Our Blog has moved!

To our loyal blog followers I would like to both apologize and thank you.  I apologize that I did not put this notification up earlier but our Website and associated Blog have moved to a new location.

You will be directed to our new Website by clicking here.

Our new Blog can be found by clicking here. We will continue to have the same great articles, tips and advice here. If you'd like to update your links, please bookmark this page.

Thank you for following both our corporate Website and our Blog: we appreciate your time.

Brad C. Johnson
Vice President, SystemExperts Corporation

The first simple steps for Mobile Device Security By Paul HillPosted by Brad C. Johnson

Most companies have policies that restrict what applications employees can install on desktops and laptops. Also, most companies have implemented technology controls to help enforce such policies.

Fewer companies have implemented similar controls on company owned mobile devices. Within companies that have adopted a Bring Your Own Device (BYOD) strategy for mobile devices, only a small percentage have created documented lists of approved or prohibited applications that may be installed.  And, still fewer use MDM tools to enforce such decisions on employee owned devices.

A number of companies document some general guidelines regarding prohibited applications in their policies. Such guidelines are usually addressing specific risks including data leakage or loss, reputation damage, and liability due to copyright infringement although they are rarely explained to employees in this manner.

Many guidelines prohibit peer-to-peer file sharing apps including BitTorrent, uTorrent, and Limewire. Typically, guidelines will also dissuade employees from using consumer grade cloud storage services such as iCloud, Dropbox, SkyDrive, and Google Drive.

Unfortunately, few companies discuss additional applications that leverage cloud storage, or adequately educate employees about the risks of using cloud storage aimed at the consumer market.  This creates a situation where employees, seeking to optimize their productivity, will adopt an attitude of begging forgiveness later instead of seeking permission before proceeding.

Applications that provide synchronization services across devices typically use some form of cloud storage. The trend is that more and more applications are doing this.  In some cases it may be obvious, in other cases users may not be aware how and where data is being stored.

Here are examples of some applications that either use cloud storage, or leverage cloud storage to provide additional integration capabilities with other applications:  SketchBook Pro, WeatherPro, PDFpen, Keynote, iBooks, Camera+, Contacts, Onenote, JotForm, Evernote, Zapier, UberConference, KustomNote, Azendoo, LiveMinutes, FileThisFetch, QuickOfficePro, GimmeBar, IFTTT, InSync, AutoCad WS, Nivio, Balsamiq Mockups, SmartSheet, SugarSync, Hoccer, Dictadroid, and CloudOn.

Companies should also be aware that dictation services, transcription services, and systems that perform voice recognition typically store data on the vendor's servers.  The software developers creating these services value a large data set from a variety of speakers in order to tune, enhance, and improve their ability to perform speech recognition.  It has been widely reported that Apple retains voice queries submitted to Siri for up to two years, although Apple says that after six months it disassociates the voice clips from the data that can be used to associate the clips with the original device from which the query was submitted.

Examples of voice transcription, recording,  and voice recognition applications: Siri, Dragon for Salesforce, Dragon Dictation, PowerScribe 360, SpeakWrite Recorder, Evernote, Voice Assistant, ShoutOUT, UberConference, and Winscribe.

Many of the example applications in each category also provide facilities for easily forwarding information to social media systems including Facebook, Twitter, and LinkedIn.

Companies do need to know what applications their employees desire to use, how the applications will store or synchronize data, and evaluate the risk.

The first simple steps for Mobile Device Security By Paul Hill

Many of our customers have mature security programs that address mobile devices with a wide range of controls.  However, many small businesses don't have fully developed security policies and are trying to determine what first steps are the most practical that they can take to secure their mobile devices.
The two most basic and most repeated steps to secure data on mobile devices are still the most important first steps to take:

1. Require the use of a PIN or passphrase to access any application or data on each mobile device
2. Configure mobile devices so that they can be remotely wiped

Employees really should be taught to assume that sooner or later the device they are using will be lost or stolen.  A PIN won't defeat someone with the device in hand from gaining access to the data on the device, if they are determined to do so.  However, a PIN should delay someone from accessing the data on the device long enough for employees to perform a remote deletion of the data, if reporting of the loss or theft is done in a timely manner.

Over time, mobile devices tend to be used on a number of wireless networks and cellular networks that may be insecure.  It is important to protect communications from eavesdroppers.

3. Use a VPN to ensure all communications are encrypted, protecting the traffic from eavesdroppers or tampering

Requiring the use of a corporate VPN for all mobile device traffic will also enable a company to perform traffic analysis and enforce Data Loss/Leak Prevention (DLP) controls, and block access to forbidden sites, if the company has such controls in place.

Most enterprises will prohibit employees from using consumer grade cloud storage services such as iCloud, Skydrive, Dropbox, or Google Cloud Storage.  If the use of these or similar services is allowed:

4. Use a password that will withstand brute force attacks for any cloud storage services and do not reuse the password for any other services or accounts

Companies that do prohibit employees from using consumer grade cloud storage services should educate employees about the risks and what applications are prohibited.  There are many applications that utilize cloud storage without necessarily explaining to the users how features leveraging cloud storage is utilized.

5. Do install anti-malware defenses where appropriate
6. Do not allow jailbreaking of devices

The large number of mobile devices in use are attracting malware authors.  If the mobile device platform has an applicable anti-virus or anti-malware package available it should be installed.  Apple believes their walled-garden approach to software installation negates the need for anti-virus software and they do not permit any such packages to be sold via the App Store.  Of course, that approach only works as long as all software available to consumers will be examined, vetted, and approved by the vendor.

Companies desiring to address a wider range of risks will likely need to impose many more controls.  Mobile Device Management (MDM) platforms provide a variety of additional controls and finer granularity of the controls listed above.  The Blackberry platform still provides the greatest variety of controls, offering enterprise administrators over 450 policy settings.  Microsoft's ActiveSync mailbox policies defines 41 settings, although not all of the settings can be applied to all device platforms.  Other MDM products typically provide fewer settings than those available from a Blackberry Enterprise Server (BES) but more options than available via ActiveSync mailbox policies.

MDM tools are limited by the features available on the device platform, and at times by the capabilities enabled by the carrier.  Companies that desire to support multiple device platforms may need to operate multiple MDM systems.

BYOD & Training By Paul Hill

In my experience employee training has been one of the business drivers that introduces tablets into some organizations.  Employees have indicated an interest in using tablets to review training materials and many training managers have responded well to the feedback.  Typically an initial pilot program will use company owned and managed devices, temporarily loaned to employees for the purposes of training.  It is not unusual for the training managers to find that the response is overwhelmingly positive and user demand quickly outstrips the capacity provided by the initially purchased company owned devices.  That often leads to a discussion about BYOD.  One could say for many organizations, training is the application that gets the camel’s nose into the tent when it comes to BYOD.

For many industries, the material contained in training material may be extremely sensitive.  Consider the training material addressing security and IT risk management for a company in the financial services sector.  The material may reveal the current threats that are of the most interest at the present time.  It may reveal how the company responds, specific email addresses, roles, responsibilities, and phone numbers.  All of this might be useful information for an attacker launching a spear phising attack.  For other industry segments, training materials may reveal valuable intellectual property.

In such situations, the organization should determine what level of protections are necessary what will be the implementation strategy.

Some organization may decide to avoid BYOD device management, and instead concentrate on managing access to corporate content.  This may work by avoiding storage of the training material on the device.  However, with this approach employees might need WiFi access during the review of training materials.

The other strategy gaining the most attention in the circles of regulated industries is the use of granular device management, and containerization.  By using containerization, data can be stored on the device, but the employees will be prevented from transferring the content to other parties or services.  This scenario is highly desirable if there is need for the employees to be able to review the training material while offline.

In order to make an informed decision about BYOD decision makers need to understand the nature of the information and how it relates to corporate data classification and data handling policies. They also need to make decisions about usage patterns.  Then they can work through the issues of specific device management strategies and review the options available.

This article was originally posted on: http://trainingstation.walkme.com/paul-hill-of-systemexperts-on-byods-impact-on-workplace-training/#.UWLRl5OyDzy

Three classic areas to improve security By Richard Zuleg

I wanted to do a quick review of three classic areas you can improve your security and try to dislodge some of the bad practices many organizations are involved in.

Monitoring – Learn your environment.  Spend time writing rules specific to your environment.  Monitoring is a running joke in the security community it is often done so poorly.  I remember one instance where a colleague of mine laughed with delight recalling a time when a monitoring system detected his 0-day during a test run.  “It actually detected it,” he commented “so then I got around it.”  That is all the explanation that was needed, it is that easy.  Do not just look for “bad things.”  You need to know your network and your systems if you ever hope to discover attacks.

Testing – If you are not modeling real world threats then you don’t have a good read on your security.  I once had a company jokingly say to me “I am not going to pay you to tell me I need awareness training.”  Another one said “I don’t need testing on that network because it is air gapped.”  I have even had a financial institution tell me “We don’t have security problems.”  Well long story short the first did in fact need awareness training, browser patches and a few other things and the second was not in fact air gapped, and the third did have security problems.  They all learned the hard way.  Testing is the easy way, so let’s start raising the scope, rules, and time constraints.  Let’s raise the bar a little.  It is a lot less painful to have a pen tester deliver the news, then to be on the evening news.

Patch Management – I cannot remember the last time I was on a network where all of the software was provided by a single vendor.  Yet I often see networks where only systems supported by one vendor ever see patches in a timely manner.  The other systems are often ignored sometimes for years.  Patch management applies to all systems.

Well that is it for now, monitor, test, patch, and do it well.

Trusting the Cloud By Paul Hill

How can a company develop trust in the cloud and determine when the risk of using a service is acceptable?

Today, enterprises must trust, and only periodically verify, the integrity of their cloud service providers through annual assessments.  The tools to verify in real time rarely exist and the tools that do exist are primarily focused on providing limited access to log data.

When an enterprise is thinking about using a SaaS vendor or cloud service it has the responsibility to assess the vendor and determine the risks, liabilities, and responsibilities.  To perform an assessment an enterprise might perform an on-site visit and perform an in-depth interview to assess the service.  Or the enterprise may choose to let the vendor perform a self-assessment by responding to a questionnaire.

SystemExperts has assisted several of our clients to assess cloud vendors they are planning to use, or are using.  One favorable trend we are seeing is an increasing number of cloud vendors are using third parties to perform annual assessments.  We’ve seen at least one cloud vendor that has an ISO 27001 certificate of compliance.  Some others are performing annual ISO 27002 assessments.  Each of these are very useful as a starting point.  However, the most mature cloud service and SaaS providers offer complex services.

It is important for enterprises to perform an assessment that also focuses on how the enterprise will use the service.  For example, an enterprise should examine the types of data that will be propagated to the cloud service provider and then compare how each parties' Data Classification Policy categorizes or labels that data, and how it will be treated.  Are the two policies compatible?  Or is there a disparity that is a cause for concern?

An assessment should examine change management processes, incident management, log management, and log analysis.  In order to understand the risks it is necessary to understand how these processes are managed, what gets logged, who has access to the logs, and under what conditions will the enterprise be notified of upcoming changes and detected incidents.

Some SaaS vendors provide an enterprise with the ability to review logs related to their use of the service.  Enterprises should use this level of access and proactively review and analyze the logs.  Ideally, the SaaS log information should be integrated into the enterprise's SIEM.

Assessing a cloud vendor's Business Continuity and Disaster Recovery management is also critical.  Hearing a cloud vendor reply that they "do not perform complete testing of its BP/DR because of the potential impact on a number of its customers" would not inspire confidence.  Instead, a reply like that should trigger a more detailed discussion and evaluation.

An enterprise should not stop with an assessment of the cloud service vendor.  Many such vendors use additional third parties.  This might include co-location facilities and/or other cloud services. An enterprise should also know about those relationships and what types of assessments the primary cloud service provider has performed when selecting those providers.

Another aspect of cloud accountability is the ability to for the customer, or third party, to reliably monitor the state of the system and verify its integrity.  This tends to be an unresolved issue.  It's often possible to monitor and detect that a service is working.  However, in the case of a failure, the customer is not likely to have access to information that provides any insight about the cause, or how to expedite a recovery.  Still fewer services make any attempt for a customer or third party to verify the integrity of the system, beyond some status APIs and access to limited log information.

Due Diligence By Jason Rhykerd

When it comes to information security many organizations, no matter their size, lose sight of the basics.  Performing the proper due diligence around the “basics” can provide a solid foundation for advancement in computer resources and protection against the so-called advance persistent threat.  The question most likely weighing on many organization’s minds is, “What constitutes due diligence?”

The answer to this question is not as easy as many Security Practitioners would like you to believe.  Many organizations tout “Best Practices.”  But how can you be sure that one person’s Best Practices are the best practices for your organization?

The answer:  Due diligence is a relative term; properly inventorying assets and assessing risk will allow an organization to identify gaps and implement controls and/or mitigation processes and polices.

Understanding the business objectives, processes, and data provide organizations a foundation for how to build the proper controls, processes, and policies.

For example:  What type of data are we collecting?  How is it being processed?  Do we need to keep it after it has been processed?  Do compliance regulations drive our need for policy and procedure – i.e. encrypting data at rest.

The “basics” – such as requiring strong passwords, monitoring, disabling and filtering unnecessary services, and least privileged account access are still being missed today.  How we implement these items is relative to our business.

Implementing these “basics” takes resources and discipline, so it is not an effort to be taken lightly.  Often these basics get swept under the rug and forgotten about – a server is built with extraneous services available and/or developer’s administrative credentials are left on that box when it goes into production.  It’s these “basic” things that add up and present risk to an organization.  Everyone knows what happens to a server once it’s built and in production – nobody ever has time to go back and “fix” the issue, or it is seen as too much of a hassle – we have to put in a change ticket, perform the work during an outage window – that’s if you even have a change control process.

The “basics” might seem like a much easier task for an organization with a small technology footprint, but it is just as important – it is in my experience that once technology is injected into a culture, it will not be going away anytime soon – business and user requests will drive the need for more technology.

Not to be lost in the “basics” is security awareness and training for the end-user.  It is not uncommon these days to walk into a small shop/office where the employees are surfing the Internet, checking Facebook and their personal email, on the same system that they will swipe your credit card on when you check out.  Providing basic user awareness in a fun and positive way can go a long way.

I would also recommend to any small company that it ingrain into its culture the idea of the basics and that security is a real part of the organization.  Cliché’ as it may sound everyone has a part to play in securing an organization no matter the size – the IT guy building a purpose built server is just as important as the CEO checking his/her email and not downloading that unknown file.

The Importance of Frameworks By Jonathan Gossels

The world of IT security and compliance is simply too big and too complex to keep all the requirements straight in your head.  It is too easy to overlook something important.  That’s where frameworks come in (note: I’m purposely conflating the terms framework and standards here).  Frameworks help you ensure that you have covered all the bases.

There are several popular security frameworks:  NIST, COBIT, and my favorite ISO 27002.  Some security practitioners get into heated arguments about which framework is best.  I look at these frameworks as more of a Rorschach test – people see in these frameworks what they want to see - some prefer an emphasis on governance, others on operations. TomAto vs TomAHto.

Using a framework (any framework) forces you to reason about each of the required controls (135 controls in the case of ISO 27002).  One of our clients once said, “Going through the compliance exercise helped us to understand what we were doing well, what we needed to improve, and what we weren’t doing at all, but should be doing.”

While appetites/tolerance for lightweight versus heavyweight processes vary by company and industry and that may steer you to one framework versus another, my overarching advice is to choose one and really master it – know it inside and out, know where it is black and white and where it is more nuanced.

Security Monitoring for Your Business By Alex Chaveriat

Security monitoring services provide certain solutions that many people, especially those dedicated to computer and networking systems, should consider. These solutions offer services for routine activities that help to securely maintain the networks for organizations. These activities are maintained by various experts with security resources given to those interested in protecting their computer systems.

Precautions
The different types of services provided with services like these can offer a multitude of solutions, one of them being able to take the right precautions before something bad happens. Usually, different types of methods are taken by IT experts to assess your network system and improve those systems with their own system. These services provide tests for various situations, such as:

• Security Check-Ups
• Assessment Tests
• Notifications

These assessments test to see how strong your setups are and compare the results with industry standards to evaluate your security systems, keeping them up to date.

Monitoring
In addition, routine monitoring schedules are enacted to keep you updated on the current status of your system. Advanced monitoring will help you extensively in checking your computer networks and taking care of the issues at hand. Examples include:

• System Integrity Checks
• Risk Reporting
• Domain Management

The benefits that come with a security service with monitoring and proactive protection is indispensable. It provides an extension of security experts and ultimately, the services will lessen the burden on your security staff and make it easier to manage the protection of network systems. By keeping a company’s network monitored and protected against security threats, this type of service allows a business to grow without fear of hackers and other security issues. This allows a business to prosper and prevents many problems that can hurt its reputation and profits.

The Power of Integration By Jonathan Gossels

In August, I gave two talks to two very different groups (the Association of Contingency Planners -

Liberty Valley Chapter hosted by The Vanguard Group and the closing keynote to the IT bank examiners from all of the Federal Financial Institutions Examination Council - FFIEC agencies [Federal Reserve, FDIC, Office of the Controller of the Currency, NCUA, and State Liaison Commission]) - yet, there was resonance from both groups on several points. This three part blog post is intended to share a few of the key points and some of the feedback from the live audience.

The key themes were:  The Power of Integration, The Problem of Extreme Complexity, and the Importance of Frameworks.  There was another important theme, “Excellence,” which I’ll deal with separately.

Deploying security controls and solutions is necessary, but not sufficient.  Compliance requirements and contracts with business partners or payment card processors mandate that security controls and security best practices are in place such as separation of duties, change control, encryption of sensitive data, least privilege access control, and separation of development, test, and production environments.

However, putting a check in the box that a required control is deployed does not mean that the control is effective.  A key attribute of any control is integration.  The more highly that a control is integrated the more effective it will be.  That integration can be with business processes or with technology.

In the photo above, the lock and unlock security functions are integrated with the key.  It is effortless to lock the car when you park.  Contrast that to the case of manual door locks.  With manual locks, each time you park, you have to make a decision (a risk analysis), “Is it worth climbing all around the car to lock the doors or am I in a safe enough place to leave them unlocked?”

Yes, the car had locking capability, but because it wasn’t integrated, much of the time the car was left unlocked.

Every time you plan a security control or deploy a security capability, think integration; think about the key fob.  If you make it effortless, you raise effectiveness.

Incomplete IT department skill sets impeding businesses' progress By Alex Chaveriat

Some businesses might have a security issue on their hands if the results from a recent survey are any indication.

According to research published by CompTIA, 80% of businesses acknowledge that their operations are adversely impacted because of a lack of certain skill sets in their information technology departments.

CompTIA, the non-profit IT industry association, says in its recent State of the IT Skills Gap study that a combination of factors such as the changing face of technology and insufficient training resources are behind the skills gap problem. These findings come at a time when IT teams are struggling to keep networks secure from hacker attacks that could potentially put confidential customer information or classified corporate data into the wrong hands.

In particular, the CompTIA study shows that companies acknowledge that their IT professionals are lacking in areas that include, but are not limited to, replacing equipment nearing the end-of-life stage; data storage, and enhancing network infrastructure, business continuity and disaster recovery.

According to the study, participating companies note that the lack of required IT skills hampers security 31%; customer service and relations 32%; staff productivity 41%; and profitability - 23% of small businesses and 15% of medium- to large-sized businesses.

Terry Erdle, executive vice president of skills certification at CompTIA, says the following in a press release focusing on the study results:

“Millions of businesses are clearly not where they want to be when it comes to optimizing their utilization of technology and in the skill levels of their IT staffs. Even modest improvements in these two areas would yield tremendous benefits in operational efficiencies, business productivity and economic growth.”

According to Erdle, an encouraging development is that 57% of businesses plan to deal with the lack of certain capabilities in their IT departments through training and refresher courses.

Yahoo! Breach: SQL Injection By Jason Rhykerd

As the Yahoo story breaks, I will continue to preach the “due-diligence” approach. These attacks occur because companies do not pay attention.  D33ds claims this is a “wake-up call” – I would say to everyone, not just Yahoo.

As the story breaks we are learning more details, but lets examine three areas of “fail” on Yahoo’s part from what is speculated at this point.

• Fail 1.  Encrypting Data at Rest - The credentials were reported to be found in clear text
• Fail 2.  Monitoring – It is reported that over 2,000 database tables and/or column names along with 298 MySQL variables were captured.  The amount of network traffic this attack would have generated should of set off the lightest of IDS rules
• Fail 3.  Least privilege – D33ds was reported to have gained administrative access to the database.  Clearly the concept of least privileged was not used for the application service account

As a bonus, what happened to Security as part of the Development Life-cycle – How did a SQL-based injection make it to production?

“What constitutes proper due diligence?”

The answer:  Due diligence is a relative term; properly inventorying assets and assessing risk enables an organization to recognize gaps and implement controls and/or mitigation processes and polices. 

Understanding the business objectives, processes, and data provide organizations with a foundation for how to build the proper controls, processes, and policies. 

The basics – such as requiring strong passwords, monitoring, disabling and filtering unnecessary services, and least privileged account access are still being missed today.  How we implement these items is specific to our business, but is crucial to staying safe.

www.systemexperts.com

PCI DSS Compliance By Alex Chaveriat

Understanding PCI DSS Compliance
The Payment Card Industry (PCI) Data Security Standard (DSS) is a worldwide information security standard defined by the Payment Card Industry Security Standards Council. The standard itself was created to assist payment card industry organizations that process card payments, and to prevent credit card fraud through increased monitoring of data and its overall exposure to compromise. The standard itself applies to every organization that holds, processes, or exchanges cardholder information from any card branded with the logo of one of the card brands. This standard is a reality and it can impact your business in a major way.

PCI DSS and You
PCI DSS Security Standards and Measures were set in place by the card issuing associations in order to protect cardholder information. They were also set in place to help prevent security issues such as credit card fraud, hacking, and many other serious issues that can arise.  The PCI standards primarily focus on the encryption, storage, and transfer of this sensitive data while in a merchant’s possession.  If your business experiences a breach of card holder data while not compliant with these standards, you may be fined by the associations up to $500,000 for the initial investigation as well as a fee per record that is compromised. The damage to your business’s reputation due to loss of consumer confidence cannot be assessed but it will be great. Let’s face it you don’t want to risk that kind of damage, and destruction to your reputable business.

 PCI Compliance: It’s not just for larger merchants
All merchants, regardless of size, must comply with the PCI DSS. Depending on the type of business and how many transactions are processed, level 1-3 merchants (annual Point Of Sale (POS) transactions over 1 million) may have some additional requirements, but level 4 merchants (annual POS transactions under 1 million) are actually the most targeted by hackers and thieves. Additionally, recent data shows that 80% of payment card compromises since 2005 affected Level 4 merchants.  The penalties and fines are excessive depending on the amount of information that is compromised and have put some merchants completely out of business. 

Looking forward to 2012 By Brad C. Johnson

To all of our readers of the SystemExperts Blog: thank you for taking time out of your busy schedules and lives to review and comment on the material that we prepare for you.

We hope that 2012 brings you all a healthy, rewarding and prosperous year. Despite the continued hardships of the economy and events around the world that impact our daily lives, we see a lot of people and organizations that continue to focus on the fundamentals that help us all do the best that we can: due diligence, professionalism, and respect.

Let's keep that going in 2012!

Back to the Future: Layered Security By Brad C. Johnson

In December of 2010 I posted a "Looking forward to 2011" entry that included the following simple advice: "One thing that we have learned in the last few years is that often times, it's the simple and straightforward actions that make the most sense." That is a theme that has been consistently used in this blog because it just turns out to be true. Albert Einstein once said: "Make things as simple as possible, but not simpler. "

Related to that is this advice: do not rely on just one method of securing a resource, no matter how dynamic, exhaustive, or impressive it is. We have been a consistent supporter of this equally tried and true "Belt and Suspenders" approach to everything security. Using simple layers of security is often more dependable than expensive or complex products or strategies. Just this last week, the following news was in the headlines:

"The NCAA mistakenly left its internal SharePoint site unprotected, allowing fans, media … to have complete access to its most sensitive economic information. The leak involves years of accounting information, slideshows and much more."

How is this possible? Probably because they assumed that since this data was on the "inside" (an assumption that used to be rampant throughout the industry that essentially makes no sense anymore) that the normal or default protections would be enough.

There are a number of "Belt and Suspender" tactics that probably would have prevented this exposure from happening. None of them sophisticated or complex; yet as a collection of protection layers they would have provided an environment that would have prevented the exposure, even if one or more of them had failed.

• Internet facing firewall: have rules that are just as strict about what goes out as you have for what comes in: don’t allow file share protocols outbound
• Monitoring: similar to the firewall, be just as concerned about traffic that is leaving the network as what is coming in: detect file share requests travelling outbound
• Intrusion detection: notice that external IP addresses are accessing internal resources
• Authentication: require users to provide credentials to use SharePoint services
• Authorization: define acceptable users or groups that can access the SharePoint services

None of the above actions are hard to implement or require unique security infrastructure or expertise. Each one of them is providing a certain type of security awareness or protection that is related to but different than the others. No single one provides ultimate protection of the internal resource but as a whole, they represent a layered approach to protecting the asset; even if one or more of them are, for whatever reason, not working.

So, here we are ending 2011 just where we started the year: focusing on fundamentals; preaching about straightforward and layered security philosophies.

Securing Dropbox (and other cloud syncing services) By Keith Royster

As the number of computers, laptops, and mobile devices we use grows, services that sync our important files between them grow in popularity. But are these services secure enough to store our confidential files? Recent news suggest not. One of the more popular file-syncing services, Dropbox.com, has experienced recent and significant security issues this year, including a brief lapse in their authentication system that made passwords optional for a 4-hour window. And not to pick on Dropbox - virtually all of these services carry some security trade-offs by design, including them having the keys to your encrypted files so that they can de-duplicate data to minimize storage requirements. Syncing confidential files in the cloud is not recommended without additional encryption.

All encrypted syncing solutions are not created equal

Searching the internet for "securing Dropbox" will result a myriad of blogs suggesting various ways to encrypt your cloud-synced files. What they all have in common is that they attempt to encrypt your files locally before they go into the cloud. But not all local encryption methods are best suited for cloud-synchronization. SystemExperts spent some time trying many of the suggestions found online, but experienced the following issues with most of them:

• Tools that create encrypted volumes within the Dropbox folder create a single large file that must be synchronized every time a single file within it changes, making it very slow. And often times the size of the these volumes cannot grow, so a single large file must be created from the start. These problems were common to tools such as TrueCrypt (cross-platform) and encrypted disk images such as .dmg and .sparseimage files (both built-in for OS X only).


• OS X has a disk image format called "sparsebundle" that it created precisely for syncing files to its Time Machine backup service. It solves the problem of syncing entire volumes by dividing it up into smaller "bands". But this is not a cross-platform solution. Additionally, testing indicated that Dropbox had trouble detecting changes to the "bands" in real-time, and had trouble synchronizing them if the volume was mounted by multiple systems.


• Encrypting individual files makes for faster syncing, but can be tedious if it must be done manually with tools such as zip-archiving tools.

EncFS to the rescue

SystemExperts found EncFS (or Encrypted File System)solutions best suited for the task. EncFS uses AES-256 encryption, is cross platform (Windows, Linux, and OS X - sorry, no mobile yet), and it encrypts individual files on the fly as they are placed into the mounted EncFS volume. As an added bonus, EncFS provides some protection for lost or stolen laptops. EncFS mounts the encrypted files on your file system and displays them decrypted at the mount point as a new drive or volume, so as soon as the system is powered off or the user logs out, the mount point is lost and the decrypted files are no longer available.

However, there are some caveats to EncFS:

• The only Windows solution we found is a commercial application called http://boxcryptor.com/ which starts at $20 for commercial use, although it does offer a free version with some limitations
• Although free, the OS X and Linux solutions are more technically challenging to install
• Although the file contents are encrypted, anyone with access to the file system can see how many files and folders exist, their permissions, their approximate sizes, and their last accessed and modified timestamps.

Example usage of EncFS

In our test setup, we synchronized files across multiple OS X systems. Following these installation steps for OS X , we created a folder within Dropbox for our encrypted EncS files, and an EncFS mount point outside of our Dropbox folder. (Tip: On OS X and Linux, name the folder within Dropbox using a preceding . (dot) to make it invisible. This way you aren't tempted to place unencrypted files within the encrypted EncFS folder by accident.) We named our new EncFS volume "eDropbox", which showed up on our Mac as a new attached drive. After repeating the setup process on two additional systems, we began placing files within this new eDropbox drive. Files were immediately and transparently encrypted to the EncFS folder within our Dropbox folder, and then synchronized to our other systems, making the unencrypted file immediately available on all of the respective mounted eDropbox volumes. But anyone accessing our Dropbox account in the cloud (including the operators of the service itself) will now only find AES-256 encrypted files there.

Please let us know how EncFS works for you, if you find other solutions that work better, or how your company is addressing secure file synchronization.

An Artist and his tools By Jason Rhykerd

I ask you, what does a security analyst have in common with Picasso, Shakespeare, and Mozart? You are probably asking yourself how one could begin to make such a connection. The connection, they are all artists with different mediums. Picasso had his paints; Shakespeare had the stage; Mozart his violin and piano; and the security tester his experience and knowledge.

While Science plays a critical role in the world of Information Security, it is strongly complemented by Art. Merriam-Webster defines Art multiple ways; I personally like the following two meanings:

1. A skill acquired by experience, study, or observation
2. The conscious use of skill and creative imagination especially in the production of aesthetic objects;

For this posting I ask you to think of findings from a penetration test or a web application test as aesthetic objects. While science helped us to discover the [potentially] vulnerable variable, or those open ports, it’s art that determines the real risk and validity of the finding, as well as uncovering their hidden meanings.

Take the following very simple example. We have a web application whose URL is www.mybadapplication.com. Using an automated web scanner (i.e. Science), we scan the web application. The scanner returns us a list of parameters that are used within the application. One of the variables is “admin” and is found as a get parameter (www.mybadapplication.com/?admin=false). To the automated scanner this is just another variable, to the security analyst (or artist) this variable is much more interesting. An artist is going to immediately change false to true and evaluate the response, whereas the automated scanner only lists the variable and flags no risk.

Let’s now assume that our scanner returned a finding of SQL injection. Almost every set of tools I have worked with rates SQL injection as a Critical or High finding. I don’t necessarily disagree with this rating, SQL injection can lead to serious compromise. But is the finding valid? Many of the tools out there go to great lengths to validate findings, but their automated actions are far from perfect. Once again our artist will work to determine whether this finding is a false positive, and if not, he will determine what risk it presents to the organization.

The interpretation of the finding, just like art, is derived from many influences. The security analyst has multiple factors to consider when determining a finding’s risk – how likely is it to be discovered, are there known exploits in the wild, what is the technical skill level to perform the exploit, or what is the impact to the organization?

If you ask two different critics to interpret the same piece of art, chances are you will get two different points of view. Similarly, the same finding at different organizations may have a different set of risk. Factors such as type of industry (Financial, Medical, Government, etc), impact to organization, and even public relations play a significant role in our interpretations.

It is a true artist who is conscious of this, can think out of-the-box, and can be creative to provide their client actionable and value-add results.

Can the science exist without the artist? Yes, but I have seen many automated reports shoved in front of developers only to be thrown away by the developer because it was filled with false positives and meaningless data. I believe the two ideas complement each other and neither one is not as powerful without the other.

Thinking about Onions By Jason Reed

Another security firm hacked. That’s the story coming out of Barracuda Networks where attackers successfully exploited a SQL injection bug in a PHP page and were able to dump the contents of the MySQL server supporting the content on the external site.

Exposed were customer names, logins, email addresses and phone numbers, Barracuda Network employee’s credentials, and credentials of the MySQL database itself.

The official word from Barracuda is that a web application firewall in front of the web app was accidentally placed in passive monitoring mode during a “maintenance period” and was not reactivated. The SQL injection allowed the attackers to gain access to at least 5 databases and their associated tables. Some of the table names shown in the release by the hackers: CHAT_ADMIN, MySQL’s USER, BUNIVERSITY_USERS, CMS_LOGINS, and DEAL_REG.

This would seem to be the year of security giants falling to attacks. With RSA’s well-publicized issues already, we stop and wonder that if these companies, who hopefully think about security often, can fall, what chance does the common .Com have?

Taking a look at the Barracuda attack helps us all learn lessons about the way we should do business on the Net. Let’s hit some of the highlights.

First, the WAF was disabled for maintenance, which left the web app behind it susceptible. What this means to me is that the application could of always had this issue, but the WAF masked it from the outside. Many will say to “let the firewall do its job”.

However, I think of onions.

We have all heard of defense-in-depth. The idea is that each service should protect itself in case of a failure in the next layer up. In Barracuda’s case, the PHP page was susceptible to SQL injection, which was blocked by the WAF up until Friday. The problem was, the PHP page should have protected itself by escaping the input, using parameterized queries, and applying a white-list to the input instead of relying on the WAF for all of these functions.

Security-based code reviews should be a part of everyone’s software development practices. Looking for dynamic SQL statements in code is easy. Looking for more complex vulnerabilities from user input takes a code review. As we often tell our customers, you could be one click away from being compromised if you don’t make security part of each layer.

The next issue was a violation of least privilege. This basic security tenant states that a principle (in this case a web application) should have the least amount of privilege needed to perform its functions. Some may say that a single application credential having access to all the databases simplifies development and deployment reducing the possibility of errors.

I, however, again think of onions.

From the hacker’s release, it is clear that the user ID used by the application had access to other databases, including the system table. Instead of using a powerful user ID for the application, the database should be configured to only allow access to the data that it requires for servicing its requests. This means, performing an analysis of the data contained in the system and what is needed for each application. Requiring multiple user IDs for access is a good way of segmenting access to the data. The attacker might have to break a couple of layers to get at anything important. At a minimum, this lengthens the time of the attack and hopefully it can be shutdown before an exploit is found.

Last, the failure of the WAF to block traffic exposed the issue with PHP. We always encourage our customers to test the periodic failure of their protections to see if the next layer down is secure. Test your systems without the benefits of your WAFs or Network Firewalls and see where your weaknesses truly lie. Take the time, at least annually, to discover if your onion has just one layer.

Bon Appétit.

Data Loss Prevention: Getting Started By Brad C. Johnson

The term DLP, or Data Loss Prevention, tends to conjure up somewhat polarizing reactions such as “That’s the most important thing in our IT environment!” or “What is that?” The reality is, both reactions are perfectly reasonable.

The minute you start talking about Data Loss Prevention, or Data Leak Prevention/Protection, or, Information Loss/Leakage Prevention/Protection, or Content Monitoring or whatever, and finally get past the acronym du jour and realize it is a conversation about monitoring confidential data, everybody is interested and concerned about the topic.

Some organizations use the DLP title and create specific initiatives or employee roles based around the topic. Other organizations consider it a by-product of the other security or IT infrastructure they already have in place. I’m going to put a stake in the ground and say, it needs to be both.

The reason you need to explicitly consider the DLP topic is that normal and even formal security frameworks don’t usually provide good coverage of all of the DLP issues. Why is that?

At the heart of DLP is that most IT environments don’t include an explicit requirement to actually monitor data payloads in many normal day to day tasks and operations. We monitor users, we monitor intrusion attempts, we monitor changes to our Web site, we monitor unexpected protocol attempts on our firewalls, but we often have no idea all of the places our confidential data resides or how it got there.

According to studies on data loss, most companies have lost data on laptops and USB drives, Personal Identifying Information (PII) is often found on expected drives or systems, and an unexpected number of simple unencrypted emails have sensitive information in them. [The Open Security Foundation has catalogued a Data Loss Data Base and is focused on giving news about the details of data loss incidents: http://datalossdb.org/statistics]

The reason this happens is that most data loss is not from malicious attacks (although they tend to be the cases more publicized and scrutinized), but instead can be attributed to employee actions such as:

• not following documented policies
• storing files with sensitive information on public or lightly secured storage devices
• using inherently insecure but popular technologies like social networking applications or instant messaging
• putting sensitive information on mobile devices like laptops or Smartphones

In other words, data loss often happens in the course of doing normal work and trying to do your job.

Now that I have planted the seed on why you need to care about DLP, stay tuned for more detailed and focused entries on this important topic.

RSA Cyber Attack By Brad C. Johnson

The recent news that EMC’s RSA infrastructure was the target of an (apparently successful) Advanced Persistent Threat (APT) cyber attack is serious news in the IT and security world. A lot more information will need to come from RSA about the details of the actual compromise and what that means for RSA customers and the systems we try and protect using RSA products. Here is a link to an RSA open letter about the situation: http://www.rsa.com/node.aspx?id=3872. EMC’s SEC filing of the situation is located here: http://www.emc.com/about/investor-relations/sec-filings.htm - Refer to “Report of unscheduled material events or corporate event” dated 03/17/11.

In the meantime, there are some things that we all can do as we wait for more details:

• Notify all staff using RSA tokens of the situation and ensure they are following corporate password quality standards
• Ensure that staff are following RSA specified best practices (e.g., PIN management, system hardening, token distribution)
• Monitor logs for increased authentication failures, social engineering attacks, or phishing attacks
• Tightly monitor RSA responses, recommendations, and announcements
• Refer to the RSA SEC filing under the section “SCOL Note Title: Required Actions for SecurID Installations” for detailed RSA recommendations

Despite the fact that this is indeed a serious situation and leads to the direct possibility that one may need to consider using different technology, until we get more information it’s probably more prudent to sit tight with the technology you are already have in place and ensure the above recommendations are being followed.

Having said that, you should set some well-defined checkpoints within your organization in the near future to either agree or disagree on how to move forward with the use of RSA technology and their response to the current situation.