Professional Information Security Association

MAR-2019

PISA Journal

Hardware Devices for Cryptographic Security
Secure your assets from Blockchain Galaxy to Fintech Universe
International Standard on Cyber-Insurance
How to Build a CSOC for SME?

www.pisa.org.hk

Issue 29

Special Topics
05 International Standard on Cyber-Insurance
14 Secure your assets from the Blockchain
Galaxy to Fintech Universe
22 The Importance of Hardware Devices for
Cryptographic Security
33 How to Build a CSOC for SME?

Page 2 of 46

An Organization for Information Security Professionals

Editor: editor@pisa.org.hk

Copyright

 2019Professional Information Security Association

Intranet
04
21
41
46

Page 3 of 46

Message from the Chairperson
The Editorial Board
Event Snapshot
Joining PISA

A Publication of Professional Information Security Association

Message from the

Chairperson

PISA

JournalProfessional Information Security AssociationA

Hot Summer.

When you see this article,
summer should have come to Hong Kong.
In May, we had our annual PISA Jam withalmost a hundred of attendees, not only ourmembers but also members from other organizations. We want to use PISA as a platform for professionals to exchange theirminds and what they want to uphold.
In early June, millions of people left their
sweet houses not enjoying good airconditioning but went out to the streets touphold their beliefs. It was initially thoughtas the worst time of the place as it wasseemed a dead end, however, people usedtheir feet to voice out their minds to make it
one of the best times in Hong Kong.

still need to use our professional knowledge
to uphold our beliefs to help facilitate a society with maximum protection of the confidentiality, integrity and availability of ourdata being entrusted to the systems.
In July, we will have our PISA 18th anniversary. Please join me to celebrate for PISA togrow up as a mature and again an independent entity. Cheers!

This journal is a late arrival. The members of
the Editorial Board has asked me to forward
their apology in not able to deliver this journal timely to fellow members and readers.

Although PISA is a small organization, wePage 4 of 46

An Organization for Information Security Professionals

Ando Ho

Professional Information Security Association

International Standard on

Cyber-Insurance

Dale Johnstone
Dale Johnstone is the Chief Security Officer (CSO) of a multinational
insurance firm and also a co-editor of ISO/IEC 27102. He has been
involved in information security, risk management and governanceroles for over 30 years. He has continually maintained full-time CSO/
Chief Information Security Officer (CISO) roles with various government / international organisations and the international standards community – www.linkedin.com/in/dalejohnstone

Page 5 of 46

An Organization for Information Security Professionals

PISA

JournalProfessional Information Security Association
International Standard on Cyber-Insurance

PurposeThe purpose of this paper is to explain how organisations can adopt
cyber-insurance to aid in protection
from cyber-risks by enhancing their
existing processes to improve an organisations overall level of effective
predicting, identifying, assessing,treating and responding to cyberincidents as part of an effective risk
management approach.

BackgroundA new standard ISO/IEC 27102 – Information security management —Guidelines for cyber-insurance [7], is
expected to be published in late
2019. This international standard isbeing developed by the International
Organisation for Standardisation(ISO) and the International Electrotechnical Commission (IEC). ISO/IEC 27102 will provide organisations
with guidelines that support the consideration of cyber-insurance as arisk treatment option to manage thePage 6 of 46

impact of cyber-incidents as an integral component of the organisation’s
information security risk management framework.

Structured
Framework

Management

An international standard ISO/IEC
27001 – Information security management systems — Requirements[1] provides organisations with astructured management framework
for an information security management system (ISMS) designed to establish, implement, maintain, andcontinually improve information security. An effective ISMS allows anorganisation to identify, analyse, andaddress its information security risks
enabling it to better keep pace withchanges to security threats, vulnerabilities and business impacts. An option available to enhance an ISMS isfor an organisation to share its cyberrisks through a cyber-insurance policy with an insurer.

An Organization for Information Security Professionals

MAR-2019

Issue

Cyber-Threats and Incidents
Cyber-threats can be identified intechnological form that includes errors, omissions, system malfunctions, denial of service, network intrusion, malware, unauthorised useof information or information systems, and extortion.

A cyber-incident occurs where acyber-threat (i.e. malicious activity
or human error) is realised against
the organisation’s interconnecteddigital environment of networks, services, systems, and processes, resulting in an impact to the business ofthe organisation. Where a cyber-risk
is realised, or a cyber-incident has
occurred, it is often linked with theloss of confidentiality, integrity oravailability impacting an organisation’s assets. For example, a loss of
information security or impact tobusiness operations may arise
through internal or external means
including a breach of asset confiden-

Page 7 of 46

29

tiality, a compromise in the integrityof stored data or a loss of the ability
to access the organisation’s information assets.

A cyber-incident may additionallyimpact a supplier or third-party organisation supplying goods or performing services for the insured organisation. When an organisation isconsidering taking on board a cyberinsurance policy, various types ofbusiness impact need to be considered including liability, incident response costs, cyber-extortion costs,
theft of funds, business interruption,legal and regulatory fines and penalties, contractual fines and penalties,
and systems damage.

Risk Assessment
When considering taking on board
cyber-insurance an organisation willneed to perform a risk assessment
process capable of translating cyber-

A Publication of Professional Information Security Association

PISA

JournalProfessional Information Security Association
International Standard on Cyber-Insurance

risks into business language that explains what would be the businessconsequences of a cyber-incident
that impacts, either directly (i.e. by
disabling an organisation’s information technology system) or indirectly (i.e. by preventing a third party
organisation or supplier from delivering its goods or services).

Once business leaders within an organisation better understand cyberrisks, they can then make appropriate
judgemental decisions as to how any
cyber-incident can be handled. Options available include risk avoidance, removal of a cyber-threat,changing a likelihood or better managing a consequence. An organisation may even be justified in retaining a cyber-risk. One final option forthe handling of the cyber-risk is toshare the risk with other parties, suchas insurers, in the form of a cyberinsurance policy.

Page 8 of 46

Risk management processes provide
information on risks and businessconsequences that would allow anorganisation to better align its cyberinsurance policy with the organisation’s overall risk management strategy. When considering risk treatment decisions, an organisationneeds to incorporate the possibilityof using cyber-insurance to improve
resilience against such risks.

Cyber-Insurance
Cyber-insurance can assist an insured organisation minimise the impact of a cyber incident by providing
funding mechanisms for recovery
from major losses.
A cyberinsurance policy can also aid in improving the recovery of normal business operations and even lead to anincreased level of resiliency of theorganisation. Taking on board acyber insurance policy is also expected to aid an organisation more
effectively prevent cyber-incidents

An Organization for Information Security Professionals

MAR-2019

Issue

occurring through the necessary preplanning activities required to be taken when engaging with an insurer fora cyber-insurance solution.

ties to provide legal, reputational andcustomer support, and assisting in
the prompt restoration of business
operations.

A cyber-insurance policy typicallytakes a wide perspective and its coverage spans a broad range of threats
capable of causing financial or otherforms of impact. Impact can occur
through loss of confidentiality, integrity or availability of the organisation’s interconnected digital environment of networks, services, systems,
and processes irrespective of the exact cause of a cyber incident andwhether it was accidental or deliberate.

When an organisation is making decisions as to how it is able to protect
its information assets, the adopted
ISMS and the potential impacts ofcyber-incidents, be they quantifiable(i.e. lost sales) or more difficult toquantify, for example reputational
damage or leakage of trade secrets,
or infringement of intellectual property rights, all need to be taken into
consideration. Assessing cyberinsurance and understanding theoverall economic consequences ofdecisions associated with competing
requirements for organisational resources should be reviewed in alignment with ISO/IEC TR 27016 – Information security management —Organisational economics.

Financial impact can include costs
associated with supporting an organisation after a cyber-incident, including evaluating the impact of thecyber-incident, utilising resources in
responding to the cyber-incident, engagement of professional third par-Page 9 of 46

29

It is important to realise that a cyber-

A Publication of Professional Information Security Association

PISA

JournalProfessional Information Security Association

Page 10 of 46

International Standard on Cyber-Insurance

insurance policy cannot address all
types of impacts arising from a cyber-incident. Cyber-insurance policy
exclusions may apply including
those associated with bodily injury,
property damage, terrorism, acts ofwar, impacts due to loss of intellectual property (i.e. patents and designs,
copyright and trademarks [8]), theftor loss of confidential information
not directly owned by the organisation, and loss of reputation. It is important that an organisation clearly
checks and understands all exclusions in its cyber-insurance coverage.
A cyber-insurance policy may also
contain excess or deductible clauses
where a pre-determined amount ofmoney needs to be paid by the organisation before a cyber-insurance policy claim can be made. Any excess or
deductible should be agreed by theorganisation with an insurer during
the preparation of the cyberinsurance policy. A cyber-insurance
policy may also incorporate a waiting period before business interruption cover can apply and only be ef-

fective for a certain period-of-time.

Partnership and Sharing
The extent to which an organisation
has implemented its information security controls to protect its information assets will usually be assessed against an established security
control set, an example of which canbe found in ISO/IEC 27002 – Codeof practice for information security
controls [2], which are further explained in ISO/IEC 27003 – Information security management systems— Guidance [3], and include the effectiveness of in place people, process, and technology security controls.
Information about an organisation
will be required to be shared with apotential insurer at the time a cyberinsurance policy is being considered.
This information sharing includes anunderstanding of the organisation’s
business, identification of key stakeholders (i.e. customers and business

An Organization for Information Security Professionals

MAR-2019

Issue

partners), information asset values,
details of information processing
systems and outsourcing arrangements, details of organisation’s ISMS
and the extent to which information
security controls have been effectively applied. Additionally, records ofprevious incidents and audit/
assurance reports all covey an imageof the effectiveness of information
security controls, which should be
provided to enable the correct cyberinsurance policy pricing to be determined.

As cyber-insurance is a risk sharing
option there is value in the insured
regularly providing relevant cybersecurity information to an insurer.
This information demonstrates how
an organisation continues to protect
itself from cyber-threats. The organisation once insured should be capable of sharing with an insurer any
documentation relating to its information security and cyber-risk activities.

Page 11 of 46

29

The benefits of an organisation’s
ISMS coupled with cyber-insurance
allows the insured organisation tomore effectively share relevant information with an insurer that can beused to improve facilitation of acyber-insurance policy from inception, renewal and throughout thecyber-insurance policy lifetime. An
insured organisation can collect andcollate the outputs from its ISMS,
information security measurement
programmes (for example, based on
ISO/IEC 27004 – Information security management — Monitoring,measurement, analysis and evaluation [4]), and risk management activities (for example, based on ISO/IEC
27005 – Information security risk
management [5]), and submit the required data to an insurer.

Conclusion
Organisations continue to modernise
themselves with the adoption of

A Publication of Professional Information Security Association

PISA

JournalProfessional Information Security Association

Copyright &Disclaimer

Copyright owned by theauthor. This article is theviews of the author and does
not necessarily reflect theopinion of PISA

Page 12 of 46

International Standard on Cyber-Insurance

more advanced technologies that further push their level of dependency
in an online cyberspace environment
thus increasing their exposure to
cyber-risks. In parallel there is anincreasing level of legislative/
regulatory oversight and penalties fororganisations that are found to havepoor information security. It only
will take a single successful cyberattack to threaten a disruption to anorganisation’s operations, to tarnish
an organisation’s brand/reputation,
and/or to cause the organisation tosuffer financial losses. As such theoverall cyber-risk environment willcontinue to increase. Therefore, theneed and value of an organisation’s
requirement to adopt strong partnerships to support its core business will
also grow. Forming relationshipsbound by a cyber-insurance policy
with an insurer offers organisations avalid option to share its cyber-risks.

■ Dale Johnstone

An Organization for Information Security Professionals

MAR-2019

Issue

29

References[1] ISO/IEC (2013). ISO/IEC 27001:2013 InformaƟon security management systems — Requirements.

Genève.

Availableath ps://www.iso.org/standard/54534.html[Accessed 29 Apr 2019].
[2] ISO/IEC (2013). ISO/IEC 27002:2013 Code of pracƟce for informaƟon security controls.
Genève. Available at h ps://www.iso.org/standard/54533.html [Accessed 29 Apr
2019].
[3] ISO/IEC (2017). ISO/IEC 27003:2017 InformaƟon security management systems —Guidance. Genève. Available at h ps://www.iso.org/standard/63417.html [Accessed
29 Apr 2019].
[4] ISO/IEC (2016). ISO/IEC 27004:2016 InformaƟon security management — Monitoring,measurement, analysis and evaluaƟon. Genève. Available at h ps://www.iso.org/
standard/64120.html [Accessed 29 Apr 2019].
[5] ISO/IEC (2018). ISO/IEC 27005:2018 InformaƟon security risk management. Genève.
Available at h ps://www.iso.org/standard/75281.html [Accessed 29 Apr 2019].
[6] ISO/IEC (2014). ISO/IEC TR 27016:2014 InformaƟon security management — OrganizaƟonal economics. Genève. Available at h ps://www.iso.org/standard/43756.html[Accessed 29 Apr 2019].
[7] ISO/IEC (2018). ISO/IEC DIS 27102 InformaƟon security management — Guidelines forcyber-insurance. Genève. Available at h ps://www.iso.org/standard/72436.html[Accessed 29 Apr 2019].
[8] Intellectual Property Department (2019). IP Laws. [online] Available at h ps://www.ipd.gov.hk/eng/intellectual_property/ip_laws.htm [Accessed 29 Apr 2019].

Page 13 of 46

A Publication of Professional Information Security Association

Professional Information Security Association

Secure your assets from theBlockchain Galaxy to
Fintech Universe

Wallace Wong
CISM, CISSP, CISA
Wallace Wong has different IT exposure in private andpublic sectors. He is currently working in the public
sector for security, audit and project management.

Page 14 of 46

An Organization for Information Security Professionals

MAR-2019

Introduction“Cryptocurrencies are still a new and hyper-volatile asset classand could drop to near-zero at any time. Don't put in more money
than you can afford to lose. If you're trying to figure out where to
store your life savings, traditional assets are still your safest bet.”

Figure 1: Web 2.0 to Web 3.0 Comparison Landscape. (Matteo Gianpietro Zago, Mar 2018)

If you had read my previous article “Security in using Cryptocurrency andBlockchain” [1], I hope you have followed the Vitalik Buterin’s reminder below
and have not lost much of your savings in the “Blockchain Galaxy”.
“Cryptocurrencies are still a new and hyper-volatile asset class and could
drop to near-zero at any time. Don't put in more money than you can afford to lose. If you're trying to figure out where to store your life savings,
traditional assets are still your safest bet.”

Page 15 of 46

A Publication of Professional Information Security Association

PISA

JournalProfessional Information Security Association
Secure your assets from the Blockchain Galaxy to Fintech Universe

I called it the Galaxy because our existing technologies (or Web 2.0)
were linked to other new blockchain
galaxy (or Web 3.0) similar to the
Matteo’s comparison of Web 2.0 to
Web 3.0 (see Figure 1). For example, in “Organizational —> Content
Monetization & Distribution” area,
companies like Medium may be
evolved to companies like Steemit
where people can distribute their ideas and also be rewarded with crypto
money.

Security in the “Blockchain
GalaxyAlthough people may say the Galaxy
is not all blockchain, I would like to
use this name or an even more general name Distributed Ledger Technology (DLT).
Since the cryptocurrencies are
deemed to be the most valuable assets in the Galaxy by the investors
and believers in this zero-trust world,Page 16 of 46

Fig. 2 The Wallets (extracted in Figure 1)

the best security measures should be
adopted to protect them such as using
the wallets extracted in Figure 1 (seeFigure 2):
These crypto wallets can be roughly
divided into three types, namely“software” wallet, “hardware” walletand “paper” wallet.
The most convenient one is the“software” wallet. It is often a mobile
app or web portal which you can easily send your cryptocurrencies when
you pay for a coffee or receive themwhen others transfer them to you (seeFigure 3). Secondly, you can also update your software client more easily(e.g. via the official app stores foryour mobile app like iOS, instead of

An Organization for Information Security Professionals

MAR-2019

Issue

29

Figure 3: Software Wallet – Sample App (e.g. Blockchain Wallet) (“Official Appstores”, Mar 2019)

third-party websites). Lastly, it is highly portable with you in the mobile device or internet account as your watch or email.
On the other hand, the “hardware” wallet is a totally different. It is often aphysical device which you may be more confident to use as the private key
is stored in your hardware which you purchased from the official website directly, instead of being kept in the providers’ space or procured from thethird parties. Secondly, the hardware firmware updates are less frequent (via
your wallet provider before use). Lastly, it is comparatively secure fromcyber attacks as the hardware is offline by design (see Figure 4).

Figure 4: Hardware Wallets – Sample Devices (e.g. Trezor, Ledger & Keepkey) (“Official Websites”, Mar 2019)

Page 17 of 46

A Publication of Professional Information Security Association

PISA

JournalProfessional Information Security Association
Secure your assets from the Blockchain Galaxy to Fintech Universe

Hardware wallet is considered to be more secure than software wallet to protect
the crypto assets as the crypto exchanges are also using them to secure for theircustomers. However, hardware wallet is still vulnerable to attacks in different
means such as follows:
1. PIN or password is required to input the hardware wallet in order to unlock
the device. Since some of these inputs are performed via keyboard (e.g.
password), it is possible to be captured by key loggers.
2. Firmware, browser plug-ins or various clients are still required to download
for the hardware wallet before use. Any obsolete software components are
possible to be attacked before update.
3. Users still need to visit web portal to manage hardware wallet to unlock thedevice, download the above software components or transfer the crypto assets. Attacker can trick users to download a malicious software component
without being notice by redirection attacks such as Border Gateway Protocol(BGP) redirection or Domain Name System (DNS) hijacking.
4. Recipient address is also required to input during asset transfer via the private key of your hardware wallet. Even the Copy & Paste of this addressfrom memory, it would be changed by the malware if your computer has
been infected.
For the simplest one, it is the “paper” wallet. It is often a general document (e.g.
A4 paper) which you may easily see your private key on the paper without above
software or hardware requirements. Secondly, you can also ignore the frequent
update of software wallet or complex update of hardware wallet. Lastly, it ismore secure to prevent from cyber attacks when you store the paper offline in
the safe only (see Figure 5), instead of electronic document.

Page 18 of 46

An Organization for Information Security Professionals

MAR-2019

Issue

29

Figure 5: Paper Wallet
Although the paper wallet cannot avoid the computers being infected or the
gateways being redirected, you do not need to concern about the specific updates and usages of the hardware wallets in the “Blockchain Galaxy”. You
can be back to basic or go back to the “Earth” with your existing information
security practices.

Figure 6: InvestHK 2018 Hong Kong Fintech Map (Fintech News Hong Kong, Nov 2018)

Page 19 of 46

A Publication of Professional Information Security Association

PISA

JournalProfessional Information Security Association
Secure your assets from the Blockchain Galaxy to Fintech Universe

Security in the “Fintech Universe”

Reference (in chronological order)

As “Blockchain Galaxy” (or Web 3.0)
seems to huge, you can find a huger“Fintech Universe” in the diagramfrom InvestHK (see Figure 6) about
the latest technologies in different financial-related areas in Hong Kong(e.g. InusrTech, RegTech and CreditTech).
Our digital assets in these new areas
should also be protected (e.g. Alipay,
WeChat Pay and TNG for payment
and remittance).

1.

Copyright owned by theauthor. This article is theviews of the author and does
not necessarily reflect theopinion of PISA

Page 20 of 46

https://www.pisa.org.hk/images/
PISA_publication_journal/issue27/pisa_j27.pdf

2. Matteo Gianpietro Zago (2018). “Web
2.0 to Web 3.0 Comparison Landscape”
on March 2018. Available
https://twitter.com/StateOfTheDApps èhttps://www.cryptocurrencyguide.org/web-2-0-to-web3-0-comparison-landscape/3. Fintech News Hong Kong (2018)“InvestHK 2018 Hong Kong Fintech
Map” on 17 November 2018. Available
http://fintechnews.hk/7652/various/hong-kong-fintechmap-2018/

Summary

Copyright &Disclaimer

Wallace Wong (2018). “Security in using Cryptocurrency and Blockchain”,
PISA Journal Issue 27, March 2018.

Comparing with those in the“Blockchain Galaxy”, even the providers in the “Fintech Universe” aremore familiar for us and comparatively regulated by the existing authorities, we should still evaluate their security controls comprehensively before use. It would be my pleasure if I
can share with you again next time.

4. “Official Appstores” (2019). “Software
Wallet – Sample App (e.g. Blockchain
Wallet)” on March 2019. Available
https://itunes.apple.com/us/app/blockchain-walletbitcoin/id493253309

5. “Official Websites” (2019). “Hardware
Wallets – Sample Devices (e.g. Trezor,
Ledger & Keepkey)” on March 2019.
Available
https://trezor.io/
https://www.ledger.com/
https://www.keepkey.com/■ Wallace Wong

An Organization for Information Security Professionals

MAR-2019

PISA Journal
The Editorial Board

SC Leung

Joyce Fan

Alan Ho

Ian Christofis

CISSP CISA CISM CGEITCISSP CCSP CISA CBCP

You can contribute to PISA Journal by:●●

Joining the Editorial Board
Submitting articles to the Journal

SC Leung,
Chief Editor
editor@pisa.org.hk
Next Issue:
Issue 30 (Sep-2019)

Page 21 of 46

A Publication of Professional Information Security Association

Professional Information Security Association

The Importance ofHardware Devices for
Cryptographic Security

Ian Christofis
CISSP
Ian is a security consultant with over 30 years’ experience in Australia, Germany and Hong Kong. He specializes in cryptographic
security, identity management, authentication, and personal data
privacy.

Page 22 of 46

An Organization for Information Security Professionals

MAR-2019

This article looks at the important roleof hardware security devices in cryptographic security.
Hardware security devices include: Hardware Security Modules (HSM),
used in data centres (on-premises
and by cloud providers) Smartcards or equivalent USB tokens
 Subscriber Identity Modules (SIM)(a type of smartcard) for mobile
phones Trusted Platform Modules (TPM) in
servers, desktops and laptops, and Secure Elements (SE) on mobile
phones or IoT devices.
Cryptographic security is increasingly important
In the modern IT environment, we increasingly use the shared communications infrastructure of the global Internet, cloud computing, and softwaredefined-networking (SDN). The actual
physical communication paths and thephysical devices involved (CPUs,
memory, disk-drives, routers, switches, ROADMs, etc.) are usually unknown to us and are constantly chang-

Page 23 of 46

Applied Cryptography
Cryptography is a very important tool for information
security. Cryptography can provide the following
types of security:
Confidentiality,
using encryption, to protect data (e.g. privacysensitive data, corporate strategies, etc.) so it can only
be read by authorised parties.
Data integrity,using cryptographic checksums such as digital signatures or keyed hashes, to ensure that unauthorised
alterations of data can be detected and rejected. This
includes detecting, using cryptographic chaining and/or sequence numbering, unauthorised replay of previously sent valid data, and unauthorised deletion ofvalid data. For example, unauthorised deletions orreplays of financial transactions would clearly be asecurity problem.
Authentication,using digital certificates or various two-factorauthentication techniques, to ensure that parties incommunication are sure who they are communicatingwith. Authentication is normally required in both directions (i.e. mutual authentication). For example, if
you transact with your bank’s website, you need to be
sure you are really interacting with the bank not a
fraudster, and the bank needs to be sure it is reallyyou. You both also need to be sure there is no ‘man-in-the-middle’ attack occurring.
Non-repudiation,using digital signatures, to provide strong evidence
against later fraudulent denial that a transaction was
legitimate and authorised.

A Publication of Professional Information Security Association

PISA

JournalProfessional Information Security Association
The Importance of Hardware Devices for Cryptographic Security

ing. We do not have the ability tophysically secure all these devices
even if we wanted to. We need to rely on cryptographic security to secure data in an end-to-end manner.
Rather than trying to physically isolate and protect devices and communication channels to prevent accessby attackers, cryptography allows us
to apply security to the data itself.
The purpose of cryptography is toseparate the security of the message
from the security of the medium.
Dr Matt Blaze

The security (confidentiality, integrity, authentication, non-repudiation)is then independent of the security ofthe transmission path (devices andcommunication channels) or storage
media. For example, data could beencrypted then sent by various media
e.g. over the internet, by USB drive,or even printed on paper – the choiceof medium does not affect the security of the data, and the security of themedium itself does not matter. From
this perspective, transmission (datain-motion) and storage (data-at-rest)

Page 24 of 46

Symmetric and Asymmetricgraphic Algorithms

Crypto-In modern applied cryptography, both symmetricand asymmetric cryptographic algorithms are normally used together. Asymmetric algorithms are
slow compared to symmetric algorithms, so asymmetric algorithms are not used for encryption anddecryption of bulk amounts of data. Asymmetricalgorithms are therefore typically used for exchangeof symmetric session keys and creating digital signatures. It is outside the scope of this article to discuss the details of how various cryptographic algorithms are used. This article is applicable to both.

are the same. Storage is just a slow
communications channel from thesender to the receiver, or from thesender to herself.
Additionally, the threat and risk environment has become more concerning,with data breaches becoming more ofa problem, stronger privacy laws suchas the General Data Protection Regulation (GDPR) from Europe, and moresophisticated attackers, so we need our
security solutions to be strong.

Software protection
Cryptographic security depends heavily on the protection of the cryptographic keys. If the keys can be discovered or used by an attacker, the se-

An Organization for Information Security Professionals

MAR-2019

Issue

curity fails – data can be decrypted,
or digital signatures can be faked andidentities can be compromised.
With software-only cryptographic
solutions, the key material must be
loaded into memory to be used. The
software can take various measures
to protect the keys, such as access
controls, operating system privilege
levels, and following best practice.
These are all important. However,
the keys will still be vulnerable tovarious threats, including exposure
throughmemorydumps(accidentally caused by a bug, or deliberately forced by an attacker) andkernel attacks. We can never be surethat a software solution is free of security weaknesses. We typically havelittle visibility of how well-designed
and secure any software solution is.
Even very well designed software
may have undiscovered security
weaknesses. Attacks on software
may bypass various controls and access memory directly, or bypass high-level APIs to call lower-level functions than they should be allowed to.
Software-only is the easy, and often
the default, approach, but there is alimit to level of assurance it can provide.
Page 25 of 46

29

Hardened Security
Hardware security devices are used toprotect and manage cryptographic
keys – fundamentally keeping keys
away from the operating system andlocked inside an isolated security device. At no time is the key material
loaded or present in the operating system. If the memory was dumped or theoperating system compromised, there
would be no sensitive key materialpresent. This drastically increases theprotection of the keys.
The functionality of the hardware device is deliberately strictly limited, andinteraction with the hardware device isconstrained to a specific communication channel. A hardware security device is analogous to a bank teller behind a security screen. We have to ask
the teller to do specific things for us.
The teller will only do what is authorised. The cash-drawer is not accessible
to the customers.
Hardware Security Modules (HSM), a
type of hardware security device, also
provide functionality that organizations can use to enforce operational
and logical security, such as strong authentication for systems administrators, and dual controls so no single

A Publication of Professional Information Security Association

PISA

JournalProfessional Information Security Association
The Importance of Hardware Devices for Cryptographic Security

person or ‘super-user’ can act alone
to conduct a malicious attack.
A hardware security device will typically provide: Strongisolation of cryptographic
keys from the host processing environment.

 Restricted set of functionality, thatstrictly limits what each key can beused for.
 True

random number generation(TRNG) to seed key generation.
Randomness is very important for
cryptographic strength.

Depending on the specific device
type, it may also provide: Anti-tamper protection to a) destroy

keys if physical tampering is attempted, or b) make physical accessto sensitive electronic circuits very
difficult, or c) ensure that any physical tampering attempt will create
obvious damage.
 Certification of the device as meet-ing a recognised standard such as
the international Common Criteria(for a specific security Target ofPage 26 of 46

Cryptographic Strength
An important measure of the strength of a cryptographic system is its resistance to a ‘brute-force
attack’. A brute-force attack means trying every
possible key until the correct key is found. On average, the key will be found after half of the possible
keys have been tried.
The set of possible keys is called the ‘key space’.
The size of the key space depends on the length of
the key. For symmetric algorithms, where any valueof the specified key length can be a valid key, thekey-space is 2key-length, so for example the key spacefor AES with 256-bit keys is 2256.
Modern cryptography specifies key spaces sizes forwhich a brute-force attack would take millennia on
current computing equipment, and hence should be
totally infeasible. (This article does not address thethreat of quantum computing to current cryptography. See PISA Journal 23 for an introduction to‘post-quantum cryptography’.)
For asymmetric algorithms, keys must fit specificmathematical criteria, so very few values of a particular length are valid keys. Hence the key space isorders of magnitude less than 2key-length, so asymmetric key lengths are much longer than symmetric key
lengths for the same size key space and equivalent
strength.
Other aspects of the system are likely to be more
vulnerable to attack, so resistance to brute-force
attack is the upper limit of strength.

Evaluation) or USA Federal Information
Processing
Standard
FIPS 140-2.
 Strong enforcement of access to ad-

ministration

An Organization for Information Security Professionals

functions,

such

as

MAR-2019

Issue

29

Figure 1 - Software-only vs Hardened Security [1]strong authentication for administrators, strongly segregated administrative domains, and strongly enforced dual controls for mutual supervision.

Where are my keys?
If software-only cryptographic security is used, multiple copies of keys
will typically be present in various
untrusted areas throughout the system, as illustrated in the picture in theleft of Figure 1. Software-based cryptography is vulnerable to the same
threats affecting the general IT infrastructure. In contrast, as shown on the[1][2]

Page 27 of 46

Key Management
Most of the complexity of cryptographic systems isin the Key Management aspects.
An important principle in designing a cryptographic
system is to limit the use of any single key. The
limitation should be in a) the value of information
protected by the key, b) the amount of data encrypted under the key, and c) the length of time the key
is actively used. The more we use a key, the morevaluable it becomes to an attacker.
Key management allows keys to be encrypted underother keys, in a hierarchy, to limit the use of any
single key. Ideally, all keys in the hierarchy should
be protected by hardware security devices when
they are in unencrypted form, but at minimum the
top level master keys should have hardware protection.

Diagram courtesy of nCipher Security.
https://www.us-cert.gov/ncas/alerts/TA14-098A and https://en.wikipedia.org/wiki/Heartbleed

A Publication of Professional Information Security Association

PISA

JournalProfessional Information Security Association
The Importance of Hardware Devices for Cryptographic Security

right in Figure 1, hardened security
provides an isolated protected environment for cryptographic processing with anti-tamper and key
controls.

Heartbleed immunity
As an example of what can go wrong
with software-only security, consider
the Heartbleed bug [2] which was
discovered in 2014 in the OpenSSL
open-source software. It affected ahuge number of websites and othersystems, causing major security
problems. The bug existed in the
OpenSSL code for several years,
since 2012, before it was discovered
and publicly disclosed. (It is possible it was known to some attackers
and/or spy agencies before the publicised discovery.)an attacker could read data from theprivate memory of a vulnerable TLS
end-point (server or client). This allowed attackers to read TLS keys andother data. See Figure 3 for a simplified explanation.
The OpenSSL software should protect these keys, and normally(without the Heartbleed bug) it does,
but a programming error that was notnoticed for many years meant thatthe software protection inadvertently
failed.

By providing an incorrect string
length in a TLS heartbeat message,

Figure 2 - Heartbleed logo
[3] CC0 license[4] CC BY-SA 3.0 license

Page 28 of 46

Figure 3 - A simple explanation of Heartbleed

https://en.wikipedia.org/wiki/Heartbleed#/media/File:Heartbleed.svg
https://en.wikipedia.org/wiki/Heartbleed#/media/

An Organization for Information Security Professionals

MAR-2019

Issue

OpenSSL using software-only cryptography
wasvulnerable
toHeartbleed, whereas OpenSSL usinga hardware security device was not
susceptible, for most types of hardware security device. This is because
the cryptographic keys are not inmemory if the TLS end-point is using a hardware security device.

Finding Keys in Memory
In a software-based solution, even if
keys are stored encrypted underhigher-level keys, to use an encrypted key, it needs to be decrypted into
the clear in memory so it can beused.
Also there must be a top-level encryption key which is not encryptedby a higher-level key. If this masterkey is derived from a password thatis not stored, the master key needs toexist in memory while it is being
used.
Because modern computing systems,
even on small devices, can havelarge amounts of memory, finding
cryptographic keys buried in an
ocean of memory may seem like a

Page 29 of 46

29

Random Number Generator
An important aspect of cryptographic security is
the randomness of the key generation process. If
the process for selecting new keys is not truly random, the attacker will have information that will
help them guess the key much more easily than abrute-force attack. Attackers will always look for
the weakest aspect of a security system to attack.
An example of this was the early implementationsof Secure Sockets Layer (SSL) in the Netscape
Navigator browser (Muehlbacher, 2007, p. 13).
Keys were generated using 3 seed parameters: a)system ID of the current process, b) system ID of
the parent process, and c) the current time of theday. As these values are somewhat predictable,
keys were able to be broken in under 1 minute,making this the weakest aspect of the system.
Pseudo-random number generation (PRNG) relies
on seed values that are ideally as random, unpredictable, and undiscoverable as possible, processed
through one-way functions that aim to increase
entropy.
Whilst best practice pseudo-random number generation in modern systems is good, true random number generation (TRNG), using a hardware random
number generator, will always be superior, adding
significant strength to the cryptographic security.

daunting task, like finding the proverbial ‘needle in a haystack’. However, keys in memory may stand-out
much more than you might expect,even to simple visual inspection. Key
material can exhibit inherent characteristics which distinguishes it fromother data in memory. In the example

A Publication of Professional Information Security Association

The Importance of Hardware Devices for Cryptographic Security

PISA

JournalProfessional Information Security Association

Figure 4- - Memory map containing a cryptographic key

binary memory map in Figure 4, canyou identify which of the 5 memory
blocks, indicated by the dotted lines,
contains a key? Try to work it out before reading on.
Did you guess which memory blockin Figure 4 contains the key? Here’s
a hint: Most data in memory is somewhat structured and regular. In contrast, properly-generated cryptographic keys should be highly random, so they exhibit a high degree ofentropy compared to other data.
When examining a memory map,
key material can be distinguished because of its higher entropy. Of the 5data blocks shown, most blocks
show obvious patterns. The only one
that does not show any pattern is the
middle block which is quite random(high entropy), so that is the key.

From the size of the key, we can also
guess the cryptographic algorithm. It
appears to be 32 x 64 = 2048 bits, so
it is very likely an RSA 2048-bit key.
Being able to guess the algorithm
further assists in cryptanalysis.
In this way unprotected key material
used by software applications can beoften identified and isolated for cryptographic analysis.
Let’s consider another aspect of why
finding keys in memory is often viable. If a key is stored in contiguous
bits and bytes in memory, the number of possible locations of the key
will be limited to the size of theavailable memory. For example, for a
256-bit symmetric key stored contiguously within 1GB of memory (233
bits), there are 233 (to be precise 233 -[5] Image from https://www.ncipher.com/resources/research-reports-and-white-papers/hardware-key-management-azure-cloud

Page 30 of 46

An Organization for Information Security Professionals

MAR-2019

Issue256) possible starting positions. Even
if we also test a few variations, suchas forward and backward bit andbyte order, the number of possibilities will be a few multiples of 233,
say 235 possibilities. Compare this toa full brute-force attack on the enormous key space of a 256-bit symmetric key. There are 2256 possible keys.
A brute-force attack would need totry, on average, half of all possible
keys before finding the key, so on
average 2255 tries would be needed.
So, compared to a brute-force attack(~2255 possibilities), testing all of thecontiguous memory possibilities(~235) is a huge number of orders ofmagnitude smaller (~2220 times

smaller).
Even if the software tries to hide thekey, rather than storing it in contiguous memory, by some obfuscation
method such as scattering it in small
chunks in multiple locations inmemory, the obfuscation processneeds to be reversible (not a one-way
function). So if the software codethat performs the obfuscation can befound (which is likely), it could be
disassembled and analysed to determine how to reconstruct the key.

Conclusion
Hardware security devices can pro-

Figure 5 - Perceived importance of HSMs as part of encrypƟon or key management over seven years

Page 31 of 46

29

A Publication of Professional Information Security Association

MAR-2019
The Importance of Hardware Devices for Cryptographic Security

tect cryptographic keys from being
discovered, and limit their use to authorised operations, providing muchhigher levels of assurance that data is
protected compared to software-only
solutions.
Hardware security devices are already widely used where risks arehigh. For example, banks use Hardware Security Modules (HSM) for
financial transactions, many industries use HSMs for securing Public
Key Infrastructure (PKI) Certification Authority (CA) signing keys,
and smartphones use Subscriber
Identity Modules (SIM) and Secure
Elements (SE), to name just a few
very common examples.

Copyright &Disclaimer

Copyright owned by theauthor. This article is theviews of the author and does
not necessarily reflect theopinion of PISA

29

portant are HSMs to your encryption
or key management strategy?”. The
response to the same question for “inthe next 12 months” was 69% for
FY18 [6].
We need cryptographic security morethan ever in today’s IT environment,
but software-only implementation of
cryptographic security cannot provide
the levels of assurance typically needed in today’s environments. Software
is vulnerable to memory dumps andundiscovered bugs. You can never becertain that your software is not vulnerable to attack. Incorporating hardware security devices in solutions
should be the norm.

The importance of HSMs and otherhardware security devices is increasingly understood by companies globally. From the recent Ponemon Institute “2019 Global Encryption Trends
Study” survey across 14 countries/
regions, Figure 5 shows the percentage of combined “very important”
and “important” responses to thequestion “In your opinion, how im-[6] Ponemon Institute, “2019 Global Encryption Trends Study”, April 2019

Page 32 of 46

Issue

A Publication of Professional Information Security Association■ Ian Christofis

Professional Information Security Association

How to build a

CSOC for SME

Frankie Wong
CISSP
Frankie is a Cybersecurity Analyst of a Financial Institution, a local teamlead of CSOC, responsible for the cybersecurity event analysis, investigation, response and incident management.
He is a Vice-Chairperson of PISA. He had presented in various pubic seminars and had given guest lectures in tertiary education institutions. He is acore organizing committee member of PISA Security Jam, an annual conference for local security professionals.

Page 33 of 46

An Organization for Information Security Professionals

PISA

JournalProfessional Information Security Association
How to build a CSOC for SME

Nowadays, Cybersecurity is becoming
more and more important. Whether yourcompany is an MNC (multi-national corporation) or an SME (Small or Medium-sizedEnterprise), if a single Cybersecurity incident hits your company, then it may cause
unbelievable loss and damage. E.g. [1] A
global ransomware attack could cost over$190 billion US dollars, in terms of financial damage, affecting over 600,000 businesses globally.

In recent years, many companies try to findsolutions to prevent Cybersecurity attacks,
not only in a preventive way but also using
an approach of monitoring, detection andresponse, i.e. CSOC (Cyber Security Operations Centre). So, the trend of building
CSOCs has happened. Even the idea of“CSOC as a service” is brought up.

pens in the company day by day. These cybersecurity events can be intrusion attacks
at the network perimeter, malicious outgoing traffic caused by malware inside
your network, and data exfiltration causedby an insider.

LIA Triad Model
Cybersecurity events inevitably occur whena company has computers, network infrastructure, and humans. How can a CSOC
figure out these cybersecurity events andprotect your company from cyber threats? I
would like to introduce the LIA model, i.e.
Logs, Intelligence, Analysis.
 Logs - Electronic facts that happened in

a company
 Intelligence - External cyber threats that

happened outside

Aims of CSOCA CSOC is an operations team. The teamprovides detection of, and protection from,cyber attack for a company. A CSOC is
responsible for looking after any cybersecurity event which is discovered and hap- Analysis - Capability to discover anoma-lies when Logs & Intelligence are provided
The LIA triad model is a key to help you
define the scope, scale, function, people,[1] https://www.infosecurity-magazine.com/news/global-ransomware-attack-could/

Page 34 of 46

An Organization for Information Security Professionals

MAR-2019

Issue

29

and measurement, when a CSOC is being developed and for ongoing improvement.
E.g. 1. Scope and Scale
Logs

How many logs / what kinds of logs will be collected by a SIEM
(Security Incident Event Management) platform?

Intelligence

How much of data / what kind of information will be collected that is related to your company? Besides external information, it also includes
knowledge / practises of company staff’s behaviour.

Analysis

What kind of anomalies could be identified? What depth of investigation
would be done?

E.g. 2. Functions of SOC
Logs

Centralize cybersecurity events; Aggregate different kinds of logs; Generate a dashboard to show the cyber health status of the company.

Intelligence

Identify related cyber threats, vulnerabilities, threat actors, operations
campaigns, in order to review any compromise inside the company andtry to predict the trends/ campaigns of cyber attacks.

Analysis

Identify any abnormal cybersecurity events; investigation; react to theincidents (i.e. incident response)

Roles in CSOC
CSOC is not about a centre; it is about a team having a close cooperation. A CSOC consistsof many functional roles. I would define their roles into 2 levels, ‘essential’ and ‘advantage’.
The essential level means the roles are fundamental to a CSOC. A CSOC cannot run without

Page 35 of 46

A Publication of Professional Information Security Association

PISA

JournalProfessional Information Security Association
How to build a CSOC for SME

the essential roles. The advantage levelmeans additional functions of a CSOC, thatcan enhance its capability when the CSOC
is mature.

Essential Level
Essential level is referring to tier 1 and 2
members mentioned in other articles. From
my experience, tier 1 and 2 are both working core functions of a CSOC that cannot
be transformed or replaced. So, I would
like to group them as ‘essential level’.
Cybersecurity Engineer (SE) - who is responsible for infrastructure building, i.e.
SIEM platform, Threat Intelligence Platform (TIP), Log collection, Endpoint Detection & Response (EDR) deployment,
etc. He is always a key supporter of the
CSOC.
Cybersecurity Analyst (SA) - who is responsible for Cybersecurity event triage,
analysis and investigation. He is always thefirst line in a CSOC.

Incident Response (IR) Analyst - who is
responsible for Cybersecurity incident handling, deep analysis, and digital forensics.
He is always the owner of an incident.
Cyber Threat Intelligence (TI) Analyst who is responsible for threat intelligence
analysis. He is the intelligence collector fora CSOC.

Advantage Level
Advantage level is referring to tier 3 members. This level of roles is not present whena CSOC is small or in the development
state. These roles should appear only if a
CSOC reaches a certain maturity level
which requires ongoing self-improvement.

Cybersecurity Threat Hunter - who is responsible for threat hunting and Cybersecurity event detection improvement.

Red/ Purple Team [2] Analyst - who is responsible for offensive attack testing andworking with the blue team to improve security defence.

[2] A Red Team is an independent group that challenges an organization to improve its effectiveness by assuming an adversarial role or point of view.
A Purple Team exists to ensure and maximize the effectiveness of the Red and Blue teams. They do this by integrating
the defensive tactics and controls from the Blue Team with the threats and vulnerabilities found by the Red Team into asingle narrative that ensures the efforts of each are utilized to their maximum.

Page 36 of 46

An Organization for Information Security Professionals

MAR-2019

Issue

CSOC for SME - Essential
CSOC (E-CSOC)
We understand that for a company to run a
CSOC is not an easy task. A CSOC is very
demanding in terms of costs and resources.
However, a successful CSOC should be an
in-house operation. The reason is that inhouse members have the most understanding of the company, such as the culture,business operations, and even the threats
which the company faces. So, we have tothink how to use minimal resources to run a
CSOC within a company environment.
Now, I would like to introduce a new idea
“E-CSOC”, which provides the services of
CSOC in an efficient way.

Characteristic of E-CSOC
1. Essential CSOC,
members

essential

team

To let an E-CSOC provide essential services and protect an SME from Cyber attacks, essential level members are required
to fit the roles of cybersecurity engineer,
cybersecurity analyst, incident response
analyst, and cyber threat intelligence analyst. When defining the scope and scale ofan E-CSOC, the roles and the responsibilities of members also need to be identified.
Some roles can overlap, with members per-Page 37 of 46

29

forming multiple roles, e.g. combining cybersecurity analyst and IR analyst, combining cybersecurity analyst and TI analyst.
But, no essential roles can be missed in an
E-CSOC.
2. Working in Business hours
In general, E-CSOC is considered to be asmaller scale of CSOC, providing essential/
key services which is a SME needs. A fulloperational CSOC requires a lot of resources, e.g. 7x24 monitoring, which is not
actually required by an SME. Most SMEs
are not running a 7x24 business. Therefore,
we suggest E-CSOC could just focus on
business hours, i.e. 5x9 (5 days, 9am to6pm). Most logs and intelligence would becollected during business hours. Not only
could analysts provide the most effective
anomaly identification during businesshours (as well as at critical times), but also
make the most timely response. Of course,
out of the business hours, E-CSOC analysts
should stay vigilant and on standby if there
is an emergency incident or predicted
threat.
3. Focusing on Cybersecurity events
A CSOC is not a NOC (Network Operations Centre). Especially for E-CSOC, theteam should focus only on cybersecurity

A Publication of Professional Information Security Association

PISA

JournalProfessional Information Security Association
How to build a CSOC for SME

events, not network issues. For example,
when there is a DDoS attack on a company
website, E-CSOC should perform investigation of any successful intrusion attempts
and identify any vulnerabilities on the web
servers, rather than working on the denialof service caused by a high volume traffic.
The best solution to DDoS attack is a
DDoS protection service. Moreover, ECSOC is not a patching team. Althoughvulnerabilities are considered a security
issue, software patching and vulnerability
patching should be pushed back to the IT
department. E-CSOC should focus on exploit detection, rather than vulnerability
management.

resource allocation. “CapEx” (Capital Expenditure) and “OpEx” (Operational Expenditure) are general concepts. CapEx
means one-off cost. OpEx means recurring
cost on operations and maintenance. For
example, the cost of security tools deployment is CapEx; staff cost belongs to OpEx.
To meet a budget, you can define the scopeand scale based on the LIA model, and figure out the resourcing in terms of CapEx
and OpEx to setup an E-CSOC. So, theway of reaching the best fit resourcing is
considering the needs of the SME and balancing LIA.
From the above ideas of E-CSOC, here aresome use cases.

4. Scalable in E-CSOC
E-CSOC can be scalable to become a fulloperational CSOC whenever the company
needs. Based on the LIA model, by proportionally enlarging the scale and scope on
Log, Intelligence, and Analysis, a company
can define a path to easily enhance thecompetency from E-CSOC to CSOC.

How to define best fit resourcing for E-CSOC
When your company decides to setup an ECSOC, you have to consider the budget andPage 38 of 46

Use Case 1:
For a very small SME, a security manager
is concerned about cyber attacks from external premises only, so he defines:
Log: External facing servers, Firewall traffic.
Intelligence: External facing service vulnerabilities & threats.
Analysis: Identify any threats/ attacks hitting external facing servers.

An Organization for Information Security Professionals

MAR-2019

Issue

CapEx:

any anomaly is detected.

Deployment of SIEM which collects logs
from external facing servers.

CapEx:

OpEx:

Deployment of SIEM which collects logs
from different servers/ devices/ agents.

Subscription fee of security vulnerabilities
and threats

Software product for machine learning for
security events.

Maintenance cost of infrastructure and platform, including SIEM, etc.

OpEx:

Staff cost of SE x1, SA/IR analyst x 1, TI
analyst x1.

Subscription fee of security vulnerabilities
and advanced/ sophisticated threats.

Use Case 2:

Maintenance cost of infrastructure and platform, including SIEM, TIP, cloud infrastructure, etc.

For a medium size SME, a security manager is concerned about cyber attacks, including malicious attempts, hacking groups,
lateral movement, and social engineering
attacks targeting the SME, so he defines:
Log: Firewall traffic, Web traffic proxylog, Windows/Linux servers, EDR log.
Intelligence: Product vulnerabilities &threats, Tactics of attacks/ campaign,
knowledge of malware/insider attack.
Analysis: Identify any threats/ attacks affecting the company externally and internally. Prevent the next step of intrusion if

Page 39 of 46

29

Staff cost of SE x1, SA x1, IR analyst x1,
TI analyst x1.
Again, the LIA model can show you therequired balance between Logs, Intelligence, and Analysis, that helps you determine the most efficient resource allocation
for an E-CSOC.

Continuous improvement of ECSOC
The balance between the three LIA aspects

A Publication of Professional Information Security Association

How to build a CSOC for SME

PISA

JournalProfessional Information Security Association

Fig.1 Log Overload

Fig.2 Intelligence Overload

is very important. If there are many logs collected, but too little intelligence support andtoo little analysis capability, it would degrade
the performance of anomaly identification(See Fig.1). Similarly, a huge amount of intelligence collected but lack of analysis skill
to figure out the related, valuable, actionable
intelligence, would drain resources on operations without useful outcomes (See Fig.2).
And finally, inadequate logs would mean analysts cannot identify cybersecurity anomalies even they are skillful (See Fig.3).
For continuous improvement of an E-CSOC,
the security manager needs to review the balance among the LIA aspects regularly and do
an evaluation for each expansion of scope.
The ultimate form of E-CSOC is taking thebest fit of resources to protect from cyber attacks based on the needs/ scope defined by
the SME.

■ Frankie Wong
Copyright &Disclaimer

Copyright owned by theauthor. This article is theviews of the author and does
not necessarily reflect theopinion of PISA

Fig.3 Lack of Logs

Page 40 of 46

An Organization for Information Security Professionals

MAR-2019

Issue

Event

29

Snapshot
We Contribute. We Achieve.

(ISC)2 HK Chapter AGM cum Technical theme talk with hands-on (26 Jan 2019)

Feature Talk - Eternalblue Exploit - a very interestingtalk was delivered by Frankie Li. Participated members
could make a copy of the virtual machine containing the
exploits and tools for study and analysis.

Ricci Ieong, Program Director of (ISC)2 HK Chapter EXCO
2018, reported the updated status of the (ISC)2 Safe & Secure
Online (SSO) School Visits. He and (ISC)2 APAC representative presented gift to thank the top speaker and helper for theircontinued support to this program.

Page 41 of 46

A Publication of Professional Information Security Association

PISA

JournalProfessional Information Security Association

Event
Snapshot
We Share. We Progress.

(ISC)2 HK Chapter AGM cum Technical theme talk with hands-on (26 Jan 2019)

Group photo for the (ISC)2 Hong Kong Chapter Meeting

After a competitive election, the new (ISC)2 Executive Committee(EXCO) 2019 was formed. A photo of the new committee was taken.

Page 42 of 46

An Organization for Information Security Professionals

MAR-2019

Issue

Event

Snapshot
We Contribute. We Achieve.

PISA Spring Dinner Gathering 2019 (27 Mar 2019)

PISA Spring Dinner Gathering 2019 was successfully held. Around 30 PISA members and invited
guests joined the Gathering.

Page 43 of 46

A Publication of Professional Information Security Association

29

PISA

JournalProfessional Information Security Association

Event
Snapshot
We Share. We Progress.

Information Security Management - Guidelines for Cyber Insurance (16 Apr 2019)

Dale Johnstone shared us his journey in Cyber Insurance Guideline development and a pre-release insight into
ISO/IEC 27102 “Information security management – Guidelines for Cyber-Insurance” international standard.

Andy Ho, our Chairperson presented gift to thank Dale Johnstone
for his sharing and the continued support to PISA.

Page 44 of 46

An Organization for Information Security Professionals

MAR-2019

Issue

Event

29

Snapshot
We Contribute. We Achieve.

PISA Speakers in the Local Community.

Frank Chow spoke in the OFCA Public Security Awareness Seminar on 22 September 2018.

Frankie Wong spoke in the OFCA Public Security
Awareness Seminar on 1 December 2018.

Frank Chow delivered a information security sharing
session for the Hong Kong Institute of Bankers (HKIB)
members on 25 January 2019.

Page 45 of 46

A Publication of Professional Information Security Association

Professional Information Security Association

Professional Information Security Association
Visionto be the prominent body of professional information security practitioners, and utilize expertise andSuccessful Career

Be up-to-date and be morecompetitive in the info-sec
community – line up yourself
with the resources you needto expand your technicalcompetency and move forward towards a more successful career.

Many Ways

Networking

Continued Education

Enjoy networking and collaboration opportunities with otherin-the-field security professionals and exchange technical information and ideas for keeping
your knowledge up to date

Check out job listings information provided by members.
Get information on continuing
education and professional certification

Sharing of Information
Find out the solution to your technical problems from our emailgroups and connections with ourexperienced members and advisors.

Enjoy the discounted or freeadmissions to association activities - including seminars, discussions, open forum, IT related
seminars and conferences organized or supported by the Association.

You Can Benefit

Membership
Information

Realize Your Potential

Professional Recognition

Develop your potentials andcapabilities in proposing and running projectgroups such as Education Sector Security, Mobile Security, Cloud Security, Honeynet, Public Policy Committee and others and enjoy the sense of achievement
and recognition of your potentials

Benefit from the immediate accessto professional recognition byusing post-nominal designation

Membership Requirements
Enquiry email:membership@pisa.org.hk

Membership
Application Form:
http://www.pisa.org.hk/
membership/member.htm

Code of Ethics:
http://www.pisa.org.hk/
ethics/ethics.htm
Page 46 of 46••

Relevant computing experience (post-qualifications) will be counted, and the recognition of professional
examinations / membership is subject to the review of the Membership Committee.
All members must commit to the Code of Ethics of the Association, pay the required fees and abide by
the Constitution and Bylaws of the Association
An Organization for Information Security Professionals