Backup tapes are still storing data in the clear?

I shouldn’t be surprised, I really shouldn’t be shocked at all when this popped up in my Reader from www.pogowasright.org. Yet another lost backup tape:

We recently learned that individual employees violated established procedures during a routine exercise and lost some supplier’s and other individual’s data which was contained on a system backup tape. Our investigation indicates that some of your personal information, including your Social Security number, name, and address may have been included in the lost backup tape. However, it is important to note that absolutely no customer or guest data was exposed.

The article does state that they don’t know whether or not the tapes were encrypted (read: protected), I hope that they were. Similar to my rant on utilising 2FA for online banking transactions (i.e. there are No Excuses), there is no excuse for not protecting your backup tapes when they are handed over to a third party.

I’m fairly sure that most, if not all, backup software provides an option for encryption, add to that I’m also sure that this functionality whilst providing protection, also provides compression. It’s like putting on armour that also makes you loose weight.

Another insight that I found quite interesting was the disclosure notification that was submitted to the New Hampshire AG, Kelly Ayotte. It was only 8 days ago that I read an almost identical document, also from Pogo, directed to Mrs Ayotte. It appears that in times of losing PII, apart from the identity thieves themselves the only people benefiting are those companies that offer ID protection services, such as ID Experts.

The common services that ID Experts offered in these two instances were:

• Credit monitoring
• Access to educational material
• A fraud representative that they can talk to (recovery advocate?)
• Insurance reimbursements

Does anyone know how effective these companies/services are?

Posted by Christian Posted in: Privacy, Profession, Risk, Security No Comments » 18 October 2008

Secure Software is Sexy

Secure software development practices excite me. Well, not physically, but mentally. And so it’s with great pleasure that I’ve been reading a couple of really good articles about secure software development. First up was the discussion about the SDL Pro Network amongst other things (SDL Optimisation Model, SDL Threat Modeling Tool 3.0).

The SDL Pro Network is:

“a group of nine industry-leading consultancies that specialize in application security and have been specially trained by Microsoft. These providers will guide and support organizations in implementing the SDL in their environments…”

This is exciting because I’ve often wondered how one would get assistance in taking the SDL torch to the developers. It’s no surprise that people come up to Dave & Co after executive briefings or TechEd asking them for guidance. Hopefully these groups will be represented well down here in Australia.

The second article was by Andrew van der Stock on the upcoming “OWASP Top 10 Coding Standard“. I’ll only list the 10 topic headlines but I definitely recommend you check out the rest of the article.

1. Secure Development Lifecycle Best Practices
2. Secure Architecture and Design
3. Authentication
4. Access Control
5. Validation and Encoding
6. Data Protection
7. Securely Accessing Services
8. Accountability
9. Debugging, Testing and Maintenance
10. Testing and Assurance

As with the SDL Pro Network, I’m excited to see how this standard pans out.

I’m a firm believer that applying security at the front instead of the end of the project life-cycle is the best way to go. You decrease cost, (potentially) decrease complexity, decrease time, and increase the control and other mitigating attributes of the application. What’s not to like?

Posted by Christian Posted in: Computers, Profession, Risk, Security, Web Development 8 Comments » 8 October 2008

Leveraging the Work of Others

When working on an information risk assessment one of the first and most important tasks is to understand what assets we’re trying to protect, and what it would cost the business if the assets had their confidentiality, integrity or availability impacted. In most circumstances these aren’t questions that can be answered by IT or by the information security people but by the business themselves. Unless the organisation is itself an IT organisation, an impact upon those assets doesn’t normally impact upon IT directly but upon the business. Impacts vary depending on the assets in question, and sometimes different assets aren’t impacted when they lose confidentiality and integrity but are heavily impacted when they are unavailable.

So apart from asking the business what they believe these impacts are what other ways can be used to gather this information? Well, if you’re fortunate enough you might be able to gather this information from other sources, such as from those fantastic people whose job it is to manage and deliver services to the business. Those same people who’s responsibility it is to monitor SLAs. If these people are monitoring service levels closely (such as transactions within a commerce application) then they will probably have metrics such as, this application performs x number of transactions per day (month, year, whatever).

All of a sudden a loss of availability isn’t just a loss of service, but a quantifiable value. If this application server goes down then you are losing x transactions per day. If each transaction provides on average $y profit then it gets even better. You get the picture. But not only do you get the picture, now your stakeholders can be given a fairly clear indication of what a loss of availability will cost them on a specific time period.

While this scenario is great for looking at the cost of impacts against availability, what does it do for loss of confidentiality or integrity? Not a lot unfortunately. I just felt like giving big-ups to those people at my work who have been doing a great job at compiling more metrics about all of our applications than I can point a finger at!

Posted by Christian Posted in: Profession, Risk 2 Comments » 3 October 2008