(ISC)2 Blog

Dotted lines in shifting sands

An opinion piece regarding a possible US law change raises fascinating ethical questions about privacy rights.  Whereas employers have some interest in what their employees are saying and doing in their personal/non-work time, employees also have reasonable expectations of privacy concerning their private lives:

OPINION: On the battlefield of the Internet, the Privacy Platoon struck a clanging blow against the Transparency Brigade last week, when two members of Congress introduced the Social Networking Online Protection Act.

The bill would bar employers from demanding job applicants' Facebook passwords - which recently has become an issue: The ACLU's Maryland branch championed the case of a Baltimore man who says he was told that his prospective bosses needed to make sure he wasn't in a gang.

"We need a federal statute to protect all Americans across the country," Rep. Eliot Engel, D-N.Y., a co-sponsor, wrote on his Web page. "We must draw the line somewhere and define what is private."

Although the opinion piece concerns job applicants, the ethical issue is much wider, for example during employment, in sensitive/trusted positions especially (e.g. any industry segment that routinely conducts intrusive 'positive vetting' - now there's an oxymoron!).  It also potentially extends to other insiders (e.g. consultants) and perhaps outsiders (e.g. the marketing department may have legitimate concerns about the brand damage caused by a customer's adverse comments on a semi-private blog), and in the reverse sense too (e.g. shouldn't employees have full access to all emails and personnel records concerning them, even though the employer may consider them private and sensitive?).

My take on this is that 'the line needs to be drawn' but exactly where the line goes depends on the context and the specific situation, making it very difficult to lay down universal rules on this.  Notions such as equitability and fairness seem to appy, but good luck if you are trying to define them in formal policies.  Making law in this area may be the most awkward and perhaps expensive way of dealing with the issues, but on the other hand there is an inherent imbalance in the power of the individual versus that of the organization, or for that matter the state (e.g. the issue of people being coerced into revealing their passwords and encryption codes 'for reasons of national security'). Legislation may be needed as a backstop against unethical or oppressive organizations.

This may be one of those situations where guidelines, principles and examples are a better way of clarifying the issues and intent than formal policies or laws, leaving the final decisions over the appropriateness or otherwise of potentially intrusive or privacy-threatening demands to those involved.  Case studies, for instance, are a good way to get people to think and talk about the issues, making this a good topic for security awareness programs. 

Caveat: I am neither a lawyer nor a privacy expert.  I'm raising it here to set you thinking about the issues, not show you The Way.

Regards,
Gary

www.NoticeBored.com security awareness
www.ISO27001security.com ISO27k
www.SecurityMetametrics.com security metrics

 

(Intellectual) Property is Theft?

As a writer in the age of the Internet, I've learned not to get too excited about intellectual property abuse (as a victim - I don't mean to suggest that it's one of my own vices). My blogs are regularly scraped by all sorts of people from other bloggers sharing the content with due credit (though not necessarily with permission), to unsavoury characters using the content to legitimize or as a wrapper for unwholesome spam, scams, malicious binaries and so on. My books are plundered and redistributed in ways that save the recipients the need to reach into their pockets so that I or the publisher recoup the investment of time, creativity, and financial resources into the publication process. Even my personal data, my thoughts and photographs, are used as collateral in a million ways by social media providers, if I let them. C'est la vie, and to some extent it's inevitable when everyone is, in a very broad sense of the word, a published writer, every PC is a virtual photocopier, and anyone can be a revolutionary. If the shades of Proudhon and Marx really stand in support of the fight for freedom, trainers and flatscreen TVs, no doubt they're even more supportive of the misappropriation and abuse of ideas and expression, now that they are long past the need to collect royalties on their own works.

(Hat tip to Andrew Lee for the pointer to the TechThump spoof story.)

Society - let alone the law - has yet to adjust to the fact that while the Web makes abuse of IPR infinitely easy, that doesn't justify such abuse. In fact, in many cases (and I'm not talking about hacktivists coldly and intentionally equating their own self-interest with the well-being of the world at large), web-users are simply not realizing that the infinite availability of resources is not just about information wanting to be free. In fact, that availability (and the anonymity that often accompanies it) put a heavier burden of responsibility on the individual. Right now, many people are failing to extrapolate from norms of expected social behaviour in the real world to desirable ways of behaving in the real world: individuals who wouldn't dream of stealing from a shop or picking a pocket, shouting insults at a neighbour or slandering them in public, may not realize that some of their activities on the Internet is no different in principle.

Laws tend to adjust slowly to social and technological trends, especially trends that change with the dramatic speed that modern IT allows. Still, change does happen. I've been subscribed for quite a few years to a news/commentary service from international lawyers Pinsent Masons, hosted at http://out-law.com/. One of their bulletins led me to a nice summary of the IP Crime Group's 2010-2011 Report. The report itself is a fairly hefty 70 pages, but it's essential reading if you're interested in a UK-specific view of what's happening in IP crime (and crime management) pertaining to copyright and trademark infringement in particular. (In the UK, patent and design rights infringement is not considerered to be IP crime.)

I certainly expect to return to the topic in the near future. And no doubt my comments will be reproduced in all sorts of unexpected venues. :)

David Harley CITP FBCS CISSP
Small Blue-Green World/AVIEN
ESET Senior Research Fellow

Epsilon Overkill and the Security Ecology

I'm not actually going to write about the Epsilon fiasco as such here. I can think of at least two journalists who will be grateful for that, but I'm not going to let them off quite that easily, even though I can empathise with their ennui.

Larry Seltzer notes that he has received far too many pitches using Epsilon as a hook. I can sympathise with that: I'm bored out of my skull with it, and I don't do much more than skim Epsilon-related articles to see if they're worth flagging on a resources blog, with or without commentary. John Leyden asks "Is the Epsilon breach a massive distraction attack? Security industry obsessing over it , maybe giving bad guys unopposed time and space." Well, I'm not sure that security researchers are spending a lot of time on the Epsilon breach: we're certainly not diverting resources into it that would otherwise be spent on something more "relevant". But I can see that if you gauge the industry's current focus by its marketing activity, you might have cause to worry.

Sometimes it's salutary, if not comfortable, to step back a bit and see the whole canvas. Researchers don't usually do direct marketing: not, at any rate, at the same stage in their careers. But we're all (journalists, educationalists, researchers, marketers, PR people) basically making a living from something being sold, and subject to pressures we don't always appreciate, but that's the game we're in.

PR is trying to give you what they think you want, guys, because that's how the brand gets exposure. And I have enough direct contact with the media to know that what the press wants is not always what interests me. Or, clearly, @lseltzer, @jleyden, @BrianHonan or @imaguid, all of whom seem to think the same way as I do about the overblown nature of this particular threat. But it's presumably what the customer wants, or the media interpretation of that.

Well, what does the customer want? Well, certainly advice about minimizing the threat, whatever it is. And several people have taken the opportunity to give some good generic anti-phishing advice, and I guess there can't ever be too much of that, however repetitive it gets. And most of my own commentary has been an attempt to give a realistic assessment of the significance of the threat. It may not be as interesting as diving into the internals of sophisticated malware, but it reaches (and directly affects) a lot more people than the 80-page papers. :-/

David Harley CITP FBCS CISSP
ESET Senior Research Fellow

SIEM ROI - How to prove it?

I received some emails lately asking me some advice on how to prove a SIEM Tool ROI to higher management (justify acquisition, prove that the solution helps, etc).

If you focus only in the technical aspects, I admit thatlife becomes more difficult (world crisis, lack of technical knowledge from higher management, etc) and gets hard to prove the ROI.

When I work with SIEM projects one of my major rules is to understand my customer business and not only the network/system security aspects.

• What they do?
• How they do?
• What facts can impact their revenue?
• What systems/devices are running their main applications?
• Are there any frauds they're aware of?

With this information you can work together with your customer (internal/external) defining correlation rules that will not only help to secure the company network and systems but also will create a tremendous value for the business.

 With this king of rule in place you know can on a more easy way collect the info that will prove the ROI of your solution.

Some questions you can ask in order to gather information:

• How many security/network/system events were identified by your SIEM solution?
• What will be the losses if your system hasn't identified them earlier?
• How much the system availability was improved since the SIEM solution was deployed?
• How many business/fraud events were detected by the tool?
• How much they will cost?

Then, you can finally add the network/system security side to you analysis showing how many attacks the SIEM tool prevented (downtime=losses and losses=less money), how many reports you'll got able to generate easily (time=money, more time=more money) and how the different teams (operations, network, security, audit, financial) are taking advantage of the solution (less work=more life quality=more satisfaction=more production=more money).

And don't remember to answer the primary question (which is the main target of this post)

How much the SIEM tool saved? 

Best Regards

Why people are not concerned about security on Internet Social tools?

I'm scared!!!

With one subject!

Why people are not concerned about exposing their lives on the Internet? On a way that can put in danger not only themselves but their family and friends.

I'm writing below some info I collected just looking ramdomly for profiles on some social network websites.

Phones, credit card numbers, full address, if they have children, how many are they and their names, where they study, where they work, etc.

You can just find everything about everyone. They're really not concerned with someone they don't know looking their profile searching for something (possible with bad intentions).

We all read stories about people that met online "friends" and many of them ended very badly.

So, why does this happen?

It's because our society lives to deify celebrities and everybody is triyng desperately to get a space on the sun and they expect that somehow they'll get it using these tools?

Or it's just because they are not aware of the risks?

What can we (Security Professionals) do about it?

One sugestion I have is to ISC2 launch some web trainning for regular people teaching about online risks related to social network tools. It might be handy.

Another thing that must be done is to include basic security concepts as a basic school subject.

I would like to hear about initiatives related to prevent people about these risks on your countries

Best Regards

Social armour

A blog posting from Eset outlining some basic tips for reducing the risks associated with social networking/social media/Web 2.0 activities.

Free licence

Interesting piece by an author who explains why he is not upset by, and even wants people, "pirating" his book, which is published under the GNU Free Documentation License.

Improving the Quality of the (ISC)² Blog

Dear  (ISC)² Members,

Here are my suggestions to improve the quality of the (ISC)² blog:

• Authors should post original content that is written by an (ISC)² member.
• Authors should not post “referral content” and “links” unless the links and referred content are a minor element of a larger, original, thoughtful story related to the security topic at hand.
• Authors should never post an article that is mostly a “cut-and-paste” from other web sources.

When we first started writing for this blog the overall quality was higher because our blog posts were mostly original, thoughtful articles by our members.  Since that time the (ISC)² blog has become dominated by reposts of unoriginal content from non-member sources, cut-and-paste content from other sites, and short referral links to other non-member content.

In order to increase the quality of the  (ISC)² blog, I believe the guidelines for authors should be updated.  Our blog should be a voice for  (ISC)² members who are interested to write original, thoughtful content.   Our blog should not become a "dumping ground" for cut-and-paste content from other sources readily available on the net.   

I elaborated on this topic in an earlier blog post this week, Suggestions to Improve the (ISC)² Blog.

Twitter feed

For those preferring to get notifications of additions in a different way, I'll be posting links to new entries on Twitter.  (Of course, I'll be posting other stuff there as well.)  I'll try to remember to post links to both http://www.infosecbc.org/links and http://blog.isc2.org/isc2_blog/slade/index.html

Resources and references

I keep forgetting there is already a lot of stuff I've put out there.  I guess there have been some changes recently, so I guess I should send it out again.

These might be useful for your own self-study, continuing education, and research, or you might want to pass it along to those who are studying for the certification.

There's a list of books and resources by domain.  Also a glossary of (newer and updated) security terms.  A comparison of the various CISSP guides.

At one time I set up a list of security sites of various types.  With the rate of change of the World Wide Web, there's no guarantee that any of them are still there.  Since a number of the sites may be gone, I have been asked to maintain/provide links for the Vancouver security SIG.  I have been populating it for a while, and while still isn't anywhere near complete I do have a fair amount of  useful material, particularly in the awareness category.  There are more sites in the secmarks, but this  system allows me to annotate the sites.

Somebody recently asked me if it wasn't available as a "feed" in some way.  So I'm using this blog on the ISC2 blog, and most of the time when I add another link to the infosecbc.org site, I'll give an explanation (with link) on the blog.  You can specify my postings or try the link for all postings in the training category.  I generally add the training tag to all the resource postings.