Month: January 2014

When it comes to IT security, data is the crown jewel. This is not to say that networks and other systems are not important. A compromise anywhere could expose resources in your enterprise to manipulation or theft. But it is the data your systems store and use that are the most valuable targets.

This is why mobile computing and BYOD are problematic. How do you protect your data when it is being accessed by and used on devices outside your control? The immediate reaction to this challenge is to forbid access, but that can be counterproductive, warns Alexander Watson, director of security research at Websense.

“People will find a way around things that stop them from getting their jobs done,” says Watson.

And employees today expect to use mobile devices to get their jobs done, no matter where they are. If balked, they will work around restrictions and create an inside threat — unintentional, perhaps, but a threat just the same. The solution is to make data security an enabler for mobile working rather than a roadblock.

The underlying problem in mobile computing is not new. Security generally has been an afterthought in computing, and security operations were set up separately from the IT shop. As a result, security is the bad guy who tells you that you can’t do something and stops you from doing it. It didn’t take long for this to be recognized as a problem. Consequently, the trend has been to move security from its silo and integrate it more tightly with IT and business operations. That way it can help with missions rather than interfere.

But patterns tend to be repeated in IT, and as new technologies are introduced this mistake often is repeated. Belated attempts at security inhibit the use of new tools until they are forced on the enterprise. However, security in mobile devices, particularly in increasingly powerful and useful smartphones and tablets, is evolving to help enable meaningful authentication, access control and data security.

Biometric authentication is emerging for phones with Apple’s introduction of a fingerprint scanner in its iPhone 5s. It’s imperfect, but a step forward in security and convenience. Card readers for devices can enable use of government CAC and PIV cards, and software credentials derived from these cards can be used for authentication and access.

Software agents can also apply data-loss-prevention policies on mobile devices. And there are software-hardware solutions such as the Trusted Execution Environment, which is a secure area on a phone’s main processor to provide security against software attacks. Independent processor chips can also be included in handsets to enable a secure work environment and secure communications channels.

None of these solutions are fully mature and no security is perfect. But if users and organizations demand these features in products out of the box, personal devices —which already are finding their way into government and private sector work  environments — can become not only safe to use, but productive. “Security becomes an enabler,” Watson said.

Posted by William Jackson

[Source: GCN]

Predicting is easy. When it’s made, one prediction is as good as another. Only in hindsight can you pick the winners from the losers. Let’s look back at my 2013 predictions for cybersecurity and see how good they were.

I hedged my bets pretty well last year. The predictions for the most part covered areas that were so basic that they would be important security concerns regardless of what happened. But did they deserve to be singled out for 2013?

Cloud

It turns out that reliability, not security, was the big issue in clouds.

An inspector general’s report found that NASA, a pioneer in cloud computing, suffered from a lack of proper security. “We found that weaknesses in NASA’s IT governance and risk management practices have impeded the agency from fully realizing the benefits of cloud computing and potentially put NASA systems and data stored in the cloud at risk.” But the report did not cite any serious breaches, and according to data from the Privacy Rights Clearinghouse most data losses still are occurring the old-fashioned way: Through lost, stolen or discarded devices and documents and from in-house breaches. Not from cloud breaches.

What caused problems in the cloud were a string of outages plaguing Amazon Web Services, Dropbox, Microsoft Office 365, Windows Azure cloud storage and CloudFlare. Data wasn’t lost, but it was unavailable. For the end user, an outage is as good as a denial-of-service attack.

Collateral damage and unintended consequences of cyberwar and espionage

This one was spot-on, especially for the NSA, which suffered from multiple self-inflicted foot wounds in 2013.

From June on, the nation’s eavesdropper in chief, Gen. Keith Alexander, found himself defending once-secret electronic surveillance programs in the wake of a never-ending stream of revelations stemming from Edward Snowden’s leaks of classified documents. Repeated lies, half-truths and evasions were exposed with each new release about wholesale collection of digital communications data at home and abroad, the tapping of international fiber-optic cables, cryptographic back doors and abuse of data.

NSA staffers, portrayed by Alexander as heroes, became the bad guys in many eyes. In December, the first of what will likely be multiple court decisions about the programs found wholesale collection of cellphone metadata likely to be unconstitutional.

Supply -chain security

This issue failed to rise to the level of a crisis in 2013.

Although lengthy and far-flung supply chains have possible weak links all over the world, China has been the primary concern for the U.S. government. There are appropriations laws in place prohibiting some agencies from dealing with Chinese contractors, and there have been anecdotal reports of NASA contractors with suspect Chinese ties.

In November, the Defense Department amended its acquisition rules allowing the DOD “to consider the impact of supply chain risk in specified types of procurements related to national security systems.”

But 2013 did not produce any serious cybersecurity incidents resulting from weaknesses or backdoors in IT products that were inserted in the supply chain (if you don’t count reports of NSA dabbling in commercial crypto systems). Of course, the beauty of supply-chain tampering is that if it is done right, no one will see it. We might not know for years if we’ve already been had.

Windows 8

With the popular Windows XP approaching end-of-life in April 2014, the security of Windows 8 is a concern. But there has not been much bad news here. The latest Windows OS generally is seen as the most secure version to date.

Windows 8 includes its own antivirus features with Windows Defender, which starts early in the boot-up process to help protect against rootkits. Downloaded files are scanned for executables and applications are sandboxed. Version 8.1 includes data classification for remote wiping, improved fingerprint biometrics and better encryption. Overall, this one was a miss.

[Source: GCN]

Muzamil Riffat, CISA, CRISC, CISSP, PMP, GWAPT

For most people, the notion and understanding of privacy tends to be fluid. Here is a question then:  How much personal information should an individual be willing to sacrifice to reap the perceived benefits of convenience?

Well, if you are not certain about what the boundaries of privacy are, how are you supposed to make an informed decision about how much of it to sacrifice? Further complicating the matter is the rapid advancement in technology that is creating previously unimagined avenues of information collection and analysis with or without our knowledge. Users, organizations and governments have become three corners of a triangle in which the lines of the relationship, as far as privacy of information is concerned, are increasingly blurred.

Information is power, indeed. Therefore, it is not surprising that governments and organizations are employing all resources within their capabilities to utilize data collection and processing technologies for their noble or notorious goals (depending upon from which angle it is being viewed). This, in turn, is adding fuel to already bitter privacy disputes.

As our digital footprint is created at an unprecedented pace, some pundits are predicting that the concept of privacy as we know it, or knew it a few years ago, will quickly become a thing of the past. The drastic shift in the social/behavioral change for an information economy is due to the fact that the choice of privacy is slowly, but surely, snatched away from users. In response to the promises of technological advancements, users are willing to sacrifice a bit of privacy for each benefit in different areas of their lives. The cumulative effect of all these trade-offs will result in the end of privacy.

For auditors, the ever-changing landscape of information protection and utilization requires them to adopt a systematic and disciplined approach to ensure that all risk associated with privacy and/or potential information misuse has been mitigated to an acceptable level. Compliance to emerging laws and regulatory requirements should also be monitored to limit an organization’s liability or reputation risk.

Read Muzamil Riffat’s recent Journal article:
“Privacy Audit—Methodology and Related Considerations,” ISACA Journal, volume 1, 2014.

[Source: ISACA]

Samir Malaviya, CISA, CGEIT, CSSA

Supervisory Control and Data Access (SCADA) systems are the backbone of critical infrastructure. Recent developments, including headlines on cyberwarfare initiated by state and non-state actors, have brought security for industrial control systems, including SCADA systems, to the forefront of cybersecurity discussions.

It must be noted that the challenges of SCADA security are quite different when compared to the challenges faced in implementation of cybersecurity frameworks in the traditional IT world. While traditional cybersecurity is more concerned with confidentiality and integrity, for SCADA system, availability is of paramount importance. Imagine if your power utility experiences failure because some of the controls applied by its cybersecurity team result in crashing the device itself. This may be catastrophic for utilities and might result in loss of life, too. The traditional cybersecurity model for IT needs to be fine-tuned to meet challenges specific to the SCADA world.

The proposed SCADA security framework from my recent Journal article describes a model for owners/operators of critical infrastructure to build a cybersecurity model for their SCADA systems. The proposed framework also covers all of the components of the recently published draft version of Critical Infrastructure Cybersecurity Framework, from the US National Institute of Standards and Technology (NIST). The SCADA security framework also maps to some of the regulatory requirements to be followed by owners and operators of critical infrastructure. In fact, the SCADA security framework can be considered a comprehensive superset that meets all of the regulatory requirements of the concerned industry for the owner and operators of critical infrastructure.

The SCADA security framework can be used by owners and operators of critical infrastructure to develop the security program. It is envisioned that the SCADA security framework can help to develop a risk profile and control framework for the organizations.

Read Samir Malaviya’s recent Journal article:
“SCADA Cybersecurity Framework,” ISACA Journal, volume 1, 2014.

[Source: ISACA]

Stefan Beissel, Ph.D., CISA, CISSP

The handling of sensitive data requires compliance to standards and laws that include high demands on data security. But the handling of sensitive data can be restricted with tokenization. Companies that process sensitive data do not always need the specific data content in every processing step. Sometimes only the unique identification of data is required. Tokenization replaces sensitive data by unique strings that cannot be converted back to the original by an algorithm. Systems that use these strings do not handle sensitive data anymore.

Tokens can be generated with different techniques such as encryption, hashing and numbers. Tokens that were generated with encryption can be converted to their original state. Thus, encryption techniques are less suitable to generate tokens. By using hashing, a digital fingerprint is created, which is generally unique. But depending on the hashing algorithm used, the risk of collisions can be present and the uniqueness of the token is no longer ensured. Other techniques for the generation of tokens are the use of a serial number or a random number. In principle, any string of numbers may be used as a token as long as it allows a unique identification, almost no collisions and it cannot be converted by an algorithm to its original state.

An exemplary use case for a tokenization system is the integration of an e-commerce merchant who accepts credit card payments through a web store. It is most advantageous for the merchant to keep payment data outside of his/her network so that he/she is not bound to the regulations of the payment card industry. In a token-based method, the merchant must ensure that the web session is redirected to the systems of an external payment processor, e.g., by using a plug-in, before the payment information is entered by the customer. When customers enters their, cardholder data, the data are sent directly to the processor who operates a tokenization system. The processor assigns the cardholder data in the tokenization system to a multiusable token and sends the token to the merchant.

By using tokenization, the scope of systems that handle sensitive data and, therefore, must meet compliance and audit requirements can be reduced. It facilitates a more restrictive handling of sensitive data without adjusting business processes. Hencem tokenization offers not only a security improvement, but also potential savings.

Read Stefan Beissel’s recent Journal article:
“Meeting Security and Compliance Requirements Efficiently With Tokenization,” ISACA Journal, volume 1, 2014.

[Source: ISACA]