Copyright law could sting businesses

It may be three weeks until the new Copyright (Infringing File Sharing) Amendment Bill comes into force, but now is the time for businesses to start protecting themselves.

The law holds the ‘account holder’ responsible for infringements, meaning if people are caught downloading copyrighted content at work, their employers could be the ones who get stung. Although the law comes into force on September 1, it is backdated three weeks, so businesses need to take action now.

Chris Barton, ANZ regional manager for online security vendors Clearswift, says businesses need to take a two-pronged approach: defining online policy and setting online restrictions. “If you think about how the population uses the internet now, there’s going to be a large number of businesses where people are using the internet for non-business purposes,” Barton says.

“As bandwidth keeps increasing, people will use it more for downloading. The internet is faster at work than it is at home, and it’s free at work whereas people have to pay for it at home.”

Barton says businesses can implement systems to block file sharing sites, but that may create more problems if employees aren’t also educated about the dangers. “Employees may think it’s going to be easy to bypass those restrictions by using proxy avoidance sites. That might be true from an organisational perspective, but certainly not from an ISP perspective.

“Proxy sites are also great places to go to find malware and spyware, so by trying to avoid detection those employees could be opening the company up to more risk.” Barton says the new law may be a wake-up call for businesses that have been delaying implementing an internet usage policy.
“It isn’t about trying to be Big Brother, it’s about making sure we are all protected.”

Advocacy group InternetNZ has set up a website to provide consumers and businesses with information and advice about the new law. Go here to read more. This article originally appeared on www.techday.co.nz

by Clearswift

The evolution of security policy

This week, Gartner research suggested that high profile data breaches and ongoing rapid changes in technology would force organisations to revise their data security policies before the end of 2012. According to Gartner, the proliferation of cloud computing and location-based services means that many organisations are battling to get to grips with the security implications of having data that resides outside corporate control. This pressure for change will be further driven by time and budgetary constraints, says Gartner.

There’s no question that evolving business processes and technologies mean that organisations have to re-think their data security strategies. But ever-present time and money factors mean that, as Gartner’s Carsten Casper puts it, privacy programmes will be “chronically underfunded” for the duration of the current global budget crisis. In this situation, finding the right balance between too little protection and too much can help organisations ensure that data security remains at the top of the business agenda without becoming a drain on resources.

A key element of achieving this balance is flexible policy. Without getting too bogged down in the fine detail of regulatory requirements, many organisations will find that a lot of the controls and policies they need are already there – they just need to be managed correctly. Flexible policy engines and content inspection capabilities tailored to the specific needs of each section of the enterprise can reduce administrative time and expense without compromising on data security.

But it’s not just the tangible solutions that businesses should be considering over the long term. Most organisations have adopted a policing approach to data security, blocking websites or only referring to policy when something goes wrong. If security is to become a more cost-efficient, flexible part of the business, it’s vital that organisations get to grips with making policy a living, breathing part of their business. This means making security more visible within the business, taking it out of the shadows and adopting flexible policies that can be integrated across the organisation.

Visible security means better informing users of company policy and using tools that remind them of what constitutes a security breach or inappropriate use of company data resources.

It’s time to move beyond a box-ticking approach to data security and adopt a more proactive, flexible one. Apart from making good business sense from a compliance point of view, it can help organisations to manage tight financial and time resources more efficiently. And that’s good news for everyone.

by Clearswift

Data breaches – not all bad news…

Download this gallery (ZIP, null KB)

 

The high profile data breaches hitting the headlines over recent months aren’t all bad news. A surprising response from a software security firm, you might think, but if one good thing has come out of all the attention, it’s been an increased awareness of the importance of data security. The industry professionals I speak with are in no doubt that the issue has moved higher up the agenda in many businesses.

 

So I was surprised to read a survey this week reporting that 77 per cent of organisations fail to perform quarterly security and compliance training. The report also highlights the fact that many organisations are unaware of what security practises they currently have in place.

These findings are by no means unique. In fact our own research on a similar topic showed, perhaps more worryingly, that 38 per cent of people had received no training at all on security issues in their current job (whether in a dedicated session or otherwise).

Given that the same research revealed that 63 per cent of employees believe a lack of understanding is a key reason for security breaches, training and education can’t be overstated when it comes to helping organisations take control of their data security.

While it is important to have a security policy in place, it is also vital that employees are educated to ensure that data is kept safe. Although it does appear that data security has moved higher up the agenda in many businesses, it’s vital that we start to see a ‘trickle down’ to all levels of the business. Ignoring training or leaving employees without it for long periods of time (as this survey suggests many organisations are doing) simply isn’t acceptable given the pace of change in the technology world. Businesses should bring IT security out of the shadows creating a visible, flexible policy before educating staff so they are not only aware of the rules but, crucially, they also understand why those rules are in place.

By Nick Peart

Making “Shady RAT” Useful: An Open Letter to McAfee, Symantec & the Australian DoD…

Earlier this week, I wrote a post comparing the cybersecurity strategies of the United States and Australian Departments of Defense. In that post, I applauded the Australians for having a strategy that was “detailed, well-researched and supported, and focused on proactively solving security problems rather than blindly reinforcing outdated and ineffective strategies.” The strategy was based on the DoD’s Defence Signals Directorate’s (DSD) analysis of attacks–learning from what happened to suggest approaches that would have prevented the attacks/breaches. The strategy outlined 35 mitigations, with a strong recommendation to implement the top 4 strategies (#4 is application whitelisting, btw):

“While no single strategy can prevent this type of malicious activity, the effectiveness of implementing the top four strategies remains unchanged. Implemented as a package, these strategies would have prevented at least 70% of the intrusions that DSD analysed and responded to in 2009, and at least 85% of the intrusions responded to in 2010.”

Also earlier this week, McAfee released a report that just about everyone in the security industry has likely now read, “Revealed: Operation Shady RAT”. The report, written by Dmitri Alperovitch, VP Threat Research at McAfee, is an eye opening read covering targeted intrusions into over 70 global companies, governments and non-profit organizations over the last 5 years. The report covers the types of organizations hit the hardest (not shockingly, defense contractors led the list with 13 of the intrusions detected), the ramifications of the breaches, estimated times each were compromised (shortest being 1 month, an honor shared by 9 victims) and even outlines the generic attack approaches utilized:

The compromises themselves were standard procedure for these types of targeted intrusions: a spear-phishing email containing an exploit is sent to an individual with the right level of access at the company, and the exploit when opened on an unpatched system will trigger a download of the implant malware. That malware will execute and initiate a backdoor communication channel to the Command & Control web server and interpret the instructions encoded in the hidden comments embedded in the webpage code. This will be quickly followed by live intruders jumping on to the infected machine and proceeding to quickly escalate privileges and move laterally within the organization to establish new persistent footholds via additional compromised machines running implant malware, as well as targeting for quick exfiltration the key data they came for.

(Side note: Not to be outdone, Symantec did their own analysis of the attacks, which adds even more details. You can find that analysis here.)
In short, the McAfee report does an excellent job of driving home Dmitri’s (and most security professionals’) key message:

“I am convinced that every company in every conceivable industry with significant size and valuable intellectual property and trade secrets has been compromised (or will be shortly), with the great majority of the victims rarely discovering the intrusion or its impact. In fact, I divide the entire set of Fortune Global 2000 firms into two categories: those that know they’ve been compromised and those that don’t yet know.”

Which finally brings me to the objective of this post. This is an Open Letter to McAfee, Symantec and the Australian DoD. Let’s find a way of making the “Operation Shady RAT” project truly useful. Please combine the known attacks from “Operation Shady RAT” with the best practice mitigation methodology utilized by the DoD in creating their 35 mitigation recommendations. Truly analyze the security processes and procedures that were in place at each victim, perhaps categorized by their effectiveness in shortening or avoiding the breach (I have to believe that the 9 entities that had the shortest compromises were doing something different than the ones that remained compromised for years), and create a modified (if necessary) version of the DoD’s mitigation recommendations. That would be truly useful… beyond the BFO (blinding flash of the obvious) from the original report: That all entities with any valuable infrastructure or information fit “into two categories: those that know they’ve been compromised and those that don’t yet know.

by JT Keating

Catering to the Sophisticated User: Make that a “babe-a-ccino”

It was only a matter of time before someone figured out how to tap into the toddler market with a specialty mock coffee drink aptly called the “babe-a-ccino.” Yes, no kidding, there is the photo in the WSJ this morning of a young man, clutching his morsel of croissant, or is it a chai lavendar biscuit, with his “babe-a-ccino.” Invitingly presented in a classic espresso cup, the “babe-a-ccino” seems to consist of frothy milk, a sprinkle of cocoa, and only the suggestion of coffee.



Jack, age 2, drinks a babe-a-ccino at the Seesaw cafe in San Francisco – WSJ
So what exactly does this have to do with business users and software? Well it’s an interesting example of understanding your audience and catering to their wants and needs. For the under five year old crowd it tends to be 99% about wants, and depending on the business user it may be the same. In the case of the “babe-a-ccino” the toddler wants what Mommy or Daddy has, however what they need is a big glass of milk. Enter the “babe-a-ccino” an excellent compromise between what toddler wants – cute cup, frothy milk and a teaspoon to play with – and what they need which is a decent serving of milk.

Let’s face it, today’s business users are sophisticated in their wants and needs. With easy access to free software they are pushing the envelope on the types of solutions they are bringing into the workplace. What they want is easy access to information, from any device, easy file sharing with colleagues and outside partners and easy collaboration. What they also need is security and tracking so they stay out of trouble.

It’s hard being a parent but someone has to do it. Sorry kid. No, you can’t have a coffee drink. Not least because I don’t want to deal with you when you are bouncing off the walls later from the caffeine. Similarly, for the business user: sorry, but no, you cannot use Dropbox for sharing confidential work information. Not least because no one has a record of what you are doing, and I don’t want to lose my job because of a data breach. Now comes the big pout.

Enter the “babe-a-ccino.” Now everyone’s happy. Kid gets what they want, Mom and Dad are happy too. Consider Accellion the “babe-a-ccino” of file sharing. It gives the business user what they want, while giving IT/Security teams what they need. Everyone’s happy.

I’ll take my “babe-a-ccino” to go, thanks.

by Paula Skokowski

Social media use at work needs flexibility not hostility.

Download this gallery (ZIP, null KB)

 

Last week, New Scientist reported that researchers in India and the US had designed a proof-of-concept Facebook botnet capable of using photos to spread large-scale, covert attacks on data without relying on users to download anything.

 

The Stegobot uses JPEG steganography technology to hide data in image files, such as the photos Facebook users typically share with each other. This data is capable of performing a pre-programmed list of activities such as harvesting email addresses and passwords, credit card numbers or keystroke logging.

The fact that all of this could happen without the end user having to download anything – Facebook currently downloads images automatically – means the news generated a lot of interest , with the researchers suggesting that blocking social network access is, in theory, the best way to prevent such attacks.

Clearswift CEO Richard Turner says such drastic action is neither necessary nor advisable. With research indicating that the majority of business leaders believe that Web 2.0 and other collaborative technologies are critical to the future success of their company, Turner says that killing off employee access to social media not only prevents companies from innovating around the technology, it also sends out the wrong message to their workforce. “One fifth of employees say they would actually turn down a job that refused access to social networking sites. It’s not much of a leap to see how blocking such sites could damage employee relations while having an adverse effect on productivity and motivation,” says Turner.

Flexible policies allow organisations to deal with specific security issues while continuing to allow them to reap the benefits of Web 2.0 technologies. Rules can be tailored to allow specific departments and individuals the freedom to communicate in precisely the way they need while preventing distribution of confidential or damaging information.

When it comes to the specifics of Stegobot, Clearswift Chief Software Engineer Paul Singh says there are too many weaknesses and dependencies involved for it to be a commercial threat. “In order to infect the user, Stegobot has to do the same things that other, current botnets need to do. So the chances of infecting someone in an already-secured enterprise is radically reduced.”

Singh says that as the command and control communication of the Stegobot relies on downloading images from the peer online social network account of an infected friend, its effectiveness is reduced. “Modern distributed botnets use lists of known ‘near’ peers and pass these to each other, operating a distributed network of sharing commands,” says Singh. “Relying on infected online accounts where the image has to be updated for a command to be passed on to the network seriously affects the usefulness of a bot.”

In addition, the amount of data that can be used in steganography is limited; not a problem if the bot is only transmitting account details but if the primary aim of a botnet is to deploy other malware, this could limit its effectiveness. “There are much easier and more effective ways to do these things and the Stegobot is too dependent on whether someone uses Facebook and how often they actually upload images,” says Singh.

In terms of dealing with a threat of this nature, Singh suggests techniques like examining bit distribution to see whether it’s following abnormal patterns and using steganography detection tools to scan and weed-out infected images. “You could also blast all the redundant bits to wipe out any possible hidden data without damaging the image too much,” says Singh, “but this would require rebuilding if the image is in a document.”

It’s not all plain-sailing, however: as Singh points out, steganography can pose a credible threat to government IT systems, as the US government discovered last year when alleged Russian spies were arrested in the country. They’d been using steganography to send and receive instructions without raising suspicion.

by Clearswift

A Tale of Two DoDs: U.S. and Australian cybersecurity plans differ in depth and usefulness…

Earlier this week, I came across some coverage about some of the Australian Department of Defence’s (DoD) cyber-security strategies. While not completely fair, I found it an interesting study in contrasts between the Australian strategies/tactics and those recently outlined by the United States DoD.
Toney Jennings, CoreTrace CEO and a former Air Force information warfare officer, recently blogged on the US DoD’s “Strategy for Operating in Cyber-Space”. The main objective of his “DoD Cyberspace Strategy: Is the DoD really ready to embrace new technologies & companies???” post was to openly challenge the US DoD to modify their procurement and evaluation processes to enable small and innovative companies to assist in cyber defense. However, Toney also made a few other key points. Most relevant to this post is that Toney highlighted that the document was extremely high level and highly prone to status quo thinking and actions, e.g.,

“Unfortunately, a significant portion of the document is simply reiterating the government’s ‘business as usual’ tactics. I’ve got to believe that for the five strategic initiatives, the DoD already has active programs in place. Therefore, the first question that comes to mind is how effective are these defenses? I suspect that the fundamental problem with the existing defenses is that the government is using traditional security solutions that don’t measure up against evolving cyber attacks. The root of this problem stems from the fact that the government continues to favor status-quo, ‘no one ever got fired for buying from’ large companies and contractors.”

Which brings me to the Australian DoD. In contrast to the high-level US cyberstrategy document, the Australian DoD’s “Strategies to Mitigate Targeted Cyber Intrusions”” plan is detailed, well-researched and supported, and focused on proactively solving security problems rather than blindly reinforcing outdated and ineffective strategies. There is a nice blend of old and new in the list of thirty-five mitigation recommendations, with a strong recommendation to implement the top four strategies. According to the DoD’s Defence Signals Directorate (DSD):

“While no single strategy can prevent this type of malicious activity, the effectiveness of implementing the top four strategies remains unchanged. Implemented as a package, these strategies would have prevented at least 70% of the intrusions that DSD analysed and responded to in 2009, and at least 85% of the intrusions responded to in 2010.”

I strongly recommend reading the whole document, but here are the four key strategies:

1. Patch applications e.g. PDF viewer, Flash Player, Microsoft Office and Java. Patch or mitigate within two days for high risk vulnerabilities. Use the latest version of applications.

2. Patch operating system vulnerabilities. Patch or mitigate within two days for high risk vulnerabilities. Use the latest operating system version.

3. Minimize the number of users with domain or local administrative privileges. Such users should use a separate unprivileged account for email and web browsing.

4. Implement application whitelisting to help prevent malicious software and other unapproved programs from running.

I sincerely hope the the US DoD will take a page from their Australian counterparts. Learn, adapt, and survive. It is a far better strategy than simply staying pat.

by JT Keating

Coming to terms with the consumerisation of IT.

This week, remote access application developer LogMeIn announced a new, cloud-based service enabling organisations to manage secure access to enterprise data and systems via employee personal devices. It’s not a new development, but it does highlight a key shift towards the consumerisation of IT in the workplace, as employees increasingly expect to be able to connect to company networks using their own devices.

While many businesses see the benefits of consumerisation, such as cost-effectiveness and reliability, the rapid adoption of personal devices brings many challenges, particularly for CIOs as they look to implement IT strategies to prevent data loss and secure corporate network boundaries. First generation devices like the Blackberry had their roots firmly in the enterprise market; as Blackberry’s star wanes, the gap is being filled by devices designed without any real consideration for enterprise-level security and the regulatory and compliance environments in which all businesses must operate. Market researcher recently reported that security was the biggest barrier to letting workers use their own devices at work, with 83 per cent of administrators saying security concerns were holding them back. It’s not scare-mongering either: Other recent research indicates that one in five employees is putting their company’s network at risk by using non-standard smartphones in breach of their organisation’s security policy.

So what can businesses do to manage IT security more effectively with this increasing challenge?

One of the key issues around consumerisation is the ‘blurring of boundaries’ as staff approach work security in the same way they would approach home security. Adopting a home-style attitude towards workplace security could have serious detrimental effects, not least because the majority of consumer users still haven’t installed antivirus protection onto their devices.

With consumerisation set to stay, businesses need to start viewing personal devices as an extension of the company network and adapt IT security policies accordingly. Education and on-going explanation of web and email policies advising staff of the risks and encouraging them to adapt their behaviour are just two elements of an overall, unified policy that should also include the development of device-agnostic procedures governing all business data, regardless of its origin or destination. For this to happen, all data entering or leaving the network should do so over a secure corporate connection, rather than directly over the internet.

by ClearSwift