Posts

ChatGPT and automotive cybersecurity #2/2: TISAX certification

/in

This is the 2nd post about Automotive Cybersecurity.

Since I am working these days on CSMS (based on ISO ECE 21434 and TISAX), part of my companies consulting offer for automotive I thought maybe I check what ChatGPT things about them.

 

First post was about CSMS and ISO 21434 and this one is about TISAX.

 

Query:

Tell me about challenges in TISAX certification 

 

ChatGPT:

“TISAX (Trusted Information Security Assessment Exchange) is a security assessment and certification process for automotive suppliers. The certification is used to evaluate and ensure the information security capabilities of companies in the automotive sector.

There are several challenges associated with TISAX certification:

  • Complex requirements: TISAX has extensive and complex security requirements that can be difficult to understand and implement. Companies may struggle to meet these requirements and may need help from experts to achieve certification.
  • Resource constraints: Implementing the security measures required for TISAX certification can be resource-intensive and time-consuming. This can be especially challenging for small or medium-sized businesses.
  • Technical difficulties: Companies may face technical challenges in implementing the necessary security controls, particularly if their existing systems are not well-suited to the TISAX requirements.
  • Cost: The cost of TISAX certification can be significant, and this may be a challenge for companies with limited budgets.
  • Maintenance: TISAX certification must be maintained, and companies must continually evaluate and improve their security controls to stay certified. This can be a challenge, as the threat landscape is constantly evolving and new risks emerge.

Overall, TISAX certification requires a substantial investment of time, resources, and expertise, but it is considered an important aspect of information security for companies operating in the automotive sector.”

 

So, I have to say that this impressed me a bit …

I have always difficulties explaining to my customers why is it so hard to pass the TISAX audit.

It is all true, and actually it is quite a challenge to get companies to commit to a long term cooperation with a consulting company, which can help them understand the requirements and teach them how to apply them.

 

Conclusion: 

I will get back to ChatGPT from time to time and try to get such short descriptions for various things I need.

The post ChatGPT and automotive cybersecurity #2/2: TISAX certification first appeared on Sorin Mustaca on Cybersecurity.

Risk Assessment of AWS services used in building a resilient Web App on AWS

/in

We wrote here in the article “Building Resilient Web Applications on AWS: A Comprehensive Approach to Security” how to use certain AWS services to implement a resilient web based application.

The services mentioned require also a brief analysis in respect to Security, Confidentiality, Integrity, Availability and Privacy.

 

CloudTrail

AWS CloudTrail records API calls and creates log files, providing visibility into user activity, resource changes, and actions taken within your AWS account.

Risk Assessment

  • Security: Unauthorized modifications to CloudTrail settings or log tampering.
  • Confidentiality: Exposure of sensitive log data.
  • Integrity: Unauthorized access to CloudTrail logs.
  • Availability: Disruptions in CloudTrail could impact auditability.

Mitigation

Implement access controls, enable log file integrity validation, regularly review logs, and use redundant log storage.

Privacy

  • Data Collection: CloudTrail logs AWS account activity, potentially containing sensitive information.
  • Data Storage: Logs include API calls and identity details, stored securely by AWS.
  • Data Retention: AWS retains logs for a limited time and may use aggregated data for service improvement.

 

CloudWatch

CloudWatch is a monitoring service that provides real-time insights into AWS resources and applications, helping you respond quickly to events or changes in your environment.

Risk Assessment

  • Security: Unauthorized access to CloudWatch data.
  • Confidentiality: Exposure of sensitive monitoring data.
  • Integrity: Unauthorized modifications to monitoring configurations.
  • Availability: Relies on underlying infrastructure; disruptions may impact real-time monitoring.

Mitigation

Implement access controls, encrypt sensitive data, conduct regular audits, and employ redundancy for critical components.

Privacy

  • Data Collection: CloudWatch collects and monitors performance and operational data.
  • Data Storage: Metric data and configurations are stored securely by AWS.
  • Data Retention: AWS retains metric data for a limited time and may use aggregated data for service improvement.

 

AWS IAM

IAM is AWS’ cloud-based identity and access management service, providing authentication and authorization for users and devices.

Risk Assessment

  • Security: Unauthorized access to user accounts or directory configurations.
  • Confidentiality: Exposure of sensitive identity information.
  • Integrity: Unauthorized modifications to user attributes or directory settings.
  • Availability: Downtime impacting authentication and access control.

Mitigation

Implement multi-factor authentication, strong password policies, regular security audits.

Privacy

  • Data Collection: AWS IAM collects and manages user authentication and authorization data.
  • Data Storage: User identities, permissions, and access policies are stored securely by AWS.
  • Data Retention: AWS retains user data for service functionality and may use aggregated data for service improvement, but individual user data is not disclosed externally.

AWS Fargate

AWS Fargate is a serverless compute engine for containers that lets you run containers without managing the underlying infrastructure.

Risk Assessment

  • Security: Unauthorized access to containerized applications.
  • Confidentiality: Exposure of sensitive container configurations.
  • Integrity: Unauthorized modifications to container environments.
  • Availability: Downtime impacting containerized application execution.

Mitigation

Implement access controls, encrypt container data, conduct regular security scans, and deploy in a redundant and scalable manner.

Privacy

  • Data Collection: Fargate processes and manages containerized applications.
  • Data Storage: Task and container configurations are stored securely by AWS.
  • Data Retention: AWS retains task and container data for a limited time and may use aggregated data for service improvement.

AWS WAF (Web Application Firewall)

AWS WAF is a web application firewall that helps protect web applications from common web exploits, such as SQL injection, cross-site scripting (XSS), and other malicious attacks.

It allows users to create custom rules or use managed rule sets to filter and block malicious traffic before it reaches applications.

Risk Assessment

  • Security: Unauthorized access to WAF configurations, potential bypassing of WAF rules by sophisticated attackers.
  • Confidentiality: Exposure of sensitive application data due to successful attacks.
  • Integrity: Unauthorized modifications to WAF rules or configurations.
  • Availability: Downtime or service disruption due to misconfigurations or overwhelming attacks.

Mitigation

Implement strong access controls, regularly update and fine-tune WAF rules, use managed rule sets, enable logging for analysis, and deploy redundant WAF instances for increased availability and load distribution.

Privacy

  • Data Collection: WAF collects logs containing information about incoming requests, potential threats, and blocked requests for security analysis.
  • Data Storage: Logs may include IP addresses and request details but are retained for a limited time, following AWS data retention policies.
  • Data Retention: AWS may use aggregated and anonymized data for improving the service but doesn’t share identifiable customer information.

 

 

AWS Lambda

A serverless stack based on AWS Lambda allows developers to build and deploy applications without managing servers, handling scalability automatically.

Risk Assessment

  • Security: Unauthorized access to serverless functions and configurations.
  • Confidentiality: Exposure of sensitive code and data processed by Lambdas.
  • Integrity: Unauthorized modifications to serverless function code.
  • Availability: Downtime impacting serverless function execution.

Mitigation

Implement access controls, encrypt sensitive data, conduct regular security scans, deploy in a redundant manner, and monitor for anomalies.

Privacy

  • Data Collection: Lambda functions process and execute code, potentially handling sensitive data.
  • Data Storage: Function configurations and logs may include details about processed data.
  • Data Retention: AWS retains logs for a limited time and may use aggregated data for service improvement.

AWS Secrets Manager

AWS Secrets Manager helps you protect access to your applications, services, and IT resources without upfront investment and on-going maintenance costs.

Risk Assessment

  • Security: Unauthorized access to stored secrets.
  • Confidentiality: Exposure of sensitive credentials and configuration details.
  • Integrity: Unauthorized modifications to stored secrets.
  • Availability: Downtime impacting applications relying on stored secrets.

Mitigation

Implement access controls, regularly rotate secrets, encrypt stored secrets, conduct regular audits, and use redundant Secrets Manager configurations.

Privacy

  • Data Collection: Secrets Manager stores sensitive configuration and credential data.
  • Data Storage: Secret configurations and access logs may include details about stored data.
  • Data Retention: AWS retains access logs for a limited time and may use aggregated data for service improvement.

CloudFront

Amazon CloudFront is a content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency and high transfer speeds.

It integrates with other Amazon Web Services products to give developers and businesses an easy way to distribute content to end-users.

 

Risk Assessment

  • Security: Unauthorized access to cached content or configurations, potential for content tampering during distribution.
  • Confidentiality: Exposure of sensitive content during distribution.
  • Integrity: Unauthorized modifications to distribution settings or cached content.
  • Availability: Downtime impacting content delivery due to misconfigurations or attacks.

Privacy

  • Data Collection: CloudFront collects logs that include IP addresses, user-agents, and request details for analytics and troubleshooting.
  • Data Storage: Logs may contain user-related information, but Amazon retains them for a limited period and follows privacy regulations.
  • Data Retention: Amazon may share aggregated and anonymized data for service improvement but doesn’t disclose individual customer data.

AWS S3

Amazon S3 is a scalable object storage service designed to store and retrieve any amount of data at any time.

Risk Assessment

  • Security: Unauthorized access to stored objects or bucket configurations.
  • Confidentiality: Exposure of sensitive data stored in S3.
  • Integrity: Unauthorized modifications to stored objects.
  • Availability: Downtime impacting data storage and retrieval.

 

Mitigation

Implement access controls, encrypt data at rest, conduct regular audits, use versioning, and deploy redundant S3 configurations.

 

Privacy

  • Data Collection: S3 stores object data, potentially including sensitive information.
  • Data Storage: Bucket configurations and access logs may include details about stored data.
  • Data Retention: AWS retains access logs for a limited time and may use aggregated data for service improvement.

EC2 (Elastic Compute Cloud)

AWS EC2 provides resizable compute capacity in the cloud, allowing users to run virtual servers for various applications and workloads.

Risk Assessment

  • Security: Unauthorized access to EC2 instances.
  • Confidentiality: Exposure of sensitive data processed by EC2 instances.
  • Integrity: Unauthorized modifications to instance configurations.
  • Availability: Downtime impacting applications hosted on EC2.

Mitigation

Implement access controls, regularly patch and update instances, encrypt sensitive data, deploy in a redundant manner, and use Auto Scaling for increased availability.

Privacy

  • Data Collection: EC2 instances may process and store data, potentially including sensitive information.
  • Data Storage: Instance configurations and logs may contain details about processed data.
  • Data Retention: AWS retains logs for a limited time and may use aggregated data for service improvement.

The post Risk Assessment of AWS services used in building a resilient Web App on AWS first appeared on Sorin Mustaca on Cybersecurity.

How to make sure your product’s reputation is good

/in

If your product is already on the market, or if you just want to release it, you need to ensure that it has a good reputation.
Balancing features that improve monetization with criteria that lower the product’s reputation is not an easy task.
For this you need a partner with experience in Product and Project Management for security products.
We can help you find the right balance that will keep you out of the radar of big AV companies, Appesteem and others, without losing revenue and customers on the long term.

Contact us for a discussion.
endpointcs-logo

https://www.endpoint-cybersecurity.com/portfolio-item/product-and-project-management

#cybersecurity #productmanagement #security #appesteem #pua #reputation #antivirus

One year later: challenges for young anti-malware products today (presentation Virus Bulletin 2020)

/in

Downloads

 

A year ago, at VB2019 we presented for the first time an overview of how the anti-malware world looks from the perspective of a young company trying to enter the market: how they try to build products, how they try to enter the market, how they try to convert users, and what challenges they face in these activities.

In this new paper we will present an overview of the situation for such a company after one year of experience. We will look at the situation from several angles:

    • that of the consulting company helping them to build the product and enter the market

 

    • that of working with certification companies regularly, checking the products for detection and performance

 

  • that of working with Microsoft to make the company compliant and keep them compliant

One year later, many still have a hard time understanding that the security market is no longer the Wild Wild West, but we also see that a lot of visible efforts are being made to improve. This means that compliance with ‘clean software’ regulations is becoming an issue. We will present some interesting statistics and compare data from the past with current data. The young companies still have a lot of challenges in understanding that implementing AV software is not the same as implementing any other type of software. Despite the fact that they still get flagged by the established products for various reasons, there are still more and more companies trying to enter the market.

A lot of people in the audience will ask themselves ‘why would anyone want to enter the market, since the market is overcrowded, there are plenty of free products out there, and on Windows there is also Microsoft Defender?’. We will try to provide an answer to this question, but the answer is not what many think it is. Or, maybe it is …

 

 

Video