We hear the term “best practices” a lot, but the truth is, there are still plenty of bad practices in use that put people and assets at risk every day. Many of those bad practices are grounded in one or more of the following myths that commonly lure people and organizations into a false sense of security. Don’t let these myths be responsible for a breach or an attack via edge devices. Here are five common myths that deserve to be busted once and for all.

1. Micro-segmentation alleviates risk. This myth is based on the opinion that “if I create a security system network that is segmented from the operational network, then the devices in this segment are not at risk. No one can access these devices on my network.”

While segmenting the security network from the operational network is a good practice, it is far from a bulletproof cyber security strategy. Back in the early days of the analog to IP transition, a systems integrator (SI) would use segmentation as a way to appease IT departments. DVRs commonly had two network interface cards, one for the device network and one for the operational network, so IT departments felt confident in only having to monitor two connections.

Unsurprisingly, this became a best practice for decades. In truth, it is easy to improperly create a segmented network that exposes backdoors. As more operational technology and industrial IoT gets connected, it’s clear that the internet is far from the only attack vector. There are plenty of insider threats to consider along with innocent mistakes when users, just trying to get something to work, assume that if it has Wi-Fi or an Ethernet jack they can just plug it in.

Take any of the above and sprinkle it with a “set it and forget it” mentality, it becomes paramount to go beyond simply segmenting a network to be truly secure.
 
2. Life cycle management. If it’s is not broken, then don’t fix it. It can be a tough one to crack for many organizations. Unfortunately, “if it’s not broken, then don’t fix it” typically leads to a “we don’t need to update the firmware” mindset. This myth also encompasses a “products don’t need to be cycled out if they are still working” sentiment.

Without robust life cycle management of security devices, exploits and backdoors that hackers expose only increase the vulnerability of these devices over time. A critical part of any cyber secure implementation is ensuring devices are updated with the latest firmware so that any known weak points are patched. It is the manufacturers’ responsibility to keep their devices secure, but it’s also the integrators’ responsibility to keep systems they support up to date.

Finally, no life cycle management would be complete without a strategy for changing out end-of-life or end-of-support devices. In either case, just because it is still running is not a reason to leave it on the network.
 
3. Identity management. One admin account is fine for all. This myth is more commonly believed than you might think. The thought is that one admin account can be used across an SI or end user’s entire installed base. The thinking seems to be that such an account is secure because it’s not with the end user or at least not with day-to-day users.

Like everything else, usernames and passwords must be properly managed. A best practice is to create multiple usernames and passwords so that the VMS connects with one username/password combination, the IT department has another, and the contracted maintenance techs have their own too. This helps a device log discern if something has changed or happened and which account was involved. Sadly, in the security industry this rarely happens.

It is typically one admin account for all devices which is not adequate. Admin privileges should only be reserved for those who understand network security management. We’ve even seen the same username and password used for every account that an SI services. In this case, the SI believed this made it secure since it was “their” password (used across hundreds of sites) and not the end users.

As privacy concerns arise, it is also important to demonstrate that not everyone has the same privileges to view security footage. The principle of least privilege states that a subject should only be given those privileges required to complete its task. As an example, privacy masking at the edge is a popular way to blur faces captured on security cameras. Only certain senior-level users or admins should have the privileges required to expose identities or view certain streams as part of a documented event. This demonstrates accountability within operations and security departments and goes a long way towards building good will.

4. No one can use an end-point device as an attack vector. It can be hard to imagine, with so many attack vectors out there (malware, ransomware, phishing, and compromised or weak credentials), that a network camera would be a legitimate target that hackers would seek out. In fact, the exponential growth of IoT devices on corporate networks has made end-point devices a major target for bad individuals both inside and outside of a company.

Not long ago, a major manufacturer suffered a Distributed Denial of Service (DDOS) attack that was waged in part from another company’s unsecured cameras that were co-opted by a botnet. The vulnerability of those cameras had been previously detected, and the camera manufacturer had issued a firmware patch to address the weak point, but unfortunately, it had not been applied.

When it comes to ensuring cyber security for end-point devices, everyone shares some of the responsibility. The manufacturer must ensure that their device is properly designed to thwart attempts to gain access to the camera or its accompanying network infrastructure. If a vulnerability is discovered, it is the manufacturer’s responsibility to address the situation, issue an update that remedies the problem and notify their suppliers and partners.

Once such an update is available, it’s the responsibility of the reseller or integrator to notify end users that the update is available and ensure that it is installed. This is also why it’s so important to have a service contract in place that provides continual maintenance and updates. The end user is also responsible for making sure their devices are regularly inspected and adheres to any regulations or best practices that their industry requires.

5. Data in the cloud is safe and secure. This popular myth is based on the belief that when utilizing a cloud-based security system, it is solely the cloud provider’s responsibility to ensure everything is cyber secure. While it is true that the cloud provider is responsible for the security of their datacenter, the access to media on the cloud is still in the domain of the user.

Not long ago, a cloud-based security provider suffered a major breach because super admin-level credentials were widely shared by more than 100 employees. Those credentials ended up online, which let hackers have access to more than 150,000 cameras. The best things about the cloud (scale) can also be the worst things about the cloud when things go wrong. So, it is paramount to choose a cloud provider with a proven track record of cyber security that uses best practices for how data is accessed.

Cloud vendors can vary widely regarding the levels of protection offered. It is critical to conduct due diligence and understand what your service level agreement (SLA) is with a cloud provider. There are different SLAs for different types of clouds. For example, if you’re using a cloud provider just as a container, then typically you’re responsible for all of the security.

It is advisable to perform a security-focused vendor assessment, such as the one created by the National Institute of Standards and Technology (NIST), prior to signing up with a cloud provider. Are they Criminal Justice Information Service (CJIS) or System and Organization Controls (SOC) compliant? How do they vet their employees? How do you ensure that your data isn’t mixed with other people’s data? How do they manage access control so that only the authorized people have access to your content?

Many verticals have their own methods for vendor assessment such as HECVAT for education and HITRUST for health care. If you’re in a regulated environment, you need to ensure that whatever design implementation, policy or process that you are required to adhere to is represented in the cloud workflow you adopt.

There are plenty of myths and long-held beliefs in our industry about how to best protect security systems and network infrastructure. Some of these may have represented adequate protection years ago, but as we all know, technology evolves quickly, and with it, so do the tools and techniques designed to take advantage and exploit any perceived weaknesses.

In our rush to make things work and move onto the next task, it can be tempting to take shortcuts and calculated risks that may seem unlikely to result in a serious event. We’ve also heard from people that no one could possibly care about these mundane video feeds — until they are forced to — when a company’s intellectual property is compromised, or someone uses an unprotected device to inject malware and ransomware that brings an organization to its knees.

With everything you do to help protect people and assets, don’t toss it down the drain by relying on outdated information. Make it a priority to stay on top of the basics of cyber security.

The National Counterintelligence and Security Center (NCSC), the National Insider Threat Task Force (NITTF), the Office of the Under Secretary of Defense Intelligence and Security, the Defense Counterintelligence and Security Agency, and the Department of Homeland Security today launched the fourth-annual “National Insider Threat Awareness Month” (NITAM).

NITAM is an annual, month-long campaign during September to educate government and industry about the risks posed by insider threats and the role of insider threat programs. The campaign seeks to encourage government and private industry employees to recognize and report behaviors of concern, leading to early intervention and positive outcomes for at-risk individuals and reduced risks to organizations. To learn more about the campaign and resources available to organizations, visit the NITAM 2022 website.

An insider threat is anyone with authorized access who wittingly or unwittingly harms an organization through their access. Most insider threats exhibit risky behavior prior to committing negative workplace events. If identified early, many insider threats can be mitigated before harm occurs. Federal insider threat programs are composed of multi-disciplinary teams that address insider threats while protecting privacy and civil liberties of the workforce, maximizing organizational trust, and ensuring positive work cultures that foster diversity and inclusion.

Fostering Critical Thinking in Digital Spaces

This year’s NITAM campaign focuses on the importance of critical thinking to help workforces guard against risk in digital spaces, which can facilitate insider threat activity. Such risk includes social engineering efforts; online solicitation by foreign or domestic threats; misinformation, disinformation, and mal-information; as well as malicious cyber tactics like phishing, smishing, and vishing.

With virtual work environments becoming more prevalent, malicious actors have more opportunities to target those in our workforces through exploitation of the digital information landscape. Government and industry employees are often susceptible to malicious digital approaches, posing enhanced risk to themselves and their organizations. The ability to spot and respond to manipulative information begins with critical thinking skills, which are essential to reducing vulnerability to these risks.

“Our trusted workforces (our insiders) are some of the most valuable assets in our nation, but they face an increasingly challenging risk environment,” said NCSC Deputy Director Michael Orlando. “It is imperative that we arm our trusted insiders with the resources and skills to counter increasingly sophisticated efforts to exploit our personnel, information, and resources.”

“Increasing the workforce’s awareness of manipulated information and attempts at online social engineering is critical to ensuring our trusted workforce remains resilient and vigilant against these threats,” said Ronald Moultrie, Under Secretary of Defense for Intelligence and Security.

Today, insider threat practitioners from across the U.S. Government and industry will participate in the 2022 Insider Threat Virtual Conference, hosted by the Department of Defense, to kick off the NITAM 2022 campaign. The 2022 Insider Threat Virtual Conference features senior level speakers and panelists who will present on critical thinking for the workforce, social engineering threats, an insider threat case study, and resources for workforce resiliency to counter insider risk.

Recent examples underscore the damage that can be caused by insider threats:

• In August 2022, a federal jury in California convicted Ahmad Abouammo, a former manager at Twitter, of acting as an unregistered agent of Saudi Arabia and other violations. Abouammo had used his position at Twitter to access, monitor, and convey the private information of Twitter users, including critics of the Saudi regime, to officials of the Kingdom of Saudi Arabia and the Saudi Royal family in exchange for bribes worth hundreds of thousands of dollars.
• In July 2022, a federal jury in New York convicted former CIA programmer Joshua Schulte of violations stemming from his theft and illegal dissemination of highly classified information. Harboring resentment toward CIA, the programmer had used his access at CIA to some of the country’s most valuable intelligence-gathering cyber tools to covertly collect these materials and provide them to WikiLeaks, making them known to the public and to U.S. adversaries.
• In June 2022, civilian defense contractor Shapour Moinian pleaded guilty in California to federal charges, admitting that he acted as an unregistered agent of China and accepted money from Chinese government representatives to provide them aviation-related information from his U.S. intelligence community and defense contractor employers. An individual in China posing online as a job recruiter had contacted Moinian offering him a consulting opportunity. Moinian later traveled to China and other locations where he supplied US aviation information to individuals he knew were employed by or directed by the Chinese government in exchange for money.

Proofpoint, Inc., a cybersecurity and compliance company, announced the release of its latest study, Cloud and Web Security Challenges in 2022, in collaboration with The Cloud Security Alliance (CSA). The commissioned study queried more than 950 information technology and security professionals from various organization sizes and locations to better understand the industry’s knowledge, attitudes, and opinions regarding cloud- and web-delivered threats. The results reveal that organizations are struggling to sufficiently secure new cloud environments implemented during the pandemic, while maintaining legacy equipment and trying to adapt their overall security strategy to the evolving landscape.

“In the wake of COVID-19, organizations substantially accelerated their digital transformation initiatives to accommodate a remote workforce.” said Hillary Baron, lead author and research analyst at CSA, the world’s leading organization in defining standards, certifications, and best practices to help ensure a secure cloud computing environment. “While these initiatives strive toward improving worker productivity, product quality, or other business objectives, there are unintended consequences and challenges because of the large-scale structural changes required. One of those challenges is developing a cohesive approach to cloud and web threats while managing legacy and on-premise security infrastructure.”

As organizations continue to migrate to the cloud, reliance on third parties and partners increases, which in turn exacerbates the risk of threats through the supply chain. The Cloud and Web Security Challenges in 2022 study shows that 81% of responding organizations are moderately to highly concerned about risks surrounding suppliers and partners, with almost half (48%) specifically concerned about potential data loss as a result of such risks. This high level of concern is entirely warranted as 58% of organizations indicated that third parties and suppliers were the target of a cloud-based breach in 2021.

The study reveals that defending data is rightfully a top concern for businesses, with 47% listing “sensitive data loss” as their most concerning outcome of cloud and web attacks. The specific types of data organizations are most concerned with are customer data, credentials, and intellectual property. 43% of organizations listed protecting customer data as their primary cloud and web security objective for 2022. Despite this, only one-third (36%) of the organizations surveyed have a dedicated Data Loss Prevention (DLP) solution in place.

“As organizations adopt cloud infrastructures to support their remote and hybrid work environments, they must not forget that people are the new perimeter. It is an organization’s responsibility to properly train and educate employees and stakeholders on how to identify, resist and report attacks before damage is done.” said Mayank Choudhary, executive vice president and general manager of Information Protection, Cloud Security & Compliance for Proofpoint. “Cultivating a culture of security within and around your organization coupled with the use of multiple streamlined solutions is critical to effectively protect people against cloud and web threats and defend organizational data.”

Key findings from the study include:

• 47% of those surveyed listed “sensitive data loss” as their most concerning outcome of cloud and web attacks, while “paying ransom” was of least concern to respondents (10%).
• 58% had a third party, contractor, and/or partner targeted in a cloud breach.   
• Organizations are concerned that targeted cloud applications either contain or provide access to data such as email (36%), authentication (37%), storage/file sharing (35%), customer relationship management (33%), and enterprise business intelligence (30%).
• Almost half of those surveyed (47%) blame dealing with legacy systems as key concern with their cloud security posture, while 37% feel they need to coach toward more secure employee behavior.
• Only one-third (36%) of organizations surveyed have a dedicated Data Loss Prevention (DLP) solution in place. Other solutions implemented include Endpoint Security (47%), Identity Management solutions (43%) and Privileged Access Management (38%).

Cybersecurity Awareness Month allows us to reflect on our progress in information security and the components that still need work. As the term “cybersecurity” has made its way into mainstream vernacular (not just in sci-fi movies but in everyday conversations in the workplace and home), it would be tough to argue that cybersecurity awareness hasn’t grown tremendously in the past few years. But what does cyber awareness mean, and what’s the ultimate goal in increasing awareness across the general population?

Being cyber aware is the online equivalent of not getting into the van of the person offering you candy as a kid. It’s about situational awareness – in the virtual world. Today, more people outside my infosec and tech circles seem to be aware that some cybersecurity “issue” generally exists – personal risks and threats against companies and our nation.

While we’ve built awareness of “the problem,” I believe we can continue building an understanding of what everyone, not just the tech pros, can and should be doing to improve security for all. Everyone is responsible for protecting themselves and the organizations they care about. As our lives become increasingly intertwined with the online world, we need to adopt a “security hygiene” mindset when interacting with technology. We all need to rally the troops to keep cyber attackers at bay. Here are four reminders to evangelize amongst your friends, family, and colleagues.

Enable Multi-Factor Authentication. Yes, it adds an extra step. But it’s worth preventing unauthorized individuals from accessing your account or data. Users who enable MFA are significantly less likely to get compromised. It provides backup if your password becomes compromised; unauthorized users would be blocked by the second authentication requirements, ultimately keeping them out of your accounts. Do it: the Two Factor Authentication (2FA), Multi-Factor Authentication, Two-Step Authentication, whichever your service asks you to do.

Use Strong Passwords. Bad passwords, coupled with no MFA, are a recipe for disaster. Follow whatever instructions your security department at work has documented for you, but for your purposes, use these guidelines:

• Use a different, complex password for every site you visit. I mean it. EVERY. SINGLE. ONE.
• Don’t use names or numbers that have meaning for you. Sure, the date of your marriage might be easy to remember, but it is also easy for bad actors to figure out – and as such, has no business being part of your password. Your first child’s name plus the date of their birth – yeah, that’s trivial as well. And if I ever find “qwerty” as part of your password, well, let’s just say we’re gonna have a frank conversation.
• Use a password that is at least 12 characters. Yes, a few years ago, we said 8. Nowadays, an eight character password with upper, lowercase, and numbers can be brute-force guessed in about 2 minutes, while a 12-character one of the same complexity will take 24 years.
• Use a password manager. There are several good ones out there; pick one and go. Use a good, really LONG password for your password manager, and then use it to generate unique passwords for all your websites and apps. A password manager with MFA is even better!

Recognize and Report Phishing. People are becoming more aware of suspicious links,, we’re moving too fast, and things still get clicked. Follow these guidelines to help you discern phishing from regular emails:

• Is the sender asking you to do anything?
• Is that something you were expecting them to ask you to do?
• Are they indicating significant urgency?
• Are they trying to get you to react without thinking?
• Can you validate the request without using any of the information in the email?
• Can you go directly to a website or phone number you already know?
• Pretend you got the email on April Fools Day and apply the same skepticism to this email that you would to anything told to you that day.

These guidelines won’t keep you safe from every phishing attempt by themselves, but they’re a great start.

Update your software AND ALL THE THINGS!

Bad actors will exploit flaws in the system. Network defenders are working hard to fix them as soon as they can, but their work relies on all of us updating our software with their latest fixes.

Update the operating system on your earbuds, mobile phones, tablets, smart TVs, internet-connected toasters, self-driving cars, and laptops. (OK, maybe you don’t have all of these things but remember, any “smart” device is a computer running an OS, and that OS is 100% guaranteed to have at least one flaw in it). As a general rule, if you can no longer get updates for your device’s OS, it is time to retire it, as unsupported devices are unsafe. With the increased likelihood that you’re working from home these days, that vulnerability in your network could be a way into your company’s network – and you don’t want to be that person, do you?

After the OS updates, update your applications – especially the web browsers – on all your devices too. Leverage automatic updates for all devices, applications, and operating systems whenever and wherever they exist.

Like Smokey says: “Only you can prevent [cybersecurity incidents]!” OK, I paraphrased, but just as it isn’t solely the forest ranger’s job to prevent fires, we shouldn’t expect any of our favorite gadget makers, social platforms, or other tech services to guarantee our online security. Even in a work setting, your friendly Cybersec team needs your help as the first line of defense against cyber incidents. For cyber security awareness month this year, let’s meet awareness with action; after all, the data you save could be your own.