Encryption and Security Awareness – it’s the law!

Several states are jumping on the information security and privacy legislation train, and it is leaving the station at full speed. Similar to the data breach laws that are now in place for 44 states now, we can expect a similar rush by states to initiate similar laws calling for specific security measures to be enacted to protect personal information, and liability for companies that have breaches

Massachusetts for example passed the following legislation, which calls for some very specific controls and measures to be enacted to comply with the state law.

201 CMR 17.00: Standards for The Protection of Personal Information of Residents of the Commonwealth

This regulation is applicable for entities who “own, license, store or maintain personal information about a resident of the Commonwealth of Massachusetts”.

According to the regulation personal information and records are defined as such:

"Personal information," a Massachusetts resident's first name and last name or first initial and last name in combination with any one or more of the following data elements that relate to such resident: (a) Social Security number; (b) driver's license number or state-issued identification card number; or (c) financial account number, or credit or debit card number, with or without any required security code, access code, personal identification number or password, that would permit access to a resident’s financial account; provided, however, that “Personal information” shall not include information that is lawfully obtained from publicly available information, or from federal, state or local government records lawfully made available to the general public.

“Record” or “Records,” any material upon which written, drawn, spoken, visual, or electromagnetic information or images are recorded or preserved, regardless of physical form or characteristics.


Two of the more interesting and detailed requirements are:

“The encryption of all personal information stored on laptops or other portable devices, and “to the extent technically feasible, encryption of all transmitted records and files containing personal information that will travel across public networks, and encryption of all data to be transmitted wirelessly”

“Each covered entity must train employees on the proper use of the computer security system and the importance of personal information security.”

Nevada has similar legislation that went into effect on October 1, 2008, which prohibits businesses from transmitting unencrypted personal information on consumers on external networks.

So how can your organization begin to comply with this type of legislation?

• Consult internal and external counsel on these matters and ensure you have someone specialized in privacy & data security law.


• Ensure you have a written information security plan that uses a published industry standard to use as a guideline (ISO, PCI, etc.). Most of the legislation is based on using “reasonable” security measures that cover (and this is the de facto language) administrative, technical, and physical safeguards.


• Once your standard is in place in your program – work to achieve that standard, by performing a risk assessment against the organization so you know where to start, and where to properly spend money and resources.


• Know where your important and confidential data is within the organization, and how people are using it. Get line managers that are responsible for this type of data together and ask them in a very non-accusatory manner how the organization is using and protecting this type of data.


• Exercise control over service providers and require them to contractually protect your data and follow your standards, as well as auditing them to ensure they are doing so.


• Have a plan ready in case none of this work and you have to report a breach.

Obviously, these are all very high-level requirements and are by no means an exhaustive list. Every organization is different and requires different controls and processes. The more you understand the data flows, and the risks to the organization the better you will be when the worst happens.

One quick note - in the definition of person, the commonwealth intentionally left any of their agencies out of this definition so they wouldn't have to abide by this legislation - NICE!

Spotting bogus e-mails using grammar checking

Bogus E-mail from Microsoft


isc.sans.org and several other sites are reporting a bogus e-mail from Microsoft containing malicious code, an example of which is below. In addition to the various technical measures that can be taken such as blocking executables in e-mail, effective spam filtering, A/V protection, and endpoint protections, users should also be reminded to be on alert for these types of issues. Besides telling them to never click on these types of items, and not giving them the local rights to accomplish this, I believe we can go further in order to promote more security conscious activities at home, and hopefully reduce the number of zombied systems available for bot herders. In this example it is easy to spot the poor grammar in the e-mail as a sure giveaway that this is bogus. OK, my grammar is not exactly perfect either, but that is not the point. Now Microsoft or any company would most likely never distribute updates in this manner, but hopefully any valid communication from a company of this size would certainly not contain as many errors as I have illustrated below in bold, and that is exactly one of the items I point out to end users in classes I teach. My guess is that someone for whom English is not his or her native language wrote this – a former or current Russian state would be my guess.

Dear Microsoft Customer,Please notice that Microsoft company has recently issued a Security Update for OSMicrosoft Windows. The update applies to the following OS versions: MicrosoftWindows 98, Microsoft Windows 2000, Microsoft Windows Millenium, Microsoft WindowsXP, Microsoft Windows Vista.Please notice, that present update applies to high-priority updates category. In order to help protect your computer against security threats and performance problems, we strongly recommend you to install this update.Since public distribution of this Update through the official websitehttp://www.microsoft.com/ would have result in efficient creation of a malicious software, we made a decision to issue an experimental private version of an update for all Microsoft Windows OS users. As your computer is set to receive notifications when new updates are available, [how do they know that?] youhave received this notice. In order to start the update, please follow the step-by-step instruction:
1. Run the file, that you have received along with this message.
2. Carefully follow all the instructions you see on the screen.If nothing changes after you have run the file, probably in the settings of your OS you have an indication to run all the updates at a background routine.
In that case,at this point the upgrade of your OS will be finished.We apologize for any inconvenience this back order may be causing you.

Travelers Privacy Protection Act of 2008

A bill has been introduced into Congress that would finally put protection and requirements in place before the Customs Service could confiscate your laptop, or perform an inspection of the data on the laptop without reasonable cause. The act further defines specific periods the equipment can be maintained and requires a warrant to be issued before a device could be seized. The bill also prohibits profiling and sets privacy requirements while the Customs Officials are looking at your computer or electronic device. I believe this is a step in the right direction, and a small return of our privacy and dignity that travelers lose every time they enter an airport, supposedly in the name of security. Our constitutional rights should not be thrown out the door in this current purgatorial zone of legality that currently exists at every US airport, and the comedic security measures that are taken, like removing your shoes, are doing little if anything to reduce the risk to the country or the particular flight you happen to be on. However, they are visible and easy, and that seems to be the mantra for the TSA – but I digress.

I still don’t believe you can legally be compelled to reveal your password, and the cases that have been tried have had so many other circumstances that had the person simply refused to divulge their password they would have probably prevailed. There is no judicial precedent on this matter, but it seems to be ill conceived on so many levels, not the least of which is the 5th amendment. Laptop computers and other electronic devices contain too much personal or corporate confidential information on them to simply let a government employee have complete access and copies of that data. Strong encryption and just one judicial precedence will hopefully end this matter for most of us law abiding citizens, and I’m sure the law breakers would never think to store this information in e-mail, or some other Internet storage application they can send back and forth across most borders without any checks.

But perhaps that is the government's next priority into our lack of privacy – let’s hope not.

Information Security and Privacy Class

Thanks so much for everyone who attended my class on Tuesday. I have published notes and links at the Class Notes link below. Please let me know if you have any questions, or need additional information.

Chris

Class Notes

What can be learned from data breach reports?

I need to thank the people at Attrition.org who are maintaining a database of data breaches that I refer to on a regular basis. I believe the information in these types of breach databases are very valuable as a research tool into good measures to spend your time and money in order to keep your company off of this list. Of course we have to make several assumptions about the data contained in the reports, and of course “you don’t know what you don’t know”, but even so, this is probably as good of a starting point as any survey we’ve all seen, and of course your risk appetite as well as the specific risks of an organization will also have to be considered. Now for the numbers

The database covers the period from January of 2000, until July 31 of this year and includes 1051 breaches. Here is a breakdown of some of the interesting facts after removing a couple which show disputed in the type of breach.

87% of the breaches were not due to a loss from a third-party. Another report from Verizon claims that 39% of their breaches are from a third-party. I believe there may be some under reporting of this statistic here due to the third parties reporting, and their customers not reporting the same incident.

The distribution of breaches amongst Business, Government, Education and Medical were 34%,24%, 30% and 12% respectively.

Stolen data was the highest reported breach type at 37% followed by “hack” which is classified by Attrition as “computer-based intrusion, data not generally publicly exposed” came in second at 21% followed by web-based intrusions at 15%.

NebuAd hauled down to Capitol Hill

WASHINGTON -(Dow Jones)- The chief executive of an Internet advertising start- up admitted Thursday that his firm could track peoples' activity on multiple Web sites without their express permission.
NebuAd CEO Robert Dykes said at a House hearing that the Internet service providers with which his company partners send their customers letters 30 days before any tracking begins.
The letters, which Dykes described as "robust," tell subscribers how they can opt out of the monitoring. If the customer doesn't respond, however, NebuAd begins collecting data on their browsing activities to offer ads relevant to their interests.

Yep - you can opt out alright, then they will place a cookie in your browser that will prevent their technology from performing its dastardly deeds. Of course if you ever get rid of that cookie, you are right back in the mix.

Another ISP caught with their NebuAd down

The Washington Post is reporting a story today that Embarq, an ISP in Kansas has been using the same technology that Charter Communications was pressured to drop just weeks ago. Apparently Embarq didn't tell their subscribers about this, and Congress is fast considering this and similar uses of deep packet inspection technology to perform these types of actions wiretapping. They have a link right on their home page listed "your privacy rights", but apparently that is just for show.

This is the first of their "five privacy principles" that apparently allow them to look at where their customers travel on the web.

EMBARQ creates, obtains, and uses your personal information to provide you the products and services you order, and to present you with product and service offerings that we believe may interest you

This is their definition of personal information.

Personal information is information that is directly associated with a specific person such as his or her name, address, telephone number, e-mail address, activities, and personal preferences.

We collect personal information about users of our products or services in the normal course of our business. This is how we know where to send you a bill for service...

Or an ad for something you may want.

All of their references to cookies in the privacy policy relate to cookies on the Embarq site, and mention nothing of the types of cookies used in the NebuAd realm. I am usually the last one to think that congress does much effectively, but perhaps this will be the nail in the coffin of this technology and stop other ISP's from getting the same idea. These types of privacy mishaps where companies had a privacy policy not outlining these types of activities, but thought it was their god given right to do so have gotten several companies in trouble with the FTC for unfair and deceptive trade practices, and a nice visit form the auditors biannually for the next 20 years. I'm hoping Embarq is next, and it serves as a lesson to other ISPs.