The global lessons learned from the July 19 Crowdstrike event

Friday, July 19th, 2024, was an unforgettable day, albeit for all the wrong reasons. 

A global technical outage linked to the cybersecurity firm CrowdStrike grounded flights, crashed enterprise Windows-based systems, and underscored the fact that the dependencies within the world’s IT infrastructure are so fragile and critical that a small bug can bring it to its knees. 

Despite the fact that the event’s impacts echoed the effects of a widespread ransomware attack, Crowdstrike CEO George Kurtz was quick to reassure the public that the outage was unrelated to a security breach. In fact, the cause was almost trivial — a small bug in a content update. Regardless, the interruption highlighted the relationship between cybersecurity and global business…and not in a positive way.

Before we take a closer look, I think it’s important to call out the IT heroes at Crowdstrike (as well as those who work at the tens of thousands of affected organizations) who worked so hard and so quickly to restore operations and service. We see you, and we appreciate you.

“Ministry of No”

Reflecting on my nearly two decades of experience as a CSO and in other security leadership roles at British Telecom (BT), I have learned the lesson that “security mustn’t get in the way of the business.” I have no doubt that many of my fellow CISOs and CSOs have been receiving similar feedback (in harsh or worried tones) from their management and organizations since Friday, July 19.

Once perceived as obstacles to agility, CISOs have worked hard to promote the understanding of security as an enabler to the business — especially in our fully digitized enterprises. After all, business interruptions due to security incidents can be disastrous to reputation and customer trust. CISOs have long promoted the mantra of “security and resilience by design” to help CIOs, CTOs and boards understand that minimizing security risks and mitigating controls must always be considered when planning business applications and services. In so doing, we have succeeded in changing the perception of the “Ministry of No” to the “Ministry of How.”

“Ministry of Slow”

Another security “public-relations problem” has been the fact that transitioning from an environment where security tools and monitoring were bolted-on afterthoughts to one where they are inherent components of core applications and services has been painful. The stage of the “security retrofit” transformed the perception of  the CISO as the “Ministry of No” to the “Ministry of Slow.” Necessary security reviews and longer design periods — as well as the overhead load of deploying security tooling on endpoints, servers, etc. —  raised concerns about agility and performance. Of course, in most environments, these burdens could have been avoided if security had been built into business infrastructure from the outset.

At BT, we had a very forward-thinking CIO and CISO who both recognized that the security tooling was part of the fabric of the IT and networks. They made sure that security was considered and managed along with the deployment and support of all enterprise infrastructure. A similar approach would have been a core strength on July 19.

“Ministry of Woe”

In the minds of many, the Crowdstrike incident transformed the “Ministry of Slow” into the “Ministry of Woe,” as, once again, security got in the way of the business. But I see it differently.

“Ministry of Pro(active)”

In reference to security and IT and network infrastructure, I have always said “there is no 100%.” The gold standard in IT is 5x9s (99.999% uptime between faults). Crowdstrike is investigating how the .001% — in this case, a flawed update — made it into production. I won’t speculate about that here.

This incident reminds us of the grave importance of ongoing management of updates across an enterprise. We must look at the net of the quality controls that we expect from our vendors and our own IT support teams. To prevent the “Ministry of Woe” we must plan defensively by embracing the “Ministry of Pro(active)”

Here’s what that might look like:

  1. Primary cohort. Define a “primary cohort” — a small set of affected devices and hosts across each part of the organization — to use to test and confirm the success of updates. Ensure that they have a support wrap around them. As part of the general population in the environment, you should plan for a manual emergency response to restore them to operation in the event of an emergency.  
  2. Phases. Plan out a set of phases (beyond the primary cohort) for deployment and operational confirmation. 
  3. N-1. Adopting an N-1 (preserving the last version of software before the new release) is a prudent practice. However, be careful here. When it comes to security tooling, an N-1 approach could leave non-updated systems vulnerable to threats. 

While the July 19 incident was not a security issue, there were serious security implications. 

It was a hugely disruptive IT event — one that attackers could quickly leverage for advantage. There are two key vectors at play here:

  1. Phishing and fraud. Since the Crowdstrike event, there has been a rapid and significant spike in fake support sites and associated phishing. All employees must be on their guard and follow Crowdstrike’s advice to use only their direct, validated support services and report anything suspicious.
  2. Exploiting defense weakness. Affected organizations may be weighing up stability vs. re-enabling Crowdstrike. They may think that it’s a good idea to disable this protection “as things settle down,” in service of a period of operational stability. This would leave them wide open to attack (attackers will definitely be looking for unprotected targets). This is not a time for organizations to forget their sound reasoning in initially deploying Crowdstrike. The damage inflicted by a cyber-attack would far outweigh the disruption they experienced, since recovery of brand and reputation would have long-lasting costs. 

More broadly, cybersecurity for the modern enterprise is based on an ecosystem of overlapping and compensating controls that maintain the security posture. Maintaining that posture is dependent on operational tools that are updated with the latest threat intelligence. 

As threats and attacks emerge, visibility and velocity of response are key. They are fueled by up-to-the-minute threat intelligence immediately bonded to the enterprise’s telemetry and defenses. This requires a different approach to security and the operations platform — one that Anomali has pioneered and is bringing to customers, helping them achieve their security mission. 

Once again, let’s appreciate the huge efforts of all the IT and security teams who got their organizations and, let’s face it, the world back on their feet. Learning from the philosopher and writer George Santayana who wrote in 1905, “Those who cannot remember the past are condemned to repeat it” . Let’s take the time to reconsider our resilience and put proactive measures in place. Let’s not allow the aftermath or sense of panic to disrupt the calm and considered approach that has built out our security controls and protection. Let us redouble our efforts to have them treated as an integral part of our IT and network fabric. Finally, let us stay united as a team to deliver business performance and achieve the security mission.

Steve benton headshot

Steve Benton is the Vice President of Threat Research at Anomali.

https://www.securitymagazine.com/blogs/14-security-blog/post/100933-the-global-lessons-learned-from-the-july-19-crowdstrike-event



INTERPOL: I-GRIP contro le truffe BEC

Ago 12, 2024 RSS 0

Uno strumento globale per il recupero rapido dei fondi, creato da INTERPOL, sta dimostrandosi sempre più importante nella lotta contro le truffe BEC (Business Email Compromise).

Queste rappresentano una minaccia piuttosto insidiosa nel panorama della criminalità informatica. Gli attaccanti infatti compromettono le email aziendali per ingannare i dipartimenti di fatturazione e reindirizzare pagamenti legittimi su conti bancari sotto il loro controllo. Una volta ricevuti i fondi, gli attaccanti agiscono rapidamente per svuotare i conti tramite una rete di intermediari finanziari.

Grazie al sistema di intervento rapido globale sui pagamenti (INTERPOL’s Global Rapid Intervention of Payments, ovvero I-GRIP), la storia sta cambiando. Questo meccanismo consente infatti alle forze dell’ordine di intervenire tempestivamente, bloccando i trasferimenti illeciti e recuperando i fondi prima che possano essere dispersi su più conti.

L’INTERPOL’s Global Rapid Intervention of Payments (I-GRIP), consente di bloccare i trasferimenti illeciti e recuperare i fondi prima che possano essere dispersi su più conti.

Il caso di Singapore ne è un esempio emblematico. Una società di materie prime, dopo aver ricevuto una richiesta di pagamento apparentemente legittima dal proprio fornitore, ha trasferito 42,3 milioni di dollari a un conto bancario controllato dagli attaccanti. Solo quattro giorni dopo si è resa conto della frode ma, grazie alla segnalazione immediata alle autorità, è stato possibile attivare il sistema I-GRIP.

Questo ha permesso di recuperare 39 milioni di dollari in tempi record, mentre ulteriori indagini hanno portato all’arresto di sette sospetti e al recupero di altri 2 milioni di dollari, per un totale di 41 milioni.

Il successo di questo intervento dimostra l’efficacia di I-GRIP, che dalla sua istituzione nel 2022 ha già recuperato oltre 500 milioni di dollari sottratti tramite frodi e crimini informatici. Operazioni come “First Light”, che ha visto l’arresto di quasi 4.000 persone coinvolte in varie truffe online, hanno beneficiato di questo strumento, che sta rapidamente diventando un’arma indispensabile nella difesa contro la criminalità informatica globale.

Con I-GRIP, le aziende hanno una speranza concreta di recuperare rapidamente i fondi sottratti, mettendo in scacco i criminali e proteggendo le proprie risorse finanziarie.

Condividi l’articolo

Articoli correlati

Altro in questa categoria

https://www.securityinfo.it/2024/08/12/interpol-i-grip-contro-le-truffe-bec/?utm_source=rss&utm_medium=rss&utm_campaign=interpol-i-grip-contro-le-truffe-bec



Almost unfixable “Sinkclose” bug affects hundreds of millions of AMD chips

Security flaws in your computer’s firmware, the deep-seated code that loads first when you turn the machine on and controls even how its operating system boots up, have long been a target for hackers looking for a stealthy foothold. But only rarely does that kind of vulnerability appear not in the firmware of any particular computer maker, but in the chips found across hundreds of millions of PCs and servers. Now security researchers have found one such flaw that has persisted in AMD processors for decades, and that would allow malware to burrow deep enough into a computer’s memory that, in many cases, it may be easier to discard a machine than to disinfect it.

At the Defcon hacker conference, Enrique Nissim and Krzysztof Okupski, researchers from the security firm IOActive, plan to present a vulnerability in AMD chips they’re calling Sinkclose. The flaw would allow hackers to run their own code in one of the most privileged modes of an AMD processor, known as System Management Mode, designed to be reserved only for a specific, protected portion of its firmware. IOActive’s researchers warn that it affects virtually all AMD chips dating back to 2006, or possibly even earlier.

Nissim and Okupski note that exploiting the bug would require hackers to already have obtained relatively deep access to an AMD-based PC or server, but that the Sinkclose flaw would then allow them to plant their malicious code far deeper still. In fact, for any machine with one of the vulnerable AMD chips, the IOActive researchers warn that an attacker could infect the computer with malware known as a “bootkit” that evades antivirus tools and is potentially invisible to the operating system, while offering a hacker full access to tamper with the machine and surveil its activity. For systems with certain faulty configurations in how a computer maker implemented AMD’s security feature known as Platform Secure Boot—which the researchers warn encompasses the large majority of the systems they tested—a malware infection installed via Sinkclose could be harder yet to detect or remediate, they say, surviving even a reinstallation of the operating system.

“Imagine nation-state hackers or whoever wants to persist on your system. Even if you wipe your drive clean, it’s still going to be there,” says Okupski. “It’s going to be nearly undetectable and nearly unpatchable.” Only opening a computer’s case, physically connecting directly to a certain portion of its memory chips with a hardware-based programming tool known as SPI Flash programmer and meticulously scouring the memory would allow the malware to be removed, Okupski says.

Nissim sums up that worst-case scenario in more practical terms: “You basically have to throw your computer away.”

In a statement shared with WIRED, AMD acknowledged IOActive’s findings, thanked the researchers for their work, and noted that it has “released mitigation options for its AMD EPYC datacenter products and AMD Ryzen PC products, with mitigations for AMD embedded products coming soon.” (The term “embedded,” in this case, refers to AMD chips found in systems such as industrial devices and cars.) For its EPYC processors designed for use in data-center servers, specifically, the company noted that it released patches earlier this year. AMD declined to answer questions in advance about how it intends to fix the Sinkclose vulnerability, or for exactly which devices and when, but it pointed to a full list of affected products that can be found on its website’s security bulletin page.

https://arstechnica.com/?p=2042298



Nashville man arrested for running “laptop farm” to get jobs for North Koreans

Nashville man arrested for running “laptop farm” to get jobs for North Koreans

Federal authorities have arrested a Nashville man on charges he hosted laptops at his residences in a scheme to deceive US companies into hiring foreign remote IT workers who funneled hundreds of thousands of dollars in income to fund North Korea’s weapons program.

The scheme, federal prosecutors said, worked by getting US companies to unwittingly hire North Korean nationals, who used the stolen identity of a Georgia man to appear to be a US citizen. Under sanctions issued by the federal government, US employers are strictly forbidden from hiring citizens of North Korea. Once the North Korean nationals were hired, the employers sent company-issued laptops to Matthew Isaac Knoot, 38, of Nashville, Tennessee, the prosecutors said in court papers filed in the US District Court of the Middle District of Tennessee. The court documents also said a foreign national with the alias Yang Di was involved in the conspiracy.

The prosecutors wrote:

As part of the conspiracy, Knoot received and hosted laptop computers issued by US companies to Andrew M. at Knoot’s Nashville, Tennessee residences for the purposes of deceiving the companies into believing that Andrew M. was located in the United States. Following receipt of the laptops and without authorization, Knoot logged on to the laptops, downloaded and installed remote desktop applications, and accessed without authorization the victim companies’ networks. The remote desktop applications enabled DI to work from locations outside the United states, in particular, China, while appearing to the victim companies that Andre M. was working from Knoot’s residences. In exchange, Knoot charged Di monthly fees for his services, including flat rates for each hosted laptop and a percentage of Di’s salary for IT work, enriching himself off the scheme.

The arrest comes two weeks after security-training company KnowBe4 said it unknowingly hired a North Korean national using a fake identity to appear as someone eligible to fill a position for a software engineer for an internal IT AI team. KnowBe4’s security team soon became suspicious of the new hire after detecting “anomalous activity,” including manipulating session history files, transferring potentially harmful files, and executing unauthorized software.

The North Korean national was hired even after KnowBe4 conducted background checks, verified references, and conducted four video interviews while he was an applicant. The fake applicant was able to stymie those checks by using a stolen identity and a photo that was altered with AI tools to create a fake profile picture and mimic the face during video conference calls.

In May federal prosecutors charged an Arizona woman for allegedly raising $6.8 million in a similar scheme to fund the weapons program. The defendant in that case, Christina Marie Chapman, 49, of Litchfield Park, Arizona, and co-conspirators compromised the identities of more than 60 people living in the US and used their personal information to get North Koreans IT jobs across more than 300 US companies.

The FBI and Departments of State and Treasury issued a May 2022 advisory alerting the international community, private sector, and public of a campaign underway to land North Korean nationals IT jobs in violation of many countries’ laws. US and South Korean officials issued updated guidance in October 2023 and again in May 2024. The advisories include signs that may indicate North Korea IT worker fraud and the use of US-based laptop farms.

The North Korean IT workers using Knoot’s laptop farm generated revenue of more than $250,000 each between July 2022 and August 2023. Much of the funds were then funneled to North Korea’s weapons program, which includes weapons of mass destruction, prosecutors said.

Knoot faces charges, including wire fraud, intentional damage to protected computers, aggravated identity theft, and conspiracy to cause the unlawful employment of aliens. If found guilty, he faces a maximum of 20 years in prison.

https://arstechnica.com/?p=2042326



FCC proposes consumer protections for AI-generated robocalls

The Federal Communications Commission (FCC) proposed a first-of-their-kind ruling on AI-generated robocalls and robotexts. With 72% of consumers worrying daily about being fooled by deepfakes, this proposed ruling may help to lessen consumer concerns and reduce the spread of disinformation. With the election season upcoming, such a ruling may support voters in making informed, confident decisions, as the ruling would mandate disclosure when AI is utilized in political ads. 

Nicky Watson, Founder of Cassie, comments, “Hiding the use of AI in political campaigns isn’t just dishonest, it’s dangerous. Recent data found that 61% of voters weren’t sure if they’ve spotted AI being used in political campaigns this year. With voters already struggling to discern what’s real from what’s not, it’s critical for political campaigns to be transparent about their use of AI, disclosing to voters how these tools are being used. It shouldn’t be up to the average viewer to determine a fabricated political message from an earnest one. 

The reality is, most (81%) of voters believe AI is a threat to election security. With a general public already wary of technology’s impact on the United States’ election, political campaigns should be spearheading a new wave of transparency. Building a relationship between politician and citizen can’t start out with faulty advertising — voters want the truth.” 

https://www.securitymagazine.com/articles/100936-fcc-proposes-consumer-protections-for-ai-generated-robocalls



512-bit RSA key in home energy system gives control of “virtual power plant”

512-bit RSA key in home energy system gives control of “virtual power plant”

When Ryan Castellucci recently acquired solar panels and a battery storage system for their home just outside of London, they were drawn to the ability to use an open source dashboard to monitor and control the flow of electricity being generated. Instead, they gained much, much more—some 200 megawatts of programmable capacity to charge or discharge to the grid at will. That’s enough energy to power roughly 40,000 homes.

Castellucci, whose pronouns are they/them, acquired this remarkable control after gaining access to the administrative account for GivEnergy, the UK-based energy management provider who supplied the systems. In addition to the control over an estimated 60,000 installed systems, the admin account—which amounts to root control of the company’s cloud-connected products—also made it possible for them to enumerate names, email addresses, usernames, phone numbers, and addresses of all other GivEnergy customers (something the researcher didn’t actually do).

“My plan is to set up Home Assistant and integrate it with that, but in the meantime, I decided to let it talk to the cloud,” Castellucci wrote Thursday, referring to the recently installed gear. “I set up some scheduled charging, then started experimenting with the API. The next evening, I had control over a virtual power plant comprised of tens of thousands of grid connected batteries.”

Still broken after all these years

The cause of the authentication bypass Castellucci discovered was a programming interface that was protected by an RSA cryptographic key of just 512 bits. The key signs authentication tokens and is the rough equivalent of a master-key. The bit sizes allowed Castellucci to factor the private key underpinning the entire API. The factoring required $70 in cloud computing costs and less than 24 hours. GivEnergy introduced a fix within 24 hours of Castellucci privately disclosing the weakness.

The first publicly known instance of 512-bit RSA being factored came in 1999 by an international team of more than a dozen researchers. The feat took a supercomputer and hundreds of other computers seven months to carry out. By 2009 hobbyists spent about three weeks to factor 13 512-bit keys protecting firmware in Texas Instruments calculators from being copied. In 2015, researchers demonstrated factoring as a service, a method that used Amazon cloud computing, cost $75, and took about four hours. As processing power has increased, the resources required to factor keys has become ever less.

It’s tempting to fault GivEnergy engineers for pinning the security of its infrastructure on a key that’s trivial to break. Castellucci, however, said the responsibility is better assigned to the makers of code libraries developers rely on to implement complex cryptographic processes.

“Expecting developers to know that 512 bit RSA is insecure clearly doesn’t work,” the security researcher wrote. “They’re not cryptographers. This is not their job. The failure wasn’t that someone used 512 bit RSA. It was that a library they were relying on let them.”

Castellucci noted that OpenSSL, the most widely used cryptographic code library, still offers the option of using 512-bit keys. So does the Go crypto library. Coincidentally, the Python cryptography library removed the option only a few weeks ago (the commit for the change was made in January).

In an email, a GivEnergy representative reinforced Castellucci’s assessment, writing:

In this case, the problematic encryption approach was picked up via a 3rd party library many years ago, when we were a tiny startup company with only 2, fairly junior software developers & limited experience. Their assumption at the time was that because this encryption was available within the library, it was safe to use. This approach was passed through the intervening years and this part of the codebase was not changed significantly since implementation (so hadn’t passed through the review of the more experienced team we now have in place).

https://arstechnica.com/?p=2042026



Report reveals 10% increase in the exploitation of old CVEs

Qualys has released its 2024 Midyear Threat Landscape Review, emphasizing the evolution and escalation of cyber threats. The report found that the exploitation of old common vulnerabilities and exposures (CVEs) rose by 10% from 2023 to 2024. Additionally, the volume of reported CVEs rose by approximately 30%, representing an increase from 17,114 in 2023 to 22,254 in 2024. Out of these vulnerabilities, .91% (204 vulnerabilities) have been exploited. Although only a few were exploited, the report asserts that these incidents present a threat and require proper security measures.

The report suggests that the increased exploitation of CVEs is a concerning trend that organizations and cybersecurity leaders must be aware of. The report then goes on to list the 10 most exploited vulnerabilities. The three most exploited vulnerabilities in this list include CVE-2024-21887 (a command injection vulnerability in Ivanti Connect and Policy Secure Web), CVE-2023-46805 (a remote authentication bypass vulnerability in Ivanti Connect and Policy Secure Web), and CVE-2024-21412 (a security feature bypass vulnerability in Microsoft Windows). 

https://www.securitymagazine.com/articles/100935-report-reveals-10-increase-in-the-exploitation-of-old-cves



Impianti fotovoltaici a rischio attacco: scoperte diverse vulnerabilità

Ago 09, 2024 Approfondimenti, In evidenza, Minacce, News, RSS 0

Bitdefender ha pubblicato una ricerca riguardante alcune vulnerabilità presenti nella piattaforma di gestione di impianti fotovoltaici di Solarman e negli inverter Deye che consentono a un attaccante di prendere il controllo dei componenti della rete elettrica.

impianti fotovoltaici vulnerabilità

Pixabay

La piattaforma si occupa di coordinare le operazioni di milioni di installazioni di impianti in tutto il mondo, responsabili del 20% della produzione di energia solare mondiale.

I ricercatori di Bitdefender hanno analizzato in che modo gli attaccanti potrebbero utilizzare gli inverter, componenti critici dell’infrastruttura che convertono la corrente continua (DC) in corrente alternata (AC), cioè quella usata comunemente nelle case e negli uffici.

L’architettura Solarman ha diversi entry point esposti per integrare inverter, data logger e altre componenti fotovoltaiche di diverse compagnie. Dall’analisi dei ricercatori è emerso che la combinazione di Solarman con gli inverter Deye espone delle importanti vulnerabilità di sicurezza che possono essere usate per interrompere l’attività degli impianti fotovoltaici.

Le vulnerabilità degli impianti fotovoltaici

Nel dettaglio, Bitdefender ha scoperto che la piattaforma di Solarman soffre di tre vulnerabilità: la prima colpisce l’endpoint /oauth2-s/oauth/token e consente agli attaccanti di generare token di autorizzazione per qualsiasi account, prendendone il controllo; la seconda è una vulnerabilità cross-platform che permette di usare i token JWT della piattaforma Deye Cloud anche su Solarman, consentendo anche in questo caso di accedere alle funzionalità senza autorizzazione; infine, gli endpoint di Solarman restituiscono troppe informazioni riguardo l’organizzazione, compresi dati sensibili.

Per quanto riguarda Deye, la piattaforma utilizza un account hard-coded con password 123456 per accedere ai dati dei dispositivi; questo account può ottenere un token di autorizzazione che gli consente l’accesso a qualsiasi positivo per accedere a informazioni quali la versione software e le credenziali Wi-Fi.

Su Deye Cloud, inoltre, l’endpoint /user-s/acc/orgs ritorna numerose informazioni private sugli utenti, inclusi nomi, indirizzi email. numeri di telefono e ID. Infine, come per la piattaforma Solarman, l’API /oaut-s/oauth/ permette agli attaccanti di generare token di autorizzazione per qualsiasi account. In questo caso il token JWT generato contiene un valore errato che non viene accettato dal server, ma in futuro questa vulnerabilità potrebbe rappresentare un serio problema.

Pixabay

Queste vulnerabilità mettono a serio rischio la sicurezza degli impianti, causando diversi problemi: oltre ad accedere ai dati sensibili di utenti e organizzazioni, gli attaccanti possono prendere il controllo degli inverter per interrompere la generazione di energia e causare fluttuazioni di voltaggio, sovraccaricare la rete e provocare un blackout.

I due vendor hanno provveduto a sanare le vulnerabilità. Vista l’estensione degli impatti, è fondamentale integrare misure di sicurezza robusta negli impianti fotovoltaici.

“Mentre continuiamo ad abbracciare le energie rinnovabili, dobbiamo anche rimanere vigili e proattivi nel mettere in sicurezza la nostra infrastruttura energetica contro le minacce in evoluzione” concludono i ricercatori.

Condividi l’articolo

Articoli correlati

Altro in questa categoria

https://www.securityinfo.it/2024/08/09/impianti-fotovoltaici-a-rischio-attacco-scoperte-diverse-vulnerabilita/?utm_source=rss&utm_medium=rss&utm_campaign=impianti-fotovoltaici-a-rischio-attacco-scoperte-diverse-vulnerabilita



Will practitioner make perfect?

@import url(‘https://fonts.googleapis.com/css2?family=Nunito+Sans:ital,opsz,wght@0,6..12,400;0,6..12,500;0,6..12,600;0,6..12,700;1,6..12,400;1,6..12,500;1,6..12,600;1,6..12,700&family=Nunito:ital,wght@0,400;0,500;0,600;0,700;1,400;1,500;1,600;1,700&display=swap’); @import url(‘https://fonts.googleapis.com/css2?family=Architects+Daughter&family=Roboto:ital,wght@0,100;0,300;0,400;0,500;0,700;0,900;1,100;1,300;1,400;1,500;1,700;1,900&display=swap’); h3 { font-weight: bold; font-size: 18px; color: #C72026; } figure { padding: 4px; margin: auto; } figcaption { background-color: #F4F5F6; color: #404144; Nunito Sans’, Arial, sans-serif; font-size: 16px; padding: 2px; text-align: left; } .pqFull { display: block; border-width: 2px 0; border-style: solid; border-color: #C72026; padding: 1.5em 0 0.5em; margin: 1.5em 0; position: relative; } .pqFull:before { content: ‘\201C’; position: absolute; top: 0em; left: 50%; transform: translate(-50%, -50%); background: #fff; width: 3rem; height: 2rem; color: #666; text-align: center; } .pqFull:after { content:; display: block; text-align: right; font-size: 0.875em; color: #e74c3c; }
Leadership & Management - Michael Gips

George Gershwin wrote his classic Rhapsody in Blue in about five weeks. George Orwell knocked out Animal Farm in four months. It took about the same amount of time for the paint to dry on Velazquez’s masterpiece Las Meninas.

It officially took about six months for ASIS International to hire its new CEO, Bill Tenney, who stepped into the role on July 1. ASIS would be delighted with just a fraction of the success of a Gershwin, Orwell or Velasquez, though the Board certainly has more realistic expectations.

The CEO of ASIS might be the most high-profile leadership position in private security. Its global footprint, influence, certifications, standards and guidelines, events and publications have made the organization the face of security for decades. Tenney won the role among thousands of contenders, many of them highly qualified.

Tenney’s arrival corresponds to the departure of former CEO Peter O’Neil, who helmed ASIS for more than eight years. (Full disclosure: I worked with Peter from 2016 to 2019; he promoted me to Chief Global Knowledge & Learning Officer and ASIS’s first ever Chief Security Officer.) O’Neil navigated ASIS through severe financial pressures and a global pandemic, reorganized departments, made key staffing changes, introduced association best practices, implemented an ESRM mandate, and changed the culture of the almost 80-year-old organization.

To move ASIS forward, the Board decided to replace O’Neil with a highly regarded security practitioner with extensive senior-level experience.

In a future column, I will discuss what Tenney considers his major goals and challenges, as well as his plan for the first 100 days.

The CEO of ASIS might be the most high-profile leadership position in private security. Its global footprint, influence, certifications, standards and guidelines, events, and publications have made the organization the face of security for decades.

Does it align with what the membership and industry want? Shortly after the hiring announcement, I posted a LinkedIn poll that asked what Tenney’s biggest challenge will be, offering four choices: relevance/credibility; finances/revenue growth; member value/membership growth; and other.

As several commenters observed, these factors are intertwined and not easily separated. Security marketing whiz Suzanna Alsayed posted, “You have to ask yourself the questions: What value does a member get? What is the value of the overall brand? Is it recognized outside the industry? If yes, is it credible? Where are the finances being distributed? How do you become relevant to the 18-24 year-old demographic?”

Security engineer Sean Ahrens called the question “the metaphorical ‘chicken and egg.’ Their issue is finances/growth, but foundationally, they need to show member value/membership growth first. Through membership growth they will achieve relevance. This will either be a Jack Welch story or it won’t.”

Also citing the combination of factors was Intel’s Kasia Hanson, who views the challenge through a technological lens. “The technology transitions happening in the market will ultimately feed into member value, relevance, and revenue growth.”

Sixty percent of poll voters pointed to member value/growth as the biggest challenge, followed by relevance/credibility (29 percent), finances (6 percent), and other (5 percent). Smart-city expert Jon Polly pointed to loss of value as the primary cause of member attrition. Factors for the decline, he said, include dated certification content and the dwindling value of ASIS certifications. Ecuador-based Kevin Palacios wrote that the issue is “a delicate balance of revenue and member value,” complicated further because “different regions have different expectations.”

Other commenters reframed the question or offered alternative challenges. Ron Worman of The Sage Group wrote that if he were at the table with Bill, he wouldn’t start the conversation with ASIS. “I would start with the Mind of the Market — risk, resilience, security. This is a great opportunity to construct a new vision based on meeting this moment with fresh eyes.” GardaWorld’s Chris Anquist contended that professionalization of the industry should be considered job number one “if we want to have any chance of making lasting change towards a body of knowledge, increased standardization, and ethical and professional oversight to the level where we deserve a seat at the C suite level.”

That would be a tall order for anyone. Forget Gershwin, Melville, and Velazquez. Tenney may have to channel Einstein, da Vinci and Jack Welch.

https://www.securitymagazine.com/articles/100917-will-practitioner-make-perfect



Leading by example


@import url(‘https://fonts.googleapis.com/css2?family=Nunito+Sans:ital,opsz,wght@0,6..12,400;0,6..12,500;0,6..12,600;0,6..12,700;1,6..12,400;1,6..12,500;1,6..12,600;1,6..12,700&family=Nunito:ital,wght@0,400;0,500;0,600;0,700;1,400;1,500;1,600;1,700&display=swap’); h3 {font-weight: bold;font-size: 18px;color: #C72026;}
figure {padding: 4px;margin: auto;}
figcaption {background-color: #F4F5F6;color: #404144;Nunito Sans’, Arial, sans-serif;font-size: 16px;padding: 2px;text-align: left;}
Security Talk Column with Rachelle Blair-Frasier

Building a robust security culture is central creating a successful security strategy within any organization. Here, I had the opportunity to discuss with two industry leaders — Kirsten Provence, Executive Director Security Programs & Governance at Kaiser Permanente, and Kristine Raad, Chief Security Officer at General Motors, their approaches to security and creating a positive culture from the top down.

“It really doesn’t matter what industry you’re in, security is everyone’s responsibility. However, you can’t just say that and not give people the tools to drive security and resiliency,” says Provence. “People, at their core, want to be empowered, and by providing them with some key components to enable them to be a security ambassador, an organization is essentially scaling its security apparatus by a huge magnitude.”

“Security culture to me is made up of the beliefs, values, attitudes and behavioral norms the organization and its employees have toward security,” says Kristine Raad, Chief Security Officer at General Motors. “An organization’s security culture is truly the driver of their policies, investment decisions, risk awareness and day to day actions; all of which are the outward expression of the culture.

Contributing to a positive security culture

When it comes to building a strong security culture in an organization, transparency and communication is key.

“People have to know what measures are in place in order to assess what additional tactics they may need to employ to increase security,” Provence says. “As with anything, communication is key. The more that an organization can provide topical messaging to team members about security, the more that those team members will think about security as a continual thread in their daily operation. That’s not saying that security organizations should be releasing multi-page intelligence summaries for the general population of an organization to consume, but a quick one-page graphical flyer that gives some key takeaways on a topic can be incredibly powerful.”

“Creating a positive security culture is no simple task and requires a comprehensive and consistent strategy,” adds Raad. “This includes:

  1. Building a positive attitude towards security through education, marketing and leadership messaging focused on the benefits to individuals and business interests.
  2. Ensuring leaders are onboard and model the desired behaviors to create norms for their teams.
  3. Creating awareness of key concepts through engaging training and micro learning.
  4. Communicating key principles and policies at all levels of the organization on a regular basis through a variety of channels.”

The role of leadership

When it comes to shaping or fostering a security-conscious culture within an organization, both Raad and Provence say it is important for the message to come through leaders from the top down.

“Building the organization’s security culture begins with leadership clearly defining core values through strategic goals and policies, communicating with consistency and modeling the behavior through their actions and decisions,” Raad says. “Leaders are absolutely critical in creating a positive security culture. When they model behaviors including a positive security attitude, compliance with policies, and decision making that supports security initiatives, they are establishing social norms and expectations for the behavior of their teams and others.”

“As with many things, shaping a security-conscious culture starts at the top,” Provence adds. “That means leadership must set the example of how they want their team members to engage with security every day.”

For security leaders looking to enhance their organization’s security culture, these leaders offer this advice.

“Start talking and empower your security team members to do so too. Your CSO isn’t the only face of security. All team members are, and they should be empowered and trusted to do so,” Provence says. “Give them some high-level talking points about the security organization’s top-line goals to use as conversation starters, and then they can take the conversation down their area of expertise on their own. It will connect their work to the larger mission and will scale the power of the ‘CSO elevator chat’.”

“Start by identifying what your security culture goals are for the organization and what gaps exist between your current and desired state,” Raad says. “While this sounds simple, determining the measurable attributes and desired outcomes is the most important step. I recommend engaging with strategic partners and leaders to gain their support and ensure alignment to overarching organization goals which is essential to successful culture change.”

https://www.securitymagazine.com/articles/100919-leading-by-example