2015 Q3/Q4 Update

This is another summary update as I've been very busy these past six months due largely to moving house.

It's important to me that I acknowledge the devastating floods that are currently happening at home. Christmas here has been ruined by unprecedented amounts of rain which have led to the worst floods anyone has ever seen. Nearly every place I've ever worked or lived in has been under water and with the clean-up under way, the rain has just returned. 

Wellington Street, opposite my office

The response has been incredible, and my thanks go out to the emergency services and everyone that's involved in putting things right. It's in times like these you realise the true value of social media and the real-world difference it can make in people's lives. From alerts and warnings to the clean up and support efforts, it's all being coordinated via Twitter and Facebook. 

Maltangent (formerly 'macrosploit'), the targeted phishing platform I've been working on with @leighhall, is two thirds through it's first client engagement. In the run up to Christmas I've been using it to test user awareness levels for my employer across several departments following the introduction of mandatory awareness training. It's still very much early days and it now seems like the market is full of phishing platforms but I'm happy with the results and can't wait to continue testing in the new year. Thanks to DLA Piper for the opportunity and for working with us and to those individuals that have provided us with feedback from phishing assessments they've had done by other parties. 

Targeted phishing appears to be a real issue within the legal sector right now. I try to write up and share the details of attacks where I can, typically with the legal security forum hosted at CiSP, but also on social media. In October alone I contributed write-ups for eleven targeted efforts against our firm which utilized a myriad of techniques. Each required immediate action, but the lessons learned will be fed back into Maltangent's the development and I used the details of the attacks to produce a 'highlights reel' which I've been presenting back to the business.

I've spent a lot of time over the last six months doing a lot of internal SANS 20 consultation after being brought in to review a long running programme that hadn't gotten anywhere. The output of this has been a lot of detailed gap assessment work (updated to v6 following release in October) which I'm now writing recommendations and strategy for to address. The initial assessment was conducted by a third party which resulted in some very light weight recommendations anchored to a set of CMM maturity scores. I'm not particularly fond of maturity scores when they're used to describe security controls. If you're doing things by the book then it can take years to move up a notch which can be misinterpreted as a lack of progress or effort higher up. This can really hamper your efforts. 

Sample SANS20 gap results made using the calculator below

I've made this v6 gap calculator available for download here if you're interested in producing your own.

We've managed to increase the headcount for our team over the past six months and consequently I've been  spending a lot of time developing junior members over the past six months. I've never really had to develop people before but I can say now it has been rewarding. I'm currently sponsoring an auditor and an analyst through day to day engagement, exercise and certification. Funmi has consequently passed the CISA exam and Farhad is working towards CISSP now. 

This will almost certainly be my last post for 2015. I'm working predictions for 2016 so keep an eye out for that in January but until then, stay safe and I hope you have a fantastic New Year :)