August
20
2010
One of the deficiencies that came to light in the aftermath of the 9/11 terrorist attacks was the communication failure between competing intelligence agencies. A report released this past Monday from the Government Accountability Office shows that the same failure to communicate is happening in the cybersecurity arena. The breakdown in this arena is between the government who has the cyberthreat information and the private sector that manages critical infrastructure that is susceptible to cyber attack. Ah yes… history repeats itself… at least that appears to be the direction.
“Auditors pointed to recent reports of cyberattacks — such as a denial-of-service attack in Estonia in May 2007, which created mass outages of government and commercial websites in that country, as well as breaches at technology companies, many in California, in January — as examples of the debilitating impact a cybersecurity breach could have on national and economic security.”
- Kalish, Brian, “Spotty coordination on cyberthreats is recipe for disaster: GAO Study“, NextGov, August 18, 2010
The planets are coming into alignment when considering the quality of attacks, the advanced persistent threat, and the unstable world climate identified easily by reading recent headlines. The failure to leverage lessons learned in communicating threats to those in position to take action seems to be lost. Unless the so-called public-private partnership learns how to talk to each other our cyber-connected critical infrastructure may be primed for a rude awakening .
By the way…. where is the CyberSecurity Coordinator Howard Schmidt and all his talk about private sector solutions?
August
4
2010
I’m getting a kick out of some fun videos put together by the fine folks at StaySafeOnline.org. Check them out and enjoy this awareness video: “Don’t be a Billy”
July
30
2010
A “security” consultant wrote a script that collected profile listings in Facebooks’ public profile directory according to the article “The Facebook Data Torrent Debacle: Q&A“ appearing on Yahoo News yesterday. Of course, this is all public information that is available to anybody who looks. The difference in my opinion is a “security” consultant compiling such a list and then making it available online. 171 million Facebook profiles! As of the date of the article, about 10,000 people have downloaded the entire file.
It doesn’t take a whole lot of imagination to think what a person with nefarious intentions might do with your e-mail address, phone number, and your home town. A little more research on your “public” profile would make it easy for a criminal to know when you’re out of town so they can have uninterrupted access to your home. Or perhaps someone notices where your kids go to school and that they will be home alone on Tuesdays because that’s what is publicly available.
Funny thing is, it’s not just this “security” consultant providing this type of consolidated information to whoever wants it, including criminals. In my hometown, the local newspaper has been collecting the names, titles, work information, and salaries of public employees and publishing them online. Sure, the story is about government spending but why invade people’s personal lives to do it? Certainly the point could be made without attaching individual names. Yellow journalism and a violation of individual privacy is all I can think of.
The bottom line is there is too much personal information available to anybody looking. It is undoubtedly a self-inflicted problem that is exacerbated by so-called “security” consultants and news outlets that make the criminal’s job easier by consolidating and making this information available for download. They should know better.
June
25
2010
The demand for a trained and educated information security workforce here in the U.S. continues to grow. Creating a pipeline of information security professionals has to start early. A national campaign to develop the next generation of “Cyber Defenders” has been happening without the fanfare or kudos that it needs.
The Collegiate Cyber Defense Competition has existed since 2005 where, according to a USA Today article, has grown from five competing schools to 83 teams from colleges and universities. A similar high school competition has also been established and is seeing great participation. This is exciting! An environment where talent merges with enthusiasm for the the information security field is the right environment to recruit professionals.
I hope these events continue to grow and inspire similar local and regional “cyberwar games” for high school and college teams. I hope they become common recruiting grounds for both the public and private sector. Well done.
June
15
2010
A June 8 Bloomberg Businessweek article noted that publicly traded companies have started including the “material risk” of computer attacks in their SEC filings. It’s interesting to see the admission of some major companies that the threat of targeted attacks can impact the bottom line.
In what will undoubtedly become the trend in risk reporting to shareholders in annual reports there should be a corresponding effort to take actions to counter the threat. Perhaps the increased visibility into the advanced persistent threat will spur organizations out from behind their Cyber-Maginot lines and into more agile defenses.
June
2
2010
Policies, procedures, guidelines, standards. Most organizations have these in some form or another but how the organization manages these important “documents” is quite telling.
The Story Teller
These organizations rely on word of mouth. People just “know” what the procedure is or what they are “supposed” to do. Just like nomadic tribes passing down their history from generation to generation through the use of stories, these organizations pass down standards from new hire to new hire through the proverbial grapevine. Policies, procedures, and standards are only as good and consistent as the story.
The Stone Tablet
These organizations go through the process of creating and documenting policy, procedure and standards but once written, these documents are never visited again. They sit on the shelf gathering dust and if they are ever reviewed, they tend to be years or even decades out of date. These documents lose their relevance and efforts to update them become a monumental task with little payback.
The File Clerk
The organizations keep their documents filed either physically or electronically on a file server. They may even have a numbering system and a process to review and renew the documents. These documents are sometimes difficult to find due to multiple storage locations and the review process is sometimes overlooked because there is relatively little control or ownership.
The Document Management System
These organizations are using a system that manages review cycles, has an approval work-flow, keeps version control, and supports multiple file types. Policies, procedures, and standards are kept current as the process becomes part of the organizational culture. Documents have owners and responsibility. Standards for systems are documented and current as the single system provides a central repository and process for updating.
Where does your organization sit in the evolution of policy & procedure management?
May
27
2010
I guess that headline wouldn’t sell too many papers but in most cases this is the reality that drives many decisions related to information security investment. For most executives, the sky isn’t always falling and a security team that tries to operate under that premise is soon thought of as the Boy Who Cried Wolf. This is exactly why pushing security investment through FUD (Fear, Uncertainty and Doubt) is ineffective as a strategy.
There is a fine line between being vigilant defenders of information and being alarmists. The need for information security has never been more important. Surveys suggest that executives understand this so now is not the time to be lighting the warning beacons of Gondor. Keep the focus on the business when proposing new security investments.
I’m not a fan of using predictive models such as “Annualized Loss Expectancy” (ALE), which pretty much takes a guess and multiplies it by another guess, to make a case for security investment. ROI? What is your return on something that doesn’t generate revenue? Again, using this type of tool in a security sense leaves too much guesswork to provide any real benefit.
It’s important to take the time to build a case using solid metrics and be able to clearly articulate the need from a business perspective. Some points to remember:
- Knowing how information is used, where it is stored, how it is processed, and where and how it is transmitted is a vital requirement when proposing new security investments. It is surprising how many organizations can’t meet this requirement but you simply can’t protect what you don’t know.
- Leverage what you already have. Show that you can maximize the value of currently deployed security tools.
- Demonstrate how the threat applies to your specific infrastructure and business environment.
- Use regulatory compliance to compliment the proposal, not BE the only argument for the proposed solution.
Remember, information security is driven by the needs of the business, the value of information, and the validity of the threat to both. Being able to articulate the message in these terms helps make the case for security investments when things are otherwise uneventful.
April
7
2010
Once again I find myself liking White House Cybersecurity Coordinator Howard Schmidt’s approach even if I think his position is weakened based on placement, authority, etc. In a Bill Brenner article today on CSOonline, Schmidt points to the defense against the wide range of threats, including coordinated attacks, to be best lead from the private sector.
“You guys have been carrying the water,” Schmidt told attendees at CSO Perspectives 2010 Tuesday. The government can do a lot to improve the nation’s cyber defenses. But ultimately, he said, the key to warding off attacks like the one Google experienced remains private-sector vigilance.
The information security community cannot expect a government bailout when it comes to defending infrastructure and information. The private sector not only is the key to defense but also is the problem. Too many organizations have created a Cyber-Maginot line that merely creates the illusion of security while the more agile attackers circumvent stale and slow moving defensive positions. The private sector needs to participate in an active defense against multiple threats and have a solid response plan should the defenses fail.
Schmidt is right. The threats and motivations for attacks are varied and we must be in a position to defend against them all. This is a day-to-day fight.
But the lack of state-against-state warfare shouldn’t keep IT security practitioners from serious concern, Schmidt said. The attacks undermine global infrastructure and endanger our way of life, he said, adding that this is a battle every IT security professional must fight from the foxholes.
What have you done today to improve security for your organization? Are you an agile defender or are you hunkered down behind your own cyber-Maginot line using the “hope” method as a security strategy?
April
5
2010
The New Jersey Supreme Court recently ruled that a company shouldn’t have read an ex-staffer’s private e-mails even though they were sent from her employer’s computer. NorthJersey.com article.
Interesting ruling which will certainly change some thoughts as to personal use of work computers. While I’m a proponent of privacy rights, I’m torn on this particular ruling. The company had a policy in place that warned e-mails “are not to be considered private or personal to any individual employee”. That’s a fairly common policy statement but the usual intent is the use of company e-mail not a personal Yahoo account. I tend to side with the court that the attorney-client privilege applied because there was an attempt to keep the personal e-mail secure. Personal e-mail accounts, especially with an attorney seems to be reasonably outside the reach of an employer in my non-legal opinion.
That said, I think the issue here revolves around the personal use of company-owned computers rather than specific e-mail. In this case the employee was absolutely out of her mind to be exchanging communications with her attorney in preparation for a lawsuit against her company using a company issued laptop. Stupidity aside, the question is if the company had a right to “monitor, audit, intercept, access and disclose” any information that was sent using, or stored on company-owned equipment. This is where things get a little fuzzy for me.
Since businesses are responsible for the protection of PII that is transmitted from or stored on their equipment, there is certainly an obligation to monitor and audit their equipment to assure compliance. While I don’t think that extends into people’s personal e-mail accounts let’s create a scenario based on the patient privacy breach at University Medical Center I blogged about in November.
What if the employee was “hired” by a dubious attorney to provide them with face sheets as part of an unethical “referral gathering” scheme. Now, instead of taking the hard copy face sheet as was done in this case that employee used a personal Yahoo account to send this information to their “attorney”. I doubt this hits the same measure of attorney-client privilege identified in the New Jersey case but certainly this illustrates a point regarding potential misuse of employer-owned computer assets that can be quite damaging to both business reputation and finances.
As this New Jersey ruling resonates it will be interesting to see how organizations shift their policies, if they do at all. With the proliferation of social media and smart phones, it may not be an unreasonable time to revisit policies anyway.