NOWHERETOHIDE.ORG

Hope is not a cybersecurity strategy

Take the time now to assess your enterprise cyber risk and discover where best to invest for the best defense!

Since 2013, there have been 169 cyber attacks against city/state government agencies; 22 so far this year. Of the 169, 45 targeted law enforcement

In a recent cybersecurity conference I attended, CISO panelists were asked for their #1 cybersecurity issue. Surprisingly, their answers was NOT better cyber security tools, more cybersecurity staff (that was their second priority), or more cyber intelligence.

Their #1 answer?

More action by executives and boards of directors to do what needs to be done to help better protect their cyber assets.

Now, to be fair to those executives (public and private sector), “cyber” is just one of numerous front-burner issues they must deal with, and unfortunately taking the time to learn about and effectively address cyber risks doesn’t always make the cut – until their agency/company is attacked.

I refer to this the “911 effect“…Terrorism was a problem on September 10th; however, it took the horrific events of September 11th to get the attention and investment that others, like FBI SA John O’Neil* and others knew it desperately needed.

So, as an executive, how can you avoid the “Cyber 911 Effect” for your agency? I offer three steps:

1. Elevate cyber risk as a priority at the executive/board level and do the work needed to better understand what your organization’s cyber risk really is;
2. Conduct an enterprise-wide cyber security assessment to become informed for how your current cybersecurity behaviors and investments stack-up to your inherent risk; and
3. Implement a program of continuous risk monitoring and mitigation to build stronger cybersecurity maturity against the threats you face.

What? You say you don’t have the time or funds to do these three things? Well the truth is that it’s going to cost you a LOT more time and money if you do get attacked and you don’t do them…a few examples:

• Albany, NY – city services and police department impacted, cost not yet known
• Atlanta, GA – city services impacted; estimates vary, $5,000,000 and $17,000,000
• Baltimore, MD – weeks with many city services offline; $18,000,000 recovery estimated
• FBI National Academy – websites breached, stolen PII of thousands of LEOs exposed
• FEMA – personal information on 2.5 million disaster victims exposed by subcontractor
• Indiana – health information of >31,000 patients exposed
• Massachusetts – attack shuts down parts of Public Defender Agency
• Oklahoma – millions of government files exposed, some pertinent to FBI investigations
• Riverside, TX – 10 months of police/fire department files affected

While I’d love you to call me in (410-903-6289) to help you get it done, there are many good cyber risk assessment offerings out there. Whichever way you go, take the time and make the investment now (less than $10k) and just do it.

To learn more about my cyber risk assessment offering, please read this posting: https://www.linkedin.com/pulse/nowheretohide-now-offering-enterprise-cyber-security-risk-georgo/

Thank you…r/Chuck

* Note: John O’Neil died in the September 11, 2001 attacks on the WTC, 2001. Believe it or not, it was his first day on the job as the Chief Security Officer for the WTC compound. You can read more about him in the book Securing the City.

NOWHERETOHIDE to launch innovative Cyber Assessment Services

NOWHERETOHIDE is pleased to announce it will soon be launching an innovative and comprehensive Cyber Assessment Service offering.

Public and private sector organizations will be able to either have NOWHERETOHIDE perform an enterprise wide Cyber Assessment for them, or they will be able to subscribe to the award winning and innovative CyberPrism Cyber Assessment Tool (CAT) being offered as a SaaS application.

Use this “Contact Us” link to find out more.

Cyber Risk International recently held an executive briefing for US and European CIOs entitled Empowering the CIO with Cyber Security;  here’s a short video capturing the briefing and the post-event networking session:

2019 IJIS presentation – Using PBD to reduce your attack surface

Thank you to everyone who attended my presentation on Privacy by Design at the 2019 Integrated Justice Information Systems (IJIS) Institute’s 2019 Symposium today.

You can download the slides from my presentation here:

20190122 2019 IJIS presentation – Using PBD to reduce your attack surface v1b (CG)

While many of us are living well, too many still suffer under human slavery

As good as the world seems today, there are still many who are living horrid lives in the world today (https://www.goodnet.org/articles/10-good-things-in-our-world-that-are-getting-better). According to the US State Department, approximately 800,000 people are illegally trafficked across international borders every year (https://www.dosomething.org/us/facts/11-facts-about-human-trafficking).

Just think about the enormity of that number. That is nearly one million souls, destined for a horrendous life of slavery, in all illicit forms of human depravity. They will be owned by other humans who will treat them appallingly. They will have no rights whatsoever. They will live in fear, probably beaten, starved and raped. And out of these 800,000, some 80% are female and half are children.

These people in many cases are fleeing war torn countries. We only have to turn on our news programs to find some story of refugees trying desperately to reach a safer land. Their boat has capsized, or they suffered inhumane conditions, piled all together into the back of a lorry. Many dying from dehydration and heat exhaustion. The lengths these people go to, to find sanctuary. And most of the time we can sit back, feel sorry for them, and turn the television off. Because we can.

I too have done this, I cannot look at the images anymore, because it’s too upsetting.

More needs to be done to stop this. It is the 21st Century, and slavery is alive and well and doing a roaring trade. In this age of technology and better policing, why are countries not able to halt this?

There does not seem to be a single database that can be used worldwide, to keep track of humans missing, so every country can access it, and keep updating it. It is just too big, and with information in different languages, and much social media footage out there, we have not gotten around to creating a single, go to site, for this purpose – we have the technology, we have the cloud computing, biometrics, facial imaging, but sharing data is still a problem.

In the US the Polaris Project is a large website dedicated to helping human trafficking by offering services to combat this crime. There is a hotline for support, they are building a large public data set on human trafficking in the USA, learning how trafficking works, in real time, strategies that change entire systems to specify all trafficking, and they work with law enforcement and other public and private-sector partners to help to support survivors and to prevent and disrupt human trafficking.

They also supply statistics, blogs, videos, and initiatives to help women from Latin American countries, support for survivors, and to detect businesses that are disguised as legitimate and used to traffic vulnerable woman and children. To read more you can find it here https://polarisproject.org.

There are other websites based in the US too http://humantraffickingsearch.org and http://www.endslaverynow.org – both of these are worth checking out.

In Europe, where the problem is touching all European countries, particularly with the influx of refugees, and many going missing when the reach the country they are travelling to, the European Commission have on their site, all information about how they are tackling the problem, and also projects associated with and dealing with the massive problem that is in every city and town throughout Europe – see http://ec.europa.eu/anti-trafficking.

People can get involved, simply by being aware of any suspicious behavior, activity, whether with people or businesses, or anything that just does not look right, it is always best to be vigilant, because it really is all around us, we don’t see it, but it’s happening in front of us.

It’s time for us to start looking out for each other again. How did it ever get this bad. I thought the really bad days of slavery were behind us, but sadly they are not.

Let’s start to be kind again. We have all our creature comforts, we are contented, what more do we want….it really is the truest saying that “No act of kindness, no matter how small, is ever wasted.”

Why being a CISO is the true embodiment of being Sisyphus

My presentation at the 2018 EU Cyber Threat Summit on why being a CISO is the true embodiment of being Sisyphus.

We need fewer “cyber warriors” and more “cyber healthcare” professionals

Recently read an article titled “New Cyber Command leader pushes for more aggressive cyber defense” – https://govmatters.tv/new-cyber-command-leader-pushes-for-more-aggressive-cyber-defense/

My apologies to US Cyber Command, but I’m not convinced that we need more cyber warriors – our Nation already spends nearly $70,000,000,000 (that’s billions) a year on cyber defense and the bad guys are still kicking our butts, and so jumping higher or pedaling faster on cyber defense is unlikely to help.

Instead I suggest what we really need is a LOT more “cyber healthcare professionals,” a well trained and equipped force to get government and industry to do the proactive and preventive things needed to reduce the risk associated with the seven core issues that enable attacks and breaches; namely stuff like:

1. Errant user behaviors – implement environmental factors and system tools to reduce the likelihood that they’ll click on something bad.
2. Poor device/application configuration – when’s the last time you validated your routers and firewalls? What about your 3rd party provider applications and devices?
3. Weak or default passwords – many devices (and a good chunk of IoT) are still holding default passwords, it’s like leaving your front door wide open.
4. Failure to patch applications – most organizations don’t even have a good list of the applications they have; on-premise, hosted, or that users use on the web.
5. Vulnerable or buggy software – are you still holding on to that unsupported legacy app that you know is vulnerable? Or haven’t upgraded apps because it’ll cost to do so?
6. Lack of, or failure to enforce policy – security policies suck, but we need them to protect our livelihood, private information, and national infrastructure.
7. Complacency of executive management – Stop asking; yes, it will happen to you. And no, cyber insurance won’t cover the costs. Invest up front and hold staff accountable.

So while it’s sexy and exciting to be a cyber warrior, chasing hackers across cyber space, the reality is that, like preventive healthcare, r-e-a-l cyber security is grinding on the things that you know need to be done so that you don’t need to go chase the bad guys.

So I suggest we trade some of the BDUs for some scrubs and use some of those cyber defense dollars instead to invest more in a cyber healthcare workorce!

Thanks for reading…r/Chuck

Applying Privacy by Design as a Strategy to Reduce Your Attack Surface

We spend a lot of time and money setting up defenses to prevent cyber threats from breaching our organizational perimeters, but we hardly spend any time on the mess we have inside. Applying Privacy by Design principles to the data and systems within your organizations can make it very much harder for cyber thieves to steal your important information when they do finally breach your networks.

Click on the link below to see the presentation I gave at this year’s Cyber Threat Summit in Dublin, Ireland on October 24, 2017:

20171009 ICTTF 2017 presentation – using PBD to reduce your attack surface v1a (CG)

r/Chuck

Achieved Certification as a “Certified Knowledge Manager” (CKM)

A great article: 5 Surprising Habits of the Most Likable People

Here are excerpts from an article by Inc. magazine’s Peter Economy that I really liked; it’s short, to the point, and is sure to help reduce conflict in your professional lives as well as your personal lives (yes I add commentary on this below).

• Want to be that person who makes and keeps friends easily? Then make a habit of being really likable.                   
• Ever wonder what makes some people much more liked than others in social settings?
• Or why there are certain people who can win over multiple friends without so much as a second thought? 

Turns out, it’s not all natural talent–there are some secrets to the trade as well. Read on for 5 habits of immensely likable people.

1. They ask questions–and wait to hear the answers.  Think back to the many times someone has asked you how you’re doing without sticking around long enough for you to get out a second word. Nobody likes people who are self-absorbed, especially those who pretend to care. Be a truly good friend–ask questions and stick around to hear the answer–and watch how more people enjoy being with you.
   

   This is also true for personal relationships – if you ask a question, wait for the answer; don’t try to finish your partner’s sentence – and of course, this works both ways

2. They do not come to quick conclusions. Nobody should be preliminarily judged based on appearance or a perceived stereotype–especially not without giving others a chance to tell their story. It’s important to remember that we all come from different walks of life and that no one else really knows what another person has been through. You scare people away when you jump to and share your conclusions too quickly–wait before drawing conclusions to make sure your opinion is always a fair one.
   

   This is actually more true in personal relationships – we all share the fact we have flaws, but we rarely discriminate with family and close friends – why do we do it in the workplace?
   

3. They don’t need attention.  One of the greatest downfalls of human nature is that so many of us are hungry for attention. That’s why you’ll often find that if you place the attention on others instead, they’re usually grateful for it and admire you more for it. When we don’t have the need to make ourselves the star of every show, others will be much more likely to want to spend time with us.
   

   This is a tough one – as humans most of us do need attention, just not the same kind, at the same time, or from the same people – in your personal and professional lives, seek to find connection with others; don’t be exclude

4. They are reliable.  This habit is really as simple as it seems. Likable people don’t cancel last minute and they don’t show up 30 minutes late. They simply do what they say they are going to do, banning an emergency, of course. Be reliably consistent, and those you interact with will appreciate you more and may very well return the same courtesy to you.
   

   If you say you will do something by a certain day/time, then commit to it – reliability builds trust, and this certainly is true for personal relationships as well as professional ones

5. They smile.  People underestimate the positive power of a smile. It is scientifically proved that you are far more attractive and draw the positive attention of others when you smile frequently and genuinely.
   

   Related to #4, would it really kill you to smile? Everyone has there share of misery in their lives, a smile from you just might make someone’s day

The full article is here –> http://www.inc.com/peter-economy/5-surprising-habits-of-really-likeable-people.html?cid=em01011week15day14a

Enjoy!…r/Chuck

Message to the Board: Stop being an Ostrich when it comes to Cyber Security – Trust, but verify

I just gave this presentation to nearly 200 attendees of the ICTTF Cyber Threat Summit 2015 in Dublin, Ireland.

For those of you that attended; thank you!

Through this presentation I hope I was able to communicate three points:

1. How company/agency executives put their agencies at risk by blindly trusting that they are doing all that can be done to secure their networks, applications and data;
2. That leadership’s approach to motivating employee’s to practice better cyber hygiene needs to mimic principles of behavioral economics theory that advertisers use; and
3. By changing the way they ask questions to their senior staff (mainly their CIO/CISO), they can a) have better proof that necessary cyber protections are in-place, and b) they will have a better understanding of the unaddressed cyber risk their company/agency faces.

Enjoy…r/Chuck