The New Etiquette of Webinars (insert post-Covid statement here)

Hands up if you have been to an in-person conference or summit since the middle of March this year. Yeah, me neither.

And so we saw the rapid build-up of the online webinar, starting from the first tentative steps made by the BBC’s Have I Got News For You, through to LinkedIn Live, Zoom based cabinet briefings being “hacked”, and the advent of the vanity backdrop. And there was much celebration amongst members of ISACA and (isc)2 as we could now still get CPE’s for sitting around drinking coffee and chatting with our infosec mates.

Some fo the first ones were, frankly, a little bit crap. Poor sound and video, and events organisers more used to managing people in person rather than at the end of a dodgy video link. But these were pioneering days, and let’s face it, we needed those CPEs. It didn’t take long for features to start pouring into platforms like Zoom, Teams, Discord, even Webex (used only by employees of Cisco and people trapped in a Cisco building), and other platforms like BrightTALK. Events people got better at putting them on and using the tools, and the quality went up. New tools (or tools that found a new audience) such as StreamYard and Livestorm have truly democratised the ability to produce slick online conferences with a big budget feel at pocket-friendly pricing.

But.

The rot is starting to seep in, and quickly too. It’s only been a few months as well.

For context since the beginning of this month (October) to the end of next month, I will have hosted over 30 hours of online events, mostly as a full-on Host but also as a panel moderator, and some poor behaviours are starting to seep in already.

So I present to you my Top Ten Webinar Peeves, from both sides of the screen

  • Start on time. Even if some of your speakers are suffering from technical difficulties, start on time. You should always have a plan B anyway, or a host that can think on their feet quickly enough to engage the audience for the few extra minutes needed. Unlike a physical conference, you don’t have a captive audience. They will leave to do something else or assume it was cancelled last minute. Be on screen straight away and engage immediately.
  • Finish on time. Or slightly earlier. Never overrun. Your attendees are busy people and have meetings and places to be. Again, they are not a captive audience with the promise of a free drink or six at the end of the show and will leave the session at the published time. This means any closing remarks, thanks to sponsors or calls to action will be lost, and the benefit of the session in the first place significantly reduced.
  • Test the platform upfront. There are so many different platforms out there now, all with their own quirks and foibles. Each one has a different workflow to share your screen to give a presentation or require an upload prior to the session. Others require a certain browser to work properly, and they all seem to handle audio devices in different ways. Get it sorted upfront.
  • Position your camera properly. Everybody’s home setup is different, but there are basics that need to be observed. Don’t sit with a window or other light source right behind you as it will darken your image such that you can’t be seen. Can’t move? Then close the curtains. Try out different lights in different locations to get the best picture of you (you want to be recognised at a real conference, later on, don’t you?), and get the camera at the same hight as your eyes. Nobody wants to look into your nostrils. This might mean putting your laptop on a stack of books or similar, but the change is very noticeable.
  • Use a wired microphone and headphones. Having audio coming out of your speakers is suboptimal and can result in feedback. Wired is best because of latency and sound quality. There are some Bluetooth headsets and buds available that do a good job here, but they are the exception, not the rule.
The steps you go to ensuring you look good on screen. I need all the help I can get.
  • Present to the schedule. As a speaker, if you have been given a 15-minute slot, speak for 15 minutes (give or take a couple of minutes I am not a heartless monster). the organisers will have some buffer built-in and can work on the fly for genuine accidental overruns, but if your 15-minute slot goes on for 40 minutes, that is rude and disrespectful to the organisers, the speakers following you, and the audience who may not have even joined to watch you but rather subsequent speakers.
  • Have a timer. Conversely, more organisers should have a visible countdown clock on-screen that will allow everyone to see how much time they have remaining. Additionally, confirming on a regular basis that the speaker knows they will be interrupted and shut down if they exceed their slot by too much is a good way of reinforcing the message to the speaker.
  • Have a discussion area available. Not all questions are going to be answered in the session, so having a Slack, Discord or other platforms available will help immensely and ensure your speakers have an opportunity to connect to the audience after the session if need be.
  • Let everyone speak. A good host will ensure that everyone on a panel or discussion gets the opportunity to put their point across. Most of the time everyone is happy for this to happen, but sometimes people like the sound of their own voice over everyone else’s. Short of removing that person from the session, it is very difficult to manage that without causing embarrassment. Don’t be that person. Let the moderator/host guide you through the whole session as they have a much better idea of what is supposed to happen and when.
  • For goodness’ sake, have fun! As if this year hasn’t been tough enough already, having an opportunity to get together and listen to good talks should be embraced and be enjoyable.

So, speakers, presenters and organisers alike, some tips to make these new (obligatory post-COVID statement here) webinars and sessions more effective for everyone. There are plenty of other tips (don’t use a virtual background if you don’t have a green screen for instance), but these will certainly improve any even you are involved in, and in whatever capacity.

The best thing about virtual events though is that I can get my tea and snacks whenever I want, and not when the venue staff decide. Win-win.


When Auditors Attack!

Although I am not a formally qualified auditor, I have had a fair amount of experience of carrying out audits and risk assessments in met various roles towards becoming a CISO. I have also been able to present on the topic and have articulated many of the unique challenges faced by auditors and audits alike.

Reading about auditors on social media, articles and LinkedIn is never a pretty affair, and there is rarely any love lost between them and those posting about them. For instance, the QSA who asked for (amongst other things) a list of usernames and plain text passwords. This auditor then doubled down when pressed, accusing the auditee of ntrying to hide a poorly maintained system.

A similar thing happened to a (barely adequate) friend of mine recently, when his auditor reported a finding that “users have read access to the Windows System32 folder” flagging it as a high risk. Even Microsoft stated that this is how their operating system works, and under “normal operation” cannot be changed. My (barely adequate) friend does not run nuclear power stations, by the way.

And attack they will.

Pushing back against these decisions in a formal manner is the only approach you can take; remove the emotion from the conversation and engage as soon as possible, even if it means potentially derailing the audit for an hour or so. If you are able to get team members to do research on the subject, or call in recognised SME’s, then all the better, but establishing the facts early is important. The longer the matter goes on though, the harder it is to resolve.

If that fails, wait until the report or draft comes in. This is an opportunity to formally respond and present evidence to the contrary. This response should be sent not just to the auditor, but also the company they work for (i.e. up the chain of command), as well as other stakeholders such as the clients that commissioned the audit. Their input is important as they are the ones both paying for the audit and with the most vested interest in its outcomes.

Finally, getting everyone involved around an actual table (difficult at the moment I know, but a videoconference will do the trick too) is the last course of action. Hopefully having line management, client/stakeholder, SME’s etc facing off will produce a more amenable result. Don’t expect it to disappear though, perhaps just be downgraded to medium or low.

Being an auditor has a complex dynamic. Third party auditors need to show value to whomever is paying the bills and can sometimes extend the scope or severity of issues to show “value for money”. They can also, ironically, be risk averse and not stand down for fear of being accused of wasting time and a subsequent law suit. An auditor is also trying to be an expert across multiple disciplines at once, as well the one of actually being an auditor, so there are always going to be knowledge gaps. Acknowledging that is a huge step to being a better auditor, and taking time to do independent research on topics you might have not understood as well as you have thought is vital.

For me, auditing/risk assessing was always an opportunity to help the people being assessed; this was a skill as well as a level of emotional intelligence that was shown to me by an ISO 27001 auditor in India, someone I remains friends with after over 12 years. That two-way engagement has been vital to establishing trust and subsequent transparency during audits, and has resulted in better quality findings and a willingness to address them.

Worst case, when it comes to an auditor that won’t back down, you can always just be Accepting the Risk and moving on with the day job.

(TL)2 Security has experience is risk assessment and audit across the security organisation. From a high level risk and gap assessment through to advisory and support services on meeting various certification audits, contact us to find out more.


Too Much of a Good Thing

The one thing the current lockdown has taught me is that you really can eat too much chocolate… who knew?

Left to my own devices and without the distraction of a routine, regular work and people observing my unhealthy eating habits, my faulty brain tells me that more chocolate can only be a good thing and that I should continue to eat it until physical discomfort forces me to stop (in spite of my brain’s protestations.). It is an obsessive and compulsive behaviour that I recognise in myself, and do my best to contain, but it is a constant struggle arguing with myself that chocolate is not the most important thing in my life.

The same could be said to be true of many security professionals and their desire to roll out security practises to their organisations, implementing new procedures, standards, policies and ways of working that are designed to make the organisation very secure. They do this despite the protestations of the organisation itself telling them they have had enough, the new ways of working are too restrictive, difficult to follow and ultimately leave them with a security stomach ache.

This weeks Lost CISO episode talks about when too much security, like chocolate, is a bad thing.

This compulsion to think that security is the most important part of a business’ life is one that leads to users having security headaches all day and the business itself feeling slovenly, bloated and sluggish. (OK, that’s enough of the analogies.)

It is ultimately self-defeating, as users will do their best to work around draconian working practices, and the perception of a security organisation will be one of business prevention than vital service. I, and many others, have spoken about not being the department of “no”, but it goes well beyond just saying “yes”.

Agreeing to everything without thought of the consequences is potentially even more dangerous than saying no, especially in the short term. The vital distinction that needs to be made is that of a two way conversation between security and the end users and business. Finding out what is trying to be achieved is far more valuable than just focusing on what is being asked. Requests can be addressed in many different ways, not just by punching a whole in the firewall or switching off 2FA on the VPN, for instance.

In fact, this very conversation helps create even stronger relationships as it highlights two things:

  1. How seriously you take their request.
  2. How much you care about the organisation you both work for.

A great example of this in the above video is that of companies relaxing their security stance during the remote working ramp up of the lockdown. If the response was simply “no”, or even a straight “yes” with no consequences there would have been issues sooner or later. Working with the business, relaxing the standards for the initial growth and then methodically scaling and tightening the security once the initial growth is over is absolutely the right way to go.

So next time you feel yourself reaching for the chocolate wanting to say “no”, think beyond the the immediate consequences and how you can use security for the long term betterment of your organisation rather than your simple security stats.

And one bar of chocolate/security is always enough for everyone, right?

Do you need two re-align your security team to your business and don’t know where to start? (TL)2 Security has a proven track record helping security leaders and teams creat strtaegies and business plans that make real, competitive, differences to organisations. Contact (TL)2 to find out more.


Busy Doing Nothing?

When you are faced with managing third-party risks, it can feel like a Sisyphean task at best. Even a small organisation is going to have  20+ third parties and vendors to deal with, and by the nature of a small business, absolutely not a full-time person to carry them out. As an organisation grows, at the other end of the extreme there will be many thousands of vendors and third parties in different countries and jurisdictions; even a large team is going to struggle to deal with that volume of work.

In The Lost CISO this week I talk about how to manage a third-party risk management programme from the perspective its sheer volume of work.

The key to dealing with this volume is, of course, to take a risk-based approach, and consciously decide to do nothing about a large proportion of them. It sounds counter-intuitive, but then a risk-based approach to anything can seem counter-intuitive. (Why would you “accept” a high-level risk for goodness sake?!) In this case, you would quite literally be putting some effort into deciding what not to do:

We’re busy doing nothing.

Working the whole day through.

Trying to find lots of things not to do.

Busy Doing Nothing, written by Jimmy Heausen-Van & Johnny Burke

This means your best approach is to filter who you absolutely must assess, who you should assess, and who can be reasonably ignored. In theory, the last group will be the majority of your third parties. How you filter is of course down to what is important to your organisation, industry, clients, the data you hold, the physical location of your environment (office or hosted) and any other criteria you can consider. Ultimately, it is what is important to your organisation, not what is important to you as a security person. Why? Because if security has the final say, there is a potential for a conflict of interest and the limiting of the organisation to operate effectively and efficiently. Here is a sample list of criteria you can sort your third parties by:

  1. Do they have access to our client’s (or our client’s customers) confidential/sensitive data?
  2. Do they have access to our confidential/sensitive data?
  3. Do they have data access to our IT infrastructure?
  4. Do they have physical access to our premises?
  5. Is our organisation reliant on their services being available at all times?

Inside each of these selected criteria, you may wish to refine further; in answer to the question, think “yes, but…” and you may find a particular vendor does not make your list as a result.

Congratulations! You have now hopefully reduced your third-parties needing to be assessed by hopefully about 80%. If that is not the case, go back to the beginning and validate your criteria, perhaps with business leadership themselves, or (ironically) a trusted third-party.

This may well still leave a formidable list to get through, so there are some more tricks you can use.

When assessing some of the larger third-parties (think Apple, Google, Microsoft etc.), you may wish to accept their certifications on face value. The chances of getting a face to face meeting and tour of the facility, whilst not impossible, are remote, and very much dependent upon how much you spend with them. The more reputable vendors will be transparent with their certifications, findings and general security programmes anyway.

You can then use this filter again with the slightly less well-known vendors but include a handful of questions (no more than fifteen) that you would like answered outside of certifications.

The smallest vendors with the least formal certification and publicly available can be presented with a more detailed set of “traditional” third-party risk questions. Make sure they are relevant, and certainly no more than 100 in total. You are better off getting a good idea of most of the vendor environments from a returned questionnaire than you are a perfect idea of a handful of environments from a barely returned questionnaire. The idea here is to get a consistent, medium level view across the board in order to spot trends and allocate your resources effectively.

Still overwhelmed with sheer volume? If this is the case, look to a three-year cycle rather than an annual cycle. You can reduce the workload by up to two-thirds this way, but you may wish to consider that some vendors are simply too crucial to have on this kind of cycle.

So all that is left is to ensure all of this is carefully monitored, tracked and managed. For instance, what are you going to do with a vendor that doesn’t meet your standards?

And that, my friends, is for another blog.

(You can download a sample third-party security questionnaire from the (TL)2 security Downloads area. There will be more templates arriving soon that you can download and use for yourself, or you may wish to contact (TL)2 if you would like some help and support in creating a third-party risk programme.)

 

 


Command, Control, and Conquer

Back in the ’90s, there was a game released called Command and Conquer, a strategic game whereby you had to manage resources, build, train and mobilise armies and conquer the neighbouring armies. It was a classic that spawned many spin-offs, sequels and addons for decades. What struck me about it though was how multi-skilled you had to be, especially in the later levels.

You couldn’t just be an excellent Field Marshall as you also had to manage resources, cash and other materials to create your buildings and structures that allowed you to create your army in the first place. You had to know logistics, how long something would take to build, train and mobilise, look into the future at new locations for better access to materials, and also have plans in place if the enemy attacked before you were ready.

Essentially, you were skipping from one crisis to the next, finely balancing between success and crashing failure. It sounds a lot like any modern-day incident management situation really.

In this week’s The Lost CISO (season 2), I take a quick look at incident management and highlight four key points to remember during an incident. In case you haven’t seen it yet. here it:

The bottom line is that, much like in the Command & Conquer game, you could plan ahead what you were doing because the environment was constantly changing, the unknowns were stubbornly remaining unknowns and the literal (in the case of the game) fog of war meant you can’t see more than just a few steps ahead. There are though some keys to success.

The first key point is that having a plan is all well and good, but as my military friend regularly tell me;

no plan survives contact with the enemy

Why? Because the enemy much like life does random, unexpected and painful things on a regular basis. Incidents have a habit of doing the same thing, so if your plan is rigid, overly explicit and has little room to ad-lib or manoeuvre in, it will fail.

Therefore, my approach has always been to build any kind of plan around four simple areas:

  • Command
  • Control
  • Communication
  • Collaboration

In other words, decide who is in charge, decide who is responsible for what areas, ensure everyone knows how to talk to each other, ensure everyone works openly and honestly with everyone else. There may be some other details in there as well, but really, if you have these four areas covered your plans will remain flexible and effective, and you may find yourself being able to close incidents more quickly and efficiently.

With all that extra time on your hands, you can then spend some time basking under the Tiberian sun.