Paper Waste

End of life information Assets in the form of paper, can, and do hold business critical, and sensitive data (information) relating to Internal Staff, as well as the Clients.

The bag of waste in the image below was dumped on the path outside of a London based Financial Outlet – two things were observed. One, the shredding actually contain complete characters, and secondly, the shredding are in a sequential form - thus reconstruction would not be an issue for anyone with a reasonable level of eyesight.

At  the end of the day, this would seem to be a case where Standards, and Policies had been applied, which dictated the requirement to shred Sensitive Waste – the shortfall here was of course not to accommodate the required level of shedder capability to assure that ease of reconstruction could not be achieved.

From a Past Blog Sent Jan 2010 - Cyber Threats

Its probably been said before that at the start of most New Years -  ‘never before has the interconnected world seemed be so exposed to new, smarter security exposures – but right now, looking back at the landscape of 2009, I feel most, with any form of vision, would tend to qualify this as a robust statement.

The cyber-battle to date has seen the majority of security operations pushing back against those we referred to as hackers.  However, what now joins the ranks of adversaries, adding to the complexity of defending the enterprise, and individual, is the onslaught of professional aggressors in the form of Organised Crime, Professional Spammers, and Scammers.

It may now also be politically acceptable to accept that very real risks exist from State Sponsored Cyber Attacks, and infiltrations – Remember Titan Rain! We may also now be close to acceptance that threats are posed by those who would seek to utilise technology in pursuit of Cyber Terror, attacking National and International Targets - of course we also have threats posed by anarchists, and politically motivated individuals through Hacktivism, and we are only just into 2010!

That all said, on the frontline Security Education, it was encouraging to see a Poster Campaign launched toward the end of 2009 with the backing of SOCA, and other Government Agencies, in the form of www.thinkjessica.com. This was seeking to educate the wider public as to the threats posed by Spam, and it’s very real potentials to hurt the public’s pocket.

The real cyber-battle exists at the end-point PC or Laptop. No matter the current level of anti-virus update – and let us be honest, anti-virus protection is only as good as what it knows about, and is no longer that panacea of all-encompassing protection it was once considered to be.

It is now a case of increased complexity at the end-point operating system, application, and multiples of software components and drivers which are co-hosted, each of which from time to time may be exposed to critical vulnerabilities exposing the end-user to some form of compromise.

So why in such a landscape of risk, and vulnerabilities can Cyber Criminals and Organised Crime flourish - do we see Government bodies helping them with their mission to circumvent security (Good news is as of October 2010 this in part, now in progress)?

After a full ten years dancing around the legal maypole, the EU finally won its case with Microsoft over the perceived dominance of the IE Browser. Now consumers will ostensibly have a choice of which browser they wish to use with their Windows operating system. However, this was also a new prime opportunity for security risks to flourish which may be left out of the current Patch and Fix equation.

Ironically, due to the arrival of a raft of new Web browsers, such as Opera and Google Chrome - Windows users have a choice of browsers regardless of whether the EU brokered peace with the Redmond-based software giant. In any case, most ordinary users would be unaware of the wide choice they have, but perhaps more worryingly, they may also unaware of the need to keep their browser software healthy, secure and updated.

Take Google Chrome - in its first incarnation it was released totally insecure, and upon installation and use, exposed the local system, and by inference, user, to the very real potential of ease of compromise and system incursion by a hacker, or criminal.

No matter how savvy the user may be, he/she must be aware of the need for to apply timely security fixes and patches. In fact consider the 2009 release of Google Chrome updates and the associated security fixes – 9 High Criticality, and 2 Moderate, most of which exposed the end-point PC to prospect of local unauthorised access.

For any hacker, or person with criminal intent, I guess they would see the past EU victory as most welcome to move their Cyber Crime business forward to be more productive, and will hopefully benefit them with an increase in their illicit revenue stream and thus are looking forward to a very crime ridden, prosperous, and opportunistic 2010 (which would now seem to be the case also).

So, some sensible advice would be, choose whatever browser you wish, but just consider the security implications, and ensure it is maintained in an up to date, and secure condition – as Microsoft, as the provider of the base operating, may no longer be assured to facilitate this as part of their on-board update service.

INFORMATION LEAKAGE

Information Leakage is possibly one of the most common, and misunderstood security risks faced today, and potentially one that impacts organisations every single day. This linked to Electronic Distance Information Gathering can, and does pose significant security risks to any Business, or Government Agencies alike.

Information Leakage and Gathering may be employed to determine much about the internal business model, and strategies – for example:

a)      Organisations connections

b)      Working practices

c)       Mobility of information assets

d)      Levels of sensitivity

e)      Personalities and contact information

f)       Infrastructure and Application Components

g)      Third Party Relationships

For instance, from information which may be located on the Internet, it may be possible to obtain a pen-picture of what an Organisation, or Agency looks like on the inside. Maybe some information made public under an FOI request, linked by inference of content to a more recent publication relating to the type, classification, and sensitivity of an Information Asset under process or retention within a particular area. Of course this is particularly of interest if such Information Assets are subject to UK Government Protective Marking.

It may be that a Department or Agency has a very low profile, and are nondescript, but nevertheless has connections with sensitive Government Agencies, Law Enforcement, or other such official body.

Lastly such leakage of Information titbits can provide an attacker with valuable information as to the type, and value of data that may be physically communicated, and thus this make the job of targeting a Business, Agency, or Organisation much easier.

With such collateral in the possession of the attacker, they may then turn to what other valuable information can be obtained about the Internal Employees, Associated Contractors, and any Third Parties who provision support.  Here opportunities exist to Socially Engineer any identified personalities, or to infiltrate one of the Third Parties who are supporting the potential target for long-arm infiltration – it has happened.

Last but not least. It may be that some external communications which have been published provide insight for the attackers to the internal electronic workings of the organisation – Servers, Operating Systems, VoIP, and Infrastructure Components that are deployed. Such information of which is valuable to underpin any form of future based electronic attack – it simply removes some of the early need for Footprinting, guessing, and leg work.

As an example consider multiples of Information Assets finding their way from the Intranet, to the Internet side of the organisations web space, providing access to around 230 individual documents, containing

a)      Organisation Charts

b)      Internal Contract e-mail, and telephones numbers

c)       Department Descriptions

d)      Agenda of Internal Security Committee Meetings (along with the outcomes)

e)      Budgets Information

f)       Documents which indicated Storage, and Process of High Values Government Protectively Marked Information Assets

Furthermore to add creditability to the published information, other FOI Information Assets which were made available on other Agency Sites, underpinning a conclusion as to the type of information that had been stored, and processed by this use – thus heightening the attractiveness of the target.

Add to this confirmation of on-going links to other more sensitive UK Government Services, and soon one realises they have a very high gain, and a very soft target!

Insecure Electronic Document: Publicly Shared documents containing invisible hidden content in the form of Metadata, and those unseen Track Changes which manifested in potentials of unintentional disclosure – all giving away additional snippets of information, or should we say Intelligence – in this case extracted from examples of the 230 farmed, downloaded documents!

So What!: In this age of internal tensions, with the associated risk of Terrorism, it should follow that such circumstances as the above would be of serious concern. However, when one links this to a time in which the National Security Stance is High, the expectation of a commensurate response should go without saying!

What such Information Leakage does provide an attacker is ease of identification of Soft Targets, which hold desired levels for information – it could be that, because of associations it is not necessarily the information that may be the target, but the actual facilities for plotting a Physical Attack – this where Information Leakage of this types does exist, can have very real potential to cause injury, and loss of life, and thus should be taken very seriously – Surprisingly this is not always the case!

Presentation is better than Cure: There are some very basic steps which may be applied to mitigate, or reduce the risk, and to accommodate high gain security to protect such soft targets, and they are as follows:

·         Ensure that any Information Assets which are published externally are appropriate

·         Control that may released, and published about your organisation

·         Consider the implicatations, inferences of any information that is published in relation to Partner, or other Sensitive Agencies

·         Agree  a Corporate Communications approach to manage ALL information releases

·         Have a process in place to periodically trawl the Internet looking for signs of Information Leakage

·         Have a process in place that removes Metadata from any documents prior to publication or external release

·         If the organisation publishes documents in PDF consider applying Security Settings, and Encrypting the content

Remember what may seem to be of little value in isolation, may be completely different ball game when assessed against other aggregated Information Assets obtained (AKA - Intelligence).

Above all remember, we are living in times where internal, and International  tensions are high, thus no matter the presumed lowly value of the snippet, in the bigger picture the implications could be serious to both information, and in the most extreme of cases life!

Cyber Forensics

Over 70% of UK Homes have a computer, with 93% + connected to always-on broadband, and with a backdrop of a fact, that with the majority of criminal and corporate cases, somewhere in the background a Computer, PDA, or Cell-Phone may be lurking – thus the case for Computer Forensics.

No matter SME, or Corporate, there is no doubt that, with the array available systems capabilities, free, and at cost tools, organisations with internal technological capabilities may maintain a technological  Computer Forensics Capability to respond to incidents, and any requirement for collection and analysis of artifacts.

This complex capability is in two parts, of which the technological aspect amount to the lesser of the two evils. The question is, if the results of a case, artifact(s), or applied processes, were subjected to test or challenge, seeking to validate the scientific approach, would they meet the expectations of evidentiary reliability? Where analysis has been conducted, would the processes meet the necessary quality expectations of the ISO/IEC 17025:2005, and ISO 9000? Lastly, would processes, procedures, and associated disciplines be robust enough to satisfactorily counter any challenge?

By its nature, Computer Forensics is heavily dependent of technical capabilities, tools, and snazzy technological prowess. However, this is a game of two halves, with the most critical components representing the applied rigour of process, applied disciplines, and documentation used to underpin such the activity. Any weakness, gap, or break in the chain could result in those impressive skills employed reacting to an incident being entirely wasted – for a Disk Image that has been obtained outside of a rigorous process may not be completely wasted effort, as it may be considered a high cost backup – but would it represent a reliable robust Forensic Artifact – possibly not!

To conclude, based on experience, and cases, it has been continually demonstrated that it is absolutely essential for a Computer Forensics Policy, and Operational First Responder Documentation Set to exist.  Agreed that to have in-house Forensic Tools, and Applications are a must, but the most important part of all is to apply rigour, then apply process, finishing off with, yes, you guessed PROCESS.

As improbable as it may seem . .

Living in an electronic age which is always open to abuse, there is an expectation that users, business, and government systems, infrastructures, and applications are secure – Right!

With the ordinary home user, the level of security they deploy will vary from nothing, to a fully-fledged and secure system, installed with up to date Patches, Malware Protection, and some levels of sensible Perimeter protection.

With the Corporate, and Government deployments however, one could make the assertion that they accommodate sensible, and , and pragmatic levels of security which will secure them, their partners, and above all their clients – and in the majority of cases, this is the mission most reputable organisations peruse to the best of their ability. Sadly, and as improbable as it may seem, the expectation of what security should look like in operational environment, is not always a reflection of reality.

One of the major flaws in the security profile of some deployments is, whilst the Corporate Policies may say System, Infrastructures, and Applications MUST be maintained in an up-to-date level of patch, there can be a gross lack of adherence to the application of Patches, and Security updates in real operational terms. Such shortfalls can range from isolated cases, through to environmental wide failings to apply the required level of security, to assure the environment is safe from the known vulnerabilities.

As an example, consider the hypothetical case in which a Global Business with a strong brand reputation running its business on an out of service e-mail system – would, or should this be a serious issue? Well first of all, if it is out of service, then it has also most likely fallen of the Security Patch, and Update lifecycle. Secondly, it will potentiality be hosting old, and well established Security Vulnerabilities and Exposures. Last but not least, in such a circumstance, the e-mail application may be a little flaky with current technologies, so, all-in-all, would not be a sound basis upon which to run our hypothetical business on.  

But what would this mean in real time security terms. Well first of all, given this is an e-mail system, it potentially affects the majority of Business Line operational assets at both mail client (Local) and Server (Remote) where such a potentially flawed application are providing the operational service – so it may also be hosting wide exploitation for the organisation. Secondly, as the mail client and application is out of date, it may gain more interest to hackers, and criminals, as they will be most likely are aware from the mail headers (Footprinting) that the version is out of date, and so its potential vulnerabilities and exploitation are much increased.

The real worry here is, if such slack practices were in place within a real world business, the question is, does this leave system, infrasturute, and applications open to abuse – and does it impact the Partners and Clients which higher levels of exposure

Last of all, one should consider the position of organisations with ISO27001 Certification, or those who are required to comply with the expectations of PCI-DSS – here they are presented with a challenge, with very few mitigations, or countermeasures, and as such the assumption of governance would tend to suggest, in such an insecure profile, this would be out of step with the requirements of security.

In a world of acknowledged Cyber Vulnerabilities, Threats, and regular hacking attempts, should it not be an expectation that business strive to service their perimeters, and assets to the best of their advantage? Is it not the case that not to do so in the face of such significant threats, and adversity, could be considered culpable of an offence? Above all is it not the expectation of every user who logs into an organisation, or has their personal data stored and/or processed within their Corporate Systems, that the level of security is maintained at its optimum – I believe this is, and should always be the case.