Posts in category: Cybersecurity

Everything was Once New

A new bit of software is released. It’s sparkling, it’s fun, it’s revolutionary. Everyone loves it and starts using it. Or, perhaps the new thing is an IoT device which lets you monitor the air quality of your office. In order to survive in today’s marketplace (read: make the company money), products get pushed onto shelves to be sold often times before they are fully functional and secure. Because of this rush, most software and software-based products are flawed at the time you purchase them. It’s important to apply patches and updates to software when released.

You know the drill: you get your brand-new cognition amplifier home and what’s the first thing you do after you turn it on and connect it to Wi-Fi? That’s right, you search for (and normally install) updates. Many people think that’s the only maintenance they need to do, but it’s not. Just like a flower in a pot. It will look nice as soon as you get it home, but if you think you can just leave it and it will always look nice, you are wrong. You need to care for it and provide what it needs, or it will get sick. Just like your devices and software.

“Data is moving in and out of hospitals very freely and they’re very unsegmented. We have customers who are still using Windows 95. That’s insane … And we’ve been told that, since they’re saving lives 24/7, they never patch. They’re afraid of rebooting the system or messing it up.” – Chris Morales, Head of Security Analytics at Vectra

What Can Go Wrong?

But what really can go wrong if you don’t update your stuff? Can it really be that bad? You might just be missing out on some new features, right? Let’s explore some recent update and patch news:

• Hackers could exploit a critical flaw in Qualcomm chips and access the protected memory (and sensitive data) of millions of Android devices. This was fixed in a patch.
• A pair of security vulnerabilities were discovered in Social Warfare (a WordPress plugin with over 900,000 users) which would let hackers “take complete control over websites and servers without authentication.” This was fixed in a patch.
• Two security vulnerabilities were discovered in Dell’s SupportAssist Client. These would have allowed attackers to remotely execute code, which could be disastrous for the computer and network. This was fixed in a patch.

These examples provide insight into potential security breaches on a massive scale that were all fixed with a patch. You don’t want to install some weather-checking software or an IoT thermostat and have it serve as a doorway outsiders can exploit to compromise your systems, steal your data, and destroy the credibility of your users and organization. And software/IoT device companies don’t want to get in the news as being the cause for such a compromise and feeling the wrath of litigation, bad press, and governmental fines rain down upon them.

All the above stories have one thing in common (other than the scale and potential damage the flaws could have inflicted): every vulnerability was fixed with a patch. This is what responsible software and software-reliant hardware companies do—they monitor and patch and update to make their product the safest and best it can be.

This is something you should think about and investigate when selecting software and hardware options. See if the company has frequent updates or patches. Make sure they are continuing to support their product and make it secure. Otherwise, you could put a lot of faith in a product that will just leave you exposed to those who wish to do you harm.

A Final Word on Patches and Updates

It’s not just for your own organization’s security that you want to keep your software and hardware updated and patched. Between GDPR regulations (where organizations can be fined up to 4% of their annual income or €20 million, whichever’s greater)  and the new Binding Operational Directive from CISA ((BOD) 19-02) setting a deadline for updating any and all systems when a patch is available (15 days for “critical” vulnerabilities and 30 days for “high”-severity flaws), pressure is on from national and international institutions to protect your systems. Like herd immunity for viruses and diseases, the world has seen the importance of all organizations keeping their software updated.

It does take a little time but make it part of standard operating procedure and get it on a schedule. Find the best time for updates to take place for your organization and make sure they are never missed. Your organization’s cybersecurity will thank you.

To learn more how we make sure our solutions stay updated and our customers are alerted any time a new update or patch is released, contact us today.

“It’s not reality unless it’s shared.” – Pete Blaber, The Mission, the Men, and Me

Information Sharing is Key

Information that just exists has almost no value. Only when information is analyzed and acted upon does it become meaningful and valuable. Information has built the world around us, and many of our most important advancements have been due to the sharing of information. In today’s hyper-connected world, where information is a valuable commodity, sharing the wrong information with the wrong people is disastrous, especially when that information is important for national security. Information sharing is inevetable, but ensuring the right security is behind it is where the focus should be.

This is why, in six of the seven objectives of the 2019 National Intelligence Strategy, controlling the sharing of information is mentioned in one form or another. Sometimes the sharing is within the Intelligence Community (IC), but quite often it is sharing with external partners. In its simplest form, external partners fall into two categories: trusted and untrusted. Trusted partners include other agencies, institutions, or organizations within our borders or those of our allies. Untrusted partners would be those same groups but in countries who are not yet our allies, or not as close as other allies, plus individual sources and informants. To make matters even more complicated, sometimes our trusted partners are in untrusted environments or the partnership is only for a single mission. So, sharing information isn’t as easy or safe as it sounds, but it can be . . . with Fognigma.

“[C]ritical decision making data will be made available through modem cloud networking, access control, and cross domain solutions to those who require access.” – Department of Defense Cloud Strategy

Fognigma Protects Sharing within Agencies

When Agency A collaborates with Agency B, data needs to flow back and forth in a safe and secure manner. But (and this is a really big but), it has to be tightly controlled so as to share only the information intended. That is, it can’t be everything Agency A and B know, but just those bits of information applicable to the mission at hand. This is the exact reason we call Fognigma’s traceless and encrypted networks Mission Partner Networks (MPNs).

But first, a little background. Fognigma’s patented enterprise software creates networks using strategically leased virtual machines (VMs) spread out over one or more cloud service providers. These VMs work together, forming one network that is wrapped in FIPS 140-2 validated, cascading AES-256 encryption. MPNs are as persistent or temporary as needed, created manually or on a schedule for optimum cybersecurity and conservation of resources.

Now back to the MPN name, itself. When multiple agencies need to work together, they create an MPN and tailor it to their needs. Inside the MPN, they’ll have access to communication tools (such as traceless phones, secure chat messaging, and encrypted video conferencing) and protected file share.

The key here is that MPNs are brand new networks that are created when agencies need to work together. Resources and components inside the MPN can be shared between agencies and agents on a granularly controlled “as needed” basis. And then, when the mission has concluded, the MPNs are destroyed leaving no trace the networks (and, equally important, the collaboration between agencies) ever existed. This temporary nature of the MPN makes it supremely difficult to discover, which makes its protected data even more secure.

“6,515 breaches were reported [in 2018,] exposing approximately 5 billion records.” – 2018 Data Breach QuickView Report

Fognigma Protects Sharing in Untrusted Locales and with Untrusted Locals

Often on missions agents must venture into untrusted or unsecured territories—places where communicating over the public infrastructure is almost synonymous with handing third parties access to your communications (i.e., interception is a given). When using Fognigma in these scenarios, agents use any device to connect to their agency’s MPN. Once connected and inside their MPN, any data shared is encrypted and invisible to outside eyes and ears.

Information sharing with untrusted assets, such as informants or other sources, is also safer using a variety of Fognigma tools. If such an informant wants to deliver documents and photos, for example, a special link is created that allows the informant to transfer the information without being able to access anything else on the network. It’s like inviting someone into a bare room with no windows where they can store things, but there isn’t anything for them to look at or take and the only door is the one through which they entered. Containerized, for your protection.

Fognigma’s telephony solutions provide two methods of safeguarding information over the phone: encrypted VoIP over cellular infrastructure and misattributed calling. Both methods assist communications to and from untrusted locations and assets. Organizations can create entire VoIP phone networks (complete with extensions and customized inbound and outbound numbers) for end-to-end protected calls. Misattributed calling is accomplished by creating a call chain where phone calls pass through two intermediary numbers which completely dissociates the end users and makes calls appear to be coming or going from local numbers, instead of to or from the agency itself.

“To improve cybersecurity in the United States through enhanced sharing of information about cybersecurity threats, and for other purposes.” – Senate Bill S.754

Fognigma Protects Sharing with Global Allies

In a world where information is constantly flowing and each day brings new stories of massive data breaches, it’s more important than ever to protect data. When data is traveling between agencies or beyond our country’s borders, safeguarding it becomes crucial (often quite literally a “life or death” undertaking). Whether it’s being shared with the Five Eyes alliance (Australia, Britain, Canada, New Zealand, and the US) or any other countries we’re partnering with, international info sharing must be protected. And not just protected, but also dissociated, as global diplomacy is a precarious (at best) balancing act of working together and putting one’s own best interests first.

As illustrated in the previous sections, Fognigma is ready, willing, and able to assist international information sharing with leading-edge and patented technology, while insuring that information remains secure. Fognigma is also constantly evolving—adding more features and technologies to provide agencies the most secure communications and collaboration tools possible.

For more information on how Fognigma can assist your agency with info sharing and safeguarding, contact Dexter Edward today.

Be Afraid of These Ghosts

A whisper in an empty office; files moving without anyone there; the eyes of a portrait following you as you pass. Your office has ghosts. Not spectral hauntings that spew ectoplasm, but ghost accounts which haunt your organization’s cybersecurity. Ghost accounts are accounts which have credentials even though there are no longer any active users associated with them. To those attempting to exploit, ghost accounts are like extra doors on the outside of a building: each one is potential way into your network. Once inside, there’s no telling what things heinous exploiters will exfiltrate. Bad is a ghost account only giving an evil third-party entry into your organization; catastrophic is a ghost account which still has access to various file shares, data, and other protected parts of your network.

‘But where do these ghost accounts come from?’ you wonder. Well, large organizations have a large number of users. That seems silly to mention, but it is important to spell out. By having a large number of users, quite often adding and removing user credentials take time. Well, to be honest, an organization needs to get the new user up and running as fast as possible, so those credentials and the access they entail are normally set up quite quickly. But when a user leaves an organization (either honorably or dishonorably), often the removal of those credentials is pushed to some later date or merely forgotten. And then your organization becomes a haunted house.

Ghost (Account) Busters

We’ve already written a bunch about Identity & Access Management (IAM) — the process of defining an employee’s role in the company as detailed as possible and then giving them exactly the access they need to do their job (no more, no less). IAM is extremely important for an organization’s internal security when new users are added, but it is equally as important when they leave. IAM strategies need to include the deletion of users and not just the creation. It’s second nature to make sure a departing employee gives back the keys to the office, so should it be to terminate their keys to connecting to your organization’s network.

But as said before, there always seems time to help a new employee settle in, but never any time once they leave, normally because you’re preoccupied with on-boarding their replacement. And this problem compounds itself if more than one worker is leaving at the same time. All is not lost, however. Fognigma is here to not only protect your network, not only bolster your cybersecurity with leading-edge technology, but also to let you automate a little more than you thought you could.

Fognigma & Active Directory Make It Easy

Many companies use Active Directory to manage all their employees. Fognigma integrates with Active Directory to make IAM even easier. Just as Fognigma’s invisible and encrypted networks and communications help protect an organization, so can teaming it up with Active Directory.  Since Active Directory administrators already have their employees entered in, it would be silly to have them redo all that work when they add the leading-edge tech of Fognigma to their cybersecurity arsenal. That’s why Fognigma can import Active Directory users right into its console!

Active Directory is engaged to activate and deactivate the user. Fognigma, on the other hand, is where admins put users into all the groups they need to do their job. (A Fognigma network has its construction and components microsegmented, with access to each part given only to a specified group. Being in a group, then determines the amount of access a user has to Fognigma capabilities, such as file share, telephony, VDI, etc.) This means the setup of a user when on-boarding is just as easy as it always has been: create user and add permissions.

The brilliance comes when it’s time to say goodbye to a user. When that day arrives, all an admin has to do is deactivate the user in Active Directory. Active Directory then tells Fognigma about the deactivation, Fognigma deactivates the user in every group they were a part of, and the user instantly has all their access revoked at once. Fognigma and Active Directory easily eliminate the risk of ghost accounts haunting your network.

To learn more about how Fognigma, contact us today.