Enter your email address:

Delivered by FeedBurner

Recent Comments

Ways to stay connected...

« April 2007 | Main | June 2007 »

May 2007

May 10, 2007

Insult to injury

Ah, the poor, often maligned TSA. It really hurts that they lost a laptop containing the names, Social Security numbers, birth dates, bank accounts, and routing data of 100,000 of their past and present employees. Now, they are being sued by their employee union for being lax on security.

It's never a good sign when a government organization that has the word Security in it is being sued by it's own employees for a LACK of security. That is just not very reassuring. But, hey, at least they caught the fact that I had a button fly on my last trip to SF. Just kidding, Kip! I'm probably already going to be audited for my comments on the IRS, I don't want to make my traveling anymore convoluted than it is.

So, back to the lawsuit: The American Federation of Government Employees's national president, John Gage, stated today that the TSA's "reckless behavior is clearly in violation of the law."

Besides facing a lawsuit (only one so far) and looking incompetent, the TSA is paying Identity Force to monitor their employees credit for one year and provide up to $25,000 in identity theft insurance.

However, the union is looking for a little more love.

They are seeking to force the TSA to comply with the 2001 Aviation and Transportation Act and the 1974 Privacy Act. Also, they want the TSA "to grant administrative leave to transportation security screeners requesting leave in order to protect against or correct identity theft or financial disruption caused by this data security incident."

Also, they want their credit monitored for the next five years, plus pay for any damages that result from the theft, plus pay each employee who was adversely affected by the theft the amount of $1000 (potentially $100,000,000.00 if you're keeping track), plus all legal fees.

Ouch!

This is, of course, in addition to the fact that we have the Secret Service and the FBI spinning cycles trying to hunt down this laptop, which if would have been encrypted, would not have even been reported. Of course, the FBI does not have a good record finding laptops, so don't get your hopes up that this one is going to make it back.

The only good thing about the TSA's actions is that they reported it the day after they lost it instead of weeks or months later.

Oh well. The future of the encryption industry looks good...

Thanks, Kip!

One last thought: if you're keeping track of the letters that are sent out to people when an organization looses their data - please add this to your rapidly growing collection.

Michael Mongold

Posted by at 04:55 PM | | Comments (0) | TrackBack (0)

| | | | |

May 09, 2007

The most dangerous device

Thumb drives have been listed as the top security concern by a resent poll of 370 IT professionals. And for good reason, if your organization fails to frisk and search every person that enters and leaves your buildings for removable media, you may be exposing yourself to a large data loss in the near future.

Of course, a trade-off must be made between what is an acceptable level of intrusion into your employees' personal space and the amount of risk you are willing to assume.

Some employers would have a difficult time keeping their positions filled if they burdened their employees with complex and aggressive physical security measures. While other organizations, such as Sandia National Labs or the National Security Agency, come with certain expectations that security is going to be taken to another level.

Regardless, some measures to address this issue must be taken.

According to the market research conducted by Centennial Software (bias alert - they manufacture a solution to the problem - of course), 80% of the respondents do not "have effective measures in place to combat the unauthorized use of portable devices." The report continues by saying that 8.6% of the organizations polled have completely banned the use of portable devices. Which makes me extremely curious how they have achieved this total ban, but that was apparently not documented.

Plus, it should be noted that the responses pulled from IT managers while they were attending a technology security oriented conference so the posture of these organizations may be slightly skewed from the norm.

The most important component of this article is the fact that IT managers are becoming aware of the dangers these little devices can present.

USB devices represent so much convenience that it has been easy to ignore the perils they can provide.

It is important to look at this as a bi-directional danger. It is not just the fact that someone could suck 80 GB of data off of a hard drive, but the fact that someone could place any number of malicious programs and/or code onto a network from within the organization.

And where there is a problem, there's a buck to be made.

As a result, there are a number of manufacturers that are beating a path to help organizations protect themselves. See Utimaco, Pointsec, Guardian Edge, Centennial, SafeBoot, and SecureWave among others...

So, the software you decide upon should provide the following functionality:

  • Block unwanted devices
  • Encrypt data written to USB devices
  • Allow data to be shared on authorized devices by authorized users

Also, remember that, unlike whole disk encryption which does not need to be intrusive into your end user's experience, device control requires policies to be created and the enforcement of those policies - which may rub some of your sensitive customers the wrong way.

See? Now doesn't that sound simple?

Michael Mongold

Posted by at 10:25 AM | | Comments (0) | TrackBack (0)

| | | | |

May 08, 2007

The Universal Adoption of Encryption

The magnanimous Nigel Dessau, SVP at Sun, has decided that the world of encryption would be a better place if everyone just agreed to get along. And to show his sincerity, Sun is giving away their Key Management System! Well, technically they are just opening up their APIs so you can connect your encryption product into their KMS, but it's a start.

IEEE has been working a number of years on a standard for key management identified as IEEE-P1619. P1619.0 refers to a disk storage standard, P1619.1 identifies a tape storage standard, and P1619.2 addresses wide-block encryption standardization for disk drives.

These are, of course, important steps.

Encryption will eventually be a ubiquitous technology requiring a heterogeneous environment which will allow all of the different players to work together. We are slowly rapidly approaching an encryption cloud that will encompass all devices and protect any and all sensitive data.

This results in one of two scenarios:

We purchase everything from one vendor and pray that they have a solution that encompasses all of our needs.

or

We purchase the best of breed products from  different manufacturers and pray they all work together.

The first option does not scale.

The second option pushes us towards an open standard that allows us to have one Key Management System that is able to store and share our keys for tape backups, full disk encryption, network share encryption, removable media encryption, CD-RW/DVD-RW encryption, etc.

This is the path we are most likely to prosper along.

No organization will be able to provide you the best solution for such a disparate group of technologies. Key management is inevitable, thus consolidation and standardization is the best solution.

So, while Sun may or may not see much movement towards their KMS and regardless of their motivation, their efforts are noteworthy.

Over the next twelve months, I look forward to other organizations stepping forward and showing us who the true leaders in encryption are going to be in the universal adoption of encryption.

Michael Mongold

Posted by at 11:01 AM | | Comments (0) | TrackBack (0)

| | | | |

May 07, 2007

TSA Security - Not So Much

Our government certainly knows how to set an example for its citizens. Ok, maybe more as an example of what not to do, but I'm trying to put a positive spin on this somehow.

It appears that the friskers have lost a laptop containing "personal, payroll, and bank information of 100,000 current and former workers" of the TSA.

 Can I get a "D'oh!"?

The laptop contains "employee names, Social Security numbers, birth dates, and bank account and routing information".

Obviously, the FBI is not going to be of much help since they lose nearly three laptops a month themselves (a few years ago they lost nearly eleven a month!). Actually, the FBI may need to look at the TSA as an example because at least the TSA knows what was on the laptops they lost. (Of course, I am not sure how confident we can be in the TSA's mea culpa at this point) 

Funny Scary sidenote: One of the laptops lost in the Boston area included software for creating FBI identification badges.

And if we look to the Internal Revenue Service to help us identify a government organization to help shine a light on the protection of sensitive data, they will need to direct us elsewhere because they are certainly in no position to assist us.

Of course, I have examples of many many more government agencies that have been caught bumbling their (our) sensitive data. But, to what effect?

The problem is not so much that these agencies are losing laptops; the problem is that they are losing laptops that contain unencrypted sensitive data.

Smart? Prudent? Responsible? Not so much.

Michael Mongold

Posted by at 10:49 AM | | Comments (0) | TrackBack (0)

| | | | |

May 04, 2007

Crossroads / HP Encrypts!

HP Encrypts!

First, let me give a big "Kudos!" to our friends at HP. It is good to see another computer manufacturer "get" the importance of hard drive encryption.  Also, congrats to SafeBoot for getting in there and making the deal happen. I know from first hand experience that can be an extremely tough battle to wage.

According to the information I've seen, it looks like they are pushing PBA, which I feel is not worth the inconvenience. Kind of like the whole TPM integration, but that's just me.

Regardless, I think it's a great step for HP and their customers. Hopefully we will see others follow Lenovo's and HP's lead...

---------------------------------------------

Crossroads

Last week I had the opportunity to discuss tape backup encryption with a local Austin company, Crossroads. I was very impressed with their line of products and how solid their presentation was. I specifically liked their agnostic approach to encrypting whatever tape backup system a company may be using.

I am a big fan of solutions that leave you the flexibility to work with a variety of vendors so you can insure you are maximizing the performance you get for your dollar. I look forward to learning more about their product line in the coming weeks.

Tape encryption is another piece of the "encryption cloud" that organizations need to insure their data is protected.

That's all for now. Everyone put your laptops down for a little while, get outside and enjoy your weekend!

Michael Mongold

Posted by at 11:52 AM | | Comments (0) | TrackBack (0)

| | | | |

May 01, 2007

GSM Encryption

There have been some high profile cases of eavesdropping or wiretapping involving cellular phones in Italy recently. While this hasn't quite exploded onto the US scene yet, it isn't much of a stretch to envision some organization that would go to those lengths (think Wal-Mart or HP's little faux pas).

Of course, I mention this because there is a solution that is available to help head this off before it even becomes an issue.

Cryptophone makes a device that can encrypt all GSM traffic to and from the phone. I suspect that over the next couple years you will be hearing more about this technology and the exploitation of it.

It goes without saying that any method of communication that conveys data that is considered sensitive or personal in nature, can and will be exploited. It is only a matter of time...

Michael Mongold

Posted by at 03:14 PM | | Comments (0) | TrackBack (0)

| | | | |

Subscribe to this blog's feed

April 2011

Sun Mon Tue Wed Thu Fri Sat
          1 2
3 4 5 6 7 8 9
10 11 12 13 14 15 16
17 18 19 20 21 22 23
24 25 26 27 28 29 30

Recent Posts

Headlines from the Security Roundtable

  • Headlines from the Information Security Blogosphere
    Add your feed to this box

    Security Catalyst

    ©Viralinks

Categories

Archives

Blog powered by Typepad

About