Category: Regulations

The lawmakers decided to propose the legislation after the Department of Homeland Security failed to provide adequate information about the searches or the limitations on the power, Feingold said in a statement.

The legislation is the second bill to tackle the controversial issue of laptop border searches.

http://www.securityfocus.com/brief/832?ref=rss

Not surprisingly, the proposal for such a technology was first suggested by a Chinese official, who has long tried to control the use of the internet in that country.

Also, as the article notes, the ITU has no power over the internet these days, but has been pushing to get more power, which is why it’s worth following what they’re discussing behind the scenes.

http://www.techdirt.com/articles/20080912/1602272259.shtml

The controls have been a recommended best practice for nearly two years now, but starting June 30, they will become a mandatory requirement under PCI — especially for so-called Level 1 companies that handle more than 6 million payment card transactions a year.

Under the requirement (PCI Section 6.6), merchants can choose to implement a specialized firewall to protect their Web applications, or to perform an automated or manual application code review and fix any flaws found. Companies also have the option of performing either a manual or an automated vulnerability assessment scan of their Web application environment, fixing any problems that are discovered during that process.

The controls are supposed to protect Web applications from common threats like SQL Injection attacks, buffer overflows and cross-site scripting vulnerabilities. For instance, excess-inventory retailer Overstock.com chose to install a Web application firewall from Breach Security Inc. rather than take any of the other options. Going that route was considerably cheaper than doing an application code review, said Bear Terburg, manager of network engineering at Overstock.com. The tool was “much easier” to implement that any of the other compliance options available under PCI 6.6, said John Halamka, CIO at Harvard Medical School. “The effort of going through application code every time a new vulnerability is discovered would be a far more daunting task.” The firewall also makes ongoing recommendations for tuning or adding new signatures when a new vulnerability is discovered or to block out specific Web threats, he said.

Bob Russo, general manager of the PCI Security Council, said that so far his organization does not have a clear indication of what companies are doing in terms of complying with PCI 6.6.

http://www.computerworld.com/action/article.do?command=viewArticleBasic&articleId=9104118&source=NLT_AM&nlid=1

The letter came ten days after a federal appeals court in the Central District of California ruled that border agents could search laptops without reasonable suspicion of illegal activity. “In a free country, the government cannot have unlimited power to read, seize, store and use all information on any electronic device carried by any traveler entering or leaving the nation,” the signatories stated in the letter.

The level of surveillance by the United States government has become an increasing worry to civil-rights advocates as well as professional, minority and religious groups that believe their members could be targeted.

As part of its “War on Terror,” the Bush Administration has instituted a program to eavesdrop on Internet and phone communications, an initiative that violates the Foreign Intelligence Surveillance Act (FISA) and has become the focus of a battle in Congress to craft a new law to govern such wiretapping.

The Electronic Frontier Foundation, a digital-rights group and one of the sponsors of the letter, has requested information on the conditions that would trigger a digital search by border agents. “We don’t really know what the Department of Homeland Security’s procedures and practices are here,” said Marcia Hofman, a staff attorney with the EFF.

The case at the heart of the debate concerns whether evidence from the July 2005 search of a laptop owned by then-43-year-old Michael Arnold can be used by prosecutors. Returning from a three-week trip from the Philippines, Arnold was stopped by customs agents in Los Angeles International Airport and asked to show that his laptop was functioning, according to court filings. Perusing through the files in those folders, the agents found pictures of two nude women and decided to conduct a more thorough investigation, which turned up suspected child pornography.

The Association of Corporate Travel Executives, one of the letter’s signers, recommended that workers not use their personal laptops for international travel and limit the amount of proprietary and personal data stored on any notebook computer taken across borders. “In a time of heightened international security, it will take a brave Congress to rule that parties may not be subject to suspicionless searches,” Susan Gurley, the executive director of ACTE, said in a statement.

Following the ruling, there is nothing preventing authorities from a more comprehensive search program, said Fred Schneider, a privacy and security expert and professor of computer science at Cornell University. “It won’t be long before customs agents can efficiently perform a thorough search on every machine,” Jennifer Granick, civil liberties director at the EFF, said in a discussion of the impact of the ruling.

Encrypting the hard drive, having a separate account on the PC owned by the worker’s company, or traveling with a clean laptop and using an encrypted VPN to access data are all possibilities, Granick said.

http://www.securityfocus.com/news/11516?ref=rss

The Supreme Court of the state of New Jersey said that information about a person’s use of the internet was so private that police there cannot order ISPs to release surfing details of suspects with a municipal court subpoena. They must receive a grand jury subpoena, it said.

“The court holds that citizens have a reasonable expectation of privacy in the subscriber information they provide to internet service providers,” said the court’s ruling. “Law enforcement officials can obtain subscriber information by serving a grand jury subpoena on an Internet service provider without notice to the subscriber.”

Many are unaware that a numerical IP address can be captured by the websites they visit. After Reid’s ISP, Comcast, handed over details of her account, including the IP address from which she accessed the internet, she was found guilty of computer theft in connection with the hacking incident. Reid overturned that decision on appeal and at the Supreme Court of New Jersey stage, arguing that the evidence should be suppressed.

The court said that although Reid was successful in having the municipal warrant-obtained evidence suppressed, the police were not barred from approaching Comcast again and obtaining the records using an appropriate warrant.

http://www.theregister.co.uk/2008/04/24/us_rules_ip_addresses_private/

Requirement 11.3 addresses penetration testing, which includes network and application layer testing, as well as controls and processes around the networks and applications. Proper use of automated source code analyzer (scanning) tools.

The second option for Requirement 6.6 is a Web Application Firewall (WAF) which is a security policy enforcement point positioned between a web application and a client end point.

The Information Supplement provides recommended capabilities of a select WAF, additional recommended capabilities for certain environments, additional considerations for organizations implementing a WAF and additional sources of information on Web application security.

http://www.net-security.org/secworld.php?id=6053