Cybersecurity Fundamentals for Bar Associations

© Copyright 2016 NowSecure, Inc. All Rights Reserved. Proprietary information. Do not distribute.
Cybersecurity Fundamentals for
Bar Associations

Andrew Hoog
CEO and Co-founder of NowSecure
© Copyright 2015 NowSecure, Inc. All Rights Reserved. Proprietary information.
● Computer scientist & mobile security
researcher
● Author of three mobile security books
● Enjoyer of science fiction, running and red wine
© Copyright NowSecure 2016, Inc. All Rights Reserved. Proprietary Information.

Contents
● Why invest in cybersecurity?
● Assets-based risk assessment
● Common attacks vectors
● Frameworks / Best Practices

Why invest in cybersecurity?

Model Rules of Professional Conduct 1.6:
Confidentiality of Information
(c) A lawyer shall make reasonable efforts to
prevent the inadvertent or unauthorized disclosure
of, or unauthorized access to, information relating
to the representation of a client.

Your job? Your bonus?

Anyone heard of the Panama papers?
The Panama Papers are:
11.5 million leaked documents that detail
financial and attorney–client information for more than
214,488 offshore entities.

Regulation

FTC v. Wyndham
“A company does not act equitably when it publishes a
privacy policy to attract customers who are concerned
about data privacy, fails to make good on that promise by
investing inadequate resources in cybersecurity, exposes
its unsuspecting customers to substantial financial injury,
and retains the profits of their business.”
Circuit Judge Thomas Ambro, United States Court of Appeals for the Third District

FTC v. Wyndhan
FTC has authority to bring
data security cases
Apple App Store and
Google Play store require
privacy policies
Failure to invest in security
of those apps (i.e., “do what
you say”) puts you at risk

Information Security - It’s a process, yo!
Information Security Management System (ISMS) is not a computer system but
an organizational policy and program to implement and manage information
security. A major component of this is executive accountability for information
security, making clear the responsibility overall and also "ownership" of specific
systems/data.

Asset-based risk assessment

Assets of value
Things I heard you value
● Member database
● Credit cards
● PII
● Anything related to cases
● …
Things attackers may also value

Assets of value
Things I heard you value
● Member database
● Credit cards
● PII
● Anything related to cases
● …
Things attackers may also value
● Network (DDoS)
● CPU (bitcoin mining, wheeee!)
● Your identity
● Making a point (political / philosophical
agendas)
● Bragging rights

I think of vulnerabilities in three buckets
Unknown / No fix Best practices
Very little anyone can do here
See router example (vulnerable
cable modem)
Tactics: implement best practices
and try to limit what attackers
can access
This is the area to focus most
energy
80/20 rule in play here, meaning a
reasonable amount of effort will
address 80% of your risk.
The remaining 20% is
precipitously expensive and
difficult to address.
Targeted attacks
Can’t defend against
Attacker will ultimately succeed
Tactics: implement best practices
and try to limit what attackers
can access

Compromised router

It all began on Saturday, February 13
● Certificate error
● Examined the details
● Determined there was an issue
Documented the issue
Contacted corporate security team
● Attempted to re-create on iPad, other iOS devices, laptop, desktop

Info gathering and identification
Symptoms
● Gmail app wouldn’t sync
● Wi-Fi certificate errors
● Analyzed certificate
Hosted in shared environment
● Istanbul
● Both used self-signed HTTPS certificate
● Issued by: ssl@servers.carsimedya.com

Continuing investigation
Suspicious DNS entries
● Queried IP address - resolved to a server in Germany
● Same DNS as carsimedya.com
● Social media and SEO related
● Investigated router configuration
Theories
● Targeted attack
● Mass router compromise (using known or zero-day vulnerability)

Common attack vectors

Common Attacks
1. Vulnerable software (and firmware)
2. Phishing attacks, email most common but
can also be SMS
3. Ransomware - (typically phishing +
vulnerable software)
4. Webserver
5. Social engineering
6. Physical
With scary cyber criminal image

Local ABA Webserver

Web Server Info
Scan took 1.5 seconds - IIS 7.5 was released in 2009!

IIS 7.5 Known Vulnerabilities

.NET Framework 4.0 Know Vulnerabilities

Ideas on how the Panama papers leaked?
Does anyone want to conjecture on how the Panama papers were leaked?
The Panama Papers are:
11.5 million leaked documents that detail
financial and attorney–client information for more than
214,488 offshore entities.

Frameworks / Best Practices

NIST Cybersecurity Framework
Check it out:
https://www.nist.gov/cyberframework

Five practical info sec tips for
non-security firms

1 2 3 4 5
Patch
Routers
Firewalls
Wi-Fi Access Points
Servers
Computer
Laptops
Mobile phones
....

1 2 3 4 5
Patch
Routers
Firewalls
Wi-Fi Access Points
Servers
Computer
Laptops
Mobile phones
....
Auth
Change default
passwords!
Use a password
manager.
Two Factor Auth

1 2 3 4 5
Patch
Routers
Firewalls
Wi-Fi Access Points
Servers
Computer
Laptops
Mobile phones
....
Auth
Change default
passwords!
Use a password
manager.
Two Factor Auth
Segment
Install a firewall
Consider segmenting
sensitive servers from
computers, mobile and
IoT devices and guest
Wi-Fi

1 2 3 4 5
Patch Auth Segment
Install a firewall
Consider segmenting
sensitive servers from
computers, mobile and
IoT devices and guest
Wi-Fi
Encrypt
Encrypt data at test
Servers
Laptops
Mobile Devices
This is only effective in
some scenarios
Routers
Firewalls
Wi-Fi Access Points
Servers
Computer
Laptops
Mobile phones
....
Change default
passwords!
Use a password
manager.
Two Factor Auth

1 2 3 4 5
Patch Auth Segment Encrypt Outsource
Security is hard so
outsourcing makes
sense in many
situations
Primary upside is using
large SaaS providers for
key systems like email
Audit your mobile apps
against the framework
Set internal
requirements for
mobile app security
Teach developers how
to code in compliance
with the framework,
and teach security
auditors how to test
apps against it
Document framework,
education materials,
and assessments (i.e.,
reports), and make sure
it’s all organized and
accessible

Security needs to be user friendly or
people will circumvent it
Executives must lead by
example and take
responsibility for security
Needs to become part of your
DNS
Assets are valuable,
vulnerabilities are everywhere.
Attackers have an asymmetric
advantage
Information Security is org policy and program

Don’t Panic
Andrew Hoog
CEO / Co-founder, NowSecure
ahoog@nowsecure.com
312-878-1100, x4242
Twitter: @ahoog42
nowsecure.com

Cybersecurity Fundamentals for Bar Associations

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Viewers also liked

Viewers also liked (20)

Similar to Cybersecurity Fundamentals for Bar Associations

Similar to Cybersecurity Fundamentals for Bar Associations (20)

More from NowSecure

More from NowSecure (20)

Recently uploaded

Recently uploaded (20)

Cybersecurity Fundamentals for Bar Associations