Enterprise Security Blog

Facebook Privacy – Are You Feeling Lucky Today?

From the desk of Warren Axelrod:  Researchers at the Helsinki Institute for Information Technology (HIIT) determined that there are a number of ways in which users manage privacy on Facebook and other social networking sites.

 

Are you following these best practices?

·          Avoid updating your status with information that you don’t want everybody to see

·          Choose to exchange private messages rather than writing on public walls

·          Keep messages within closed groups

·          Approve only a limited number of people as friends

·          Define groups of friends more precisely

·          Avoid publishing information that others might find negative or troublesome

 

But what about Facebook and the others – what should they be doing to provide privacy management systems that are easy to use? What problems aren’t addressed?

 

One problem is that it can take an extraordinary amount of effort to manage all the various groups and members of groups that you have assigned and then remember all the participants and their relationships. Inevitably memory will fail and mistakes will be made.

 

Second, you can’t be sure that when you share, the person you intend to share with won’t share with someone that you would not choose to have your pictures or stories. You could avoid sharing information that, in the wrong hands, could have a negative impact. While you may choose to avoid publishing certain information it does not preclude revealing information that may, over time, become important to protect. This dynamic aspect of information privacy is extremely difficult, if not impossible, to anticipate.

 

The dynamic aspect of privacy is further emphasized in a New York Times article “Career Couch: The Online Divide Between Work and Play,” by Matt Villano. He discusses, in a Q & A format, a number of privacy issues pertaining to social networking sites, such as LinkedIn, Facebook, MySpace and Twitter. Mr. Villano reports on his discussion with Nick O’Neill of “All Facebook” blog fame. Mr. O’Neill has recently posted a guide to mastering Facebook’s new privacy settings. O’Neill reports that “Most Facebook users don’t even know these [privacy] features are options. I can’t tell you how many people sign up and don’t ever think about privacy again.”

 

Security professionals know that privacy protection is not static and is therefore more difficult to manage. I wrote about this in ISACA’s IS Control Journal in an article “The Dynamics of Privacy Risk”. Facebook and Twitter are new – privacy concerns are not. Consideration of how to avoid and protect against disclosure of private information is very similar to designing for and using secure Web 2.0 applications. When combining applications and data, one may not be fully aware of their “pedigrees” and in fact may be confronted with systems and data from highly questionable sources.

 

The tradeoff in managing privacy is between trust and avoidance. If you aren’t absolutely sure about origin, source and destination, then avoidance might be a better strategy, even if it results in many fewer capabilities. Trust is a two-edged sword. By establishing trusted relationships, one can share more information and benefit from that sharing. However, if a trusted relationship is subsequently compromised, then the losses can be that much greater.

 

Since it is so difficult to determine current trustworthiness and forecast future trustworthiness, it is perhaps better to stick to the avoidance strategy or, in security jargon, “default deny.” You should only relax privacy when you are very sure of the trustworthiness of the applications and individuals. You need to maintain constant vigilance in keeping such knowledge current. Once a system breach occurs, or information is inadvertently disclosed over a social network, it is too late to reel the data back in – there are no “re-do’s”.  While avoidance is a viable alternative, it can put critical processes in jeopardy. A prudent approach is gradual, controlled increase in access and use; evaluating at every step along the way. 

 

See you on Facebook – maybe!

Intellitactics Explains the Value of ONE

21 - the number of vendors offering security information and event management (SIEM) products including Intellitactics. These products offer a variety of features and functions and just as many architectural approaches to providing these product capabilities. So what is so important about ONE?

ONE is the number of appliances you'll need to enjoy a FULLY CAPABLE SIEM from Intellitactics. That means you buy and implement ONE appliance that provides TWO key capabilities: log management which is essential for compliance with regulatory standards and real time event management which is essential for threat management and security operations.

Another number to consider: 1400! That's the number of packaged reports you get with the Intellitactics SIEM products.1400 audit ready reports for every regulatory standard:  NERC, PCI, HIPAA, SOX, FISMA, GLB and for best practice control sets like CoBit, NIST and ISO.

Finally - 0 - yes ZERO is the number of DBA's you'll need and the amount of SAN storage you will need to get full value from your Intellitactics SIEM. It's also the number of times you'll wish you had bought another product and the number of calls you'll have to make complaining that you've run out of storage or connected to a device your SIEM doesn't support.

So get the ONE SIEM appliance that does it all. See the ONE every Tuesday at 2 PM EST.

Intellitactics Challenges the Idea of Hiring Hackers

Sunil Bhargava, CTO Intellitactics, talks with Warren Axelrod about hiring hackers to foil the cyber criminals.

SB:  I saw an Associated Press article entitled “US Looks to Hackers to Protect Cyber Networks,” by Associated Press writer Lolita C. Baldor.  She writes that “…federal authorities are looking for hackers – not to prosecute them, but to pay them to secure the nation’s networks.” What’s your reaction to this strategy?

WA:  I have never liked the idea of hiring hackers to defend against other hackers. I know it’s frequently done – like the way that safe manufacturers have hired safebreakers to improve their products, but I have my doubts.

The real question is whether such hackers can be trusted. What if you anger them for some reason or other? Will they turn on you and act against you, using the knowledge that they have gleaned during the work they were doing for you? Of course, this could happen with anyone – it’s just that it is arguably more likely to occur with someone who has already challenged authority and has demonstrated disregard for the law in their past lives.

My own opinion, expressed in a blog post “Security Mindset: Nature or Nurture?” is that security professionals can have a security perspective of the world without  having a criminal mind.

SB: I would agree and contend that the criminal perspective can be taught. It seems ludicrous to maintain that all law enforcement officials would benefit from being former law breakers.

WA: Yes, I agree. I was originally reacting to Bruce Schneier’s description of the security mindset. He claims that good security professionals see the world differently. I maintain that many professionals, including civil engineers, look at the world in terms of what it might take to break something, and that such a worldview can be taught.

Wth the recent economic downturn, there are many knowledgeable white-hat security professionals available for hire, so why should it be necessary to take on folks with dubious backgrounds for critical work accessing sensitive information? I think that it is a bad and unnecessary approach – and it’s even worse when you publicize it!

SB:  Warren – thanks for your perspective and I couldn’t agree more.

Intellitactics Feature: Re-Insourcing - a Security Risk

We asked Warren Axelrod this question: You’ve been a proponent of safe outsourcing and you’ve become an expert in this area. I’m wondering if you see a trend developing for companies to bring their outsourcing back in house. If you do – what types of risk does this present?

From the desk of Warren Axelrod:  It is generally accepted that the most dangerous events in flying are takeoff and landing. One can argue that, with IT outsourcing, the most dangerous periods are the transition to and withdrawal from an outsourcing arrangement.

In an article, “Delta Air Ends Use of India Call Centers,” in the April 18-19, 2009 issue of the Wall Street Journal, reporters Paulo Prada and Niraj Sheth relate how Delta Air Lines and other companies are bring their Indian call centers back onshore (read U.S.A). The reason cited is customers’ dissatisfaction with the communication skills of the Indian employees. While that’s a plausible reason, a more likely reason is that it is considerably less troublesome and distressing to fire a disembodied group of voices than the person in the cubicle next to yours. So the goal becomes reducing incremental costs while seeking better customer relations during these difficult times. Unfortunately, other than being politically correct and “bringing good jobs back to America,” such actions are not likely to be the most effective way to reduce costs and protect or increase revenues. More important these plans become highly questionable when data confidentiality and privacy are taken into account.

I have written and spoken frequently about the security risks inherent in moving and disbanding business and IT functions, as in my book Outsourcing Information Security (Artech House, 2004) and in a post on September 30, 2008 “Security in Times of Crisis” at  The disgruntled insider or ex-employee may well represent the biggest security risk that you will ever encounter. The population of disgruntled persons greatly increases during downsizing, outsourcing and similar exercises.

The fact is that the individuals employed in these offshore call centers and IT service providers react like anyone else and, depending upon the data to which they have access, could represent a real threat. Coincidentally, in the same issue of the WSJ as above, Eric Bellman and Jackie Range in the article “Satyam Buyer Inherits Bloated Workforce” forecast potential layoffs of former employees of Satyam Computer Services by new owner Tech Mahindra Ltd.

So what do we have? Depending upon security policy and enforcement programs, call center employees could have access to names, addresses, credit card numbers and other nonpublic personal information for possibly millions of customers. Is there motivation for dishonest laid-off employees to try to benefit by selling or using such information? Of course there is … particularly in countries where law enforcement is not particularly capable or laws to prosecute perpetrators are weak, so that deterrence is not as effective.

By the time management realizes the potential impact of their downsizing actions, it is often too late to implement preventative measures. The only recourse at that point is to implement stringent monitoring; trying to capture when employees are loading data to USB drives, emailing sensitive information to their home accounts, and the like. A good policy is to always monitor for these behaviors so you can act fast, because, the criminals are acting very fast. Then be ready to prosecute to the full extent of the law.

Intellitactics Alert Extensions - Faster Incident Response

Intellitactics customers act quickly when a threat is identified because they have all the detail they need without performing time consuming searches on multiple consoles. The Alert User Interface (Alert UI) is a fullly integrated feature of Intellitactics Security Manager designed to provide security analysts with in depth understanding of correlated security events, known as Alerts..A primary feature of the Alert UI, the Alert Detail, brings together all the detail: from the logs to the correlated events, to automated risk scores and now direct access to device or data consoles providing even more native detail for critical security products like Sourcefire or Real Secure IDS. This fast access from the Alert UI, is known as an Alert Extension. .During incident response, when minutes are critical, Alert Extensions combined with the composite of information available with one click on an Alert listed in the Alert UI provides decision support and actionable information to respond quickly and accurately.  Get more information on Alert Extensions and faster incident response.

Intellitactics Featured in Silicon India

It's a well known fact that businesses are able to provide wider access to applications and information to a broader audience of customers, partners, and employees utilizing a dizzying array of access methods, protocols, and devices. The information security industry, companies like Intellitactics, have been trending along with this growth by providing even more technologies and products to protect and enable safe computing. Success breeds success; the information security industry has been enabling business growth and businesses are scooping up protection as fast as it becomes available. The result of more protection is more complexity. The challenge for businesses today is managing the very complexity they’ve created by adopting more and more of the innovation that the industry serves up year over year.

Sunil Bhargava, Intellitactics CTO, was invited by Silicon India to  write about managing the complexity of layered protection. The article includes a close examination of three factors contributing to complexity: 1) The very infrastructure, which most enterprises now have in place to protect themselves, is growing and by its nature is becoming more complex; 2) Second, government and industry regulations are contributing to an already complex landscape. All companies are subject to one or more regulations with the same intent - to ensure standards of due care are in place to protect information assets; 3) Pervasive growth in criminal activity, exacerbated by global economic turmoil is adding another layer of difficulty. (MORE)

Bhargava comments on the impact the economy is having on a company's ability to address the complexity. While new program/product budgets may be intact, the staff that would implement the new programs or products has been cut, or at best not expanded. This translates into delayed projects because there is no headcount to implement them. So at a time when risk is increasing, capable resources are decreasing making the mandate to protect and defend even more complex. (MORE) 

On Wednesday we'll be featuring how an effective SIEM like Intellitactics ISM and Intellitactics  SAFE simplifies the complexities inherent in data protection.

 

 

BeWARE of the SCARE – Try CarrotWARE and StickWARE

From the Desk of Warren Axelrod:

 

There’s hardware, software, firmware and malware, followed by crimeware and now the Washington Post reports on scareware. Microsoft warns that scareware is on the rise.  Joseph De Avila  in the April 15, 2009 edition of the Wall Street Journal wrote an article entitled “False Security: ‘Scareware’ Spreads.” The article describes a very disturbing trend described in Microsoft report showing that scareware infections increased by 48 percent from the first to the second half of 2008, with one particular program increasing by 67 percent over the same period.

 

Scareware is defined as rogue anti-virus programs. Here’s an example that will be familiar to many: You get a pop-up telling you to update your anti-virus software for a fee of say $49.99. You  pay the money and receive some software—only it isn’t anti-virus software, it’s malware. The so-called anti-virus software company does not respond to attempts to claim back the money. What a surprise!

 

The bad guys are endlessly creative with their social engineering exploits. No sooner is one distribution-response vector stymied they come up with many more until they find something that works. The scareware approach is perhaps one of the more insidious as it plays on the victim’s trust in his or her defender. It is the equivalent of a bad guy dressing up as a cop. After all if you can’t trust the cops whom can you trust?

 

Maybe its time the good guys took a cue from the bad guys. As security professionals we use aWAREness training to protect against such exploits. You don’t want to err on the side of TRUST NO ONE; e-commerce will grind to a halt. You can’t train all the people, all the time on every exploit. I don’t have an answer. I don’t think anyone does, aside from emphasizing the need for vigilance. But that doesn’t do it because the perpetrators are continually coming up with new ways to hoodwink the innocent victim.

 

To protect against the likes of scareware, we do the awareness thing, apply a physical fix if we can. Awareness training, based on my personal experience, is marginally effective even though regulators and legislators push for it. While I believe its necessary, I don’t believe is sufficient. We need to be just as creative and wily as the dark side if we are to have any chance of beating them. So far the force has not been with us and most of our responses have been ho-hum.

 

Now none of us is totally immune from the effects of fear and greed. So how about more effective use of what I call “stickWARE”. Very simply it is threat of punishment or pain if you don’t take some action. For example: “Change your username and password on your bank account or your balance will be forfeited.” For those of you who like a more positive approach you could try “carrotWARE”: “Change your password and we’ll send you a chance to win an iPod. If one doesn’t work maybe the other will. Creators of social-engineering exploits are endlessly creative and no one is immune to these types of appeals.

 

More effective deterrence is what we need – but that’s another topic for another day.

 

From SB: Check out Warren's new book Enterprise Information Security and Privacy and plan to hear Warren discuss his book during an Intellitactics First Person podcast in May.