{"id":41274,"date":"2020-08-26T04:54:59","date_gmt":"2020-08-26T11:54:59","guid":{"rendered":"https:\/\/www.enxmag.com\/twii\/?p=41274"},"modified":"2020-08-26T05:11:12","modified_gmt":"2020-08-26T12:11:12","slug":"the-enemy-within-dealer-security-tools-protect-end-users-from-themselves","status":"publish","type":"post","link":"https:\/\/www.enxmag.com\/twii\/state-of-the-industry\/2020\/08\/the-enemy-within-dealer-security-tools-protect-end-users-from-themselves\/","title":{"rendered":"The Enemy Within: Dealer Security Tools Protect End-Users from Themselves"},"content":{"rendered":"\n
While high-profile ransomware attacks have dominated technology headlines primarily in the last 10 years, it might be surprising to learn that the first documented attack launched in an effort to extort money occurred in 1989. <\/p>\n\n\n\n
Although computer worms have been around since the early 1970s, evolutionary biologist Joseph Popp garnered the distinction of creating the first for-profit attack with the AIDS Trojan. Disseminated through Popp\u2019s postal mailing list and spread by a floppy disk, the Trojan horse replaced the AUTOEXEC.BAT file in computers. On the 90th boot following infection, the Trojan hid directories and encrypted the names of all files on the C drive, effectively paralyzing the computer. Users were then asked by PC Cyborg Corp. to renew their \u201csoftware lease\u201d via sending $189 to a post office box in Panama.<\/p>\n\n\n\n
While Popp may have been the unofficial godfather of cybercriminals, the AIDS Trojan suffered from poor design\u2014only the names, not the files, were scrambled\u2014and could be easily removed. As for the eccentric Popp, he was arrested, declared mentally unfit to stand trial and deported to the United States (he passed away in 2007). The sad postscript is the manner in which he perpetrated the act: Popp claimed to have devised a questionnaire that would effectively determine patients\u2019 risks of contracting the AIDS virus, and he mailed 20,000 copies of the disk to researchers in 90 countries.<\/p>\n\n\n\n
Popp reportedly did not profit much from his nefarious scheme; scientists and researchers were not as gullible as he\u2019d hoped\u2014they were intelligent enough to discover the workaround. Had it been proliferated among the general population, particularly in the early days of the home computer, it likely would have ensnared many more victims. Even 30 years later, cybercriminals are still figuring out ways to lure unsuspecting employees into clicking on links and files that launch a world of problems for their employers.<\/p>\n\n\n\n
Thus, dealers who supply security components among their IT offerings to protect servers, data centers, printers, network-connected and employee-introduced devices must also protect end-users from their own bad judgment. As part of the September State of the Industry report, we canvassed some of the industry\u2019s top providers of security solutions to see how they establish their platforms and maintain competency standards to help protect clients from themselves.<\/p>\n\n\n\n
Jeff Leder, Impact<\/figcaption><\/figure><\/div>\n\n\n\n
When Impact Networking of Lake Forest, Illinois, made the decision to build out its own managed security practice, it studied a number of all-encompassing, out-of-the-box third-party solutions. But while several offerings boasted a variety of strong components within the overall package, there were usually other elements\u2014such as antivirus and security awareness training\u2014that left something to be desired, according to Patrick Layton, vice president of managed IT for Impact Networking. The dealer wanted its managed security practice to be on par with the level of service it provides across its product and service menu.<\/p>\n\n\n\n
In looking at the marketplace and the solutions that were available to certain types of clients, we saw the same surge of problems popping up in the security industry. <\/p> \u2013 Jeff Leder, Impact <\/cite><\/blockquote>\n\n\n\n
As a result, Impact Networking budgeted the necessary dollars and set up a one-year timeframe to develop its own competencies, which entail best-of-breed products across nine categories.<\/p>\n\n\n\n
\u201cIn looking at the marketplace and the solutions that were available to certain types of clients, we saw the same surge of problems popping up in the security industry,\u201d noted Jeff Leder, director of managed IT security services for Impact Networking. \u201cSo our goal was to define those problem categories and identify the solutions that would address them. Working out partnerships and determining how we can deliver that as a managed solution set for clients through a larger security program was a big part of it. Once we got that established, it was just a matter of engaging a process in which every time we work with a prospective client, the goal is to educate them on the problems they have and show the types of solutions that can address them.\u201d<\/p>\n\n\n\n
Home Grown<\/strong><\/p>\n\n\n\n
Security competency begins at home, and Impact Networking is certainly no exception. The dealer, which prior to the pandemic had rolled out two annual Optimize IT & Business Security Summits that drew upwards of 1,000 attendees, is its own customer as well, and educates employees in the same manner as clients. They\u2019re trained on the secure use of their own network, data and tools, with extensive training and testing. <\/p>\n\n\n\n
On the security side, a new cybersecurity engineer\u2014tasked with performing vulnerability and penetration testing\u2014will need credentials such as PenTest+ (CompTIA), CEH (certified ethical hacker) or OSCP (offensive security certified professional). Cybersecurity analysts require certifications that speak to defending and monitoring infrastructure.<\/p>\n\n\n\n
On the account management side, a vCISO (virtual chief information security officer) should tout CISSP (certified information systems security professional) and certifications\/education that enable them to communicate in a meaningful way to business owners and decision makers. Compliance certifications will help team members engaged with client verticals that have specific line-of-business requirements.<\/p>\n\n\n\n
Patrick Layton, Impact<\/figcaption><\/figure><\/div>\n\n\n\n
When it comes to ongoing training of staff and end-users, Impact Networking\u2019s go-to solution is KnowBe4, one of the leaders in security awareness training. According to Layton, the dealer provides phishing tests for end-users, and client managers get detailed reports and notifications regarding employees who \u201ctake the bait.\u201d Various education tools are used, and peer pressure (pointed notes from end-user managers) can also be effective in identifying and ensuring offenders do not repeat bad habits. BrainStorm, a learning management tool, also allows for custom content such as educational videos.<\/p>\n\n\n\n
\u201cThere are some training and educational components that go along with certain regulatory compliance,\u201d Leder added. \u201cWe have additional tools and resources that have been developed in-house, in addition to some of the managed solutions we offer, so that we can help client organizations educate users specifically in relation to those types of compliance as part of the managed compliance program.\u201d<\/p>\n\n\n\n
Earlier this summer, Gordon Flesch Company announced the creation of Elevity. This marriage of its managed IT division and recently acquired Information Technology Professionals supplies cloud, managed IT and cybersecurity for its Midwest client base. From a security standpoint, the Madison, Wisconsin-headquartered dealer provides managed competencies for patching\/updates, security devices, networking components, advanced threat protection with 24\/7\/365 security operations center monitoring, advanced email protection, security training, backup solutions, disaster recovery and strategic advisory services.<\/p>\n\n\n\n
Best of the Best<\/strong><\/p>\n\n\n\n
Paul Hager, director of solutions for Elevity, notes it can be challenging to sift through the many security offerings and vendors in the marketplace, so the dealer relies on bringing the best-in-class products into a complete solution. \u201cWe make sure all of our underlying solutions that we wrap into a bundled offering adhere to industry standards and meet compliance requirements,\u201d he said.<\/p>\n\n\n\n
According to Hager, Elevity regularly conducts customized assessments of its technical staff to ensure they meet both industry and company proficiency standards. It also uses the same tools it applies to clients for its own staff, including ongoing security testing and security awareness training.<\/p>\n\n\n\n
Paul Hager, Gordon Flesch Co<\/figcaption><\/figure><\/div>\n\n\n\n
Acknowledging the self-inflicted damage that end-users can unwittingly impart on the company, Elevity believes the \u201chuman firewall\u201d is an essential component of security for clients and its own operation. As such, Elevity trains its own staff frequently through phishing tests, online learning modules and various other industry-leading tools.<\/p>\n\n\n\n
\u201cAs a managed service provider, we are acutely aware that our staff not only serves as a human firewall for our business, but are also an integral part of our clients\u2019 human firewalls as well,\u201d Hager said. \u201cIn addition to training, we also follow other best practices, such as two-factor authentication.\u201d<\/p>\n\n\n\n
As a managed service provider, we are acutely aware that our staff not only serves as a human firewall for our business, but are also an integral part of our clients\u2019 human firewalls as well.<\/p>\u2013 Paul Hager, Gordon Flesch Co<\/cite><\/blockquote>\n\n\n\n
\u2013 Scott Anderson, Kelley Connect<\/figcaption><\/figure><\/div>\n\n\n\n
Delivering security to the end-user is wholly based around the risk reduction plan for Kelley Connect, headquartered in Kent, Washington. Scott Anderson, senior vice president of IT, notes any plan comes with the caveat that it\u2019s impossible to guarantee that any end-user can be 100% secure, but the risk reduction plan enables the dealer and its clients to have ongoing conversations about the solutions and programs\u2014which are wrapped around the NIST framework\u2014that can be implemented to mitigate exposure to issues.<\/p>\n\n\n\n
Kelley Connect has various baseline standards it seeks in all new hires, requiring various levels of flavors of certifications\/accreditations. Many of its security programs are wrapped around licensed third-party resources. <\/p>\n\n\n\n
We\u2019re sending out phishing emails with the idea that if you click on one, you have just volunteered yourself for additional training.<\/p> \u2013 Scott Anderson, Kelley Connect <\/cite><\/blockquote>\n\n\n\n
\u201cWe have a very strategic relationship with Continuum, who we partner with to provide a SOC on our behalf,\u201d Anderson noted. \u201cThat relationship brings with it a lot of certified security personnel to the table, with the ability to dial up as needed.\u201d<\/p>\n\n\n\n
Security awareness training is a major component of the risk reduction plan. Anderson points out that too often, training is a once-a-year event that buys into the \u201cset it and forget it\u201d mentality. It\u2019s really incumbent upon the end-user to create a culture of security within the organization, which Kelley Connect helps facilitate.<\/p>\n\n\n\n
\u201cIf somebody clicks on a phishy email, their first reaction is to slide a little lower in their cube and hope nobody else knows they clicked on a bad link,\u201d he observed. \u201cWe really preach that if you\u2019re the one to click on a bad link, stand up in your cube and yell about it, so the next person doesn\u2019t click on it.\u201d<\/p>\n\n\n\n
Fake or test phishing emails coordinated by Kelley Connect are a necessary evil. Anderson pointed out that 91% of vulnerabilities come via phishing expeditions by the so-called bad actors. <\/p>\n\n\n\n
\u201cWe\u2019re sending out phishing emails with the idea that if you click on one, you have just volunteered yourself for additional training,\u201d he added.<\/p>\n\n\n\n
Laying Groundwork<\/strong><\/p>\n\n\n\n
At the Les Olson Company, client engagement centers on the fundamentals of education, risk assessment and immediate issue resolution, according to Keith Adams, vice president of IT for the Salt Lake City-headquartered firm. It starts with a review of systems, followed by a patching process (including security patching) for known hardware\/software issues to ensure systems are up to date. Antivirus products are installed and monitored for each system within the client\u2019s environment.<\/p>\n\n\n\n
Beyond the baseline, Les Olson Company determines the needs and business objectives of the customer, including applicable industry standards to which the client must adhere. \u201cIn every case, we ensure the customer is fully aware of their basic needs and the extended solutions that we can bring to enhance their environment,\u201d Adams said. \u201cEnsuring that all systems are monitored is of primary focus, as any system that is put into place is only as good as its ability to perform, combined with regular assessments of that performance.\u201d<\/p>\n\n\n\n
Depending on the needs and risk mitigation level sought by the client, Les Olson Company offers a full suite of next-generation products that can augment an environment\u2019s defenses. Some examples:<\/p>\n\n\n\n
Email gateway defense, including attachment and URL sandboxing.<\/li>
Two-factor authentication for cloud or on-premise systems.<\/li>
SIEM (security information and event management) deployment with 24\/7 SOC monitoring and anomaly notifications for remediation.<\/li>
SOC monitored and managed software to cover threat detection above and beyond traditional AV. This software includes patented AI algorithms that can help the endpoint self-defend and heal with the advantage of oversight from the SOC team 24\/7 to ensure detections are appropriately managed, not simply left to AI.<\/li><\/ul>\n\n\n\n
Keith Adams, Les Olson <\/figcaption><\/figure><\/div>\n\n\n\n
Adams notes that additional software may be deployed to systems that monitor an oft-neglected area of security\u2014the \u201cundetected\/new process\u201d\u2014that may lie dormant, awaiting a trigger. \u201cWith traditional antivirus and threat detection software systems, you are left with two primary areas covered: detection of the known threat (traditional signature-based AV), and software meant to detect abnormal activities such as spontaneous encryption (threat detection),\u201d he said. \u201cOur additional solution looks for any new foothold in the startup, login or process execution areas of systems and, when they are present, they are analyzed and categorized. Should a system produce a finding that is considered a threat, immediate notification to our team is sent along with a specific process to mitigate the potential actions of the detected threat.\u201d<\/p>\n\n\n\n
We also require our team members to train and certify on firewall products and their complementary systems prior to being able to work on or configure systems for customers.<\/p> \u2013 Keith Adams, Les Olson <\/cite><\/blockquote>\n\n\n\n
In terms of security standards for staff, Les Olson Company has a full repository of customer-specific needs for security; approvers for work, settings and changes; along with ticketing for all requests. The dealer ensures standards are met on a customer-by-customer basis through regular training based around its policies, along with continuous reviews and updates of documentation and supervisor review of user work (ticket work audits). Team members may only use approved tools, including systems that are encrypted and protected via unique token, two-factor authentication.<\/p>\n\n\n\n
\u201cWe also require our team members to train and certify on firewall products and their complementary systems prior to being able to work on or configure systems for customers,\u201d Adams added. \u201cEven when someone has completed the training process, we will typically require a senior engineer with specialization in that product to review or verify the configurations.\u201d<\/p>\n\n\n\n
As part of its ongoing training platform, Les Olson Company provides security awareness training and tests clients through phishing and vishing maneuvers. Much of its training is focused on the systems and certifications from specific vendors for the products the dealer provides, and includes extensive lab work and testing. In addition to online training and curriculum systems for general industry knowledge and baseline certifications, Les Olson Company is implementing a learning management system for training content and testing of content unique to its business or customers.<\/p>\n\n\n\n
Mike Burgard, Marco <\/figcaption><\/figure><\/div>\n\n\n\n
When it came time for Marco to pick a security framework, the St. Cloud, Minnesota-based firm opted for NIST, which is what most of the regulatory frameworks (including banking, health care and government) are based upon. Mike Burgard, Marco\u2019s chief information security officer (CISO), notes the dealer wanted to ensure its offering covered five different phases in NIST CSF and was fortified with the products and services that fulfilled the requirements in each phase within the framework. That translated into defensible solutions and optimal client security protection. <\/p>\n\n\n\n
The training component has to continually evolve to address newer threats. Unfortunately, there\u2019s persistence from an adversary perspective, and that calls for constant due diligence. <\/p> \u2013 Mike Burgard, Marco <\/cite><\/blockquote>\n\n\n\n
In dealing with various client verticals including the aforementioned, Marco has certification\/accreditation requirements that are required for doing business in various regulatory environments. In fact, the dealer built its onboarding and offboarding procedures to ensure it remains compliant, which comes back to its framework alignment.<\/p>\n\n\n\n
\u201cHaving strong framework alignment really does aid throughout the process in building standard processes and standards of work,\u201d Burgard said.<\/p>\n\n\n\n
End-user security awareness training for Marco is delivered via KnowBe4, which it not only resells, but consumes as a customer. Burgard believes the value of the security awareness training extends beyond work applications, as users can apply it in their personal lives. Burgard particularly values the real-time remediation training that provides red flags for users to watch and guidance on how to handle suspicious emails moving forward.<\/p>\n\n\n\n
The days of obvious scams (remember the Nigerian prince hoax?) have given way to evolved tactics being used by bad actors wishing to infiltrate networks. \u201cThe training component has to continually evolve to address newer threats,\u201d Burgard said. \u201cUnfortunately, there\u2019s persistence from an adversary perspective, and that calls for constant due diligence. Attackers are now using good platforms, like Microsoft or Google, so these things get through traditional email security products.\u201d <\/p>\n\n\n\n
According to the FBI, phishing was the No. 1 cybersecurity incidence in 2019 that resulted in the highest dollar loss for organizations, Burgard said. \u201cAnd phishing is not new, it\u2019s been around for years. It\u2019s not going away anytime soon.\u201d <\/p>\n","protected":false},"excerpt":{"rendered":"
While high-profile ransomware attacks have dominated technology headlines primarily in the last 10 years, it might be surprising to learn that the first documented attack launched in an effort to extort money occurred in 1989. Although computer worms have been around since the early 1970s, evolutionary biologist Joseph Popp garnered the distinction of creating the first for-profit attack with the AIDS Trojan. Disseminated through Popp\u2019s postal mailing list and spread by a floppy disk, the Trojan horse replaced the AUTOEXEC.BAT file in computers. On the 90th boot following infection, the Trojan hid directories and encrypted the names of all files on the C drive, effectively paralyzing the computer. Users were then asked by PC Cyborg Corp. to renew their \u201csoftware lease\u201d via sending $189 to a post office box in Panama. While Popp may have been the unofficial godfather of cybercriminals, the AIDS Trojan suffered from poor design\u2014only the names, not the files, were scrambled\u2014and could be easily removed. As for the eccentric Popp, he was arrested, declared mentally unfit to stand trial and deported to the United States (he passed away in 2007). The sad postscript is the manner in which he perpetrated the act: Popp claimed to have devised a questionnaire that would effectively determine patients\u2019 risks of contracting the AIDS virus, and he mailed 20,000 copies of the disk to researchers in 90 countries. Popp reportedly did not profit much from his nefarious scheme; scientists and researchers were not as gullible as he\u2019d hoped\u2014they were intelligent enough to discover the workaround. Had it been proliferated among the general population, particularly in the early days of the home computer, it likely would have ensnared many more victims. Even 30 years later, cybercriminals are still figuring out ways to lure unsuspecting employees into clicking on links and files that launch a world of problems for their employers. Thus, dealers who supply security components among their IT offerings to protect servers, data centers, printers, network-connected and employee-introduced devices must also protect end-users from their own bad judgment. As part of the September State of the Industry report, we canvassed some of the industry\u2019s top providers of security solutions to see how they establish their platforms and maintain competency standards to help protect clients from themselves. When Impact Networking of Lake Forest, Illinois, made the decision to build out its own managed security practice, it studied a number of all-encompassing, out-of-the-box third-party solutions. But while several offerings boasted a variety of strong components within the overall package, there were usually other elements\u2014such as antivirus and security awareness training\u2014that left something to be desired, according to Patrick Layton, vice president of managed IT for Impact Networking. The dealer wanted its managed security practice to be on par with the level of service it provides across its product and service menu. In looking at the marketplace and the solutions that were available to certain types of clients, we saw the same surge of problems popping up in the security industry. \u2013 Jeff Leder, Impact As a result, Impact Networking budgeted the necessary dollars and set up a one-year timeframe to develop its own competencies, which entail best-of-breed products across nine categories. \u201cIn looking at the marketplace and the solutions that were available to certain types of clients, we saw the same surge of problems popping up in the security industry,\u201d noted Jeff Leder, director of managed IT security services for Impact Networking. \u201cSo our goal was to define those problem categories and identify the solutions that would address them. Working out partnerships and determining how we can deliver that as a managed solution set for clients through a larger security program was a big part of it. Once we got that established, it was just a matter of engaging a process in which every time we work with a prospective client, the goal is to educate them on the problems they have and show the types of solutions that can address them.\u201d Home Grown Security competency begins at home, and Impact Networking is certainly no exception. The dealer, which prior to the pandemic had rolled out two annual Optimize IT & Business Security Summits that drew upwards of 1,000 attendees, is its own customer as well, and educates employees in the same manner as clients. They\u2019re trained on the secure use of their own network, data and tools, with extensive training and testing. On the security side, a new cybersecurity engineer\u2014tasked with performing vulnerability and penetration testing\u2014will need credentials such as PenTest+ (CompTIA), CEH (certified ethical hacker) or OSCP (offensive security certified professional). Cybersecurity analysts require certifications that speak to defending and monitoring infrastructure. On the account management side, a vCISO (virtual chief information security officer) should tout CISSP (certified information systems security professional) and certifications\/education that enable them to communicate in a meaningful way to business owners and decision makers. Compliance certifications will help team members engaged with client verticals that have specific line-of-business requirements. When it comes to ongoing training of staff and end-users, Impact Networking\u2019s go-to solution is KnowBe4, one of the leaders in security awareness training. According to Layton, the dealer provides phishing tests for end-users, and client managers get detailed reports and notifications regarding employees who \u201ctake the bait.\u201d Various education tools are used, and peer pressure (pointed notes from end-user managers) can also be effective in identifying and ensuring offenders do not repeat bad habits. BrainStorm, a learning management tool, also allows for custom content such as educational videos. \u201cThere are some training and educational components that go along with certain regulatory compliance,\u201d Leder added. \u201cWe have additional tools and resources that have been developed in-house, in addition to some of the managed solutions we offer, so that we can help client organizations educate users specifically in relation to those types of compliance as part of the managed compliance program.\u201d Earlier this summer, Gordon Flesch Company announced the creation of Elevity. This marriage of its managed IT division and recently acquired Information Technology Professionals supplies cloud, managed […]<\/p>\n","protected":false},"author":166,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[1641],"tags":[],"_links":{"self":[{"href":"https:\/\/www.enxmag.com\/twii\/wp-json\/wp\/v2\/posts\/41274"}],"collection":[{"href":"https:\/\/www.enxmag.com\/twii\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.enxmag.com\/twii\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.enxmag.com\/twii\/wp-json\/wp\/v2\/users\/166"}],"replies":[{"embeddable":true,"href":"https:\/\/www.enxmag.com\/twii\/wp-json\/wp\/v2\/comments?post=41274"}],"version-history":[{"count":7,"href":"https:\/\/www.enxmag.com\/twii\/wp-json\/wp\/v2\/posts\/41274\/revisions"}],"predecessor-version":[{"id":41289,"href":"https:\/\/www.enxmag.com\/twii\/wp-json\/wp\/v2\/posts\/41274\/revisions\/41289"}],"wp:attachment":[{"href":"https:\/\/www.enxmag.com\/twii\/wp-json\/wp\/v2\/media?parent=41274"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.enxmag.com\/twii\/wp-json\/wp\/v2\/categories?post=41274"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.enxmag.com\/twii\/wp-json\/wp\/v2\/tags?post=41274"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
![\"\"](\"https:\/\/www.enxmag.com\/twii\/wp-content\/uploads\/2020\/08\/Jeff-Leder-Impact.jpg\")
![\"\"](\"https:\/\/www.enxmag.com\/twii\/wp-content\/uploads\/2020\/08\/Patrick-Layton-Impact.jpg\")
![\"\"](\"https:\/\/www.enxmag.com\/twii\/wp-content\/uploads\/2020\/08\/Paul-Hager-Gordon-Flesch-Co.jpg\")
![\"\"](\"https:\/\/www.enxmag.com\/twii\/wp-content\/uploads\/2020\/08\/Scott-Anderson-Kelley-Connect.jpg\")
![\"\"](\"https:\/\/www.enxmag.com\/twii\/wp-content\/uploads\/2020\/08\/Keith-Adams-Les-Olson.jpg\")
![\"\"](\"https:\/\/www.enxmag.com\/twii\/wp-content\/uploads\/2020\/08\/Mike-Burgard-Marco.jpg\")