trends & actions to implement immediately

Trends & Actions to

IMPLEMENTIMMEDIATELY

CYB�SECUR�Y:

By Aninda Kumar Sadhukhan

As security threats have

changed over the years,

from structured query language (SQL) injection attacks to malware to

phishing and ransomware attacks, ONE RISK FACTOR HAS REMAINED CONSTANT:

HUMANSHUMANS. .

Copyright © 2021 by the Construction

Financial Management Association

(CFMA). All rights reserved. This article

first appeared in CFMA Building Profits

(a member-only benefit) and is reprinted

with permission.

Trends & Actions to

IMPLEMENTIMMEDIATELY

CYB�SECUR�Y:

By Aninda Kumar Sadhukhan

Unsecured

passwords, phishing, clickbaiting,

and other security risks

center around exploiting human tendencies to

inherently trust the information they are

presented with and act promptly.

Any approach to improve organizational

security must consider the effect of

humans and the culture of information

security in which they operate.

Exhibit 1 presents the most concerning threats in the U.S.; in our experience, more than 40% of the top cybersecurity threats are strongly influenced by a human factor in some way, shape, or form.

This article will discuss how to adopt cybersecurity mea-sures based on people, processes, and technologies to improve the security posture of your company.

But before implementing any cyber solution, it’s important to first look at what types of cyber breaches occur – and why they happen – to get a clearer picture of which areas to focus your attention.

What We’re SeeingCybersecurity breaches and incidents are overwhelmingly financially motivated – 86% of breaches and 65% of cyber incidents are motivated by financial reasons, and organized crime is by far the largest threat.1 Trustwave’s 2020 Data Security Index finds that malware and ransomware are the most concerning threats,2 and Verizon’s 2020 Data Breach Investigations Report (DBIR) finds that hacking and phishing are the most commonly occurring threats.3

AnticipAted vs. ActuAl

What cybersecurity planners are anticipating does not match actual attacks. For instance, in the U.S., only 13% considered phishing the most concerning threat vs. 38% for ransomware; however, when looking at the actual attacks, 24% experienced a phishing incident vs. 30% who experienced a malware attack (Exhibit 2).4 Therefore, using better threat intelligence to inform cybersecurity spending is an important consideration given how thinly spread cybersecurity resources are in a typ-ical organization.

HAcking

When it comes to hacking, more than 80% of breaches involved brute-force attacks, often using lost or stolen creden-tials. In comparison, exploiting unpatched vulnerabilities con-stituted about 15% of all hacks. Phishing is the most common form of cyber breach experienced.5

According to the 2020 DBIR, 96% of social actions were triggered over e-mails. In the past, this has caused the U.S. Securities and Exchange Commission to release a business

e-mail compromise advisory6 to alert auditors of public compa-nies and senior management about this specific risk.

tHe impAct to construction

The construction industry may not come to mind when you think about data breaches, but hackers are always integrating new industries into their ecosystems. For the first time, the 2020 DBIR examines trends in the construction industry with respect to breaches and shows that it suffers from weak web application, social engineering, and ransomware attacks (like phishing) the most.

A phishing test conducted as a part of the DBIR survey noted the low number of submissions to clickbaits. Overall, there were 37 reported incidents, of which at least 25 had con-firmed data disclosures. Another trend that we have noticed over the past few years is that the risk to small and large companies is similar, so a company’s size does not insulate it from being attacked.

If you have not done so already, start by selecting a suitable framework to fit your organization. Depending on the com-pany’s size, complexity, and regulatory needs, various cyber-security frameworks are available like that of the National Institute of Standards and Technology (NIST) as well as the Information Systems Audit and Control Association’s (ISACA’s) Control Objectives for Information and Related Technology (COBIT).

However, the Cybersecurity Maturity Model Certification (CMMC), an emerging framework from the U.S. Department of Defense (DOD), may be the most relevant to the con-struction industry, particularly to those that work on defense contracts or for defense contractors.7

The CMMC Framework: A Tiered Approach to Cybersecurity

Building on NIST’s 800-171 standard, the CMMC moves away from self-assessments and toward external assess-ments, depending on the maturity level. The goal of this framework is to increase the protection level of data and information within the supply chain of the DOD by manag-ing federal contract information and controlled unclassified information (CUI) from public access and release. The CMMC outlines five maturity levels as shown in Exhibit 3.

CFMA Building Profits July/August 2021

101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010010101010101010101010101010101010101010101010101010101010101010101010

Trends & Actions to

IMPLEMENT IMMEDIATELY

101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010010101010101010101010101010101010101010101010101010101010101010101010

Trends & Actions to

CYB�SECUR�Y:

CYB�SECUR�Y:


July/August 2021 CFMA Building Profits

Actions to Implement ImmediatelyinformAtion security policy

An information security policy is the foundation upon which every contractor should build its security model. According to cybersecurity expert Larry Alton, lack of a formal strategy is one of the most common weaknesses, especially in many small businesses.8

A good information security policy lays out a high-level guideline to define a security strategy, connects it to other relevant and common policies (like an acceptable use pol-icy), and provides the bedrock on which other procedures and standards can be built. Common themes of a well-written information security policy include:

• Simple and easy to understand

• Enforceable but reasonably flexible

• Updated to remain current

• Describes the high-level approach to secure data and systems (e.g., defense-in-depth)

However, to be successful, it’s not enough to just have a well-written policy. It must be shared with its intended users and reinforced periodically through trainings and other inno-vative means. This is where the importance of maintaining good security hygiene and continuous user education comes in. The CMMC expects various policies to be in place for maturity levels 2 and up.

user educAtion

Writing policies is one thing, but real-world application to maintain high security standards is another. It’s important to educate employees about the policies since humans play a significant role in enforcing them.

The old method of asking staff to read a policy and certify that the action was completed does not yield good results. Too many people simply skim through without understand-ing the essence of the policies and when, where, and how the policy details should be used. Organizations are increasingly adopting involved yet creative approaches.

101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010010101010101010101010101010101010101010101010101010101010101010101010

Trends & Actions to


101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010010101010101010101010101010101010101010101010101010101010101010101010

Trends & Actions to

CYB�SECUR�Y:

CYB�SECUR�Y:


13% Phishing/Social Engineering

10%Insider Threats

12%Application (Web

or Mobile) Attack

10%Misconfiguration Attack

6%Data Regulations

2%Some Other Security-Related Problem

38%Malware/Ransomware

9% Privilege Escalation

HUM�Influence

=

Exhibit 1: Most Concerning Threats

Source: 2020 Trustwave Data Security Index


For instance, instead of having users read through lines of text, consider creating short videos and learning bursts that are disseminated via e-mail or the company intranet through-out the year. These learning bursts should replicate common scenarios that users find themselves in and question how they would react to potential real-life threats.

For example, in one organization, one of the frameworks would actively run a phishing campaign over company e-mail (with permission from the senior management) throughout the year to supplement the annual training and learning bursts. Users who were deceived by the phishing e-mail would have to undergo additional training with information security personnel.

At another organization, if someone left a workstation unlocked, the company would encourage departmental secu-rity ambassadors to send out an e-mail from that workstation to the rest of the department offering to bring in donuts the next Friday.

In the CMMC framework shown in Exhibit 3, awareness and training are expected activities at levels 2 and up, security awareness training is necessary for level 3, and customized training pertaining to phishing and other threats previously described is required at level 4.

security Hygiene

To be effective, user education cannot happen in a vacuum. The tone at the top and the organization’s culture play sig-nificant roles in maintaining good security hygiene. As the 2020 DBIR states, “Errors definitely win the award for best supporting action this year.” These errors fall into three main categories:

1) Publishing errors – putting sensitive data in the public domain instead of in a private data source

2) Misconfiguration – wrongly configuring a database or application, thus exposing information to unauthorized users

3) Misdelivery – sending sensitive data to unintended recipients

Therefore, user education must be supple-mented by good overall security hygiene that exists at every layer of people, pro-cess, and technology.9 It relies on focusing on the basics, prioritizing security spend-ing depending on business criticality, and tailoring solutions to fit the scale and size of the organization.

People

The senior management can lead from the front, setting the right tone at the top and stressing the importance of information security best practices and making employ-ees feel comfortable enough to speak up and raise alerts about information security issues. Line managers, as intermediaries, play a key role in developing a culture that values security and sharing the leadership’s message with those in the lower levels in the organization.

Exhibit 2: Actual Threat Events

Source: 2020 Trustwave Data Security Index

24% Phishing/Social Engineering

10%Insider Threats

�%Application (Web

or Mobile) Attack

6%Misconfiguration Attack

5%Data Regulations

4%Some Other Security-Related Problem

30%Malware/Ransomware

10% Privilege Escalation

101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010010101010101010101010101010101010101010101010101010101010101010101010

Trends & Actions to


101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010010101010101010101010101010101010101010101010101010101010101010101010

Trends & Actions to

CYB�SECUR�Y:

CYB�SECUR�Y:


101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010010101010101010101010101010101010101010101010101010101010101010101010

Trends & Actions to


101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010010101010101010101010101010101010101010101010101010101010101010101010

Trends & Actions to

CYB�SECUR�Y:

CYB�SECUR�Y:


Process

Key business processes should be identified, and adequate controls should be placed around them. For example, the CFO should not have administrative privileges to the finan-cial system and payroll system. Key changes to IT systems and infrastructure should go through a change management process that documents approval from business owners. Important data should be recoverable in the event of a disaster, allowing the business to get back on track after an unplanned event.

Technology

One of the most common causes behind data breaches is inadequate change control – such as outdated patches in applications, databases, or servers – that allow hackers to exploit a known vulnerability to gain unauthorized access to confidential systems and data.

To control this, organizations should implement good disci-pline around patch management, control access to critical systems, and limit or eliminate the use of unauthorized software (e.g., a trial winzip application). Monitoring the cor-porate network and applications for unauthorized activities and terminating user access promptly (e.g., when an employ-ee resigns or a contractor’s term expires) creates better risk mitigation around access controls.

Users can feel overwhelmed with security measures and, if not tailored well, they can have negative and unintended con-sequences. As the premier body that develops standards and best practices around technology, NIST has revised its pass-word standard recommendation. It no longer requires length-based complex passwords if other, harder-to-crack options are in place (e.g., much longer passphrases and multi-factor authentication (MFA)). Specifically, where lost credentials are a big threat factor, using MFA neutralizes much of that benefit. The key message here is that one size does not fit all.

Together, with security measures like server hardening, segregating access to limit too much control of one or a few user accounts, and complex password controls all contribute toward building a robust security hygiene. Many of these actions have little to no extra cost. For example, managing

MFA does not add a huge cost burden and most organiza-tions already have resources devoted toward patching; they just need to develop greater rigor and better prioritization processes.

At the end of the day, information security is a shared responsibility. Creating a baseline policy, establishing user awareness and education around security threats, and devel-oping a culture of good security hygiene helps create a solid foundation to further build out an organization’s information security practice.

ConclusionIT and cybersecurity are enabling functions. Their primary objective is to make it easy for stakeholders to conduct their business operations efficiently, safely, securely, and without interruption. The objectives of confidentiality, integrity, and availability are the foundational principles on which cyberse-curity teams can build their posture, determine their strategy, and go about implementing their cybersecurity program.

Information security officers and business leaders will do well to keep the power of simplicity in mind, further reinforced by a serious but innovative culture about cybersecurity across the organization. Truly, necessity is the mother of invention! n

Endnotes

1. “2020 Data Breach Investigations Report.” Verizon. 2020. enterprise.

verizon.com/resources/reports/2020-data-breach-investigations-report.

pdf.

2. “2020 Data Security Index.” Trustwave. 2020. trustwave.

azureedge.net/media/17231/2020-data-security-index-final.pdf?

rnd=132477009690000000.



pdf.

4. “2020 Data Security Index.” Trustwave. 2020. trustwave.

azureedge.net/media/17231/2020-data-security-index-final.pdf?

rnd=132477009690000000.



pdf.

July/August 2021 CFMA Building Profits

101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010010101010101010101010101010101010101010101010101010101010101010101010

Trends & Actions to


101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010010101010101010101010101010101010101010101010101010101010101010101010

Trends & Actions to

CYB�SECUR�Y:

CYB�SECUR�Y:


6. www.sec.gov/litigation/investreport/34-84429.pdf.

7. “Cybersecurity Maturity Model Certification (CMMC).” Carnegie Mellon

University and the Johns Hopkins University Applied Physics Laboratory

LLC. March 18, 2020. www.acq.osd.mil/cmmc/docs/CMMC_ModelMain_

V1.02_20200318.pdf.

8. Alton, Larry. “The 8 Most Common Cybersecurity Weaknesses to Watch

for in Small Businesses.” ISACA. October 29, 2020. www.isaca.org/

resources/news-and-trends/isaca-now-blog/2020/the-8-most-common-

cybersecurity-weaknesses-to-watch-for-in-small-businesses.

9. “Security Discipline and Hygiene Mean Healthy, Naturally.” ISACA.

2021. www.isacajournal-digital.org/isacajournal/2021_volume_1/

MobilePagedArticle.action?articleId=1650344.

ANINDA KUMAR SADHUKHAN was formerly with BKD CPAs & Advisors in Springfield, MO, where he led a team of IT risk professionals across various U.S. Securities and Exchange Commission and private clients providing end-to-end relationship management and IT audit assurance and advisory services. Aninda’s work covers the Sarbanes-Oxley Act, system and organization controls report (SOC) 1 and 2 reporting, IT risk assess-ments, and internal audit projects with a focus in banking, insurance, and manufacturing sectors.

Website: www.linkedin.com/in/aninda-sadhukhan-cisa


trends & actions to implement immediately

Documents