Applied Computer Security

AKS-Labs has released some metrics that are very useful for estimation of security risks. These metrics are:

- Identity Theft Risks;
- Security and Privacy;
- IT Security;

Check homepage for details.

To protect your organization’s employees and clients, you need to evaluate how well your company protects its PII. Here are seven common mistakes to avoid.

Keep users in the dark

If your users don’t know how to identify and handle PII, it’s only a matter of time before one of them discloses this data to the wrong source.

Partner with the wrong businesses

If your company collects and shares PII with insecure partners, who do you think will end up in the paper and explaining to law enforcement about how a breach occurred? Your company will.

Keep data around past its prime

What do you do with data once it’s served its purpose? If you aren’t destroying PII when it’s no longer required, then you’re not doing your job. That doesn’t mean throwing it away either — that means destroying it.

Don’t worry about physical security

It’s imperative that you implement physical access controls to prevent unauthorized people — including employees — from gaining access to PII. Get a door lock and a badge reader, and start controlling access.

Don’t lock up your records

If you don’t have specific storage areas on your network (as well as file cabinets) for PII, then how can your properly protect it?

Ignore activity on your network

If you’re not going to actively monitor your network for suspicious activity or incidents, then stop collecting the data. Develop a method that’s within your capabilities and budget to monitor your network for suspicious activity or incidents. And while you’re at it, develop a response and mitigation strategy for security incidents.

Audits? Who needs audits?

A lot of businesses either don’t know what security events to audit or don’t read their security logs — or both. If you’re not sure which events to audit, find out. Set up security auditing, and start reviewing your logs today.

From the article by Mike Mullins.

This blog is run by the authors of FindProtected.
FindProtected is a security program that allows you to search for password protected files. With FindProtected, you can effectively identify protected files containing sensitive data on your network.

A misstep in preserving electronic data for litigation could mean defeat before the enemy is even engaged.

According to Greg Fordham, a founder of K&F Consulting Inc., “Just not deleting anything off the computer isn’t enough.”

“The continued use of a computer can alter important metadata such as file system date and time stamps. Similarly, continued use can overwrite dynamic system data such as virtual memory stored to a disk, or overwrite deleted data so that it is unrecoverable,” he said.

Steps Fordham recommends include: early notice to preserve evidence - even prior to filing; preserving electronic evidence in a forensically sound manner that will capture the full spectrum of data; and developing a questionnaire or guide that seeks specific details about a clients electronic and computer systems.

According to K&F Consulting.

This blog is run by the authors of FindProtected.
FindProtected is a security program that allows you to search for password protected files. With FindProtected, you can effectively identify protected files containing sensitive data on your network.

Oracle is suing SAP in federal court, alleging that its chief competitor in business software markets has been stealing corporate secrets. SAP is still reviewing the suit.

Concerns over sabotage or theft are on the rise, prompting companies of all sizes and including utilities to examine their policies and business processes. Because utilities are geographically dispersed and have thousands of employees, breakdowns in security will inevitably occur. The goal then is to mitigate that threat on the front end and if espionage has taken place, perpetrators should be tracked down and held responsible.

According to the FBI, corporate espionage costs U.S. companies between $24 billion and $100 billion annually. Interestingly, only about 20 percent of those losses are tied to cyber threats while the majority of them are associated with low-tech schemes such as stealing from trashcans.

It’s not just big business that is at risk. It can also be the smaller engineering, environmental and law firms. Most corporate crooks can’t break into computer systems. But, they can meander into open offices, taking phone numbers, strategy bulletins and computer info.

“A good spy always looks for the path of least resistance before trying anything fancy or high tech,” says Ira Winkler, an information-security-systems consultant, in a book called Corporate Espionage. “In fact, small businesses tend to be targets more often than large corporations, simply because they have more competitors.”

Beyond cyber threats, companies must keep classified information restricted while requiring employees to sign agreements prohibiting the unlawful use of company trade secrets. Those secrets may include anything that a company knows that is unknown in the marketplace, which gives it an uncommon competitive advantage.

Corporate espionage is a risk for all companies. Utilities are clearly aware of the problem. As a result, their information technology units are now working hand-in-hand with upper management to guard the integrity of the business lines. It’s a sensible solution to what could be a potentially devastating issue.

See full story by Ken Silverstein.

See the latest on Oracle’s SAP lawsuit at PCWorld.com.

This blog is run by the authors of FindProtected.
FindProtected is a security program that allows you to search for password protected files. With FindProtected, you can effectively identify protected files containing sensitive data on your network.

According to the recent article by Dan Morrill, “Google Desktop Applications, or Google Apps is a risky decision to be making, small company or big company it does not matter”.

Information Security - Google has a lot of money to spend on information security, but Google also has a track record like every other software maker, of having code with bugs. If you use Google apps, you have to trust their code over the internet, and you have to trust them to patch their code in a timely manner.

Legal Discovery - so far the law has worked in this fashion, ISP or Company gets a discovery notice, the ISP or Company is not obligated to inform you, rather they usually make a copy of all the data and send it to the legal group requesting the information. Since all your data is hosted outside the company on a 3rd party server system, ownership is most likely not going to be efficiently defined until there is a series of lawsuits to determine who owns information on 3rd party service providers. Technically, it should already all belong to Google.

Control - usually when working with technology and 3rd party outsource, only “authorized” people are allowed to call for support. Control of the help desk, and the services that the help desk provides for lost information, e-mail support, password reset support, and other low level support functions are now being taken over by Google.

Other Legalities - Have you engaged legal counsel before signing up? This is a big one, what do the company lawyers say about the issue? Will they be involved in the decision, and will management listen to what legal counsel is saying, and what the legal liabilities are.

Federal/State Mandates - if you are covered under HIPAA, SOX, GLB, HB1386, or otherwise, how does using Google Apps help you gain compliance, or remain in compliance if you use their system? From the legal mandates and laws side, unless Google can provide a statement of compliance that will stand up in court, anyone who is under any federal or state law for information security compliance might want to think twice before using this service.

Think long and hard before using Google Apps, make sure there are legal protections and someone can not just randomly request data without talking to legal council first. Make sure that the bases are covered, and if you are in a regulated industry that you get a certificate of compliance from Google. Otherwise, there is a ton of free or low cost software out there that will allow you to do the same things, do them in an equal or like manner.

See full story.

This blog is run by the authors of FindProtected.
FindProtected is a security program that allows you to search for password protected files. With FindProtected, you can effectively identify protected files containing sensitive data on your network.

An adviser to the UK Cabinet warns that civil servants’ low awareness of data security threats puts information collected by the government at risk.

A key advisor to the Cabinet Office on information assurance issues, said that with the exception of the police, defence and intelligence communities, public servants have little grasp of information security threats. “What keeps me awake at night is that, with some notable exceptions, across government there’s too little awareness of the scale and breadth of the risk facing us at the moment,” he said.

Ignorance of information security threats at board level is actually more of a threat than the threats themselves, according to Burton. “No-one knows the scale of the risk. We need to energise boards. The technical risks are nothing compared with ignorance at board level,” he said in a panel discussion at a British Computer Society (BCS) security event this week.

The UK government recently announced two sets of controversial plans around data use - plans to form the database for the ID Cards National Identity Register from three existing databases, and plans to relax data-sharing laws so government departments can share information more easily.

See full story.

This blog is run by the authors of FindProtected.
FindProtected is a security program that allows you to search for password protected files. With FindProtected, you can effectively identify protected files containing sensitive data on your network.

AKS-Labs has released a Windows privacy utility called RecentCleaner. With RecentCleaner one can check and clear the list of recently opened files. Recent files is a kind of link that program creates when the file is being opened. Almost all products create recently files, for instance Microsoft Word, Excel, PowerPoint, Access, WinZip, WinRar. Windows system keeps the record of recently accessed files too.

Sometime the list of recently opened files can become a great security problem, as it hard to remove all these records fast. RecentCleaner was created to solve this issue in a timely manner. Recent files records can be cleared in a single click now.

Learn more about clearing recent files at RecentCleaner web-site.

AKS-Labs has released a version 1.0 of RecentCleaner, a personal privacy tool designed to browse and clean recently accessed files list. The program supports WinZip, WinRar, Word, Excel, PowerPoint, Windows recent files.

Learn more about clearing recent files.

Amid warnings about the risk of identity theft, Canadian insurance companies have begun offering policies that help defray the cost of setting things right, if you fall victim.

Identity theft occurs when a crook uses another person’s name and other personal information such as social insurance number, credit-card number or bank account illegally to make purchases, borrow money or make some other costly transactions without the victim’s consent or even knowledge.

According to research by Phonebusters, a national anti-fraud organization…, thousands of Canadians a year report cases of identity theft — although the rate may be lower now than it was a few years ago.

It can be time-consuming and costly for innocent victims of identity theft to compile the information and get the legal advice required to verify they aren’t at fault. It’s those expenses — such as lost wages, lawyer and notary fees and courier charges — that are covered by identity theft insurance.

“Those are where the real expenses come in. It’s not the $5,000 or $10,000 loan. It’s the expense of clearing everything up,” says Bryan Seaton, spokesman for ING Canada, which recently began offering identity theft protection across Canada.

There has been increased public awareness of the measures — such as shredding documents with account numbers, proper storage of passwords and account numbers and software protections for your computer — that can be taken to prevent your personal information from getting into the wrong hands.

“We have a duty to defend your title. So we do what we can to get it resolved. Or, in a worst-case scenario, we can pay out the money that you’ve lost as a result of this problem,” says Kathleen Waters, vice-president of Title Plus, a service provided by Lawyers’ Professional Indemnity Co.

See full story.

This blog is run by the authors of FindProtected.
FindProtected is a security program that allows you to search for password protected files. With FindProtected, you can effectively identify protected files containing sensitive data on your network.

Discovery is the part of the litigation process in which opposing parties exchange relevant information and testimony. Discovery helps both sides understand the facts and evidence before the trial starts. On April 12, 2006 the Supreme Court approved proposed amendments to these rules to address discovery issues that are unique to electronic discovery. These amendments will increase the pressure on corporations to proactively manage the electronic discovery process to avoid sanctions, unfavorable rulings and a loss of public trust.

The amendments will require that if your company is engaged in a law suit, prior to a discovery request you must furnish to the other party a description of electronically stored information that your company plans to use in its case. In addition, your company will be required to expand the scope of their potentially relevant data sources to include all media and all formats, including backup media, portable media, remote or third-party locations, etc.

The amendments state that absent “exceptional circumstances” you will not be subject to sanctions for failing to produce email or electronic documents “as a result of the routine, good-faith operation of an electronic information system.” However, the rules make it clear that that IT should in certain circumstances intervene to modify or suspend automatic overwriting or deletion functions to prevent the loss of information that is related to a pending case.

Here are the specific steps IT should take to be prepared for the new regulations:

#1 - Map out all places where electronic information is stored

#2 - Update your records retention policy to include all electronic information

#3 - Ensure your litigation hold policy fully covers all electronic information including backup tapes

#4 - Establish systems that simplify identification, retrieval and production of potentially relevant data

See full article by Kevin B. Roden (posted on July, 7th): New Federal Discovery Rules are Coming. How Can IT Get Ready?

This blog is run by the authors of FindProtected.
FindProtected is a security program that allows you to search your network for password protected and evidential files. FindProtected makes it easier to discover electronic evidence that may be used in litigation.