Steve's Security Blog | @northvein

A well known high street supermarket received a fine from the Information Commissioner's office (ICO) yesterday. I had a look at the details and you can too.  It's not a vast sum but it should be cause for embarrassment. It should also be cause for concern for anyone working there who has anything to do with data protection given the approaching changes to the ICO's powers coming next year with GDPR .  There are still a lot of people who think GDPR will be the next Y2K - I've literally heard two separate groups of people say this. I think a lot of people think that the ICO is a paper tiger and if you pushed them for an example of their actions they'd at best recount TalkTalk's record £400,000 fine. I thought then it might be interesting to review all of the monetary penalties the ICO has issued since the start of this year up to yesterday. All enforcement notices can be viewed online  here .  ICO Monetary penalties - 01/Jan/17 to 17/Jun/17, Introdu...

The media coverage of the recent major systems outage at British Airways is some of the worst I can recall reading. Essentially a national institution working in an industry synonymous with resilience, safety and preparation is making a drama out of a crisis and many technical practitioners are still trying to understand what happened.  In the most recent reports, it sounds like a contractor accidentally switched off the power in their datacenter and with it, toppled the first domino in a series which lead to 750,000 passengers being unable to fly and an as yet to be calculated compensation bill.  "It was not an IT issue, it was a power issue" -  British Airways  Nothing in the information they’ve released so far really explains how this course of events came to transpire nor does it provide any confidence or assurance around BA’s approach to business continuity planning (BCP) or disaster recovery (DR). Essentially, someone was able to gain access to a...

Distributed denial of service (DDoS) attacks are now an established aspect of the threat landscape. The number of attacks reported continues to rise, as does the recorded peaks for the traffic they can deliver. ‘Booter’ services, the prevalence of poorly configured IoT devices and access to command and control operations for botnets like Mirai mean threat actors need relatively low levels of sophistication or competence to disrupt or completely disable unprepared organisations. Even those organisations that already have countermeasures in place must remain alert and aware to threat actors who adjust their tools, techniques and procedures (TTPs) to circumvent controls or exhaust and overwhelm defenders.  Booter Service “There is a lack of ultimate control associated with this attack. You can’t prevent attempts, and likely need to rely on help from some upstream allies to defend if/when attempts are made. If someone points their botnet at you, hopefully you have...

If your inbox or social media feed is anything like my own you'll have probably been inundated with a stream of marketing material following the WannaCry(pt) outbreak last week. Amongst all the vendor bragging, claims and offers of free trials and assessments I've seen a lot of good advice from security professionals. The message is clear enough to sum up in one sentence for technical staff - patch, manage your network, do the basics . For security practitioners, this advice is a message they've repeated enough to become mantra. I thought then it might be useful to look at this recent event through a different lens and provide a pocket guide for Business Managers looking to assess the situation and provide Business Owners with an understanding of their exposure. This can be used then to identify what help (if any) your technical teams need.  Clearly, a disconnect still exists in many organisations between risk owners and technical staff.  Below is a series ...

Why it's a good idea There are a myriad of reasons to test in peace time, the controls and processes which collectively represent your incident readiness. These include: Validating your Incident Readiness - testing can confirm that you are as ready as you think you are, and that nothing has changed resulting in an end state which prevents you from initiating IR.  Assess Controls Coverage and Identify Gaps - testing can confirm your controls coverage is adequate as well as highlighting those gaps which you'd rather not have in the event of a real issue. Demonstrate value of investment - you've probably spent a lot of time and other people's money acquiring controls, attracting talent and preparing for the eventually of an incident. Internal stakeholders will likely already be looking for assurance that their investment has been worth while.  Demonstrate investment and commitment to interested parties - internal stakeholders considered, you'll lik...

My mate Dan set up our bug bounty programme and wrote a post over at the company  engineering blog about it back in November. It’s a solid guide to establishing your own with practical considerations for outlining such a programme, getting it off the ground, running it, rendering the benefits to your organisation and extending its coverage and scope over time. It’s been a triumph and as we approach month 4 I wanted to spend a bit of time outlining some things worth considering before starting your own programme. I also wanted to dig into some of the points of friction we’ve encountered. Before You Start (Day 0)  First things first… Is a Bug Bounty Programme right for you? If this is new to you and you’ve not already got your own programme up and running, it’s worth stopping to check that starting your own is right for you and your business. Do you have the right people -or- the right people with enough time? Your programme is going to need...

Over the course of this week various news outlets began to report and further investigate issues with Intel’s Atom C2xx chips. These low power CPUs appear to suffer from a hardware fault which renders them useless after roughly eighteen (18) months of service. You should care because this family of CPUs is widely used across network platforms and peripherals. Effected product lines include security platforms (Cisco ASA, pfSense Netgate), Switching platforms (Cisco Nexus, Broadcom Trident II), industrial routing components (Cisco 809) and possibly Network Storage. The list of products will likely only grow over time as vendors investigate the issue and report on effected products. What Should You Do Now? Keep Up to Date – you should look to ensure that your engineering and infrastructure people are aware of this issue and are monitoring the situation for updates. Identify your risks – with the information available now and as more information is released, look to i...