Cavirin Blog

We’re excited to wrap up and announce our Winter 2019 release!

Customers will benefit from closed-loop security, which unlike siloed approaches to proactive and reactive security, assesses the impact of alerts related to new, deleted or changed resources from AWS CloudTrail and Google StackDriver Monitoring using CyberPosture scoring to prioritize infrastructure changes based on their risk. As part of closed loop GCP security, a Cavirin-developed Google Function watches Google StackDriver Monitoring for events related to the creation, deletion and changes to specific Google resource types. As these changes accumulate beyond a certain threshold, Cavirin triggers an assessment of your GCP account. This results in CyberPosture scores for affected resources which in turn helps create a remediation plan sorted based on improvement to security posture. A similar (alert -> threshold trips -> assess -> score) blueprint applies to AWS resources based on AWS Lambda Functions and AWS CloudTrail events.

Next, prioritized security gaps can be auto-remediated using AWS Lambda and Google Functions, as applicable. As the figure below shows, the remediation blueprint for Google comprises of a Google Function that watches for remediation requests from the Cavirin server on a GCP PubSub topic. As the Google Function remediates security gaps, the Cavirin server processes the remediation confirmations as another set of changes to your environment. As before, as changes accumulate beyond a threshold, an assessment is triggered, resulting in updated and improved CyberPosture scores. A similar remediation blueprint applies to AWS.

Extending closed loop security to operating systems resources, the Winter 2019 release also offers Ansible integration to streamline the hardening of operating systems powering compute instances. Cavirin periodically assesses all instances, checking for drift against a known baseline and recommending and carrying out remediation through Ansible to re-establish the instances’ golden posture. As the figure below shows, as we assess OS resources for policy packs like CIS and generate Ansible artifacts, in particular a variables file (list of failed policies to remediate) and a hosts file (list of Ansible-managed resources that require remediation), which when applied with the Ansible playbook for the given policy pack results in a return to the golden posture.

Compliance and security professionals struggle with translating regulatory requirements and industry standards to automated technical controls – spreadsheets and manual mapping processes are the state of the art. While organizations like UCF have provided a universal/canonical representation of regulatory requirements, gaps still remain with respect to mapping requirements to technical controls with quantitative inputs that can drive risk scoring and security analytics.  Cavirin’s Winter 2019 release is the first to apply machine learning to recommend technical controls for industry standards (e.g. NIST 800-171) and regulatory frameworks (e.g HIPAA) with associated weights and severities which in turn drives the ability for customers to drive compliance based on risk, using Cavirin’s CyberPosture scores. Machine Learning ensures consistency of mapping and the resulting weights and severity. This further improves the efficacy of CyberPosture scoring and resulting remediation guidance.

Announced earlier, we now feed security findings for resources in a customer’s Google Cloud Platform into Google Cloud Security Command Center, which unifies security finds from a select group of Google Cloud partners. To leverage this feature, be sure to check out Cavirin Cloud SCC Companion and Cavirin CyberPosture Intelligence on the Google Cloud Marketplace!

Reporting enhancements: A new change reports feature offers the ability to compare the latest assessments against the previous one enabling users to quickly gauge the effectiveness of change management. A new reporting service for RSA-Archer permits management of Cavirin-reported compliance posture gaps through an organization’s existing GRC platform. 

Enhanced connectivity through Bastion and proxy hosts: Network segmentation and isolation are important best practices. With the Winter release, customers can isolate compute instances behind bastions and proxy hosts while allowing Cavirin to discover and assess these assets.  

Other new capabilities include additional OS scanning support, including for Amazon Linux 2, SUSE Linux 11/12 and Ubuntu 18.04.

Details

Written by David Ginsburg

Category: CyberPosture

Our Rush to Automate Our Cites 

In “The ‘Too-Smart’ Home – Uninvited Guests,” I look at unintentional threats due to insecure internet-connected devices. Do we face some of the same issues with our rush to automate our smart cities, where spending is expected to grow from $80 billion in 2018 to over $158 billion by 2021? As reported numerous times over the past year, the answer is a resounding yes, with Industrial Internet of Things (IIoT) devices harboring an unknown number of vulnerabilities. The New York Times even recently reported on the potential threat, citing that cities, in the rush to publicize their ‘smart creds’, many times don’t understand the privacy, security, and financial implications of their deployments. These deployments are many times proposed by technology vendors, not always taking into account the readiness of the city to properly manage them. However, not all is lost!

Attack Vectors

As with the home, it is not only the infrastructure that may be compromised, but the data gathered as well.  But in contrast with the home, both outcomes may be much more damaging, if not fatal.  One good measure of potential vulnerabilities is to map a typical smart city to the 16 DHS critical infrastructure sectors. 

Relevant areas of concern include communications, emergency services, government, and commercial facilities, information technology, transportation systems, water and wastewater, and in many cases, energy, healthcare, and dams. Instead of each of these separately managed and secured, under a smart city initiative, one or more may very well be under the control of a single, interconnected operations platform, where a single breach may impact multiple sectors simultaneously.  Highlighting concerns, a recent ISACA survey identified energy, communications, and transportation as the three sectors (71%/70%/64%) that will benefit most from a smart cities initiative but are also the most susceptible to breach.

Attacks can come from multiple sources, including malware/ransomware as well as denial of service, with both nation-states (67%) and hacktivists (63%) likely culprits.  And, with more smart infrastructures in place, hackers have a larger attack surface, with pre-existing vulnerabilities more likely to be found and exploited.  Research from Threatcare and IBM X-Force Red, lends credence to this, having uncovered multiple zero-day vulnerabilities across different IIoT vendors. Security gaps identified include the use of default passwords, authentication bypass flaws, SQL injection vulnerabilities, and even open ports where control is possible from across the internet.  And the threat has only increased, with a recent Gemalto study finding that almost half of all businesses can’t detect if an IoT device has been breached.  There are even websites such as Censys and Shodan (among others) that make an attempt at tracking IoT devices.  And, more sophisticated attacks could take place against RF-controlled devices that may find their way into smart city architectures.  For example, Trend Micro recently identified security gaps in many commercial products, vulnerable from hardware-based rogue RF controller man-in-the-middle attacks.

The Threat Landscape

Moving from the general to the more specific, what are the types of IIoT devices one may encounter, and what specific actions are most effective and that one or more of the sectors described earlier?

From Iibelium
 

From:  Rambus

Solutions 

One way to look at a solution is to first consider a set of universal security hygiene actions, and then look at specific requirements sector-by-sector.  An analysis by Microsoft looked at the properties of highly secure devices, and came up with the following recommendations:

From: Microsoft Research, The Seven Properties of Highly Secure Devices

IBM’s recommendations, based on the identified vulnerabilities described earlier, and more focused on software and processes, include: 

• Implementing IP address restrictions for who can connect to the smart city devices, especially if networks rely on the public internet.
• Leveraging basic application scanning tools that can help identify vulnerabilities.
• Using strong network security rules to prevent access to sensitive systems, as well as safer password practices.
• Disabling unnecessary remote administration features and ports.
• Taking advantage of security incident and event management tools to scan network activity and identify suspicious internet traffic.
• Hiring ethical hackers to test systems, such as IBM X-Force Red. These teams are trained to “think like a hacker” and find flaws in systems before the bad guys do.

From:  IBM, The Dangers of Smart City Hacking

And remember that these recommendations also apply to 3^rd parties, an environment known to be especially vulnerable, and one where a breach may lead to disastrous consequences in the context of a smart city.  

In essence, develop a comprehensive architecture for proposed smart city services and applications, planning head vs creating a bolt-on architecture where every new sector becomes an exception or custom integration.  This planning is also critical in defining a least-privilege architecture where only those systems that must communicate with one another are actually able to do so.  Sure, a single screen depicting power, water, and roadways may look good and not disappoint Hollywood, but this may not be the most secure implementation. As with enterprises, leverage best practices such as the NIST-CSF, CIS, SOC2, and others, as a baseline to evaluate one’s security posture. 

To draw an analogy from the public cloud, the cities and their vendors share responsibility for the secure deployment, operation, and updates of any hardware and software deployed.  And, as opposed to deployments where detailed lifecycle security plan may be a ‘nice-to-have,’ here it is critical.  This is doubly true for devices whose data is made available to the public-at-large, such as the City of Santa Clara, CA traffic cameras.  In support of this, the government will step in to push the industry along, as with California’s recent IoT legislation.  Though only a beginning and not by any means comprehensive, it does imply that IIoT security has gained awareness.

Divergent Views – The East and the West

 Are there different priorities and approaches between smart city deployments in London and Shanghai, for example?  The answer is yes.  Though much of the technology will be the same, approaches to individual privacy differ.  There is less reluctance to gather PII from multiple sources and then correlate it, and many of the views track debates concerning just how to open the internet should be and to what data citizens should have access.  Already, many deployments include facial recognition to target individuals, and these use cases are spreading to the US.  On the positive side, there is probably a greater emphasis on centrally planning and securing any deployment.

The Future

As I noted earlier, there is still time to properly secure the IIoT with many of the suggestions listed above.  Looking to the future, a few initiatives are in play to better secure the various devices deployed.  As an example, the major public cloud providers, with their interests in the IoT space, have proposed and deployed architectures to better secure their services and devices.  Examples include Google’s Titan, Microsoft Azure Sphere/Pluton, and AWS’s IoT Device Defender.   One would hope that the various players reach consensus on a single, interoperable approach, but in any case, it will take years for these more secure devices to be deployed, and existing devices will still present vulnerabilities.

Check out our Leveraging NIST CSF Playbook, for more information on securing our critical infrastructure. 

Details

Written by David Ginsburg

Category: Trending in Security

• CIS Benchmarks
• CISO
• Cybersecurity
• Data Security
• NIST CSF
• Critical Infrastructure Security

Voluntary Cybersecurity Practices for the Healthcare Industry

Just after the new year, the US Dept of Health and Human Services (HHS) released updated guidance to help healthcare organizations protect themselves against a cyber attack.  This guidance is not only timely, but essential given the continued escalation of attacks against healthcare environments--attacks that are becoming more complex, including DDoS, ransomware, and those against connected devices.   As they say, thieves go where the money is, and the typical healthcare record is worth $100 , 10x more than those across other verticals such as financial records.   The cost of a breach is just as impactful, with a loss of over $400 per record compromised.

 Organizations of all sizes, but especially smaller ones that may not have deep IT expertise, will, therefore, benefit from this guidance. 

The overall intent of the guidance is a:

• Cost-effectively reduce cybersecurity risks for a range of health care organizations;
• Support the voluntary adoption and implementation of its recommendations; and
• Ensure, on an ongoing basis that content is actionable, practical, and relevant to health care stakeholders of every size and resource level.

Note that these are great goals for any vertical!

Resulting from the 2015 Cybersecurity Act (CSA), the guidance, Health Industry Cybersecurity Practices:  Managing Threats and Protecting Patients, aligns closely with the NIST CSF, a set of best practices that Cavirin embraces and supports.  The five threats explored in this document are as follows:

• E-mail phishing attacks
• Ransomware attacks
• Loss or theft of equipment or data
• Insider, accidental or intentional data loss
• Attacks against connected medical devices that may affect patient safety

The two technical HHS volumes, Cybersecurity Practices for Medium and Large Health Care Organizations, and Cybersecurity Practices for Small Health Care Organizations go into much greater detail and the 
Managing Threats and Protecting Patients Resource and Template document maps the best practices to specific NIST identifiers.  

Best practices for threat mitigation fall into ten areas: E-mail protection systems Endpoint protection systems Access management Data protection and loss prevention Asset management Network management Vulnerability management Incident response Medical device security Cybersecurity policies

Check out the Cavirin NIST CSF Playbook, where we outline the mapping between the NIST CSF and healthcare-specific standards and best practices such as HIPAA and IEC/TR 80001-2-2 similar to what the HSS recommends here.  Cavirin's healthcare solution supports the NIST CSF, HIPAA technical controls as well as the AWS HIPAA Quickstart, and the ability to customize frameworks based on specific business requirements including the CIA (Criticality, Impact, Availability) for specific controls so that healthcare organizations can automate compliance to achieve and maintain their golden cybersecurity posture just as Pacific Dental Services, Cepheid, and a large national healthcare partner have done.

Details

Written by David Ginsburg

Category: Trending in Security

• Cloud Security
• Hybrid-Infrastructure
• Cybersecurity
• hipaa
• healthcare
• multi-cloud

Plus Other Cloud Security Predictions for 2019

Well, 2018 is almost behind us, (sigh!) and we see 2019 as a watershed moment in hybrid and multi-cloud adoption. Organizations, maybe yours included, are increasingly comfortable in running critical workloads across multiple environments as long as they can maintain visibility and control. And, the major public cloud providers have embraced hybrid deployments with products that streamline adoption, such as Microsoft’s Azure Stack and the just-announced AWS Outposts. But we still have a long way to go. For example, how do you best secure these more complex deployments?

At Cavirin, we’ve supported and embraced the hybrid cloud from our earliest days. We offer security monitoring and remediation via CloudTrail and Lambda Functions for AWS, as well as the equivalent StackDriver and Functions on Google Cloud. The same capabilities are shortly coming to Azure. Across all three clouds, CIS hardening and network policy checks are available today. Increasingly, the public cloud providers are combining their own security offerings with those of their cloud partners, offering their customers better control. We recently announced Google Cloud Security Command Center integration--a good example of this trend.

Not to ignore the workloads, remember once again that under the cloud provider shared responsibility model, AWS, Azure, and Google Cloud secure the services they offer ‘in the cloud,’ but the customer takes over for their ‘on the cloud’ applications and data. Our new Ansible Playbooks, in combination with our continuous assessment, permits the operator to first create ‘golden images’ based on their risk profile, and then track any deployments for drift and immediately invoke corrective actions if required.

So, what are some specific predictions for 2019? Here’s a selection from our input to various publications:

• Cloud 2.0: Security, especially across multi-cloud and in combination with on-premise, will continue to be top of mind. Additional awareness of both insider and external threats will be combined with effective tools that balance protection and usability. More CISOs will peer with CIOs as opposed to reporting to them. Further, mainstream enterprises will look beyond just getting their apps to work in the cloud. They will move to the next phase of optimizing performance, manageability, and security as part of a true multi-cloud deployment, where they have critical workloads both on-premise as well as within one or more public clouds. Smaller enterprises, with an awareness of cloud risks, will deploy third-party cloud security software.
• Mind the Gap: Too often, SecOps or SIEM tools report on issues, but follow-up by DevOps is delayed. For security, this can result in major risks. We’ll see a wider deployment of tools that close the loop from this monitoring to change management, helping to automate many processes that require manual intervention. An example could be monitoring one’s hybrid infrastructure for change in security posture, automatically triggering Ansible Playbooks to correct to the known good baseline.
• DevSecOps Becomes Real: On the back of DevOps and SecOps, many now understand the concept behind DevSecOps. But, that has happened, is that this is still pushback on how to best automate checks, and how to protect against potential job loss. This is solvable with some of the new approaches on the market, and through past technology and role transitions, job loss was never as high as anticipated.
• Elevating the Importance of Cybersecurity: Business executives will embrace cybersecurity as a primary business responsibility, and not simply a technology issue. This will be combined with new state and potentially federal laws that improve privacy and reduce exposure. These shifts parallel trends internal to the organization, where technologies are increasingly vendor-managed and IT moves to the business units. The overall move to the cloud is only one example of this. Conversely, cyber and information security, due to importance, will transition from a technology function to a legal function.
• ML and AI Reality Check: No set of predictions would be complete without homage to AI. There is no shortage of investment in this space, and startups with novel ideas. The goal will be to better understand how these technologies solve well-understood problems, how they integrate with existing workflows, and most importantly, how they remove risk. This all can’t happen soon, given that the hackers, especially those state-sponsored, are deploying many of the same tools. As noted in BlackHat this past summer, 2019 is the year that the industry must go back on the offensive.

Check out our News page for links to all the articles our leaders were featured in during 2018. 

Details

Written by David Ginsburg

Category: Trending in Security

• Cloud Security
• Hybrid-Infrastructure
• Cybersecurity
• hybrid cloud
• DevSecOps
• multi-cloud

Minimize Risks Due to Change Management Delays 

As DevOps leaders continue to deliver greater agility to the business, SecOps is faced with a widening security gap needing more time to manually work through change requests that ensure appropriate testing is achieved taking into account risk, security, and compliance. This whitepaper is for those looking to minimize the risks due to change management delays and manual processes. It highlights how Cavirin auto-remediates both compute instances and cloud services to minimize the security gap between SecOps and DevOps.

AUTO-REMEDIATE TO MINIMIZE RISKS DUE TO CHANGE MANAGEMENT DELAYS 

Many organizations separate security posture monitoring from change management, leaving them exposed when security alerts monitored by SecOps teams wait for DevOps teams for remediation. Closing this security gap via auto-remediation is a key outcome enabled by Cavirin. In this document, we discuss how Cavirin auto-remediates both compute instances and cloud services, starting with a chart that highlights an organization with and without auto-remediation. 

AUTO-REMEDIATION APPROACH LEVERAGING ANSIBLE 

For compute instances, Configuration Management systems like Puppet Enterprise, Chef Automate, or Red Hat Ansible offer a good foundation. Their cloud counterparts include Microsoft Azure Automation as well as the AWS Elastic Compute Cloud Systems Manager. Cavirin’s approach, below, leverages Ansible to remediate compute instances in AWS, GCP, Azure or on-premise environments. 

First, a SecOps user using the Cavirin system defines a “golden configuration” of operating system parameters for a group of machines using Cavirin’s technical controls (CIS, in the figure below). The system continually assesses the organization’s machines against “golden” technical controls and identifies those assets drifting from it (Step 2 in the figure below). 

Next, the Cavirin system creates the list of drifting machines (“host file”) as well as a list of configuration settings (“variables file”) that require remediation in Ansible’s format. Finally, the Ansible server retrieves the Ansible hosts file, variables file and the Cavirin-supplied Ansible playbook to remediate machines to the golden state. 

The same approach can also be used to create ‘golden’ images during pre-production by assessing candidate images against a golden posture and involving Ansible with Cavirin playbooks to remediate images to a golden state. 

Moving from compute instances to cloud services, here we can use the monitoring, queuing, and remediation services provided by public clouds. Options for remediation include AWS Lambda, Azure Functions and Google Functions. Cavirin monitors cloud services via provider APIs and assessing them for various technical controls. The system then develops a list of the top resources for remediation, and then executes the provider-specific functions. 

Using AWS as an example, Cavirin, via its AWS Network Policy Pack, periodically assesses the status of commonly used TCP ports associated with the Security Groups created within a given AWS account. It then informs the operator of the top 50 ports, which if remediated will positively impact the score (see Figure below). 

Technically, in the figure below, 

1. The operator issues the remediation command from the Cavirin dashboard 
2. Which publishes a remediation request to an AWS SNS topic 
3. …that then invokes the Cavirin-authored Lambda function 
4. Remediation occurs and confirmation is now posted to Cavirin via SQS 
5. Cavirin takes this confirmation and modifies the scoring accordingly 

To summarize, auto-remediating compute instances and cloud services as described in the article can help organizations accelerate responses to security gaps, reduce security risks, and eliminate manual processes. 

Details

Written by Bashyam Anant

Category: CyberPosture

Excellent Hybrid Cloud Environment with Real-time Visibility

We are excited to announce that this week Cavirin’s CyberPosture Intelligence for the Hybrid Cloud was recognized by SC Magazine. The Cavirin solution earned five-star marks (the highest rating) in all six review categories: Features, Documentation, Value for Money, Performance, Support, and Ease of Use.

The SC Magazine five-star rating is especially gratifying as it is based on an objective evaluation of features and capabilities.  Leading the charge, the reviewers thought that one of the most prominent features was Cavirin’s nonpareil CyberPosture Score.  

According to Cavirin’s Director of Product Management, the CyberPosture Score is derived by continuously assessing the security posture of all managed cloud services and workloads to compute a CyberPosture score, a number between 0 and 100. A score of 100 represents the least risk. Representing risk in this manner facilitates prioritized response plans and in-depth security analytics including score drill downs from the company level to asset groups, individual resources, policy pack/control families and operating systems. At any of these levels, with visibility that spans your entire hybrid infrastructure, Cavirin’s solution depicts trends of CyberPosture scores to help CISOs assess the impact of security posture improvements.

In addition, SC Labs evaluators Matthew Hreben & Katelyn Dunn highlighted the importance of a single, unified view, emphasizing that “point” security solutions can be costly and have limited visibility into an organization’s defensive security posture:

“Users typically struggle building a meaningful risk security assessment process across a hybrid environment due to the lack of network visibility and the cost of needing multiple products. Cavirin CyberPosture Intelligence for the Hybrid Cloud serves as a single, unified view of the hybrid cloud environment that gives real-time, continuous monitoring and assessment, has automatic asset discovery and encompasses an API-first architecture that integrates security into DevOps. It enables continuous improvement of security posture and is cost-effective compared to alternatives requiring multiple products.”

In closing, the verdict of the SC Magazine analysts on Cavirin’s CyberPosture Intelligence for the Hybrid Cloud is:

“Great API-driven technology that integrates with Slack, Jira and Okta for SSO, also provides users concrete documentation and workflow suggestions. This is a strong contender in its space and worth a look.”

 To read the complete review visit, scmagazine.com

 For more information on Cavirin’s CyberPosture Score check out our latest whitepaper:  Cavirin CyberPosture - Your Credit Score for Security.

Details

Written by Rosella Fernandez

Category: Risk Management & Analytics

• Cloud Security
• Cybersecurity
• CyberPosture
• RiskManagemet
• SC Magazine