admini – Page 175 – CyberSecurity Institute

Institutions Face Bewildering Web of Breach Notification Statutes: GAO Report

Posted on July 28, 2007December 30, 2021 by admini

According to a report issued in June by the U.S. Government Accountability Office, GAO Report 07-737 a number of challenges exist related to complying with the breach notification requirements in state laws or federal banking guidance, such as interpreting ambiguous statutory language, identifying and locating affected consumers, and developing effective notification letters. Similarly, financial intitutions must determine whether misuse of breached information is “reasonably possible,” such as when little information exists about the location of the data, the intent of a criminal who stole data, or the effectiveness of security features designed to render data inaccessible.

Institutions that issue credit and debit cards compromised by a merchant that’s not the institution’s service provider are generally not required by the banking regulators’ guidance to notify their customers, but nevertheless in some cases, they feel obliged to do so. Breaches of credit card information by third parties can adversely affect an institution’s reputation and result in costs related to notifying customers and reissuing cards.

It can also be difficult to identify which consumers may have been affected by a breach and obtain their contact information. This can be a particular problem for entities, such as merchants, that have breached credit card numbers but don’t themselves possess the mailing addresses associated with those numbers. Institutions whose customers’ account information is breached also may incur costs for remedial steps such as canceling existing accounts or replacing affected customers’ credit or debit cards—although such steps may not be required by the applicable breach notification requirements.

http://www.bankinfosecurity.com/articles.php?art_id=512

SOA Security: One Treacherous Journey

Posted on July 28, 2007December 30, 2021 by admini

To lock down a large Web services network involving multiple enterprises, everyone must agree on technologies, even security policies: There’s no use demanding that your employees use biometrics and physical tokens if a partner’s staff accesses the system with weak passwords.

Before buying the elements of SOA security, do your homework, because the market is in flux. On balance, the movement we’re seeing is good news for IT because it means more choices and potentially fewer vendors to deal with. But it also makes buying decisions a lot more complex.

For example, Web services exposed to the Internet need XML firewalls, also known as SOA security gateways. However, this product category is disappearing thanks to ongoing SOA consolidation.

Meanwhile, with XML firewall functionality rolled into everything from management platforms to core switches, what kind of product to use–even basic decisions such as whether to use hardware or software–will depend on the scale and predicted growth of each enterprise’s Web services, as well as any existing SOA infrastructure.

Decisions around encryption and authentication are harder, as they don’t depend on a single organization. Everyone in a Web services extranet needs to be using the same technologies, and right now, there are several competing standards. The biggest conflict is over identity management, the complex exercise of ensuring that a user or process logged on to one company’s systems is authorized to use those of a partner. The first, SAML (Security Assertion Markup Language), is supported by almost everyone–except Microsoft. Redmond prefers the newer WS-Federation, which is more tightly bound to other Web services standards. Although both use XML, the two are incompatible, meaning enterprises with public Web services must either support both or ensure that all their business partners using secure Web services choose the same standard.

To help, Oasis (Organization for the Advancement of Structured Information Standards) created WS-Security, a standard for applying XML Security and XML Encryption in Web services. Its main weakness is that, like all the WS-* standards, WS-Security requires SOAP–anyone doing business with Web services running REST (Representational State Transfer, a way of describing XML Web services that don’t use SOAP) need not apply.

Though WS-Security helps encrypt and sign SOAP messages, it doesn’t say anything about AAA (authentication, authorization, and accounting) or security policies. The exception is federated identity, where the relatively new WS-Federation and WS-Trust are competing with SAML 2.0, an established standard also published by Oasis. The main practical difference is that SAML uses XML Encryption and XML Signature directly, meaning it can work with REST, whereas WS-Federation requires SOAP. SAML also has a large installed base, though this may not count for much because Microsoft has thrown its weight behind WS-Federation and said it will not support SAML.

Unlike some other standards battles, this isn’t simply a case of Microsoft vs. everyone else.

On the public Internet, firewalls were one of the earliest drivers for Web services. Although different organizations have different security policies, almost all need to keep Port 80 open, so vendors and standards bodies gravitated toward text-based protocols that run over HTTP. And, for the same reason, so did attackers and malware. As a result, companies publishing Web services to the Internet have traditionally used application security gateways, appliances that can read and understand application-layer documents, filtering out potential attacks. The deep-packet inspection and understanding of XML required to recognize attacks also makes security gateways useful for XML transformation and routing, and often better at it than management software, thanks to specialized SSL or XML acceleration hardware. The other independent security gateway vendors–Layer 7, Vordel, and Xtradyne–are moving in the opposite direction, toward software and virtualization. Vordel and Xtradyne have always distributed their gateways as software, intended to be installed on dedicated blade servers.

http://www.informationweek.com/news/showArticle.jhtml;jsessionid=AWX5VKJHPYNXCQSNDLRSKH0CJUNN2JVN?articleID=201201384

UK phone records to be kept for a year

Posted on July 27, 2007December 30, 2021 by admini

The Data Retention (EC) Regulations (draft; the final Regulations were unavailable at time of writing) were approved by the House of Lords on Tuesday and signed into law by Home Secretary Jacqui Smith on Wednesday.

“Communications data, such as mobile phone billing data, have a proven track record in supporting law enforcement and intelligence agency investigations and are a vital investigative tool,” said Lord Bassam of Brighton, who proposed the adoption of the Regulations this week in the House of Lords. “Without this data, the ability of the police and the Security Service painstakingly to investigate the associations between those involved in terrorist attacks and those who may have directed or financed their activity would be limited,” said Bassam. “The police and the Security Service’s ability to investigate terrorist plots and serious crime must not be allowed to depend on the business practice that happens to be employed by the public communications provider that a particular suspect, victim or witness used.

The Home Office conducted a consultation on the regulations with the public and industry and said the telecoms industry told it that the collection of internet data was too complicated to be include in the current rules.

“Many respondents felt that the complexity surrounding the internet make the draft regulations an inappropriate framework for implementation of the internet aspects as this would present particular technical and resourcing issues,” said a Government response to the public consultation.

http://www.theregister.co.uk/2007/07/27/data_retention_law_passed/

Study: Internet censorship spreading

Posted on July 27, 2007December 30, 2021 by admini

In a new case not covered by the report, a senior Malaysian minister vowed this week to apply law prescribing jail terms for Web writers of comments said to disparage Islam or the king.

In a speech to the OSCE parliament on Thursday, Kazakh Information Minister Yermukhamet Yertysbayev insisted Kazakhstan was determined to build democracy and create an “e-government” expanding Internet service and making “our media more free, contemporary and independent”.

The OSCE report said Kazakhstan’s state monopoly on Internet providers tended to deter use by making prices for all but very slow and limited dial-up service far higher than those for West Europeans even though Kazakh incomes are much lower.

http://news.com.com/Study+Internet+censorship+spreading/2100-1028_3-6199294.html?tag=nefd.top

Disaster Planning Is Critical, but Pick a Reasonable Disaster

Posted on July 27, 2007December 30, 2021 by admini

Disaster planning is critically important for individuals, families, organizations large and small, and governments.

For the individual, it can be as simple as spending a few minutes thinking about how he or she would respond to a disaster. For example, I’ve spent a lot of time thinking about what I would do if I lost the use of my computer, whether by equipment failure, theft or government seizure. As I a result, I have a pretty complex backup and encryption system, ensuring that 1) I’d still have access to my data, and 2) no one else would. On the other hand, I haven’t given any serious thought to family disaster planning, although others have.

For an organization, disaster planning can be much more complex. What would it do in the case of fire, flood, earthquake and so on? The resultant disaster plan might include backup data centers, temporary staffing contracts, planned degradation of services and a host of other products and service — and consultants to tell you how to use it all.

And anyone who does this kind of thing knows that planning isn’t enough: Testing your disaster plan is critical. Far too often the backup software fails when it has to do an actual restore, or the diesel-powered emergency generator fails to kick in. That’s also the flaw with the emergency kit suggestions I linked to above; if you don’t know how to use a compass or first-aid kit, having one in your car won’t do you much good.

But testing isn’t just valuable because it reveals practical problems with a plan. It also has enormous ancillary benefits for your organization in terms of communication and team building. There’s nothing like a good crisis to get people to rely on each other. Sometimes I think companies should forget about those team building exercises that involve climbing trees and building fires, and instead pretend that a flood has taken out the primary data center. It really doesn’t matter what disaster scenario you’re testing.

The real disaster won’t be like the test, regardless of what you do, so just pick one and go. Whether you’re an individual trying to recover from a simulated virus attack, or an organization testing its response to a hypothetical shooter in the building, you’ll learn a lot about yourselves and your organization, as well as your plan. There is a sweet spot, though, in disaster preparedness. Some disasters are too small or too common to worry about. It makes no sense to plan for total annihilation of the continent, whether by nuclear or meteor strike: That’s obvious.

But depending on the size of the planner, many other disasters are also too large to plan for. People can stockpile food and water to prepare for a hurricane that knocks out services for a few days, but not for a Katrina-like flood that knocks out services for months. Organizations can prepare for losing a data center due to a flood, fire or hurricane, but not for a Black-Death-scale epidemic that would wipe out a third of the population. No one can fault bond trading firm Cantor Fitzgerald, which lost two thirds of its employees in the 9/11 attack on the World Trade Center, for not having a plan in place to deal with that possibility.

If your corporate headquarters burns down, it’s actually a bigger problem for you than a citywide disaster that does much more damage. If the whole San Francisco Bay Area were taken out by an earthquake, customers of affected companies would be far more likely to forgive lapses in service, or would go the extra mile to help out. Think of the nationwide response to 9/11; the human “just deal with it” social structures kicked in, and we all muddled through.

A blogger commented on what I said in one article: Schneier is using what I would call the nuclear war argument for doing nothing.

Bird flu, pandemics and disasters in general — whether man-made like 9/11, natural like bird flu or a combination like Katrina — are definitely things we should worry about.

http://www.wired.com/politics/security/commentary/securitymatters/2007/07/securitymatters_0726

Virtualization’s New Benchmark

Posted on July 27, 2007December 30, 2021 by admini

Chris Farrow, director of the center for policy and compliance for Configuresoft, says the creation of a security benchmark for virtual machines began last year.

Some large financial firms were retooling their data centers with virtualization, and they urged CIS to consider addressing virtual machine security as well.

“We found that no one was building a best-practices [model] for securing the virtual infrastructure,” says Farrow, who works with the CIS, which is made up of vendors, universities, consultants, government agencies, and enterprises.

Configuresoft is among the organizations working on the security benchmark, which will include benchmarks for specific virtualization software, including VMware’s ESX Server, Microsoft’s Virtual Server, and Xen Virtual Machine. To prevent malicious activity from a “guest” virtual operating system, for instance, the benchmark recommends disabling the copy-and-paste operations between the guest OS and the remote console, says Joel Kirch, information assurance programs manager for WBB Consulting and a member of the CIS team working on the virtualization benchmark.

http://www.darkreading.com/document.asp?doc_id=130189&WT.svl=news2_1