Articles

ISNow – Coming Threats

The following introduction was originally published in the BCS Information Security Now Magazine, Winter 2009/10 issue (Volume 4, Issue 2), which was on the topic of Coming Threats:

“The start of each new year brings the promise of a bevy of unwelcome threats. Many will be variations on an existing theme, some may rely on the growth of a particular medium, and there could be an occasional new but predictable attack that leads us to smack our foreheads and wonder why we didn’t see it coming.

I’m no soothsayer, but I have a few ideas of threat-related trends we may well see in the coming year:

Business Change

The global downturn, recession, comeuppance for greed and risk ignorance, or whatever you wish to call it, threatens business. This could be through redundancies, liquidation, jettisoning failing companies and mergers, all of which will bring significant business changes that have to be managed securely, ensuring that critical business assets are properly protected.

Cloud Computing

Bringing together all the benefits and pitfalls of outsourcing, off-shoring, virtualisation, co-location and rapid application development. Great when it works, but when it doesn’t there may well be issues of legal jurisdiction, enforcing contract and audit rights, forensic investigation, data migration and so on. Make sure the cloud doesn’t become a basket to hold all your eggs.

Social Networking

Website, email and instant messaging wrapped up into one. Already allowing ready personal and business information leakage through to providing a new platform for malware distribution and botnet command and control, the social networking phenomenon offers unrivalled growth for interaction, both good and bad, which is likely to continue unabated.

I’m sure this only touches the tip of the iceberg, and we may well see more large-scale politically motivated attacks, new vulnerabilities in core internet services, smartphones get hit hard, growth in internet governance (read interference, control and surveillance) along with new ways to avoid it.

Happy New Year.”

A PDF version of the magazine is available online at:

http://www.bcs.org//upload/pdf/isnow-winter09_1.pdf

Press Releases

Talk on ‘RIPA: Perception & Practice’

I will be speaking at the BCS Information Security Specialist Group’s 11th Annual Legal Day, being held at the RAF Club, London on Friday 22nd January 2010. My talk is entitled “RIPA: Perception and Practice”, although I was tempted to title it “RIPA: Proportionality, Paranoia and Practice”, and the synopsis is:

“There has been much discussion in the media and elsewhere about the use and misuse of the powers granted to many public authorities under the Regulation of Investigatory Powers Act 2000 and associated legislation.

Stories about snooping on people for trying to get their children into a particular school or letting their dogs foul the street may make the front page, but they are not necessarily representative of how the powers are used in general.

Sure, they should lead to questions about the implementation and effectiveness of the necessity and proportionality tests that are a mandatory part of the legislation, but there may be greater things to concern ourselves with when law enforcement and the intelligence community wish to grow and extend the use of data retention, monitoring and surveillance.

This talk will give an overview of many years of practical experience and interactions with the public authorities authorised to seek access to information under RIPA, Part I, Chapters I & II.”

Further information can be found in the events section of the BCS ISSG website:

http://www.bcs-issg.org.uk/events.html

Articles

ISNow – Insider Threat

The following introduction was originally published in the BCS Information Security Now Magazine, Autumn 2009 issue (Volume 4, Issue 1), which was on the topic of Insider Threats:

“The insider threat is not new. But when companies seek to make cost savings by divesting themselves of their biggest assets, especially during a recession when uncertainty amongst the workforce is likely to be heightened and financial pressures felt more acutely, the likelihood and impact of the threat may increase. Normal controls, such as separation of duty, audit and training, may well get left behind as the remaining employees each try to do more, due to necessity and self-preservation. Whereas a company making significant changes should review their risk assessments, which may show increased controls are required.

Taking away data
Research appears to bear out the view that staff will take information when they leave a business, and may also exploit that information in any future role. Indeed, senior management and IT staff seem more likely to take information in their possession, which may be more valuable and accessible due to their roles.

Logic bombs
Recent scandals in Formula 1 have demonstrated the value of competitor intelligence, however obtained, and secret arrangements being exposed. Also, in the last few years there have been a number of cases of logic bombs, left just in case the person lost their job, and passwords being changed on departure.

Robust contracts
When dealing with an insider threat, the whole gamut of people, process and technology controls should be considered, preferably in that order, to help mitigate the risk; including robust contracts, staff screening, training, awareness, information marking, handling, access based on business need, role and least privilege, separation of duties, logging/audit, data loss prevention and so on.”

A PDF version of the magazine is available online at:

http://www.bcs.org//upload/pdf/isnow-autumn09.pdf

Articles

ISNow – Data Loss & Data Leakage

The following introduction was originally published in the BCS Information Security Now Magazine, Summer 2009 issue (Volume 3, Issue 4), which was on the topic of Data Loss and Data Leakage:

“Data Loss
Data loss prevention should be less about deploying the latest technology that claims unrivalled capabilities in securing all the data you value, rather it should be about having the right data policies, procedures in place along with suitably educated and motivated people, who can act as your data guardians.

The lack of universal technical control will always leave gaps for data to be deliberately exfiltrated or accidently exposed, but without comprehensive and effective data policies and procedures, and the people to support and enforce it, technology cannot provide a solution to your data management ills.
It is key that data procedures cover at least:

  1. how the organisation assigns a value to its data and information, i.e. values its assets;
  2. how its categorises and marks data, in relation to its value or sensitivity;
  3. how it assigns rules for handling data throughout its whole lifecycle, especially for personal information.

In a recession, the impact of the loss of corporate or customer data can be amplified and leave your organisation more vulnerable to disaster than before. The actual or suspected loss of information should be covered by your organisation’s incident response or business continuity plan.

Data Leakage
People can be shocked and concerned when media-friendly volumes of data are lost or exposed, even though only a tiny proportion may directly relate to or affect them, yet they volunteer personal information to near strangers when using the Internet and think very little about the implications of doing so.

With their photos, blogs, CVs, social networks, and contributions to online discussions individuals can provide the greatest insight and intrusion into their online and real world lives, and also the lives of their friends and family who may not have consented to their information being shared so openly.

Maybe each Internet connection should come with a health/wealth warning…”

A PDF version of the magazine is available online at:

http://www.bcs.org/upload/pdf/isnow-summer09.pdf

The Blog of Gareth Niblett