Category: Cyber Security

Today marks Data Privacy Day, and ISACA is proud to be a champion of this initiative. The purpose of Data Privacy Day is to raise awareness and promote privacy and data protection best practices. The debate over privacy seems to have shifted to a larger discussion about new types of personal information, such as location information, browsing history, Internet of Things data, individual rights and enterprise use of personal data. This expanding debate results from the proliferation of technologies, opportunities for enterprises to gain value by leveraging new data items and government’s interest in e-government initiatives. This includes taking action to protect citizens and promoting the economic opportunities that personal data use brings. The volume of personal, and often sensitive, data being collected and shared by organizations today is growing exponentially—largely because of technology advances, lower data storage costs, the rise of the Internet of Things and the emergence of major data brokerage companies.

Currently, there is a global set of privacy principles in the OECD Guidelines Governing the Protection of Privacy and Transborder Flows of Personal Data (2013) . In the last couple of years, the principle of accountability has received renewed attention as a means to promote and define organisational responsibility for privacy protection.

To help the global community implement a corresponding privacy management program, ISACA created a Privacy Guidance Task Force. Its first task was to conduct a survey regarding enterprises’ privacy governance structures and how various privacy issues and concerns are addressed. Clearly, one of the main obstacles is the complex international legal and regulatory landscape. While everybody may be in agreement on the principles, their implementation through laws and/or regulation differs across the world and, in some cases, in the same country, by state and industry sector. Obviously, business may only influence the lawmakers to try to harmonize their position. This will be difficult as privacy is a cultural issue. ISACA’s survey was recently conducted, and results will be published in the near future.

Enterprises need to embed privacy as an integral component of their overall governance, risk management and compliance (GRC) frameworks. Embedding privacy into GRC frameworks requires a holistic approach. COBIT 5 defines a set of enablers to support the implementation of a comprehensive governance and management system for enterprise IT and information.

As a result, the next Task Force action is to create practical guidance explaining how the COBIT 5 enablers may be used for implementing privacy in practice. It will provide specific guidance related to all enablers:

1. Information privacy policies, principles and frameworks
2. Processes, including personal data privacy—specific details and activities
3. Privacy-specific organisational structures
4. In terms of culture, ethics and behaviour, factors determining the success of privacy governance and management
5. Privacy-specific information types for enabling information security governance and management within the enterprise
6. Service capabilities required to provide privacy and related functions to an enterprise
7. People, skills and competencies specific for privacy

This will constitute a framework that can be tailored to any organization. Large companies with locations in multiple jurisdictions may need to consider different internal oversight mechanisms than small or medium sized companies with a single establishment. Similarly, programs for companies that deal with large volumes of personal data will need to be more comprehensive than those of companies who handle only limited amounts of personal data. The sensitivity of the data processed may also impact the nature of a privacy management program, as even a very small company may handle extremely sensitive personal data.

With the survey and practical guidance targeted to be published in 2015, ISACA will continue on its mission to contribute effectively to the promotion of privacy and data protection best practices.

Yves LeRoux, CISM, CISSP
Principal Consultant at CA Technologies

[ISACA]

Privacy has been getting a lot of attention lately. And with good reason, given the increasing occurrences of privacy breaches, personal information records breaches, all the many new types of smart devices being used by more and more people, and the collection of more personal and associated data than ever before. It would appear that the 2014 Sony hack was the tipping point that motivated US President Barack Obama to propose the Personal Data Notification & Protection Act and the Student Digital Privacy Act on 12 January this year. It was encouraging to see this new interest in taking steps to better protect personal information—not only for improving personal privacy of US residents, but also to help show the rest of the world that the US is moving beyond having a patchwork set of privacy laws and being considered as an “inadequate” privacy protections country by the rest of the world, to moving forward with actions to better protect personal information throughout all industries, and not just a chosen few that exist in the US today.

However, on 16 January, the White House released a statement showing their support of an announced UK goal to outlaw encrypted messages and other communications unless the government is given a backdoor to decrypt such communications. These two messages from 12 and 16 January are in direct conflict with each other. You cannot achieve privacy without strong information security, and you cannot have strong information security when tools have backdoors built into them. This is an Information Security 101 lesson that has been taught for decades, but seems to have been lost (or never learned) by leaders making decisions that impact everyone’s privacy and information security. It is also something that all information security professionals need to make sure their own organization leaders understand.

Here are five important and compelling facts that government and other types of organizational leaders need to know:

1. Backdoors can often be exploited accidentally, resulting in great harm. Backdoors in technologies are nothing new. Hearken back to 1988 when the Morris worm became the first widespread Internet attack. It spread quickly and destructively to infect systems and spread widely by using backdoors purposefully built into technologies. The backdoors in that case were a set of secrets then known by a small technically proficient group of Internet users. One error resulted in a large-scale attack that disabled many systems and brought the nascent Internet to a virtual standstill. Lessons were not learned, were they, if leaders still want to build backdoors into technology systems. As a systems engineer at a large multi-national organization at the beginning of my career, I saw fellow programmers building in backdoors and hardcoded passwords that “only they knew” (and of course anyone else examining the code) at the urging of their managers, many of which resulted in significant systems outages and program mistakes once they were put into production through accidents, which caused unforeseen problems.
2. Backdoors will not remain a secret. Backdoors will be discovered and used by the adversaries and crooks they were established to find in the first place. This is not a new truth. History demonstrates that so-called “secret” technology backdoors are dangerous, put the associated systems at risk, and lead to breaches and security incidents. And the more people that know about each backdoor, the more dangerous having such backdoors will become. Consider another real-life example. In 2013, the security company Barracuda had an undocumented backdoor in its security tool that allowed high levels of access from the Internet addresses assigned to Barracuda. However, when it was publicized, as of course secrets will be when humans are entrusted with them, it became extremely unsafe and Barracuda’s customers said they didn’t want it. There is no such thing as a “secret” backdoor if even one human knows about it.
3. Backdoors created to fight crime will be used to commit crime. Proficient enemies who are looking for vulnerabilities in security technologies know how to exploit the weaknesses when they find them. It has happened many times before. One example of how attackers can use backdoors placed into systems occurred in Greece’s largest commercial cellular network operator. Switches installed in the system came with built-in wiretapping features created specifically for authorized law enforcement agencies. A yet-to-be-identified attacker was able to install software, use these embedded wiretapping features to secretly, and of course illegally, collect the calls from many cell phones, including those belonging to the Prime Minister of Greece, a hundred high-ranking Greek dignitaries, and a US Embassy employee in Greece. The crooks are also willing to pay large amounts for the details on such built-in backdoors and other types of unpublished vulnerabilities. An undisclosed vulnerability in widely used commercial software reportedly sells for US $160,000, on average, on the black market.
4. Backdoors and other types of weakened security create opportunities for malicious insiders and the authorized unaware. Humans are the weakest link in information security, and trusted insiders present the greatest threat to systems and information. Edward Snowden has become the poster child for the high risks and consequences of trusted insiders that break their promises to keep the secrets entrusted to them. Even though he started releasing his pilfered data in June 2013, he still continues to trickle out large chunks of stolen data, such as the F-35 blueprints he recently posted that had already been obtained by Chinese hackers.
5. Backdoors in technology hurt business success and thwart technology advances. If weakened security in commercial products and services is the result of a national policy (as opposed to other causes, such as human error or corporate interests), this weakened security harms the nation economically. After having so many privacy breaches impact hundreds of millions of individuals, consumers justifiably want products and services from companies that they believe are building secure technology and that do not build in backdoors, regardless of who told them to do so. Implementing such policies could have a significant negative impact on competitiveness in the information technology sector. For example, Forrester Research Inc. estimates that recent allegations about US data surveillance activities may have reduced US technology sales overseas by as much as US $180 billion, or 25 percent of information technology services, by 2016. The government could be significantly damaging the economy even more if they would require such backdoors to be installed within security technology products that are used by consumers throughout the world.

Governments and other entities with goals of creating backdoors in security technologies, by a well-intended but fatally flawed attempt to improve security, could ultimately compromise information security and privacy and make systems and data more vulnerable. Data Privacy Day on 28 January is an opportune time to point out, to government leaders, business leaders and individuals, that privacy protections are weakened when information security protections are weakened. There are ways to ensure a country’s security without making security tools, such as encryption, weak and vulnerable to exploitation.

Rebecca Herold, CISA, CISM, CIPM, CIPP/IT, CIPP/US, CISSP, FLMI
CEO of Rebecca Herold & Associates and partner of Compliance Helper
Member of ISACA’s Privacy Task Force

[ISACA]

In Washington tonight, US President Barack Obama will propose legislative action to focus on cybersecurity during his State of the Union address. In Davos, 2,500 world leaders from government, industry and civic society are gathering today for the World Economic Forum (WEF) to discuss what WEF Chairman Klaus Schwab describes as “The New Context.” Front and center on the agenda are cybersecurity, risk and the Internet of Things.

Large-scale data breaches have brought this issue to the forefront and showcase that even well-protected, mature organizations face difficulties keeping data secure. And with cyberattacks rising exponentially, it’s no surprise that organizations are aggressively trying to hire those with the skills to prevent them.

There is one problem, however: the severe shortage of skilled cybersecurity professionals. According to the ISACA 2015 Global Cybersecurity Status Report, 86% of respondents believe there is a shortage of skilled cybersecurity professionals and 92% of those whose organizations plan to hire cybersecurity professionals in 2015 say it will be difficult to find skilled candidates. The ISACA 2015 Global Cybersecurity Status Report, conducted 13-15 January 2015, polled more than 3,400 ISACA members in 129 countries. It found that close to half (46 percent) expect their organization to face a cyberattack in 2015, and 83 percent believe cyberattacks are one of the top three threats facing organizations today.

ISACA, which assisted the National Institute of Standards and Technology (NIST) in the development of the US Cybersecurity Framework, has launched its Cybersecurity Nexus (CSX) program. CSX is a global resource for enterprises and professionals that helps identify, develop and train the cybersecurity workforce, while also raising the awareness of cybersecurity throughout the organization. CSX has extensive resources to address the cybersecurity skills gap through training, mentoring, performance-based credentials and applied research. CSX also now offers a Cybersecurity Legislation Watch center, which features the new CSX Special Report.

Cybersecurity is everyone’s business. It is absolutely essential that we accelerate the pace of creating a cyber-aware and cyber-trained society. And we need to do it together. As philosopher and inventor Ben Franklin once said, “We can hang together, or we can hang separately.” At ISACA, we are doing our part by providing knowledge and the tools to assure trust in a digital world.

Matt Loeb, CAE
Chief Executive Officer, ISACA

[ISACA]