SECTION 9 Cyber Security

On Friday, November 30, Alaska was hit by a 7.0 earthquake. This happened just outside of Anchorage where we live. This was an experience we will never forget. We thought we would share some of the things we’ve experienced since the earthquake happened.

Time to look at controls 4-6. This is where things get a bit tricky. Do you have the skills to deploy these controls? That’s a question we have to ask our selves. In some cases, we don’t. This is just the beginning. Dorothy and I have a long way to go before we can deploy the first 6 controls.

It’s time to take a look at the first three Critical Security Controls. What are they? How do they keep your organization secure? How are we going to implement them? There’s a lot to think about with the first three. Our goal is to implement the first 6. We have a long way to go.

We’re trying to use the CIS Critical Security Controls as an audit process. We go over some ideas we’ve come up with. It will take us time to refine the process. We also go over some of the tools we might use. Tools like Nessues for vulnerability scanning. We also talk about ITSM solutions for managing everything.

I’m taking the SANS 566 course, Implementing & Auditing the Critical Security Controls - In-Depth. We talk about why I’m taking this course.

In this episode we track down devices on a switch using mac addresses. Sounds simple enough. Took a project that forced me to think in different ways to realize this. I add Nmap scans and a spreadsheet formula for good measure.

We started out talking about Dorothy’s Cisco switch configuration. It quickly morphed into a conversation about vulnerabilities. It turns out that the switch doesn’t support ssh. It could also have other vulnerabilities. Think of this conversation as a quick risk assessment.

Rather than jumping up and down about possible security issues, we evaluate the situation. Sometimes things aren’t as bad as you think they are.

We did it! Or I should say Dorothy did it. She deployed her Asus Router on her home network. The deployment was flawless. We talk about the process and some of her fears. We also talk about how the OWASP Top 10 can be used in this situation.

The OWASP Top 10 is a list of vulnerabilities or weaknesses. In this case we want to think about the vulnerabilities in the Asus Router. Once they’ve been identified, we want to take them out or make them more secure.

This was a big step in the right direction. We still have a long way to go before Dorothy’s network is secure.

Dorothy and I review the OWASP top 10 and my failure at answering one important interview question, “What is the OWASP Top 10?”. I recently had a job interview for an information security analyst position. I was asked some general security questions. All of which I think I answered OK. Then I was asked, “What is the OWASP Top 10?”. My answer was terrible.

We found time to configure the Asus router and the Cisco Switch. We also found time to do a partial configuration of our Palo Alto firewall. To configure these devices we needed a basic understanding of vlans, subnets, and routing. Dorothy and I talk about how this knowledge is used in network design, security and configuring devices. We’re a couple of steps closer to deploying Dorothy’s new network.