Bake-off: Ensuring Security in the Cyber Kitchen

Image

I’ll start this one with an apology – I’ve been watching a lot of the TV show The Bear (which I’d highly recommend!) and thus been thinking a lot about kitchen processes and the challenges of making everything come together nicely (both in life and in a recipe). If you are unfamiliar with the show, it is a comedy-drama about a chef who manages his deceased brother’s sandwich shop.

When I see different chefs interacting in a busy environment I can’t help but think of the same activities happening in the data center and IT offices that I’ve visited. But whilst the best businesses in the world are sometimes operating at Michelin star restaurant levels, the rest of us are closer to the Great British Bake Off and that brings with it certain challenges that are worth exploring.

Into the Kitchen

Picture this: you diligently follow a recipe, carefully measuring each ingredient, only to discover that someone has swapped out the flour for sugar while you weren’t looking. You see, knowing the recipe for success is just the first step – if you aren’t keeping on top of where everything is, whether it’s measured “just right,” you risk your cake being overbaked. This is where Security Configuration Management (SCM) and File Integrity Management (FIM) step in – a pair of vigilant sous chefs in the cyber security kitchen, ensuring that everything comes out just right and keeping you on the right path even when you’re under intense pressure.

Following the Recipe: Security Configuration Management (SCM)

Just like a seasoned baker meticulously follows a recipe, organizations adhere to security best practices through Security Configuration Management (SCM). SCM sets the foundation for a secure digital environment by defining and enforcing a standard set of security configurations across systems and devices. It's a recipe book from skilled security researchers that guides IT teams in configuring operating systems, applications, and network devices to meet security requirements.

Imagine SCM as the master chef overseeing the kitchen, ensuring that every system is configured with the right ingredients – strong passwords, restricted user access, and updated software versions. Any deviation from the recipe is swiftly corrected, minimizing the risk of vulnerabilities and ensuring a consistent level of security across the board.

Whether that policy or cookbook comes from a seasoned set of experts in the industry (CIS, PCI, NERC CIP) or trusted notes (your security team’s best practices, blending knowledge of your environment’s individual ingredients and techniques based on vendor guidance), it’s important that you follow that recipe otherwise you can’t predict the outcome and your cake risks ruin.

The Unexpected Swap: File Integrity Monitoring (FIM)

But what happens when you're in the midst of baking, and someone sneaks in to swap your carefully measured ingredients or knocks your oven temperature up inadvertently? This is where File Integrity Monitoring (FIM) comes into play. FIM acts as the vigilant taste tester, constantly monitoring files and systems for any unauthorized changes or deviations from the established baseline.

In our baking analogy, FIM would be the watchful eye that alerts you when the sugar-to-flour ratio suddenly shifts. By tracking changes to critical files, directories, and configurations, ensuring that any unexpected modifications are promptly detected and investigated, you’ll get a heads up that something is going off-plan and give you a chance to respond. Importantly, even if the bake goes wrong, with FIM in place you have a chance to see where, so that next time you turn the oven on, you can do so with confidence. Whether it's a malicious actor attempting to alter system files or a simple error that could compromise security, FIM acts as the early warning system and log book that keeps the cyber kitchen safe.

Behind Chef!

If there was one thing I took away from watching The Bear, it’s my, and my partner’s over-use of the word “behind” – letting the other know when we’re moving around behind them so we don’t bump into each other. FIM and SCM tools like Tripwire Enterprise offer a great “behind” auditing system – alerting the world as to what’s happening on systems as it happens. That quick warning doesn’t have to be the same as antivirus or other security tools that focus on something going wrong, but instead it can co-ordinate activities and impact with deep insight, throwing up quick notifications when things get close, but before they become a problem.

I recently had the pleasure of setting up some real time monitoring with a client, and we put together a use case that shows recent changes on systems when admins log in to servers so they know what’s recent that has happened. It was unintrusive, but, importantly, helped administrators from different teams better understand the big picture – ironically, we set this information just “behind” the login screen, as a small dashboard addition to the server’s backdrop.

Bringing It All Together: A Deliciously Secure Outcome

In the grand bake off of cybersecurity, SCM and FIM work in harmony to ensure a tasty outcome. SCM sets the standards, defining the recipe for a secure environment, while FIM continuously monitors and verifies that these standards are maintained.

Thinking of security like a baking competition where the judges – your security auditors and compliance frameworks – expect nothing less than perfection is a useful starting place even in a busy kitchen with lots of chefs at work. With SCM and FIM by your side, you can confidently present your cyber creations, knowing that every security configuration is in place and every file’s integrity is intact with no soggy bottoms!

So, the next time you're in the cyber kitchen, remember the role of SCM and FIM. They can be the trusty utensils in your toolkit, ensuring that your digital delicacies come out just right. Whether it's following the recipe to the letter or detecting that sneaky ingredient swap, SCM and FIM are there to make sure that your cyber bake off ends with a deliciously secure outcome.