Put a SOC in IT

2016 has been an unprecedented year that has resulted in many surprising and unexpected outcomes;

1. Cyber criminality and hacking has been at an all new record high.
2. Leicester City won the Premier League 2015/16 season.
3. Brexit Means Brexit.
4. President Elect Donald Trump.
5. Sir Terry Wogan passing away.

There’s no link between them in simple terms, however, the amount of online activity to discover and watch these events unfold, has meant that each service provider has needed to be preventative and proactive whilst safeguarding their communities (internally and externally) from cyber hacks and the theft of personal and business sensitive data.

Examples of hacks in 2016

• National Lottery
• Three Mobile
• Tesco Bank
• Sage
• Kiddicare
• Hospitals in Grimsby, Scunthorpe and Goole
• Yahoo
• Ashley Madison
• And On And On And On And On And On…

The common denominator is ‘People’ and their albeit extensive attempts to destroy these organisations by hook or by crook (pun intended), has led first and foremost to arrests and significant financial penalty fines followed by CEO’s and their senior management openly communicating responsibility that they royally screwed up and working to mitigate how to recover and plan for future breaches.

The future of Cyber Security and Technology, if you’ve been keeping abreast, has been the innovation and investment of Artificial Intelligence (AI) and Machine Learning based technologies.  Talented people have built them using sophisticated algorhythms and people will continually manage them whether or not you think differently.

Companies in the UK that i’ve personally engaged with throughout 2016 have a wish list of projects for 2017 and these are their priority order;

1. Security Operation Centre (SOC).
2. GDPR.
3. ISO27001 certification
4. Cyber Essentials
5. Cloud based security services

If the priority is a SOC, then where will they be built?  In-house OR collaboration with a Cyber Security Partner?

Happy Christmas, Happy Chanukah, Happy Holidays and a Healthy, Successful and Prosperous New Year.

Jonathan Posner

Cyber Security Advisor

 

It’s Derby Day In Manchester

The clash of the titans is soon to kickoff between Manchester City F.C and Manchester United F.C in what is commonly named ‘The Manchester Derby’, Saturday 10th September, KO 12:30 at Old Trafford.  This match is significant because it will set the tone for how the rest of the season will unfold for both teams and who is ‘the greatest Manchester team’ – i’m a realistic City fan but with grandeur.

The recent acquisition of two of the hottest football managers Pep Guardiola and Jose Mourinho by their respective teams have both held their press conferences today.  Pep is telling the press everything they need to know but nothing he knows compared to Mourinho who has come out with fighting talk.

What makes this relevant based on the feelings of us, the die hard football fan, has parallel connotations within Cyber Security right now.

Cyber Crime is a reality.  ‘When’ is the new ‘If’ surrounding threat levels.  Investment or disinvestment? CapEx or OpEx?  Risk Averse or Greed? Defence or Attack?  Scaling up talented resource or managing what resource is already in place?

All of these suggested variables aren’t conducive for the CISO, their immediate and extended team.  They take a great deal of due diligence, internal strategy meetings with senior stake holders (hopefully engaging with HR, Finance, Procurement, Risk and Compliance).  Compounded with timescales for a final decision that once was 3 months (2006) now up to 12 months (2016) isn’t helping the situation and there lies the similarities.

Imagine being Pep or Mourinho for a moment.  You’ve been contractually signed to a 3 year deal to be the manager of one of the biggest football clubs in the world.  The pressure is on to make a difference and quickly.

Are you given autonomy or do you have to square off every decision?  Do you have a budget that you can personally sign off or does it have to be ok’d (sic) with the CFO?  If you were to get rid of the drifting wood and replace them with new blood, how will that play out with the already existing team players.  What are the risks for not buying new players? What are the risk of doing nothing?  Which transfer window do you choose to make your moves?

I conclude with a pause of thought.

Football is ‘The beautiful game’.  It’s a team sport therefore everyone needs to be communicated to (i’ve not met a mind reader yet!)  but trust that the difficult decisions will be made and executed by the experts.

Cyber War is today’s reality and it affects everyone, therefore if advice is being shared it should be listened to, considered and implemented.  The experts know the risks and they will deliver but you have to trust them.

COME ON CITEH #CTID

Jonathan Posner

Cyber Security Advisor

Caretower a Cyber Security Partner

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Negotiators Understand ‘Packaging’

The anecdote I’m sharing is powerful for many reasons.  Israel last week celebrated her 68th Birthday.  Also, the fact that the country are bounded together by mutual respect for life, therefore acknowledging a day in which to reflect upon those Men, Women, Girls and Boys who defended their country so that others can live with all the freedom and peace we as westerners take for granted.  Lastly, the admiration I have for Rabbi Johnny who considered that albeit his first proposal wasn’t successful, he re-packaged his second proposal therefore progressing to his ‘Must Have’. Scotwork teaches you these skills that will over time and practice become innate.

Two years ago on Yom Hazikaron I had a conversation with an Israeli police officer that helped crystallise how I feel about Israel, and especially how I relate to the fallen soldiers buried on Mount Herzl Military cemetery.

I had been to Mount Herzl on a number of occasions, but never on Yom Hazikaron – and certainly not since we’d made aliyah. So that Yom Hazikaron afternoon I drove from Yad Binyamin to Yerushalayim to visit and honour those who are buried there, while especially planning to visit the graves of Hannah Senesh, Yoni Netanyahu, Nachshon Wachsman and Michael Levin – whose names had been engraved in my heart and mind through their stories and their example.

Having arrived at around 4pm I walked towards the main entrance of Mount Herzl, but just as I was about to enter the cemetery I was stopped by a police officer who asked me where I was going. I replied that I wished to enter Mount Herzl and visit the graves of the fallen soldiers. She then asked me whether I had any relatives buried there, to which I answered no. Then, in a kind yet firm manner, she explained that entrance was currently limited to those whose family members are buried there and that, with regret, I was unable to go in.

Though I understood that the police officer was just doing her job, I was very disappointed. I had made a special journey to come and visit, and while I certainly wished to respect families visiting their relatives, I also wished to honour those who had made the ultimate sacrifice for the Jewish State. Given my mixed feelings, I took a few moments to do some thinking, and I then approached the same police officer and, in a gentle tone, told her the following:

“A few moments ago you asked me if I had any relatives buried on Mount Herzl, and I replied no. However, while it is true that none of those buried are my blood relatives, they are all part of my family. I am a Jew who loves Israel and who has chosen to make Israel my home, and all those buried here did so because they considered every other Jew as part of their family. So today, on Yom Hazikaron, I’d like to visit my family who are buried here and show them the honour that they most certainly deserve.”
The police officer was deeply moved by what I had said, and she then allowed me to go in.

Yom Hazikaron is a day on which we think about those whose dedication to both the people and the land of Israel led them to make the ultimate sacrifice for both the people and the land of Israel. It is a day of sadness and reflection, while also a day of pride and appreciation. But most importantly, it is a day when we should remember that we’ve all got family buried on Mount Herzl, and that we are utterly indebted to each and every one of them.

I’VE GOT FAMILY BURIED ON MOUNT HERZL by Rabbi Johnny Solomon

Space Balls

Who’d of thought that the reality of flying into space was no longer for those privileged few, to endure an ‘Out Of This World’ life changing experience. Our very own Great Britain’s Tim Peake @astro_timpeake who has taken over all of our imagination that with the right aptitude anything is possible.

What would happen if there were to be Cyber Attack/Cyber War between enemies that could cause irrevocable damage and bring down not just power plants but intergalactic explorations to further parts of our galaxy and the plan to place humans on Mars?

The greatest minds in some of the most infamous academic institutions who apply their scientific, creative and mathematical minds to develop extraordinary technologies to get men/women into space maybe to some the envy, BUT, are they applying common sense surrounding ‘Security’?  I’m not so sure – happy to be proven wrong.

A recent study by IOD identified that almost half of businesses do not have a strategic security improvement programme albeit it’s on their agendas, and, if they were to have a breach they couldn’t rectify the damage within an acceptable timeframe (SLA) therefore causing an apocalypse disconnect from working daily activities.

What’s more, Brand Reputation is the ultimate objective and therefore has greater ramifications and this is, in the words of  Scotwork “A Must Avoid”.

What’s the solution? is a common and a basic flawed question in my opinion, there are better questions that should be asked;

1. How do we protect ourselves (the company who has hypothetically been attacked) and our customers?
2. If senior management were to know of the problem, they would be asking their I.T/HR ‘What did they get’? (The Hackers)
3. What’s going to keep me awake at night?
4. When are we going to be attacked not If?
5. Let’s suppose there were to be a major network outage, are there simple, processes and procedures in place to quarantine the issue and reduce the impact?

‘Space’ the final frontier is now a reality for the common person, for example you will be able to, for a hefty price i may add, fly with Virgin Galactic, but let us hope they’ve had ‘Security’ through all of their thinkings from inception to soon to be launch and it won’t be ballsed up.

Jonathan Posner

Cyber Security Enterprise Account Manager

 

 

 

 

 

 

 

 

Life Off Grid

What would happen if your life were to become off grid, stagnant, due to not having access to the basic essentials such as hot water, sanitised water, lighting, cooking utensils etc…

5th January 2016, power companies in the Ukraine, were hit with a Cyber Attack that gave intelligent black hat hackers, the control of partial areas of the nation’s national power grid for hours.  Fortunately the employees overrode the system to manual to bring the affected areas back on grid.

Hackers are advancing in their abilities of sophistication with real-time severe disruption, this is not just a Cyber Attack this is Cyber War – It’s personal.

The need to always be online and connected 24 hours of a day, 7 days a week, 365 days of the year is all of our minimal expectation, however, without preventative measures the exposure to attack and vulnerability is unquantifiable.

UK PLC are now months away from enforcing their new and improved legislative programme GDPR.  This will be safeguarding businesses and their employees from Cyber Attacks and Cyber War, but the key differentiator between the old version and the new one is that if there aren’t measurable deliverables then those who are affected will be financially penalised and more worryingly have to publically announce that they’ve been hacked – How do you put a price on Brand Reputation?

Fear not, scaremongering this isn’t, this is a real threat to us all in our personal and working lives however we can batten down the hatches but without causing too much disruption.

Life Off Grid for some would be an adventure but for most it would be hellish.

Jonathan Posner

Cyber Security Enterprise Account Manager

 

 

 

 

 

 

 

 

 

 

 

 

Blazing Saddles

A couple of weeks back. I was privileged to be invited as a friend of Scotwork to attend ‘The HR Directors Business Summit’ in Birmingham, UK.

The opening of the 3 day event was headlined by ‘Howard Webb MBE’ who introduced us to his life as a professional referee and his personal experiences at club level, country level and refereeing the final of the last World Cup.  He explained that throughout his career he was asked to draw upon all of his skills, expertise and knowledge, and within a matter of seconds conclude a decision that would ultimately come from his ‘Gut’.

Imagine deciding the difference between a free kick or a penalty in front of 1 billion viewers watching his hand reaching for either a card or pointing to the penalty spot – Oy Vey!

HR people are typically not my first port of call, to be perfectly honest surrounding Information Security and Cyber Security, however, the opportunity to understand their roles and responsibilities gave me ample insight and awareness to dot the i’s and cross the t’s. – HR and I.T do talk with one another.

People collaborate with  People. People engage with Like Minded People.

Take for example a scenario whereby there’s been an internal breach such as a ‘Phishing Attack’, commonly stemming from clicking on what looked like a bonafide and genuine link as part of the email.  Once it’s been clicked it’s too late, the hackers are now on the inside of your company’s network and use the entry point as the host to cast their attack of malicious ‘Ransomware’.

Both IT and HR will call upon one another’s team of experts, to mitigate the risks of exposure of the individual and/or the company and investigate whether the attack was internal or external.

There lies the collaboration, There lies the opportunity.

If you’re planning a security improvement programme or a new strategy of your cyber security, my advice would be talk with HR, their input could be of more value than you thought and be the trigger to empower you to trail blaze the saddles.

Jonathan Posner

Cyber Security Enterprise Account Manager.

 

 

 

 

 

 

Trading Places

2009 was a significant year for the world when the Global Finance Crisis unfolded, causing significant positive future outcomes.  7 years later this has made the world in my opinion a more challenging world to work within but the rewards are greater, allow me to elaborate with personal experiences.

The past couple of weeks i’ve held client meetings with 3 large global companies (confidentiality prevents naming them) surrounding Information Security and Cyber Security.  The people I met with are senior security management (CISO,CIO,CTO level) whom’s responsibilities include – mitigation of risk, brand reputation, client loyalty, security improvement programmes and ‘The Preservation of Profit’.

‘The preservation of profit’ raised for me a number of curiosities (that’s how I am), this lead a general conversation to a more intriguing and challenging proposition being presented.

The client asked ‘How do we improve the services for our clients, who fundamentally call the shots of whether we are awarded their business or not?  They explained “In other words preventing the dilution of the senior management’s personal bonus (pay cheques), if we are to make changes, we have to ensure that we are providing a tier 1 level of Cyber Security, Adding Value, Saving Money however we don’t have the opportunity to increase our internal resources.

This presented a new opportunity for me, to offer a principal proposal together with a price against these new demands (they are not ‘New’ per se but now realistic) but also allowed me to trial whether if they were wanting me to meet their objectives would they in return be willing to meet mine, a skill I learnt from Scotwork ‘Over and Under’.

The world of commerce has forever changed, the profiteering that once was, is now affecting the senior management big bonuses personally, whereas once upon a time the money being spent was the company’s.

If like me, you’re the ‘Salesperson’ then there are golden rules to meet with these new challenges.  You should try, in your opening gambit be courageous to include the words- Openness, Transparency & No Bullshit and if you know me and we’ve met then maybe you’re nodding.

Trading places is making a revival, the client’s position has changed and so have their agendas and their expectations require calibrating .  Empathy goes a long way to draw closer engagement and with resounding success, be willing to challenge the status quo, place a price against a demand and don’t fear the ‘Bullish’ they may change to ‘Bearish’.

Jonathan Posner

Cyber Security Enterprise Account Manager

 

 

 

 

 

 

 

 

 

 

 

Don’t Ask = Don’t Get

Whilst travelling into the work the other day, I was listening to Radio 2 Breakfast with Chris Evans, who has a segment especially for kids aged circa 6-11 calling in to tell him what they’ll be doing ‘For The First Time’.

A young caller no more than 9 years old, explained that he, his brother and his Dad had just been to Anfield ‘For The First Time’, to watch their team Liverpool F.C v Manchester United.   Unfortunately they lost 0-1 due to a Wayne Rooney 78th minute winning goal (Stuffy Gets – I’m a Manchester City Fan #CTID).

Chris asked the young boy how he felt scoring it between 0-10?  He gave himself an 8 out 10.

The next part is the fantastic.

The boy told Chris that he felt sad that Liverpool lost although it was a great night out with his family but ‘You Know What Would Make It A 10 Out of 10’ asked the boy? If you were to give me 3 free tickets to be a guest at the ‘Top Gear’ live recordings.

Chris paused, laughed and replied with ‘what the hell, sure you can have 3 tickets’ and then went on to say ‘If You Don’t Ask You Don’t Get’

Lessons learnt by a 9 year old

• No Fear
• Straight forward question
• Asking for something realistic
• Maximising the opportunity

These are traits that as you become older, you tend to give up, you’re more aware, educated and perhaps afraid to push the boundaries for fear of rejection and be made to feel inadequate.

Richard Branson wrote a book titled ‘Screw It, Lets Do It’, in other words what’s the worse that can happen by not asking or giving something a go ‘For The First Time’

Jonathan Posner

 

 

 

 

 

 

 

 

 

 

 

 

Happy New Year

The end of 2015 will have either ended with all the trimmings of happiness, success and achieving bucket list items, or, a gladness to see it fizzle away into the ether, with a new year ahead filled with promise, dreams and new year resolutions.

Throughout 2015 Cyber Security ascended to the priority of senior board level meetings for many of the major companies in the UK, they could no longer ignore the severity of what was happening on an almost weekly occasion and had to take evasive action internally to mitigate threats potentially them be next as a target.

TalkTalk, Marks & Spencer, Moonpig, 56 Dean Street Clinic, WH Smith, HMRC (be diligent when submitting your tax returns for 2016 – phishing emails that look like they’ve come from HMRC are viral at the moment) publically announced their breaches in the UK and the world, they had no choice.

‘EU Data protection regulation’ is to come into effect therefore companies are now working towards developing a security improvement programme with artefacts, identifying that if company X were to have a breach they have safeguarding measures in place and are confidently protecting the company, employees and most importantly the brand.

EU General Data Protection Regulation Draft – here are some highlights

• Applicability to EU citizens’ personal data (even if such data is processed outside of the EU);
• Explicit informed consent required to be given by data subjects to any entity that processes or analyzes personal data, with the ability to easily withdraw such consent (this could be particularly onerous and expensive to implement in connection with the entity’s employees);
• Right to compensation for monetary damages in the event that unlawful data processing occurs;
• Imposition of fines as high as 1 million Euros, or two percent of a company’s “total worldwide annual turnover of the preceding financial year” (in particular cases), for non-compliance;
• Mandatory risk assessments and in-house data protection officers for larger companies; and
• In the context of cloud-based systems, direct accountability and reporting requirements for every person or entity that is part of the cloud “supply chain”.

The beginning of 2016 has begun with a vengeance, ‘Juniper Networks’ have come forward to advise that their ‘NetScreen line of firewalls contained unauthorized code that can surreptitiously decrypt traffic sent through virtual private networks’

The trend will continue with more sinister and sophisticated threats throughout 2016 discussed by Wired.Com such as ‘Data Manipulation’,’Extortion Hacks’ and more ‘Backdoors’.

The EU GDPR will not be effective until Spring 2016 however 4/5 months ain’t a long time.

‘Prevention Is Better Than Cure’

Jonathan Posner

Cyber Security Enterprise Account Manager

Caretower

 

Creative Questioning Encourages Differentiation

 

10 years ago I was working for an American Information Security vendor which was on an aggressive path to merge and grow through acquisition to become leaders within their vertical.

4,000 employees attended a symposium in Nashville, Tennessee for a 4 day jam packed event.

Two CEO’s came to the stage to make the keynote address – they presented jointly that a Joint Venture ‘JV’ between their two companies was to be announced and it will rock the industry.

They presented us with the Why, How, What, When and Who, selling us their unique proposition and how it was going to cause major disruption but be all things wonderful.

BUT ‘Disruption’ then had a different meaning to what we all now understand to be ‘Disruptive’.

Within 10 years the company had disrupted the market  with a negative affect, which led the two companies to demarcate from one another and become two separate businesses once again.

The customers went through a similar journey to the work force, I hasten to add.  There were many casualties and to the detriment of this exciting so called JV it all went due south, mainly destroying the clients’ confidence who as a result walked away.

My employer might have used a creative questioning technique when they evaluated the proposed JV, and that is to be applauded.  However, I don’t believe they kept their clients  at the forefront of their thinking.

The cost of customer acquisition is very high, but more even valuable is their loyalty, so be cautious not to ruin that.

Openness and transparency is the best approach (Top Tip), be willing to invite your clients and customers into your internal dialogues and thought leadership conversations, they will 99.999% of the time add invaluable feedback to help you make a final decision.

Jonathan Posner