Category: Uncategorized

At Citizens & Northern Bank, a $1.2 billion community bank headquartered in Pennsylvania, log management is a requirement for complying with information security regulations such as Gramm-Leach-Bliley and Sarbanes-Oxley. The auditors who review the bank’s systems interpret those laws to mean that it should be actively monitoring those logs. “As administrators responsible for various network devices and operating systems, we need to know what typical behavior is,” says Pete Boergermann, head of MIS at Citizens & Northern.

The FFIEC has stated that “log files are critical to the successful investigation and prosecution of security incidents and can potentially contain sensitive information.

While collecting and storing logs is important, it’s only a means to an end — knowing what is going on and responding to it. Network intrusion detection systems often produce false alarms of various kinds (“false positives”, etc.) leading to decreased reliability of their output and inability to act on it. Comprehensive correlation of network intrusion logs with other records such as firewalls logs, server audit trails allows companies to gain new detection capabilities from such correlation (such as real-time blocking and attack mitigation).

It’s also critical that logs be converted into a universal format which allows financial institutions to compare and correlate different log data sources.

http://www.bankinfosecurity.com/articles.php?art_id=242

Internal auditors at the Massachusetts Department of Revenue (MDOR) — which administers the tax and child support laws of the Commonwealth of Massachusetts — use a combination of automated and manual data surveillance techniques to proactively monitor, evaluate and test individual accesses of confidential financial information stored in databases. MDOR’s data surveillance function, referred to as “Transaction Tracking,” is a continuous process performed by the Office of Internal Audit’s Information Security Unit (INFOSEC), which is part of MDOR’s Inspectional Services Division.

Instead, the surveillance process must be structured, ongoing and proactive — similar to an audit program of continuous transaction testing and sampling. To be effective, surveillance programs must encompass policy and awareness; monitoring, detection and investigation; and a structured disciplinary process.

Set Clear Policies Before implementing a data surveillance program, it is critical that organizations establish a clear data access policy and notify all employees that violations will result in disciplinary action. Although most organizations currently have policies prohibiting the nonbusiness use of workplace technologies and systems, a separate policy is needed to address access of confidential information for personal reasons. The policy must set forth the prohibitions against accessing data for nonbusiness reasons, provide specific examples of accesses that are prohibited, and emphasize that violations will result in discipline, including termination and potential criminal prosecution.

During the orientation process at MDOR, each new employee is required to review the department’s confidentiality policy, sign an acknowledgment that they understand it, and view a “Protecting Privacy” video detailing the consequences of data access violations. Further, employees are reminded when they log into the network that their activities are being monitored and must be directly related to their official responsibilities.

A Blended Approach
In data surveillance programs, the monitoring process must be continuous and not used solely to respond to, or investigate, specific allegations of employee “browsing” of the database. All employees with access to confidential information must be subject to this monitoring, and the process must be structured and applied consistently. Although the process of monitoring database activity may appear to be highly technical, MDOR has implemented a blended approach that combines information technology (IT) strategies, audit sampling methods and traditional investigative techniques. If the employee is unable, or refuses, to provide a response for accessing a certain account, auditors refer the case to MDOR’s Office of Internal Affairs for further investigation.

http://www.technewsworld.com/rsstory/57211.html

With the announcement of a new release of the ITUP tool, IBM provides clients enhanced and expanded practical guidance in how to implement process integration, activity flows, clarified operational roles, and management tool strategies required for effective service management.

ITUP supports ITIL, COBIT, ISO IEC 20000, eTOM and includes detailed documentation of IBM’s Process Reference Model for the Business of IT.

“With complex compliance regulations looming, many organizations are seeking to implement a more consistent IT governance and risk management process,” said Susan Blocher, Director, Governance and Risk Management, IBM.

http://www.darkreading.com/document.asp?doc_id=121692&WT.svl=wire_2

OnStar is one of the various services that provides motorist assistance, including Global Positioning Satellite location data. If you report the car stolen, they can remotely turn the GPS on, track the car, and even turn the telephone inside the car on and listen into the thieves’ conversations. All of this occurs on the network the real owners own and it reveals information about your vehicle.

When it comes to network based investigations however, we cannot easily track where the computer went. Once we have the IP address, we would look up the network that was assigned that block of IP addresses. It might be an Internet café in Riga, Latvia, or a giant Internet Service Provider in Dulles, Virginia.

What we really want is subscriber identification information. That is, what subscriber was assigned that particular IP address at that particular instant. Now of course, a lot of this information may be spoofed, and it is usually less than trivial to piggyback on a legitimate network (such as, a hacker using an open or insufficiently secured WiFi network.) Nonetheless, tracking down physical location data or subscriber data from a raw IP addresses is the ultimate goal of the investigator.

This is where technology and the law intersect – and not in a good way for either of them. While you can do a traceroute or a WHOIS search in a couple of seconds, in order to get subscriber data from an ISP requires some form of legal process (usually). ISP privacy policies legitimately protect this data, but they generally contain a provision (and one would be implied by law even if it wasn’t in the policy) that the information may be disclosed if there is a “valid legal order.”

In extreme situations (imminent threat to health and safety) the promise of a later subpoena may be sufficient. In the United States, for example, they can also use various legal processes – a grand jury subpoena, a formal investigative demand, an administrative subpoena, a discovery order, a search warrant, a Title III wiretap order, an order issued by the Foreign Intelligence Surveillance Court. Or, as recently revealed in The New York Times, various agencies including the Department of Defense and the Central Intelligence Agency (and of course the FBI) can issue what is called a National Security Letter (NSL) on their own authority to get this information.

A subpoena generally requires very little level of proof that the information demanded is relevant to whatever you are looking for, or may lead to the discovery of relevant information. Most people think that subpoenas are issued by a court or a judge — that you apply for a subpoena to a court, show them that the information is relevant, and then get an order. You see, to issue a subpoena there has to be an investigation authorized by a grand jury: a group of citizens authorized by the court to investigate crimes.

To have a lawsuit pending, we have to have a “case or controversy” involving some violation or law or tort, which is capable of being heard in the court in which we have filed suit, which also has jurisdiction over the matter and the people involved. The legal discovery process, particularly for civil discovery, is slow, unwieldy and ungainly. Just some “John Doe” who did the bad act.

Oh yeah – getting wiretap or other orders for discovery related to national security, foreign intelligence and foreign terrorism under the Foreign Intelligence Surveillance Act (FISA.) The Bush administration has long argued that they were lawfully entitled to bypass the super-secret court set up under this law and demand records under what they later dubbed the “Terrorist Surveillance Network” because the FISA law was slow and cumbersome.

Imagine a standing court discovery order from an appropriate court that says the following: if a computer protected by this service is reported stolen, and it finds itself on a strange network, and “pings” home with its IP address, then and only then the owner or the provider of the LoJack services is entitled to an order of discovery from the ISP from which the IP address is associated, permitting discovery of the customer data associated with that IP address. The information may ONLY be used for the purposes of either filing a lawsuit against the perpetrator, or to turn over to law enforcement, or other reasonable purposes. The court might also appoint a “Special Master” responsible for overseeing the discovery process.

http://www.securityfocus.com/columnists/438?ref=rss

Bloggers post confidential information, defamatory information, or just annoying information. Websites host stolen credit cards, hacking tools and techniques, or other things that you might not want. In the course of investigating these things, companies or law enforcement agencies frequently need to rely on information in the hands of third parties. An example of this is the various companies that offer data or computer locator services. If a corporate computer is reported lost or stolen, these services use various means to identify the computer, or the data on it. When the target computer is then used – generally to get online – the computer essentially “phones home” with its location. The computer doesn’t really give its location. At best, it can reveal the Internet Protocol (IP) address of the network it is on. While this information is helpful to the true owner of the computer, it is not sufficient to locate and/or recover the stolen hardware.

OnStar is one of the various services that provides motorist assistance, including Global Positioning Satellite location data. If you report the car stolen, they can remotely turn the GPS on, track the car, and even turn the telephone inside the car on and listen into the thieves’ conversations. All of this occurs on the network the real owners own and it reveals information about your vehicle.

Finding subscriber information When it comes to network based investigations however, we cannot easily track where the computer went. Once we have the IP address, we would look up the network that was assigned that block of IP addresses. It might be an Internet café in Riga, Latvia, or a giant Internet Service Provider in Dulles, Virginia.

What we really want is subscriber identification information. That is, what subscriber was assigned that particular IP address at that particular instant. Now of course, a lot of this information may be spoofed, and it is usually less than trivial to piggyback on a legitimate network (such as, a hacker using an open or insufficiently secured WiFi network.) Nonetheless, tracking down physical location data or subscriber data from a raw IP addresses is the ultimate goal of the investigator.

This is where technology and the law intersect – and not in a good way for either of them. While you can do a traceroute or a WHOIS search in a couple of seconds, in order to get subscriber data from an ISP requires some form of legal process (usually). ISP privacy policies legitimately protect this data, but they generally contain a provision (and one would be implied by law even if it wasn’t in the policy) that the information may be disclosed if there is a “valid legal order.”

In extreme situations (imminent threat to health and safety) the promise of a later subpoena may be sufficient. In the United States, for example, they can also use various legal processes – a grand jury subpoena, a formal investigative demand, an administrative subpoena, a discovery order, a search warrant, a Title III wiretap order, an order issued by the Foreign Intelligence Surveillance Court. Or, as recently revealed in The New York Times, various agencies including the Department of Defense and the Central Intelligence Agency (and of course the FBI) can issue what is called a National Security Letter (NSL) on their own authority to get this information.

A subpoena generally requires very little level of proof that the information demanded is relevant to whatever you are looking for, or may lead to the discovery of relevant information. Most people think that subpoenas are issued by a court or a judge — that you apply for a subpoena to a court, show them that the information is relevant, and then get an order. You see, to issue a subpoena there has to be an investigation authorized by a grand jury: a group of citizens authorized by the court to investigate crimes. To have a lawsuit pending, we have to have a “case or controversy” involving some violation or law or tort, which is capable of being heard in the court in which we have filed suit, which also has jurisdiction over the matter and the people involved.

The legal discovery process, particularly for civil discovery, is slow, unwieldy and ungainly. Just some “John Doe” who did the bad act. Oh yeah – getting wiretap or other orders for discovery related to national security, foreign intelligence and foreign terrorism under the Foreign Intelligence Surveillance Act (FISA.) The Bush administration has long argued that they were lawfully entitled to bypass the super-secret court set up under this law and demand records under what they later dubbed the “Terrorist Surveillance Network” because the FISA law was slow and cumbersome.

Imagine a standing court discovery order from an appropriate court that says the following: if a computer protected by this service is reported stolen, and it finds itself on a strange network, and “pings” home with its IP address, then and only then the owner or the provider of the LoJack services is entitled to an order of discovery from the ISP from which the IP address is associated, permitting discovery of the customer data associated with that IP address. The information may ONLY be used for the purposes of either filing a lawsuit against the perpetrator, or to turn over to law enforcement, or other reasonable purposes.

The court might also appoint a “Special Master” responsible for overseeing the discovery process.

http://www.securityfocus.com/columnists/438?ref=rss

The increasing use of portable devices and WiFi access to company IT resources means that truly personal control of data is a thing of the past. As a result, data on PCs, laptops, PDAs and smartphones – as well as back-up data on the network – needs to be encrypted. It’s now possible to install encryption solutions on most mobile devices.

You can also use authentication technology – tokens, biometrics and smartcards – to create a security system that is stronger than the sum of its parts.

Using a factory reset on your portable device may seem to be the easiest precaution before disposing of the unit, but factory resets are far from permanent, since they only delete the header information to your data. That way, even if a hacker manages to un-delete your portable device’s files, it stays secure, since it is encrypted. Even deleting the data files on the back-up system is not full deletion, as network/PC restore functions can regenerate the back-up files.

The optimum approach to mobile device security is to conduct a risk analysis and, from the results, formulate a best practice set of policies relating to the use of mobile devices across the entire organisation.

Don’t forget the cellular network backups. A growing number of cellular networks now support network-based data back-ups.

Although designed to assist users in the event of a mobile phone loss or theft, the back-up poses a security risk if a third party obtains your network logon details, or if your old mobile number is re-assigned (as most are).

Many mobiles automatically back-up data from the SIM card to the phone, so moving your SIM card can leave contact data behind on the old handset.

Care should be taken when downloading or installing company data on a mobile device – even a mobile phone – as that information could easily fall into the wrong hands.

http://www.it-observer.com/articles/1314/how_safely_dispose_old_mobile_devices/