Don’t overlook your employees’ rejection of your security policies. Without their understanding and acceptance, your company’s information security is at stake.

Here is a very good article why we should and how we can enforce security policies in a corporate environment:

http://www.cw.com.hk/article.php?type=article&id_article=2588

As we have discussed before in this blog, the point is that you need to let employees know why there are security policies and how the policies are benefiting them. And let them know the consequences of violating the policies.

CISCO has recently released a study that shows many employees do not follow Security Policies in the work environment. The reason is that they think the policy is not fair to them, and that the policy is not aligned with the reality of their daily work activities.

http://www.cw.com.hk/article.php?type=article&id_article=2591

In the article, it states:
“The study found that the majority of employees believe their companies’ IT security policies are unfair. Indeed, surveyed employees said the top reason for non-compliance is the belief that policies do not align with the reality of what they need to do their jobs, according to Cisco”.

This reconfirms that the human factor in Information Security is still the primary issue we need to deal with in our day-to-day security management.

Tags: Information Security Policy, Information Security Policy Management, Employee Attitude to Security Policy, Security Policy, Security Policy Management

Technorati Tags: Information Security Policy, Information Security Policy Management, Employee Attitude to Security Policy, Security Policy, Security Policy Management

For every first lesson I teach about Risk Management and Contingency Planning, I always like to raise an example to begin a discussion about the illusions of human beings.

This illusion is best illustrated by an interesting game called the Monty Hall Problem, which goes like this:

Suppose you are a lucky game show player who is picked to participate in a game. The game requires you to stand in front of the three doors. Behind one door is a car, and behind each of the other two doors is a goat. You are told to choose one of the doors, and if you choose the door to the car, you win the car.

The game requires you to make your choice, and then the host (who knows what is behind each door) will open one of the other two doors that he knows does not open to the car. According to the game rules, you have the chance to change your mind and choose the other remaining door, or remaining with your original choice.

The problem is: Should you pick the other remaining door, or trust your first choice? Would this decision make any difference in the chance of winning the car?

Most people will say that the chance is the same for whichever choice because you have half the chance to win the car out of the two remaining doors. It sounds logical, doesn’t it?

But let’s examine this carefully. Suppose you label these two strategies as:

Strategy A:  Remaining with the present door choice.

Strategy B:  Changing the choice to pick the other remaining door.

Let’s take a look at Strategy A first, where there are two outcomes:

Strategy A, Outcome 1: Your original door choice was the one if front of the car all along, and you win because you chose to remain with the first door you picked. The chance of you picking the door with the car at the beginning of the game was 1/3 because you had to choose one out of the three doors.

Strategy A, Outcome 2: Your original door choice was one of the two doors in front of a goat, and you lose because you chose to remain with this first door you picked.  There is 2/3 of chance for this scenario to take place, since two of the doors had goats behind them.

So for Strategy A, you had only a 1/3 chance to win the car.
What about Strategy B, where you change your original choice?

Strategy B, Outcome 1:  You change your door choice, and unfortunately your new door choice is hiding the other goat. You lose. Remember you have 1/3 of chance in this outcome as discussed previously.

Strategy B, Outcome 2: You change your door choice, and open the door hiding the car. You win! And you have 2/3 of chance in this outcome. (If you’re interested in a full explanation of how the outcome changes to 2/3, search for the term “Monty Hall Problem” using your favorite search engine and you’ll find plenty of information.)

Looking at the problem this way, it’s quite obvious that Strategy B is a better choice, isn’t it?

Some of you might still feel confused. You might need to re-read the whole discussion above to clarify your thoughts.

Ultimately, this game illustrates one very important weakness of people: We tend to jump to conclusions for many problems too easily without careful analysis. And worst of all, we are usually over confident as to what we have concluded at the beginning.

This problem is closely related to the people issue in Information Security or Corporate Risk Management. People tend to overlook many possible system vulnerabilities when undergoing so-called “risk analysis”. They are not aware that they have been overly naïve when thinking about the possible threats to their system of operations.

It’s quite interesting that this phenomenon is well observed now, as there are so many financial institutions around the world running into their own financial problems because the people who run those organizations were too confident in themselves to manage the risks. And indeed, they seem to be completely blind to the possible exposure of managing and holding all those financial products they have on hand, without even thinking about the possible serious consequence of dragging down their own companies if things go against them. And indeed, it catches up to them in the end.

So in the risk management exercise of information security, the number one beneficial attitude is to be humble. We need to realize that we are not invincible, and be very careful in weighing all possible risks related to the information system we are using. We have to work out the plan in every step of risk management without the tendency to overlook or jump to conclusions too easily. Without the right mind set, we are very likely to fail to manage all possible risks properly.

Tags: Corporate Governance, IT Governance

Technorati Tags: Risk Management, Monty Hall Problem, risk analysis, Corporate Governance, IT Governance

I read a piece of news about the security issue of the new Google Browser Chrome from ComputerWorld.

The Google Browser is an open source project, and many of the components it was built on use open source software. One of them is the open-source rendering software called WebKit. This component was found to have a security flaw in its older version. It allows the attacker to maliciously trick web surfers into downloading a java (or other types of) executable file from a webpage. As the downloaded file appears, a button under the Chrome browser could be pressed by the user and hence run the program.

Since a java executable file will not warn the user before it runs, the user could accidentally trigger a malicious java program.

For details of this news, refer to this article:
http://www.cw.com.hk/article.php?id_article=2236

This security flaw has been identified previously with Safari, the browser from Apple. Apple patched the flaw last June.

To avoid the possible download of a malicious file, you can turn on the option to prompt the user for the file download path under Options → Minor Tweaks → Ask where to save each file before downloading.

In fact, other than this security issue, I always recommend using browsers under open source efforts such as Firefox, or now Chrome, because those browsers are built using program sources that are open to everyone. Then, security experts can always look at the program code details inside the program to uncover potential security flaws. This makes the software safer to use in the long run.

Tags: Google Chrome, Apple Safari, Google Chrome Security Issue, Google New Browser

Technorati Tags: WebKit, Google Chrome, Apple Safari, Google Chrome Security Issue, Google New Browser

In this article, I will use layman’s terms and descriptions to help you understand the various fundamental concepts of Risk Management in Information Security.

To illustrate those concepts, I like to use a popular diagram¹ from Common Criteria, shown below:

In the center of this diagram you’ll find the term vulnerabilities. Vulnerabilities are any weaknesses of a system. A system always contains vulnerabilities. You cannot build a 100% perfect system with no vulnerabilities, even if you have unlimited power, money, and time to build such a system. All systems contain imperfect components, and the integration of imperfect components produces an imperfect system that always possesses certain vulnerabilities.

Threats are elements from various sources that can exploit vulnerabilities and that increase risk. Risk is the probability that the system’s asset will be damaged/abused by the threats that exploit the vulnerabilities. Assets can be tangible (such as hardware/software) or intangible (such as good will and customers’ confidence).

Threats can be initiated by threat agents. A common threat agent for IT systems is people. They can accidentally or intentionally exploit vulnerabilities of a system to impact an IT system.

In order to manage risk, we deploy countermeasures (controls) to a system to reduce the vulnerabilities. The decision to deploy certain countermeasures to reduce the vulnerabilities and hence reduce risk lies solely on the information owner, who bears all consequences arising from the risk.

In a formal risk management exercise, an organization should undergo an intense brainstorming session to discover all possible threats that can exploit the vulnerabilities of a system. The difficult part of this step is not determining whether a certain threat will cause risk to a system, but the effort required to locate all possible threats to a system. Anything overlooked could lead to possible serious exposure to risks that have not been identified.

It is of the utmost importance for the owner (the “Owners” in the diagram) of an organization to identify all possible threats to its information system to the very best of his/her effort and knowledge, in order to fulfill fiduciary duties to customers and other stakeholders. Without knowing what the risks are, it’s impossible to implement suitable countermeasures to contain and mitigate those risks.

Reference:

¹Picture from Common Criteria

http://www.commoncriteria.org/docs/PDF/CCPART1V21.PDF p.14

Tags: Vulnerability, Countermeasure, Security Controls, Risk mitigation, Information Security Management, Information Risk Management

Technorati Tags: Risk, Common Criteria, vulnerabilities, Threats, threat agents, information owner, risk management, Vulnerability, Countermeasure, Security Controls, Risk mitigation, Information Security Management, Information Risk Management

Yesterday morning, I managed to find some time to attend the 9th INFOSECURITY CONFERENCE in Hong Kong. One of the keynote speakers was Bruce Schneier, a security guru and founder and CTO of BT Counterpane – an information Security firm offering managed security services. Bruce, the author of several best-selling books on the subject, presented an excellent talk on his views about security concepts. Some of his books that I have on my shelf are: Applied Cryptography, Secrets and Lies, and the recently published Beyond Fear.

Bruce began the discussion by stating the difference between two types of security in our lives. One type has to do with what you feel about security, and other type is about the reality of security.

These are two separate things. You can feel secure yet not actually be secure. On the other hand, you can have real security but not feel it. These two tend to diverge from each other. But what surprises us is that in linguistics, we do not find two different words to describe these two types of security. We have only one word in English and it seems the situation is quite similar in other languages.

Perhaps the reason for this is that in the ancient world, while our languages were being developed, these two types did always go together. You can observe the physical environment with your five senses and judge whether it is secure or not. So essentially you feel secure when you really do in fact have physical security.

But today in the information world, these two types of security do not go together all the time. We have security measures installed in our information systems that “safeguard” our information assets, even when we do not actually “see” or “feel” them.

What is worrisome is that most of the time we may not actually “feel” there is lack of security in our system when in fact it does contain serious security flaws.

So the first thing we need to do in regards to security is educate people to be more aware of the need for security. Educate them so they have the knowledge necessary to “see” the security measurements installed in their systems.

What helps us do this, according to Schneier’s idea, is to use “systems” to explain the security implementations in our society. System refers to the simplification of the real world situation into models, to help people understand in a simpler way how something works. For example, we can explain the mechanism of a camera surveillance system in a way that helps people understand its value in not only monitoring a crime taking place, but also in helping to deter the crime from happening as well, since criminals know that its presence increases the risk of being caught.

By helping people understand the working mechanism behind a camera surveillance system, people are more likely to support its implementation, and to be less likely to object to the concern about privacy issues involved with a surveillance system.

As I have always emphasized, successful security management has to first be built on the trust, support, and understanding of people. After all, it is always a tradeoff to obtain security. You need to forgo first convenience, and second, the time and money invested in the security system in exchange for something you cannot really “feel,” even when has been properly put into place.

So security is kind of a “second thought” in many people’s minds. People tend to think of many excuses not to commit to the best security practices simply because they don’t really feel insecure, even when they do not have proper security measures in place.

All in all, I think Bruce used a very good approach to present this idea at the conference. If you want know more about Bruce Schneier, visit his personal website here: http://www.schneier.com/.

For details of the conference, please visit: http://www.infosecurityproject.com/

Tags: Information Security Awareness

Technorati Tags: 9th INFOSECURITY CONFERENCE in Hong Kong, information Security, Applied Cryptography, Secrets and Lies, Beyond Fear, security management, security, Bruce Schneier, Information Security Awareness

I have been using Gmail, Yahoo! Mail, and Hotmail for very long time. My general feeling is that the super-powerful spam filtering capability of Gmail is unprecedented. It can eliminate almost 98% of spam emails while at the same time maintaining an almost zero error rate of filtering legitimate emails. It definitely outperforms the other two free email systems.

I am always curious how it achieves this phenomenal success rate, but I find no clue at all. Having had no success in finding its algorithm, I turn to a very practical question: How we can make use of its powerful spam filtering capability to handle our daily corporate email reception task?

The first solution is to use Gmail for receiving emails from your contacts. That sounds easy and straightforward, but the downside is that you have to give up the corporate email address that signifies your corporate identity. How can we preserve that?

Here is a quick solution you can try. Since Gmail allows email received to be forwarded to another email address, you can follow these steps to set this up.

First, you’ll need to create the following three email addresses for each staff member of your company:

1. The primary corporate e-mail, which is shared with contacts. Say, for John Doe of your company XYZ Inc., you can john.doe@xyz.com.
2. A second corporate e-mail, called john.doe_filtered@xyz.com. (You’ll see the use of this second e-mail in a few minutes.)
3. A Gmail account, with an address similar to: john.doe-xyz@gmail.com

Next, configure the first, primary email address to forward email to the Gmail address.

In the Gmail account settings for the Gmail email address, select the option “Forwarding and POP/IMAP” as shown below:

You will see the following screen:

Set this to forward to the second corporate email address of your staff (i.e., the john.doe_filtered@xyz.com address, as shown in the above screen capture).

Now John Doe can configure his email client to read spam filtered email from the second email account. Those emails are originally addressed to his primary email address, filtered by Gmail, then automatically forwarded to his second corporate email account.

What John needs to remember is to make sure the email address john-doe_filtered@xyz.com is hidden from his contacts. He only uses it as a tool to receive the filtered emails.

If you really want to own the Gmail account as a private labeling service to your company (and that entitles you to own the big storage space of Gmail for each of your private corporate email account and also the spam filtering service), you can register for a private label email program through Google Apps here:
http://www.google.com/a/help/intl/en/index.html

However, this involves pointing all your corporate emails to Google’s Server for storage and processing. I am not so sure if this is a good idea for your company, although this service is basically free with an option to pay a small fee to receive technical support service.

Technorati Tags: Gmail, Yahoo! Mail, Hotmail, spam filtering, spam, Google Apps

In today’s environment, Risk Management is considered a core management issue in modern corporate governance. We have been discussing this concept in several areas of finance. Now, we are considering the subject as it pertains to the area of Information Security (IS). This is an important consideration since, in the past thirty years, IS systems have grown to be a core component among many other operations within the corporate structure.

In order to understand Risk Management, some basic terms related to risk management should be understood. They are: Vulnerabilities, Threats, and Exposure.

Vulnerability refers to the inherent weakness of an IS system. (“Inherent” simply means something that is internal to the system that you can’t easily eliminate completely.) The fact is, there is no system that is totally free from defects. No one-hundred-percent “bullet-proof” system can exist, simply due to the fact that a system is only as strong as its weakest point. There is no system in the world that is without weaknesses. One could not possibly be developed without unlimited resources to build, verify, and test the system.

Threats are certain incidents that exploit the vulnerability of a system. Threats can be natural (such as a thunderstorm or earthquake), environmental (such as temperature or humidity), or intentional (such as hacking or virus spreading).

Exposure refers to the damage that can be done if and when a threat successfully exploits the vulnerability of a system.

When there is a chance that a threat could exploit a system’s vulnerability, there is risk. In the field of information management, risk refers to the possible attack on an IS system by the threats made possible by its inherent vulnerabilities.

Risk includes the following properties:

• Risk cannot be totally eliminated.
  When a system possesses vulnerability, and it always does, there is risk.
• You can reduce the risk, but not completely eliminate it.
  However, risk can only be reduced by carefully planned countermeasures.
• You can deal with residual risk by insuring the system.
  We call this process Risk Mitigation.

Information Security Management is the art of dealing with risk using systematic and consistent management principles. This is not merely a technical issue—it is more likely a management issue. Therefore, Information Security Management is best achieved with the proper deployment of carefully planned corporate strategies to deal with Information Security risk.

Computer Security, Information Risk Management

Technorati Tags: Risk Management, Information Security, Vulnerabilities, Threats, Exposure, vulnerability, threat, Risk Mitigation, Information Security Management, Computer Security, Information Risk Management

Availability is a complete different concern from Confidentiality and Integrity. It focuses on the data’s availability when a user needs it. Its aim is easy to understand but the measures to achieve availability could be very costly.

Since the September 11th attack, organizations tend to pay more effort and investment in maintaining the continuation of the business operation after unexpected incidents. It is now commonly named as Business Continuity Planning (BCP). BCP is not only about the Availability of the information system (what we used to name it as Diaster Recovery Planning) but also the ability to keep the whole business operation run without interruption.

In information system management, to achieve Availability requires an organization to impose security measures like redundant IT infrastructure, proper information backup, data protection policy and many Internet security defenses particularly to fight against the Denial of Service (DOS) Attack and Distributed Denial of Service (DDOS)Attack, etc.

The measures of redundant infrastructure could be particularly costly if it involves the setup of a ‘warm site’ -  the site with complete duplicated IT installations ready to be put into operation once the main site is in jeopardy.Technorati Tags: Information System Availability, Information Security

When people talk about information security or computer security, they usually refer to Confidentiality.

In deed, the origin of information security comes from the need of this in military and polictical area. Countries worry about their confidential information leaks to emeny countries. That threatens their security and standing positions in the World.

If you are new to security history, read the book by Simon Singh called “The Code book -Science of Secrecy from Ancient Egypt to Quantum Cryptography“

Technorati Tags: information security, computer security, Confidentiality