http://www.technewsworld.com/story/57281.html
So what's new, right?! This expression is becoming very common nowadays, from completely unforgivable sins such as not securing hardware to exposing sensitive data to the general public on an uncontrolled/unmoderated website (the Agriculture department comes to mind).
Let's analyze for a second how such a mishap could occur. Places such as the Los Alamos lab - famous for disappearing drives and dead-end investigations, don't seem to have a clue as to what to do and look for when a critical piece of hardware goes poof!
Lifecycle of a disk (bought separately, and assuming formal processes exist):
a. Requisition for purchase
b. Approval
c. Order
d. Delivery
e. Verification
f. Change Management process approval
g. Implementation/installation
h. Usage
i. Fault - Return to sender
j. EoL
Worker W requests Manager M for extra space and submits requisition, M approves it and sends it to Purchasing for placing the order.
Disk comes through, is verified by the appropriate personnel, and the CM team authorizes the installation of the disk (might involve downtime, reboot etc).
IT installs the disk and brings it online so users can store twenty-thousand copies of the same document so they run out of space way before the projected date and then place more orders.
Say an error crops up on this new disk, which by now has a lot of data, IT will be asked to look into it. IT will try to backup the data to another disk and try to fix it. In the meantime, since most workers have filled up this new backup disk and don't have any problems with it, they're likely to push for IT to delay installing the new disk, which has been fixed by now.
So, IT just waits around, and eventually something happens that causes them to lose track of it. This 'something' is the most dangerous aspect of IT and security because nobody knows what it is (and that's why it's called 'something'). It could be an employee with malicious intent to an ID thief to an innocent misplacing to out and out loss of the disk beyond recovery. This becomes much more of an issue if the disk is to be shipped elsewhere (ironically, for safekeeping or backup) and nobody really knows whether the destination received it, or whether they got the right material, or whether the disk was even sent!
Anyway, all through the steps above, there is no TRACKING of the material. If there were a CMDB in place, then much of this could have been part of its DB and then could be made a traceable and trackale entity.
Then, when a disk went missing, all one would have to do is search for the part number/brand/custom id/tracking number/dept id/destination -- you get the idea -- and take further action. The point is that not much is unknown at that time. Auditing, which should come in between 'h' and 'i' is the one process that people love to hate, but one which may save their (and our) lives one day. As long as regular auditing is done using the CMDB as an authoritative source of existing inventory, one can be assured that such 'issues' won't be so common as one's less likely to be lackadaisical when an audit is due.
Since most people don't even know what a CMDB is, it's going to be hard to convince them or educate them on the importance of such a database. The root problem thus lies in education and awareness. Get familiar with ITIL!
Security is all about education, training, and awareness. As Fox Mulder put it, TRUST NO ONE. This doesn't mean you incur the wrath of your boss for asking him 20 questions on why he wants to see your code, but that anyone that's not in your immediate circle of trust (something like PKI) should not be privy to your sensitive data. The idea is Need to Know comes before everything else.
Coming back to this intriguing case of the missing disk, here's how I'd do it (all of these trackable details such as tracking number etc would go into the CMDB):
a. Requisition generated by user (tracking number (tn) 1234)
b. Approval by manager (tn, approval id (aid) A45)
c. Order (tn, aid, order number (on) O858)
d. Delivery (tn, aid, on, delivery date (dd) 05/08/2007, shipper id (sid), dept id (did))
e. Verification (tn, aid, on, dd, sid, deptid, verification id (vid))
f. CM approval (tn, aid, on, dd, sid, deptid, vid, chg mgr approval id (cmid))
g. Ticket to install/installation (tn, aid, on, dd, sid, deptid, vid, cmid, iticket)
h. Usage
i. Fault (tn, aid, on, dd, sid, deptid, vid, cmid, fticket)
j. Shipping (tn, aid, on, dd, sid, deptid, vid, cmid, fticket(if fault), rticket (if request to ship), sid, sender deptid, receiver deptid, slaid (service level agreement id))
k. EoL
As you can see, everything here can be traced to the finest level - nothing can escape scrutiny, and accountability is preserved.
As for data structure, when I say verification id, the id should point to a table that contains at least the original requisition id, the id of the person performing the verification, the outcome, destination dept, contact who will pick up the disk, and anything else that may matter).
I realize it sounds like overkill, but try facing 10,000 workers after 'losing' their most precious and sensitive information. Their stares alone will jolt you into becoming an evangelist for data safety, if the govt/sanctions/bad reputation don't get there first.
Be safe!
Tuesday, May 8, 2007
Thursday, May 3, 2007
VeriSign's Passcode Initiative
http://www.itwire.com.au/content/view/11775/53/
VeriSign now offers a special card that generates a one-time passcode that expires quickly, so even if someone were to steal it, it wouldn't be of much use.
The passcode is displayed on the card itself, at the push of a button. Expected to last two years or around 100000 uses, it's a nice, elegant, and compact solution.
I know you're waiting for the key word - HOWEVER - it's easily subject to the infamous MitM attack (Man in the Middle). See, after all, the passcode is just another bit of data that can be stolen along with user name and password. Nothing really more to it, in my opinion, than hype.
Although two-factor authentication schemes are very strong and should be recommended for most security applications (who you are, what you have, what you know are the three principal factors), there are severe limitations that need to be considered as well.
A nearly foolproof method would be the use of biometric systems - the iris check, fingerprints, voiceprints, facial recognition, and so on, are somewhat advanced and used in most high-security areas. The trick is to incorporate them into devices that we need access to at higher levels of security, such as ATM machines, bank lockers, safes etc.
In any case, VeriSign is doing the right thing by at least starting the process somewhere. I know Discover Card used to have a little application that one could download to one's desktop, and it'd do the same thing. Not sure what happened to it.
Also, many MasterCard and Visa issuers are also using the two-factor method to prevent phishing. For example, one site lets you pick a picture, and it'll show it to you when you enter just your username, and if you don't recognize it you simply don't supply the password. If the picture is something that you know you picked then you enter the password. How secure is this? Quite, but not foolproof. A hacker could try and randomly generate the pictures from actually using the site as a regular user and looking at the pictures, and if it matches - whoa!
A better idea would be to let the user pick their own pictures - something personal, say their dog or their home or their messy office desk or something that's not easy to duplicate.
In summary, while it's a good start, it's only a start. I look forward to seeing more biometric authentication schemes available to the general public and not just to the privileged. We pay the bills, after all!
Be safe!
VeriSign now offers a special card that generates a one-time passcode that expires quickly, so even if someone were to steal it, it wouldn't be of much use.
The passcode is displayed on the card itself, at the push of a button. Expected to last two years or around 100000 uses, it's a nice, elegant, and compact solution.
I know you're waiting for the key word - HOWEVER - it's easily subject to the infamous MitM attack (Man in the Middle). See, after all, the passcode is just another bit of data that can be stolen along with user name and password. Nothing really more to it, in my opinion, than hype.
Although two-factor authentication schemes are very strong and should be recommended for most security applications (who you are, what you have, what you know are the three principal factors), there are severe limitations that need to be considered as well.
A nearly foolproof method would be the use of biometric systems - the iris check, fingerprints, voiceprints, facial recognition, and so on, are somewhat advanced and used in most high-security areas. The trick is to incorporate them into devices that we need access to at higher levels of security, such as ATM machines, bank lockers, safes etc.
In any case, VeriSign is doing the right thing by at least starting the process somewhere. I know Discover Card used to have a little application that one could download to one's desktop, and it'd do the same thing. Not sure what happened to it.
Also, many MasterCard and Visa issuers are also using the two-factor method to prevent phishing. For example, one site lets you pick a picture, and it'll show it to you when you enter just your username, and if you don't recognize it you simply don't supply the password. If the picture is something that you know you picked then you enter the password. How secure is this? Quite, but not foolproof. A hacker could try and randomly generate the pictures from actually using the site as a regular user and looking at the pictures, and if it matches - whoa!
A better idea would be to let the user pick their own pictures - something personal, say their dog or their home or their messy office desk or something that's not easy to duplicate.
In summary, while it's a good start, it's only a start. I look forward to seeing more biometric authentication schemes available to the general public and not just to the privileged. We pay the bills, after all!
Be safe!
Wednesday, April 25, 2007
WhIther Fidelity
http://www.computerworld.com/action/article.do?command=viewArticleBasic&taxonomyId=12&articleId=9017825&intsrc=hm_topic
OK - so you're at this fashionable hotel - either staying or picking up someone - and you whip out your fashionable laptop, the one with diamonds and rubies encrusted on the logo that screams "YUCK!"
You power it up, and as expected, the 'top finds a few free networks (unsecured, of course, for easy exploitation). You connect to one of them start surfing. The name of the access point matches the name of the hotel, so there are no second thoughts of any warning bells in your head giving you an impromptu migraine.
Three days later, all of a sudden, you notice your email account has been hijacked, and also your credit cards. Hmmm how could this happen?
It could happen because the shifty-eyed person that was sitting just a few feet away from you WAS the access point and he simply named his AP the same as the name of the hotel to fool you.
This method of attack is virtually impossible to detect because the entire AP can be brought down by the attacker in a matter of seconds. So there is no trace of his presence.
How do you protect yourself? Simple - do not use any unsecured connections that appear 'free' - if in doubt ask the company about their WiFi policies and the name of their AP. Plus, warn them if you find an AP with a similar name or the same name. Be careful about submitting any sensitive data over these lines, and definitely do not submit passwords/SS numbers/medical/financial information. Use it to surf aimlessly while waiting for your date, but don't go beyond that. It's not worth it.
Be safe!
OK - so you're at this fashionable hotel - either staying or picking up someone - and you whip out your fashionable laptop, the one with diamonds and rubies encrusted on the logo that screams "YUCK!"
You power it up, and as expected, the 'top finds a few free networks (unsecured, of course, for easy exploitation). You connect to one of them start surfing. The name of the access point matches the name of the hotel, so there are no second thoughts of any warning bells in your head giving you an impromptu migraine.
Three days later, all of a sudden, you notice your email account has been hijacked, and also your credit cards. Hmmm how could this happen?
It could happen because the shifty-eyed person that was sitting just a few feet away from you WAS the access point and he simply named his AP the same as the name of the hotel to fool you.
This method of attack is virtually impossible to detect because the entire AP can be brought down by the attacker in a matter of seconds. So there is no trace of his presence.
How do you protect yourself? Simple - do not use any unsecured connections that appear 'free' - if in doubt ask the company about their WiFi policies and the name of their AP. Plus, warn them if you find an AP with a similar name or the same name. Be careful about submitting any sensitive data over these lines, and definitely do not submit passwords/SS numbers/medical/financial information. Use it to surf aimlessly while waiting for your date, but don't go beyond that. It's not worth it.
Be safe!
Friday, April 20, 2007
Universal Security Blunder?
There's been a spate of news concerning the threats posed by USB devices - including devices such as iPod, Zen etc. The main threat is that data could be very easily stolen using these seemingly harmless and innocuous devices.
Other threats may soon include viruses and trojans happily hopping from iPod to iPod, iPod to computer, and computer to computer.
When I say iPod I refer to the general class of such disk-based entertainment devices - sheer laziness and not any bias makes me refer to them so (I'm a huge fan of Apple's!).
A typical such device comes with a disk that's at least a few GBs, so it's not that difficult to steal large files using the USB ports.
Most companies permit employees to take their laptops with them - else what's the point of having one! The biggest problem is not that the laptop itself will go missing (which is an obvious threat) but that the data will be stolen (can't catch that unless you really audit the machine or install special tools to monitor data transfer). Now, with USB2.0 and FireWire, even GBs of data can be copied in minutes.
How do you protect against such an invisible, internal attack?
* Use software to lockdown the USB ports
* Educate employees on USB safety and security
* Order machines that have the ports disabled or not configured
* Glue them shut if all else fails
In any case, before we fall into this hysteria and become part of the USB-banning mob, we should give some thought to the level of crimes that occur using USB ports. How many people steal data using USB drives vs via hard copies of documents, CD-RW disks, email, illegal upload to online backup sites...the list is endless.
So, what do you learn from this? Definitely, USB ports are a threat, but maybe not to the extent that people make it out to be. At least not yet. Or maybe it already is, and we just haven't realized it yet.
Be safe!
Other threats may soon include viruses and trojans happily hopping from iPod to iPod, iPod to computer, and computer to computer.
When I say iPod I refer to the general class of such disk-based entertainment devices - sheer laziness and not any bias makes me refer to them so (I'm a huge fan of Apple's!).
A typical such device comes with a disk that's at least a few GBs, so it's not that difficult to steal large files using the USB ports.
Most companies permit employees to take their laptops with them - else what's the point of having one! The biggest problem is not that the laptop itself will go missing (which is an obvious threat) but that the data will be stolen (can't catch that unless you really audit the machine or install special tools to monitor data transfer). Now, with USB2.0 and FireWire, even GBs of data can be copied in minutes.
How do you protect against such an invisible, internal attack?
* Use software to lockdown the USB ports
* Educate employees on USB safety and security
* Order machines that have the ports disabled or not configured
* Glue them shut if all else fails
In any case, before we fall into this hysteria and become part of the USB-banning mob, we should give some thought to the level of crimes that occur using USB ports. How many people steal data using USB drives vs via hard copies of documents, CD-RW disks, email, illegal upload to online backup sites...the list is endless.
So, what do you learn from this? Definitely, USB ports are a threat, but maybe not to the extent that people make it out to be. At least not yet. Or maybe it already is, and we just haven't realized it yet.
Be safe!
Monday, April 16, 2007
Keeping Children Secure on the Net
http://www.mercurynews.com/business/ci_5677788
An inspiring read - however, the parents simply talk about online security. Here are the concerns:
1. Kids will be exposed to images/video/text that are totally inappropriate or even dangerous
2. Kids will download spyware and assorted malware/adware because they surf in ignorance
3. Kids are in danger from predators
4. Kids will communicate with anyone that seems friendly or offers comfort or shows interest or praises them (most kids nowadays are starved of love and attention because both parents typically work) - and provide easily identifiable information
How do you watch them?
Some tips:
1. Do not give them their own personal computer till they are at least 17
2. Do not let them take the computer to their room
3. Force them to interact with websites in 'public' - meaning the living room
4. Inform them that you have Internet monitoring software and that you know what they are doing anytime they're online
5. Monitor the sites they visit, noting down what they post and who they interact with on social networking sites
6. Have regular chats with them making them understand the dangers of being online without sufficient knowledge to protect oneself
7. Educate them on what the dangers are and how to spot them
8. Disable installation of all programs, and disable the USB ports
9. Give them a user id that has severely restricted access
10. Do not give them the password that'd enable them to go online
11. Do not let them go over an hour online per day - it's too much of a waste of time
12. And finally, watch out for any warning signs that may indicate unhealthy exposure of any sort
Be safe!
An inspiring read - however, the parents simply talk about online security. Here are the concerns:
1. Kids will be exposed to images/video/text that are totally inappropriate or even dangerous
2. Kids will download spyware and assorted malware/adware because they surf in ignorance
3. Kids are in danger from predators
4. Kids will communicate with anyone that seems friendly or offers comfort or shows interest or praises them (most kids nowadays are starved of love and attention because both parents typically work) - and provide easily identifiable information
How do you watch them?
Some tips:
1. Do not give them their own personal computer till they are at least 17
2. Do not let them take the computer to their room
3. Force them to interact with websites in 'public' - meaning the living room
4. Inform them that you have Internet monitoring software and that you know what they are doing anytime they're online
5. Monitor the sites they visit, noting down what they post and who they interact with on social networking sites
6. Have regular chats with them making them understand the dangers of being online without sufficient knowledge to protect oneself
7. Educate them on what the dangers are and how to spot them
8. Disable installation of all programs, and disable the USB ports
9. Give them a user id that has severely restricted access
10. Do not give them the password that'd enable them to go online
11. Do not let them go over an hour online per day - it's too much of a waste of time
12. And finally, watch out for any warning signs that may indicate unhealthy exposure of any sort
Be safe!
Even More Privacy Issues
http://www.buffalonews.com/185/story/54888.html?imw=Y
When you donate your old, pathetic, and mostly useless computer, keep one thing in mind: the disk. Forget everything else - just go after the data. Whitewash as much as possible. Many good software can accomplish the task painlessly, and they're worth the investment.
You simply do NOT want someone to have access to private data (SS numbers, medical records, employment details, financial data) etc. If they're a nice person as the one in the story above, you won't lose anything. However, if an ID thief buys up your computer from the local donation center, who knows what he can turn up? And imagine what he could do with it - a virtual goldmine of data begging to be (mis)used.
The main problem is (as it is everywhere else) lack of data awareness, and fear (even disdain) of technology itself. Luddites that may pride themselves on their 'simple' life have NO idea how vulnerable they are, every time they encounter technology that gets and/or dispenses private data.
You are SAFE if and only if:
1. You do not have an SS number
2. You do not exist
3. You are a wandering saint
4. You have NOTHING to lose - not even your identity
So, before you chuck that computer of yours for a tax write-off, download a good disk-cleaning software, and scrub as much as possible. Remember - deleting files or moving them to the Recycle Bin or emptying the RB has no effect. The data is simply marked to be overwritten but the data itself is still there - invisible, but there, and can be very easily read by someone sophisticated enough to know how to run the right tool.
Whitewashing a disk usually consists of writing garbage over and over again to the disk (or writing 0s) until there is nothing left to read.
Next time you donate a computer, whitewash the heck out of it. And when you buy a used computer, clean it the same way and then install a fresh OS on it. You don't want to see/read/hear someone else's secrets just as you don't want yours to be exposed.
Be safe!
When you donate your old, pathetic, and mostly useless computer, keep one thing in mind: the disk. Forget everything else - just go after the data. Whitewash as much as possible. Many good software can accomplish the task painlessly, and they're worth the investment.
You simply do NOT want someone to have access to private data (SS numbers, medical records, employment details, financial data) etc. If they're a nice person as the one in the story above, you won't lose anything. However, if an ID thief buys up your computer from the local donation center, who knows what he can turn up? And imagine what he could do with it - a virtual goldmine of data begging to be (mis)used.
The main problem is (as it is everywhere else) lack of data awareness, and fear (even disdain) of technology itself. Luddites that may pride themselves on their 'simple' life have NO idea how vulnerable they are, every time they encounter technology that gets and/or dispenses private data.
You are SAFE if and only if:
1. You do not have an SS number
2. You do not exist
3. You are a wandering saint
4. You have NOTHING to lose - not even your identity
So, before you chuck that computer of yours for a tax write-off, download a good disk-cleaning software, and scrub as much as possible. Remember - deleting files or moving them to the Recycle Bin or emptying the RB has no effect. The data is simply marked to be overwritten but the data itself is still there - invisible, but there, and can be very easily read by someone sophisticated enough to know how to run the right tool.
Whitewashing a disk usually consists of writing garbage over and over again to the disk (or writing 0s) until there is nothing left to read.
Next time you donate a computer, whitewash the heck out of it. And when you buy a used computer, clean it the same way and then install a fresh OS on it. You don't want to see/read/hear someone else's secrets just as you don't want yours to be exposed.
Be safe!
Thursday, April 5, 2007
More Windows Issues
http://searchsecurity.techtarget.com/originalContent/0,289142,sid14_gci1250157,00.html
It must be quite maddening for Windows users to realize that 'secure computing' is nowhere near secure nor is it all about computing!
The animated cursor problem/exploit is more bad news for both IE and FF users - apparently both use the same vulnerable modules.
Where does that leave the average user? Nowhere, really. It's somewhat incomprehensible that a simple thing like an animated cursor could introduce a hugely devious problem where a hacker could completely take over a user's computer when they simply visit a website.
To make things worse some IT folks are reporting problems with installing the patch itself - the classic 'umbrella with a leak' problem. Well, better to have a leaking umbrella than get soaked, huh?
More terrible news for regular Joes: it looks like RadioShack dumped sensitive customer data in an alley in Portland, Texas. The Texas AG is suing them (they could get up to $50K/violation).
Also, a breach at UCSF has possibly exposed thousands.
When/where will it all end? Probably never. As long as people continue to have SS numbers liked to every aspect of their lives, as long as they continue to have credit cards, and as long as they have something to protect, the breach will go on...
Be safe!
It must be quite maddening for Windows users to realize that 'secure computing' is nowhere near secure nor is it all about computing!
The animated cursor problem/exploit is more bad news for both IE and FF users - apparently both use the same vulnerable modules.
Where does that leave the average user? Nowhere, really. It's somewhat incomprehensible that a simple thing like an animated cursor could introduce a hugely devious problem where a hacker could completely take over a user's computer when they simply visit a website.
To make things worse some IT folks are reporting problems with installing the patch itself - the classic 'umbrella with a leak' problem. Well, better to have a leaking umbrella than get soaked, huh?
More terrible news for regular Joes: it looks like RadioShack dumped sensitive customer data in an alley in Portland, Texas. The Texas AG is suing them (they could get up to $50K/violation).
Also, a breach at UCSF has possibly exposed thousands.
When/where will it all end? Probably never. As long as people continue to have SS numbers liked to every aspect of their lives, as long as they continue to have credit cards, and as long as they have something to protect, the breach will go on...
Be safe!
Subscribe to:
Posts (Atom)
