E-Cards are evil!

Ok, maybe they aren't evil, but they are pretty scary. I arrived at work this morning after a 3 day weekend to discover that an employee had sent an e-card to lots and lots of our users. We have about 5000 employees most of which have an email account. The user doesn't have access to the global email group but was able to send it to a lot of people by selecting different groups that they did have access to plus individual accounts.

As I said, when I saw the e-card in my inbox and noticed that it had also gone to lots of other users I got that sinking feeling in the pit of my stomach. My initial reaction was to send out an email to everyone telling them not to click on the link to view the card. Then I noticed that the card was sent Friday afternoon around 3:30. Too late. If this was malicious then the damage was already done. The good news was that I had not heard of any thing going awry over the weekend. Of course, since lots of people cut out early on Friday there was a good chance that this morning would be the time to fear.

Before I reacted rashly I decided to check out the link to see if it was malicious or not. I did a search on the e-card company. It was one I was not familiar with. Nothing bad came up. I then went to the site and looked around. It looked OK. Then I took the next step and put in the e-card number to view it (all of this was done in a safe environment). Whew, nothing evil appeared. It was a Thank You card for something that the company had done for her.

Of course there is a "dark" side to this. We don't state in our email policy that it is against the rules to send e-cards but we do state that email is to be used for "business purposes". So the user did "break policy". What is really bad though is this.

• By doing this the user (who has a supervisory role) has told their subordinates and others that it's OK to do this thus increasing the likelihood of others doing the same.
• By doing this they are teaching the users that clicking on an e-card that seems to comes from someone you know is OK, even at work.
• By doing this they are reducing the effectiveness of company policies. (Unless something is done which is out of my realm of responsibility).

Something so seemingly innocent and nice really has a negative effect on information security. A simple email saying thanks would have sufficed and would have been much less damaging.

The good thing is that this will give me opportunity to ensure that this and similar issues are addressed in a way that ensures that all understand the importance of following policy and practicing safe computing. Plus it will add to my UA Training listing.

Spam Attack

This weekend my wife and I took our 2 girls to the Atlanta Children's Museum. They had a special exhibit that was a recreation of Sesame Street. Both of our girls watch Sesame Street and of course my wife and I both grew up watching it. We were pretty excited about taking the girls to see and experience it. When I was checking into it I was kind of surprised to see that tickets were $11 each for everyone one 2 years old. That meant that we had to buy 4 full priced tickets. I had a feeling that it wouldn't be worth $44 dollars but it was for the girls so I was willing to do it. It did turn out that it wasn't worth it. It would have been better if we hadn't found out how to get to Sesame Street.

We got there and it seemed like every kid in Metro Atlanta was there. Plus the each had at least one if not both parents there. My wife described it as "stay at home mom hell". Kids were running around everywhere screaming, laughing, pushing, shoving and just generally acting crazy. Just like kids are prone to do.

I was checking my email over the weekend and I noticed that not only was I getting lots of spam but lots of spam was getting past my filters. That means that I was checking my email I was having to sort through lots of JUNK! People wanting me to act as their US representative and share millions of dollars with them. I've won the UK lottery at least 25 times in the last month. Enough grass seed spam to turn the earth into a "lush tropical paradise". I could even grow hair on Santa's head. :) Then there are all these people who think that I need to be a few inches taller. I just don't understand.

Then it hit me that our experience at the Children's Museum must be similar to what an email server experiences with all that spam. (OK, I know I'm really reaching here but it did occur to me) The museum was set up in a particular way to handle a certain number of kids in an organized fashion but when the attendance exceeds expectations then chaos occurs. Just as an email server is set up to do a specific function then you add a spam filter to help keep out the junk. As email comes into the system in greater quantities then it makes it more difficult for the system to function as it was designed. Just as kids run amuck and cause chaos all of the spam causes chaos on the server. Then spam gets through the filter and into your inbox.

Then just as with more and more kids running around someone is bound to get hurt. I saw 2 or 3 minor injuries occur and one of them involved my youngest. I didn't see it but my wife told me that a mother knocked her down and turned and said sorry and went on chasing her kid. As more and more spam gets through our filters the likelihood of someone acting on one of them increases and as that increases the likelihood that a virus, worm, rootkit or keystroke logger is going to get installed on your network or home system.

Unlike the museum where I at least understand why parents bring their kids there and allow them to run amuck I still don't understand why people actually act on these emails. Why they buy stuff advertised in them. Why they click on links promising them great pictures, the latest movie, the best price or the greatest deal on improving their whatever.

That leads me to this weeks information security poll.

"Have You or anyone you know actually bought something sold via spam or gotten a virus due to clicking on a malicious email link?"
A. Yes, I bought something.
B. Yes, I know someone who bought something.
C. No, I have not bought anything nor no anyone who has.
D. Yes, I have gotten a virus via a malicious email link.
E. Yes, I know someone who has gotten a virus via a malicious email link.
F. No, I have not nor do I know anyone who has gotten a virus via a malicious email link.

In this poll you will be able to choose more than one answer so please answer all that apply. If you do have a good story to tell please take a moment and leave me a comment about it. I'm sure some of you have great stories to tell.

Information Security Poll

My latest information security poll was a hit with y'all. It received more votes than the other 3 combined. I was very pleased to see the response. I have to admit that I did solicit a couple of votes towards the end of the poll. I was in a chat room with some of the other members of the Security Catalyst Community and since I was just a couple of votes shy of 100 I asked any of them who hadn't already voted (and shame on my friends for not being the first) :) to go ahead and vote to push me over the 100 vote mark.

I have to admit that I am quiet surprised at the results. I honestly expected about 95 to 98 percent of the votes to go to the last 2 options (Slightly or None). While they did receive the majority of the votes it was only about 73% of the total vote. The second option (Mostly) received about 26% of the vote and the first option (Completely) received 1% of the votes. My first glance says that some of you were not being completely honest (yes I'm talking to you who voted for option 1). But then Cutaway pointed out to me that there were a couple of different ways to interpret the question and the response could vary depending on your interpretation. As I looked back at the question I see how that could be so I take back what I said of you who voted for option 1. :) Then there is the possibility that those of you who voted for option 1 were talking about yourself. Maybe you are your user.

If the results of this poll really do show that a full 26% of you trust your users to act securely and there was no misunderstanding of the question then that is quiet encouraging. It tells me that y'all are doing a good job in getting the message of security out to your users and that they are listening. I would love to talk with some of you about what it is you are doing that is working so well for you. Please drop me a note either in the comments or via email.

As usual I don't have a question for the next poll yet, but I'll have something in a day or two. Monday is a holiday here in the US so it may be Tuesday before I have something up. I'm hoping to spend most of the weekend enjoying spending time with my Wife and daughters and not blogging or coming up with another poll. Yet, you never know. I am up earlier than them most of the time and that's when I try to catch up on reading and blogging.

Where Does the Buck Stop

Dr. Anton asks the question "Where do you draw the line: Security Responsibility?" Well this time the answer isn't "It depends". The way I read the question after reading his post is, Where does the buck stop? The buck stops here. It stops with us. It is our job to secure the environment and part of that job is to ensure that the users know how to practice security.

It would be ridiculous for IT or Security to have 100% responsibility. If we did then things would be locked down so tight that the users couldn't get anything done. If we gave them all of the responsibility then we might as well pack up and go home. That is unless you want to spend your days playing PC clean up or pushing out new Images every few days.

We shoulder most of the burden. It's our responsibility to make sure that the systems are hardened and that the controls are in place and that the policies (both written and system) are effective and to get as much information to the users as possible so that they can do their job (and even their play time) securely. If you have done all you can with what you are given and a system gets owned then it's not your fault (your boss may think otherwise, just tell them to talk to me). If you haven't done all you can and you get owned then it doesn't matter what the user did you are responsible. Users are like little children. We can't send them out into the big bad world without preparing them and expect them to escape unscathed.

So how does Dr. Anton's equation really look? Probably something like Security=85%, IT=10% and Users=5%. We build the security program, create the policies, train the users (and IT), set the rules. IT follows the policies and procedures that come from us. They build the systems according to spec and ensure that the infrastructure works as it should. Then the users do their part and the users do their part and play it smart and safe. Then we are all happy, safe and secure. That is a recipe for information security ala mode.

Staying Fresh

Rebecca Herold has a good post on her blog about keeping your security, privacy, or compliance program fresh. She makes a good analogy between how your program can slowly become ineffective over time due to lack of attention and how running shoes can slowly become less effective over time. I can't relate to that because I bought my new running shoes in April and they haven't had as many miles put on them as hers gets in one day. Try as I may I just can't get into a running frame of mind.

I've seen fist hand how programs start strong and slowly erode or die over time. They don't get the TLC that they need to stay alive. They are put in place to satisfy a audit or a new boss and then they end up in a closet or on a shelf only to be given a passing glance from time to time.

I recently did a review and update of security policies for a company. What they had was between 4 and 8 years old. They had been created (mostly just changed the company name on a template) and filed away. As I looked over them I started asking questions about them. Is this really what is done? Where is the ??? to back this policy up? Where are the ??? that this policy states is happening? Blank Stares and hidden smiles met me. They weren't being followed. They were just there to satisfy a whim.

These documents and programs are living. They are meant to be reviewed regularly, followed consistently and changed as needed. They are not static documents that are just to satisfy an audit. When I create a policy program or a security plan I make sure to write it in such a way that those who are entrusted with it know that it is a living document. I include regular review schedules and then I encourage those who are entrusted with them to go ahead and put reminders in their calendars to review them. I can't make them do it unless they report directly to me, but I can try to make it easy for them to do.

Another area that gets ignored is log review. Most people hate to review logs. Especially if they don't have a SIM, SEM or some other method for automating it. I've done it before. I've had to sift through thousands of entries to try and find the "bad" stuff. It's no fun. Unfortunately it has to be done and you need to be able to prove that you are doing it. If your policy says that you are doing it then the auditors are going to want to see proof. How many times have you or someone you know spent a day or two prior to an audit "falsifying" log reports. Going through and checking off that they were checked when they haven't been looked at in days, weeks or months.

It's important to remember that these things are crucial to the success of your information security program. If you let them get sick or die then your program will do the same. Security Professionals need to follow the policies and those in management need to ensure that they are being followed. Those who are tasked with keeping the policies or program alive need to be proactive in doing so. Don't wait until the last minute and try emergency CPR. If you will schedule a little time weekly or monthly to check on them then they will stay healthy and your program will be more successful.

Is Telecommuting safe?

An article on DarkReading tells us that Federal Information Security Chiefs don't think that teleworking is a security risk. Sounds like a good poll for next week to me.

When I first saw the headline "Federal Security Officers Say Telecommuting Is Safe"my initial thought was "these are the same guys who regularly get D's and F's on their security reviews and they are telling us what is safe and what isn't safe!" Not sure I really want to listen to them on this. I'm not saying that telecommuting is or isn't safe. A comment such as that can't be made carte blanche. The answer to this is again "It depends". It can be safe provided that the right controls are in place.

If you give a user a laptop with admin privileges, a T-Mobile Hot Spot account and tell him to go work where he wants then I'd have to question the security of your telecommuting program. If done correctly I believe that a user can work remotely from most places and still remain secure.

Here is my list of what needs to happen to make telecommuting as safe as possible. This is assuming the use of a company provided laptop. If we get into using personal systems then things get a little more complicated.

• User has user level access only.
• Laptop runs AV, HIPS, Personal Firewall that can't be disabled by the user.
• When connected to company network a security posture of the laptop is done via NAC. This is true whether it's via VPN connection or direct (wired or wireless) connection on site.
• USB ports and CD/DVD copying is disabled.
• Autorun is turned off for CD/DVD drives.
• Wireless radios are disabled when connected to wired network.
• Bluetooth is disabled
• Use a 3G, EVDO or similar card for access when not on a company approved secure wireless network.
• Train the user on how to be secure and reinforce this on a regular basis.
• Ensure that you have the proper security policies in place to CYA when the user manages to do something that you can't protect against.

I know that there are more things that can be done. Some of you will think that this is too much and some will think that it's too little. But remember, there has to be a trade-off between security and usability. If you go too tight then the user will be unproductive, calls to the help desk will be frequent and the user will try to find ways around your controls.

New Security Poll

I meant to tell you about this in my last post but I got so irritated and on a rant roll that I completely forgot.

My Information Security Poll for this week will deal with How much do we trust our users to act securely. Here is the question and the answer choices. Go to my home page to take the poll.

How much can you trust your users to act securely?
A. Completely
B. Mostly
C. Slightly
D. Not at All

Users don't care about security threats

It seems that most mobile workers think that security should be completely left up to the IT department and that they should be able to do what ever they want. This article from Information Week gives the details.

I saw this earlier in the week but was too busy to really look at it or think about it. It was brought to my attention today as I was looking at this weeks SANS News Bites newsletter. For those of you who aren't familiar with this newsletter typically it has stories about this weeks news and the editors will comment on it. It was one of those comments that got my attention today. After reading the story about how mobile workers think that security is IT's job and that they do things that they know they shouldn't without a care the editors started in. They talked about things like how sad this attitude is and how UA training has failed and how people are just stupid enough (my words not theirs) to believe that they really won the UK lottery or some other something. Then Johannes Ullrich, who is Chief Technology Officer of the Internet Storm
Center, made a stupid comment. He said

Why shouldn't users expect IT to take care of securityy? I think we (IT / Security professionals) expect too much if we expect office workers to worry about security. Perhaps we can ask them not to leave their laptop unattended. But beyond that, it's our job!

Before I start ranting..... He is correct that security is OUR job. That's what we get paid for. But unless companies are going to hire a Security Professional for every worker, to stand behind them and look over their shoulder and physically stop them from opening emails, clicking on links, going to porn sites, installing unauthorized software, etc... then we have to put some measure of responsibility in their hands. Information Security technology can only go so far and do so much. Users have to be responsible for their actions. They have to use common sense and follow company policy. They have to learn to be careful with their actions. It's not their laptop. It's not their data. It's not their company to take such risk with. They need to realize that their compromised machines don't only affect them. The data they lose affects the company, the customers, the investors, the partners. The malware that they install on their machine causes the rest of us to be at risk because of their actions. They should be charged with SWS (Surfing While Stupid) and be taken off the information superhighway. They should, in some cases, be fired or put on probation. Mr Ullrich, and those who promote reckless computer use should be charged as an accessory prior to the fact and given similar sanctions.

When technology gets to the point where everyone surfs in their own little virtual world and they can't hurt others by their stupidity then I will quit promoting quality UA training and will happily let users do what they want. Until then I will continue to promote and practice good security. I will work to make sure the technological controls are in place and the users are trained properly. I will also rant when people make ridiculous comments like this.

SSN Poll Results

The polls just closed on the SSN question. Overwhelmingly most people said NO! There is no valid reason for a company to keep you SSN on file. I am a little baffled because there were a couple of you who voted Yes. WHY? I'm having a hard time understanding that. Now I realize that I don't know all the in's and out's of how and why every industry does things the way they do, but I would love to know why you voted yes. Please leave a comment and tell me why.

I was also please to see that the total number of votes increased drastically. I don't know if that means that more people liked this question or if it means that more of you are finding the site or more of you decided to participate. Either way I'm happy.

I'll have another poll up soon.

Incident Response belongs to everyone

Harlan asks "who decides what best practices are" in regards to Incident Response. Harlan is a forensics guy and has written an excellent book (I've only read 1 chapter but many others have told me how good it is) on Windows Forensics Analysis. Obviously forensics plays a part in many Incident Response scenarios. His answer to the question of who decided best practices is "It depends". And I agree.

Dr. Anton asked how PCI can be both complex and basic security. He asked that based on the fact that my PCI poll (as scientific as it was) said that 40% of you said that PCI is complex and 40% said that it was basic security. My take on that was "It depends".

On the Security Catalysts forums someone asked if NAC had any real value due to the fact that there are ways around it. My response again was "It depends".

Security depends on your company, your environment, your level of risk and risk acceptance. It depends on the level of competency of your IT and security staff. The level of competency of your end user employees. What partners, contractors, visitors, etc that are allowed to connect to your network. What controls you are willing and able to put in place. What policies you have and enforce. What level of buy-in you have from management. What does your IT environment look like. Is it new, old or a mix? It is small, medium or large? Is it complex or simple? Do you have lots of different apps or only the core ones required to do business. How big is your Internet facing presence.

This list could go on and on and on and on. There are too many variables to give a concrete answer to these and other similar questions. So the real answer is that it doesn't matter what your idea of the answer is. Your job, as a Information Security Professional is to do the best you can with what you have and plan for the worst. That is where the concept that IR belongs to everyone comes in.

Many companies have IR teams that jump into action at a moments notice. But what happens between the time a incident is discovered and the team is able to take action can make all the difference in the outcome of the teams work. The rest of the company, from end user to IT/IS needs to know what to do in the event of a incident. If they don't then they will invariably do something wrong that will hinder the investigation and fixing of the issue.

I've written too much so I don't have time to go into details here but suffice it to say that IR goes way beyond the team. It has to be dealt with at ALL levels if success in dealing with an incident is your goal.

Light on Posting

I've been light on posting lately because I've been heavy on busyness. Between work and family life it's been quiet hectic. I've got LOTS of projects going on at work plus we just finished our yearly IT Audit last week and that has spawned a few more.

One of the tasks that I've been given here is basically creating a information security program from scratch. It's a great challenge and opportunity but it's also a great time consumer. Luckily I've got some good friends who have given me some insight on what direction to take. I'm currently re-reading The Pragmatic CSO because it is basically about building a security program from scratch. I'm also working on a User Awareness Program, several new technical controls are being rolled out for which I have primary leadership responsibility. Luckily I won't have to do all the work on them. I have a VERY talented team of engineers to assist me with that.

I'm also still learning the environment here. There are lots of things going on in the network that are not documented. It's a weekly thing to discover new ones. Talk about a Security Professionals (dream, nightmare, challenge) You pick your favorite answer. :)

I also had a good scare and laugh yesterday. We have a partner that has a connection to our network and they have a DFS share that we access. They have been having problems getting people to connect to it lately. They have tried several things and finally found the answer. Their firewall was blocking some of our subnets. So they fixed the problem and then their server admin got the idea that it would make life much easier on us if we didn't have to "reauthenticate" to access the share. So he decided that since he had several new users to set up access for he would just have them give him their domain username and password. Of course we had a couple of users who did do this before I found out about it. Needless to say I made a phone call to him IMMEDIATELY. As I politely explained to him why this was not an acceptable solution to the problem he said that he understood and was only trying to make it easier for us. Then he said that he too was very security conscious and understood my position on this. OK, if you are so security conscious and really do understand then WHY did you do this in the first place? This just reinforces my stance that much of our User awareness training needs to focus on the average IT staff person.

Well, I've spent enough time here for now. Got to run and get back on these projects. I'll try to post a little more regularly from now on.

More on User Awareness Training

User Awareness is one of my favorite topics (like I had to tell you that). There are a couple of different camps when it comes to this. Those who think it is a vital part of a Information Security program and those who think it is a waste of time. I fall in the first category (again, like I had to tell you that).

In my opinion the problems with UA is that many programs are close to useless. They cover the topics but they do a poor job. Even if the information is correct the delivery is bad. Poorly written, delivered, boring, etc... This is the challenge in creating an effective UA program for your company. I have been a participant in a few UA classes in the past. They all have lived up to their reputation of being a waste of time. Now I'm in the process of designing a UA program for my company. I'm excited to have the opportunity. Now I will be able to put into practice some of the things that I truly believe will make UA effective. I'm going to work with some good friends who have been doing UA for a while and have created successful programs. Depending on budget and such I will possibly enlist them to provide content and counsel or possibly just allowing me to bounce ideas off of them. Then of course I have the resource of the Security Catalysts Community to draw from. Between their participation in programs and creating or having input into them I will have a rich pool of information and creativity to draw from.

Why do I bring this up now? Well, my thoughts turned back to here when I saw these two posts from Tom Olzak on the ITT Blog (here & here). The first one talks about how the bad guys are starting to turn their focus from firewalls, servers, etc to end users. Why? Because of a couple of reasons. There are lots of new attack vectors that work well and are easy to do. They attack the browser or other popular applications that are used frequently on the Internet. Java, Quicktime, Windows Media Player, JVM, JRE, Adobe Acrobat, Silverlight..... This is just a small sample. Many of these attacks require nothing more than the user visiting a web site that has a malicious add on it. This article from Brian Krebs at Security Fix has a good example of this.

The second post by Tom talks about how we need to start teaching Security Awareness in high school. Start the education before the users get into the workforce. I like that idea. Not only will it help when they do enter the workforce but maybe it will help at home. Maybe what they learn they will then teach to their parents. Hopefully by doing this we can spread the word outside the work place and get it into the homes where it needs to be.

I'm not sure if all of you are aware of how easy things are for the bad guys now. Hopefully you do, but if not I'd like to point you to a couple of good posts that Jeremiah Grossman pointed us to a few days back. They are here and here. Check them out to learn more about some of what is going on or at least what is possible.

Also if you want to learn more about putting together a good Security User Awareness Program you can talk to Michael Santarcangello, Rebecca Herold, or The guys at NoticeBored.com. All of them can help you with your program.

Sun Tzu got this one wrong. :(

I finally ran across an Art Of War quote from my handy calendar that definitely does not apply to information security. Even if vendors try to convince you otherwise.

If you carry on alliances with strong countries, your enemies won't dare to plot against you.

Alliances with strong countries (i.e. security vendors) will NOT protect you from the attempts of the bad guys to get into your network, application or systems. I would even venture to say that for some of the black hats they consider it a challenge and the stronger the defense the harder they work to penetrate it. Especially if they think that there is something worthwhile waiting on the other side.

Sun, I'm sorry to say that you have let me down on this one. I can see Amrit smiling now. :)

New Information Security Poll

Yesterday I asked a few guys on the TCC SILC channel for ideas for a new poll. The first suggestion had to do with keeping SSN's. I thought it was ironic because there was a thread on a PCI mail list asking that very question. They guy on the TCC channel that suggested the SSN question was completely unaware of the PCI mail thread. Then when I got home I had a letter in the mail telling me that a company that has access to my PII had had it compromised. It was sold by an employee to a marketing broker. Who knows what happened to it after that. Part of the information that they had was my SSN. How lovely. Then on top of that I remembered a friend who works in a university environment that has had a couple of SSN incidents lately. So all of that combined made me think that a Poll on the validity of companies keeping SSN's was in order. So here is the question and you can rush to my web site to take the poll.

Is there a valid reason for companies (other than employeers) to ask for and keep SSN's?

This is a hot topic in the world of Information Security. Many think that there is no valid reason for any company to ask for them and definitely not to keep them. Then there are those who think that there is a valid business reason. Others argue that it depends on the industry. In my opinion SSN's and ANY PII (personally identifiable information) should only be used when absolutely necessary and storage of them should be kept to an absolute minimum and guarded like it was financial information. Customers are the life blood of any business and need to be treated as such.

What's wrong with this statement?

I saw this article on Network World today regarding VOIP (in)security. This statement caught my eye. See if you have the same thought that I did.

Much of the notoriety of VoIP vulnerabilities come because the technology is relatively new and its code wasn’t necessarily written with security in mind — a problem that plagues many new technologies.

What do you see wrong with this statement? Shouldn't newer technologies be written with security in mind? I can see where ethernet and IP and such didn't take security into consideration when they were created. Security wasn't hardly even on the radar then. Now it's everywhere! There is no excuse for any technology that has come about in the last 10 years to not have security as a primary design consideration. I know that even 10 years ago security wasn't big but anyone who had any foresight would have seen what was coming.

I haven't ranted in a while about how software companies have to put more work into shipping secure products. This mindset of sacrificing security for "speed to market" has got to go.

PCI Poll results

My newest information security poll on the PCI/DSS ended yesterday and it looks like we almost have a tie. Out of the thousands of votes (OK, maybe not quiet thousands but at least 10) the results were 55% said PCI was basically common security 101 and 45% said that it was complex and costly. There were 5 possible answe

1. Too Complex 40%
   
2. Easy to Understand 30%
3. Too costly for most 20%
   
4. Too time consuming 0%
   
5. Basic Security 101 40%

Now I know that the numbers don't add up but voters were allowed to select multiple answers and the percentage is based on the total number of voters.

So I guess it goes back to my original thought that the level of difficulty that PCI compliance involves depends on the shape of the network you are working with. Large or small if it is a poorly designed network you are going to have a struggle. If it is a securely designed network then your job will be much easier. The issue isn't understanding what is required it's putting the requirements into practice.

I'll have another poll soon. This week has been all audit all the time so I've not had a chance to think of another question and nothing in the RSS feed has jumped out at me. If any of you have any suggestions let me know. And lets get more involved with the process. Poll response has been less than steller. Consider it practice for the November election. :)

Shunned by the WSJ

After my letter to the author of the WSJ article "Ten Things Your IT Department Won't Tell You" I was contacted by the author. She thanked me for my comments and told me that she would do a follow up article and asked for my input. The topic was to be something along the line of what the IT department wants users to know. I decided that since I was quick to criticize I would also give my input on how to be a better user.

After thinking about it I decided that my advice was to basically ignore the advice given in the original article. I was a little more tactful than that but that was the essence of it. I pontificated on the virtues of NOT trying to skirt company policy and why it was a bad idea for security reasons and such. Well today she published her new article and lo and behold my advice was NOT included. Why? Is it because she had better advice from others? Possible. Is it because it didn't fit with the nature of the article? Possibly. Is it because I told everyone to ignore her first article? Hmmmm.

Of course I probably will never really know why and it's very possible that it has nothing to do with that, but I will always wonder.

Great Awareness Video

Roger over at the Infosecblog links to a great video on them importance of "thinking" before posting something on the internet. Once it's there it's there. This is true for what you say, what pictures and videos you post and comments you make. Remember, what happens on the internet stays on the internet. And one day your parents, spouse,child, boss or potential boss may find it. That may not be a good thing.

Egg on you FaceTime

Even security companies make mistakes. It's just a little more embarrassing for them than the rest of the world.

ComputerWorld reports that FaceTime Communications applied some patches to their web server that reset defaults on some folders. This allowed the contact information for people who had downloaded whitepapers to be exposed on the net. I don't really blame FaceTime for this. It was an innocent mistake that anyone could make. What we need to do is learn from their mistake.

As I've mentioned before we are in the middle of rolling out a new Change Management system and our users HATE it. They like the old way of little or no accountability and having the freedom to do things their way. I don't know if FaceTime has a Change Control procedure in place or not but either way they do need to revise their test scripts. They need to expand what they test and also go back and check to ensure that unexpected changes don't happen. You can never be to careful when applying changes, especially to public facing systems.

1 year and 275 posts

One year ago today I started my blog. I did it as a way to say somethings that I wanted to say. At that time I didn't have much interaction with IT and Information Security Professionals on a day to day basis. I was the lone IT guy at my company and was tired of talking to myself so I started blogging. I have to give credit to a couple of those who gave me some inspiration. I read their blogs and thought "hey, I can do this to". Martin McKeay, Michael Farnum, and Michael Santarcangello. These were guys a lot like me that were blogging and telling stories from the trenches and giving good sound advice. Now I count each of them as a friend that I can turn to with security, technology and life advice. I've only met Santa face to face but in todays world of the internet it doesn't even matter anymore.

Since then I've made lots of other friends because of my blogging. I'm involved in the Security Catalysts Community as a Trusted Catalysts and this has allowed me to interact with some of the brightest guys in Security. I've also gotten to know several people who are well known and well regarded in the blogshepere and in Security in General.

I hope that all of you have found something of value in my rantings, questions, concerns, and comments. I guess you have or you wouldn't keep reading. I've heard from lots of you and it amazes me that people from all over the world actually read what I have to say.

I look forward to this next year and the fun times ahead. :)

Oh yeah, one other thing. I discovered a few days ago that my friend and Art of War and User Awareness nemesis, Amrit Williams, also started blogging one year ago today. I found that rather amusing considering the number of times we have butted heads over these subjects. But I must say Amrit is a great guy and I wish him all the best on his next year of blogging.

Viva VM!!

Good news! According to my latest completed poll Virtual Machines are not doomed to failure. The potential problems do not out weigh the benefits and users are still confident that VM technology will provide their needs with adequate security. OK, so I read into the results a little but I'm allowed because it's my blog and my survey. :) Not a single person said that VM was on it's way out and only one said that they wanted to "wait and see" on how the research and technology played out. Obviously most think that even though we are starting to see issues with VM technology that we can stay well enough in front of the curve to keep pushing on.

This weeks survey is about PCI. I'm still crafting the question and answers to pick from, but it will have something to do with your thoughts on PCI complexity or lack thereof.

PCI and your network

Many of us work for companies that have to comply with various regulations. HIPAA, SOX, GLBA, FISMA, PCI, and on and on. For me in my current position it it PCI. I am familiar with the basics of most of the above mentioned regulations and know enough about them to tell you that many of them are vague (which may or may not be good) and difficult to interpret and understand. PCI is NOT one of those that falls under that category. PCI is pretty clear and does pretty much everything except tell you what brand of equipment to use and what vendor to buy it from.

I read a couple of articles today by Rebecca Herold and Ben Rothke at CIO.com that got me to thinking a little about my own PCI woes today. Both of these articles assert that PCI is not a complex monster like some would lead you to believe. It is fairly clear and straightforward. Yet lots of people complain about it and talk about how much it costs to comply and how much work is involved and how long it takes. Which is true to some degree. It can be long, costly and time consuming, but it is still just basic information security sense.

Between the stuff that you can find at the PCI Security Standards web site and a little ask.com searching (still not using Google unless I have to) you can find just about everything that you need to put together a plan to be compliant in short order. That doesn't mean that there will be some areas that you need clarification and direction on. There will be questions that you have no clue how to answer. But it's not rocket science. I think Ben Rothke nails it on the head when he says.

The issue really is that these merchants have created their networks with little to no thought to security and privacy. They have placed minimal controls on their users, given no direction to their application developers, nor documented required procedures for their administrators on how the network should be managed. Merchants are not noncompliant due to PCI DSS; they are noncompliant because they never developed their security programs in the first place.

These Tier 1 and 2 merchants and many of the smaller merchants have large complex networks that are old and were designed with ease of use and administration in mind and not security focused. They put in the basics to keep the passive snooper out but not the aggressive hacker. They are complaining because they did not do a good job and now they have to go back and clean it up. That is why it is expensive, time consuming and complex. I know this first hand because that is what I'm up against. I'm having to retro fit security into some areas that should have had it in the first place. I'm just lucky that I'm working with a standard that is cut and dry or I'd really have something to complain about.

I'm confused (or one of my readers is)

When I started blogging I decided that I would not be a "fan boi" for a vendor and that I would speak my mind and always try to get my facts straight before I wrote about anything. I also decided that I would post all comments provided they weren't spam or of a obscene and vulgar nature. Well I received a comment today on my "Open Letter to the WSJ" post and I've decided not to post it in the comments section. I'm going to post it here. I'm doing that for 2 reasons. First, whoever wrote the comment decided to submit it anonymously and secondly it makes absolutely no sense what so ever. I thought maybe some of you could add some insight into what in the world he/she is talking about.

Yes, I'm certain that our having casualties over there is entirely the fault of the Post and the Times outing every operation (or Geraldo on Faux News), and has nothing to do with our military and our government simply not having sufficient planning or men involved to properly control the dismantling of another country.

If the 'secret details' they inform us about happen to be against the law, or violations of our civil rights, then they are doing what they should, making the citizenry aware of inappropriate behavior on the behalf of their government. Are you guys all for such behavior?

That's just like encouraging people to skirt the rules, precisely what you are castigating this reporter for doing. Yet you are applauding the government for doing it?

• I can vaguely understand the connection between papers posting reports about troop movements and the WSJ posting ways to subvert network security.
• Apparently the reader assumes that I and most of my information security and blog friends are in favor of the war and think alike regarding it and politics. I can assure you that there are many of my security/blog friends that are on opposite sides of the fence from me in regards to politics, the war, social issues, etc..... (I'm getting this from his comment "Are you guys all for such behavior?")
• It seems that the reader thinks that I am being double minded in regards to media coverage of political events and such. I applaud them when they say what I want and chide them when they say something that I don't like. I may be wrong but I don't think I have ever written about anything political. I make a very conscious effort to not do so.
  

If anyone has any insight into this please let me know. If the person who wrote this wants to clarify I sure would appreciate it. At first I thought that maybe he/she meant to post it to some other site, but I don't think so.

I'm also making a modification to my comment rules. I will continue to post all comments, positive or negative, as long as those who have negative comments (especially off the wall ones) will identify themselves. The way I look at it is if you have something negative to say and you don't want to identify yourself then you can find another place to make negative comments.

We're All #1

I've received 2 comments from others who checked their Technorati ratings after reading my post and they also were number 1. One of them actually just registered his site with Technorati after reading my post and immediately went to number 1. I guess he was a instant best seller. Shortly after I posted the Technorati site went down and when it came back up I had gone back to my usual ranking. Actually I even fell a little into the 38000's. Oh well, glory is short lived.

I'm #1

It's been said that bloggers blog to feed their own ego. I have to admit that it does my ego good as I get to be known by more and more people. Honestly that isn't why I blog but I do keep track on my Technorati ratings and do "vanity" searches from time to time to see who my be linking to me.
Today I checked my Technorati ratings and got a complete shock. I'm sure that there is some sort of an error but it shows me as being #1! I had to do a screen shot of it and save it for posterity. I know it can't really be right because I know roughly how many readers I have and when you click on the "Top 100" button I don't show up. Usually I'm around 37,000 or so and I imagine that I will be back there as soon as they fix whatever is causing this error but it looks good. :)

Lots of good stuff to read

This is my "semi occasional" (yes, that's my own made up word) link post. I've been too busy to write much and today I'm playing catch up. There is so much good stuff out there that I can't do separate posts on them all so I'm just gonna link and make quick comments.

http://securitybuddha.com/2007/08/04/trends-in-information-security/
This "State of Information Security" report of sorts from Mark Curphey is gives his take on several issues regarding security.

http://taosecurity.blogspot.com/2007/08/black-hat-usa-2007-round-up-part-1.html
Richard Bejtlich gives us "no hope" in getting ahead of the game when it comes to securing our networks and systems. Unfortunately he may be right, but I'm not ready to give up yet. I also thing that even though he is "depressed" Michael Farnum isn't ready either. Of course Richard isn't a total pessimist either. He promises some defensive strategies in the near future that will brighten our outlook.

http://www.realtime-itcompliance.com/information_security/2007/08/the_many_languages_of_security.htm
Rebecca Herold has some good points on Security Awareness Training. This is one of my favorite topics, especially since I'm in the middle of creating a program for my company. I look forward to seeing more details on her upcoming offering.

http://security-awareness-training.com/2007/07/23/best-practices-for-security-awareness-training/
This is another good post on SA Training.

Now for the awards!
Blog post that I am MOST sick of seeing. I've seen this sooooooooooo many time in my Google blog search listings that I am really ready to delete the search and just rely on other blogs that I read keeping me linked to the new and good stuff out there. I'm also so tired of seeing it that I'm not gonna link to it I'll just give you the post title. I'm sure all of you have seen it. Welcome, Postini Team.

Best story of the week has to go to the one about Michelle Madigan getting kicked out of DefCon for trying to get video of the event w/o registering as press. It would have been so much easier for her to do her story if she had just stayed on the up and up. Of course that would not have made for very exciting coverage.

What are the boundries of security?

I read this from Bruce Schneier and it wasn't the article he referenced that got me to thinking it was this comment.

The real issue here is that people don't understand that an airport is a complex system and that securing it means more than passenger screening.

This comment holds true for Information Security as well. The issue is that a network is a complex environment that involves many different systems, applications, connections and users. Securing it means more than traffic screening at one level.

I was speaking with someone the other day and she commented that we didn't need to worry about security on her project because nothing was internet facing. That statement might have held some truth in it a few years ago but not today. The average user doesn't realize all of the attack vectors into a system. They think that if you secure the perimeter or stay off of it then you are safe by default. Unfortunately there are still some IT professionals who feel the same way.

At my company we are in the middle of rolling out a change control system. We have had a policy and manual process for years but it was always just a formality. Someone would request to make this change at this time and it was approved. The focus was to keep 4 groups from making major changes at the same time in case something went wrong. Now we are starting to make the requestors justify their request and give full documentation as to who, what, where, when, why and how. Most of the users do not like this. They whine and complain constantly. Luckily we have someone in control of the process that sticks to his guns and hold them accountable.

This is the same mentality that we need in all of IT/IS. We need to ensure that our users understand the where and why of security. That way they will understand that security belongs everywhere in the network and not just at the border.

On Open Letter to the WSJ

This is an email that I sent to the WSJ writer and her editors regarding the article "Ten Things Your IT Department Won't Tell You"

You can also read some more good thoughts on this article here, here, and here.
__________________________________________________________________
Ms. Vara,

Isn't it good to live in a country where you have the freedom to be an irresponsible reporter? You don't have to live with the consequences of your own actions here. You can just speak your mind, reveal your little secrets and move on to your next assignment. Maybe your next article can tell people how they can steal confidential company data. Oh wait, you did that in this article.

As a security professional my days are filled with trying to protect the assets of my company. I strive to educate my users to practice safe security and not do things that will put the network or the company at risk. Your article has just thrown lots of work out the window. I realize that you have a "The Risk" section for each trick, but that doesn't diminish the fact that you are telling people how to break the rules, policies and procedures that are in place for security. This will put the company at risk and the offending persons job at risk. Not to mention the fact that people will use the work-arounds that you suggest even if they know better because now they know how.

Your attempt to justify your position by calling in hacking and security pros does little to nullify the bad advice that you are giving to people. It's NEVER a good idea to encourage people to do things that they are not supposed to do. Just because either you or anyone thinks that Security is being too strict or that it's just easier to do it at work does not justify such actions. Your attempt to say that if you take work home then you should be able to take home to work is also a very weak argument. If you take work home it should only be because you have a legitimate business need and it has been approved by Management and Security. Not to mention that your home network and PC should also be checked and approved before use. Carelessness such as this only leads to problems.

Sincerely,

Andy Willingham
http://andyitguy.blogspot.com
http://www.linkedin.com/in/andyitguy

Virtual Machine = Virtual Vulnerability?

Paul and Cutaway both write about the latest research in VM escaping and it's not pretty. The research that is not their writing.

It seems that Ed Skoudis and team have come up with a way to really escape a VM and run an exploit on the host system. This is still "shaky" in terms of it's not perfect and it's not complete but the potential consequences of this is pretty severe. VM's are used quiet heavily today for many different things. One of the biggest being malware testing. The bad guys have already figured out a way to make that more difficult but this makes it even worse. A VM is used because it can be blown away and reloaded in a matter of minutes so if it get hosed it's no big deal. If the bad guys can cause the VM to crash and then exploit the host machine then that puts AV research in a bit of a bind. VM's are also used by companies to save space, hardware and time. Lots of security software runs on VM's and this has the potential to put all of that at risk.

Read the articles by Cutaway and Paul and do some research yourself and let me know your thoughts. After you have become informed check back on my site and take the new poll. "Are Virtual Machines days numbered?"

The debate continues

I just tallied the results of my first poll (we actually they were automatically tallied). It looks like the jury is still out on Security ROI. There has been lots of good debate going on lately regarding this and both sides have good points.

The question was "Whether real or perceived, does security provide ROI?"
46% said Yes, it does provide ROI
54% said No, it does not provide ROI

Obviously the No's have it, but the results are fairly close. If I were a statistician and figured in a margin of error of 3 or 4 percent then the results could be much closer.

People much smarter than me have written on this and have sound arguments for their positions but here is the final word (I can say that because it's my poll) :)

In the strictest sense of the term security does not provide ROI but when you look at it in the big picture and take into account things that you can't really measure (and that is what happens in real life business everyday) then yes it can and does provide ROI. Money not spent because a breach didn't happen is a form of ROI. Savings realized because of time saved due to a security measure introduced is a form of ROI.

Now I know that many of you will take issue with this and go back to the "literal" definition of ROI but this world isn't literal when it comes to technology and security. If it was then my guess is that most of us would not be employed in this field because our "literal" inability to completely protect our networks and data 100% of the time would push us out the door. The Information Security field would be reduced to a very small group of people in a "literal" world.

You can never be too careful

You would think that me being a Information Security Professional that I would always be extra careful in what I do. That way I save face and ensure that all of my systems are safe and secure. Well as an act of humility I'm gonna tell you about something STUPID AND CARELESS that I did yesterday morning. I started to write about it but forgot. Then I read this post by Ravi Char this morning and it reminded me.

You have heard my rants and woes about SunRocket. (just a quick update, my service was restored for 2 days then went away again. My sister still has service w/ them even though she has signed up w/ another company. She is just waiting on the equipment to arrive so she can complete the transfer.) A couple of days ago I signed up w/ another company for phone and internet service. I saved the order info to a pdf on my laptop. I then emailed it to myself so I could get it at work. I was in a hurry and didn't pay attention to the address that I selected. I accidentally sent it to a group list that I had that was named Andy. So the details went to about 15 friends. Luckily there wasn't any "sensitive" info but a careless mistake like that could cause real problems. So lesson learned? Pay Attention!!!

Legimitate Uses for Encryption

Robert over at the Errata Security Blog writes about a fear that he has. He read a post that made him start to worry more about the possibility of encryption being used against you. I think I agree with him. Our rights are being eroded almost every day. A new law is passed or a judge with an agenda makes a ruling that makes it illegal for the average person to do something that is completely harmless. Already in some countries rights have been taken away all in the name of "security". Handguns have been banned and made illegal, encryption keys are required to be given to law enforcement, etc...

Robert has a method that he suggest that all of us use to do a couple of things. One will make it much harder for law enforcement to determine what is actually encrypted data and what is just random "junk". The other will make the daily use of encryption more acceptable and "normal". The purpose is to increase the use of encryption so that it is considered something that the normal person would do. Kind of along the line of the "Reasonable Person" rule used in many legal cases.

I like the ideas but the method is not for the faint of heart. Many IT and information security pros would have difficulty making sense of his plan unless they are very familiar with cryptography. So it is out of the question for the "average Joe". Not to mention many would have moral and religious issues with carrying around a DVD full of encrypted Porn. :)

My suggestion is that we, the IT and Security community, need to do a couple of things. First, we need to make sure that we use encryption on all of our personal systems. It's a good idea from a privacy and security perspective, but even if you don't have anything to hide use it just to increase the number of people using it for normal and legitimate reasons. Second, we need to encourage and teach our friends and family how to use it. There are several free and low cost options for encrypting our disk or data. Third, we need to create a plan to get the word out to the rest of the world. We also need to create some easy to understand guides that we can make available to anyone. They need to be done is such a way as to be usable by most anyone without them needing assistance from someone who understands encryption.

This is a big challenge, especially number 3, but I think we can do it. How is the question. I have posted this question to the forums over at the Security Catalysts Community also. So between them and us we can come up with a plan.

Someone Beat Me To IT

I knew that I should have quit procrastinating and started writing. But it looks like Scott Watson beat me to the punch and wrote "The Art of War for Security Managers". I've already put it on my Amazon Wish List and will get it soon. I may even get 2 copies. One for me and one to send to Amrit. :)

HOTSEC is Tonight!! (this time I mean it)

For those of you in the Atlanta area that can make it tonight is the inagural meeting of the Atlanta CitySec community. We are meeting at The Brick Store Pub in Decatur at 6:00. If you are in the area and can make it we'd love to see you there.

Learning from the Pros

My Out of Control Network post has generated a lot of discussion on the Security Catalysts forums. The reason I'm telling you this is to point you to a resource that will give you lots of useful information and advice. These information security and IT pros took my few comments on documenting your network and expanded it into a firestorm of advice for what to document to ensure that your network is a fine tuned machine. At least from a documentation point of view. Check it and the rest of the useful information out.

Web Poll

With all the discussion going on regarding ROI and information security and the fact that blogger has just released a polling option I have decided to take a poll on my site. For those of you who read via RSS please take a minute and go to my site here and take the poll. It is on the right hand side of the page just under the subscription links.

It's a simple and short poll. Whether real or perceived, does security provide ROI? I'm not asking to get into the true definition of ROI. For You and your organization does it provide ROI?

I just changed primary search engins

Like many, many people I use google a lot. I have a gmail account, I use Google calendar, Google docs and spreadsheets, Google reader, Google blogger, Google maps, Google earth and Google search. I, also like many others, am concerned about the amount of information that Google is able to gleen about me from my use of their tools. Not enough to really do anything about it because I don't do things that I want or need to hide. I know that there is much more to it than just that, but that is how I feel currently. Now I don't use any of them as my primary tool except for blogger, reader and search. Now the search is going to change. At least for a while. I saw this ComputerWorld article this morning that has made me switch to Ask.com for my search needs. Why? Principle if nothing else. I like the fact that they are willing to really do something to address the concerns and needs of their users. Although I don't have anything to hide in my searches I like knowing that I can do them anonymously and, even more so, that Ask.com cares that I may want to. I sure seems that Google doesn't care. Even though they are implementing a new 2 year policy on cookie life Martin McKeay, of The Network Security Podcast and Blog, tells us that this is really useless because the cookies are "renewed" every time you visit a Google site. Can you say "tomorrow never comes"?

Out of control network

Like most IT people I've always disliked documentation. At least having to be the one to actually do the documentation. I know it's important and that it can save you and others lots of time when push comes to shove. This has hit me in the face hard since starting my new job. The company uses lots of contractors in the IT department and the network has been built and modified over the years by lots of different people. Documentation has been sporadic at best. So therefore knowing what is going on and why can be a challenge. Almost everyday someone on the team gets a "surprise". They either discover something new, different, unexpected, unexplained, or just plain unnecessary. It's almost comical at times, but when you think about it there are potential serious ramifications.

This has made my job quiet a challenge. It's hard to design a security program when the environment isn't well understood by those who have been there for a while and especially when I'm still learning new things about it. The good news is that we have managements blessing and understanding of how things are and how they need to change. We also have a good team assembled to make this work. I'm amazed at the level of knowledge and understanding that they guys I work with have. They are much smarter than most of the guys I've worked with in the past. These guys are passionate about what they do and they don't like doing shoddy work.

All that said the real purpose of this post is to emphasize the importance of documenting and understanding your network. Not only is it good for daily understanding of what you have and how it works it will come in handy in troubleshooting, DR situations, personnel changes and compliance. Many of the regulations that most of us have to comply with require you to have a well documented environment.

Technology will help you in your information security endeavors but it has to be complemented with documentation, policies, procedures and a well designed User Awareness program. Most of us focus on the technology part but if we want to expand our horizons and ensure that our environments are as secure as they can be it is a good idea to get familiar with the other areas.

• Look over your documentation and update it. This needs to be done at least yearly and especially anytime you introduce a change in the environment.
• Read your policies. Ask questions if you don't understand something or if you think something is incorrect. Remember, if your policy says you do it you better do it and be able to prove that you do. The Auditors will want to see the checklist, the archived logs, etc.. Don't be afraid to bring up inconsistencies to Management and to make suggestions.
• Review the procedures and guidelines that are published within your company. Again many regulations require you to have written procedures for how you deploy systems, handle new users and users that leave. They want to know that you know what is going on and again if your procedures say that you do something they will want to see proof that you do it.
• Sit in on a UA session or ask to see the material that is used. Make suggestions on ways to make it better and more understandable for the average user. Suggest new things that could be done to make the information easier to retain. People learn in different ways and maybe you have an idea on how to present something in a different format. You may even have the talent to make it happen. You could help put together podcast, videos, RSS feeds, email blasts, or whatever sounds good and works.

As I've said before security goes beyond the server room. It requires that the IT and IS groups work together along with Management, HR, Training and even the end users. We have the knowledge and skills to really make a difference beyond the technology side of things. We just have to get out there and make it happen. I don't think you will regret making the effort.

Final SunRocket Update

Something "official" finally happened from SunRocket. I received the email below yesterday telling me that it's over and that they enjoyed serving me. It also gives a few more details but nothing much.

The odd thing is that my sister still has not lost her phone service, my dad lost his on Wednesday and my service was restored last night.?????? Of course I have no idea how long it will work for. I still haven't decided what to do as far as my service goes. Do I continue with a similar VOIP provider (Packet8, ViaTalk, etc), go with my cable providers offering, go back to a land line provider.

Here is the email that SunRocket sent.

Dear Customers,

After significant effort by the Company to avoid this result, SunRocket is in the process of closing its operations and therefore will no longer be able to provide you with the phone service that you have been accustomed to. However, this email provides you with an opportunity to sign up with select service providers who we believe will offer outstanding replacement service

In order to assist you, we have entered into negotiations with a number of service providers. As a result of those negotiations, we have entered into agreements with 8x8, Inc., provider of the Packet8 service, and Unified Communications Corp., provider of Teleband service to offer you the best options and we are proud to recommend the following alternatives to you. Please make your decision to move to a new service provides immediately as future service is uncertain.


8x8/Packet8

The Packet8 Internet phone service incorporates patent protected technology from 8x8. Inc., a publicly traded company in business for more than 20 years. The service works in the same way as SunRocket.s and offers a virtually identical feature set.

. No Startup Costs
. FREE activation
. FREE equipment
. FREE shipping
. FREE first month of service
. Quickly port your number at no charge

A Savings of over $100!

Copy and paste the following link into your Internet browser: http://getpacket8.packet8.net/sunrocket/ or call 1-800-868-0068 and mention special offer code SUNROCKET


Unified Communications Corp./TeleBlend

The TeleBlend Internet phone service incorporates patent-protected technology from Unified Communications Corp., a privately held company in business to provide outstanding customer service and telephony products. Teleblends has been working behind the scenes already to restore and continue service for all Sun Rocket customers The service works in the same way as SunRocket.s and offers an identical feature set with our Unlimited Transfer Plan.
. No Startup Costs
. FREE activation
. USE your existing hardware
. FREE and Quick transfer of your current number
. No Need to port your number to another provider
. UNLIMITED calling to the US, Canada, and Puerto Rico

Copy and paste the following link into your Internet browser: http://www.myteleblend.net

It has been our pleasure to service you at SunRocket!

Correction on HotSec

It's not tonight it's next week on Wednesday 7/25/07. Sorry for the confusion. I was so excited that I moved it up a week. :(

Thanks for pointing this out to me Rothman.

HotSec Tonight

For those of you in the Atlanta area that can make it tonight is the inagural meeting of the Atlanta CitySec community. We are meeting at The Brick Store Pub in Decatur at 6:00. If you are in the area and can make it we'd love to see you there.

New SunRocket Update

I've found a little more info. This CNN article gives some news and Beau pointed me to this blog from a former SunRocket employee. He gives us tips on how to transfer our numbers.

I still don't have any clue as to why some service is up and some is down.

VOIP Woes

Update:

OK, I'm officially confused. I called my sister and my dad and they both have service. I thought that maybe SunRocket was forced to turn service back up until all current users can make other arrangements. So I called my house and I still do not have service.

________________________________________________________________

About a year ago I signed up for VOIP home phone service with SunRocket. They had been around for a while and seemed to have a good track record. Voynage was starting to have issues so I decided to go w/ SunRocket. NOT A WISE CHOICE!

Last night I lost service and decided to wait until today to see what happened. Then this morning I saw this post on O'Riley. I did a little more investigating including calling their support line. It was before 7:00am Eastern Time so I got their voicemail. I just called back and got the following message.

Thank You for calling SunRocket. We are no longer taking sales or support calls. Goodbye.

That's it. No emails telling us what we need to do to be able to retain our number. No word on what happens to those who paid a yearly fee and still had months remaining. Nothing.

I consider myself lucky in that I was close to the end of my first year and only lost a month or so of prepaid service. My sister, on the other hand, just signed up in May and my Dad signed up in January. What are they to do?

Anyone interested in buying 3 relatively new SIP enabled VOIP boxes? :) Just kidding. They may make good project fodder. Maybe the guys at Pauldotcom will write a book on hacking them.

You know better than that

I received a password protected document from a security company that we do business with. I did not know the password so I sent him an email letting him know that. I expected to get a phone call but to my surprise and disappointment I received an email with the password in plain text. Now the document was not of a highly sensitive nature but it's not something that is meant for the public eye.

Of course the sensitivity of the document is not the issue here. The issue is that the password was sent via email. An worse than that is the fact that it was a security professional that did it. Someone who really should know better. I realize that the chance of someone actually sniffing out connection at that moment and pulling the password is remote and that it is even more remote that he would have been able to capture the earlier email with the document attached to it.

It's just one of those things that gets my goat just a little. Of course shortly after I started writing this I received another email with a password in it. This one was from a friend and Security Professional. What am I gonna do with you guys! :)

Maybe he didn't really think this through.

A friend pointed me to this article about a student list at Texas A&M Corpus Christi that was "misplaced" for a few hours. The list contained the personally identifiable information of 49 students. The list contained names and social security numbers of the students. This is the second incident in less than 2 months for TAMCC.

This post isn't about the incident or how it was handled by the college. It's about a comment that was left. Here is the comment:

Posted by josegutz on July 12, 2007 at 1:24 p.m.

It seems like it is an issue with the IT department at TAMUCC.
They need to ban all key or flash drives from being used if they cannot get that security measure together about using SSN's for identity purposes. They should do a PKI access after all they use access cards for Identity when enrolling at the University. Banning these thumb drives would minimize the security risk of someone walking off with all of this information. I don't want to get in too deep about all this technical garb since it seems that one would have a hard time to comprehend such a concept.

Here is my issue with the comment:

1. This has absolutely NOTHING to do with the IT department.
2. This has absolutely NOTHING to do with flash drives.
3. IT does not dictate whether or not the university uses student SSN's as identifiers.
4. PKI would not have prevented a student from walking off with a SHEET OF PAPER.
5. PKI is not an easy technology to implement or manage especially is a university environment where my nature of what they do the network needs to be open.
6. Banning thumb drives would not have prevented anyone from walking off with a SHEET OF PAPER!

This comment just set me off for some reason. Maybe it's because I have friends who work in IT and security for several universities. Maybe it's because the person tried to blame the IT staff for this and IT gets enough of a bad rap as it is. Maybe it's because the comment really didn't serve any constructive purpose except to put blame on someone without having all, no wait, ANY of the facts. Maybe it's because this person probably works in IT. I say that because the average person does not know what PKI is or how it works. Apparently this person doesn't really have much of an understanding of PKI either. If he did he would have realized point 5 above.

Now that I have ranted let me try to add value to this.

1. Yes, it is a bad idea to use students SSN's as identifiers. I have it on pretty good authority that this is going to change in the very near future.
2. Yes, PKI can help mitigate the risk associated with storing PII. It can be used to prevent it from being accessed by unauthorized users. It can be used to enforce security policies that could prevent copying data to removable media or prevent documents from being printed. But it has to be used in conjunction with other technologies to be effective.
3. There is no reason for the SSN's to be on the class roster that is given to the professor. But it is not the fault of IT or Security that this happens. Even if there are policies in place they have to have the support from Management in order to be enforced and true enforcement would require other technology to be implemented.
4. Security is not just the responsibility of the IT or Security. It is something that has to be embraced by everyone (or most everyone) in the environment. The professors have a share of the responsibility even more so than the IT department does.
   

Then my final point. If you really want to blame someone for all the problems that SSN has caused us, blame President F.D. Roosevelt and the U.S. Congress of 1935. They are the ones who gave us Social Security Numbers. :)

The Slow, Blue Poop Security Model

The other day I was on the TCC Silc channel and mad a comment about security being considered a four letter word at some companies. Well true to form James Costello and Larry Pesce both chimed in with several four letter words: slow, easy, blue, poop, none. The the conversation went south from there. Some how Larry coined the term "Slow, Blue Poop Security". I knew there was a blog hidden in there somewhere. Well here it is.

What does a SBP security model look like? It looks a lot like what you may have seen at your company or a company that you once worked for. It the security model that does just enough to get by. The security that keeps you from having you network owned by every hacker in the world but not enough to really offer protection. It provides just enough to make you feel like everything is OK but you really don't know what is going on. What is happening with your clients and servers? Just because AV doesn't report anything doesn't mean there isn't anything to report. Richard Bejtlich has a post today about something very similar. The SBP Security model doesn't let you know what is really going on on your network.

Sometimes the SBP model even looks good to the casual information security professional. The network has many tools and devices that look good and provide lots of pretty blinking lights. But there is no real plan behind them. These are devices that allow them to check boxes on their compliance audit. They have a device for each check box, yet there is still gaping holes in the network.

The point of all this is to say that there is no room for the SBP Security model in today's world. SBP security only causes things to be less secure in the long run. It keeps compromised systems on the network and allows them to still spew their SBP to the rest of the world. It gives the bad guys a cloak of privacy to do their bidding without being discovered because SBP makes you feel good.

That's where our job comes in to rid the world of SBP networks. To build our case for building networks that are really secure and that actually provide our companies, users and customers with the protection, privacy, and security that they really deserve.

And to quote Sun Tzu.................. Just kidding Amrit. :)

Larry, bet you didn't think I could do it.

Learning Security

There is an interesting conversation going on over at the Security Catalysts Community that I wanted to point you to. It's about employees using ICMP tunneling to get around web filters. It is just an example of the many different topics that are discussed in the SCC.

For those of you who may not be familiar with the SCC it is a gathering of passionate security professionals who want to have a place to interact with others who are of like mind. It consist of forums, a silc channel for secure chat and other resources to help you do security better. There are other things in the works also that will be coming down the pike soon. The best part is the interaction that goes on between the members of the community. We have people from all different industries. Financial, educational, government, private industry, the public sector. Our members work in different disciplines in security. Beginner Techs, programmers, researchers, penetration testers, administrators, managers, policy and compliance, and even CIO's, CSO's and CTO's. Many of these men and women have become my friends and I value what I have gained from the community.

I say all of this to invite you to stop by and take a look. You can spend time just looking around or apply for membership. It's all up to you. If you have a passion for security and want to join a group of people who are working towards changing the way we practice security then you are the type of person the SCC wants and the SCC is probably the place for you.

ATLSec

It's official Atlanta is starting a CitySec gathering. According to Thomas Ptacek (CitySec site Administrator and Matasano Chargen) the official name for Atlanta is HotSec but for some reason someone has branded it HillyBillySec. :)

It will be held Wednesday July 25th at 6:00 PM at The Brick Store Pub in Decatur. It's open to all Atlanta area Information Security and Computer professionals. I look forward to meeting y'all there! If you want to join in the conversation check out the posts at the CitySec site.

Writing Policies

Information Security involves many different disciplines. Some are technical, some are administrative, some are managerial. A good security professional will gain and retain skills in all of these areas as he/she moves through their career. I've spent most of my career on the technical side of things with some administrative and managerial thrown in. My new job has me focused primarily on working with policy at this time. I've been updating old policies, writing new policies and looking into just how PCI is going to affect us and what we have to do in terms of policy and technology to ensure that we are compliant. This is not an easy process, especially when you are new to a company. I still am learning how various parts of the network connect and interact with other parts. I'm still learning what it is that Management wants and what we have the technology and infrastructure to support. Then there is the decisions that were made just prior to my starting with the company. Some of them were done because it fits well with the direction that the company is heading and some of theme were made because it allowed us to put a check mark in a compliance box. If you have been reading my blog for very long you know how I feel about that.

Anyway, I digress. My point in this post is to talk about policy and how to write an effective one for your company. Of course I'm not the expert on this and I don't have all the answers and am still learning much. Much to my delight I ran across a site the other day that does a much better job than I can do. The site is The Trusted Toolkit Blog. They have declared July to be "Policy Month" and they are writing about how to create a security policy and even giving sample policies for you to download. I recommend that you keep you eye on this site this month because even if you never have to write a policy it will benefit you to have an understanding of how a policy is written and the steps involved in creating one. Not to mention that the focus on learning some "soft skills" will benefit you in the long run.

Security Urgency

There is a trend in information security (actually in IT and life in general) to tackle the urgent issues first. These are the issues that users are screaming about, management is on you about, auditors have written you up about and then things that get you noticed. No one gets noticed for the security flaw or vulnerability that they found, patched and as a result prevented a breach. You get noticed when you put out a fire that other people see. Even if that fire is in the middle of an field and is surrounded by a mote full of water. People see you out there jumping up and down putting out that fire and they applaud you. This is where the security professional needs to make a change.

How do we do this? We can't stop fighting fires because if we do then we will lose battles that we can't afford to lose and we need others to see us succeed. We have to be proactive and plan. We have to know our environment and what the threats to it are. We have to put together a plan to protect our data and get management buy in. Being proactive and getting buy in can be our biggest challenges (next to time) but they are crucial to success. Not only success in getting our plan implemented but being successful in getting out of the "Tyranny of the Urgent" cycle.

This problem is multiplied for those who are either solo IT/Security departments or part of a small shop. Fighting fires can and often does take most of your time because they are always there. That is why it's important for management to realize that just because it's a fire doesn't mean that it's a priority. You need to have a policy in place that defines what is priority and what isn't. A problem that affects only one user or doesn't impact business is not as important as getting a patch deployed that will prevent a breach. Sure the fire is visible and puts off heat where as the patch is not seen by anyone but you but it is important and has to be done.

So what is it that needs to change. Our policy? Our plan? Our mindset? Ensuring that all three constantly updated and evolving is a good idea but our definition of urgent and our priorities are key to keep us out of trouble and keep us from stomping out fires in the middle of a field surrounded by a mote full of water.

Bye Bye Data

Wouldn't this just tick you off? You make one mistake and get a virus. That is bad enough. If you are lucky it's just a mass mailer and none of your data is at "real" risk. Maybe you get something that does a little damage to an app or some files. It could be worse. You might get infected with a bot program or a keystroke logger. Not pretty. Yet if you don't do any financial related work on your PC even that isn't so bad. What could possible be the worst thing is a virus that actually deletes files from you machine. Especially one that deletes OS files. Now you are hosed. You have to rebuild and for many that means losing data because they don't back up and don't know how to recover what may be left on the system.

Oh wait, it can get worse. Not only does the virus delete your files it tells you it's doing it and taunts you as it happens. That is one cold hearted virus writer.