One of the most frustrating things is to sit in on a C-Suite meeting and hear the lofty strategic goals presented for the company and for cybersecurity only to have them torn to pieces when you explain what those goals will actually take and cost. The sticker shock that comes from understanding the moving pieces of a “Risk Intolerant” stance can be amusing, but in the end, it is more of an annoyance than anything. So, with that in mind I am going to discuss how to turn breakdown strategic goals into realistic tactical and logistical steps. I will not be focusing on anything specific but will follow some common guidelines and practices that can help bride the gap between ideals and reality It might also help inform future strategic statements by understanding the moving pieces involved in making them.

One of the most commonly asked questions in cybersecurity is “where do I start?” This common question shows just how overwhelmed many organizations are when faced with the reality of the threats that are out there. From ransomware to business email compromise, the threat actors certainly seem to be ahead of the implementations when it comes to securing the data that organizations are responsible for. So where should an organization start when it comes to building or optimizing their cybersecurity program?

Last week Microsoft, the FBI, and CISA made disclosed several attacks on Federal Civilian Executive Branch agencies and other targets of a campaign that appeared to be driven by a new threat group out of China. The attack we detected and tracked down using internal logging available to the GCC low-side tenants and with the help of Microsoft. Fortunately, GCC (Government Cloud Computing) Low Side is not supposed to contain or pass any classified information. It is intended to be used by government agencies and contractors that do not need or have authorization to access anything more than routine sensitive information. This does not reduce the seriousness of the attack and does beg the question on how well the tenants were secured by the cybersecurity teams involved, but at least nothing National Security related was compromised.

The UEFI (Unified Extensible Framework Interface) was the replacement for the old BIOS (Basic Input Output System). It was intended as an improvement to the underlying systems on a motherboard (also called mainboard) the motherboard controls communication between all components connected to it from CPUs, to memory, to GPUs, disk or solid-state drives, network cards… you get the picture. The old BIOS was limited and also susceptible to compromise in a number of rather simple ways. By moving to UEFI systems could become more complex without issues potential hardware conflicts, the UEFI structure was also much faster than the BIOS system meaning that as overall computing increased in speed the underlying controls for different components was up to the task.