Professional Information Security Association

SEP-2020

PISA JournalCommon Practice of Work from
Home in North America
A Draft Version of the Security
Threat Landscape 2020

www.pisa.org.hk

Issue 32

Special Topics
06 The Common Practices of Work
from Home in North America

12 A Draft Version of the Security
Threat Landscape 2020

Page 2An Organisation for Information Security Professionals

Editor: editor@pisa.org.hk

Copyright

 2020Professional Information Security Association

Intranet
04
05
1820

Page 3Message from the Chair
The Editorial Board
Event Snapshot
Joining PISA

A Publication of Professional Information Security Association

Professional Information Security Association

Message from theChairtions for newly remote workforces. We also
took steps to prevent new network and application threats that target remote workers
and to strengthen business facing online
business and operation after a rush inonline shopping during pandemic lockdowns.

After a year with pandemic, we realizedthat COVID-19 has changed many ways of
our lives, such as working from home, virtual class, virtual meeting, and online shopping are becoming our new normal. Hackers and cybercriminals have taken advantage of this situation by sending fraudulent emails and WhatsApp messages that
attempt to trick you into clicking on malicious links or opening attachments. Theseactions can leak your user ID and password, which can be used to steal money orsensitive information. Besides, many of us
suddenly found ourselves in a work-fromhome model, we adjusted, turning fromworking on routine tasks and toward longterm goals to establishing secure connec-Page 4

I would like to thank our Editorial Committee, in particular, SC Leung, Joyce Fan, Ian
Christofis and Alan Ho, for their dedicationand contributions to the PISA Journal. Thisjournal could not have been successfully
published without the hard work of Editorial Committee.
Wish all PISA members stay safe andhealthy!

Thanks.

An Organisation for Information Security Professionals

Frank ChowChairSEP-2020

PISA Journal
The Editorial Board

SC Leung
CISSP CCSP CISA CBCP

Joyce FanCISSP CRISC CISA

Ian Christofis
CISSP

Alan Ho
CISSP CISA CISM CGEIT

You can contribute to PISA Journal by:●●

Joining the Editorial Board
Submitting articles to the Journal

SC Leung,
Chief Editor
editor@pisa.org.hk
Next Issue:Issue 33 (Mar-2021)

Page 5

A Publication of Professional Information Security AssociationProfessional Information Security Association

The CommonPractices of Work
from Home inNorth America

Billy Pang
CISSP
Billy is an experienced information security analyst who focused ondisaster recovery and business continuity planning.
He joined PISA in 2009 and he was a committee member of theISC2 Hong Kong Chapter.
Billy is also a volunteer of the Safe and Secure Online (SSO) Program, and he has conducted talks for the SSO community.

Page 6

An Organisation for Information Security Professionals

SEP-2020
The Common Practices about Work from Home in North America

Introduction
2020 is an extraordinary year and the world is affected by COVID 19. People are strongly
advised to stay home to control the pandemic. However, life must go on and people have towork; Work from Home (WFH) becomes a panacea to solve this problem.
According to the article from Career Expert1 on June 20, 2020, 3.5% US population areworking as full-time remote workers. In those 5 million work forces, 99% of them prefer
work remotely in the coming future. On the other hands, employers accept this approach too.
On July 14, Gartner announced a survey2 stated that more than 80% of organizations plan topermit their staff becomes tele-workers (work from home thru internet), even after the reopening from the pandemic.

1. Work-Related Devices
Information and Privacy Commissioner of Ontario released a Privacy Fact Sheet3 in July
2020 suggested that, if possible, organizations will provide devices with all work-related applications installed to tele-workers. For example, Wells Fargo & Company provide laptops,
security tokens and iPhones to tele-workers who work from home. Tele-workers link up theirlaptops with their iPhones and then login the bank servers thru VPN with their security tokens. With such infra-structure, tele-workers are working under a secure communication tunnels which authenticate users and restrict accesses. Internet Protocol Security (IPsec) and Secure Sockets Layers (SSL) are most used for VPN connection and they ensure the security ofthe connection.

Page 7

A Publication of Professional Information Security Association

PISA

JournalProfessional Information Security Association

2. BYOD with Remote Desktop
AccessFor those tele-workers without devices
provides, remote desktop access may be analternative. A remote desktop access solution gives teleworkers the ability to remotely control desktop computers at theorganizations with their own devices. The
most popular free of charge tools in North
America are Chrome Remote Desktop andMS Remote Desktop. Other than those
two, Citrix XenApp is also a choice forsmall and medium enterprises.

Page 8Chrome Remote Desktop is free and easy touse4. However, limited features are available, and the support of remote technical support is minimal.
Remote Desktop Services by Microsoft enables users to connect to server-hosted applications or virtual desktops. This is a thin client approach, so the session of the user isalways hosted and processed on the server. It
is free of charge too.

An Organisation for Information Security Professionals

SEP-2020
The Common Practices about Work from Home in North AmericaCitrix XenApp provides many similar features to Microsoft RDS. Citrix is more powerful and it provides a central management
platform that allows network scaling andmonitoring simpler than ever before. But it
is expensive, and the initial set up is complex.
Swiss Chalet, a Canadian chain of casual
dining restaurants founded in 1954 in Toronto, is using Citrix XenApp for managerswho works from home.

3. Segregate work issued email
accounts with personal email
accounts
Although it is convenient for using a single
email account for both personal and business, there are reasons to separate organization email with personal email5.
Firstly, a work issued email addresses arevaluable to parties who send unsolicitedcommercial email. In addition, it also facilitates hackers to attack organizations thru
Pharming6 those email accounts. Malwares
are installed on personal computers or servers and redirecting users to fraudulent Web
sites without their consent. Codes sent in an
e-mail modifies local host files and thenPage 9Issue

32

convert URLs into the number strings thatthe computer uses to access Web sites.
Computers with compromised host files will
go to fraudulent Web sites even if users
type in the correct Internet addresses orclick on affected bookmark entries. Users
need to change their browsing habits toavoid the recurrences of such corruption.
Secondly, the work issued email accounts
and intellectual property under those email
accounts belong to organizations. All items
under those work issued email accounts arebelong to those organizations too. Pleasebeware that tele-workers are not able to access any email or attachment after their “lastworking day”.
Thirdly, there are risks of sending business
related emails to nonbusiness related recipients if email accounts are not segregated. It
is found that once the first three or four letters under recipient textboxes are typed,
some email addresses with same initial letters will be pop up. It is because the email
systems are trying to find recipients thru theemail sending history. If email accounts aresegregated, only business-related email addresses will be pop up and it reduces thechance of sending emails to incorrect recipients.

A Publication of Professional Information Security AssociationPISAJournal

Professional Information Security Association

4. Teleconference
Skype for Business/Microsoft Teams, Meetby Google Hangouts, Cisco WebEx andZoom are popular teleconference applications used by North Americans7. But nomatter what teleconference applications
you are using, there are some tips for videoconferencing at home8. Before starting themeeting, please check the system settings
like internet connection, microphone, andcamera. Make sure that the connection

Page 10speed is good enough to let the meeting running smooth. Adjust the microphone andcamera to an appropriate position so that all
meeting attendees can see your face and hear
your voice well. A neutral background is important. Attendees may lose their focuses ifyour background is too busy. If a neutral
background is not available, blur the background or switch to a virtual background.

An Organisation for Information Security Professionals

SEP-2020

Issue

32

During the meeting, please mute the speaker when you are not speaking. This eliminates
any background noise on your end. Before share screens, go to browsers and close alltabs. Also enable the “Do Not Disturb mode” on your computer to ensure that others
will not accidentally see messages from private conversations while sharing screens.
Last but not least, try to keep pets and children away from the meeting. It shows yourrespect to other attendees.

Billy Pang ■Copyright &Disclaimer

Copyright owned by theauthor. This article is theviews of the author and does
not necessarily reflect theopinion of PISA

Page 11

A Publication of Professional Information Security AssociationProfessional Information Security AssociationA Draft Version of theThreat Landscape 2020

Frankie WongCISSPMr. Frankie WONG is working in Cybersecurity of a Financial Institution. His another role is a Vice-Chairperson of PISA. He is eager to promote security awareness. He had presented in a number of security awareness pubic seminars organized by (ISC)2, OGCIO, HKCERT, Hong Kong Police Force, OFCA, and also
given guest lectures in tertiary education institutions. He is a core committee member of an annual conference PISA Security Jam for local security professionals inHong Kong.

Page 12

An Organisation for Information Security Professionals

SEP-2020

Overview
I will try to summarize the cybersecurity
events/threats of the year 2020. I havecalled this article a ‘draft’ version because it
does not meet the level of a professional
threat report and it includes my subjectiveviews. I hope the following picks will provide some insight that you can benefit fromin the year 2021.

Early 2020
Since the end of 2019, COVID-19 is one of
the threats to not only human beings, butalso to cybersecurity. COVID-19 brings
huge impacts to companies and enterprises
because they are not ready for WFH (WorkFrom Home) and themed phishing attacks.

(1) Vulnerabilities in VPN appliances [1][2]Vulnerabilities in VPN appliances may letattackers penetrate company or enterprisenetworks through a vulnerable VPN gateway. Some security vendors found cyberthreat actors actively scanning networks forvulnerable VPN gateway discovery. Thereare many incidents due to VPN flaws thisyear. For instance, money exchange Travelex [3] became one of the victims due to anunpatched VPN appliance, and the incident
caused its foreign exchange services to gooffline, affecting banks like Lloyds, Barclays, HSBC and RBS.

(2) Issues in Video Conference systems
There were many issues with Video Conference tools as people started using video
meetings amid the pandemic situation. e.g.
ZoomBombing,[4] war dialing [5]/passcode brute-force [6], application vulnerabilities and credential stuffing, etc. So, it
can be observed that developers and users
have to put more concern on security when
they try to move to video-meetings online.

[1] Ref: https://us-cert.cisa.gov/ncas/alerts/aa20-010a[2] Ref: https://us-cert.cisa.gov/ncas/alerts/aa20-133a[3] Ref: https://portswigger.net/daily-swig/travelex-ransomware-attack-pulse-secure-vpn-flaw-implicated-insecurity-incident[4] Ref: https://home.sophos.com/en-us/security-news/2020/zoombombing.aspx[5] Ref: https://krebsonsecurity.com/2020/04/war-dialing-tool-exposes-zooms-password-problems/[6] Ref: https://portswigger.net/daily-swig/zoom-fixes-flaws-that-allowed-brute-force-attacks-to-crack-privatemeeting-passwords

Page 13A Publication of Professional Information Security Association

Is My car hackable?

PISA

JournalProfessional Information Security Association(3) COVID-19 themed phishing attacks[7] [8]Phishing is always an effective social engineering attack. It becomes very effective
when there is a common hot topic, e.g.
COVID-19, in the public arena. It lures
users into clicking links or opening attachments inside email. Lack of security
awareness is the weakness exploited tomake people become phishing victims.

Later in 2020

(4) Ransom DDoS on the rise
Since August, Ransom Denial-of-Service(RDoS) attacks have become very active.
One successfully disrupted the New Zealand Stock Exchange (NZX) [9] service forseveral days, but without getting a ransom.
This kind of RDoS attack not only targeted
the financial sector, but also multiple sec-

[7] Ref: https://us-cert.cisa.gov/ncas/current-activity/2020/03/06/defending-against-covid-19-cyber-scams[8] Ref: https://us-cert.cisa.gov/ncas/alerts/aa20-099a[9] Ref: https://www.zdnet.com/article/new-zealand-stock-exchange-suffers-day-four-disruption-followingddos-attacks/

Page 14

An Organisation for Information Security Professionals

SEP-2020

Issuetors [10]. The threat actor purported to be
one of various Advanced Persistent Threat(APT) groups, posing as Fancy Bear, Armada Collective or Lazarus Group.[11]The attackers also claimed that they had
the ability to perform volumetric attacks
that peaked at 2Tbps. When you found thetraffic volume beyond your expectation,
the only thing you could do is to review
Anti-DDoS solutions with your network/
security partners. I believe enabling an Anti-DDoS solution is much better than kicking-off a Business Continuity Plan (BCP)
when your company is facing a DDoS attack.

32

Throughout the year 2020
Last year, many critical vulnerabilities werediscovered and exploits were found in thewild. The increase of severity was because
zero-day attacks targeting the common platforms, like Windows and Chrome, werefound.

(5) Zero-Day and Critical Vulnerabilities
In 2020, several critical vulnerabilities withexploits in the wild caused security participators concern. In March, Microsoft announced 2 new critical unpatched zero-day[10] Ref: https://us-cert.cisa.gov/ncas/current-activity/2020/09/04/dos-and-ddos-attacks-against-multiple-sectors[11] Ref: https://blogs.akamai.com/2020/09/unprecedented-levels-of-ransom-ddos-extortion-attacks.html

Page 15

A Publication of Professional Information Security Association

Is My car hackable?

PISA

JournalProfessional Information Security Association

vulnerabilities (CVE-2020-1020) that
could let hackers remotely take complete
control over targeted computers.[12][13] In
August, Microsoft released a patch for azero-day vulnerability CVE-2020-1464(Glueball) that had been exploited in thewild for 734 days.[14] In Sep-Oct, CISA
announced they had recently observed
APT actors exploiting multiple legacy vulnerabilities in combination with a newer
privilege escalation vulnerability CVE-2020-1472, dubbed as ZeroLogon, in Windows.[15][16] In Nov, Google disclosed an
actively exploited Windows kernel zero-day(CVE-2020-17087). The attackers were using the Chrome zero-day (CVE-202015999) to gain access to the target systemand then CVE-2020-17087 to gain administrator access on it.[17] We may foresee zero-day vulnerabilities becoming more common and patching will shift from preventivecontrol to corrective control.

[12] Ref: https://msrc.microsoft.com/update-guide/en-US/vulnerability/ADV200006[13] Ref: https://thehackernews.com/2020/03/windows-adobe-font-vulnerability.html[14] Ref: https://www.balbix.com/blog/glueball-cve-2020-1464/[15] Ref: https://us-cert.cisa.gov/ncas/current-activity/2020/09/14/exploit-netlogon-remote-protocolvulnerability-cve-2020-1472[16] Ref: https://us-cert.cisa.gov/ncas/alerts/aa20-283a[17] Ref: https://www.zdnet.com/article/google-discloses-windows-zero-day-exploited-in-the-wild/

Page 16

An Organisation for Information Security Professionals

SEP-2020

Issue32

My Thoughts
The year 2020 was a difficult year due to the pandemic situation. In cyberspace, we have toreview our current controls, especially when we are more reliant on the Internet for Teleworking and Video-meetings. Also, we have to realize that existing cyber-attacks are becoming more and more sophisticated. The traditional concept of focusing on prevention does notwork. If a company/enterprise looks to focus on cybersecurity, it should try to do more ondetection and hunting. That will help to defend against cyber-attacks by the proactive discovery of suspicious activity.
.

Frankie Wong Copyright &Disclaimer

Copyright owned by theauthor. This article is theviews of the author and does
not necessarily reflect theopinion of PISA

Page 17

A Publication of Professional Information Security Association

Professional Information Security Association

EventSnapshot
We Contribute. We Achieve.

Data Privacy Assessment and ISO/IEC 27701 (10 Aug 2020)

Mr. Chris Yau of SGS shared in the webinar on Data Privacy Assessment and the ISO/IEC 27701.
– Data privacy is more than just information security– A brief introduction to ISO/IEC 27701– The relationship between ISO/IEC 27701 and GDPR (and other privacy regulations)– Establishing a Privacy Information Management System

Page 18

An Organisation for Information Security Professionals

SEP-2020

EventSnapshot
We Share. We Progress.

Joint AGMs 2020 cum PISA & ISC2 HK Chapter EXCO Elections(26 Sep 2020)

PISA Executive Committee 2020-2021

PISA Executive Committee
Chairperson: Mr. Frank Chow
Vice-Chairperson: Mr. Frankie Wong (External Affairs)
Vice-Chairperson: Mr. Thomas Kung (Internal Affairs)
Vice-Chairperson: Mr. Otto Lee (Membership & Constitution)
Hon. Secretary & Treasurer: Mr. Frankie Leung
Program Director: Mr. Andy HoProgram Director: Mr. Mike Lo(ISC)2 HK Chapter Executive Committee
President: Frank Chow *Secretary: Frankie Leung *Treasurer: Eric Moy
Membership Chair: Otto Lee *Professional Development: Martin Chan
Program Director: Andy HoProgram Director: Mike Lo
Liaison: Thomas Kung *Page 19

A Publication of Professional Information Security Association

Professional Information Security Association

Professional Information Security Association
Visionto be the prominent body of professional information security practitioners, and utilise expertise andSuccessful Career

Be up-to-date and be morecompetitive in the info-seccommunity – line up yourself
with the resources you needto expand your technicalcompetency and move forward towards a more successful career.

Many Ways

Networking

Continued Education

Enjoy networking and collaboration opportunities with otherin-the-field security professionals and exchange technical information and ideas for keeping
your knowledge up to date

Check out job listings information provided by members.
Get information on continuing
education and professional certification

Sharing of Information
Find out the solution to your technical problems from our emailgroups and connections with ourexperienced members and advisors.

Enjoy the discounted or freeadmissions to association activities - including seminars, discussions, open forum, IT related
seminars and conferences organised or supported by theAssociation.

You Can Benefit

Membership
Information

Realise Your Potential

Professional Recognition

Develop your potentials andcapabilities in proposing and running projectgroups such as Education Sector Security, Mobile Security, Cloud Security, Honeynet, Public Policy Committee and others and enjoy the sense of achievement
and recognition of your potentials

Benefit from the immediate accessto professional recognition byusing post-nominal designation

Membership Requirements
Enquiry email:membership@pisa.org.hk

Membership
Application Form:
http://www.pisa.org.hk/membership/member.htm

Code of Ethics:
http://www.pisa.org.hk/
ethics/ethics.htm
Page 20••

Relevant computing experience (post-qualifications) will be counted, and the recognition of professional
examinations / membership is subject to the review of the Membership Committee.
All members must commit to the Code of Ethics of the Association, pay the required fees and abide by
the Constitution and Bylaws of the Association
An Organisation for Information Security Professionals