applied security research
Erik Remmelzwaal - 30 apr 2020

Security 4.0

Let’s talk about the near future: some 10 to 20 years from now. Picture the world we are living in, and how it typically differs from today. I will assume that we get over this Corona crisis and digitalization will continue to expand.

Yes of course digitalization: surely by then we will have autonomous systems, like vehicles and robots. We (or our autonomous descendants) will probably go to Mars as well but lets focus on this planet for now. Virtual Reality, exoskeletons, gene editing, bio engineering and things like Neuralink. Technologies like these basically will make any kind of science fiction scenario possible. Think Robocop, Ready Player One, X-Men, Wall-E, etc.. All of these movies have a different kind of digital hero (Cyborg, Virtual Reality, Mutant, Artificial General Intelligence), and all seem not that far-fetched anymore. At least they aren’t when considering the entire time-scale of Homo Sapiens existence. I do not think we will live in Dystopia in 20 years, but surely our lives will have been fundamentally altered by digitalization by then. 

4th Industrial Revolution

So when considering such a world, clearly, we are thinking along the lines of what is called the fourth industrial revolution.

“One of the features of the 4th Industrial Revolution is that it doesn’t change what we are doing, but it changes us”Klaus Schwab, World Economic Forum

Homo Deus: A Brief History of Tomorrow

We will be able to fix our inabilities through the means of technology. Make us stronger using robotics, immune by bio engineering and walk around in impossible locations using VR. Homo Sapiens will evolve into Homo Deus, according to Yuval Noah Harrari. 

OK so let’s put our feet on the ground again. Because regardless whether you believe in robotty fairytales: digitalization is all around us, nobody will dispute that. I would like to focus on the role of security and hackers in a heavily digitalized world. To me it is quite clear that the true wiz-kids – or nerds if you will, I prefer ‘hackers’ – will be the de-facto technological cornerstone of society. De-facto because it might not be so by means of policy making, but the important role of hackers will become apparent during incidents and crises.

If we are more and more reliant on technology, even to the extent of injectables and smart medicine, who will have the capabilities to help when it fails us? If your self-driving car runs into a river: how are we going to understand why? Surely it won’t be effective to ship every malfunctioning piece of technology to a factory abroad. We will need tools and knowledge to test and troubleshoot technology in our close vicinity. We will need hacker workshops at the corner of our streets where we can bring our malfunctioning robots. And from what other current part of society could such capabilities emerge than from the hacking & security community?  

If not us: who? If not now: when? 

On a more idealistic note: with the digital revolution also comes the risk of further bifurcation of humanity. Will the poor benefit in the same way from technological progress as the rich? And if not: how will the technosplit widen and with what consequences? I believe that the availability of hacking capabilities embedded within a society will strengthen it’s independence. And allow it to actually benefit from digital revolution. We need hackers around the world.

Transforming Security

“Security 4.0” is my idea of having hacking capabilities as a societal function, acting as the safety net for human kind in the digital era. Products and services that are designed to fit the needs of organizations of the future. If you close your eyes and try to envision this world, you know security has to adapt quite a bit to fulfill that role. It’s important to start working in that direction today, now we still have some time left to create competencies in a controlled fashion.  

3 features of security 4.0

Security 4.0 providers should….

  1. Act Research-driven – do actual and continuous research on emerging technologies and threats. There will be no educational system up to cope with the speed of change. We will need to do it ourselves. Failure to do so will make us redundant in 5 years.
  2. Be Agile – organized in such a way to be able to adapt to rapid change. New digital technologies create new questions and problems. Thus new markets and new demands. No place to remain locked up in 1 service and operating model for years.
  3. Be Communicative – take security out of the complexity arena it has been in for past decades. Cognitively involve the ones that need protection by making them understand: why?. Behavioral change requires people to be aware of a problem and motivated to change their behavior. This requires simple and clear communication about problems and solutions.

But is the security community up for such a transition? I am quite sure it’s best to rethink the way we are used to do things in our industry. That is scary though: as opposed to mimic other players in the market space it requires true entrepreneurship. Understanding the actual problem you are solving, having a belief as to how that problem will look like in 5-10 years from now. And then building your solution, go-to-market and operating model to make it work.  

I am happy to have found my position with 3 of the brightest and most creative minds I have encountered in this space. And we will work to create the security 4.0 company I envision. It’s great that because of my background it is possible to do so in relative independence, and so without distraction of short term goals or unrealistic expectations.

And so for the most part, it will come down to actually doing what we love to do, most of the time. Making sure Zolder is the environment in which hackers thrive and can be flexible enough to adjust to evolving demands coming from the digitalizing society.

Zoldersession

In Dutch, I spoke about the digital revolution in my Zoldersession with Joost Hoebink. Here is a clip of the relevant part. The full podcast can be viewed/listened here.

Blogs

Honeytokens using Azure Keyvaults

Rik van Duijn - 15 okt 2020
In 2017 Wesley and I gave a presentation at SHA2017 about honey/pot/tokens. We actually planned on building a fully fledged platform. But never came further then the POC phase of that project. This week we got a product demo from the guys at Thinkst, i’ve always loved this way of thinking: let the attacker come […] Lees verder

Zolder.App Blog 2 - Probleem & Oplossing

Zolder B.V. - 08 okt 2020
Het is best een goed idee om voordat je begint met het bouwen van een product of dienst, te weten welk probleem je ermee gaat oplossen. Voor Zolder.App: we lossen het probleem dat MKB-ers slecht beveiligd zijn op door enterprise-niveau security voor hen toegankelijk te maken. In feite zijn er een aantal problemen die we […] Lees verder

Risk of exposed home automation services

Wesley Neelen - 24 sep 2020
At home, I am automating many things for fun. Currently I am using Home Assistant, an incredibly powerful piece of software for automating your home. Regularly I am combining the home automation experiences with security. Home automation is often related to physical things such as changing lights, moving curtains, opening door locks or turning the […] Lees verder

Zoldersessions Studio Setup

Zolder B.V. - 27 aug 2020
Here is the kitlist which we end up with to record our Zoldersessions 🙂 Audio Input 4x Rode Procaster microphone 4x Triton Audio FetHead Microphone PreAmp 4x YellowTec m!ka Mic Boom Focusrite Scarlett 18i8 3rd gen Audio Output 4x Shure SRH840 Headphone ART HeadAmp 4 headphone amplifier Video Input 2x Sony Handycam main cameras Logitech […] Lees verder

Zolder.App blog 1 - het idee

Erik Remmelzwaal - 27 aug 2020
Op Zolder bouwen wij aan een mobiele app die MKB’ers op een baanbrekende manier moet helpen digitaal weerbaar te zijn. We verwachten in het vierde kwartaal van 2020 de app te kunnen lanceren. In deze blogreeks neem ik je mee in de ontwikkeling van Zolder.App. Eigenlijk was er niet 1 idee, maar is Zolder.App het […] Lees verder

Hacking the traffic light of the future

Wesley Neelen - 06 aug 2020
Nowadays we are connecting everything we can think of to the internet. Usually to make our lives easier or more comfortable. Some of the new upcoming innovations are related to making our traffic smart with the goal to improve safety, comfort and the traffic flow. We dived into this technology to analyze the inner workings and identify potential security risks. Lees verder

Detect lateral movement with Azure Sentinel

Wesley Neelen - 01 jul 2020
Lately we have been setting up a the production network for our Zolder.App service. The network consists of multiple segments separated by a firewall. As an addition we wanted to add monitoring features into the network. If an attacker is in our network, we would like to get a notification. Lees verder

CSBN 2020

Erik Remmelzwaal - 01 jul 2020
Het jaarlijks CSBN is weer beschikbaar. Het Cybersecurity Beeld Nederland, opgemaakt door onze overheid in de hoedanigheid van de NCTV. Aan afkortingen geen gebrek. Dat maakt het gelijk ook heel taaie kost: ingewikkeld om te doorgronden. Je gaat haast denken dat het ook de bedoeling is dat we er niet teveel aandacht aan besteden. Of […] Lees verder

Detecting BEC fraud using Azure Sentinel

Rik van Duijn - 17 jun 2020
Business Email Compromise (BEC) Fraud inflicts the most damage of all types of cybercrime, according to the FBI. How to detect such attacks using Azure Sentinel? Rik shares some actual possibilities. Lees verder

Security-by-design. Zo makkelijk is dat niet

Wesley Neelen - 16 jun 2020
Wesley beschrijft de complexiteit bij het bouwen van een netwerk infrastructuur: kies je voor veiligheid of werkbaarheid? Of is er een optimale mix? Lees verder

Phishing aftercare

Rik van Duijn - 26 mei 2020
This blog is part of our Office 365 attack & defense series. We also maintain a Github page where we share our Office 365 tools and queries. We often get sent phishing emails by family and friends. Not to phish us but because we ask family and friends to forward them to us. Sometimes they […] Lees verder

Inside a phishing panel

Wesley Neelen - 20 mei 2020
Dutch and Belgium citizens are receiving phishing attacks every day. But how does that exactly work? Lees verder

DBIR 2020

Erik Remmelzwaal - 19 mei 2020
We hadden het eerder al over de moeilijkheid om een beeld te vormen van digitale dreigingen. Er is eigenlijk geen partij die hier een goed beeld van kan vormen. Maar als er 1 rapport is dat al jaren goede inzichten biedt gebaseerd op data uit heel veel gezaghebbende bronnen, dan is het DBIR. Het Verizon […] Lees verder

Wat zou er mis kunnen gaan?

Erik Remmelzwaal - 17 mei 2020
Waarom worden bedrijven slachtoffer van virussen die losgeld vragen? Of online afpersing? Of fraude met betalingen? Het antwoord: door gebrekkig leiderschap. Lees verder

Office 365 - Exchange rules

Rik van Duijn - 13 mei 2020
This blog is part of our Office 365 attack & defense series. We also maintain a Github page where we share our Office 365 tools and queries. Exchange rules can be useful in managing the emails we receive on a daily basis. For example, it allows users to automatically respond or move specific emails to […] Lees verder

Office 365 - malicious applications

Wesley Neelen - 05 mei 2020
Wesley dives into the App Registrations feature of Microsoft Azure Active Directory. Finds ways to abuse it through delegate & application permissions and shares ideas howto protect from such abuse. Lees verder

Security 4.0

Erik Remmelzwaal - 30 apr 2020
A vision of the digital future, the role of security and how it should adapt to be able to fulfill that role. Lees verder

Applied Security Research; more than just a pay-off

Rik van Duijn - 28 apr 2020
Rik beschrijft wat Applied Security Research voor hem betekent. En hoe we als Zolder die pay-off in praktijk willen brengen. Lees verder

Windows terminal profile fun

Rik van Duijn - 24 apr 2020
Rik plays around with the preview version of Windows Terminal to find manipulation options. Lees verder

Building a Zolder logo

Wesley Neelen - 22 apr 2020
Wesley writes about his most recent IoT project: building a Zolder logo with WS2812B ledstrips behind it, to give it some cool effects. Lees verder