Blog

On Wednesday, November 14th, the Federal Financial Examination Council (FFIEC) released an updated version of the Business Continuity Management Booklet. One of the changes is related to business continuity and disaster recover exercises and tests. In the new booklet, the FFIEC redefines the testing methods and introduces more delineation between a BCP exercise and a BCP test.

What is a BCP Exercise?

According to the new booklet, "an exercise is a task or activity involving people and processes that is designed to validate one or more aspects of the BCP or related procedures" (p. 37). Each exercise can look different depending on the scope, goals, and objectives of the test. Some exercises can be discussion only (i.e. tabletop discussion) while others could be comprehensive (i.e. full-scale exercise).

What is a BCP Test?

The new booklet defines a test as a "type of exercise intended to verify the quality, performance, or reliability of system resilience in an operational environment" (p. 37). Tests typically focus on a system or set of systems. An example of a test might be verifying back on a server is functions or verifying recovery time objectives (RTOs) are acceptable for a system. The big difference according to the booklet is, "exercises address people, processes, and systems whereas tests address specific aspects of a system" (p. 38).

How are the testing methods different in the new booklet?

Examples of testing methods from the older 2015 Business Continuity Planning Booklet included (p. 18):

  • Tabletop Exercise Structured Walk-Through Test. "[The tabletop exercise structured walk-through tests] primary objective is to ensure that critical personnel from all areas are familiar with the BCP and that the plan accurately reflects the financial institution's ability to recover from a disaster."
  • Walk-Through Drill/Simulation Test. "A walk-through drill/simulation test is somewhat more involved than a tabletop exercise/structured walk-through test because the participants choose a specific event scenario and apply the BCP to it."
  • Functional Drill/Parallel Test. "Functional drill/parallel testing is the first type of test that involves the actual mobilization of personnel to other sites in an attempt to establish communications and perform actual recovery processing as set forth in the BCP."
  • Full-Interruption/Full-Scale Test. "In a full-scale test, a real-life emergency is simulated as closely as possible."

The new testing methods introduced in the 2019 Business Continuity Management Booklet map closely to its predecessor; however, they are renamed and have slight differentiators (pp. 42-44).

  • Full-Scale Exercise. "A full-scale exercise simulates full use of available resources (personnel and systems) prompting a full recovery of business processes."
  • Limited-Scale Exercise. "A limited-scale exercise is a simulation involving applicable resources (personnel and systems) to recover targeted business processes."
  • Tabletop Exercise. "A tabletop exercise (sometimes referred to as a walk-through) is a discussion during which personnel review their BCP-defined roles and discuss their responses during an adverse event simulation."
  • Tests. "Management uses tests to verify the quantifiable performance and reliability of system resilience."

What does this mean for me?

The new FFIEC guidance highlights the "people and processes" aspects of your organization's BCP. This is a shift in focus from the 2015 BCP booklet in which testing guidance more heavily emphasized testing IT systems and system components. This change can be seen in the definitions of the testing methods. Personnel are specifically included in all four of the "exercise" definitions whereas the definition of "tests" is only concerned with validating system resilience.

What hasn't changed is BCP exercises and tests are used to validate one or more aspects of an enterprise-wide BCP. Financial institutions should incorporate a variety of exercises and tests into their overall BCP test program in order to ensure the institution can restore operations and recover from business interruptions. While the test program will be different based on each institution's size and complexity, strong test plans include strategies to evaluate all aspects of the institution's BCP, including people and processes as well as IT systems.

Resources

For more information about the updated booklet, visit:

 


 

When removing unwanted Windows 10 Apps via Powershell scripts, the process for removing it for all users deletes the AppXPackages from C:\Program Files\WindowsApps. This is normally the intended process, however, most scripts used to remove these use shorthand names such as "Netflix" to find the package label of the appxbundle then using the full path found, delete it. The reason the shorthand is used is because every major release of Windows 10 (1809, 1903, etc) changes these packages. This shorthand method has at times removed packages unintentionally. In order to add the package back you need to find the .appxbundle and .xml of the exact version of Windows 10 you are using. An in place upgrade can be done to replace the missing packages, however, remotely that's not always a feasible/safe option.
 
Microsoft has a Windows 10 Inbox Apps ISO for each available Windows 10 version. These can be found on the Microsoft Volume Licensing Service Center. In order to reinstall the package use the following steps.
  • Mount ISO
    • Mount the ISO or UNC path with Packages to be added.
    • Open Powershell as Admin
    • Run powershell command: Add-AppxProvisionedPackage -Online -PackagePath <path to .appxbundle> -LicensePath <path to .xml>
      • Add-AppxProvisionedPackage -Online -PackagePath "D:\x86fre\Microsoft.WindowsCalculator_8wekyb3d8bbwe.appxbundle" –LicensePath "D:\x86fre\Microsoft.WindowsCalculator_8wekyb3d8bbwe.xml"
 

 

I was working with a Windows Surface where the user would open File Explorer from the taskbar and it would freeze.  The window showed the message "Getting Things Ready" and would never open.  
 
The first time I looked at this, I ended up deleting all of the user's quick access history thinking there was corruption somewhere.  This resolved the issue for about 3 weeks until it returned.
 
I was able to right click on the Windows logo, click run, and open C:\ with no issues loading the file explorer window.  Clicking on quick access had no issues, as long as I didn't open file explorer from the taskbar.
 
The fix for this is to open file explorer as previously mentioned to the C:\ through run command, go to view, and click options.  In the general tab is a drop down that says "Open File Explorer to: "Quick access" or "This PC".  
 
Changing the setting from "Quick access" to "This PC" resolved file explorer freezing when opened from the taskbar.
 

 

Recently I noticed the fingerprint reader on my T450s had stopped working. I cleaned it, rebooted my laptop (twice), and it still didn't work. I went to Device Manager and didn't see Biometric Devices or anything resembling Synaptics, so I started researching what the problem may have been. I saw a lot of suggestions such as modifying registry keys and such, but I avoid those steps without proper supervision. Eventually I finally found a solution that fixed my fingerprint reader issue. Go to Settings\Apps\Apps & Features\Search for Synaptics and then select Uninstall. After the reboot, my fingerprint reader was working again. I went into Device Manager and confirmed Biometric Devices was there again, and made sure the driver was updated.


 

We've all done it before — searched for instructions on something we feel like we should be able to do ourselves. Whether it's how to tie a bow tie, how to change your oil, or how to repair a smartphone, people are constantly looking to do things for themselves. Naturally there are tasks beyond our actual ability, but can you blame any of us for trying? We have the information, resources, and always the desire to save money. That being said, one of the things that is likely beyond DIY abilities is combating cyberattacks for your business.

There are a seemingly unlimited number of cybersecurity solutions created to help businesses protect the personal and financial information of their customers. These services are best supported by cybersecurity companies, but far too often business owners and IT managers look to buy the tools and attempt to do it themselves. But can you really learn everything you need to about technologies like SIEM and then defend against cyber-attacks?

This blog will explain why you not only need cybersecurity tools, but also cybersecurity vendors to provide you with effective solutions.

SIEM Systems Need Constant Management

Depending on the SIEM system, there are different approaches for cybersecurity monitoring and protection. No matter if the SIEM tool is made by Intel, IBM, or Fortinet, the overall goal of being notified of attackers is the same. However, one may have a larger range of coverage for devices and log types, while another may have a specific log manager that picks up different events. Whatever it may be, the solution will collect information and present an analysis, but to optimize your security there should be someone managing the system full-time.

Let's say you want to build a shed in your backyard to protect some equipment and toys from the rain, and you have a hammer, plenty of nails, wood, and a few other tools. Unfortunately, nothing will get done if you don't pick up the hammer. While it is great that you have the necessary tools and supplies, but you will never build a shed to protect your equipment and toys if no one is utilizing the tools. It is the same with these SIEM services, or tools — without full-time personnel, ideally from a professional cybersecurity company, you are at risk of missing critical notifications and real threats.

Why Cybersecurity is not a DIY Product

If you don't necessarily think this is the case and you feel confident that you'll be able to check up on the program every now and again, you might want to reconsider. There were 668 million breaches in the U.S. just last year alone (the year before, there were over 1.5 billion breaches); this means that over 668 million times confidential information was exposed without permission. Also, 38% of the world's cyberattacks are targeted at the United States. While we are legally required to secure our customers' information, these numbers alone highlight the magnitude of the problem and the necessity to invest in a solid cybersecurity company's services. With a constant attack from unseen sources, are you really all that confident that you'll be able to manage it all yourself?

Let's again assume you are determined in doing this all yourself. Are you proficient in programming Java or C/C++? Do you understand web application technologies? Linux operating systems? Telephony technologies (analog and Voice over IP)? Okay, well…maybe you don't but you can learn, right? If that is the case, are you planning on learning on the fly from a couple of online videos? We don't want to discourage you from learning, but we need to be realistic. Installing a SIEM program and then following a manual to figure out how to make everything work is about as easy as putting a 4th grader, who is just able to read decently well, into a college-level biology and expect them to do be successful. The information is right in front of them, but can you really expect that?

Maybe we aren't giving you enough credit and you actually do understand all of these things — if that is the case, good for you for sticking with this blog and reading all the way to here — but can you handle reading all the analyzed data for every device for your entire company every day? That's where the benefit of hiring a cybersecurity company to manage the entire SIEM system for you comes into play. Not only will you have a service that is customized to your business, but you will also have a team of experts constantly reviewing your system for dangerous activity. With just the SIEM tool at your disposition, you may be alerted when a breach is detected but what will you do from there? A Managed Security Provider like this will not only notify you but also assist with a solution.

The wisest approach when you are looking to improve your company's cybersecurity is to not only purchase one of the many tools that are on the market, but make sure you also have a cybersecurity company on your side providing you with all the support you need.


 

When a FortiGate is managed via FortiManager, administering the FortiGate outside of FortiManager can cause the configuration to become out of sync. While updating an SSL certificate used for VPN access on a FortiGate for a customer, I found that I was unable to create a certificate signing request from FortiManager. After doing some research, I found a Fortinet cookbook article that explains that the certificate must be requested and the certificate request completed from the FortiGate itself, even if the device is managed via FortiManager. To complete this process, do the following:
  • Login to the FortiGate in read-write mode
    • Create a certificate signing request on the FortiGate
    • Download the certificate signing request from the FortiGate
    • Submit the certificate signing request to the certificate authority
    • Download the issued certificate from the certificate authority
    • Import the certificate on the FortiGate to complete the certificate signing request
  • Login to FortiManager
    • Select the FortiGate in Device Manager and go to the "System: Dashboard" page
    • In the "Configuration and Installation Status" pane, click the "Revision History" (four horizontal lines) icon on the "Total Revisions" line
    • Click the "Retrieve Config" button
    • The current configuration, including the new certificate, will be retrieved.
    • The certificate should now be able to be used in configurations managed in FortiManager
If you are deleting the old certificate, you will need to write the config to the FortiGate from FortiManager so that it is no longer using the old certificate. After the old certificate is no longer in use, you can login to the FortiGate in read-write mode and delete the old certificate. After the old certificate is deleted, you will need to repeat the "Retrieve Config" operation.
 
The Fortinet cookbook article explaining this process can be found at https://kb.fortinet.com/kb/documentLink.do?externalID=FD35142

 

I was needing to add some interactive check boxes to a Word document, but found out that they only show up in the "Developer" menu, which does not show up by default in Word. To add the "Developer" tab menu, you must follow the following steps:

  1. Click the "File" drop down menu
  2. Click "Options" at the bottom of the menu
  3. Select "Customize Ribbon" on the left side of the dialog box that appears
  4. Choose "Main Tabs" from the "Customize the Ribbon" drop down menu
  5. Check the "Developer" box to enable it:

 

6. Then to add a checkbox, switch to the "Developer" tab and click the checkbox icon:


 

Unauthorized individuals have accessed nonpublic information, who do you notify? Whether it be documents discovered in dumpsters that should have been shredded, ransomware holding information hostage, or a tornado that blew files all over the county.

Definition of Information

Before we can determine appropriate action, we must first understand what exactly we are talking about. In this instance, we are talking about personally identifiable information (PII). The definition appears to be standard across all industries, whether it be financial industries, healthcare industries, or beyond. However, although information is considered publicly available information, once it is combined with consumer information for a service or product it then becomes nonpublic personal information.

U.S. Department of Homeland Security

The U.S. Department of Homeland Security released a factsheet that defines personally identifiable information (PII).

PII is any information that permits the identity of an individual to be directly or indirectly inferred, including any information which is linked or linkable to an individual. Some PII is not sensitive, such as that found on a business card. Other PII is Sensitive PII, which if lost, compromised, or disclosed without authorization, could result in substantial harm, embarrassment, inconvenience, or unfairness to an individual.

That definition leaves room for some interpretation, and even some misinterpretation if we are not careful.

Gramm-Leach-Bliley Act (GLBA)

In 1999, Congress adopted the Gramm-Leach-Bliley Act (GLBA) to provide a framework for the financial services industry. When talking about nonpublic information, we often reference GLBA; however, it is actually only a small section of the act. Title V of the GLBA defines nonpublic information as follows;

Nonpublic personal information may include individual items of information as well as lists of information. For example, nonpublic personal information may include names, addresses, phone numbers, social security numbers, income, credit score, and information obtained through Internet collection devices (i.e., cookies).

I like to think about it this way, what information of mine do I not want to be disclosed? When classifying data, do you assess the legal implications for information being disclosed? What about the reputational implications if customer or consumer information is disclosed?

Considerations for your Incident Response Plan

Avoiding notification does not guarantee the preservation of reputation. Notification paired with action already taken or to be taken can be used in your favor. No notification and the public learning of the disclosure from another source will rarely work to your advantage.

Your Incident Response Plan needs to include metrics to help determine what action is necessary. To help with that, address the following questions within your plan:

  • What types of information disclosure requires notification?
  • Who is notified?
    • Does your regulatory agency require notification? When in doubt, reach out to your regulatory agency. I know, I know! I hear the grumblings and eye rolls as I type this. Contrary to popular opinion, your examiners' sole purpose in their regulatory life is not to make you miserable, but rather to collaborate with you and help. Build that relationship with them.
    • Does law enforcement require notification? It is a good practice to notify law enforcement (local, FBI, Secret Service, etc.). They may not be able to assist with your incident; however, it is possible they are working on a case that is linked to yours.
    • Do service providers and/or insurance providers require notification? Some service agreements and insurance policies have very specific notification requirements identified. Make sure these are identified in your Incident Response Plan so you do not miss those in a time of crisis.
    • Do customers require notification? In 2005, the FFIEC agencies jointly issued a guidance, Response Programs for Unauthorized Access to Customer Information and Customer Notice. In it, it clearly states if customer information has been accessed in an unauthorized manner, timely customer notification is required.
    • Do consumers and/or the public require notification? What if rather than customers it was consumers affected? Individual notification may not be feasible. Assess the impact of notification, or lack thereof, to determine if notification is warranted. A consumer could be a potential customer, and the notification could be what sways them one way or the other.

As you are developing your notification procedures in your Incident Response Plan, keep in mind notification timing. For example, law enforcement may need to you hold off on notifying customers and/or the general public for investigative purposes. Your insurance policy may dictate they be notified prior to any other action taken. Make sure your plan outlines these, and are reviewed as part of your Incident Response testing.

In the End

According to the Identity Theft Resource Center, in July 2019 alone, 104,546,381 sensitive records were exposed due to varying types of breaches. This indicates information disclosure is inevitable, which means having a strong notification strategy is necessary.


 

On May 24, 2019, Fortinet published an advisory stating that certain versions of their FortiOS software are vulnerable to a path traversal attack which allows an attacker to download system files through specially crafted HTTP requests. The vulnerability is only present when the SSL VPN service is enabled – either web-mode or tunnel-mode. The vulnerable FortiOS versions and the corresponding patched versions are:

  • FortiOS 6.0.0 to 6.0.4
    • Patched version: 6.0.5 or above
  • FortiOS 5.6.3 to 5.6.7
    • Patched version: 5.6.8 or above
  • FortiOS 5.4.6 to 5.4.12
    • Patched version: 5.4.13 (upcoming)

CoNetrix Security Penetration Test engineers have confirmed this vulnerability can be used to download usernames and passwords from FortiGate devices. The usernames and passwords can then be used to establish an SSL VPN connection which would give an attacker access to internal networks and systems.

CoNetrix strongly recommends all customers ensure the patched versions of FortiOS listed above are installed on all Fortinet devices that have the SSL VPN service enabled.

CoNetrix Technology customers with managed service agreements have already been updated to the FortiOS version to protect against the vulnerability.

References:
https://fortiguard.com/psirt/FG-IR-18-384
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-13379


 

We've had some frustrations with end users shutting down their machines accidentally at end of day, causing updates and software pushes after hours to fail. We wanted users to have the ability to restart, and for administrators to be able to shut down machines if needed. We investigated a few options using group policy and user rights assignment, but both options ultimately did not work out because it removed the ability for the user to restart their machine.
 
After some research, a recent post in a Citrix forum made a note of a new registry hive that was released with either the 1703 or 1709 build of Windows 10 that allows for way more granularity when it comes to managing the desktop interface. This includes a key specifically for only removing the shutdown option from both the "Shut down" or "Sign out" menu and the Power menu.
 
 
The registry hive can be found (or created) under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\current\device\Start