Enterprise Security Blog

Intellitactics is Moving to blog.intellitactics.com

Yes, we're moving the blog to a NEW ADDRESS! This is our LAST POST at  www.enterprisesecurityblog.com

_{^{NEW BLOG ADDRESS is  blog.intellitactics.com}}

_{^{Same high value content - more authors - more posts and COMMENTING!}}

_{^{Please visit us at blog.intellitactics.com}} 

_{^{First 10 identified comments on the new blog get a free lunch!!}}

 

Intellitactics Asks Will Privacy Disappear Like Vinyl Records?

It may be hard to believe but Intellitactics' Sunil Bhargava has finally taken a vacation - he's at a hidden location in the Mediterranean with his family absorbing the culture of the ages. In his absence, we asked Warren Axelrod to share an observation on the disappearance of privacy.

 

From the desk of Warren Axelrod: More than a dozen years ago, I was a big advocate of data mining and analysis using OLAP (on-line analytical processing) to sieve through huge databases and summarize the results to be used as “business information”.  I published two articles about data mining and OLAP in Wall Street & Technology magazine. The first was published in the July 1996 issue and has the title “Real-time Decisions, Anywhere, Anytime.” It touted the advances in technology, particularly access via the Internet, as enablers for employees to analyze their companies’ data remotely. The second article, published in December 1996, had the title “Cashing in on Data Mining” and covered the use of data mining and OLAP to discover patterns that would predict trends in generic “customer” behavior. Back in the day, data mining was concerned with data in aggregate for examining patterns and associations at the macro level.  

  

Now there is nothing macro about data mining. A July, 2009 article in the The New York Times by Stephanie Clifford, “Ads Follow Web Users, and Get Deeply Personal”,  caught my eye. The article explains how the mega- data gathering and data mining companies, such as the Acxiom and Experian, provide detailed personal information on request. They gather and analyze publicly available information such as the details from warranty cards, magazine subscriptions, etc. Axciom purportedly has “15,000 pieces of data on every American …” These companies can (for a fee) provide detailed reports, including names and addresses of individuals who conform to a set of criteria which the requestor specifies. What causes concern on my part is that Acxiom was a victim of two data breaches, one in 2003 and another in 2004 (neither mentioned in the NYT article), 

 

The lesson here is that technologies and procedures frequently evolve from the benign to the dangerous. Knowing the spending pattern of a group of 100,000 persons is one thing; knowing how you or knowing how I spend money is quite another thing. There is clearly marketing value in both, but the latter exposes us all to what might be considered an invasion of our collected privacy in a way that is seemingly quite legal. Maybe it’s just the way I look at the world, but don’t you think it’s a little hypocritical to have financial firms assiduously protect non-public personal information, while much of the same information is available for a price from the Acxioms of the world? I guess private is becoming a relative term.

The $2500 SIEM

This isn't a misprint - for as little as $2500 per month you can take the first step that all companies with effective security have taken to comply with standards and protect critical information. Intellitactics and Quest have put together a great program - security as a service -  to get you to take the first step. 

There are many reasons that companies and agencies have deferred their SIEM projects: the budget got smaller, the project was cut, we lost the headcount, we had to cut the SIEM project to save jobs in our group, we like maintaining the log collector we built, the dog ate it (the budget that is).

How did your project get stalled, postponed or shelved indefinitely? Every project requires human capital and sometimes you're just short one set of hands. Sometimes the best person, most qualified person is engaged in another high priority project. Budgets do change. Dollars shift to other projects, budgets get smaller in one area to compensate for unavoidable increases in other areas and revenue projections that fund the budget fall short of  expectations.Unfortunately the need for effective logging and event management doesn't shift and what the company expects from you - the security team - doesn't get put on hold. 

For $2500 you get Intellitactics SAFE- the only SIEM appliance with all the capabilities on one appliance sitting right where you are. Then you decide how much you can do with your SIEM - some of the work, all the work or none of the work at night or weekends. You get a trusted partnership with Quest,a full service managed security service provider. With Quest's security as a service you can do as little or as much work as you choose by augmenting your staff with Quest - using Quest to add the most value. 

SIEM is established by SANS as an important first stepin developing an efficient and effective security startegy. It reduces the cost of compliance, mitigates risk by automating monitoring of controls that enforce policy. 

For more information on security as a service  visit www.intellitactics.com or your virtual security team visit www.questsys.com   

Intellitactics SAFE Powers Up for NERC Compliance

An online publication reported that the North American Electric Reliability Corporation (NERC) has approved a set of revised cyber-security standards for the North American bulk power system. NERC is an international self-regulatory authority for ensuring the reliability of the bulk electric power system in North America. It develops and enforces reliability standards, and under the Energy Policy Act of 2005, it has the power to fine violators for standards violations.

The 88% majority approval by the electric industry indicates strong support in the industry for the more stringent standards. "The approval of these revisions is evidence that NERC's industry-driven standards development process is producing results, with the aim of developing a strong foundation for the cyber security of the electric grid," said Michael Assante, Vice President and Chief Security Officer at NERC, in a statement.  “The standards, if properly implemented, will develop the capabilities needed to secure critical infrastructure from cyber security threats," the statement noted.

The revised standards define 40 requirements that, when implemented, will provide a solid foundation of sound security practices. Audits for compliance with these comprehensive requirements will begin on July 1, 2009. Entities that fail to comply can be fined up to $1 million per day, per violation in the U.S., with other enforcement provisions in place throughout much of Canada, said NERC.

Being audit ready requires automated log collection and reporting. Intellitactics SAFE offers one fully capable appliance that not only provides audit worthy NERC reports to demonstrate compliance but also automates event monitoring to sustain compliance between audits. Monitoring is a proven strategy for mitigating risk and protecting against costly breaches in security. See SAFE every Tuesday and decide is SAFE is right for you.

Intellitactics on Medical ID Theft and Health Reform

Sunil Bhargava: The White House is kicking up the volume on health care reform and several plans are under consideration. While the overriding goal of healthcare reform is to ensure the right to healthcare for a larger segment of the US population, it will require a close look at taking the cost out of healthcare by providing streamlined, secure management of health information. Everyone knows that the collection of and access to patient information represents a major portion of the cost of healthcare. Overall, the prevalence of legacy systems, processes requiring redundant data collection and incompatible data bases create lots of cost in delivering patient care. The In the following post, guest author, Warren Axelrod, suggests that forethought can minimize the exposure to unavoidable costs resulting from medical ID theft.

Warren Axelrod: In an article by Walecia Konrad, (6/13/09 New York Times, “A New Ailment: Medical ID Theft: Treatment at Your Expense, Or at Least Your Insurer’s”) I read that medical ID theft is on the rise. Medical ID theft is when someone hijacks your health card account and charges all manner of services without your knowledge. Usually you only become aware of it when a red flag is raised, in the form of you exceeding your limit or you being notified of charges that you did not make. So how is credit card account ID theft and medical account ID theft different?

For one, if “Joe” (the thief) steals your medical ID and charges various services to your account, the information relating to Joe’s medical condition is protected personal information under HIPAA (Health Insurance Portability and Accountability Act). The implications are somewhat ridiculous but are surely unintended consequences of HIPAA. The article states that if and when your medical information is intermingled with Joe’s, you may have trouble accessing your files since HIPAA apparently requires that Joe’s medical information, which may be intertwined amongst your records, must be kept confidential. The article goes on to state that the discovery of “erroneous information in … medical files … may pose a bigger danger than the financial risks.” These risks include the possibility that a doctor will make an incorrect diagnosis or prescribe the wrong treatment because he/she is distracted by Joe’s information in your file.

As President Obama pushes for the massive automation of medical records, we must take into account the risks that medical account hijacking imposes. As more information is converted to electronic form, the security of those records becomes increasingly at risk. Yes, automation will likely yield greater efficiencies and lower direct costs. However, the cost of ID theft and its consequences to the health and financial wellbeing of the patient must be taken into account. While there is money to be saved by automating health records there is money to be spent building the requisite levels of security. Measuring the indirect costs resulting from misdiagnosis and rectifying damaged credit ratings are less easily measured than direct out-of-pocket costs, and therefore much more likely to be ignored. Positive results from reform could likely be diminished by the impact of lax security.

Pam Dixon, executive director of the World Privacy Forum, is quoted as saying, “Without aggressive safeguards, we could be building an infrastructure for massive medical fraud.” Agreed. So the mission is clear: design and implement the requisite security measures before the system is developed; rather than afterwards when the costs will be orders of magnitude greater.

Want to know more about securing patient information? Go to www.intellitactics.com to learn about HIPAA compliance.

Picture this - Intellitactics NEW EnterpriseVue

Jeff Vince, Director of Solution Services with Intellitactics, spends more time in Fortune 100 SOCs than anyone else at Intellitactics. He relates that the job of enforcing security policy is hard and thankless. "While the security team is accountable for prevention and defense, they need every employee to be on board with the rules and regulations. Training is the obvious answer, but reminding people every day to DO what they learn in training requires continuous awareness."

That's what EnterpriseVue for ISM is designed to do. Using state of the art dashboard technology, EntepriseVue transforms gigabytes of data into graphical and tabular reports arranged on a role appropriate dashboard. The dashboard is dynamic with protected access to specific roles and responsibilities. ISM or Intellitactics Security Manager is a fully featured security information and event management (SIEM) solution that transforms millions of logs into actionable security events, automates alerting and accelerates investigation and incident response. "You can configure dashboards for the NOC, the application managers, the business line managers and other stakeholders. Everyone benefits from the ISM repository of security information, while the SOC works with security events to actively monitor control violations and attacks," explains Vince.

“Training end users on behaviors they can watch out for amongst their peers and then reinforcing that training with frequent reporting may deter the activity of a malicious insider,” is an example offered by Jeff Vince, Director of Solution Services for Intellitactics. “We encourage the SOC to run reports that keep security front of mind. We also suggest they involve other IT functions like network operations, database managers, application managers and others by providing reports they can use to make decisions and take actions to comply with policies.”

Read more about EnterpriseVue for ISM. Looking for a SIEM appliance? Intellitactics SAFE offers the same powerful, dynamic dashboard powered by the Intellitactics Security Data Warehouse - the only fully integrated repository that doesn't limit capacity to maintain performance.  

Intellitactics Poised for Mid Market Success

This week Gartner published their annual research on security information and event management (SIEM)vendors. The research covers the high number of vendors (21) in this space and it also underscores the many different ways companies are building, packaging and selling SIM and SEM and a combined solution for companies that want and can handle both.

So what about Intellitactics? Well, we have two distinct product lines that we've developed. The first is a software solution, Intellitactics Security Manager, that in Gartner's estimation is "optimal for large enterprises" with the need to customize and configure their SIEM to adapt to sophisticated and complex requirements.the second is Intellitactics SAFE - a fully capable SIEM appliance that is uniquely designed for mid market companies. SAFE is simple to deploy and easy to use. So if a company just wants to do better during an audit or is large enough to face complex security threats but too small for dedicated security operations centers  then SAFE is perfect. Lots of capability on ONE appliance - the ultimate in simple and a fast path to value.

Our packaging is simple. Buy what you need now from Intellitactics or from a select number of VARs that all have unique capabilties and areas of expertise. We're also proud of the MSSPs that offer security services in the traditional way or co-opt SIEM with a SAFE appliance on premise with remote management by the MSSP. No matter what your budget, there is an affordable way to get the benefits of SAFE: improved understanding of logs and events and accelerated investigation of security incidents. We aren't bundled with your storage solution or your NOC solution or thrown into your maintenance bill. Everyone of our customers conducted a thorough investigation and selection process and chose Intellitactics.

Finally, we like what we do. Everyone in the company takes a lot of pride in the success our customers in 21 countries and many industries are having with our product. We are just as excited today after 11 years of providing security solutions as we were when we the first customer bought a product that in those days was an elaborate toolkit.

So if you're an independent thinker and you're looking for a vendor partner highly invested in your success - we're the company you're looking for! Take a look -  any Tuesday and see for yourself how simple SIEM can be.

Intellitactics Explains the Value of ONE

21 - the number of vendors offering security information and event management (SIEM) products including Intellitactics. These products offer a variety of features and functions and just as many architectural approaches to providing these product capabilities. So what is so important about ONE?

ONE is the number of appliances you'll need to enjoy a FULLY CAPABLE SIEM from Intellitactics. That means you buy and implement ONE appliance that provides TWO key capabilities: log management which is essential for compliance with regulatory standards and real time event management which is essential for threat management and security operations.

Another number to consider: 1400! That's the number of packaged reports you get with the Intellitactics SIEM products.1400 audit ready reports for every regulatory standard:  NERC, PCI, HIPAA, SOX, FISMA, GLB and for best practice control sets like CoBit, NIST and ISO.

Finally - 0 - yes ZERO is the number of DBA's you'll need and the amount of SAN storage you will need to get full value from your Intellitactics SIEM. It's also the number of times you'll wish you had bought another product and the number of calls you'll have to make complaining that you've run out of storage or connected to a device your SIEM doesn't support.

So get the ONE SIEM appliance that does it all. See the ONE every Tuesday at 2 PM EST.

BeWARE of the SCARE – Try CarrotWARE and StickWARE

From the Desk of Warren Axelrod:

 

There’s hardware, software, firmware and malware, followed by crimeware and now the Washington Post reports on scareware. Microsoft warns that scareware is on the rise.  Joseph De Avila  in the April 15, 2009 edition of the Wall Street Journal wrote an article entitled “False Security: ‘Scareware’ Spreads.” The article describes a very disturbing trend described in Microsoft report showing that scareware infections increased by 48 percent from the first to the second half of 2008, with one particular program increasing by 67 percent over the same period.

 

Scareware is defined as rogue anti-virus programs. Here’s an example that will be familiar to many: You get a pop-up telling you to update your anti-virus software for a fee of say $49.99. You  pay the money and receive some software—only it isn’t anti-virus software, it’s malware. The so-called anti-virus software company does not respond to attempts to claim back the money. What a surprise!

 

The bad guys are endlessly creative with their social engineering exploits. No sooner is one distribution-response vector stymied they come up with many more until they find something that works. The scareware approach is perhaps one of the more insidious as it plays on the victim’s trust in his or her defender. It is the equivalent of a bad guy dressing up as a cop. After all if you can’t trust the cops whom can you trust?

 

Maybe its time the good guys took a cue from the bad guys. As security professionals we use aWAREness training to protect against such exploits. You don’t want to err on the side of TRUST NO ONE; e-commerce will grind to a halt. You can’t train all the people, all the time on every exploit. I don’t have an answer. I don’t think anyone does, aside from emphasizing the need for vigilance. But that doesn’t do it because the perpetrators are continually coming up with new ways to hoodwink the innocent victim.

 

To protect against the likes of scareware, we do the awareness thing, apply a physical fix if we can. Awareness training, based on my personal experience, is marginally effective even though regulators and legislators push for it. While I believe its necessary, I don’t believe is sufficient. We need to be just as creative and wily as the dark side if we are to have any chance of beating them. So far the force has not been with us and most of our responses have been ho-hum.

 

Now none of us is totally immune from the effects of fear and greed. So how about more effective use of what I call “stickWARE”. Very simply it is threat of punishment or pain if you don’t take some action. For example: “Change your username and password on your bank account or your balance will be forfeited.” For those of you who like a more positive approach you could try “carrotWARE”: “Change your password and we’ll send you a chance to win an iPod. If one doesn’t work maybe the other will. Creators of social-engineering exploits are endlessly creative and no one is immune to these types of appeals.

 

More effective deterrence is what we need – but that’s another topic for another day.

 

From SB: Check out Warren's new book Enterprise Information Security and Privacy and plan to hear Warren discuss his book during an Intellitactics First Person podcast in May.

Intellitactics SAFE is a Winner - Best Security Management

During InfoSec Week in London, SC Magazine Hosted a Gala Event to recognize the best products in multiple categories. Intellitactics SAFE was voted the Best Security Management Product..

Intellitactics Director of International Sales Brent Davidson and Intellitactics Security Specialist Matt Schnarr hosted a table of Intellitactics customers and partners at the SC Magazine Gala and eagerly anticipated the award announcements. "We're proud to accept this award on behalf of all the talented people at Intellitactics who contributed to this complete and affordable security information and event management appliance," Davidson said. "While the Award is great to get, we are rewarded everyday by the customers who choose Intellitactics over dozens of other alternatives. When a customer volunteers to tell prospects about their product and their Intellitactics experience, it makes me so proud of what we do and what we provide to this market." 

Davidson and Schnarr were at InfoSec to leverage the excitement around the SAFE product. Global laws and regulatory standards continue to challenge organizations of all sizes. SAFE provides everyday compliance with policies implemented to reduce risk and protect against insider and external attacks. Intellitactics partners in 22 countries outside North America incorporate SAFE into comprehensive infrastructure management and compliance initiatives.

See SAFE in action every Tuesday at the virtual Open House or learn how one right-sized SAFE appliance enables PCI compliance.