How to start a Career in Cyber Security

I received an infographic by cybersecurityjobs.net on the top ten tips on landing a cyber security job, I  thought it provided excellent advice for budding cyber security professionals looking to gain a foothold. 

There is a considerable shortage of experienced cyber security professionals in the UK, but starting out in cyber security is a 'chicken and egg' scenario, in that it can be difficult to land a cyber security job without having the experience, but you can't get the necessary experience without being in a dedicated cyber security role. 

If you are struggling to get into the industry I recommend initially specialising in a specific area of security, undertake training and gain qualifications. Be patient, expand upon your areas of knowledge and experience, working your way up in different roles to your dream cyber security job. Dream big, but think small.

Krack WiFi Attack: Vulnerabilities in WPA2 Protocol

All Wi-Fi connections are potentially vulnerable to a newly discovered security attack called "Krack", which allows an attacker to listen in on internet traffic (a Man-in-the-Middle Attack) over a wireless network. 

In theory, a hacker could read your web and email communications, and even inject malware like ransomware onto your device. Krack takes advantage of unpatched Apple, Android, and Windows operation systems, while unpatched Wi-Fi access points can be manipulated to orchestrate the man-in-the-middle attack.

The sky is not falling in on WiFi, this is not like the WEP protocol situation of many years ago, WEP is a security protocol fundamentally flawed by design, WPA2 encryption is not broken, the software that uses it needs to be corrected to secure it. Wireless Access Points (APs) and operating systems that use WPA2 are (or soon will be) patchable, which protects them from this attack.

For a video demo of the attack see - https://www.krackattacks.com/#demo 

For the full technical details of the WPA2 flaw and attack method see - https://papers.mathyvanhoef.com/ccs2017.pdf

Wireless Usage Advice

• Make sure your laptop operating system has the very latest security updates patched (always) i.e. Windows, Linux, Mac. Microsoft said they have already patched Windows systems, but at this time have not confirmed details about which patch it was. Several Linux distributions have released patches for the flaw.

• Make sure your smartphone and tablet devices have the latest security updates patched, especially Android devices, and Apple, and Windows (if anyone still uses it)

• As always, if you are going to use public WiFii networks, my first suggestion is to avoid using public WiFi, but if you are, use VPN software. Using a secure VPN will protect you against "Krack exploited" public WiFi access points, regardless of patching and whether AP is exploited. Failing that, if you like to take risks with your personal and confidential information, as a very last resort ensure you use "https://" websites only, and be extra vigilant the "https://" do not revert to "http://".  If it does, it is a clear sign of a compromised wireless network and of your connection to it.

Preventing Your Wireless Access Point from being Exploited

Wireless Access Points (AP) firmware versions are presently being updated and released to fix this WPA2 flaw, apply them with they are released - see https://www.kb.cert.org/vuls/id/228519/. AP firmware patches are often missed, as routers updates tend not to be applied automatically.

Cyber Security Roundup for September 2017

A massive data breach at Equifax dominated the UK media finance headlines this month, after 143 million customer records were compromised by a cyber-attack, 400,000 of which were UK customer accounts. Hackers took advantage of Equifax’s negligence in not applying security updates to servers. The data breach has already cost the CEO, CIO and CISO their jobs. In the UK Equifax faces investigations and the prospect of significant fines by both the Financial Conduct Authority and the Information Commissioner's Office over the loss of UK customer financial and personal data respectively.

Hackers stole a quarter of a million Deloitte client emails, follow the breach Deloitte was criticised by security professional for not adopting two-factor authentication to protect the email data which they hosted in Microsoft’s Azure cloud service.

September was an extremely busy month for security updates, with major patches releases by Microsoft, Adobe, Apache, Cisco and Apple to fix an array of serious security vulnerabilities including BlueBorne, a Bluetooth bug which exposes billions of devices to man-in-the-middle attacks.

UK government suppliers using Kaspersky to secure their servers and endpoints may well be feeling a bit nervous about the security software after Kaspersky was banned by US Government agencies. The US Senate accused the 20-year-old Russian based security company as being a pawn of the Kremlin and posing a national risk to security. Given the US and UK intelligence agency close ties, there are real fears it could lead to a similar ban in the UK as well. A UK ban could, in theory, be quickly extended to UK government suppliers through the Cyber Essentials scheme, given the Cyber Essentials accreditation is required at all UK government suppliers.

While on the subject of the Russia, the English FA has increased its cybersecurity posture ahead of next year's World Cup, likely due to concerns about the Russian Bears hacking group. The hacking group has already targeted a number of sports agencies in recent months, including hacking and releasing football player's world cup doping reports last month. 

In the last couple of weeks, I was Interviewed for Science of Security, and I updated my IBM Developer Works article on Combating IoT Cyber Threats.

NEWS

• Equifax Data Breach: 143 Million Records Stolen, including 400,000 UK Customers
• Deloitte hit by Cyber Attack Revealing clients’ Secret Emails
• Kaspersky software banned from US Government Agencies
• Avast CCleaner used to Spread Backdoor to over Two Million Users
• NSA Cryptography Proposal Rejected by Allies
• Thousands of Amazon AWS Instances Host C&C Servers for POS Malware
• FA increases Cyber Security over World Cup 2018 Hacking Concerns
• Lenovo fined over Superfish Adware-Ridden Laptops
• 20% of Manchester Police computers at Risk of Ransomware - using XP
• BlueBorne: Billions of Bluetooth devices Vulnerable to MITM Attacks
• Apache Struts alters API code, Patch Critical Remote Code Execution Flaw
• Microsoft release Critical Security Updates for IE/Edge, Office, .NET, Skype & Windows
• Adobe Releases Fixes for 43 Critical Security Vulnerabilities in Acrobat and Reader
• Cisco patches remote code execution flaws in IOS and IOS XE
• Bashware Vulnerability could put 400 million Windows systems at Risk
• Joomla 3.8 Patches eight-year-old Credential Stealing Flaw
• Apple Patches a potentially Critical Vulnerability with iOS 11.0.01 Update
• Apple iOS 11 makes it harder for Law Enforcement to Access Data

AWARENESS, EDUCATION AND THREAT INTELLIGENCE

• Dragonfly APT Group Targeting Power Facilities
• SynAck Ransomware Attacks on the Rise - Active £325k Bitcoin Wallet
• Locky Ransomware back in Huge Spam Campaign; New Variant Escapes Sandbox
• Phishers Target LinkedIn users via Hijacked Accounts
• NIST Guidelines for Ransomware Recovery: Situational Awareness Vital
• Dolphin Attack could allow Hackers to take over AI Voice Assistants

REPORTS

• 2017 Global Internet Report: Catastrophic Worldwide Attack Feared by Experts