Cyber Security Archives - Page 2 of 3 - Kenton Brothers Systems for Security

Cyber Security is Complex: Don’t Bury Your Head in the Sand

May 24, 2023/in Cyber Security/by Neal Bellamy

By Neal Bellamy, IT Director at Kenton Brothers

In the physical security world, we tend to think about security as locks, keys, access control, and maybe cameras. If you are an IT person, you might think security is more about firewalls, usernames, passwords, and encryption. Physical security people and IT security people really have the same goal: Protect the Business. Physical security teams and IT Security teams generally operate in different bubbles, but I think it’s time for another convergence.

Cybercrime has a cost, and when it happens, the cost is often high. In 2021, Ransomware alone cost an estimated 620+ million. While Ransomware is probably one of most everyone’s top concerns, there are other ways to make money from your data. Exporting your data or your customer’s data or denying access to your data could also have major impacts to your business.

The capabilities of computers continue to skyrocket.

Anyone in the computer field knows “Moore’s Law”. While not actually a law of physics, it was more of an observed phenomenon. The idea is that the speed of a computer doubles every two years. This idea is bigger than I’ve given it credit for. You can see the phenomenon in more than just microchips. Since the beginning of programming, we’ve built software tools (by writing code) to make new coding efforts faster. Since the processing power of computers doubles every two years, software has access to more and more resources. Software’s capabilities continue to grow at an astounding rate. Machine learning, Deep learning, and AI are all outcomes of this growth. It’s terrifying and inspiring at the same time.

Here’s why software matters.

Once upon a time, a computer programmer made a program that could do something malicious. It might take that programmer months to code and tweak, then it would be released to the world. Sometimes it would make a big splash. Even if it was a major threat, anti-virus companies would find a way to identify it and stop it in a matter of days. Now, we have programs that make programs. Coding a virus can be done in minutes, but viruses are old hat.

What happens if we release an AI to attack a company? It could find the open ports, discover what software is behind those ports, look up vulnerabilities, and then try to exploit the vulnerabilities in seconds. Once an attacker is in, the game is over. It’s only going to get scarier from here.

What can you do?

First, take it seriously. As someone trying to protect your business, you should have several plans. A defense plan is important, but so are recovery plans. The basics still apply. Protect your perimeter, have at least two sets of backups, and use strong passwords (preferably with Multi-Factor Authentication). Anti-Virus alone is no longer good enough. You need to implement Endpoint detection and response (EDR / XDR / MDR) of some type.

How can Kenton Brothers Help?

While we can’t protect all of your networks (we have partners that do), we will do our part while we are on your network. We make sure that software and firmware are up to date when we install equipment, we use strong, randomly generated passwords for your security systems. This is standard in all of our implementations. If your IT company has further security, we will work side-by-side to complement it. Even though we are a physical security company, we understand and value IT security.

If you need help in the physical security world, we are always here to help. But if you need help in the cyber security world, I am also here to help. I have done a deep dive into the cyber world for the last six months and would be happy to share my knowledge. I’m certainly not an expert, but I can share my experiences trying to make KB more secure. I’ve also met some great people and companies along the way that would love to help you with your cyber security efforts. Just give us a call.

Why Physical Security has to be part of the convergence discussion of OT/ICS security.

April 26, 2023/in Access Control, Commercial Security, Cyber Security, Video Surveillance/by David Strickland

By David Strickland, Vice President of Kenton Brothers

There is a real buzz in the security world right now around securing Operational Technology (OT) and Industrial Control Systems (ICS). This buzz comes from two sources: companies and organizations that are being attacked through cyber security and physical attacks, and government agencies trying to get information broadcast to counter these threats. Threat levels have been increasing over the last few years and the cost of these attacks have risen to devastating levels.

According to CISA, in the first half of 2022 there were at least 22 reported large impact attacks on critical infrastructure leading to billions of dollars in losses. As the second half of 2022 numbers are being compiled, the sense of urgency to shore up the vulnerabilities is at an all time high.

How is OT security different than IT Cybersecurity?

IT – Information technology is just that. It is the transfer of data or information through physical appliances such as routers, switches and servers. Security for this technology centers around the prevention, detection and mitigation of attacks from software.

OT or Operational Technology is the manipulation of real world physical devices such as pumps, valves and controls through software or human interaction. These are called Industrial Control systems. In contrast to IT cybersecurity attacks, the outcomes of successful OT / ICS attacks include the potential to impact human safety and damage physical equipment. For example, taking any industrial processes OT / ICS equipment offline for extended time periods. This can be done through software or physical attacks known as sabotage.

Many organizations point to the Purdue Model for protecting OT and ICS.

The Purdue model, created in the 1990’s is a comprehensive look at protecting ICS and has been the standard for many years. The Purdue Model has five zones that are considered when creating a robust security model. Yes, this model is the current standard, but in our opinion does not adequately address physical security.

Cybersecurity of IT, IIT (Industrial IT) and OT systems is still a very high priority.

A recent comprehensive report provided by the Department of Homeland Security (DHS) pointed out a few concerns. “Many organizations lack visibility into their complete OT environments, including IT/OT interconnections and supply chain dependencies. Cybersecurity is overwhelming for organizations and entities with small staffs and budgets. As a result, many are not able to achieve the cybersecurity posture required to adequately secure their IT/OT infrastructure. The majority of legacy OT equipment was never designed for internet connectivity, and may not easily be replaced, making it increasingly challenging to secure in converged environments.”

We must not make the mistake of ignoring the real probability of physical attacks on these same organizations that are overwhelmed with cybersecurity.

“A top priority must be to prevent unauthorized physical access, damage and interference to the organization’s information and information processing facilities. Essentially a key aspect of this standard is to implement effective access control and protection of systems and equipment from damage.”

Physical Security for the OT Starts here:

Policies and Procedures:

It’s a well-known fact that most breaches (95%+) are a failure of procedure or policy over systems. A good red team will tell you that their most effective weapon for entry is a poorly trained or poorly disciplined employee. Polices and procedures must be created, trained, followed and tested constantly.

Establishing your perimeter:

As with most things involving physical security, you must start with a strong perimeter. This perimeter must be extended as far as physically possible. Access should be granted to only authorized personnel that have been through proper background checks and assigned clearance based on their job function. The perimeter is your best chance at early detection, reaction and mitigation.

Access Control:

Only authorized personnel with the proper clearance and certifications should ever be allowed access to your OT systems. These authorized personnel should constantly be vetted. Many organizations don’t remove terminated employees from this list quickly. No visitors or vendors should ever be allowed access without proper vetting and escort. Your access control systems should be set up in concentric circles with stronger policy the closer you get to critical infrastructure. All access control devices should be kept in proper working order and updated with proper firmware and cyber security practices.

Alarms:

Too many times we see organizations practice poor alarm management. Alarms in any form (Fire, Access Control, Intrusion Detection, Car) should never be ignored yet many times are. OT devices are vulnerable to physical attack and to things like flooding, fire and electrical damage. A system alarm can help bring immediate attention if properly managed.

Surveillance:

Who inspects the inspector? Your IP video surveillance system. It keeps honest people honest and identifies those who are not. Critical infrastructure devices should have surveillance on the device itself and the human interaction point. This of course is on top of all perimeter entrance areas and key points throughout your property.

Knowledge and Cooperation:

The United States can leverage an existing body of knowledge to secure OT infrastructure. Prioritizing and applying these best practices, recommendations, and standards more broadly, in a comprehensive and accelerated manner, would strengthen security and achieve strategic outcomes.

Kenton Brothers Systems for Security stands by to do our part. Please let us know how we can help your organization.

Everything is Sunny in the Cloud… Maybe Even Sunnier When the Robots Take Over?

February 8, 2023/in Access Control, Commercial Security, Cyber Security, Video Surveillance/by Neal Bellamy

By Neal Bellamy, IT Director at Kenton Brothers

Cloud-based physical access control systems offer several advantages over on-premise access control servers.

Here are a few key reasons why this is true:

1. Scalability: Cloud-based systems can easily scale to accommodate a growing number of users and devices, without the need for expensive hardware upgrades. This makes them a cost-effective solution for businesses that are expanding or experiencing high levels of turnover.
2. Remote Management: Cloud-based systems can be managed remotely, allowing administrators to manage access control from anywhere with an internet connection. This is especially useful for businesses with multiple locations or employees who travel frequently.
3. Increased Security: Cloud-based systems are often more secure than on-premise systems because they are managed by experts who specialize in security. They also benefit from automatic software updates and backups, which can help protect against data breaches and other security threats.
4. Cost-Effective: Cloud-based systems generally require a lower upfront investment than on-premise systems, as they do not require expensive hardware or software. Additionally, they eliminate the need for costly IT staff to manage and maintain the system.
5. Flexibility: Cloud-based systems can integrate with a wide range of devices and platforms, making them more flexible than on-premise systems. This allows businesses to easily add new features and functionality as their needs evolve.

It might surprise you that the content above was written by Artificial Intelligence (AI).

It’s certainly not the best blog I’ve ever written, but it might not be the worst either. It’s factual, it is the top 5 reasons IT companies got to the cloud, and it has no grammatical errors. The coolest part about this content is that I asked only a single question to the AI… “Can you write a blog post on why cloud based physical access control is better than on premise access control server?”

As you can see from the question, I didn’t give much information. Yet the AI had gathered enough information to create five bullet points, use a beginning and ending paragraph and come up with valid statements. This particular AI is not specifically programmed to write blog content. It can also tell you about world events, write a Haiku in the voice of Captain Kirk, and solve math problems.

“Galaxy vast and wide
Stars that shine so bright and bold
Adventure calls forth.”

From a technological point of view, this is groundbreaking.

Computers have started to “think” for themselves. AI has been around for several years, but until now the “thinking” has been mainly contained to “What color is this object?” or “What fruit is in this video?” This is the first example I’ve seen where an artificial intelligence can take a subject and formulate a response on almost any topic based on its trained knowledge.

I can see AI launching into the commercial security world in an impactful way. While everything is “AI” right now, there is a major difference between telling a program what to look for to determine an outcome versus letting a program learn and make decisions based on past learning. I can certainly see a future where we don’t have to monitor commercial security systems for every single alert. Instead, an AI will monitor the incoming data and alert us when there is an anomaly. And we can define the rules that define an anomaly. I can see where an AI will alert us intelligently. Not that a person is in the parking lot. But the fact that there is a person in the parking lot, they have a saw, and they just disappeared under a car.

It will be interesting to see where this new AI charge leads us. I will certainly be paying attention to how AI can keep us safer while making it easier to manage commercial security systems.

If you need help designing and implementing a commercial security system to protect your people, property and possessions, please give us a call.

Top 10 tips for raising the cybersecurity bar in your organization today!

October 12, 2022/in Cyber Security/by David Strickland

By David Strickland, Vice President of Kenton Brothers

October is Cybersecurity awareness month!

CISA, or the Cybersecurity and Infrastructure Security Agency, celebrates October as the month to get in the know.

Kenton Brothers Systems for Security would like to remind you that many of your physical security systems run on an IP (Internet Protocol) network. These include IP video surveillance and IP based access control systems. In an effort to help support our customers and bring about greater awareness of the risks surrounding Cybersecurity, we thought it would be good to create a guide for some of the best practices around cybersecurity for your organization.

Here are 10 ways to raise the cybersecurity bar in your organization today!

1) PASSWORD PROTECT EVERY DEVICE

Every device that connects to the internet in any way should have a password. It should not be the default password from the manufacturer. A strong password is at least 12 characters that are a mix of numbers, symbols, and capital lowercase letters. Never reuse passwords and don’t share them on the phone, in texts, or by email. Limit the number of unsuccessful log-in attempts to limit brute force password-guessing attacks. Configure your systems to require passwords be changed at least quarterly.

2) UPDATE YOUR OPERATING SYSTEM AND DEVICE FIRMWARE

This includes your apps, web browsers, and operating systems. It may also include your software upgrades for security devices such as cameras and access control controllers. If possible, set updates to happen automatically. Many of these updates include patches and fixes for vulnerabilities that have been discovered.

3) USE MULTI-FACTOR AUTHENTICATION

Require multi-factor authentication to access areas of your network containing sensitive information. This requires additional steps beyond logging in with a password — like a temporary code on a smartphone or a key that’s inserted into a computer.

4) ENCRYPT YOUR DEVICES

Encrypt devices and other media that contain sensitive personal information. These include laptops, tablets, smartphones, removable drives, backup tapes, and cloud storage solutions.

5) DISABLE ALL PORTS NOT IN USE

Confirm that the organization’s IT personnel have disabled all ports and protocols that are not essential for business purposes. Switches that have open ports that have not been turned off are literally open doors to your data.

6) USE EMAIL AUTHENTICATION

When you set up your business email, make sure the email provider offers email authentication technology. That way, when you send an email from your company’s server, the receiving servers can confirm that the email is really from you. If it’s not, the receiving servers may block the email and foil an email imposter.

7) TRAIN YOUR STAFF

Teach your staff how to avoid phishing scams and show them some of the common ways computers and devices become infected. Include tips for spotting and protecting against Ransomware in your regular orientation and training. Also, train them to never share passwords or leave devices such as cell phones unattended or computers unlocked when they step away.

8) THINK BEFORE YOU CLICK

More than 90% of successful cyber-attacks start with a phishing email.

A phishing scheme is when a link or webpage looks legitimate, but it’s a trick designed by bad actors to have you reveal your passwords, social security number, credit card numbers, or other sensitive information. Once they have that information, they can use it on legitimate sites. And they may try to get you to run malicious software, also known as malware. If it’s a link you don’t recognize, trust your instincts, and think before you click.

9) LOWER REPORTING THRESHOLDS:

Every organization should have documented thresholds for reporting potential cyber incidents to senior management and to the U.S. government. Senior management should establish an expectation that any indications of malicious cyber activity, even if blocked by security controls, should be reported to report@cisa.gov. Lowering thresholds will ensure we are able to immediately identify an issue and help protect against further attack or victims.

10) INSPECT, INSPECT, INSPECT!

You can have the greatest policies and procedures in the world. However, to get the best results you must test and inspect your system regularly. A member of senior leadership should randomly test and inspect your systems for compliance.

Need Some help implementing these standards? Give us a call!

Viakoo can proactively update IoT devices, strengthening your protection against hacking attempts.

September 28, 2022/in Commercial Security, Cyber Security/by Neal Bellamy

By Neal Bellamy, IT Director at Kenton Brothers

Hacking, at its root level, is a person using a computer program for a purpose that is not intended. It’s like discovering a person walking a dog and then using the dog to attack someone. That wasn’t the intent of the person walking the dog, but the hacker was able to take control. In order to “hack”, the attacker must find a weakness in the software and then exploit the weakness. In the ever-evolving game of cat and mouse, weaknesses get found and software gets modified to patch those weaknesses.

Most successful hacks are possible because the software on a device is outdated.

Even though previous weaknesses have been fixed with software updates, the newest software has not yet been installed, and new weaknesses are found that can be exploited.

In other areas of information technology (IT), we have tools to detect and notify us when software needs to be updated. Most people are probably familiar with Windows Update, the little icon on the lower right that tells us new software is ready to be installed. There are many other systems that can also notify and even update the software automatically. But there is an area of IT that generally gets missed…

The Internet of Things

The Internet of Things (IoT) is defined as “a system of interrelated computing devices, mechanical and digital machines, objects, animals or people that are provided with unique identifiers (UIDs) and the ability to transfer data over a network without requiring human-to-human or human-to-computer interaction.”

IoT has been around for decades. We’ve used and interacted with IoT devices in our offices for as long as I can remember. Things like copiers, scanners, and credit card machines are all examples of devices that usually are on the network and can send and receive data.

In the commercial security world, cameras and access control panels are also IoT devices. Anything that you can interact with and not have to touch is an IoT device. Can you adjust your thermostat from anywhere in the world? If so, It’s an IoT device. IoT is transforming our world and has been for many years now. It is making our lives more convenient and more connected. The security risk with IoT is that most devices are installed and never updated. If there is a security weakness detected, the software may never get installed… leaving that device wide open for being compromised.

Most companies spend a lot of IT time and money protecting servers, firewalls, and desktops to make sure that they have the latest software updates and are secure. But the IoT devices are usually left out of the discussion. IoT devices are now one of the largest attack vectors for malicious hackers. These “Set and Forget” devices are often left unprotected and sometimes directly connected to the internet. (Please don’t connect anything, except a firewall, directly to the internet; There are better ways.) As a whole, we have to do a better job of protecting these devices.

Part of the answer for the physical security world could be Viakoo’s new offering.

Viakoo has been offering camera, access control, and IoT monitoring for quite a while.

At their core, Viakoo will catalog all of your devices and monitor them at varying levels to make sure they are operational. And now Viakoo is taking it to the next level. Viakoo is offering IoT risk evaluation and IoT risk remediation. In evaluating the risk of each IoT device, Viakoo looks at the password, security certificates, and installed firmware version for each of the IoT devices. In supported devices, passwords can be changed and because Viakoo is already connected to some video management software (VMS), it can even change the password in the VMS so the video is not lost. Viakoo can also install new certificates in supported IoT devices so that they can be trusted at a higher level.

Viakoo can push new firmware to all the devices across the network. Since Viakoo architecture is already designed to be installed at multiple sites and buildings, the firmware can be pushed across the entire corporate footprint at the same time. Viakoo works across many hardware and software manufacturers, which most competing systems are not yet capable of doing, making Viakoo a good choice for almost any business with IoT devices.

Viakoo is a simple subscription-based software that can catalog, evaluate and secure all of your IoT devices. If you want help in securing your IoT Devices, please give us a call!

Cyber Security is Complex: Don’t Bury Your Head in the Sand