Fixing cybersecurity findings that disrupt your business

Like finally fixing the cracking beam in a 100+ year old house where I work

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

⚙️ Check out my series on Automating Cybersecurity Metrics. The Code.

💻 Free Content on Jobs in Cybersecurity | ✉️ Sign up for the Email List

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Just recently I updated all my Azure security training material and taught a 6-week 2 hour class to about 40 auditors. I just delivered the CPE certificates last week. I received positive feedback, but I am currently having someone review the class again as I noticed a few typos along the way. I plan to make a few fixes and revisions before I teach it again, but I was pretty happy with the updates. I think it provides decently comprehensive coverage of an Azure environment for those new securing an Azure account.

I had initially postponed all training and videos because I thought the project was going to start much more quickly than it did. As it turns out, highly recommended contractors in the Savannah area are very busy!

I had an opportunity to teach the afore-mentioned class and then I decided to put off the contractor who had been promising to start for months and was suppose to “start soon.” The start date was so undefined and it was close to a year since we started talking and the class was a great opportunity so I put my house projects on hold and taught the class.

Since then, the contractor has arrived and is tearing apart a bathroom, and more importantly, the room I use as an office and teaching which has a failing cracking beam. A structural engineer also warned me that the point where the old and new roof meet in a very poorly engineered way could leak — and it has. Not much thankfully, but one day I did have water dripping out of the ceiling onto a vinyl floor which I plan to replace anyway. It doesn’t match the historic nature of the house.

There are so many analogies to this current project and cybersecurity risk. I put off the fix of this risky beam fix until the contractor was available. In the meantime, I asked the structural engineer what the chances are of the roof caving in and he said he couldn’t tell until they rip out the ceiling to see what’s under there. Joy.

The inability to tell me exactly if and when this beam is going to crack for good and fall in is like trying to predict if and when a cybersecurity finding is going to result in a breach. There’s really no way to know for sure, but we can make an educated guess. The more data we have to make the assessment the better the estimation will be. We can watch the crack to see if it is getting bigger. We can see if more rain comes through that faulty roof design.

My next step is to rip off that ceiling and see what nasty problems exist under there. With more data we can more accurately assess the problem. Once we understand the direction of the beams we can design a solution to fix the problem in a structurally sound manner.

From my standpoint, I can try to guess when the beam will fail and hold out until the very last minute — or I can just fix it, which is what I plan to do. It will, however, disrupt my business to some degree.

Although I wanted to fix it right away, there were just certain things out of my control like when I could get the contractor to show up. Additionally, a resurgence of covid caused me to pause at one point. I also have to consider my budget and my need to continue business operations, some of which occur in this room I’m about to tear apart and will be interrupted by noise from the construction work. All of that needs to be coordinated.

As for the fix itself there are short term and long term options. Similar to trying to prevent a problem from ever happening again in cybersecurity by completely fixing it at the core or fixing one aspect of the problem to alleviate the immediate crack, I have choices. Depending on my budget and how long I want to be out of this room, I can jack up the underside of the house and the failing beam. Alternatively, I could rip off the top deck, roof, and basically rebuild the back end of the house to do it right and make it look good all at once.

Then there’s a failure under the kitchen with a makeshift fix according to the report I got from the structural engineer. I also want to get that corrected with a long term solution as well while I’m at it by way of the bathroom floor and wall, if that is possible (TBD). The other option is to rip out the kitchen floor and doing all the work in the kitchen and the back room at once is definitely not feasible with my current budget.

As with most cybersecurity initiatives, I can’t do everything at once, but I want to fix the foundational and core problems that may lead to further extensive damage if the whole back end of the house caves in. Will it? No one can tell me that exactly. They can tell me how to fix the problem appropriately to prevent it. Similarly, in cybersecurity, I don’t want to spend my time predicting if a security finding will lead to a breach and when as is the case with some of the metrics in a book I just reviewed:

I do think the above risk analysis has merit and value. It’s just not what I want to do. I don’t want to try to predict if you will have a breach because that’s like trying to predict what the stock market will do. I want to tell you that you have a finding, and how to fix it in either the most short term manner, or holistically through a foundational change that will help eliminate the risk at the core. I can tell you the result of not fixing it, should an incident occur.

Some in my household have a different risk-tolerance than myself and believe the beam will never crack completely and we will be fine indefinitely. Don’t worry about it. There are many old houses in Savannah. Yes, and I’ve seen the caved in back end of these houses like the one across the alley. One house I visited while looking to purchase houses had a hole in the ceiling where it caved in. An architect I had come inspect the house told me that it could last for many years. He also worked in an office where a plaster ceiling they knew would give way at some point came crashing down on them.

The people who want to put jacks under the house predict doomsday. They say that in order to fix the problem I should spend $47,000 on jacks and holes drilled deep under the house to hold it all up. I’ve been told by two structural engineers this may be overkill and it won’t straighten out the floors. It may also break windows and crack walls. When I asked one of these companies if their work would exacerbate the problem with the beam and cause it to fail, they said they would stop work if they noticed any further damage and get my approval first. MY approval? I have no idea — that’s why I’m hiring them!

I think I’ll fix the beam before it fails. I have a report from a structural engineer and we will base our plans off of that.

These risk-based decisions are like the decisions we have to make in cybersecurity every day. There’s a finding on a report. Will that finding actually lead to a beach? When? What sort of damage will it cause and how much will it cost to fix it? And how much does it affect our ability to sleep at night if we don’t fix it?

If fixing that finding leads to a business disruption or detracts from other business investments — time and money — all these options need to be weighed and balanced. Can I afford to stop teaching classes while I fix the beam? Can I afford not to if it fails in the middle of a class or hurts someone while I delay the fix? Can I teach my classes from another location or do some other type of work in the meantime?

As far as my business is concerned, classes are on hold for a bit while we tear out a ceiling and make a plan for how to fix the beam. I may opt to do a temporary fix, teach more classes, and then a longer fix, in order to keep my business going. However, I can also do other things like penetration tests and security assessments in the meantime. I can do those from any room in the house.

I could also, worst case scenario, teach from an alternate location where I can set up my lighting and video equipment, but the ones I found in Savannah have limited hours during which I could teach and would not have worked for my last client. I may have to raise the price due to the additional cost if I do that. I could also travel but not so much into that these days and would also cost more. I’d rather teach remotely, and hope to get back to that soon.

If you are interested in a cloud security class, I can still schedule a cloud security overview class, GCP, Azure, or AWS classes but the exact timing will be TBD temporarily until we get this ceiling opened up and make a plan; Unless you want a higher priced class, in which case I can make other arrangements. As always reach out to me on LinkedIn for any of the services listed in my profile. In the meantime, I’m busy with a few things over here. Wish me luck!

Follow for updates.

Teri Radichel | © 2nd Sight Lab 2022

About Teri Radichel:
~~~~~~~~~~~~~~~~~~~~
⭐️ Author: Cybersecurity Books
⭐️ Presentations: Presentations by Teri Radichel
⭐️ Recognition: SANS Award, AWS Security Hero, IANS Faculty
⭐️ Certifications: SANS ~ GSE 240
⭐️ Education: BA Business, Master of Software Engineering, Master of Infosec
⭐️ Company: Penetration Tests, Assessments, Phone Consulting ~ 2nd Sight Lab

Need Help With Cybersecurity, Cloud, or Application Security?
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
🔒 Request a penetration test or security assessment
🔒 Schedule a consulting call
🔒 Cybersecurity Speaker for Presentation

Follow for more stories like this:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 
❤️ Sign Up my Medium Email List
❤️ Twitter: @teriradichel
❤️ LinkedIn: https://www.linkedin.com/in/teriradichel
❤️ Mastodon: @teriradichel@infosec.exchange
❤️ Facebook: 2nd Sight Lab
❤️ YouTube: @2ndsightlab