Michael Mongold's Technology Security

Study shows weak encryption adoption

Generally, when I see a study come out that is performed by some group or institute for a player in the field that is being surveyed, I am often skeptical of the results. It is just hard for me to see the propriety in it.

However, in a recent study by the Ponemon Institute performed for PGP, I found myself shaking my head in disbelief for another reason: There is no way that nine percent of companies have a comprehensive encryption scheme.

I would say one in one thousand would be an exaggeration.

I must assume that the responding organizations' concept of a comprehensive encryption scheme and mine are far different. I believe that if you looked solely at whole disk encryption on laptops we would still be at a one in one hundred ratio. Once you figure in the other places that sensitive data can reside in an organization, I believe you will find that the ratio starts to really stretch out.

That's not to say that many organizations are not pursuing a larger role for the encryption of their data. I spoke with approximately fifty IT managers at an information management consortium meeting yesterday that had excellent questions and seemed to understand the necessity for the technology.

But ultimately it comes down to money, resources, political will, and urgency. The agenda for most organizations (from a security perspective) is dictated by perceived need or threat and the cost of action/inaction.

If you remember back to your economics class when your professor discussed the idea of an opportunity cost, it becomes directly relatable to security in a very quantifiable way. The necessity of urgency can easily be demonstrated on a daily basis by the number of organizations that lose data and spend more money on investigating the loss, damage control with their customers, and then performing some emergency encryption in an attempt to save face - when all they had to do was encrypt the data ahead of time and save themselves all of that drama (and possibly their jobs).

Make sure the people that own the pocketbooks of your company/agency understand the economics of data loss. If they believe you can afford to wait on data encryption, get them to put it in writing...

Michael Mongold

Technorati tags: Michael Mongold, data theft, PGP, Ponemon Institute, Data encryption

Encryption Cloud

I have been speaking to some of my clients over the past few weeks about an "encryption cloud". It is the idea that there are many different ways that data can escape from an organization and to protect that data requires a larger approach than just whole disk encryption.

Right now, many companies and agencies are just trying to get a handle on all of the laptops they have that leave the relative safety of their offices every day. This is a great first step and one that should not be procrastinated on. However, any security policy is only as good as its weakest link. Unencrypted PDAs, CD-RWs/DVD-RWs, thumb drives, iPods, P2P software, etc. represent paths along which large amounts of sensitive data can quickly appear in the wrong hands.

That is why you see different encryption manufacturers producing a wider variety of solutions to try and stem all of the leakage points. Secure E-mail, encrypted network shares, tape and database encryption are all areas that must be included in a comprehensive encryption solution. Data at rest and data in transit must have a way to be centrally managed to provide for the ease of use and management while always providing the most security.

Pretty soon a cloud of encrypted traffic within your network appears and extends out to to encompass mobile devices taken to client's sites or user's homes.

Encrypting data is not hard to justify if you ask the right people. And I am not talking about people within the encryption industry. I am speaking of organizations like Neiman Marcus who just announced they "lost" the names, addresses, social security numbers, birth dates, and salaries of over 160,000 current and former employees. Of course, the sad part of this is that it wasn't really Neiman Marcus that lost their entire staffing history but a pension-benefits consulting firm that NM had hired. The contractor's guidelines requires them to encrypt their information but strangely, they cannot confirm if the data was encrypted or not (Ahem, whole disk encryption would have not made that an issue).

Be sure to read the whole article and be glad it's not your organization that they are talking about. :)

Michael Mongold

Technorati tags: Michael Mongold, Neiman Marcus, Encryption Cloud, data encryption, data theft

Cancer patients' data stolen...

Thieves have no conscious and this is definite proof of that.  I believe it also shines a light on the fact that we have a tendency to minimize the risk of having unencrypted devices that may not seem so portable. What is more likely to have sensitive data on it? A laptop or a server? The answer will typically be a server. Of course a laptop has a higher likelihood of being lost or stolen, but those are usually more a crime of opportunity whereas someone that steals a server is out to perform some serious damage.

I believe that you need to prioritize your devices by sensitivity of data and probability of loss. If you weigh both elements you might find that certain segments of your mobile workforce AND certain segments of your desktops/servers need to be addressed first.

If you have groups within your organization that are at an elevated level of exposure or have information that is significantly more sensitive then consider deploying a solution that addresses those groups first from a panoptic approach. That may mean that you focus on a specific group within your organization or a subset of devices and perform whole disk encryption, PDA encryption, USB/CD-RW/DVD-RW restrictions, and removable media encryption within just that group.

Additionally, adding to that mix a network access solution that insures there is no P2P software to siphon data off of the device can provide some additional assurance.

Finally, a quick thanks to the organizations that I spoke with this week in Detroit. It is always interesting to see how universal the needs are of those I speak with.

Ultimately, everyone is faced with the same obstacles and hurdles both internally and externally. The positive side of that is that there are mature products and processes that can be implemented to clear those hurdles.

Michael Mongold

Technorati tags: Michael Mongold, UCSF, stolen server, data Security, data encryption

Encrypted world

I initially wanted to write today's blog about Disk Encryption and Pre-Boot Authentication but quickly realized that I would never get it published today due to my preperations to be in Galveston this weekend and Detroit all of next week. So, I will just hit on a point that is beginning to ring louder and louder for many organizations. All information is becoming electronic. Yea, everyone know that. However, it's not just that more devices are now mobile and have the capability of carrying more information, but it is also the fact that more information now resides in an electronic format than ever before. As Richard Moulds points out in his article today, everything from gambling machines to new projectors in movie theaters deal only with digital information.

What's the security spin? Before we started storing all of our documentation in digital media, someone needed physical access to the information in order to aquire it. I couldn't steal a document off of your desk at your job in Chicago unless I was in Chicago and was able to get into your office. Now we live in a world where we have more means of accessing more data.

That is a pretty good thing unless you are worried about a global catastrophe wiping out most of the knowledge accumalated in the last thirty years. Of course, the most likely source of problems associated with this migration from physical information is the same as its greatest benefit: its accessability.

Granted, we may not care that our personal information is so readily available as our society evolves. Once we are able to make some form of bio-metric authentication ubiquitous throughout our work and personal life, perhaps we will feel more comfortable that anyone accessing our data will have the proper authority to do so. Then again, we may feel even more exposed than ever before.

The main point that I want to make here is: we will have more data available to more people than ever before and that without encryption we will have less control than at any point in history. Organizations that have sensitive data that they need to protect will have to rely more and more on technology security and the people behind it, as analog information slowly fades away.

Michael Mongold

Technorati tags: Michael Mongold, Technology Security, encryption, data Encryption, Richard Moulds, Secure Computing

Encryption and Live CDs

I was reading a great article this morning written by Dr. Eric Cole titled "The Secrets of Laptop Encryption." I think that the article is a great place to start if you are trying to bring yourself up to speed on encryption and how it works. Also, it discusses some of the caveats of encryption and where some of the pitfalls (in what I call encryption confidence) can get you burned.

One example of encryption confidence that Dr. Cole produced was of an executive that lost a briefcase with an encrypted laptop inside. Initially the security team at the executive's organization was happy to dismiss the lost device because they had the foresight to encrypt the hard drive. But then they discovered that a PDA was also in the briefcase, unencrypted, with the same passwords that the executive used on his laptop. Thus the PDA became a potential threat vector for the data on his laptop.

Most organizations do not see the PDA as a high enough threat to warrant attention at this phase of the game. The truth is, while you are encrypting one device, you might as well encrypt all points that might easily be compromised for its password or the data on the device itself.

So, I really did enjoy Dr. Cole's article and highly suggest you check it out BUT there is something I would like to point out.

Near the end of the article under the heading of "Scope of Needed Protection", Dr. Cole writes of the dangers presented by Live CDs.

If you're unaware of what a live cd is, then you should take a look at BartPE, WinPE, Backtrack, Knoppix, and DSL. There are also other tools that you can boot to and change passwords, such as EBCD. Live CDs can be a lifesaver for an admin or general user. These tools allow you to reset passwords, change passwords, edit the registry, copy files, etc. In a word, invaluable. However, these actions by a person trying to help can also be duplicated by someone trying to gain unauthorized access to your hard drive. Typical examples include when an attacker boots to a Backtrack CD then attempts to run L0phtcrack/Cain and Able/John the Ripper/Ophtcrack against your SAM or runs your hard drive as a secondary and views your documents from their primary boot drive.

With a fully encrypted hard drive this is not possible without a module that plugs into a livecd and allows you to authenticate to the hard drive. Utimaco provides a BartPE/WinPE plugin that allows an admin to authenticate via BartPE to their SafeGuard Easy product. This gives owners of SafeGuard Easy the ability to boot from BartPE but still requires them to enter the username and password so it can authenticate and allow the hard drive's data to be viewed.

It is important to note how vulnerable a laptop is to an attacker that boots your computer from anything other than your hard drive. It can mean serious trouble unless you have a full disk encryption product. If you have your data encrypted, it doesn't mean you can stop worrying, it just means you can worry about something else.

Michael Mongold

Technorati tags: Michae l Mongold, Technology Security, data Encryption, Dr. Eric Cole, L0phtcrack, Cain and Able, John the Ripper, Ophtcrack, SAM, Utimaco, SafeGuard Easy, LiveCD, EBCD, BartPE, WinPE, Knoppix, DSL, Backtrack, encryption confidence

Burn me twice, shame on me...

IT Policy Compliance Group has released a report showing 68 percent of companies lose sensitive data each year and have sensitive data stolen six times a year. Sadly, twenty percent of those companies lose sensitive data... (are you ready for this?) - twenty-two times OR MORE per year.

Hmmm. To quote the Captain in Cool Hand Luke, "What we have here is, a failure to communicate."

Apparently, quite a few organizations do not look at data protection as an essential business practice.

The first part of a solution for data protection is the technology. Anyone who has worked on their car or had to perform some handy work around the house knows that having the right tool makes all of the difference. Data security is no different.

The second part to the technology is the resources. Without people to confirm that the technology is implemented properly, the solution is incomplete. Assessments and processes are what separate the chaff from the wheat in the world of data security.

What about your company? Where is your organization at in the encryption adoption process?

The right people will recommend the right actions and the right technology to protect your company from the wrong people.

Make sure that your organization does the right thing and finds a good combination of the two.

Just a side note: Folks, if you buy the software, get it installed. If you are panicky and in a hurry before you bought the software, then stay focused until it actually gets installed. I've seen some organizations that will push to purchase the technology like their house is on fire (which is an appropriate analogy) and then once the PO is completed, the deployment is shuffled to the back of the deployment queue. Sorry, but all IT needs are not equal and you have to treat the deployment of a data security technology with the same sense of urgency that you purchased the product.

Michael Mongold

Technorati tags: Michael Mongold, IT Policy Compliance Group, Data Encryption, Data Security

Whoa there, encrypted traffic!

So for quite some time now, Rogers Communications in Canada has been shaping their traffic and that should be no real surprise to anyone. QOS is a common process in MSOs and this is how it has been for a number of years. But Rogers is now on a path to make traffic shaping become much more well-known to our neighbors to the North.

P2P networks generate beaucoup traffic and suck up a lot of bandwidth for organizations like Rogers, Time Warner, Comcast, etc. To combat this issue, a number of years ago they started de-prioritizing packets that looked like P2P traffic. In response, this led P2P organizations to begin encrypting their traffic to obscure its content from prying eyes.

So, to beat the miscreants at their own game, Rogers has decided that their response is to de-prioritize (thus slow) encrypted traffic. Jeepers! Apparently Rogers' zeal for cleansing its network of P2P traffic has blinded them to the collateral damage that might be generated by their actions.

My take on this is, that the message that organizations should be sending out is certainly not one where encrypting web traffic is penalized. I really do not have an answer for this one yet, but I believe it is a bad precedent to set.

The problem here, of course, is that a number of people connect into their network via encrypted tunnels. Hopefully, everyone connects into their bank via an encrypted session. Also, anytime you purchase anything over the Internet or when your personal information is requested, the traffic is typically encrypted.

Additionally, bittorrent and limewire are not illegal (yet). There ARE legitimate uses for these services, whether they are the primary reason they exist or not, is another question.

Here is a little bit of the conflict that I see in this:

• Should companies be allowed to shape their service to best suit the needs of their customers as they see it?
• Should customers pay for a service that they feel does not adequately provide the functionality they seek?

I believe that companies should be allowed the flexibility to make their product cater to their market however they see fit, as long as the market has the ability to go elsewhere if they do not like the product.

So, Rogers customers - if you need your encrypted traffic post haste then I would recommend letting Rogers know or find another ISP that will take your business and give you the service you require.

I encourage other ISPs of the unintended consequences before making a decision to de-prioritize encrypted traffic.

Michael Mongold

Technorati tags: Michael Mongold, Rogers Communications, Slashdot, bittorrent, P2P, encryption, traffic shaping, MSO, ISP, LimeWire

Dangers of working mobile

Just a little tidbit from "News of the Weird" before you get out there on the roads for the Easter weekend...

 

"California Highway Patrol officers at the scene near Yuba City, Nev., said the 28-year-old driver that crossed into oncoming traffic and fatally crashed into a Hummer in February was, perhaps, working at his laptop computer while driving. Though the screen was shattered in the crash, the computer was open in the seat beside him and plugged into his car's cigarette lighter. [Los Angeles Times-AP, 2-27-07]"

The perils of the mobile workforce continue to grow. SO, make sure you practice safe computing and have a safe and happy Easter weekend!

Michael Mongold

Technorati tags: Michael Mongold, safe computing

Who will audit the auditors?

There is an alarming interesting report that has been published by the Treasury Department. This report details how the Internal Revenue Service lost or had stolen nearly 500 computers over a three year period (2003 to 2006). The document continued by stating that in a separate investigation conducted by Treasury Inspector General for Tax Administration, revealed out of 100 IRS laptops, 44 contained unencrypted sensitive information.

There are other issues that were evident to the Inspector General, such as the fact that sensitive data was not always encrypted on flash drives, CDs, and DVDs, a lack of education and awareness of encryption policies, and incorrect configurations on the devices that allowed the inspectors to bypass the current security controls.

And for the sake of brevity, I will not even go into the issues found involving securing backup media and user provisioning.

Once again we find a large organization that is overwhelmed by the burden of controlling sensitive data in a mobile workforce. This is not going to change for the better, but instead will consistently worsen until organizations are faced with enough financial pain to spur them into action.

Sure, we all recognize that security is important. But unfortunately, it is not enough, soon enough. Ultimately, I do not want to tell my customers that I am incapable of being entrusted with their personal information. Do you?

It comes down to responsibility and in this instance, the IRS is being irresponsible with its customer's (the American taxpayer's) personal information and that is not acceptable. Education and technology are the tenets that security should be built on and it is failing us because organizations are more inclined to be reactionary instead of proactive.

If TJX would have spent the $5 million they have already spent investigating where the losses occurred, on thorough assessments and education - they might have saved themselves so much more.

Organizations are in triage mode when they should be focused on more preventative measures.

The recommendations offered by the Inspector General are sound and will go a long ways towards helping the IRS stem the flow of bad press. If they listen...

Unfortunately, there is little guarantee that will occur. The Inspector General "reported similar findings in July 2003" but it did not result in "adequate corrective actions." Obviously.

This leads me to the conclusion that organizations will not really take ownership of their role as protectors of their customer data until they are hit where it hurts most: the wallet. Of course, anyone in corporate America is not going to be surprised to see their organization talk about security but delay action until the media smells a story or the government steps in.

If you are responsible for the data security budget of an agency or company, it is time to wake up to the realities of mobile technology. Data that people hold valuable is very accessible, to both the employees of your company and those who would profit from its misuse.

If the IRS (or any organization) wants us to trust them with our personal information, they should prove they are worthy of that trust.

Educate your employees about the necessity of safeguarding their data, at the very least encrypt all hard drives on mobile devices, lock down/encrypt removable media, perform more accurate monitoring of data traffic, use frequent assessments to keep you on the right path, and then follow through on those recommendations the auditors make.

I would even add that controls should be put in place that enforce all connecting drives to be encrypted and all connecting devices meet the security policies of the organization before they are allowed access to the network. Ahem, NAC.

The processes and technologies are there if the companies and agencies will get on board. Perhaps then we can trust them as much as they expect us to.

Michael Mongold

Technorati tags: Michael Mongold, Data Encryption, Encryption, IRS, Internal Revenue Service, TJX

NAC it in the bud

Purely on the merits of prose alone - Stiennon 0 Hoff 1

Of course, I have to wonder what Richard was thinking when he wrote his self-congratulatory post on Tuesday. Now, I will not be able to wax as poetic as Christofer Hoff. Alan Shimel has already differed to the points made in the verbose retort at Rational Security. However, I would like to add a word or two to the fray.

First - I do not think that the steps made in the exploit were "trivial". Roecher and Thumann followed a sound methodology to spoof the CTA and followed that process to include even reporting false information regarding the state of Trend Micro on the device. Great job, guys!

Second - Cisco has known about this vulnerability and has responded that through 802.1x this issue goes away. Hmmm, yes, but that doesn't really help the vast majority of organizations out there, does it? That was a rhetorical question.

Third - although Cisco has received some negative press for this, I would like to step forward and say "good on you" for not trying to stifle this presentation as you have done in the past. It is good to see that they are not being as much of an ass to those who ultimately are helping them do their job.

Fourth and last - I cannot find anyone who is willing to come forth and state that NAC is the end-all of all end-alls for network security. It is another tool that gets us closer to where we want to be. I know I am stating the obvious but apparently that is something worth getting credit for.

Michael Mongold

Technorati tags: Michael Mongold, Richard Stiennon, Christofer Hoff, Alan Shimel, Dror-John Roecher, Michael Thumann, Cisco, Trend Micro, NAC, vulnerability