Cyber Security and Digital Devices

What is Cyber Security?

Cybersecurity is the practice of protecting computer systems, networks, and digital information from theft, damage, or unauthorized access. It encompasses a wide range of technologies, processes, and practices designed to safeguard digital assets and data.

Watch

Watch the video below from Murdoch University to find out more about why cyber security is more important than ever.

Digital Devices

In managing a business’s cyber security, a useful definition of ‘digital devices’ is items that use technology to perform a function and are connected to a business’s network. On first look, identifying digital devices may seem simple. In any business, the personal desktop computers, laptops and mobile phones used operationally are certainly digital devices. On closer inspection, the spectrum of devices in a business is broader. Consider the USB (universal serial bus) sticks, portable hard disks and the printers in your office. All these devices connect to a business’s network.

Any device that connects to a business’s network has the potential to be exploited to facilitate access to malicious agents. In effect, they open a business to be ‘hacked’. Furthermore, digital devices often store valuable confidential business information. Ensuring that a business knows what devices connect to its network and what is stored on these devices is a fundamental cyber security routine.

The Internet of Things

The Internet of Things (IoT) has opened a next level of network connectivity. In effect, the idea that a digital device is a form of computer is now incorrect. Everyday objects such as microwaves, televisions and even wearable fitness devices provide connectivity using internet communication protocols such as TCP/IP (Transmission Control Protocol/Internet Protocol) and Bluetooth. In effect, IoT devices can be controlled remotely as a part of a network.

A whiteboard used to be just a whiteboard, but now, an IoT-enabled whiteboard is able to interact synchronously with the wider set of digital devices across a business by being a part of a business network.

Watch

Watch the video below to learn more about the concept of the Internet of Things:

The Need for a Registry

In the early computing era of the 1940s and 1950s, computers were standalone. Processing data and creating reports, computers were not part of an integrated network. At this time, data security was focused on physical information security. For example, the paper reports of data runs or copies of data on physical tape reels were guarded. A data breach occurred when a human acted to remove the information from what was a secure facility.

Networking changed the requirements for data security. Not only could data be copied over the network, but it could also be deleted or encrypted to stop a business operating. Critically, networks allowed remote access. This created a new vector of attack that could be exploited by malicious third parties.

Networking also allows devices to ‘roam’. With employees working from home over laptops and phones, devices exist outside the primary internet security of a business – typically a firewall. Not only is there a vulnerability for illegal access to a business’s network, but there is also the potential that devices can be lost. When a member of staff loses their business phone, the business data that was on the phone is lost with it.

Knowing what devices connect to a network allows for better addressing of cyber security issues, including the:

• itemisation of the business data that the devices contain
• itemisation of methods of network connection that a device uses
• classification of the device type – who is responsible for the device, and what the device is (software/ hardware).

Having a registry of digital devices enables planning for maintaining cyber security, and being prepared to act in the event of a security breach.

MAC Addresses

On any network, every device will have a unique MAC (media access control) address. The MAC address provided to a device is a 48-bit or 64-bit number that is designed to be complex so that the chance of two devices on the same business network having the same address is virtually nil.

A digital device registry should include the MAC address of each device listed. The international standard for MAC addresses is maintained by the Institute of Electrical and Electronics Engineers (IEEE). Large businesses looking to ensure the MAC addresses on their network are globally unique can purchase custom blocks of MAC addresses from the IEEE, rather than rely on the native MAC addresses loaded to the devices they purchase.

Watch

Watch the video below to learn more about MAC addresses:

MAC Spoofing

It is possible to change a MAC address on a device. Relying on allowing only devices with a range of MAC addresses is not a successful cyber security model. Rather, it can be a part of a wide range of defenses to build an in-depth approach to cyber security. Changing MAC addresses is a technique called ‘MAC spoofing’.

Vectors

In cyber security, the concept of a vector is the principle by which all security breaches are facilitated. A vector is the method that a third party uses to illegally gain access to private information to exploit a business’s or private citizen’s technology for any means – financial gain or malicious intent.

The range of vectors is broad and spans from physical to technology exploits. Some vectors are well known, such as using an authorised person’s user ID and password (their identification/authorisation pair) to gain access to a system. Some vectors are less well known. A physical vector employed by third parties looking to gain access to a business’s IT systems is to leave unbranded USB sticks in company car parks. When the curious staff member plugs the USB stick into their computer, an exploit is opened, allowing a malicious third party to access the activity on that PC. This can include key trapping the actual username and password of the user to gain access to the business’s backend data.

Legal and Code of Conduct Responsibilities

Beyond ensuring a critical step in creating a business’s cyber security envelope, there are direct regulations and indirect codes of conduct requirements for cyber security in Australia. The legal framework for cyber security extends further, and the compliance requirements noted here pertain only to the need for creating a digital device registry.

Direct Regulations

The Privacy Amendment (Notifiable Data Breaches) Act 2017 (Cth) and the Privacy Act of 1988 (Cth) require businesses to inform the Office of the Australian Information Commissioner (OAIC) when personal information has been accessed by unauthorised third parties. According to the OAIC, this occurs when:

• a device with a customer’s personal information is lost or stolen
• a database with personal information is hacked
• personal information is mistakenly given to the wrong person.

According to the 2017 amendment in the Privacy Amendment Act, Division 3, subdivision A:

The entity in this case is the business that has had personal data of individuals exposed. To be organised and able to identify the source of a data breach and respond with an ‘expeditious assessment’, a business should maintain a device registry.

Furthermore, the Privacy Amendment Act requires businesses to inform all individuals affected by a data breach likely to do serious reputational harm.

Without a device registry, fundamental information as to the source of a breach is not readily at hand and can, in the case of a company, constitute a breach of care and diligence under the Corporations Act 2001 (Cth), which makes company directors personally liable. As the penalties for privacy breaches for individuals and businesses range from tens of thousands to millions of dollars, ensuring best practice cyber security and maintaining a digital device registry is critical.

All Australian businesses with a turnover of more than $3 million and/or are involved in the finance, health or contract with the government must comply with the Notifiable Data Breaches amendment to the Privacy Act of 1998.

Indirect Codes of Conduct

The Australian Securities and Investment Commission (ASIC) maintains the voluntary ‘Cyber Resilience Good Practices’ code of conduct. Within the code, there is a direct reference to maintaining a centralised digital device registry: ‘Asset inventories for hardware, software and data, both internal and external to organisations, are managed through a centralised asset management system.’ A digital device registry is a central plank of a best practice cyber security approach.

While the ASIC code is voluntary, when considered in the light of the direct regulations discussed previously, it is advisable for businesses to follow it. As Australia’s business oversight and regulatory enforcement agency, ASIC’s advice, when followed, demonstrates a business has adopted a best practice approach.

The device registry is a key cyber security resource. The registry is one of the resources a business requires to build a viable cybersecurity model.

Creating a Digital Device Registry

Creating a digital device registry is a time-consuming task. Considering that a typical business has numerous devices of various types, with a range of hardware and software configurations, there is more to the process than simply itemising each device. For example, a registry needs more information than an entry, such as the number of PCs in the head office.

A registry needs to list a minimum of six points:

1. Location/device owner – This itemises the literal physical location of the device or the person responsible for the device.
2. Device name – This provides a unique common name, such as ‘office printer’ or ‘home laptop’, to identify the device.
3. Type of computer/device – This relates to the hardware and software of a computer/ device. This assists in the application of software patches to keep devices up to date with the latest functional and cyber security software.
4. Device MAC address – All digital devices on a network will have a unique MAC address. This should be recorded as the unique identifier. MAC addresses are translated into IP addresses on a business network. Depending on where a device is plugged in (e.g. which specific wall port it is cabled to), the IP address can change; however, the MAC address remains unchanged. Once the registry is complete, it is possible, through inclusion of the MAC addresses identified, to exclude any MAC address not in the registry from accessing the business network. On a firewall, this is called ‘MAC filtering’.
5. Method of access – Is the device connected to the business network after validating a username and password? Does the device require a virtual private network (VPN) to connect? 
6. Patch level and data held – Business policy typically requires users to rely on networked data access rather than local storage, although local storage of sensitive information can occur. Regardless, depending on the applications on the device, the range of data that can be accessed varies. This is especially true when devices are used by one team or an individual in a business. Consider, for example, a PC used by the accounts team. This PC may store local data about the business’s clients. A PC on a shop floor may contain parts inventory information.

There may be other fields a business wishes to add, such as valuation of the device. For strictly cyber security purposes, the six fields listed are the minimum requirements for the registry. Note that USB sticks and portable hard disks, while digital devices, do not have MAC addresses, and in a digital device registry, their MAC address field should be empty. Only devices with a network interface card (NIC) have a MAC address.

Depending on the size of the organisation, the approach to cataloguing digital devices will vary. In a small business with a single location and limited mobile devices, it is sufficient to methodically audit each device. The audit is often done by IT staff.

In bigger organisations, referring to the asset inventory in the business’s finance and accounting package may be the first step. As bigger companies may have multiple locations, creating a registry of devices will likely be performed by more than one person, although managed by a single role, such as the IT security officer.

The objectives in both cases remain the same:

1. Create a list of the digital devices connected to the business network.
2. Identify their working hardware and software, and how each device is attached to the network.
3. Identify the data that each device stores and the role the data plays in the business.

Achieving these objectives means that each device can be assessed for its risk level for a data or access breach, and the threat the risk poses to the business.

Follow these steps to create a digital asset registry:

As noted previously, cataloguing in detail the range of digital devices in a business, big or small, requires time and effort. Furthermore, it requires the cooperation of people across the organisation. As a result, before undertaking the exercise, it is important that senior stakeholders in the business are aware of the requirement and support the process.

Business stakeholders should always be engaged with, and briefed on, any cyber security initiative. Their support ensures cyber security policy, processes and behaviours are a requirement in the workplace and greatly assists in establishing a culture of thinking about information security and access.

Note: A ‘patch’ is a small update to a computer’s or phone’s operating system, such as iOS (iPhone Operating System), Windows or Android. An ‘upgrade’ is a release that significantly changes the entire operating system

Maintaining a Device Registry 

Without periodic updating of the digital device registry, the contents of the registry will become out of date. Whenever devices are removed from the network for any reason, or new devices added, the business policy should ensure that the group or individual maintaining the registry is informed. This is often the person responsible for IT in a business.

Changes occur over time in the devices a business uses due to:

• new equipment purchases replacing redundant or failed digital devices
• purchases of entirely new equipment
• old equipment being sold or retired
• devices, especially mobile devices, being lost or stolen.

To manage the recording of these changes, aside from lost or stolen devices, a business’s procurement policy should ensure as part of the process that changes in equipment are recorded.

When devices are lost or stolen, the business’s mobile devices policy must describe the process for reporting a missing device to the business. All businesses should have a policy describing the allowable and prohibited use of mobile devices supplied to staff. When digital devices are lost, early reporting allows a business to react to the loss, to quickly assess the potential impact on cyber security – as well as manage insurance and claiming any loss.

While policies can be put in place to ensure the digital device registry stays current, there are instances when policy may not be followed, and the registry becomes out of date.

When this happens, not only does it increase the potential for security breaches, but non-registry-listed devices often will not be maintained with the latest local cyber security protection.

To manage the currency of the registry, the registry keeper should:

• Check with procurement in a monthly business meeting to discover whether there has been procurement of digital devices and to ensure any new device has been added to the registry.
• Have the IT group run a weekly report to list all the MAC addresses on the businesses network. A MAC address included in this report but not the registry is considered an unknown device and should be removed from the network. The process of compiling the report and comparing it to the register to identify unknown MAC addresses can be automated by competent information technologists. 

Typically, when a device is removed from the network, IT support or the appropriate support person is notified. Why the device was connected and what the device is can then be determined.

Using USB and Portable Storage Devices

As noted in the case study ‘Making a Digital Registry’, a sound cyber security policy excludes USB sticks and portable hard disks from the set of authorised devices. While they can be convenient, cloud storage with file management is equally convenient and typically, in quality cloud storage solutions, has a secured environment that blocks unauthorised access.

USB and portable storage devices provide a vector to connect malicious software hidden on these devices to a business’s network. For example, a USB stick may contain network access software to allow external access first to the USB stick and then to the host PC.

Furthermore, when a business uses USB and portable storage devices to move and store files, the risk of data loss from a device failure, and the risk of devices being stolen are real cyber security vulnerabilities. As such, it is advisable that businesses use a reliable cloud service and not include USB and portable hard disks in the list of allowable digital devices.

Watch

Watch the video below to learn how ‘juice jacking’ works and the vulnerability it creates. In effect, a USB carries power and data at the same time, and plugging in a device allows charging and can facilitate third-party actors to access the digital device:

Activity - Mapping digital devices

Data Policy and Exceptions

Ideally, a business should not allow business data to be held on digital devices. As in the case study ‘Lost Digital Device’, any data exposure can be exploited, resulting in a degree of business loss. It is recommended as a matter of policy that:

• No business data is store on digital devices.
• Digital devices do not retain stored user ID and passwords allowing third parties to access business software if they have illegally obtained a device. In effect, users must always log on to systems and cannot use browsers or Windows/Mac systems to remember user IDs and passwords.
• Email is read online through a secure browser, and no business emails are stored locally. If a device is lost, no one will be able to read emails on the phone or laptop as they are not stored on the device.

This is ideal. However, a business may decide that some business data, for convenience, can be stored on digital devices, as the data is not business critical. Also, especially on mobile phones, contact lists and SMS traffic are stored locally by default. (There are third-party applications that claim to perform encryption of contacts and SMS messages. However, they are outside the Android native architecture and should be looked at very carefully before use.)

So, for reasons of efficiency and operational reality, digital devices may contain some business data. However, under no circumstances should highly sensitive data be outside the cloud and stored on digital devices as a matter of policy. Furthermore, SMS traffic should not reference sensitive business information. Business policy should stipulate a range of communications that should be used depending on the data to be carried. For example, emails with encrypted documents may be required to ensure only an intended recipient receives the document.

Watch

The IBM Cloud allows for enhanced data security. Watch the video below to learn how the IBM Cloud acts to secure a business’s data:

In the case study ‘Making a Digital Registry’, the GM of ACE Pty Ltd performed an audit to create a digital device registry.

While the device registry was complete for the devices staff use, the registry did not address the systems and network infrastructure the business relies on. For a business such as ACE with a central ordering system that the staff log on to, digital devices such as the following will also exist:

• 1 x server running web server and firewall, with an order system as a database and software
• 1 x network access point with internet connectivity. These devices require a higher level of oversight and cyber security focus.

The business’s core sales/distribution, accounting, stock management and human resources/payroll modules run from the server with connectivity facilitated by the access point.

While the loss of a laptop, phone or desktop PC is consequential, recovery to maintain effective cyber security in a business is not threatening to the business’s operation.

If any of the following happen to ACE’s server, ACE’s business operation will be severely interrupted:

• The server is physically stolen.
• The server’s web server is remote accessed, and data is encrypted on the database with ransomware.
• The server’s network suffers a distributed denialof-service (DDoS) attack on the application server, flooding it with access requests. 

Critical infrastructure provides a vital business function that, if breached by hackers, threatens the business’s operation.

When securing critical network and server infrastructure, such as ACE’s IT servers, always:

• Ensure the servers are included in the digital device registry.
• Ensure the data that is on the devices is fully identified - for example, where the marketing resources are held (on the database server).
• Ensure that protocols for security management are highest for critical resources and, in the event of a breach despite active layers of protection, there is effective contingency to recover quickly with minimum disruption.
• Prioritise devices based on their role and the data they contain - 'prioritise' meaning to apply higher levels of physical security, policy and procedure requirements, and software management (such as patch application).

Businesses will have limited cyber security budgets and personnel, so prioritising where effort and resources are applied in building a cyber security environment ensures that high-risk assets are identified and receive the most attention. Critical infrastructure will be a more valuable target for hackers, and prioritising business servers and network assets focuses attention on where penetration attempts are more likely to occur. For example, it is more attractive to access a business’s client database than a single PC (which is non-critical to the overall business operation).

Watch

A DDoS attack is designed to disrupt operations rather than steal data. Watch the video below to learn about DDoS attack methods:

A device registry is a map of a business’s digital devices. It describes the potential attack surface that third-party actors can exploit to gain access to a business’s IT infrastructure. By allocating priorities to device types, effort and finance is spent on securing devices that pose the greatest threat to a business.

A security protocol is a hardware or software method to provide cyber security. Depending on the cyber security risks a business must manage, there is a range of protocols that can be deployed. Why not simply apply the maximum strength protocol to all digital devices used in the business?

There are three limitations that influence the scope of protocols available to a business:

• Cost – There is a cost to providing cyber security, and depending on the business, budgets vary.
• Practicality – Adding security does not improve speed and productivity. It is typically a choke point on business operations, and high-end cyber security may be impractical for day-to-day
• Need – Desktop PCs on the business’s network can have simpler forms of protocols (such as login/password access), while mobile phones outside the network require multiple authentication methods. Depending on the device, the protocol varies accordingly operations.

The principal of cyber security is to protect the CIA of a business:

C - Confidentiality of a business’s data

I - Integrity of the data from unauthorised changes

A - Availability of the business’s data to ensure operational continuity

This is known as the CIA triad in cyber security and simplifies the reasons for the measures taken to provide a secure digital environment.

While not exhaustive, the following table details common and powerful digital assets for use in developing cyber security protocols for digital devices:

Each of these protocols can be categorised as satisfying contribution to cyber security to ensure CIA to systems and data. They do so by limiting the risk that an unauthorised ‘actor’ will seek to access and compromise a business’s operational IT systems.

Actors

A formal term, the word ‘actor’ has been used to describe third parties looking to exploit IT vulnerabilities. The following are common types of actors who seek to access business systems illegally:

• Script kiddies – It is possible to buy hack tool kits online that use common exploits. As simple to use as a toaster, such kits are typically unable to gain access to IT systems that have a coherent cyber security policy requiring digital devices be updated with the latest security patches.
• Black hats – Black hats are deeply immersed in cyber security and typically belong to networked crews of people who actively research, find and use new exploits to gain access to IT systems. Their targets are typically large corporations. Reasons for attacks include:
  • locking systems to require payment (usually in Bitcoin) to allow normal business to continue – a financial gain
  • threatening to publishing sensitive data or destroy systems – for a financial gain.
• Hacktivists – A form of black hat, hacktivists typically have a political agenda and often steal and publish sensitive data to support a change agenda.

Cyber security ‘hardening’ to reduce potential vectors into a business’s systems is a continual process of monitoring, upgrading, analysing and researching vulnerabilities.

In typical business risk management, removing risk by changing processes and mitigating risk by predictive observation is reasonable. In effect, the probability of an event occurring has a role in the amount of effort applied to manage the risk.

With cyber security, it should be reasonably assumed that a full range of hacking attempts will be made, including attempts yet unknown.

Cyber security risk management should always lean to removing risks entirely. The outcome of cyber attacks will always lead to business interruption. While budget plays a significant role in being able to close down gaps in security, strong enforcement of tight cyber security policy, coupled with best practice management, will make a business a ‘harder nut to crack’ and less attractive to malicious third parties.

Cyber security should always look to remove risk, rather than live with it.

Watch

Quiz