Information Security Awareness

Welcome to BD&F Infosec

Welcome to BD&F Information Security.

This site raises awareness about the laws and standards that govern Information Security (InfoSec) in the United Kingdom and the methods that businesses can use to achieve compliance and improve base standards of data protection. There is useful information for small and medium enterprises (SMEs) to help protect their information including the various laws and standards that control how data is handled securely.

The information will include generic InfoSec advice such as the value of owning data and why policy is a requirement. The focus is on the SME environment where the resources for securing data are found in standard PC applications and in work habits that ensure InfoSec.

BD&F Information Security is a private consultancy that provides research, education and guidance to SMEs.

BD&F is the creation of Sean Pollonais and started life as a t-shirt logo in Trinidad in 1995. It was originally called BULL DOG and FROG. The last batch of BULL DOG and FROGs was printed in the UK in 2000. Since that time I have switched careers from artist to InfoSec consultancy with BD&F.

I will share my knowledge through regular writings, white papers, templates and direct advice about all things InfoSec. Welcome to this site and I hope that the information is of help to you.

Browser Security

I use Internet Explorer (IE) solely as a matter of habit but also because I believe it is secure enough for web use. I’ve had my assumption challenged a few times by other colleagues who believe that IE is an inherently unsafe browser.

Today I did some online research to determine if the claim of superior online security is a correct one for the non-IE browsers.

My first surprise was the popularity of Firefox. Nearly half of the browsers in use are Firefox and the three types of IEs add up to less. Last time I checked in July 2006, Firefox was at 26%, which, back then, made me feel smug about my IE preference.

2009	IE7	IE6	IE8	Firefox	Chrome	Safari	Opera
October	12.8%	14.1%	10.6%	47.5%	8.0%	3.8%	2.3%
September	12.2%	15.3%	12.1%	46.6%	7.1%	3.6%	2.2%
August	10.6%	15.1%	13.6%	47.4%	7.0%	3.3%	2.1%

Browser Usage for the last three months

The online research I did to find a definite ‘most secure’ browser did produce a clear winner. IE8. I am pleasantly surprised to find it has the best features for defending against Socially Engineered Malware and Phishing. These two vulnerabilities are quite difficult to defend against because they involve the user to a high extent.

When users are not aware of the threats present in an activity it is easier for them to be fooled into acting to the benefit of criminals. Browser makers are now designing technologies that rate websites in order to warn or block users from visiting them.

While IE8 might be the champ, I still believe the user can control how secure the browser runs on their system.

A browser is similar to other applications in that it comes with a default setting. The security level of this in most cases is the lowest and needs to be adjusted for improvement. This should be done as soon as the browser is installed to avoid infections such as spyware. In IE browsers the adjustment can be done in the Tools > Internet Options section. Here is an excellent tutorial on securing your browser.

Web activity contributes the most to the spread of infections and the growth of cyber crime. Securing the browser is a major step towards protecting your system and data. It is not the only step and should be complemented by the use of antivirus software on your computer. Software vendors send out updates, patches, for their products, receiving these updates should be automated as much as possible.

Photo by Amehare

Appetite for Risk 03

We followed the development of a company from a single operator through its growth to one that hired staff and worked with partner businesses. The information handled by the company was now exposed to more people and systems, entities, than at start up and the security practices had to be kept in tandem

As the company expands there will be an increased need to identify where data comes into the view of unauthorised entities. The staff are divided to specialise in different tasks such as Finance where records such as salaries are handled and HR where personal identifiable information is viewed. There must be policies and technology in place to ensure that these two views of company information remain distinct.

As a company grows there is a higher likelihood of exchanging data with external parties. When services are outsourced there needs to be a level of diligence by the client company regarding the security practices of the service company. The client must seek guarantees that the information exchanged is kept safe among the external staff and also not exposed to rival companies using the same service.

A larger company presumably comes under more legislative scrutiny and is subject to regular audits of its processes. Successfully passing these audits is a marketing bonus because it shows the company is responsible in many aspects, such as finance, health and safety and data protection.

I’ve given a very high level view of the importance of data security across all sections of the business spectrum in order to show its importance. The role of an information security consultant is to determine how best a company can safeguard its information and remain compliant with as little technological investment and disruption to business as possible.

At the start up stage there are security tools that are shipped with operating systems and applications that do a very good job. As more information processing systems are brought into the company, the implementation of policy and governance along with additional technology becomes important.

A company that develops a culture of security awareness from the onset will find it a simpler task to protect its data as the business grows and the stakes become higher. The practices of securely backing data, updating software, physically protecting machines, restricting access and ensuring that the systems and information are always available will remain part of the organisation’s operation throughout.

Appetite for risk decreases, information security increases.

Photo by Sean Dreilinger

Appetite for Risk 02

We will continue to look at the changes to the risk appetite that a company experiences along with growth. Part 1 started with a one-man operation that was home based as in the majority of cases. The business has experienced success and is now demanding the owner to make a bigger commitment.

The space at home is no longer enough and does not allow the owner to operate in a highly focussed environment so an office is needed. It may be the garden shed but most likely a rented dedicated space. The setting up of an office signifies the owner’s intention to create a professional atmosphere for his company.

With the increased workload additional staff would be necessary. The owner would now have a higher value attached to his time and although growth continues to be a major goal, there now has to be a system to support the customers who are already on board.

Apart from the hired staff there are operations that will be outsourced to outside businesses such as accounting and application development. The company might decide on using a hosting company to support its website or a payment handler to process purchases.

At this point a lot of information needed to run the company is being exposed to people other than the owner. The company’s staff and that of the outsourced services are privy to the business’ customers’ personal details.

At this stage of the business there will be a need to separate the views of the data held by the business both within the company and among external partnerships. Salaries, accounts, emails are a few examples.

Staff should have personal password protected accounts on machines. Personal email accounts for staff with the owner maintaining ultimate access rights. Data shipped to external parties should be encrypted. Stored data should be encrypted, given a time limit and safely discarded in the end.

It is never too early or too late to develop good information security habits. The earlier the good habits are started, the more mature a protective system becomes.

Mature protective systems avoid the need for constant fire fighting with respect to protecting data and achieving legislative compliance. As the company gets bigger there will be external audits to deal with on a regular basis. In the final part of this series I will look at how an information security system can work to protect data and maintain compliance continuously.

Photo by MissNatalie

Appetite for Risk 01

I had a discussion recently with a security manager when I came across the term “appetite for risk”. I never heard of this in information security and assumed it meant the level of risk an organisation is willing to accept.

That definition is vague because it treats the entire organisation as a single unit with one view of the risks involved in all its operations. I am interested in investigating how risk is viewed and would like to start with a small company which is experiencing growth along with changes to its appetite for risk.

To clarify, appetite in this term is not the same as ‘desire’ in the case of food. It is closer to tolerance of the various risks a company encounters.

The majority of companies are owned and operated by one person. In this scenario the appetite for risk with regard to information security can be very high. The IT systems used in these small businesses are usually machines placed in areas of the home where they can be easily shared with family members.

At this point, the business might not be entirely sure about its future prospects, it might be still testing the market, acquiring new customers, trying out a new product, getting to grips with the IT used. These all demand resources which are usually limited due to the number of people involved in the business. The appetite for risk is high because the concentration is on growing the business. The business is still in its infancy and information security would seem unnecessary.

I will disagree of course but also point to the basic security functions available through the operating system and applications software in use. The machines should be physically protected from as many domestic hazards as possible (heat, water, knocks and theft). All the business affairs can be assigned to a separate password-protected account. The documents on that account should be regularly backed up to an external drive. If the information is secret, it can be encrypted in the back up, on the everyday machine or in both places.

It is never too early to incorporate security into the operation. Doing this would help the business avoid avertable costs as it matures. A culture of security awareness keeps a business focused on protecting its data, developing new products that might usually be considered too insecure and enrols each member of staff as an additional guardian of the company’s information.

I will follow the development of the small company and the changing appetite for risk in my next post.

Photo by Norma Desmond

Defence in Depth Review

The previous six posts make up a Defence in Depth approach to securing an IT system and the data contained within. IT systems are essential to commerce in many parts of the world. Protecting all the components of these systems helps to safeguard the business’ secrets and maintain compliance with the laws that govern the security of data.

Layers
The Perimeter of the system is hard to define with the use of new communication tools that connect people to systems remotely. The system’s owner has to regularly define the boundary between the business’ system and that which is entirely out of his control.

Boundary defence will include securing access to the System. Machines should be locked away from unauthorised access. A home run business would avoid risks by locating the computer in a private part of the home. Scale this up to a large company and you get dedicated server centres with high security.

Networks are usually connected to the Internet and are protected primarily at that junction. Firewalls help control the type of traffic that comes into the home network but defending against the Web is not the end of network defence. Within a company there will be division of responsibilities and different rights of access which must be technologically defended.

The Host machines run different applications to serve the business. Some staff will have access to the finance applications, others to the HR. The machines need to be protected, access to the applications need to be protected and access to the data used by the applications must also be protected.

Some Applications such as an email program are used but all staff. Proper authentication is important to ensure that each person see only their account. These applications usually come with default settings which are common knowledge and need to be reset on installation.
 
Data Classification helps decide what to hide where. When a business is clear about which data must be kept secret, it makes it easier to allocate resources to protecting that data. Without a classification there will be an effort to protect all, nothing or the wrong things.

Additional Steps
Back up of essential data is a security step that ensures a business can continue running after a disaster. It can be a loss of power, machines, offices, natural disasters or anything that would deprive the business of its IT systems and data. An external storage device and a schedule for backing up data would provide a company with the means to recovery from many types of attacks and catastrophes.

Encryption is another defensive tool that would keep data private both in storage and transit. Many of the usually office applications have the function to save documents in an encrypted form. There are also Open Source encryption tools to help protect email, memory sticks and storage devices.

A Defence in Depth strategy for a business’ IT systems pays its way because it sets up barriers at each point between an external entity and the data that is the lifeblood of a business. This ensures that the company can keep hold of its secrets and in the event of a disaster, resume business without much interruption.

Photo by Adam Mulligan

Data Classification

Data is the basic component of an information system. It includes the intellectual property of a company, staff information and records of customer transactions. Data coming into an organisation is processed to facilitate the business operation.

To advise on the need to classify data requires a clear understanding of the risk associated with the exposure of each type of information.

It is normal to choose three classifications of data. There is public data such as the company’s history, news releases and published plans. Employee data is information that should stay within the company and not be exposed to the public. An example of this is a company strategy before it is announced to the public. Secret data is confined to certain sections of a company such as finance, research and HR.

These classifications come with different names and are not standardised across the industry. In each company one can find a customised data classification schema and different system configurations to support the levels of protection applied to each designation.

There are laws and standards that order the protection of customer data. These laws can be used to help decide what protection should be used for what type of data. A classification based on legislation can be more useful than one based on a subjective appraisal of what a piece of data is worth.

The Data Protection Act (DPA) and Payment Card Industry Data Security Standard (PCI DSS) are two relevant examples. DPA states what type of customer information should be kept from public exposure. Any data that can be used to identify a person should not be given out without consent. PCI DSS stipulates that cardholder data must be protected and gives very good prescriptions on how to achieve the required level of security.

A good starting point for classifying data takes into account what laws and standards govern the data taken in by the company and also what data does the company consider proprietary. In looking at the latter it is important to consider the triad of Confidentiality, Integrity and Availability.

That triplet can help a company classify a piece of data and decide what measures will be used to protect it. The use of encryption for stored data or data in transit will obviously be considered for Confidentiality. There are other methods to provide assurance of Integrity such as digital signatures and for Availability, protection of servers from attack and disaster.

The classification of data helps a company decide what resources to allocate to the protection of its information. There is the customary three-level approach which can be difficult to implement because it is subjective and it does not always address the requirements of legislation. This method is more suited to the intellectual property of a company.

Using the laws and standards to classify customer information is more useful because the legislation is aimed at the protection of customers and because the penalties can be quantified. This makes it easier to calculate a justifiable level of spending to achieve compliance.

Application Defence

Securing client applications involves both the application of security settings and the education of users. You can secure Internet Explorer through the use of administrative templates, as well as by configuring the security settings for the built-in security zones. Microsoft Office also has a set of administrative templates that you can use to control access to certain types of attachments, junk e-mail, and other potentially damaging content. Helping users understand how to safely download files from the Internet and how to safely open e-mail attachments is key to maintaining application security in your organization.

Internet Explorer Administrative Templates
Internet Explorer administrative templates help you enforce security requirements for workstations running Windows XP and prevent the exchange of unwanted content by means of the browser. Use the following practices to help secure Internet Explorer on the workstations in your environment:

Consider using the settings included in the Enterprise Client templates.

Ensure that requests to the Internet occur only in direct response to user actions.

Ensure that information sent to specific Web sites reaches only those sites unless specific user actions are allowed for transmitting information to other destinations.

Ensure that trusted channels to servers/sites, and the owners of the servers/sites on each channel, are clearly identified.

Ensure that any script or program that runs with Internet Explorer executes in a restricted environment. Programs delivered through trusted channels can be enabled to operate outside the restricted environment.

Internet Explorer Zones
In Internet Explorer, you can configure security settings for several built-in security zones: the Internet zone, the Local intranet zone, the Trusted sites zone, the Restricted sites zone, and the My Computer zone. The default settings for these zones in Windows XP Service Pack 2 are:

For the Internet zone, the default security level is Medium. This zone is intended for all content in Uniform Resource Locators (URLs) with fully qualified domain names.

For the Local intranet zone, the default security level is Medium-Low. This allows your user credentials (user name and password) to be passed automatically to sites and applications that need them. This site is intended for all Web sites on your local network in the same DNS domain as the client computer.

For the Trusted sites zone, the default security level is Low. This allows browsing of many Internet sites. This zone is empty unless specifically configured.

For the Restricted sites zone, the default security level is High. This zone is empty unless specifically configured and is often used by e-mail applications for viewing e-mail messages formatted in Hypertext Markup Language (HTML).

The My Computer zone (sometimes referred to as the Local Computer zone) is not displayed in the user interface by default. The security for this zone is set to Low by default. This zone is intended for content that is found on the local computer.

You should carefully evaluate the settings for each of these zones to ensure that they are appropriate for the level of security required in your environment.

Caution
Configuring Internet Explorer zone settings to values that are lower than the default settings may cause a computer to become vulnerable to attacks the default settings have been configured to prevent. Use caution when using templates to lower the security settings for zones.

Note
To further reduce the attack surface, the default security settings for these Internet Explorer zones have been increased in Windows XP SP2.

Windows XP SP2 Internet Explorer Security Enhancements
Windows XP Service Pack 2 (SP2) has added security features to Internet Explorer and has improved existing ones. These features help to make Web browsing more secure.

MIME-handling enforcement. Internet Explorer uses Multipurpose Internet Mail Extensions (MIME) type information to decide how to handle files that have been sent by a Web server. Depending on the MIME type, Internet Explorer will process the Hypertext Transfer Protocol (HTTP) file requests differently. For example, an HTTP request for a JPEG file when received will be displayed, but an .exe file will result in the user being prompted for a decision on how to handle the file.

Consistency checks. Internet Explorer now requires that all file-type information that is provided by Web servers be consistent with the actual file content. The browser will enforce consistency between how a file is handled in the browser and how it is handled in the Windows Shell. Additionally, files are renamed in the Internet Explorer cache to enforce consistent handling of the files by all applications.

Stricter rules. In SP2, Internet Explorer will now follow stricter rules that are designed to reduce the attack surface for spoofing the Internet Explorer MIME-handling logic. If Internet Explorer receives a file with “text/plain” MIME type but the MIME sniff indicates that the file is actually an HTML, media, or executable file, Internet Explorer will not increase the privilege of the file compared with the server’s declared MIME type. If an incorrectly configured Web server hosts HTML files but sends text/plain as the content type in the HTTP header, Internet Explorer will show the file as plaintext rather than render the HTML.

Better security management. The overall security management for Internet Explorer has been improved with the addition of the following features:

Add-on management and crash detection

Add-on installation prompt

Download prompt

Pop-up manager

Internet Explorer Window restrictions

These features allow users and administrators to more easily obtain information about their security settings. Users and administrators can also easily retrieve the status of their browser add-ons and configure these add-ons. The clarity of information provided by the prompts for both download and add-on installation have been improved to help users make more informed security decisions about the required actions.

Local Machine zone restrictions. Internet Explorer treats pages differently depending on the locations from which they are opened. Pages that are opened from the Internet have applied restrictions that might prevent them from performing certain operations. Pages that are opened from the local machine are in the Local Machine zone and have fewer restrictions. The Local Machine zone is an Internet Explorer security zone, but it is not displayed in the settings for Internet Explorer.

Feature Control Security Zone settings. In an effort to improve the management of some security settings, SP2 has been built with Feature Control Security Zone settings. The zone settings provide users and administrators with more specific control for:

MIME sniffing

Security elevation

Windows restrictions

Group Policy settings. With the addition of the Feature Control Security Zone settings, SP2 has added new security policies that allow administrators to manage the new feature control settings by using Group Policy objects (GPOs). This change allows Group Policy administrators to uniformly configure the new Internet Explorer Feature Control settings for the computers and users that they manage.

Microsoft Outlook Security
If your organization uses Microsoft Outlook 98, Outlook 2000, Outlook 2002, or Office Outlook 2003 with a server that has server-side security, such as Microsoft Exchange Server, you can customize the security features to meet your organization’s needs.

You can use the Outlook Administrator Pack to control the types of attached files blocked by Outlook, modify the Outlook Object Model warning notifications, and specify user- or group-security levels. For example, you can modify the security settings for viewing various types of attachments, such as executable files and application data files, and apply those settings to specific groups of users of an Exchange server.

You can use the Outlook administrative template to configure security options for client computers by using Group Policy or local Group Policy. You can configure various settings in this template to customize Outlook security for your environment. For example, you can import the Microsoft Office Outlook 2003 (Outlk11.adm) administrative template into a GPO and use it to set the Outlook security level for macros to Low, Medium, or High for all clients affected by the GPO.

Outlook 2003 includes several security enhancements, including:

Warns the user before opening potentially dangerous file types.

Runs executable content in the Restricted Sites zone.

Uses antispam controls to reduce unsolicited e-mail.

Does not automatically load HTML content.

Prevents other applications from accessing address books.

Provides application programming interfaces (APIs) to prevent software from running.

More Information
The Outlook Administrator Pack is included in the Office 2003 Editions Resource Kit. You can download this resource kit from the Microsoft Office Online Web site.

Best Practices for Securing Applications
Consider the following best practices for securing applications on client computers on your organization’s network:

Educate users about how to download files from the Internet safely and how to open e-mail attachments safely. Ensure that users configure zones correctly in Outlook so that scripts and active content in HTML e-mail messages from the Internet zone will not be run. Users should not open e-mail attachments that they were not expecting, even from other users whom they trust.

Only install applications that are required for users to do their jobs. Each application that is installed can introduce additional security issues. To limit the number of security issues on client computers, install only applications that users must use to perform the tasks required by their jobs.

Implement a policy for updating applications. Keeping applications current with security updates is just as critical as keeping the operating system current. You can update Microsoft Office applications at the Microsoft Office Online Web site. You can also use Windows Server Update Services to update Microsoft Office applications.

Photo by smithi1

Host Defence

The computers that make up a business’ network will host different types of software depending on their role. Typically there are servers and client machines.

Servers can be further classed as web servers, email servers and network servers. Client machines are usually desktop computers with the software systems that are specific to users’ requirement. Additionally there are laptops and other mobile devices that make up a company’s network of machines.

All the machines run an operating system which comes with default security settings. The settings are there to protect from attacks that bypass the perimeter and network security defences. These types of attacks such as viruses and Trojans are aimed at the operating systems.

The operating systems on servers come with many services turned on by default. If your business is not using a service it should be turned off else you will be leaving an unmonitored hole for attackers to exploit.

On client machines the security updates must be current. These patches are automatically available but some require that the machine be restarted in order to complete installation. Client machines use software firewalls to control the types of traffic coming into the system. Again if a certain type of service is not needed in your business operations, for example Instant Messaging, turn it off.

Client machines can be centrally managed through software such as Microsoft’s Group Policy where protective policies can be set. You can have policies for mobile machines that are different when they are attached to the business’ network and when they are used remotely. Machines can also be restricted from installing unauthorised software.

Good security is the successful balancing of defence and usability. Full defence calls for completely limiting a machine’s ability to interact with the rest of the business’ network and the Internet. Full usability wants a connection to everything to allow users to freely call on services with no interruption.

It is important to fulfil the basic security requirements of updating anti-virus and anti-spyware software, monitoring network activity and using firewalls. Above this level security must be designed around the business functions of the network to allow users to work free of obvious restrictions.

Photo by patrick h. lauke

Network Defence

If there is more than one computer used by a business chances are that they are networked to make sharing of information and resources such as printers easier.

To protect the network both the hardware and software that make up the system have to considered. Servers, routers, user machines must be protected from physical damage by placing in dry, elevated, fireproof locations.

Think about where the office is located, the natural disasters that can happen and what best can be dome to alleviate the risk of losing use of the machine when the worst happens.

The linking mechanisms such as cables and wireless transmitters must be protected from unauthorised access. The cables not be run through conduits or covered where they cross high traffic areas of the floor. The wireless router must be configured to stop free access to the network and the information transmitted has to be encrypted.

On a network there may be many different services installed on different machines. If one of those services has a weak entry point a hacker can compromise the entire network. Segmenting a network through the use of switches limits access to the entire network from any one point.

When a small company is networked all machines are usually linked to the printer. This saves having to purchase multiple printers and the costs associated. With this type of setup the recommended practise is for users to remove printed documents as soon as they are printed and not left there for others to read freely.

The IPSec port filtering must be implemented to restrict the web traffic that can come to the servers. Only the specific ports that are required to support a server’s role must be open and all other default and unnecessary ports must be blocked.

The network is the largest and most dispersed part of an information system’s infrastructure. All parts have to be audited for weaknesses and defences beefed up to raise the average strength of the entire network.

Photo by pascal.charest

System Security

The systems that process data for businesses need to be protected before we go on to defend the data that is held within these systems.

Your wallet is a good example of a place you keep items of varying values. Even when it is empty your wallet is an item you will secure for its cost, convenience and perhaps sentimental value.

A business’s information system is similar to a wallet in that it holds valuable contents and even if empty it still has value for its use as a business tool. The first level of security for the information systems can be placing the machines in controlled areas.

If your information system runs on a single computer you should limit physical access to that machine. It should be secured against theft and accidental damage from other users of the office space such as visitors or family. A business with a server system should use a locked server cabinet or a separate room. The individual machines would still need to be protected.

The machine’s location should help protect it in times of natural disasters and fires. It should be protected from extremes of temperature and kept in a dry location. A UPS power backup allows the system to keep running after a power supply failure and gives the business control of the shut down process if needed.

Many businesses start as table top enterprises, being part of the home furniture until a separate area for working can be afforded. During those early days the machines holding the business’ information are most likely shared among family members.

The business should use a separate password protected account on the computer. When the owner logs onto that account all work done will be regarding the business. Log off the account when the work is done and the computer can be used by others without fear of losing valuable business information.

The account should be locked whenever the machine is left unattended for a length of time. The screen saver can be set to automatically lock access to the account or it can be done via the keyboard or a desktop icon.

Laptops and PDAs are also common among SMEs and care should be taken to limit access to authorised users only. If all your business data is held on a laptop it should be kept close and high risk areas should be avoided. Newer laptops have the ability to encrypt the entire drive.

If your data is lost your business would face a tough challenge getting up to speed again. Your information should be regularly backed up on an external storage drive which is kept separately from the main machine.

Photo by shareski