<![CDATA[[SecurityRatty] tag: forensic]]> http://securityratty.com/tag/forensic Tue, 15 Jul 2008 13:20:45 +0000 iRatty Engine http://blogs.law.harvard.edu/tech/rss <![CDATA[Fun Reading on Security - 8]]> http://securityratty.com/article/d60cc90ef226fd7624953a3c03f282d4 http://securityratty.com/article/d60cc90ef226fd7624953a3c03f282d4 Instead of my usual "blogging frenzy" machine gun blast of short posts, I will just combine them into my new blog series "Fun Reading on Security." Here is an issue #7, dated October 2nd, 2008.

  1. Great paper that complements the whole "SIEM is dead?" saga - "Most enterprises are looking for a product that will solve all of their problems in some sort of off-the-shelf miracle, and when they find out that the currently available tools can't do it, they either postpone their deployment or put them on the back burner. "
  2. "The Mess: looking for someone to blame?" is an awesome piece on Internet security and its architecture - and so is Gunnar's follow-up ("If a tree falls in someone else's silo...")
  3. Mike call to "Rise up against Mediocrity."  - "Dilbert makes the risk of the lowest common denominator approach abundantly clear."; in other words, you say 'best practices', I say 'mediocrity!' Mike also remind us, in vain, to do "Security FIRST!" (and compliance second)
  4. A great piece from Burton: "On Response" - I think the world needs another 10-20 million reminders that PREVENTION FAILS. This is definitely a good one for those still in the "we'll just block the threat world" - "we will not win a continuing war of escalation" and "using response can be more cost effective than installing the latest and greatest preventative tool"
  5. More on metrics, including the highly-awaited ISO27004.
  6. Pretty dumb paper by a person confused by why PCI DSS exists (the guy needs to read this). PCI doesn't "fall short," it helps people who will otherwise not do anything and their systems will "power" those botnets of the future...
  7. While we are on this subject: a really good coverage of PCI 1.2. changes, released Oct 1st. More PCI fun here. And more here ("PCI Compliance - dispelling some common myths"). And, more PCI myths. And more good ideas on PCI from Mike R. Sorry, can't stop thinking about PCI :-)  - also this is good.
  8. Adrian on behavioral monitoring; mostly in DAM, but also elsewhere in security.
  9. "Premature Chasm-Crossing"  - a must-read for all security vendors and especially their marketing (and  their easily-excitable PR teams...) - "Shouldn't vendors be spending more time fighting the problems that security managers are facing today, right this minute?" (Mike R also comments on that). A related - and  just as interesting point is made here: "Security is not a solution"
  10. More on compliance and security checklists, good and bad: "I think this is a dangerous trend unless the "checklist" is all inclusive." (how can a checklist include ALL? :-))
  11. "SANS Top 7 New IR/Forensic Trends In 2008"
  12. Read "The three approaches to computer security!"  Why? Come on, it is from Joanna! :-)
  13. A fun discussion about a hot new technology: network IDS. Is IDS absolutely indispensable to ALL companies? No. Can it be incredibly useful? You bet. End of discussion.
  14. On an unrelated note, are lasers the future of warfare? Some say no.
  15. Finally, some security humor from Gartner (!): "Get Rich Quick With Network Security"

Enjoy!

Previous security reading.

About me: http://www.chuvakin.org
]]> Thu, 02 Oct 2008 06:31:00 +0000 security security managers previous security pci pci dss exists computer security pci fun security checklists network security Fun Reading on Security - 8 <![CDATA[Links for 2008-10-01 [del.icio.us]]]> http://securityratty.com/article/2e61bbf8f65cea7668e676362729b6b6 http://securityratty.com/article/2e61bbf8f65cea7668e676362729b6b6
  • Behavioral Monitoring | securosis.com
  • Dana Gardner's BriefingsDirect: Improved insights and analysis from IT systems logs helps reduce complexity risks from virtualization
  • E-Commerce News: ID Security: New PCI Security Standard Falls Short
  • Enterprise Architecture: From Incite comes Insight...: How many fingers are required to count the number of clueless IT Security Professionals?
  • IT Security: Can We Be Compliant and Yet Insecure?
  • Get Rich Quick With Network Security
  • Rational Survivability: IDS: Vitamins Or Prophylactic?
  • PCI DSS News and Information » Great Expectations?
  • GFOA Treasury Management
  • SANS - Computer Forensics - Top 7 New IR/Forensic Trends In 2008
    SANS Top 7 New IR/Forensic Trends In 2008
  • You Might be a PM if… « Mark Curphey - SecurityBuddha.com
  • Security is not a solution | Computerworld Blogs
    Security is not a solution
  • Andrew Hay » Blog Archive » Secure Life Ep 3
    • ]]>     Wed, 01 Oct 2008 20:00:00 +0000 security security professionals computerworld blogs security network security sans top irforensic trends sans top pci dss news Links for 2008-10-01 [del.icio.us]     <![CDATA[FileAdvisor: software file search engine]]> http://securityratty.com/article/856af459093a6fe1d8cb8a725ef66103 http://securityratty.com/article/856af459093a6fe1d8cb8a725ef66103 Troy Larson sent me a heads up on Bit9's FileAdvisor, a service they describe as "a comprehensive catalog of executables, drivers, and patches found in commercial Windows applications and software packages. Malware and other unauthorized software that affects Windows computers is also indexed."
    I immediately checked the FileAdvisor db for malware results as well non-Windows binaries and was pleasantly surprised with immediate and comprehensive results. You do have to register, but I was further impressed with the fact that they offered the option for a short or full registration.
    This appears to be worthy of a bookmark in your incident handler/malware researcher/forensic investigator toolkit.

    del.icio.us | digg]]>     Wed, 01 Oct 2008 10:34:00 +0000 software fileadvisor commercial windows applications malware malware results software packages affects windows computers comprehensive results incident handlermalware FileAdvisor: software file search engine     <![CDATA[Government sends auditors to investigate Postapay fraud]]> http://securityratty.com/article/c0eda9efb0ee776398a1680c5609a96e http://securityratty.com/article/c0eda9efb0ee776398a1680c5609a96e Tue, 30 Sep 2008 20:00:00 +0000 government shillings lost forensic auditors postapay postal corporation embrace technology fraudsters kenya hit Government sends auditors to investigate Postapay fraud <![CDATA[Nigerian IT group pushes forensic training]]> http://securityratty.com/article/d7635d9407c13e64d8cf60b3a4ed4592 http://securityratty.com/article/d7635d9407c13e64d8cf60b3a4ed4592

    ]]>     Wed, 06 Aug 2008 20:00:00 +0000 nigeria computer society fight e-commerce fraud train civil servants computer forensic technology country government ncs Nigerian IT group pushes forensic training     <![CDATA[Write-Once Read-Many Memory Cards]]> http://securityratty.com/article/55aec2b13f3c80cd4f2e69ccf191f9a8 http://securityratty.com/article/55aec2b13f3c80cd4f2e69ccf191f9a8 SanDisk has introduced Write-Once Read-Many Memory (WORM) cards for forensic applications.

    ]]>     Mon, 28 Jul 2008 01:04:22 +0000 write-once read-many memory forensic applications cards sandisk worm Write-Once Read-Many Memory Cards     <![CDATA[VM Forensic Tools Remain MIA]]> http://securityratty.com/article/349581ced94a343a2a536fd5d620bfaa http://securityratty.com/article/349581ced94a343a2a536fd5d620bfaa Sun, 27 Jul 2008 20:00:00 +0000 data theft virtual machine computer forensics analyze increasingly hacks security intrusions physical VM Forensic Tools Remain MIA <![CDATA[Assessing the Security Benefits of Cloud Computing]]> http://securityratty.com/article/1e09e5c89f15d3a4df4ea921f9230c2d http://securityratty.com/article/1e09e5c89f15d3a4df4ea921f9230c2d Is the glass half empty or half full?

    With all this talk and reporting about security concerns, lets change the channel for a moment and assess the potential security benefits of Cloud Computing.

    In my view, there are some strong technical security arguments in favour of Cloud Computing - assuming we can find ways to manage the risks.

    With this new paradigm come challenges and opportunities.  The challenges are getting plenty of attention - I’m regularly afforded the opportunity to comment on them, plus obviously I cover them on this blog.  However, lets not lose sight of the potential upside.

    In this post, I walk through seven technical security benefits.  Some are immediate, others may arise over time and have conditions attached (some unstated for the sake of brevity).  However, I’m including the longer-range benefits now to raise awareness.  Some of the outcomes listed are available today without the Cloud, but they are either complex and slow to implement (and thus less likely to happen) or prohibitive for capital cost reasons.  I don’t claim this is a definitive list - it reflects where my thinking is today.

    Some benefits depend on the Cloud service used and therefore do not apply across the board.  For example; I see no solid forensic benefits with SaaS.  Also, for space reasons, I’m purposely not including the ‘flip side’ to these benefits, however if you read this blog regularly you should recognise some.

    On a sidenote, I believe the Cloud offers Small and Medium Businesses major potential security benefits.  Frequently SMBs struggle with limited or non-existent in-house INFOSEC resources and budgets.  The caveat is that the Cloud market is still very new - security offerings are somewhat foggy - making selection tricky.  Clearly, not all Cloud providers will offer the same security.

    Seven Technical Security Benefits of the Cloud

    1. Centralised Data

    • Reduced Data Leakage: this is the benefit I hear most from Cloud providers - and in my view they are right.  How many laptops do we need to lose before we get this?  How many backup tapes?  The data “landmines” of today could be greatly reduced by the Cloud as thin client technology becomes prevalent.  Small, temporary caches on handheld devices or Netbook computers pose less risk than transporting data buckets in the form of laptops.  Ask the CISO of any large company if all laptops have company ‘mandated’ controls consistently applied; e.g. full disk encryption.  You’ll see the answer by looking at the whites of their eyes.  Despite best efforts around asset management and endpoint security we continue to see embarrassing and disturbing misses.  And what about SMBs?  How many use encryption for sensitive data, or even have a data classification policy in place?
    • Monitoring benefits: central storage is easier to control and monitor.  The flipside is the nightmare scenario of comprehensive data theft.  However, I would rather spend my time as a security professional figuring out smart ways to protect and monitor access to data stored in one place (with the benefit of situational advantage) than trying to figure out all the places where the company data resides across a myriad of thick clients!  You can get the benefits of Thin Clients today but Cloud Storage provides a way to centralise the data faster and potentially cheaper.  The logistical challenge today is getting Terabytes of data to the Cloud in the first place.

    2. Incident Response / Forensics

    • Forensic readiness: with Infrastructure as a Service (IaaS) providers, I can build a dedicated forensic server in the same Cloud as my company and place it offline, ready for use when needed.  I would only need pay for storage until an incident happens and I need to bring it online.  I don’t need to call someone to bring it online or install some kind of remote boot software - I just click a button in the Cloud Providers web interface.  If I have multiple incident responders, I can give them a copy of the VM so we can distribute the forensic workload based on the job at hand or as new sources of evidence arise and need analysis.  To fully realise this benefit, commercial forensic software vendors would need to move away from archaic, physical dongle based licensing schemes to a network licensing model.
    • Decrease evidence acquisition time: if a server in the Cloud gets compromised (i.e. broken into), I can now clone that server at the click of a mouse and make the cloned disks instantly available to my Cloud Forensics server.  I didn’t need to “find” storage or have it “ready, waiting and unused” - its just there.
    • Eliminate or reduce service downtime: Note that in the above scenario I didn’t have to go tell the COO that the system needs to be taken offline for hours whilst I dig around in the RAID Array hoping that my physical acqusition toolkit is compatible (and that the version of RAID firmware isn’t supported by my forensic software).  Abstracting the hardware removes a barrier to even doing forensics in some situations.
    • Decrease evidence transfer time: In the same Cloud, bit fot bit copies are super fast - made faster by that replicated, distributed filesystem my Cloud provider engineered for me.  From a network traffic perspective, it may even be free to make the copy in the same Cloud.  Without the Cloud, I would have to a lot of time consuming and expensive provisioning of physical devices.  I only pay for the storage as long as I need the evidence.
    • Eliminate forensic image verification time: Some Cloud Storage implementations expose a cryptographic checksum or hash.  For example, Amazon S3 generates an MD5 hash automagically when you store an object.  In theory you no longer need to generate time-consuming MD5 checksums using external tools - its already there.
    • Decrease time to access protected documents: Immense CPU power opens some doors.  Did the suspect password protect a document that is relevant to the investigation?  You can now test a wider range of candidate passwords in less time to speed investigations.

    3. Password assurance testing (aka cracking)

    • Decrease password cracking time: if your organisation regularly tests password strength by running password crackers you can use Cloud Compute to decrease crack time and you only pay for what you use.  Ironically, your cracking costs go up as people choose better passwords ;-).
    • Keep cracking activities to dedicated machines: if today you use a distributed password cracker to spread the load across non-production machines, you can now put those agents in dedicated Compute instances - and thus stop mixing sensitive credentials with other workloads.

    4. Logging

    • “Unlimited”, pay per drink storage: logging is often an afterthought, consequently insufficient disk space is allocated and logging is either non-existant or minimal.  Cloud Storage changes all this - no more ‘guessing’ how much storage you need for standard logs.
    • Improve log indexing and search: with your logs in the Cloud you can leverage Cloud Compute to index those logs in real-time and get the benefit of instant search results. What is different here?  The Compute instances can be plumbed in and scale as needed based on the logging load - meaning a true real-time view.
    • Getting compliant with Extended logging: most modern operating systems offer extended logging in the form of a C2 audit trail.  This is rarely enabled for fear of performance degradation and log size.  Now you can ‘opt-in’ easily - if you are willing to pay for the enhanced logging, you can do so.  Granular logging makes compliance and investigations easier.

    5. Improve the state of security software (performance)

    • Drive vendors to create more efficient security software: Billable CPU cycles get noticed.  More attention will be paid to inefficient processes; e.g. poorly tuned security agents.  Process accounting will make a comeback as customers target ‘expensive’ processes.  Security vendors that understand how to squeeze the most performance from their software will win.

    6. Secure builds

    • Pre-hardened, change control builds: this is primarily a benefit of virtualization based Cloud Computing.  Now you get a chance to start ’secure’ (by your own definition) - you create your Gold Image VM and clone away.  There are ways to do this today with bare-metal OS installs but frequently these require additional 3rd party tools, are time consuming to clone or add yet another agent to each endpoint.
    • Reduce exposure through patching offline: Gold images can be kept up securely kept up to date.  Offline VMs can be conveniently patched “off” the network.
    • Easier to test impact of security changes: this is a big one.  Spin up a copy of your production environment, implement a security change and test the impact at low cost, with minimal startup time.  This is a big deal and removes a major barrier to ‘doing’ security in production environments.

    7. Security Testing

    • Reduce cost of testing security: a SaaS provider only passes on a portion of their security testing costs.  By sharing the same application as a service, you don’t foot the expensive security code review and/or penetration test.  Even with Platform as a Service (PaaS) where your developers get to write code, there are potential cost economies of scale (particularly around use of code scanning tools that sweep source code for security weaknesses).

    Your Thoughts?

    What benefits do you see that I haven’t included in the above list?  Where do you agree/disagree and importantly, why?

    ]]>     Mon, 21 Jul 2008 03:00:15 +0000 benefits cloud security technical security benefits based virtualization based cloud efficient security software security software cloud market Assessing the Security Benefits of Cloud Computing     <![CDATA[Backup tape is stolen from Bristol-Myers Squibb]]> http://securityratty.com/article/911478f22f756b8e8513c59d7f720d18 http://securityratty.com/article/911478f22f756b8e8513c59d7f720d18 Security Breach

    Date Reported:
    7/17/08

    Organization:
    Bristol-Myers Squibb Co. ("BMS")

    Contractor/Consultant/Branch:
    Unknown

    Victims:
    Current and former employees and some dependants

    Number Affected:
    Unknown*

    *Bristol-Myers Squibb had "about 42,000 employees as of Dec. 31, the last date for which work force figures were available in regulatory filings.", Source: CNN Money

    Types of Data:
    "name, address, date of birth, Social Security number, marital status, gender, salary, hire date, termination date, retirement date, and, in some instances bank account information"

    Breach Description:
    "On June 4, 2008, Bristol-Myers Squibb Company ("BMS") learned that a back-up data tape containing BMS-related data was stolen while it was being transported for storage.  Through subsequent forensic work, it was determined that the data tape included personal information of current and former BMS employees"

    Reference URL:
    Pharmalot (copy of notification letter)
    Pharmalot
    CNNMoney

    Report Credit:
    Ed Silverman, Pharmalot

    Response:
    From the online sources cited above:

    The drugmaker sent letters over the past week saying a data tape containing reams of personal information was stolen several weeks ago

    On June 4, 2008, Bristol-Myers Squibb Company ("BMS") learned that a back-up data tape containing BMS-related data was stolen while it was being transported for storage.
    [Evan] This statement prompted me to list the contractor as "unknown" instead of "none".  I presume that the data tape was being transported by a third-party vendor when it was stolen.  I am looking for more information on this.

    Through subsequent forensic work, it was determined that the data tape included personal information of current and former BMS employees, such as name, address, date of birth, Social Security number, marital status, gender, salary, hire date, termination date, retirement date, and, in some instances, bank account information.
    [Evan] Ugh, this looks like very sensitive HR and benefits data.

    The names, addresses, and Social Security numbers of some employee dependents also were included on the tape.

    an untold number of current and former employees - and their dependents - could be affected

    BMS has initiated an investigation of this incident.

    To date, BMS has no reason to believe that any of your personal information has been inappropriately accessed from the data tape by an unauthorized party, or that any identity theft, fraud or misuse of your personal information has occurred.
    [Evan] I agree with most of this statement except for the "misuse" part.  There may be no evidence of misuse post stolen tape, but there may be an argument for misuse by BMS themselves.  BMS is the data custodian in this scenario, not the data owner.  If a data custodian does not care for the owner's information in a manner that is expected or communicated, does it constitute misuse?

    In addition, there is no evidence that the data tape or the information contained on it was the target of the theft.
    [Evan] I am interested in knowing more about who was transporting the tape and whether or not other items were taken.

    As a precaution, to help you detect any possible misuse of your data, BMS has arranged for you to enroll in credit monitoring for one full year, at no cost to you.
    [Evan] There is that "misuse" mention again.  One year of free credit monitoring does nothing to protect a victim against fraud that occurs after one year, supposing the victim does not renew at his/her own expense.  I wonder how many people renew on average.

    If you have any questions, you may call the dedicated Privacy Help Line at 1-877-214-0689.  Our representatives will be available to assist you Monday through Friday, between 8 a.m. and 5 p.m. ET.

    the drugmaker is issuing this statement: "Bristol-Myers Squibb regrets that this incident occurred and is committed to providing appropriate assistance for affected individuals who had their personal information on the stolen data tape. We are committed to protecting the privacy and security of employee and dependent information. Maintaining the trust and confidence of our employees is paramount to Bristol-Myers Squibb."

    Protecting the privacy and security of your information is extremely important to us.

    In this regard, BMS wishes to reiterate that it does not have any evidence indicating that your personal information has been misused.
    [Evan] Another "misuse" mention.

    the company is taking appropriate remedial steps, including enhancing security protocols regarding the handling of personal information and our back-up data tapes.
    [Evan] Like what? Encryption maybe?

    On behalf of BMS, I apologize for any inconvenience or concern that this matter may cause for you.

    Commentary:
    I couldn't find any mention about encryption or whether or not police were called.  You would think that a large, well-repected company like Bristol-Myers Squibb encrypts confidential data on tape, right?

    Past Breaches:
    Unknown

    ]]>     Fri, 18 Jul 2008 07:26:26 +0000 tape back-up data tape data tape owner data owner data bristol-myers squibb information personal information Backup tape is stolen from Bristol-Myers Squibb     <![CDATA[Blue Box #80: VoIPShield vulnerabilities, what is ethical disclosure?, SIP trunking, VoIP security news, new nomadism, and much more...]]> http://securityratty.com/article/90bb58ffbec02539c2d62e825dbe8146 http://securityratty.com/article/90bb58ffbec02539c2d62e825dbe8146

    Synopsis:  Blue Box #80: VoIPShield vulnerabilities, what is ethical disclosure?, SIP trunking, VoIP security news, new nomadism, and much more...

    Welcome to Blue Box: The VoIP Security Podcast #80, a 44-minute podcast  from Dan York and Jonathan Zar covering VoIP security news, comments and opinions.   

    Download the show here (MP3, 20MB) or subscribe to the RSS feed to download the show automatically. 

    NOTE: This show was originally recorded on April 17, 2008.

    You may also listen to this podcast right now:

    Show Content:

    Comments, suggestions and feedback are welcome either as replies to this post  or via e-mail to blueboxpodcast@gmail.com.  Audio comments sent as attached MP3 files are definitely welcome and will be played in future shows.  You may also call the listener comment line at either +1-415-830-5439 or via SIP to 'bluebox@voipuser.org' to leave a comment there. 

    Thank you for listening and please do let us know what you think of the show.

    ]]>     Tue, 15 Jul 2008 13:20:45 +0000 voip voip security news voip news australia voip news voip security voip security podcast voipsa blog site voipsa voipshield vulnerabilities Blue Box #80: VoIPShield vulnerabilities, what is ethical disclosure?, SIP trunking, VoIP security news, new nomadism, and much more...