The TCG Specifications: A Hard Drive Encryption Standard For Us All

Computerworld discusses the Trusted Computing Group's (TCG), disk encryption standards. The TCG includes all of the major hard disk manufacturers, resulting in a standard that can be broadly supported by software, and which will allow enterprise wide encryption and management to be done far more easily.

Thus far, my experiences with this style of disk encryption are limited to Lenovo laptops which appear to be missing one key element: a simple way to check if the drive is actually encryped from a Joe User perspective. The real key to making drive encryption work for users will be making it approachable and usable for everyday users in addition to enterprise administrators.

Have you worked with hardware level FDE? If so, how was your experience?

Monster.com Announces Security Breach

Monster.com has posted an announcement of a breach:

"We recently learned our database was illegally accessed and certain contact and account data were taken, including Monster user IDs and passwords, email addresses, names, phone numbers, and some basic demographic data. The information accessed does not include resumes."

The news has been picked up in various places, including the Consumerist and TechUrbia, and TechUrbia correctly notes that much like the 2007 compromise, Monster.com users can likely expected targeted phishing attacks to begin now that accounts with access to resume data have been compromised.

As always, this is a great time to remind your users that password re-use is a bad idea.

IT Security Benchmarking: the CIS Benchmarks

The Center for Internet Security, or CIS provides a variety of publicly available benchmarks which can provide an excellent foundation for your own organization's technical security standards. Perhaps more interesting, they also work to develop new benchmarks for various platforms, systems, and software packages. At the moment, an iPhone benchmark is in progress, with version 1.0 for iPhone software version 2.2 in progress right now.

The CIS toolkit also includes a variety of scoring tools, and mailing lists for each benchmark, including those in development.

Heartland Payment Systems Breach Site Published

Heartland Payment Systems has created a website to provide information about their data breach:

http://www.2008breach.com/

A number of their answers in the Q&A section are vague at best, including "What is the extent of the breach?" answered with "We believe the intrusion is contained.".

Heartland is currently advising customers to review their statements, however a list of affected institutions has not been released.

Email Disclaimers

Slate's Jack Shafer has a great take on email disclaimers and their legal relevance. While the article is from 2004, organizations and individuals continue to use them. I'm reminded of a friend who slowly changed his company's standard disclaimer to include lines like "throw a pinch of salt over your shoulder and spin widdershins". Nobody reads them, and nobody noticed.

Playing TSA: Playmobil's Security Checkpoint

Amazon carries Playmobil's Security Checkpoint play set - from the description:

"The woman traveler stops by the security checkpoint. After placing her luggage on the screening machine, the airport employee checks her baggage. The traveler hands her spare change and watch to the security guard and proceeds through the metal detector. With no time to spare, she picks up her luggage and hurries to board her flight!"

(Image from Amazon's listing)

The Amazon reviews are priceless, with lines like "My 5 year old son pointed out that the passenger's shoes cannot be removed." as a starting point, and they quickly go downhill. Sadly, it doesn't come with a line of passengers waiting, nor is there a recording announcing that the security level is orange...

If this looks familiar, it was posted in a number of places as long ago as 2005, although I seem to have missed it then.

Disabling AutoRun...Doesn't Disable AutoRun?

The US-CERT has released advisory TA09-020A, "Microsoft Windows Does Not Disable AutoRun Properly".

Many organizations disable AutoRun as part of their default domain policy to prevent malicious programs from using autorun capabilities to spread malware. Sadly, Microsoft's current guidelines for disabling AutoRun are not completely effective.

From the alert:

The Autorun and NoDriveTypeAutorun registry values are both ineffective for fully disabling AutoRun capabilities on Microsoft Windows systems. Setting the Autorun registry value to 0 will not prevent newly connected devices from automatically running code specified in the Autorun.inf file. It will, however, disable Media Change Notification (MCN) messages, which may prevent Windows from detecting when a CD or DVD is changed. According to Microsoft, setting the NoDriveTypeAutorun registry value to 0xFF "disables Autoplay on all types of drives." Even with this value set, Windows may execute arbitrary code when the user clicks the icon for the device in Windows Explorer.

The solution is reasonably simple - inserting the following registry entry will disable AutoRun:

REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IniFileMapping\Autorun.inf]
@="@SYS:DoesNotExist"

The US-CERT also recommends rebooting your system to prevent cached AutoRun information from continuing to allow mounted devices to be exploited.