layer attacks, Protocol attacks and Volumetric Attacks.

4.  Structured Query Language (SQL) Injection

A Structured Query Language (SQL) injection is a type of cyber-attack that results from inserting malicious code into a server that uses SQL to manipulate the towards access to private information. The attacks use a set of SQL codes to manipulate a database and gain access to potentially valuable. Submitting the malicious code can be as simple as entering it into a vulnerable website search box. SQL is a query language applied in programming to access, modify, and delete data stored in backend database. This information may include sensitive company data, user lists or customer details.

The common SQL injection examples include: Recovering hidden data, where attackers can alter an SQL query to return additional results. Sabotaging application logic, where hackers can modify a query to disrupt with the request’s logic.

Due to websites and servers that commonly use databases, SQL injection liabilities are one of the older and most common types of cyber-attack. Numerous developments within the hacker community have multiplied the risk for this type of attack. Specifically, the development of tools to detect and exploit SQL injection are now freely available from open-source developers. Cybercriminals take advantage of these tools to automatically perform attacks in only a few minutes by letting them access to any table or column in the database with just simple clicks.

Types of SQL Injection are listed as follows:

1.       In-band SQL

• Error-based SQLi
• Union-based SQLi

2.       Inferential SQLi (also known as Blind SQL injection)

• Time-based SQLi
• Boolean SQLi

3.       Out-of-band SQLi

Noteworthy principles to help preserve organisations from cyber-attacks include:

Awareness Exercise:

Produce awareness about cyber risks within the team responsible for your web application, data as well as security by providing necessary role-based training to all users.

Use the latest versions:

It is crucial to keep the development environment up to date for optimised protection. This is to ensure eliminate of the older versions when needed which may lack current safety landscapes. Ensure the organisation are well protected with the latest software and security reinforcements at all time.

For more information about the Cyber security, feel free to email us at info@cybiant.com or contact us via the website chat.

INTRODUCTION

Cybersecurity is crucial as data keeps growing and becomes more valuable every single year. A significant portion of an organization’s data is often sensitive information of their customers, business strategy or financial information that could badly affect the business of the company if those data were breached. Even though most organizations have a dedicated team of cybersecurity professionals to prevent cyber-attacks, we still see a great number of high-profile organizations from which data was stolen or were compromised otherwise.

Solely depending on a team of professionals working on preventing cyber-attacks would not be effective as it requires a collective effort from the entire organization. What is needed is a framework that underpins a system or concept at the core of the organization so that every working component such as people, processes, and technologies can be designed to act as one to improve the overall cybersecurity capabilities of the organization. A cybersecurity framework is a system of guidelines, standards and best practices to manage cyber threats or risks. It provides a systematic way to mitigate cyber risk no matter how complex the environment might be.

CYBERSECURITY FRAMEWORK 

The NIST Cybersecurity Framework is one of the most widely adopted frameworks globally. The framework is introduced by the U.S. Department of Commerce’s National Institute of Standards and Technology (NIST) in February 2014 [1]. The framework was initially focused on NIST’s own critical infrastructure but today it is being adopted by many organizations. In fact, according to the research company Gartner in 2015, 30% of U.S. organizations use the NIST Framework and it was predicted that the number will rise to 50% by the end of 2020. Internationally the framework has been adopted in over 27 countries, and Japan and Australia have made NCSF central to its Government programs.

The reason NIST Cybersecurity Framework is widely adopted is that it allows an organization to view cybersecurity holistically. The framework in general covers five critical functions of cybersecurity and the definitions for each function are stated below:

• Identify: It highlights the importance to “develop the organizational understanding to manage cybersecurity risk to systems, assets, data, and capabilities”. The focus is on the organization, and how it relates to cybersecurity risk while taking into account the organization’s resources.
• Protect: “Develop and implement the appropriate safeguards to ensure the delivery of critical infrastructure services”. This function focuses on the crucial elements and actions that an organization needs to consider to help protect itself from cyber-related risks.
• Detect: “Develop and implement the appropriate activities to identify the occurrence of a cybersecurity event”. Despite the organization’s best efforts in preventing cyberattacks, there’s still always a chance that it can occur. This function enables the organization to discover these threats in a timely manner.
• Respond: “Develop and implement the appropriate activities when facing a detected cybersecurity event”. Being able to detect threats in a timely manner wouldn’t bring any good if the organization is not able to respond to the threats rapidly and effectively. This function provides knowledge on how to design and implement processes or guidelines to follow when a threat is detected.
• Recover: “Develop and implement the appropriate activities for resilience and to restore any capabilities or services that were impaired due to a cybersecurity event”. The recovery function is also very crucial as most businesses now are highly dependent on their digital assets in order to operate. A data breach could severely impact the operations of the business if the recovery process is not well executed.

NIST Cybersecurity Framework’s 5 Functions and Categories [2]

The framework covers the five important areas of cybersecurity providing the guideline or concept that any organization can implement to be equipped to respond effectively to cyberattacks, which is why it is widely considered to be the gold-standard for building a holistic cybersecurity program. To find out more about the NIST CS Framework, please sign up for Cybiant’s newsletter here or visit Cybiant’s knowledge centre. In the next article, we will share about the NIST Cybersecurity Framework Tiers and how an organization can benchmark or assess its cybersecurity capabilities.

Reference:
[1] https://www.nist.gov/news-events/news/2019/02/nist-marks-fifth-anniversary-popular-cybersecurity-framework
[2] https://www.nist.gov/cyberframework/online-learning/components-framework

INTRODUCTION

“50% of American organizations are expected to have implemented the NIST CSF by 2020.” – Gartner IT research and NIST.

The NIST Cybersecurity Frameworks gives organisations a five-point core structure to improve the cybersecurity posturing. Whilst it does not mandate requirements however, it is considered best practice that has been widely used globally for years now. The framework designs to provide organisations with powerful ways to governs their cybersecurity strategy. By implementing the NIST Cybersecurity Framework, organisations can evaluate their exposure as well as cybersecurity measures and take preliminary action to decrease risk.

In this article, we will take a closer look at what NIST entails and how the five functions react to enhance cybersecurity for an organisation.

The five points position as the basics of a successful and holistic cybersecurity framework that guide organisations in building a high-level cybersecurity risk management strategy. The five cores consist of the following functions:

• Identify
• Protect
• Detect
• Respond
• Recover

The five core elements of the NIST framework all work together among each other. They are the foundation role that supports all other elements in order to build highly effective risk management.

THE FRAMEWORK

The NIST Cybersecurity framework will guide an organisation to better understand, manage and reduce the possible cybersecurity risks. It also acts as an assistant in defining the activities that are crucial to assure the critical operations and service delivery. Moreover, the structure of the framework will allow the organisation to prioritize the investment allocation to assure every single budget spend optimally. On top of that, the framework also provides every member of the organisation with a common language to address cybersecurity risk management. It helps improving communication within the organisation and outside the organisation. The improvement that the framework provides includes clearer communication, awareness and mutual understanding among all units involved in the work scope. Also, the framework can also be used to share cybersecurity expectation between a buyer or supplier.

Furthermore, the framework can be used by organisations that already have extensive cybersecurity programs. Same applied to those who just begin thinking about putting cybersecurity management programs in place. The approach applicable for every organisation even the application may differ depending on your current state and priorities.

Organisations are using the framework in multiple ways nowadays. The most common practice in the industry is to use it as an aid to raise awareness and be the communication bridge with stakeholders within the organisation and this includes executive leadership. Apart from that, the framework also works as a guideline by mapping the current organisation management approaches to match up to the framework’s standards, guidelines and best practices. Some of them also use the framework as a case reference to reconcile and solve the internal policy legislation conflict, regulations as well as assess risks to current practices.

TIERS

Framework implementation ‘tiers’ provide context on how an organisation interpret cybersecurity risk and the processes in place to manage risk. Tiers used to define the degree of an organisation’s cybersecurity risk management practices that reveal similar characteristics as stated in the Framework. The ‘tiers’ illustrate an organisation practice by range (from tier 1 to tier 4). The tiers then replicate a development from informal to reactive responses to approaches that are agile and risk-informed.

In conclusion, the developed framework tend to provide guidance that is relevant for the organisation as a whole. The value of the implementation will not be realised if only the IT department uses it. The framework functions as a comprehensive due diligent check on risk management with one language that is adaptable to the audience. Additionally, the function, category and subcategory levels of the framework correspondent well to the organisation’s mission, business intelligence, IT and operational technology system level in one place. This drives the team towards an accurate and meaningful communication holistically across the organisation by having a mutual understanding from each party.

If you have any inquiries regarding the NIST Cybersecurity Framework, please feel free to contact us via our chat or info@cybiant.com.

Phishing attacks are increasing every year, as more and more people gain access to the internet and fall victim to phishing attempts. An attack can have devastating results. For individuals, this includes unauthorised purchases, the stealing of funds, or identify theft. Where phishes are concerned, it doesn’t matter how advanced the preventative technique is, somebody somewhere is going to fall for it. That doesn’t mean that organisations cannot do anything to lower the risk, as anti-phishing plans help reduce the chances of successful phishing attempts significantly. In this article, we are expanding more on what it is, the various types, and some anti-phishing measures employees and managers can take to protect their organisations.

What is Phishing?

Phishing is a type of social engineering trick that is primarily used to steal user data such as login credentials, credit card numbers and other pieces of sensitive information. The objective of this cyberattack is to lead the target into believing that a message, whether it’s an email, SMS, etc., is a legitimate one that they need. This message could be one impersonating a bank, or an insurance company, or a service that the cybercriminal believes the target might be subscribed to. The cybercriminal hopes that the target will click the link in the message or download an attachment, which can lead to the installation of malware, the freezing of the system, or the exposure of sensitive information.

What is a phishing kit?

The availability and easy accessibility of phishing kits makes it easy for cybercriminals to launch phishing attacks against potential victims. A phishing kit negates the need for any technical skills because it bundles together phishing website sources and tools that only need to be installed on a server. Once it is installed, an attacker simply sends out emails to potential targets. These kits as well as mailing lists are available on the dark web. A couple of sites, Phishtank and OpenPhish, keep crowd-sourced lists of known phishing kits. The goal is to attract the victim enough so that they will share their login details and other sensitive information, which will vary depending on the phishing scam. Developed using a mix of basic HTML and PHP, most phishing kits are stored on a compromised web server or website, and usually only live for about 36 hours before they are detected and removed.

Phishing techniques

There are many methods used by cybercriminals to lure their targets. Some of these include:

• Embedding a link in an email that redirects your employee to an unsecure website that requests sensitive information
• Installing a Trojan via a malicious email attachment or ad which will allow the intruder to exploit loopholes and obtain sensitive information
• Spoofing the sender address in an email to appear as a reputable source and request sensitive information
• Attempting to obtain company information over the phone by impersonating a known company employee

And there are three main categories of phishing, these are: Spear Phishing – Phishing attacks that are targeted at specific individuals, companies or organisations are known as spear phishing. Cyber criminals who conduct these attacks usually spend time gathering and using the personal information about their targets to increase the probability of success. It is often intended to steal data for malicious purposes and cybercriminals may also intend to install malware on a targeted user’s computer. Clone Phishing – A more sophisticated type of phishing, this method is more difficult to identify and often tricks users into believing an email is legitimate. In clone phishing, an email is a clone of an email which has been previously delivered, this way, the victim is less likely to be suspicious of the email because it appears to be coming from a real sender. Whaling – Whaling is a form where the attacks are directed specifically at individuals who are in positions of power, high profile people, senior executives, etc. In the case of whaling, the content of the malicious emails will be tailored to target an upper manager or person of interest. The content will usually include things that are more likely to get their attention such as subpoenas or complaints.

Anti-phishing techniques

Avoid clicking suspicious links – Most phishing scams are successful because the emails contain very convincing links. The scam emails motivate people to take action by impersonating institutions and threatening to close down important accounts because of inactivity. If you get one of these emails, don’t click on the links provided in the emails. Instead, it is recommended that a user opens up a tab in your browser and types in the domain name him or herself. Once logged in, a user can then check to see if the request is authentic. If it is, they can take action on the legitimate website. Don’t open unknown files or attachments – Opening malware files is how computer systems and networks can get infected. It is important to double check the attachments and files that you are receiving from emails. Some Emails automatically send infected emails to your spam folder or delete them entirely, but it can be the case that an email bypasses that filter and ends up in your inbox. Use an Internet Service Provider (ISP) that implements strong anti-spam and anti-phishing technologies and policies. Users can check with their respective ISPs for more information about the anti-spam and anti-phishing services that are available. Keep software up to date – Keep all your software and applications up-to-date, including your anti-virus software. Updates keep you safe from known security vulnerabilities which hackers exploit for their malicious intents. Some more steps that employees can take include:

• Deploying web filters to block malicious websites
• Encrypting all sensitive company and private information
• Converting HTML email into text only email messages or disable HTML email messages
• Use spam filters that filter out blank senders, viruses, spam emails
• Implement a security policy that encourages regular password changing

And most importantly: Educating and raising awareness in company employees is one of the best lines of defence against cybercrime and especially phishing. Want to learn more? Read our article on enabling cyber security awareness.

By now most people understand the concept of cybercrime but probably may not understand the full implications of the term. The consequences of cybercrime can be heavy and industries are in constant battle against cyber attackers. Hacking with the intention of stealing personal or financial information is one of the most common types of cybercrime. It is one of the fastest growing criminal activities across the globe and it affects both organisations and individuals alike.

CSIS estimated that in 2016, whilst taking into account the full range of costs, cybercrime cost the global economy between $445 billion and $600 billion. As a percentage of global GDP, this represented 0.8% on the higher end. The countries with the greatest losses (as a percentage of national income) are in the mid-tier nations—those that are digitised but have not yet realised their full cybersecurity potential.  In this article we will cover the definition of cybercrime, the types of cybercrime and some real-world examples.

What is Cybercrime?

Cybercrime is an ‘umbrella’ term for lots of different types of crimes which normally take place online or where technology is a means and/or target of the attack. This is why it is called cybercrime since the crimes are done using computers and network connections. Cybercriminals often commit crimes by targeting electronic devices like computers, mobile phones, TVs, or other devices with a connection to a network. These crimes can often causes virtual or physical harm and pose real threats to victims globally, which is why governments and police around the world are constantly adapting to new technologies to fight against cybercrime.

Traditional forms of crimes have also evolved as a result of criminal organisations becoming smarter and adapting to the usage of the internet to facilitate their crimes. These crimes are not new but are adjusted to take advantage of the internet to maximise profits such as theft, fraud, illegal gambling, the sale of narcotics, etc.

As technology advances, so does the complex nature of cybercrime and the need to protect ourselves against it. The explosion of the internet and use of computer and mobile devices has seen an increase in cybercrimes occurring around the world. Internet speed, convenience, value and privacy mean it’s much easier for cyber criminals to carry out cyber-attacks.