Tag Archive for: Retire

CREST president Ian Glover to retire after 13 years – but where’s the transparency, bossman? • The Register

/in


Ian Glover, president of infosec accreditation body CREST, is stepping down from his post, he told the organisation’s annual general meeting yesterday.

Sources whispered of Glover’s departure to The Register ahead of a mass mailout today to members of the organisation, which oversees some industry-recognised penetration testing exams and certifications in the UK.

“My retirement is something I have been planning for some time and, while I leave with a heavy heart, I am confident CREST will continue to move forward in the hands of an excellent team,” said the man himself in a canned statement emailed round CREST member organisations, following his 13 years at the helm.

CREST had not responded to The Register‘s request to interview Glover by the time of writing. He will remain in post for another three months.

Glover was president of CREST when the exam-cheating scandal broke last year. A major CREST backer, pentesting firm NCC Group, had been creating cheat-sheets and walkthroughs for CREST certification exams.

Numerous ex-NCC sources told The Register of an internal culture where exam candidates were shown marked copies of past papers, in apparent breach of CREST’s non-disclosure agreement. Unlike school exams where past papers are freely circulated, CREST was supposed to rigidly control all of its exam materials to prevent their public disclosure at any stage. One source told us at the time: “The content of the exams and syllabus is intentionally extremely vague and under heavy NDA.”

People who worked hard to pass their CREST exams expressed disgust to El Reg that a significant backer of the industry body appeared to be spoon-feeding its staff the answers, raising questions about the exams’ integrity and the competence of people who ultimately sign off clients’ crown jewels as secure. Those clients include the British government and critical national infrastructure operators.

Rob Dartnall, chairman of CREST,…

Source…

Time to Retire a Cybersecurity Cliché

/in


I’ve had it.  It is time to retire some of the old, worn-out cybersecurity clichés polluting the landscape. Clichés are painful to hear.  At the top of the list is the ‘defender’s dilemma’. This platitude states that breaches occur because attackers only have to be right once, whereas defenders have to get cybersecurity right every single time. I’ll admit, I’ve used this cliché myself, but no longer!  This adage places organizations at a distinct disadvantage. Following this to its logical conclusion, it implies that no matter what you do, you are bound to fail. This seems to be a theme in many cybersecurity discussions, but it is a subject for another day.

The problem with the defender’s dilemma is that both parts of the statement are flawed.

Only One

Saying an attacker only needs to get it right once sounds like the idiom, “Even a blind squirrel finds a nut every so often.” The implication is that attackers do not need to work hard to breach security defenses. This is the exact opposite of reality. Attackers work at their trade. The MITRE ATT&CK knowledge base of adversary tactics and techniques explains the variety of activities required to successfully execute a cyberattack campaign.

Attackers must research their targets and conduct reconnaissance to determine the best entry point. Cybercriminals then need to compromise their target to gain a foothold. Next, they work to elevate privileges and compromise additional systems to facilitate lateral movement. Just like a physical thief, they search for valuables to steal in order to collect their payoff. To be successful, all of these activities must go undetected, otherwise the operation will be exposed.  When that happens, it is back to the beginning. This is not a job for a blind squirrel.

Perfect Security

On the defender’s side, by saying you must be right all the time is tantamount to advocating for perfect security. Perfect security is a fool’s errand – it isn’t going to happen. As Franz Kafka implied in his short story, “A Hunger Artist,” the search for perfection is, ultimately, the inability to accept reality for what it is. Absolute security fails because it creates an unwillingness to…

Source…