BD&F Information Security

Personal Custody

My wife and I went shopping for a new bag recently. For her it is important that there is a zippered top because it is more secure. That made it difficult because most of what we saw were without.

I felt it was not needed because a bag is so personal that you will always guard it closely. She disagreed saying there are always situations where it would be exposed without total supervision and a zippered top buys that extra security and time needed then.

I have to agree because it is an example of using a technology to supplement good security practice. My wife’s bag is almost always slung over her shoulders when she is out and she hardly ever puts it down and the zip remains shut. It might be considered overkill and looking at the choice of bags most people seem to think a zip is not necessary.

I can think of two reasons why the zip is a good idea. It makes it a tougher target for opportunistic thieves who can easily look elsewhere especially with so many zipless bags about. It also prevents the contents of the bag from falling out and this avoids a heap of pain when it comes to replacing things like driver’s licence, credit cards and the lot.

When something is considered worthy of protection, the security habits and technologies that surround it have to be considered. The habits can be taught and practised until they are 2^nd nature. The technology can be chosen to support the habits but only to the point that the activity is not unduly affected.

You can make a habit of keeping your bag closely tucked to you. You can add a zip for those times when you are unable to guard it fully and to securely contain what’s in there. But you won’t use a lock, which is most times overkill.

Protecting information has many parallels with this situation. The debate about the effectiveness of user awareness training versus the use of technology still carries on. I think both are necessary. User awareness has to be done constantly in an effort to develop secure habits surrounding information.

Technology has to be assessed for its suitability to the business process. There are most likely more than one option for protecting data in a situation and it is the duty of the company to choose the solution that allows them to realise commercial activity in the safest possible manner.

Central Data

Woke up today to 3C temperature outside. The seasons are changing and the length of the days is shortening. Soon the clocks will “Fall back” and the journey to and from work will be done in the dark.

Come the 28^th October at 2:00am this year, British Summer Time ends and the time changes to 1:00am. This always involved an arduous ritual of setting all the house clocks and watches to the correct time. Of course you might always forget one, the clock in the car being the best example, and you never know when that mistake can be costly.

If all were changed, they still weren’t in sync. In the case of domestic clocks the few seconds difference might not be critical but there are situations where seconds count. Now more timepieces are centrally controlled either by radio signals or via the Internet. The list includes my computers, smartphones and watches. Life is easy!

In businesses, information experiences the same type of challenge, accurately reporting an update to all users. When a change is not centrally distributed, you are in a similar situation as having to manually change clocks.

Companies must employ ways of centralising information to ensure that an update is broadcasted to all endpoints. It is more efficient in many respects. Takes less time and avoids many mistakes down the line.

Master data management is a discipline designed to address this problem. The idea being that properly tagged and centrally stored information and its changes will always be visible to users. The best starting point will be to design procedures that allow users to access one copy of a document, edit it and have the changes available to all. Think SharePoint, DropBox…

I see the NHS has moved to radio controlled clocks in the hospitals. The savings made by that move must be tremendous and the punctuality benefits immeasurable. This is a good example for businesses to consider when planning how they will process data across the company.

Brand Loyalty

When I was a child in Trinidad the two main imported bicycles were Raleigh and Humber. Both were from the same company but Raleigh was the ‘must have’ brand and my first bike was a Chopper. Looking at my family’s collection of bikes today I realised that they were all Raleighs.

During my cycle racing days I always kept an eye out for Raleigh but thought they weren’t up to the performance level of the Continental and newer American brands. A few years ago I started taking the English brand seriously again and the selection for 2013 looks the business. There might be another addition to the collection soon.

As an InfoSec consultant I am always talking about the protection of reputation and how important to is for companies to maintain their public perception intact. With eCommerce it is more important that customers trust that their purchases will be secure and the exchange of goods for money will be seamless.

I am always hesitant to buy from a new online seller. I always check that my trusted online retailers stock what I looking for and if the price is right, I buy from my tried and tested. I am not too sure what I will do if one of those retailers reports/is reported losing my information. It all comes down to how the situation is handled and what treatment is meted out to me as a valued customer.

Coming back to Raleigh, in my opinion they have always portrayed themselves as a trustworthy bicycle company with the widest range of products, tuned for each sector. During the 80s and 90s they maintained that image although the products were not at the forefront of the market. Now that the company is on the rebound, I take pride in being a close witness to that journey.

Right First Time

Last night’s homework was simple. Read an online article, list in your notebook 5 words you need to learn the meaning of and make sentences with each. Simples!

Fifteen minutes passed before I decided to check on the wailing and crying. What was wrong? Dictonary.com does not have the word “anjacent”!! And neither does the hardcopy Oxford dictionary! What to do?!

That was a classic example of how important it is to record information correctly. A lot of time and energy was wasted with a definite dead-end. Unfortunately this is not limited to children but can be found in businesses where information is erroneously collected.

People’s names can be the trickiest because without a standard we can record both the official name and a nickname of someone in different parts of an information system. This is a recipe for frustration and time wasting. How do we translate that Bob = Rob = Robert?

A different name can create problems in obvious systems such as the contacts directory and email but it can also prove to be problematic in granting access control to IT systems. It might be possible for Bob and Rob to be working on two different projects with associated access rights while it is only one person.

This lowers the level of accountability and can waste time correcting the initial mistaken identity. There should be a policy stating how the company supports initiatives to maintain data integrity. It will advise staff to consistently identify themselves.

 There are technologies to help with this. Applications can insist on formats for input, use of ID numbers help, directory services such as Active Directory and OpenLADP, all which must be supported by strong managerial vision.

How Secure Do You Want To Get

I lived on a farm in the countryside where we never locked
the doors. The house was up a 1km track and we were already living where the
crows turn back. Locking the doors seemed a waste of time. Over 2 years there
was never an incident. It was the wind that blew off the roof in a February storm.
We had to move for months while it was repaired.

One risk was covered by our knowledge of the area and the
other was covered by a contract with the landlord. Keeping all our stuff intact
was very important to us and so was having a warm dry house.

Information Security uses a triad of targets to base all its
efforts when protecting data. The Confidentiality, Integrity and Availability
of information are the three. Systems are analysed for their ability to provide
a desired combination for each process within.

Each organisation will decide on the different combinations.
Within a business, sub-divisions will have their own versions of the
combinations. The requirements depend on the value of what item is being
protected and what means are available to lower the risks of not being able to
continue operating.

There are formulas and frameworks to help with these
decisions but my farmhouse experience shows they can be judgements made on the
ground. The common driving factors I believe are the commitment to protect
value and compliance with the laws and regulations.

The trick as in most things is achieving efficiency in
outcomes. To keep an item safe the protection should be as little as needed and
as strong as it should be.

Baked In

There is no silver bullet for how best to bake InfoSec into the behaviour of a company. There will not be much uptake until the benefits of doing this are clear and the penalties become concrete.

The UK’s Information Commissioner’s Office (ICO) has first concentrated on government bodies with respect to DPA infringements and fines but it will also focus on private enterprise when it gets its mechanisms polished. Your company will want to be in a good place then.

The pace of technology is dictating how quickly the traditional role of InfoSec can become redundant. Cloud-based solutions for example allow internal teams to easily adopt a technology without considering the risks. Why? These offerings are 'plug and play' with very low entry barriers. If InfoSec remains a high barrier checkpoint, it will be circumvented. Unfortunately that could lead to a breach and consequential damage to your company.

InfoSec teams need to restructure their position and offering within organisations. InfoSec has to secure more leverage for its function via addition to the development process or continue in the role of final arbiter with respect to near go-live projects. The first opinion is more practical.

To accomplish that takes commitment to advertising the skills and utilities an InfoSec team can offer. Internal blogs are a good place to start. They are easy to publish and do make an impact when done regularly in an engaging fashion.

When the content is consistent, interesting and informative staff appreciate the value of company information, how it is being protected and what role they can play in keeping data secured.

The Guys who set up the Typewriters

Q: Do all employees (permanent staff and staff contracted from other organisations) all receive information security awareness training?

A: Not all staff receive this training but the key
Technical staff do

Ran across this Q&A this week and it led to a thought; we are struggling to set a place for InfoSec Awareness in the arsenal. If there is agreement to support such training, there is still the discussion - to whom to focus it on.

I try to think of Information Security as an eternal endeavour. Humans have been keeping secrets for competitive advantage for a very long time. The change in technology is a constant. If there is a group of people working towards a goal, all should understand the value of the operating information.

If the question above was asked at a large company in the 1920s, will it have been okay to say that the technicians were aware of the value of the information and not the rest of staff? Organisations receive, generate, process, store and dispose of information in numerous formats.

InfoSec efforts should be applied at all points where valuable information and a risk of exposure intersect. The profile and potency of each effort will depend on choices made by the organisation.

One of the weakest points will be staff members who do not appreciate what information means to the business. Training those people will go a long way in increasing the defence of the company’s prime asset, information.

Browser Security

I use Internet Explorer (IE) solely as a matter of habit but also because I believe it is secure enough for web use. I’ve had my assumption challenged a few times by other colleagues who believe that IE is an inherently unsafe browser.

Today I did some online research to determine if the claim of superior online security is a correct one for the non-IE browsers.

My first surprise was the popularity of Firefox. Nearly half of the browsers in use are Firefox and the three types of IEs add up to less. Last time I checked in July 2006, Firefox was at 26%, which, back then, made me feel smug about my IE preference.

2009	IE7	IE6	IE8	Firefox	Chrome	Safari	Opera
October	12.8%	14.1%	10.6%	47.5%	8.0%	3.8%	2.3%
September	12.2%	15.3%	12.1%	46.6%	7.1%	3.6%	2.2%
August	10.6%	15.1%	13.6%	47.4%	7.0%	3.3%	2.1%

Browser Usage for the last three months

The online research I did to find a definite ‘most secure’ browser did produce a clear winner. IE8. I am pleasantly surprised to find it has the best features for defending against Socially Engineered Malware and Phishing. These two vulnerabilities are quite difficult to defend against because they involve the user to a high extent.

When users are not aware of the threats present in an activity it is easier for them to be fooled into acting to the benefit of criminals. Browser makers are now designing technologies that rate websites in order to warn or block users from visiting them.

While IE8 might be the champ, I still believe the user can control how secure the browser runs on their system.

A browser is similar to other applications in that it comes with a default setting. The security level of this in most cases is the lowest and needs to be adjusted for improvement. This should be done as soon as the browser is installed to avoid infections such as spyware. In IE browsers the adjustment can be done in the Tools > Internet Options section. Here is an excellent tutorial on securing your browser.

Web activity contributes the most to the spread of infections and the growth of cyber crime. Securing the browser is a major step towards protecting your system and data. It is not the only step and should be complemented by the use of antivirus software on your computer. Software vendors send out updates, patches, for their products, receiving these updates should be automated as much as possible.

Photo by Amehare

Appetite for Risk 03

We followed the development of a company from a single operator through its growth to one that hired staff and worked with partner businesses. The information handled by the company was now exposed to more people and systems, entities, than at start up and the security practices had to be kept in tandem

As the company expands there will be an increased need to identify where data comes into the view of unauthorised entities. The staff are divided to specialise in different tasks such as Finance where records such as salaries are handled and HR where personal identifiable information is viewed. There must be policies and technology in place to ensure that these two views of company information remain distinct.

As a company grows there is a higher likelihood of exchanging data with external parties. When services are outsourced there needs to be a level of diligence by the client company regarding the security practices of the service company. The client must seek guarantees that the information exchanged is kept safe among the external staff and also not exposed to rival companies using the same service.

A larger company presumably comes under more legislative scrutiny and is subject to regular audits of its processes. Successfully passing these audits is a marketing bonus because it shows the company is responsible in many aspects, such as finance, health and safety and data protection.

I’ve given a very high level view of the importance of data security across all sections of the business spectrum in order to show its importance. The role of an information security consultant is to determine how best a company can safeguard its information and remain compliant with as little technological investment and disruption to business as possible.

At the start up stage there are security tools that are shipped with operating systems and applications that do a very good job. As more information processing systems are brought into the company, the implementation of policy and governance along with additional technology becomes important.

A company that develops a culture of security awareness from the onset will find it a simpler task to protect its data as the business grows and the stakes become higher. The practices of securely backing data, updating software, physically protecting machines, restricting access and ensuring that the systems and information are always available will remain part of the organisation’s operation throughout.

Appetite for risk decreases, information security increases.

Photo by Sean Dreilinger

Appetite for Risk 02

We will continue to look at the changes to the risk appetite that a company experiences along with growth. Part 1 started with a one-man operation that was home based as in the majority of cases. The business has experienced success and is now demanding the owner to make a bigger commitment.

The space at home is no longer enough and does not allow the owner to operate in a highly focussed environment so an office is needed. It may be the garden shed but most likely a rented dedicated space. The setting up of an office signifies the owner’s intention to create a professional atmosphere for his company.

With the increased workload additional staff would be necessary. The owner would now have a higher value attached to his time and although growth continues to be a major goal, there now has to be a system to support the customers who are already on board.

Apart from the hired staff there are operations that will be outsourced to outside businesses such as accounting and application development. The company might decide on using a hosting company to support its website or a payment handler to process purchases.

At this point a lot of information needed to run the company is being exposed to people other than the owner. The company’s staff and that of the outsourced services are privy to the business’ customers’ personal details.

At this stage of the business there will be a need to separate the views of the data held by the business both within the company and among external partnerships. Salaries, accounts, emails are a few examples.

Staff should have personal password protected accounts on machines. Personal email accounts for staff with the owner maintaining ultimate access rights. Data shipped to external parties should be encrypted. Stored data should be encrypted, given a time limit and safely discarded in the end.

It is never too early or too late to develop good information security habits. The earlier the good habits are started, the more mature a protective system becomes.

Mature protective systems avoid the need for constant fire fighting with respect to protecting data and achieving legislative compliance. As the company gets bigger there will be external audits to deal with on a regular basis. In the final part of this series I will look at how an information security system can work to protect data and maintain compliance continuously.

Photo by MissNatalie