Gotcha, Gotcha, Gotcha. Always forgetting something! Dynamic
Security can handle all these problems. It is like having central locking in
your automobile.
The 10 Most Overlooked Aspects of Security
NOVEMBER 29, 2006 | Feel like
you're forgetting something?
Most likely, you are.
Did you post
a surveillance camera in your server room? Check the trash can for discarded
disk drives that weren't wiped clean of sensitive data? Do a deep background
check on that new database administrator you hired? Look into that new
third-party security services offering?
Encrypt the backup of the
year-end financial data?
Gulp. Maybe you're not quite ready for the
holidays.
You'd better watch out. But don't cry, and don't pout, because
you're not alone. Most organizations have at least a few security issues that
have been lost in the shuffle, and it's not too late to give them some
attention.
So, with the help of Dark Reading's editorial advisory board,
we've compiled this list of The 10 Most Overlooked Aspects of IT Security, along
with the risks of skipping out on them, and some advice on how to attend to
them. Our research turned up a wide variety of opinions on these topics, many of
which are environment-dependent, so we're giving you this list in no particular
order. You decide which bases you've got covered -- and which ones need your
attention.
Consider this our contribution to your holiday shopping list.
Post 'em on your blog and the company intranet, pass them on to your colleagues
and business partners, all in good cheer. There is still plenty of time to make
your own list -- and check it twice.
(Editor's note: If there are other
commonly forgotten security measures you've just remembered, we'd love to hear
about them. Please send comments via the message board associated with this
story, not by email. All postings are completely anonymous.
Enjoy.)
Contents: — The Staff, Dark
Reading
Next Page: Physical
security
|
The 10 Most Overlooked Aspects of
Security |
|
1. Physical
security |
|
NOVEMBER 29, 2006
| When you review your IT security architecture, you
probably don't consider your organization's physical security.
But that can be a lethal oversight.
"In order to truly achieve 'defense in depth,'
we have to think physical security as well as information
security. The best [logical] security can't prohibit a
physical theft of a server if the computer room is not
adequately protected," says Steve Delahunty, senior associate
with Booz Allen Hamilton.
More often than not, the people who do IT
security and the people who do physical security in large
organizations don't work with one another. Many small- to
mid-sized enterprise IT security groups may overlook physical
issues altogether. It's not until a building break-in occurs
that the two may even meet at all.
"It's always somebody else's fault when there's
a break-in in the building," says Steve Stasiukonis, vice
president and founder of Secure Network Technologies,
regarding IT security blaming facilities management and vice
versa. But IT security should be on the same team as the
facilities management group, he says.
In many organizations, physical security is
often focused more on protecting copiers, printers, and fax
machines from theft -- not servers or computer equipment,
Stasiukonis says.
"A lot of companies are allocating surveillance
technology in the wrong places," he says, and not where
intruders are more likely to gain access, such as the cargo
landing where smokers take their breaks, or on the cafeteria
patio.
Leaving physical access to chance in these
areas makes it that much easier for an attacker to simply walk
in and make a network attack or other breach.
"A lot of attacks become much easier because of
physical security weaknesses," says Sean Kelly, technology
consultant for Consilium1, who does penetration testing for
clients. "It makes things a lot easier if you can walk in the
door. And you don't have to be a technical person to perform
these breaches -- it opens the door to a wider pool of data
thieves."
Social engineering is way too easy a ploy to
get a foot in the door, experts say. Stasiukonis, who stages
social engineering exploits for his clients to audit their
security, recently duped employees at a credit union client's
facility, posing as a copier repairman stopping by to "clean"
the copier machine.
"I busted into a credit union last week,
wearing one of those copier company t-shirts," Stasiukonis
says. "So I jacked in and grabbed the password and log-ins in
clear text and then [used them] to break in from the outside,
too."
Getting the IT and physical security teams
together is crucial to thwarting social engineering attacks
like these. But it's not easy to teach employees who to trust
and who not to trust.
"Social engineering is a huge issue no matter
what level of organization you're in," Consilium1's Kelly
says. "Security awareness training needs to stress more on
auditing and procedures to identify people you're giving
information to, and for questioning people without badges."
Next Page: Proper
disposal of devices, storage media, and sensitive
documents |
|
|
|
|
The 10 Most Overlooked Aspects of
Security |
|
2. Proper disposal of
devices, storage media, and sensitive
documents |
|
NOVEMBER 29, 2006
| IT people hate dealing with trash. Attackers, on the
other hand, love it. That should tell you something right
there.
Each day, corporations dump tons of material on
the curb, most of it useless landfill. But companies that
don’t have strong policies on garbage disposal may be leaving
bits of gold for hackers seeking passwords, customer
information, or other sensitive data. And if they’re not
careful, those organizations may just be throwing out the keys
to their most valuable information.
One of the most frequently-overlooked treasures
for attackers is the discarded hard drive. As companies
upgrade their old machines, they often donate them to
recycling centers, charities, or simply mark them as trash.
But some IT departments are lax in their efforts to wipe those
old hard drives clean, creating potentially damaging data
leaks.
In a study published in August, researchers at
the U.K.’s
University of
Glamorgan and
Australia’s
Edith Cowan University bought more
than 300 hard drives in auctions and computer fairs all over
the world. What they found was a surprising array of data that
should have been erased long before the drives were sold or
tossed. Some of the data included payroll information,
employee names and photos, IP addresses, network information,
mobile phone numbers, copies of invoices, and financial
information such as bank and credit card accounts. (See Second-Hand Drives Yield First-Class
Data.)
And the problem isn’t limited to hard drives.
In a separate study also published in August, security firm
Trust Digital made similar purchases of used cell phones and
PDAs on eBay, and researchers were able to recover sensitive
data on nine of ten devices in the study.
”The file system on your cell phone or PDA is
just like the one on your PC’s hard drive,” said Norm
Laudermilch, CTO at Trust Digital. “If you delete a file,
you’re not really overwriting the data. All it’s doing is
changing the index of the file system, or the file’s
pointers.” (See Study: Used Cell Phones, PDAs Contain
Confidential Data.)
And companies shouldn’t overlook one of the
oldest forms of stolen data: paper trash, experts say. Jim
Stickley, CTO at penetration testing company TraceSecurity,
says he has found a wealth of sensitive information --
including user identities and passwords -- simply by
dumpster-diving on unshredded company trash. “Shred, shred,
shred,” he says. (See 'Analog Hackers' Overlooked,
Undetected.)
Next Page: Background
checks |
|
|
|
|
The 10 Most Overlooked Aspects of
Security |
|
3. Background
checks |
|
NOVEMBER 29, 2006
| A background check? When did it
become necessary to do more than call references and verify
past employment?
It's easy and tempting to overlook the
character issue when hiring employees, or even managing them
over the long term. But as the strategic value and importance
of IT has risen, so has the need to make sure those with the
keys to the kingdom aren’t eavesdropping, stealing, or worse.
"It's become more the norm that companies
screen all their employees," said Jason Morris, president of
Background Information Services, Cleveland. "People quickly
realized that IT is one of their biggest liabilities -- when
employees take home data tapes, for example. So they may not
screen low-level carpet sweepers, but if they have access to
sensitive areas, employers screen."
In addition to verifying education and previous
employment, Morris encourages making sure there are no
unexplained gaps in a candidate's job history. Are they
claiming MCSE or Cisco router certifications? Get it
confirmed, he suggests. "Driver's records could also be a good
measure of responsibility, as are credit reports."
A basic check might include SSN verification,
address history, and a search of county records for felonies
and misdemeanors. Background research can get even more
detailed (and expensive) with searches of sex offender
databases, state and national archives, even international
resources.
So how much should a company expect to spend on
a background check? "It varies, but a good rule of thumb is
one day's salary" for the position for which you're hiring,
Morris says. "It can be a lot less too."
Doug Shields, president of Secure Networks
finds less value in sifting through official records and
prefers to drill down more on what he calls "character
issues."
Shields, who worked at the CIA for nine years,
is more interested in why a prospect left his last job, or if
he was an Eagle scout, for example. "That may sound hokey, but
it tells you something."
You can also learn about character issues by
asking a candidate how they safeguard their own data. Do they
use encryption on their personal laptop? Have they even set up
a wireless LAN at home, and if so what security protocol did
they use? The answers will tell you something about
consistency and follow-through, Fields suggests.
And while screening before employment begins is
great, it doesn't help much if you don't continue to keep tabs
of some sort on employees. "If they go bad over time, you're
not going to know about it" unless there's continued
monitoring, Shields explains. "It doesn't matter what industry
you're in. You have to make sure your stuff is secure and that
people only have access to things they should have access
to."
Next Page: Getting
control of the at-home user
|
|
|
|
|
The 10 Most Overlooked Aspects of
Security |
|
4. Getting control of the
at-home user |
|
NOVEMBER 29, 2006
| Out of sight, of out mind. Many IT departments
carefully watch their employees in the office, but they fail
to monitor just what software their users are installing or
what hardware (think thumb drives and iPods) they're plugging
into their desktop or laptop machines at home -- or who else
may have access to those machines.
The rash of laptop losses and thefts at major
corporations and government agencies over the past year has
red-flagged the problem of securing data when it leaves
company premises. But what about the machines that sit in home
offices where telecommuters work daily, or company executives
work after-hours? And what happens when a user's home is
broken into and his laptop or PC stolen?
"The problem companies face with home workers
is that the security boundary with the Internet has been
extended to hundreds, even thousands of remote locations,"
says Geoff Bennett, director of product marketing at
StreamShield. "The odds of a weak point are multiplied
exponentially."
Ironically, top execs can be the biggest
weakest links in the home-user chain. "The CEO and CFO want to
store sensitive information locally on their laptops because
they don't want to worry about VPNing in," says Consilium1's
Kelly.
Few IT organizations have the means to restrict
user-access when it's not on-site: Home users may leave their
machines connected to the company network, or give passwords
out to family or friends. And watch out for those
technologically precocious kids in the house.
"In one instance, a CEO’s kid got on his
machine and renamed critical financial files. The firm was
unable to do a planned stockholders' meeting as a result,"
says Rob Enderle, principal analyst with the Enderle Group.
"End point security remains important especially if the
equipment isn’t on premise."
Security assessments are rarely, if ever, done
of the homes of these users, Enderle says.
And now, as home users increasingly become the
targets of phishing attacks and botnet attacks, the
company-issued laptop and the user's home PC with VPN access
can leave the corporate network at risk. "If their machine has
turned into a zombie and has access through a VPN to the
corporation, the corporation is clearly exposed," Enderle
says.
Most zombie infections use keylogging, which
captures password information. And a zombie PC also becomes a
spam pipeline, says StreamShield's Bennett, which can wreak
havoc since most corporate email systems are configured to
filter inbound, not outbound, spam.
"The assumption is that one's own employees are
not likely to send spam. But a compromised PC will act as a
spam relay," he says, which could result in the company's
legitimate email being blacklisted by other organizations.
One way to lock down home users is to eliminate
VPN access and instead use biometric, multi-factor
authentication to email and "the most limited set of resources
needed to do the job," Enderle says.
A home security audit is also helpful, as well
as training home users how to best protect their computer and
the company network. "And the computer accessing the corporate
resources should remain administered and patched, and
protected to a degree sufficient for the level of access the
remote employee has."
Next Page: Taking
advantage of built-in security functions
|
|
|
|
|
The 10 Most Overlooked Aspects of
Security |
|
5. Taking advantage of
built-in security functions |
|
NOVEMBER 29, 2006
| Security is big business these days, and hardware
vendors know it. As a result, many hardware vendors have begun
to build security features directly into their devices, giving
them out-of-the-box capabilities that are often unexplored or
overlooked.
One of the best examples of this phenomenon is
the Trusted Computing Group’s Trusted Platform Module (TPM)
1.2, a set of specifications that enables vendors to add a
"security chip" microprocessor to any PC. TPM 1.1 chips made
by vendors such as Atmel, Broadcom, and Infineon, have become
standard issue on most PC hardware, but PCs that use TPM 1.2
only began shipping in the first half of this
year.
Companies that have begun using TPM packages,
such as Wave Systems’ Embassy Trust Suite 5.1, are giving it a
thumbs up. "Using TPM and Embassy Trust Suite has made a huge
difference in the way we administer security," says Chris
Cahalin, network manager at Papa Gino's, which operates some
400 restaurants throughout New
England. "It's not only made our client machines
and files more secure, but it's given us a lot more control in
IT."
ETS 5.1 is a set of security tools and
applications that leverage TPM chips to encrypt files,
folders, and passwords on a laptop or PC, leaving the key only
in the hands of the end user and the IT department. The keys
can be given out in the form of smart cards, or the user can
be authenticated via biometrics or digital
certificate.
The net result is that users of TPM 1.2 and ETS
1.1 can lock their hard drives, folders, and files via an
encryption key that can only be decrypted by the authorized
user. A thief can't read any of the files on a stolen TPM
laptop, and even users inside the company can be locked out of
sensitive files on any end station.
Although most new PCs have TPM, many
enterprises have yet to turn on their functionality, concedes
Steven Sprague, president and CEO of Wave Systems. "I would
encourage every enterprise to take a few of their new PCs into
the lab, turn on this technology, and see what it can do," he
says. "It'll change the way they look at end-user
security."
Most experts see TPM as a boon for enterprises because it
is a standard that works uniformly across vendors and PC
models. But they are more wary of proprietary built-in
security capabilities that are now being added to
consumer-oriented machines.
Over the last few weeks, PC hardware vendors have been
rolling out security technology at a rapid rate. On Nov. 1,
Hitachi Global Storage Technologies announced that it will
offer optional hardware encryption on all of its new 2.5-inch
disk drives, which are expected to ship at a rate of a million
units per quarter in early 2007. That announcement came on the
heels of new drives from Seagate Technology, which will not
only offer hard drive encryption but also multi-factor
authentication options that would make it impossible for
unauthorized users to access any data on the hard drive. (See
Dark
Reading) |
|
|
Labels: IT Security, Security, Security Integration
|
Made4biz Security
Translating real-world security knowhow into state of the art security systems.
Made4biz Security
Turn on Sound for Demos:
Bill Gates Demo (Location-based)
Elvis Demo (Location/Context-based)
Clint Eastwood Demo (Temporal-based)
Subscribe to
Posts [Atom]
Technorati Profile
RSS Syndication
|
1 Comments:
The Top 10 is a great contribution and wake up call to security folks that there are fundamental 'blocking and tackling' issues that we can not afford to overlook in today's tumultuous times. One point I would suggest you add is that the technology now exist to conduct continous post hire screenings which is one way to 'keep tabs' on what is going on with your employees. Too often we assume once an person passes the pre-employment screening he/she will stay squeaky clean forever. The risk is too large to not periodically check'em out. For more info on this read the article, Infinity Screening:
Why Background Checks Should Never End, at http://preemploymentdirectory.blogspot.com/
Post a Comment
<< Home