You can't secure what you don't acknowledge.SM

Friday, December 9, 2011

Reactive security at its finest

I've been hearing on the news about Georgia State University (@GeorgiaStateU) installing 50 new security cameras. No doubt, universities in downtown Atlanta (one of the highest-crime cities in the nation) are not fairing so well with security these days so somebody needs to do something, no?

Well, Georgia State's solutions was to install more security cameras. Is this security theater at it's finest? Not totally, but it is security theater like I see all the time in townhome and apartment complexes where the "gate's always up".

This reminds me of some security concerns I found when I first moved into my previous office: outside doors staying unlocked around the clock, wiring closet accessible to everyone who comes inside the building among others...When I mentioned these concerns to my landlord he, in typical head-in-sand fashion, brushed them off and said "We have security cameras that monitor the parking lot." Oh, okay, well in that case...sheesh.

Like cloud computing contracts and SLAs that so many businesses over-rely on, these cameras are certainly good for reactive measures - a means to fall back on. Sure, they may deter a few thugs but they're not going to stop the actual crime in most situations (think convenience store robberies we see on video all the time). Perhaps this would but it'd never fly so the crimes will likely continue. As with criminal hackers, the thugs terrorizing Atlanta's streets know they have the upper hand.

Thursday, December 8, 2011

Are CIOs not doing their jobs?

In the past week I've come across three different articles on how CFOs are getting more involved in IT. For example, in last week's Atlanta Business Chronicle feature CFOs take on increasing roles in IT department stated: "CFO involvement with IT has been largely driving by the need to upgrade reporting functions and the general inability of many legacy systems to provide the kind of data the C-suite needs." According to Robert Half Management Resources, 44% of CFOs have become more involved in technology-related decision-making. Interesting finding.

And this CSO piece from a couple of weeks ago stated: "For business both small and large, CFOs now are finding themselves with fiduciary responsibility in data-protection cases."

Finally, some interesting findings were documented in this CIO piece from just a few months back:
  • 26% of IT investments in the past year have been authorized by CFOs alone
  • 51% of cases, IT decisions are being made either by the CFO alone, or by the CFO in a collaboration with the CIO
  • 5% of the time the CIO makes the investment call
  • 42% of IT organizations report directly to the CFO
  • 47% of executives viewed IT as being strategic


Is this a sign that CIOs aren't communicating effectively with others in management? Perhaps they're not providing them with the tools they need to make strategic decisions? Does it underscore the very issue I've been ranting about for years regarding executives having their heads in the sand over IT? I'm hopeful that it's merely a sign that IT and information security are getting more visibility in the business and thus luring more decision makers to the table.

Only time will tell. One thing's for sure...If you're an IT leader, you'd better keep doing the things that good leaders do so you can keep your visibility....and your job.

Wednesday, December 7, 2011

BitLocker, Passware...heads in sand everywhere!

Three times in the past three weeks. That's how many conversations I've had people who have blown off any sort of technical or operational weaknesses associated with Microsoft BitLocker when using it as an enterprise full disk encryption solution. They're well-documented. I highlighted these issues in my recent whitepaper The Hidden Costs of Microsoft BitLocker as well.

I've said it before and I'll continue saying it: I've sung the praises of BitLocker for years. I still use it on a few non-critical systems that aren't storing sensitive information just to create a hoop for someone to jump through if the systems are lost or stolen. The thing is, there's a tool that can supposedly negate BitLocker's encryption. It's called Passware Kit Forensic.

In one of my recent full disk encryption conversations, someone in a highly-visible healthcare organization told me that even though it's been proven that laptop loss and theft is a big problem for healthcare (backed up by this December 2011 bit from Dark Reading on Ponemon's new study: Healthcare Data in Critical Condition), that loss/theft/Passware Kit Forensic was not a risk to the business. Even when the law says it is. Amazing stuff.

You see I've sung the praises of Passware Kit Forensic to over 1,000 people during my speaking engagements this year alone. I've see it in action and have had some colleagues who have used it recommend it to me. But I want to be able to demonstrate on my blog and to my audiences when I present how BitLocker can be compromised using Passware Kit Forensic. Although Passware has some screenshots on the process here, I need more.

Like other bloggers, trade rags and test labs, I'd like to get a (fully-functioning) demo/test/trial copy of the tool first so I can take it for a spin, validate which scenarios the tool can actually work and document my findings here on my blog, my articles and any forthcoming edition of Hacking For Dummies...especially given how pricey Passware Kit Forensic is ($995; it was $795 just recently so apparently there's a demand for it).

I truly believe this is a big deal and it'd be a win-win for us all. The problem is I can't seem to get anyone at Passware to get back with me. Numerous emails, a Web form submission and LinkedIn requests have fallen on deaf ears. Maybe Passware is no longer around?

For now, just know that the threat and subsequent business risk is likely there and maybe I'll have the opportunity to demonstrate it for you in the future.!

Information security quote

Don't expect short-term perfection in your security program. Instead, aim for incremental improvements over time. -KB

Join me live online today with TechTarget & ISACA

Today is our live virtual seminar Making the Case for the Cloud: The Next Steps. Join me, Urs Fischer, Dave Shackleford, Andrew Baer and Diana Kelley to hear about various aspects of cloud computing you may not have thought about.

Starting at 11:15am ET, I'll be presenting on Incident Response in Cloud Computing. I'll talk about common incident response weaknesses I see in my work, questions you must ask your cloud providers and how you can start developing your incident response plans with a proven incident response plan template.

It'll cost you nothing but an hour or so of your time and it'll be well worth it. You'll even have the opportunity to send me a curveball question at the end of my session. Won't you join us?

Tuesday, December 6, 2011

School staff members and porn - Why you should care

Here's an interesting read on government employees trying to make an extra buck by serving up pornography on their high school-issued computers. What a lovely story.

Don't think this kind of behavior is random. I've seen this very thing at the university level during a security assessment I did early on in my information security consulting venture.

You see, one thing I do during my internal security assessments is connect a network analyzer just inside the firewall for a few hours to look at general traffic patterns, protocols and the like. Interestingly, during this assessment I found a workstation that was the top talker on the network. No, it wasn't the email server, or the Web server or the high-traffic FTP server but, instead, a workstation.

After further review it was determined that a staff member was hosting porn on his computer...right on the school network. He was apparently doing pretty well as his workstation was sending and receiving literally 10 times the traffic of any other system on the network.

Folks, just because an employee passed a background check, had good references and seems to be a reasonable person doesn't mean s/he can be trusted to always do the right thing.

You've got to know your network...As I wrote about a network analyzer is a cheap and easy way to get rolling to make sure your network - and your users - are kept in check.

Monday, December 5, 2011

What happens when third-party patches are ignored

The majority of people I speak with claim they have no means for patching third-party software. As Kelly Jackson Higgins mentions in her recent Dark Reading blog post regarding the rash of Java exploitations, when third-party software goes unmanaged, bad things can happen.

It's great that Metasploit has a a module for Java exploitation - something that'll not only benefit me in my security assessments but will also help bring to light what can happen in any given enterprise. But you know as well as I do that criminal hackers will use it for ill-gotten gains.

In my work, I certainly don't see what HD Moore was quoted as saying in the Dark Reading piece regarding most enterprises not allowing admin privileges on desktops. Between my clients and the people in at my speaking engagements, maybe 5-10% of businesses have their desktops truly locked down. I will agree with the reality that Java is pervasive across any given business. In fact, I had to install Java on a system yesterday and believe the following screenshots underscore the issue:

Given such proclamations, where do you think the bad guys are going to focus their efforts?

Another funny thing about Java is what Microsoft recently documented in its 2011 Security Intelligence Report. Microsoft found that Java exploits make up to 50% of all exploits. Wow. Another side note from this report that I found interesting is that 0.1% of attacks are related to the sky is falling zero-day exploits that so many people (especially vendors) are claiming to be a huge problem.

Bottom line: as I talked about this piece - unless and until you get your arms around third-party patches, you're going to continue to be vulnerable, especially given how simple Metasploit is to use.