Who'd want to be a CISO?

Challenging job, but increasingly well paid

Cyber Risk Insurance Won't Save Your Reputation

Be careful what you purchase and for what reason

Security and the Board Need to Speak the Same Language

How security leaders speak to thier C-Suite and Board can make all the difference

Australian Cybersecurity Outlook

Aussie healthcare scrambles to catch up

The Changing Face of the Security Leader

The role is changing, but what does the future hold?

Just keeping its head above water

New Zealand Healthcare steams forward with minimal security

Medical Tourism - Growing in Popularity

Safe, fun, and much, MUCH more cost-effecitive

Cyberespionage, and the Need for Norms

Harvard Political Review (external link)

Healthcare Needs better Access Control


A rising tide of opportunistic ransomware and targeted nation state cyber attacks against medical research labs working on cures for COVID19 has made cybersecurity a turning point for most providers.

Last week in the Cylera blog I wrote about Zero Trust which is slowly growing in popularity across organizations like Google, but has so far, only limited deployment across the healthcare industry. Zero trust may prove to be nothing more than another panacea at the end of the day against a rising tide of cyberattacks, or, it may prove to be a vital cog in the wheel that finally redresses the balance between defenders and attackers by minimizing what can be attacked. I'm betting on the latter personally.

Zero Trust works on the basis of well-known, frequently voiced, but usually not fully implemented security principles of 'Least Privilege' and 'Trust But Verify'. Trust your staff but verify their activity and don't provide them more access than they need to do their jobs. The principles are not too dissimilar to military personnel, where access is granted on the basis of 'need to know' following 'mandatory access control' principles - based upon your role, rank and assignment.

In other words instead of being given access to everything when you join an organization, you should be provided access only to what you need in order to do your job. You get a key to this box and that box but no other boxes and what you access is monitored. Essentially you have segmented or compartmentalized access rather than carte blanche. As your role or assignment changes, so certain keys are revoked and new ones are provided.

One way of looking at this segmentation approach is to think about the story of a fox in the hen house. Rather than one large hen house and one large door, segmentation places each hen in its own hen house with its own locked door. A hungry fox can then only get to one hen with each breach rather than them all at once as is the case in most hen houses today. By limiting and containing a successful attack, the fox only gets to steal one hen which may not be worth the effort to break down its coup door. The loss of one hen won’t put the farmer out of business and alerts him to the fact that there is a fox in his midst and to get his shotgun.

Of course, in this example the fox is an outside threat, but malicious insider threats are a growing concern with rising levels of cyber espionage and theft of commercial trade secrets and intellectual property by staff. The recent story of Xiaolang Zhang is perhaps a good example. Zhang, had worked at Apple in the Bay Area for several years on its autonomous self-driving car project. He announced his intention to leave the company after returning from a trip to China, in order to join a competitor XMotors (aka Xiaopeng Motors) based in Guangzhou.

Before handing in his resignation however, he trolled the Apple network for data and copied over 40GB of trade secrets, and walked out the building with a Linux server, and circuit boards. He was arrested by the FBI at San Jose airport before boarding a plane out of the country. Zhang was caught because he had gone outside of the swim-lane required for his role and had raised suspicions. 'Trust but Verify' in this case landed Zhang in court when verification of his activities took place and were found to be illegitimate.

In healthcare, there is an implicit trust across staff to do the right thing and a common belief that everyone is mission-orientated to provide the best possible patient care. However, that may not always be the case. The value of healthcare data – PII, PHI, and IP such as clinical research into new drugs and treatments is rising in value, and a number of clinical researchers have been caught stealing intellectual property of the hospital or research facility they work for.

Last year a husband and wife team, Yu Zhou, 49, and Li Chen, 46, were charged with stealing intellectual property related to pediatric medical treatments they had worked on while employed at Nationwide Children's Hospital in order to launch their own pharmaceutical company in China. When they took this company public in China, it netted them millions of dollars based on the cutting edge research developed at Nationwide Children's.

Zhou and Chen are not alone however, and nor are they the only Chinese citizens involved in medical IP theft. The NIH and FBI are investigating 180 individual cases of alleged intellectual property theft of biomedical research funded by the U.S. government, primarily involving Chinese or Chinese American researchers, The New York Times reports.

While the principles of Zero Trust and Segmentation would probably not have averted all of these attacks, it is likely that many could have been contained to smaller thefts of data, and alerts raised earlier as verification of access took place, thus alerting security staff to suspicious access.

Zero Trust is a key ingredient in helping to solve healthcare security. Not only is it a very effective preventative control, restricting access by users and objects like applications or devices to data, but it's also a critical indicator of risk, letting your operations team know when anomalous access behavior is attempted.

A Career in Cybersecurity

Anyone who is considering their career choices will have noticed that there's a lot of job openings in the cybersecurity space. Every week someone, somewhere, is trying to hire a cybersecurity professional of some particular skill set or other. The job ads are full of openings and anyone with 'cybersecurity' on their Linkedin profile or online resume, is probably getting connection requests from recruiters like they just won a large sum of money and offered to give it all away.

According to the Cisco Annual Cybersecurity Report for the past 5 years in a row, there has been a consistent 12x demand over supply for qualified, certified or experienced, security professionals. That means that there's currently 12 open security jobs for every person able to fill that role. With statistics like that, cybersecurity professionals will never be out of a job for long.

But what does it take to get into the field of cybersecurity? How do you get a foot in the door? How do you gain the experience that everyone is asking for to get the job in the first place?

Sometimes it can be a bit of a Catch 22 - and that's a bit of an understatement. Just read some of job postings requiring 'n' years experience for an 'entry' level position plus a current CISSP certification. However, those who may have looked into becoming a CISSP, will have noticed that not only do you need to sit and pass a grueling 6 hour long multiple choice exam (where every answer is correct but one is more correct than the others), but you also need 5 years of experience, or 4 years and a Masters Degree in cybersecurity or a related field, before you can become a CISSP. Its the classic Catch-22 - you can't get the job without the CISSP and you can't get the CISSP without the experience!

The truth is that job postings are written by HR professionals, most of whom have very little understanding of what the actual job they are hiring for involves. Someone should make a movie about it and call it "Recruiters are from Mars" because they might as well be. A classic example of this was a job posting I saw last week that wanted someone with ten years experience of Kubernetes. However Kubernetes is only five years old as a technology, so no one could possibly have more than five years experience. This post of course was quickly noticed by the security community and the job posting became the center of ridicule for a few days before it was taken down. Not only did it make a mockery of the reputable company that had posted it, but it highlighted the problem of unrealistic job posting requirements.

Someone should make a movie and call it "Recruiters are from Mars" because they might as well be.

Whether the problem ultimately lies with HR, recruiters or hiring managers, there is an unreal expectation in the cybersecurity space. This is a highly, highly, competitive space for scarce security resources so whether this comes down to company salary scales that are out of touch with market rates, and the need to use approved more senior job requirements to hire in junior staff at a rate they will consider, I don't know. But cybersecurity professionals are currently making at least 25 to 30 percent more than their peers in IT with the same experience and levels of qualifications.

Some of the job postings that demand all kinds of experience would probably command a salary package of at least a million dollars a year if someone had all of those skills, certifications and experience. While I would like to believe that security professionals in their 30s are making seven figure salary packages, that probably isn't the case for most. In other words, JOB REQUIREMENTS are nothing more than a WISH LIST.
But it's not just experience, the same is true for security certifications and academic qualifications. 

Any recruiter claiming that 'x' security experience, plus 'y' certifications, plus 'z' masters or doctoral degrees is a MUST HAVE, simply couldn't afford to hire that candidate if he or she walked through the door today. 

In other words, you should apply anyway. It might not work all of the time but you only need it to work once to get your foot in the door. It is after all, getting more competitive each year as more and more companies attempt to hire the few security resources that might be looking. Increasingly, companies are having to re-think who they hire, at what level, and what skills are really necessary. They are taking what they can get and providing on-the-job training instead in order to fill vacancies and get backsides in seats. 

Companies looking for security certifications will usually pay for the training, the materials and the examination if they want you to obtain one. While the Catch-22 nature of the CISSP might be out of reach for entry level candidates, get yourself certified in an easier credential such as the CompTIA Security+ or some of the SANS GIAC foundational courses. That combined with a desire to work towards a higher more widely recognized certification or qualification, and an interest and aptitude in cybersecurity might be enough to get you past a cert 'required' in the HR job posting and on to the next level with a video interview with the security team.

The same is true with academic certificates and degrees. Most universities are now running courses on-line thanks to COVID and many have solid cybersecurity programs at the Associates, Bachelors and Masters level. That allows you to shop around for the best course from the best university at the best price from any reputable university in the world.
There are many government grants, and university stipends available each year and companies will often pay for you to study for degree or certificate programs so take advantage of this. These education benefits are sometimes capped at $5,000 to $10,000 a year so you may have to plan accordingly and space out your classes to have them covered. It may take you a couple of years of part time evening or weekend study, but a degree will boost your career opportunities and salary expectations so is most definitely worth your time. It may also exempt you from having to keep up with professional certifications like the CISSP, and pay these commercial bodies annual membership fees which can be expensive and annoying.

But you as a candidate need to start somewhere.

In the following 90 minute video, I outline:
  • What is cybersecurity and why is it front and center as we adopt increasing levels of automation and digitalization?
  • Who are the main perpetrators of cyber attacks and what are their motivations?
  • Why is cybersecurity so important today?
  • What are the security frameworks being used to secure organizations?
  • Why you should consider a career in cybersecurity
  • What are those opportunities?
  • How to develop a cybersecurity career strategy
  • What security certifications and qualifications should you consider?
A PDF of this presentation can be downloaded or viewed here: 

Useful References and Further Information

Ransomware and Increased Attacks against Healthcare

The number of attacks against healthcare and hospitals continues to rise as cyber criminals and pariah nation states take advantage of the current Coronavirus crisis where hospitals in many part of the United States and around the world are distracted by large numbers of infected patients and a workforce that by and large, is now entirely remote outside of clinical care.

This was the subject of discussion for a panel of healthcare security experts today at the Washington HIMSS Chapter Meet Up.