Episode 01: Endpoint Security Best Practices (HexCon20)

Hello, welcome to XCON 20. I am Bob Fabien Zinga, the Head of Information Security at Doitly. A little bit about myself: you can find me on LinkedIn.com in Bob Fabien Zinga, or my personal website bobfabienzinga.com, or on the Forbes Technology Council website. I have 20+ years experience in IT working in complex environment. And since 2005, I've been working to establish, lead, and manage cybersecurity program within higher education, state and federal government, Department of Defense, and since 2014, tech industry here in Silicon Valley. So welcome back to XCOM 20, and I'm talking about endpoint security best practices. So why is this important? Why am I speaking about endpoint security and why are you listening to me now? Well, the bottom line is endpoint security is extremely important because endpoint devices provide an entry point for threats into your organization, your network. I am currently working on an article for Forbes.com about 3 ways security and IT can facilitate business resiliency in the midst of a global pandemic. And one of the points I highlight is the use of MDM to centrally manage endpoint device on an organization network. And this is critically important. Do your research. Use the best MDM solution out there. So you are here at XCOM 20. So hopefully you are going to spend some time and at least look at XNOD. MDM solution as well. So a modern MDM solution should definitely ensure that all endpoints in a network are using a modern operating system. So this is critically important because, as an example, Apple, since OS X, right, we had 10.0, 10.1, 10.3, and recently Apple released macOS 11, Big Sur. So there are several versions of this wonderful operating system. Why is it important for you to know? Well, last month, November 12th, Apple released a patch for Safari 14.0.1. And notice that the security patch Apple released was only for macOS Catalina and Mojave. That's it, right? Catalina and Mojave. This patch was not for High Sierra, it was not for Sierra, it definitely wasn't for El Capitan, right? So that is why it is very important for you to know which operating system are running on your network and ensure that all of your devices are running the latest or the most secure version of the operating system. Another thing with technology is usually With time, the business value of the technology decreases while the risk, right, increases significantly. As an example, if you're using an older version of, let's say, macOS 10.0, and Apple is no longer releasing security patches for that operating system, you are really putting yourself at risk, right? So the best practice is for you to really recycle obsolete hardware. If your hardware cannot run the last free version of the operating system that Apple is still supporting today, you really should recycle it. And when you do, make sure you permanently delete any data in the hard drive. Very, very important. So again, if you are using any prior version of the macOS operating system prior to Mojave, you really should think about recycling those devices if you cannot upgrade them. And when you do recycle hardware, just make sure to, again, permanently delete the data in the hard drive. In the past, some hard drives have been sold on eBay containing very, very sensitive government data, so that shouldn't be you or your organization. Another thing a modern MDM platform should ensure is FDE, right, full drive encryption, full disk encryption, ensuring that the hard drive of each one of your devices are fully encrypted. That's very, very important because if your device is lost or stolen, you could just send the signal to the device to remote wipe everything on the hard drive, which is great. And also you may not have to do a breach notification if personal data was compromised, right? In the past, when personal data of some of your clients or employees has been breached, you usually have to notify them, and many times you also have to spend money to provide some type of credit monitoring service. But if the drive was fully encrypted and you wiped it, then nobody is going to get access to that data. So basically, the device turns into a paperweight, right? So many of the modern MDM solutions would also allow you to enforce a security password standard based on your security policy or passcode for your mobile devices—iPhone, tablet, and smartphones—and sometimes even two-factor authentication. So when it comes to password, You really want to make sure that the password is a long password, and by long password is definitely more than 8 characters, right? 12 characters or more is really what's recommended these days. Anything shorter than that is easily crackable. So, and also when you use a password, unfortunately for many, many systems, that's really the only control between you and the sensitive data on the platform. So make sure it is a complex password, meaning You must use uppercase character, lowercase character, special characters, and number. And also do not use the same password everywhere, because if you do that, someone can break into your Google account and then be able to log in into your Yahoo account, into your bank, and into your work computer and everywhere else. So you really do not want that. And for passcode, make sure you use 8 characters or more. I know for most banks today, the ATM card use 4 characters only. But that's really not very secure, especially if you're using 111 or 1234. Those are extremely common. So if you are using any of those today, please, please change your PIN. Okay, try to use 8 characters long or more, and also try to spell a word. This way your passcode, your PIN, will be different on every single system you have to use a PIN. Or a passcode. For example, if you want to spell Tom, T is 8, right, right here. And then O is 6 and N is 6 also. So it will be 8 6s to spell Tom. So spell a word, 8 characters or more, and let that be your passcode. Now you also need two-factor authentication and two-factor authentication. So it's something you know, something you have or something you are. So as an example, something you know is your password, but once you put in your password, then it asks you for something you have, like your phone. The system might send the SMS message to your phone, or you might need to use Google Authenticator or one of those apps, which is actually better than SMS, which will give you a code that usually lasts only about 30 seconds also to ensure that you are the person logging in. And then something you are is like your fingerprint. Many of the smartphones are now with the iPhone, the face scan. And again, you can enable all of those requirements in your MDM platform. And it's also very important to get the latest security software, even for Macs, right? So that's anti-malware, antivirus, software for all of your devices. Ensure that you have a screen lock, no, 10 minutes or less. The shorter, the better. For example, on my Mac, I have it set up to 5 minutes only, and on my iPhone to 2 minutes or less, but definitely no more than 10, 10 minutes. All right, stay updated. Update all of your application and operating system at least once Every month, once every 30 days, make sure you update all of your applications. And again, using an MDM platform, you can automate all of that and test your patches. And once everything works, again, within 30 days, distribute the— deploy the patches to all of your endpoint devices. As an example, Conficker, right? Conficker was discovered November 7th, 2008. So mostly affected Windows computers. And in January 2009, there were more than 12 million computers infected worldwide. Well, guess what? A patch was actually released October 23rd, 2008. Before it was discovered, the vendor had released a patch to fix just that. But because we just don't patch our system, even in March 2012, there were still about 3 million computers still infected when the patch had been released back in 2008. So that means there were at least 3 million computers that hadn't been patched from 2008 to 2012. 2012, right? That's like 4 years. So that is really not acceptable. We really, really need to patch our system. Well, you might say, well, I'm using a Mac. And back in the days, we used to say, Macs, you don't have to worry about malware or viruses, but that's not really the case anymore, is it? One great example is Flashback, right? Latest version was discovered April 2012, and Apple released a patch to fix it April 5th, 2012. Well, Oracle had actually released a patch earlier than that, February of 2012. But anyway, the point being, it doesn't matter what your operating system is, make sure you are patching your systems very, very frequently. And what's recommended? Once a month. Okay, 90% of all malware exploits are successful due to a patch not having been applied. Again, the vendor provides the patch, but we just get lazy sometimes and we do not apply them. And a great MDM solution would allow you to test those patches and then apply them across your entire network. Another thing that's important for endpoint security is turning on the firewall on the local device. One more thing. Try to restrict admin access if at all possible, right? Best practice is to have everyone in the organization only run their computer using limited accounts, standard access. And for the few people who need to have admin access, they will need to then log in as an administrator in order to do administrative tasks and then go back to using a standard account. That's the way it is in the military, in the US Navy. That's not always the case in Silicon Valley. If you absolutely cannot do that, then limit the number of people who can use admin privileges in your organization. I've worked for some companies in Silicon Valley that only allow the members of the engineering department to run with admin privileges. And everybody else uses a standard account. That's better than nothing, but think about it. So as a user, you also have to be aware of your environment, right? Because when we talk about endpoint security, it's about the risk, and you need to be aware of what you are connecting to. With IoT now, right, Internet of Things, you can use your phone to control the lighting in your house, the thermostat, change the temperature, open and close the garage door of your garage, and you can turn on your smart TV. So you are always connected, and of course the more things you connect to, the more you increase your cyber security exposure. So just be aware of what is going on around you, and if you don't need something, you need to turn it off, do not use it. You also need to consider freezing your credit, right, and monitoring your credit regularly, like once a month. Well, what does that have to do with endpoint security? Well, the truth is the only sure way of you never being hacked, your data never being breached, if you want to be 100% sure, is to take your computer, your mobile device, and bury it in the sand and never use it. The moment you turn it on, definitely the moment you connect to the internet, you definitely have a risk of the data eventually being breached. So freezing your credit is great because if an hacker is able to steal your identity, your personal information, at least they won't be able to open a new mortgage account or credit card account using your Social Security number because your credit will be frozen, right? So something to think about. Avoid malicious sites. And again, endpoint security has also a lot to do with user awareness, right? We talk about technology, which is great. We talk about processes and policies, but there are also people, right? And every time I provide a presentation, I always have the idea of educating the audience about being more aware about cybersecurity in general. So try to avoid any malicious site. And in many of the MDM platforms out there, you could also whitelist certain sites and don't allow porn or peer-to-peer traffic because not only copyright infringement, but a lot of the sites really carry a lot of malware. Right? And at home, you could think about something like Family Shield, which will block adult sites, proxy, anonymizer, and phishing sites and malware sites for you automatically once you set it up. But again, at work, you probably already have some type of whitelisting technology in place to prevent those. And when you log into a site, especially if you have to put in your username, your password, or if you have to access sensitive information, make sure you are using HTTPS, right? Make sure SSL certificates are on and working. For example, I remember in 2010, 2011, Facebook had HTTPS optional. Most people logged in on their Facebook account just using HTTP, www.facebook.com, and many, many, many accounts were compromised back then. I believe it was in 2012 where it became mandatory. You cannot log into Facebook just using HTTP any longer. So when you log into your bank account, social media, wherever you have to put in a username and password, just ensure that you are using HTTPS and that the SSL certificate is valid. Another thing to think about is using VPN. VPN is great because it encrypts all of your internet traffic from end to end, right? This way, even if an hacker is able to intercept your traffic, it's all going to be scrambled, right? So any man-in-the-middle attack would not be successful. All right, always be diligent, be skeptical. If something is too good to be true, it probably is. Be careful filling out surveys online and in social media. Some no-brainers up there, so back up your data. Very, very important to back up your data, and I definitely recommend backing up all data to a secure cloud. For example, directly all of our users back up their data on Google securely. This is very important because if anything happens to the data on your computer and if your hard drive stops working or whatever, you will still have access to all of your data on the cloud once you get a new computer. Or the hard drive has been replaced on your computer. And also, if you have ransomware or anything like that and they're asking you for money to decrypt the data on your hard drive, well, you can just reinstall the operating system and then access your backup data on the cloud. So very important to do. Another thing that is important with endpoint security is to frequently reboot your computer, right, at least once a week. The thing is, if your system administrator is sending security patches to your system using the MDM platform, many, many times security patches won't take effect until after you reboot the computer. So it's a very, very good idea to reboot the computer for that reason. But also, by rebooting your computer, the computer just works a lot better, faster, because it clears the memory cache. So be diligent with apps. Again, most MDM today would allow you to only allow sign software or approve software to run on your computer. Be diligent about that. Some final thoughts: use licensed software, right? Do not just install any software you find on the internet. Again, whitelisting software is very important for endpoint security. Use a very strong password. We already talked about that. So let's watch one final video about security in general. All right, so the bottom line is security is everybody's business. Endpoint security is very, very important, and there are really great MDM platforms out there that would allow an organization organization to apply this security setting across all devices and manage them. Thank you so much for allowing me to be here, and I really appreciate it. Bye.