Cold Boot Attacks on Encryption Keys

The EFF posted this article about a new found vulnerability in what they refer to as Popular Disk Encryption Technologies. After reading the details, it seems more like a vulnerability in File Encryption technologies -- these are the technologies that require a user to enter a password in order to encrypt or decrypt files and folders on the file system. The difference in my view is that the term Disk Encryption is usually used to refer to products that encrypt or protect the entire disk when it's shut down. This is important, though. File encryption is particularly important in shared use scenarios where you want to protect files or data from people who have physical access to your machine. What this tells us is that even if you log out or put the computer in sleep mode, someone can come along and run software to get the data that is stored in RAM which may include your encryption key (password). What they didn't say is whether other types of passwords or credential information is also stored in RAM. It's another argument for two-factor authentication where a password alone wouldn't be enough to carry out an attack on the data. At least, how I read it is that the password is what could be stored in RAM and not necessarily the protected data.

Compliance as a Service - Counterpoint

Thanks for keeping us honest Ian! I would be pretty blind to claim that overall regulatory compliance can be solved with any IT solution (...or set of ...or service of). But I didn't make that distinction in my previous post. But, is that the basic point you're making? ...that IT compliance is a subset of overall Compliance? Or is there more to it?

I guess what I was thinking is that the service would not only provide controls that put you in compliance and evidence that proves you're compliant but also could tell you which questions you should be answering. ...even with regard to current trends in regulatory and market pressures (which no doubt change over time).

Understanding that big-C Compliance requires much more than IT controls, would it seem more realistic if we said IT-compliance-as-a-service? or IT-Audit-as-a-service?

The main thing I'm wondering is if organizations would get value from an external party taking over the IT audit portion so that the org itself (who might be anticipating regulatory pressure) wouldn't have to figure out which questions to ask, how to ask them, how to build controls to get the right answers, and how to prove that the answers are what they should be.

Compliance as a Service – The new frontier

Mark Macauley thinks CaaS - Compliance as a Service may be the new frontier. I like the concept. It seems to me that organizations are struggling with how to attack compliance issues. Fortune 500's with a compliance officer and a separate internal audit staff are probably able to come up with a methodology and processes for dealing with compliance. But, it's not easy. Or cheap. Smaller organizations especially don't have the resources to put people full time on figuring out compliance. I think there are definitely organizations out there that would love to have a third party who is willing to be an expert and own compliance for them. To understand which questions need to be answered and how to get the answers. And in the process of making life easier, reduce cost as well. Sounds good Mark.

Users Cutting Corners, Not Crooks, Are Main Inside Threat

Thanks to IT Business Edge for taking some time to speak with me about the insider threat. Now, I'm going to take a moment to argue with myself on one point. While I do think non-malicious breaches occur far more often than their malicious counterparts, I do also concede that so far it appears that the malicous attacks have brought about more monetary damages (which is usually the bottom line in corporate environments). So, the question of which is a bigger threat probably depends on which beans you're counting. Strictly from an audit and policy perspective, you want to be sure that policies are being enforced, which is why the numerous security breaches we often see in our daily routines seem like a bigger threat. They're more likely to cause problems in an audit or compliance project. And they open holes which can be exploited during malicious attacks. So, if you don't patch the holes that are often exploited by non-malicious personnel, it could come back to bite you in the bottom line.

Audit for Active Directory

NetVision launched a new web site focused on our solution for reporting and monitoring on Windows and Active Directory. The solution is pretty cool. If you're having trouble understanding how to generate reports or apply real-time monitoring for Active Directory, you should check it out.

This is not a SIEM solution designed to collect logs from as many sources as possible. This is a very focused solution on Identity information in Active Directory. The listener is embedded into Active Directory so that we're not reliant on the security event logs, which provides non-repudiable proof of events that are taking place. And it means that we're not limited to the information provided by the event log (there is a limited set of attributes available for a user object change, for example). We can tell you what changes were made, when the change occurred and who initiated it. All of which is valuable audit and compliance information.

We also have advanced filtering capability on the listeners so that you can filter events by type, object, or actor. This means that you only collect relevant data which reduces storage and makes it easy to get to the data you want on the reporting side. We can tell you things like user attributes and group memberships, changes to user accounts or groups, inactive user accounts, OU changes, file system Access Control List changes, file system access attempts and file adds or changes. And we provide policy and report templates that make it easy for you to get up and running.

So take a look and let us know if you have questions.

The Insider Threat: News & Info

Some recent news of malicious insiders:

• Employee's silent rampage wipes out $2.5m worth of data - Here, a woman unnecessarily fearing job loss wiped out valuable employer data.


• Sys admin jailed for 30 months over failed logic bomb - A system administrator at MedCo planted a logic bomb that was luckily a dud in his first attempt.

Some interesting reading on the insider threat:

• Are Insiders Really a Threat? - An article from the Software Engineering Institute at Carnegie Mellon discussing the reality of the insider threat and outlining thirteen practices for preventing insider attacks. Incidentally, I think the 30% stat they provide is low. I think 30% may be the percentage of reported malicious attacks perpetrated by insiders. A far greater number of security breaches happen every day by non-malicious insiders. And here's an article on research suggesting that many insider breaches aren't reported (and why).


• The CERT Insider Threat Research page - Lots of useful information on insider breaches, including the source of the article above.

What does all that mean?

Well, the insider threat is real. I don't think that's controversial news. But I would argue that there are far more light security breaches by insiders than malicious attacks -- something I haven't seen much data on. But a breach is a breach and in many cases can be prevented with the right policies, processes and tools. I like the SEI article and I think it provides a good place to start thinking about how to approach the challenge.

The Year of Virtual Directory?

I have blogged quite a bit on the value of Virtual Directory technology in directory services infrastructure. I was pleasantly surprised yesterday while attending a Burton group webinar titled VantagePoint 2008: The End of Command and Control is Near (you must be a client for access). The fifth and final agenda item was Trends for Directory Services in which the speaker focused almost entirely on the evolution toward (and value of) virtualization of identity information. That is, virtualizing the data structure, access protocols, server locations, etc. and presenting the same useful data from its original source in real time (or cached) in virtually any format and over most common data interfaces. It's nothing new to long-time readers of this blog, but seeing it as the center of the Trends section in Burton's webinar probably means that customers are telling them that Virtual Directory is moving up the prioritization ladder. That's a good thing -- it means Virtual Directory vendors will be able to continue to invest in this very cool technology and implementation teams have a better chance of getting this very useful tool to leverage in their bag of tricks.

A couple of quick things

A quick tactical point:

Thanks Mark for pointing out NetVision's ability to police the IDM environment. Specifically, Mark mentions the combination of NetVision with Novell's ZENworks Endpoint Security Management. I also wanted to point out that we already have customers who have deployed and are excited about our ability to add value to Novell Sentinel as well. Sentinel does security event monitoring and logging. NetVision adds value by providing advanced filtering capabilities for eDirectory events at the event collection side. So, the database doesn't fill up with unwanted or unneeded information. And by filtering it on the way in, we simplify the reporting process as well by organizing data in your terms according to your policies.

Also, if you're in LA tomorrow, stop by the CSO PCI Compliance Seminar. I'll be presenting a high level PCI compliance reference architecture and drilling down on policy management, encryption and key management, and the role of identity audit in PCI compliance.