Recently in Compliance Category

Developing an Information Security and Privacy Schedule for Service Provider Transactions (Part Two) : Info Law Group

By Bill Leroy on February 21, 2010 3:06 PM | No Comments | No TrackBacks

Informatics 2005/2006 Creative Commons photo-p...

Image by musha68000 via Flickr

Developing an Information Security Privacy Schedule for Service Provider Transactions by David Navetta.

This article points out the need for customers to develop Information Security and Privacy Schedules as part of their Service Provider agreements. As more and more of our Information Technology and Information Security moves to out sourced technologies, customers need to be aware that not only are they still responsible for the privacy and security of their data, but may be undertaking the risks involved with utilizing the service providers information security environment.

"The Customer should think of the Service Provider's security as an extension of their own internal security." IT Services and Information Security Management must undertake the security of how the trust relationships with their Service Providers are handled and how those relationships may impact the business, should the Service Provider be compromised or suffer a breach.

In David Navetta's closing statement, he mentions the impact of incidents, not from the initial impact of the exploitation of an exposure but the after effects concerning liability and reputation damage. "First, it is not unusual for a security incident to yield "consequential damages" in addition to "direct damages," including loss of profits, lost customers, attorney fees, breach notice costs and other similar costs. If the overall contract contains a consequential damages disclaimer, the Customer should endeavor to get an exception for consequential damages arising out of a security incident and/or breach of the Schedule."

The credibility and reliability of your information security program is now an integral part of stability and reputation of the business along with how well you are maintaining the trust relationships with your business partners and service providers which are now part of your extended business and control environment. The days of IT involving a few core services are gone and now have been replaced by data moving in and out of the environment for outside processing and storage, site to site vpns, international privacy and security laws of internal, external data and the rise of "Cyber insurance". David's article covers a wide variety of suggestions of what can be included in the Security /Privacy Schedule in contractual agreements with Service Providers.

ERM and Its Instantiation as an Automated Framework to Manage IT Risks - John Raezer

By Bill Leroy on February 18, 2010 5:18 PM | No Comments | No TrackBacks

Image by Cold Cut via Flickr

Yesterday at the Security Awareness for 2010 ISACA meeting in Philadelphia John Raezer delivered a welcomed presentation on Risk Management Effectiveness.

How Information Technology and Information Security Management must understand the Business Model. What are the key assets, what are their exposures and vulnerabilities,
and from the peril of a threat what would be the outcome. It is not only the identification or the recognition of a incident but what was the root cause and contributing factors, how does this information get included or relayed back to Business Intelligence information. What are the distribution of events not only in near real-time
but historically their severity, impacts, risk response, what policy and procedures were used in containment, mitigation, follow up step and what was the contributing factors,
who owns the Risk Relationships.

In his example on why Frameworks such as BASEL, COSO, COBIT, are so important was the highest thing that affected corporate reputation to it's business partners, customers, and suppliers was accounting irregularities. By far accounting irregularities had the highest corporate reputation risk of affecting your business with suppliers, business partners, and customers, he sited some recent banking incidents as an example of customer and partner distrust.

The need to study and understand what disruptive technologies will have an impact on business processes how many industries are using chaos theory for risk assessment, black swan events the unexpected, unexpected and how we must understand the Language of Risk, not only in the physical world but in the virtual world and that eventually he believed there will be Risk Management Accounting.

If you get a chance to read his presentation or see him speak on the values of risk management in the enterprise it is well worth the time.

Blackhat DC - "Malware Analysis for the Enterprise"

By Bill Leroy on February 5, 2010 9:53 AM | No Comments | No TrackBacks

Jason Ross's presentation at the Blackhat DC conference related the issues about checkbox compliance, that companies are using checkbox compliance as a means to indicate whether they are secure. When in fact it should be deemed as the lowest possible level of acceptance a baseline of acceptance and he points out as others have that some of the largest privacy compromises of personal information were done at companies that had past their external PCI audits. Compliance is absolutely wonderful it enforces at least a baseline of requirements but it should not be used as a means that you have a seal that protects you from exploits and non-publicized
holes in the grid.

Jason points out the difficulties of detecting Malware in enterprise environments, that by the time the antivirus sends off an alert about a malware or virus being seen it's usually too late you have already been owned, as Dan Geer pointed out a few years ago at the Gartner Risk Conference it's hard to get exact metrics on what is happening because by the time that alert kicks off 6 other events have already happened that were not detected.

For IT and Security administrators that have been through some of these malware wars with Downloaders and Polymorphic attacks know that just because the antivirus says it's cleaning up there are way too many other things happening. I once saw some thing interesting it was a Polymorphic virus that was loaded on a system that had Microsoft's development studio on it, that we could watch as the polymorphic virus recompiled other malware from it's code that would attempt many ways to infect the machine and other machines quickly and one time there was a downloader. Even Microsoft writes about recovering the operating system and files from a known state from before this activity started unfortunately with out historical view of activity on this node and user that information and the correlation of events will be difficult.

Jason Ross points out the goals of malware now is to have Business support models. Their objective is not to be noisy but to be very quietly performing their tasks of infecting other hosts and using a network of hosts to make money and the use of malware like URL Zone and Monkif

In the presentation he talks about Spider Monkey - By Didier Stevens a tool for helping to analyze malcode. The use of SAN NETS to isolate malcode in action so that it can be analyzed to determine what it wants to connect with or what services or files it wants to abuse with Polymorphic viruses that constantly change it's usually interesting to observe them in action in a closed environment.

Years ago I can't remember the movie name, but the analyst in the movie were collecting them and keeping the code and binaries for sale and redistribution or modifying them in some way not to be detected.

Another point from the presentation is that Malcode writers are now writing them so they can not be easily detected by signatures by using multicode that each binary performs a small function of the code.

via this Black Hat briefing

Internet Explorer could turn your Windows XP machine into a web server, Microsoft warns (guardian.co.uk)

Massive blackhat SEO of 200K sites (ecombizcenter.blogspot.com)

nFX SIM One at HP Software Universe 2009 - Managing risk based decisions

By Bill Leroy on December 18, 2009 12:51 AM | No Comments | No TrackBacks

HP Software Universe 2009

Image via Wikipedia

Last day here at HP Universe in Hamburg, talking about integrating Information Security Management more closely into the enterprise architecture and the system development life cycle. Enterprise Frameworks including the new NIST guideline for Special Publication 800-37 Rev. 1 and six step Risk Management Framework, highlights ITIL V3 and COBIT 4.1 frameworks call for information security to be closely aligned with the enterprise for effective Risk Management.

We have been talking about the new Standards and Guidelines concerning the harmonization of IT and Information Security Governance. With netForensics Sim One, information security management enterprise software, HP uCMDB, and HP Operations Manager Software integration, we can provide the proof that IT Operations Management and Information Security Management are working on the same vision of Domain Services for continual monitoring of enterprise services providing IT Operations and Information Security the ability to monitor the effectiveness of the control environment, promoting near real-time risk management.

If your looking for solutions to help you manage risk-based decisions with regard to the organizational information systems supporting their core missions and business functions, we already have it.

HP Software Universe 2009 Hamburg Germany

By Bill Leroy on December 13, 2009 10:58 PM | No Comments | No TrackBacks

Image via Wikipedia

netForensics will be at HP Universe in Hamburg Germany this week.

On December 16th through the 18th at HP Universe 2009 we will be featuring how our Information Security Management tools integrate with HP uCMDB and HP Operation Center Management. IT Enterprise frame works including the OCG's ITIL v3 and the ISACA's COBIT 4.1 call for Information Security Management, Change management. Service Asset and Configuration Management processes to be implemented across the ITIL Service Lifecycle from the Service Strategy, Service Design, Service Transition and Service Operation.

nFX SimOne provides the ability for Information Security Management and Operations Management to be closely aligned throughout the Service Life Cycle, by integrating with HP uCMDB, HP Operations Manager (OVO) and Information Security Management ( SIEM tools ), organizations will have common view of the relationships of host and host resources and applications and automatic change history. This provides organizations a common view of the Service Design and it's control environment allowing Information Security management to create effective correlation event scenarios based on the enterprise framework and business processes, providing effective event management and incident management.

HP UNIVERSE HAMBURG GERMANY 2009

Microsoft Baseline Security Analyzer 2.1.1 Released

By Bill Leroy on October 25, 2009 9:43 PM | No Comments | No TrackBacks

Image via Wikipedia

MBSA 2.1.1 is a minor upgrade to add support for Windows 7 and Windows Server 2008 R2. MBSA can be used locally or can be used to look at Windows Systems remotely.

Some of the advanced options are use with Windows Update Services (WSUS) servers ony or use Microsoft Update Sevice only.

Checks system not only for Operating System Updates but for Microsoft Office Updates
Ref:
MSBA 2.1.1 download

Punishment of the Innocent

By Andrew on September 25, 2009 2:28 PM | No Comments | No TrackBacks

It is amazing and rather disturbing that a US federal judge has recently ordered Google to lock a gmail user out his own account despite the fact that he has done nothing wrong.

It seems that a bank accidentally sent this user a file containing sensitive information. They asked the user to destroy it without reading it, but didn't receive an answer. At that point the bank sought legal action.

Again, I am left with questions and thoughts:

- How did this happen? Did someone intend to send this sensitive file via email to a different address and simply mistyped? If so, was the sender not aware of the inherent risks in sending unencrypted email?

- Does the bank have a policy regarding sending unencrypted sensitive information over the Internet using an insecure protocol like SMTP? If so, do they have any tools to enforce it?

- How did the bank discover this mistake? Did the sender realize his or her mistake and informed the compliance / security group, or was some automated detection system in place?

- What legal responsibility does the innocent email recipient have? Sure the data is sensitive, but it was freely given to him. Can't he do what he pleases with it (short of committing crime, such as theft)?

- As much as I would like to see the prevention of information leakage, I am still disturbed by the legal precedent set here. What if they send it to a corporate email system next time? Does the government have similar authority to disrupt the business of a private organization by forcing a shut down of their Internet connection?

The onus of correcting this problem should fall 100% on the bank. They should have to compensate the affected customers. They should have to compensate the email recipient for any harm they cause him. And most importantly, they should learn their lesson and prevent this type of leak from happening again.

Unintended Consequences

By Andrew on September 18, 2009 12:41 PM | No Comments | No TrackBacks

Here's an interesting story making the rounds today about an Ohio man who used a commercial spyware program on an (ex?) girlfriend. He expected it to track her activities on her home computer, but instead ended up getting an ongoing screenshot feed from a computer in a hospital pediatric cardiac surgery department, where she works. He sent the file to her Yahoo! Mail account. She opened it and unknowingly installed the software on a work computer.

Needless to say, instead of getting juicy details on her online activities a la Joey Greco, he ended up with a feed of sensitive data, including PII and ePHI. While this was indeed an unintended result, he is still on the hook for big fines and possible jail time.

There is a lot of blame to spread around here for sure. There are also many questions (some rhetorical) that popped into my head as I read this:

- How did he convince her to run the installer and infect the PC? Obviously, he had an advantage over a random malware spreader since she knew the sender. Still, it must have required at least a small amount of social engineering skill. She didn't even know she had infected the system (or didn't think it wise to tell anyone).

- Does the hospital have a webmail policy? Do they have the tools to enforce it? Blocking access to Yahoo! Mail at the gateway would have nipped this problem in the bud, at least for the hospital.

- Did the PC in question have adequate anti-malware protection? By the looks of things, whatever they were using was insufficient.

- What else could the hospital have done to prevent the leak of ePHI in accordance with HIPAA regulations? Of course SIM comes to my mind, but SIM would need to rely on feeds from web gateways, AV servers, DLP systems, firewalls, etc.

- The hospital is actually lucky here in that the person who stole the sensitive information had no nefarious plans for it. They were shown the weakness of their defenses without having to pay for an audit and without the need to pay ransom or experience worse consequences. They should view this incident as a gift and use it to improve their security stance.

- The stalker / boyfriend was clearly in the wrong no matter how you slice things. I imagine it's just as illegal to spy on a private citizen this way as it is to do it to a hospital. To borrow from an old saying: Spyware doesn't steal information - people do.

The Whitehouse Cyberspace Policy Review

By Bill Leroy on June 1, 2009 9:17 AM | No Comments | No TrackBacks

Below are select areas I highlighted from the 76 page Whitehouse Cyberspace Policy Review document. Throughout the document, the review shows that it is clearly in favor of a national awareness programs and special consideration for the development of information security specialists and information technology specialists. In 2007 at the Gartner Risk Conference when CISO's and CIO's were asked where they would like to spend additional funding, the primary answer was on information security education and awareness programs.

There was a mutual feeling among many specialists in the Information Security field that the suggestions on creating a cyberspace official did not quite go far enough to resolving complex problems in the public, private, and government space, there were a lot of people that had hoped this office would report directly to the President and were disappointed in the recommendations regarding this.

The Whitehouse Cyberspace Policy review documents can be found here:
White House Cyber Space Policy Review

Cyber Review Documents

The December 2008 report by the Commission on Cybersecurity for the 44th Presidency states the challenge plainly: "America's failure to protect cyberspace is one of the most urgent national security problems facing the new administration. The Present had ordered a "clean slate" review to asses U.S. polices and structures for cybersecurity. What is cyberspace according to the Presidential Directive 23 (NSPD-54/HSPD-23) defines cyberspace as the interdependent network of information technology includes, the internet, telecommunication networks, computer systems, embedded processors and controllers in critical issues."

The report estimates that in 2008 systemic loss of U.S. Economic value due to intellectual property data theft was nearly 1 trillion dollars.

"The President should consider appointing a cybersecurity policy official.
The cybersecurity policy official should not have operational responsibility or authority, nor the authority to make policy unilaterally."

"Many advisory bodies touch on cybersecurity-related issues, including the National Security and Telecommunications Advisory Committee (NSTAC), the
National Infrastructure Advisory Council (NIAC), the Critical Infrastructure Partnership Advisory Council (CIPAC), and the Information Security and Privacy Advisory Board (ISPAB). The cybersecurity policy official should review the responsibilities of these bodies and propose changes as necessary to optimize advice and eliminate unnecessary duplication."

"The cybersecurity policy official--in consultation with NSC, OMB, NEC, and OSTP--would define the milestones and success criteria and raise the visibility of cybersecurity within all agency budgets."

"The Nation should implement, for high-value activities (e.g., the Smart Grid), an opt-in array of interoperable identity management systems to build trust for online transactions and to enhance privacy. The public and private sectors' interests are intertwined with a shared responsibility for ensuring a secure, reliable infrastructure upon which businesses and government services depend."

"The Federal government, the private sector, and other stakeholders together should define technology-neutral performance and security objectives for future infrastructure, both to meet its own requirements as a consumer as well as in its capacity as a steward of the public interest."

"The Defense Advanced Research Project Agency (DARPA) describes defense of current Internet Protocol-based networks as a losing proposition and calls for an independent examination of alternate architectures."

Reference - DARPA Assurable Global Networking

Reference - Intrinsically Assurable mobile ad-hoc network (IAMANET)

"The Federal government--in collaboration with industry and the civil liberties and privacy communities--should build a cybersecurity-based identity management vision and strategy for the Nation that considers an array of approaches, including privacy-enhancing technologies. The Federal government must interact with citizens through myriad information, services, and benefit programs and thus has an interest in the protection of the public's private information as well. Increased use of on-line transactions involving financial, health, and commerce require a basis for building trust between the parties to a transaction."

Near Term Action Plan:

1. "Appoint a cybersecurity policy official responsible for coordinating the Nation's cybersecurity policies and activities; establish a strong NSC directorate, under the direction of the cybersecurity policy official dual-hatted to the NSC and the NEC, to coordinate interagency development of cybersecurity-related strategy and policy."

2. "Prepare for the President's approval an updated national strategy to secure the information and communications infrastructure. This strategy should include continued evaluation of CNCI activities and, where appropriate, build on its successes."

3. "Designate cybersecurity as one of the President's key management priorities and establish performance metrics."

4. "Designate a privacy and civil liberties official to the NSC cybersecurity directorate."

5. "Convene appropriate interagency mechanisms to conduct interagency-cleared legal analyses of priority cybersecurity-related issues identified during the policy-development process and formulate coherent unified policy guidance that clarifies roles, responsibilities, and the application of agency authorities for cybersecurity-related activities across the Federal government."

6. "Initiate a national public awareness and education campaign to promote cybersecurity."

7. "Develop U.S. Government positions for an international cybersecurity policy framework and strengthen our international partnerships to create initiatives that address the full range of activities, policies, and opportunities associated with cybersecurity."

8. "Prepare a cybersecurity incident response plan; initiate a dialog to enhance public-private partnerships with an eye toward streamlining, aligning, and providing resources to optimize their contribution and engagement."

9. "In collaboration with other EOP entities, develop a framework for research and development strategies that focus on game-changing technologies that have the potential to enhance the security, reliability, resilience, and trustworthiness of digital infrastructure; provide the research community access to event data to facilitate developing tools, testing theories, and identifying workable solutions."

10. "Build a cybersecurity-based identity management vision and strategy that addresses privacy and civil liberties interests, leveraging privacy-enhancing technologies for the Nation."

ICANN Plan for Enhanced Internet Security, Stability and Resiliency

By Bill Leroy on May 26, 2009 9:24 AM | No Comments | No TrackBacks

May 21st 2009: ICANN published it's 2009‐2012 Strategic Plan.

"Security,stability and resiliency will remain a top priority and ICANN will work
effectively with other Internet stakeholders to enhance and protect the security and stability of the Internet, paying particular attention to ICANN's mission to protect the security, stability and resiliency of the Internet's systems of unique identifiers."

ICANN is moving forward with its commitment to enhance DNS Security through DNSSEC, working with Verisign and the NTIA implementing root level resource public key infrastructure practices in the Top Level Domain (TLD) community. ICANN has been working with the Internet Registry's using DNSSEC to sign the reverse parts of the Internet Tree in an effort to authenticate ip addressing and boarder gateway routes through rPKI.

ICANN is investigating implications for the root server system as a whole, with regard to a series of potential changes within the DNS including the implementation of new gTLDs and IDNs, along with possible implementation of DNSSEC signing of the root zone over the following 18 months. Their report on this study is expected September 2009.

ICANN staff plans to work with the Software Engineering Institute (SEI) at Carnegie Mellon University to leverage the SEI Resiliency Engineering Framework (REF) to ensure its security, continuity and risk management programs incorporate best practices, and to measure improvements to maturity over time.

For the complete Plan Draft view:

Security, Stability and Resiliency Program

The international community is calling for more international control of ICANN. I don't know what will be the international response to ICANN's design plans for 2009-2012. There are a lot of outreach programs listed in this document to international country code top level domain operators and registry's, but I don't know if this design will be enough to satisfy the international community's request for more control.

« Audit | | Archives | Database Activity Monitoring »