CISO

Enterprise Information Security

Gulf Countries and Data Security Breaches

by Leave a Comment

Hacked
It is a no brainer to mention that cyber crime is increasing and today, the focus is more on money & cyber war than anything else. We see a lot of such incidents these days including the hacking and data breach at Target, Sony, Anthem to name a few.

What about information security in the other parts of the world? Are we secure enough? Or better, did we have any breaches in the recent past?

I see that a number of organizations were hacked in the recent past in all of the GCC countries. Saudi Aramco cyber incident was a major one in the last 2 years. There were a number of political influenced security incidents in the past

The list above is just a few among a large number of such incidents in the region. Now, lets see how serious are Gulf Countries in terms of Information Security?

UAE emirates Dubai and Abu Dhabi has set up security standards (ISR & ADSIC respectively) that should be implemented within the government sector. Other countries such as in the GCC (Kuwait, Bahrain, Oman) are still weighing their options in terms of developing country security standards.

What about the companies? How serious are they about cyber security? Information Security is still considered as a cost component and regulatory requirement by most of the companies in GCC and not as a better business practice.

Do we have to wait till a major security incident happen in the middle east to make it a better business practice?

Another set of Celeb Leaks

by Leave a Comment

imageAfter Jennifer Lawrence it is now time to see what hackers have about Kim Kardashian. Private photographs of Kim Kardashian and Vanessa Hudgens, which appears to be naked, are publicly leaked and shared on the social network. As usual, Reddit and 4Chan were the sites used by the hackers to release the photos publicly.

Security Blogger, Graham Cluley, suggests that these images could be leaked much earlier and many years old. Online accounts of these celebs might have compromised much earlier but the compromised photos found their space in the internet just recently.

From a security standpoint, it shows the importance of protecting your accounts at various providers. In most of these events, it is not the cloud service providers who are affected. Instead, it is the individual accounts of these celebrities got hacked, data stolen and eventually published / leaked in the internet.

Today, many of the popular service providers offer better authentication methods. It is up to the subscribers to use these added security features and many of us failed to use these security features such as two factor authentication. The common reason we talk about are the convenience vs security and most of the time, easiness or convenience takes the precedence. It eventually ends up in incidents like this.

Key take away for individuals are :

  1. Think before taking nude photo’s. In today’s world of “Internet of Things” it is not difficult for these photos to end up in the internet
  2. Store the private information, private. Most of the websites are not really private. You should not assume that these photos are going to be private forever at these website providers custody
  3. Once stored, even if you delete those files, it will remain in some storage location of these sites. Which could eventually lead to resurrection
  4. Keep strong passwords and enable 2 factor authentication
  5. Monitor your account activities so that you would come to know about potential access to your account by others.

Identity Protection Services

by Leave a Comment

Identity theft is on the increase. Everyday we hear stories about identity theft by hackers and millions of identifies are on sale after such security incidents. When looking for a Identity Protection company, it is important to check out the services offered by them. Some of the key identity protection services offered by these companies are:

  • Fraud Monitoring : Monitoring the internet, internet underground, dangerous websites to check if your information is listed fraudulently. The fraud monitoring also looks for the illegal exchange of personal information. Most of the identity protection companies offer’s this service

  • Fraud Alerts :  When these identity protection companies detect fraudulent activity, if the “Fraud Alerts” service is included, they notify the major credit bureaus that is attached to your credit report. Fraud alert with a credit bureau means, they will have to call you and take your approval before a line of credit is opened. Fraud alerts are valid for 90 days and should be updated.

  • Resolution Services :  Most of the identity protection companies provides recovery assistance for stolen identities. They contact the required authorities and credit bureaus when a data breach occurs. Many times, this includes the legal and/or monetary assistance

  • Stolen Wallet Assistance : It is not so common to lose your wallet. However, in such an event, many of the identity protection companies offers help in contacting the banks or credit card issuers to cancel your accounts

  • Additionally, look for the Service Guarantee (which is the maximum amount of money the identity protection service will spend to help you in case of failures or defects from the company) and the insurance coverage you might get as part of the identity protection service offered.

It is also important to understand and analyse the types of identities protected by these identity protection services. A key set of identity records are listed below:

  • Social Security Number (SSN)

  • Full Name

  • Street Address

  • Email Address

  • Telephone

  • Credit Card Numbers

  • Bank Account information

  • Financial loans/lease information

  • Drivers License

You might need to consider the option to include / extend the service to Family Members including children. Consider the Identity Protection service provider who offers credit monitoring and provides credit history reports.

Free Firewall from Checkpoint

by 1 Comment

Checkpoint is getting into the Free Antivirus game by offering its ZoneAlarm antivirus software as a free consumer product for the first time, adding the company’s no-cost firewall to the bundle to offer all-in-one PC protection. The following features are built into the Free Antivirus. Checkout here to see more details

Antivirus/Anti-Spyware Engine

Detects and blocks viruses, spyware, Trojan horses, worms, bots, and rootkits.

Two-Way Firewall

Makes your PC invisible to hackers and stops spyware from sending your data out to the Internet.

Advanced Firewall

Monitors programs for suspicious behaviour spotting and stopping new attacks that bypass traditional anti-virus protection.

Anti-Phishing/Site Status Toolbar

Blocks phishers and authenticates websites, and warns you if a Web site is dangerous.

Advanced Download Protection

Warns you if you try to download a dangerous program.

Identity Protection

Monitors your credit and alerts you of changes in your credit files.

Parental Controls . Not available in free version

Filters and blocks inappropriate websites and limits time spent online.

Support . Not available in free version

Customer service and technical support available 24/7 via live chat.

Virtual Browsing . Not available in free version

Frees you to surf the web protected from drive-by downloads and browser exploits.

PC Tune-up . Not available in free version

Optimizes your PC for faster speed and higher performance.

Automatic Antivirus signature updates . Every 24 hours

Based on hourly frequency. Plus unlimited real-time manual updates.

PCI DSS compliance and Password policy

by 2 Comments

Usernames and passwords is still the major method of authenticating users to the systems. It would be difficult to find someone without a user name and password in the workplace. In addition, personal usernames and passwords often come into picture when people access various websites and private emails. Proper use of the usernames and passwords are important to ensure accountability of the activities performed by the users. This post is to revisit the security best practices on the username and password policies and how it relates to the PCI DSS compliance requirements.

Standard for Usernames

It is important for an organization to have the usernames built in accordance with a pre-defined standard. This will help the business to quickly identify who is the owner of a particular user name and helps the organization to quickly resolve issues in case of a troubleshooting or identify the user in case of a malicious activity. It should be communicated with in the organization so that the privilege assignments would be easy for individual users.

Imagine a situation where an organization has around 10 John.s in a 100 employee company. If all they have usernames like John1, John2 etc. how difficult it would be for someone to share a folder and assign required privilege to the right John?

Consider the username password combination as a public and private key pair where the username is public to everyone and the password is private to the user. This helps everyone easily identify who did what without much hassles and enables a faster audit trial review.

Some of the common username formats include:

  • First initial of the first name and complete last name
  • Complete first name dot complete last name.
  • Employee number with predefined prefixes

Password Policy

After the username standard is defined, the next key step is defining the password policy which defines the private or undisclosed part of the authentication mechanism. The use of password ensures the accountability of any actions performed by a user account and the owner of the user account is held responsible for the activities performed by the said user. Due to this reason, it is important for an organization to ensure to ensure that the passwords are strong and follows best practices. Some of the key components of a good password policy follows

Password Strength, occasionally part of the password standard

  • Alphanumeric passwords, special characters if needed based on the risk posture
  • Minimum 8 characters or more
  • Not to write the passwords in a clear text form like in paper, sticky notes etc. or in text editors
  • If stored electronically, use cryptographic controls to protect the same
  • Password is a private information and thus it should be kept confidential.
  • Password sharing not to be allowed
  • Not easily guessable passwords like spouses name, kids name, birthdays etc.
  • Not a word from common dictionary (think about dictionary attacks)
  • The username should not be used as the password
  • Use of uppercase and lowercase characters
  • Change the password frequently, ideally within 60-90 days of the new password creation
  • Change the password if it is known to anyone else

The above list is not an exhaustive list of password policy components. Many of these items to be considered only after assessing the security situation of your company. Passwords are not the single line of defence against identity attacks but a key step towards protecting one.s account.

PCI Compliance

Now let us look at the PCI compliance requirements related to Password policy. The Requirement 8 -  Assign a unique ID to each person with computer access is the key section where the username and password requirements are detailed. Two of the key controls are listed below from a number of items from requirement 8

  • 8.1 – Assign all users a unique ID before allowing them to access system components or
    cardholder data.
  • 8.5.8 . Do not use group, shared, or generic accounts and passwords.

The PCI DSS is drafted to include all the requirements related to password security so that the merchants and service provider will employ proper controls to restrict and identify the access to card holder environment. At first glance, the operations of creating unique user IDs may seem to be a time consuming task with few benefits when multiple employees may perform the exact same functions.

I often get questions from people asking why we can.t have just one user account or email account for a group of people? It is important from a PCI DSS or Card holder perspective that the users are identified when they access the cardholder data such is what has been accessed and when. The PCI Data Security Standard is taking proper measures with these requirements to ensure that Merchants protect themselves from the following concerns.

Without having a unique user id assigned to all users, merchants could face the following challenges:

  • Unable to find who performed what on the systems or data
  • The use of audit trials to identify who performed a change or deletion of information
  • Implement the access controls based on the job functionalities or job roles

It is important from the organization perspective that individual usernames and passwords are assigned to every user of the system and thus ensuring accountability of the actions being performed by the employees. this will ensure that you don.t have to fight with the QSA during the audit, but more importantly, it will allow you to pin point who did what. Each organization will need to determine a Username and Password Policy based on specific business needs, risk mitigation process or regulatory requirements. What is most important is that a policy exists and the employees understand and follow it consistently.

10 resolutions for New Year 2012

by 1 Comment

All of us take resolutions in the new year. What is followed and what will be left out are points of discussion beyond this post, however, most of us make resolutions. Here is a list of resolutions you can take this new year. If you hold on to it, better it is.

  1. I will use strong Passwords : Change all your passwords into a stronger one. Try this post on Securing your password, which will help you build better passwords
  2. I will not reuse passwords: Password reuse enables someone who hacked one of your account to hack another account of your on another service including the bank accounts. Try some of the password managers
  3. I will install an Antivirus: If you haven.t installed one, use an antivirus software. Configure it to automatically download the virus definitions and updates
  4. I will think thrice before posting anything on the internet. Internet is not a safe place at all and anything personal you post in the online social networks will be soon public
  5. I will keep my PC updated: Botnets are being built by the friends in the other side of the internet. If you want to be away from being part of the botnets, it is better to keep the systems patched and updated. This gives no guarantees as the hackers can hack into the systems using vulnerabilities which are not public
  6. I will not click on links in the email claiming to be from a bank: I understand that it could be a fake email trying to get my passwords or install some malware on my system. Reading How to avoid phishing scams and Tips for keeping your online accounts secure can give some insights
  7. I will protect my wireless connection: Protecting wireless network is your responsibility. If not protected, people may use it to leach your bandwidth and more importantly, the actions performed by them will be counted by the ISP and legal institutions as performed by you.
  8. I will not use USB drives obtained free: USB drives are a new type of threat agents, if you get it free, it often contain some add-ons. This is true especially when the giver is not known to you and has no visible benefit when given to you like monitory benefit. However, it can later become an issue as these devices could contain rootkits and malware
  9. I will use encryption: Using encryption helps you protecting confidential data from attackers. Most of us use laptop computers and often it get lost to the public. Once lost, it is lost along with your data. Protection of the confidential data is important and encryption is the best way to protect the data. Also, it is the case with mobile phone.
  10. I use secure erasing tools for file deletion: Deleting and emptying the files from recycle bin will not actually delete files from the computer hard disks. Using secure erase software’s will ensure that the files are actually erased from your hard disks ad ensure protection.

These are some of my thoughts for new year resolution on the security front. If you think there are better ones, do share with me.

Wish you all a Happy and Secure New Year

Hack attack underscores danger of reusing passwords

by Leave a Comment

The fallout from a hacking attack on Gawker Media Inc. a week ago underscores a basic security risk of living more of our lives online: Using the same username and password for multiple sites is convenient, but costly.

After the attack on the publisher of such blogs as Gawker, Gizmodo and Jezebel exposed account information on as many as 1.4 million people, several unrelated companies had to freeze their accounts and force users to reset passwords.

Gawker Media itself didn’t have all that much sensitive information about its users. But the usernames and passwords obtained there could open doors to more valuable accounts elsewhere, including e-mail and banking.

Twitter, Google Inc. and Yahoo Inc., among others, saw the potential damage and began resetting their passwords en masse, disrupting users as they tried to check their e-mail or post a tweet.

“It shows one of the fundamental problems with passwords — they get reused and shared across multiple sites,” said Jeff Burstein, a senior product manager with the Symantec Corp. security firm.

Despite repeated warnings from security companies, users tend to reuse passwords anyway because they can be hard to remember and manage. Users may have dozens, perhaps hundreds, of accounts — for e-mail, Facebook, Twitter, e-retailers, banks and the growing number of news Web sites and blogs requiring registration.

Although account information gets compromised all the time, the infiltration of Gawker’s servers is noteworthy because the hacked data were posted online, for free.

In most other breaches, the stolen data are never made public and are sold to criminals.

Because the databases were freely available, other sites were able to score the data and look for matches with their users.

Twitter acknowledged resetting some passwords for its 175 million users after hackers used the Gawker data to break into Twitter accounts and pump out links to a site selling acai berry drinks.

At least two of the biggest Web e-mail providers, Yahoo and Google, also reset some passwords. Neither would say how many of its users were affected. Google said it was a “small subset” of its users.

Job-networking service LinkedIn also changed a small number of its 85 million users’ passwords.

Some Web sites said the breach didn’t affect them because they don’t rely solely on passwords. JPMorgan Chase & Co. said it didn’t have to change any passwords because the bank has “multiple layers of security.”

Banks typically require security questions and other challenges beyond just usernames and passwords to get into their sites, particularly when someone logs on from a specific computer for the first time.

So what can be done to better protect consumers? Security experts say the Gawker breach shows that it’s time to move beyond passwords.

But people are used to needing only usernames and passwords to log on to accounts, and piling on more layers of security can be a hassle.

Many sites are trying to do the best with what they have, and what they think users will accept. They require strong passwords that are tough to break with “brute force” attacks — using computers to keep trying commonly used passwords against an account until one works.

But those requirements have made it harder for people to remember their passwords, and that increases the likelihood that they’ll be used across multiple sites.

Security tools that take advantage of smart phones can make it harder for strangers to break into your accounts. You’re given a code through your phone to enter on the Web site with your password. That way, the Web site knows it’s not a hacker, who wouldn’t have access to your phone.

Burstein said imposing additional layers of security on users can backfire if the measures are too cumbersome but added that the push for mobile phone security applications has been well received.

via Associated Press

People – Walking threat

by Leave a Comment

Kevin Mitnick, the legendary hacker once said, “People are the weakest link. You can have the best technology, firewalls, intrusion-detection systems, biometric devices – and somebody can call an unsuspecting employee. That’s all she wrote, baby. They got everything..

Recent wikileaks episodes can be taken for example, the real danger relies on vulnerable people. A Cyber war is already started between Wikileaks supporters and opponents. Websites after Websites are now being DDOSed. Already lose of millions of dollars has been reported. The leaked documents started to create friction between some governments. The real impact of all these incidents cannot be predicted. However, one thing we can be sure, Wars never bring anything good to humanity. Let it be Cyber war or Normal war. History teaches that very well.

So, Who are vulnerable people? What can we do to stop them?

The answer to the first question is, Everyone. We are all vulnerable, nobody is perfect, and there will always be some weak points which can be exploited. The behavior of these “Biological machines” could be changed by n number of reasons. Emotional or Physical or Political… We human are quite unpredictable. Even though, Our Science and Technology could map human genes and we are in the process of uncovering the secrets of human Brain, it would take us may be decades to fully understand about ourselves and predict our behavior. As long as we remain as a mystery, more and more episodes such as Wikileaks will be happened without a doubt.

Now, the second question, how do we stop vulnerable people? First step, identify the vulnerable people. Well, who are all vulnerable?, As I said before, Everyone. So, what we could do to reduce the risk?

That is a tricky question.

We know, no matter what controls you put, Risk can never be fully eliminated. There will always be some risk, which you will have to accept. While considering the danger from People, you are left no choice than being optimistic and trust on your controls.

However, you could continuously try various methods to reduce the likelihood of People executing their malicious intentions. If you could design fool proof processes and pretty good monitoring and reporting controls, you shall be able to reduce the likelihood to an extent. But, is it possible to design a fool proof process; does it worth putting so much of your money on Monitoring and Reporting controls?. That question you need to ask yourself. It all would be depending on the Criticality of information you are trying to protect. Whatever decision you take now, will decide the fate of the Information and ultimately all of your assets.

You may ask now “Are you telling me that, Lack of proper monitoring controls and fool proof processes resulted incidents like recent wikileaks episodes?”

Neither I can say Yes, nor No. Will need to conduct the thorough analysis to find out the root cause and then learn from it. You always have the room for improvement. Security is process, a continuous process. There is no full stop. Learn from your mistakes. Governments and Organizations started to think of Yoga, Art of living and such type of Mental health programs as part of their Security Program to help their employees to be mentally healthier, thus reducing the chances of being malicious. You could try any approach that you think could help. Security is nothing but common sense, you should use it well while finalizing your control objectives and selecting your controls.

And one last point I would like to mention is, the importance of Security awareness training. Sometimes you can see innocent people are used by an attacker through simple social engineering tricks, they might not even know that they are doing something that could compromise the overall security of your Organization. So, all of your employees, top to bottom, must know about your Information security policies and must get adequate awareness training. Also try to setup an anonymous reporting option to encourage every employee to report anything they find suspicious.

Infosys CEO: People willing to trade privacy for tech benefits

by Leave a Comment

“You allow that privacy to be compromised for a benefit,” says CEO Kris Gopalakrishnan

People are willing to adjust their ideas about privacy if they can benefit from revealing more of their personal information, the CEO of Infosys Technologies said Thursday.

“You allow that privacy to be compromised for a benefit,” CEO Kris Gopalakrishnan said during a talk at MIT’s Emerging Technologies conference. The definition of privacy must now take into account whether personal information is “properly used to give additional benefits,” he said.
read more… 

Microsoft Security Essentials . First impression

by 2 Comments

Recently I have decided to replace my current anti-virus software with Microsoft Security Essentials. So last weekend I have done this exercise. My initial thoughts are it is a nice work by Microsoft. It does not give much load to my laptop. Seems to have fairly good protection from virus.

I have tried downloading some virus infected files, which triggered alerts. Also opened some old virus infected files from the archive.

The thing is that all the tests were done against the old viruses, now what I need to see is that how this work against the new or zero day threats.

Overall, I am satisfied at this point in time and waiting to see how this is going to react to the new threats.

If you would like to download this, click here