Cloud Computing Privacy

As organizations and individuals make the move to cloud computing service such as storage, video, financial, social networks, the question of how to retain privacy becomes more important. Each site or system has a different privacy policy, different security architecture, and different potential risks. These can vary widely, and individuals and organizations each have concerns about how their data is stored, used, and made available.

The World Privacy Forum, has both an in depth report (PDF) and brief tips for consumers and business organizations. If your organization is considering using cloud based services, this is a great starter document to review, with details on the Electronic Communications Privacy Act, the PATRIOT act, HIPAA, the Fair Credit Reporting Act, and many other related laws, policies, and requirements that may affect your data and disclosure. It also discusses subpoenas, ownership, and even venue, making it the most complete cloud computing privacy overview that I've seen.

They suggest simple behaviors such as reading the terms of service, limiting what data you make available, and how the provider will use your information. With the recent outcry about Facebook's
Terms of Service change - and their subsequent change and clarifications, this is very much a current topic.

netForensics Acquires High Tower Assets

netForensics announced their acquisition of the assets of High Tower today. Note that they are acquiring the assets, rather than the company itself - an interesting difference. Per the email sent to customers and partners:

"netForensics is proud to announce our agreement to acquire the assets of High Tower Software. I would like to take this opportunity to pledge our continued commitment to the success of your business and welcome you to the netForensics family."

netForensics goes on to explain that High Tower products will be available as standalone solutions and as extensions to the netForensics nFX One product line. netForensics has typically been seen as a standout in the log management and data mining arena - this acquisition will likely expand their portfolio nicely.

Customers can call +1 732-393-6060 with questions - the first of which will likely be what the change in support means for existing High Tower customers. In addition, readers may also want to review our previous posts on High Tower's demise, as the comments thread has further detail about High Tower's fall.

LinkedIn to Malware

ITNews reports that hundreds of fake LinkedIn profiles promising nude celebrity pictures are, as might be expected, lures to malware sites. Unlike other social sites, LinkedIn is likely not as easy of a target as other sites might be - limitations on profile visibility and the more closed networking circles that the site is based on will limit the spread, as will the content, which is not typical of a professional social networking site.

Targeting LinkedIn users wouldn't be very difficult - I wouldn't be surprised to see more advanced tactics in the future.

The Case For Full Disk Encryption: Military Gear On the Open Market

Military.com's recent article "US Gear Ending up in Pakistan Markets" offers a great example of why organization wide full disk encryption is a good idea. One of the items that author Shahan Mufti found for sale was a Maintenance Support Device (a ruggedized laptop), which contained "documents and photographs inside the computer" that indicated that "the assigned user of the laptop likely belonged to the U.S. Army's 864th Engineer Combat Battalion". In addition, "the computer also contained dozens of manuals on how to operate, assemble and trouble shoot U.S. Army equipment".

It is not at all surprising that the paper versions of these support documents are also available. What is surprising is that a military laptop does not have protections preventing unauthorized users from accessing it. While combat systems may need to be operated at short notice by other members of a team, laptops and desktop computers would benefit from having at least data partitions encrypted.

For most companies, encrypting portable devices is a good first step, and full disk encryption is easily available in a variety of price ranges and support models. From a risk management perspective, being able to confidently state that a stolen device which contained sensitive data was encrypted and inaccessible when stolen is a huge benefit - one which many current laws recognize as a means of avoiding their disclosure notification clauses.

We've discussed using TrueCrypt 6.0 for Windows as a free solution in the past, but many vendors offer enterprise ready products as well.

Heartland Payment Systems Breach - First Arrests Made

StorefrontBacktalk has further detail about the Heartland Payment Systems data breach, including the fact that the malware hid in the slack space on the disk, and that it was detected with temp files. The current suspects are Eastern European, but three arrests have been made in Tallahassee after suspects used cards with data stolen in the breach. Interestingly, the suspects were using gift cards, rather than credit cards, and according to the article Wal-Mart was a favorite location.

Heartland's next step according to StorefrontBacktalk is to investigate end to end encryption, noting that PCI is not sufficient. The article points out that card data is unencrypted, requiring connections to be encrypted, rather than the data that travels over them. This process of pushing encryption to the endpoints would require a significant infrastructure change - every endpoint card might well require an encryption key and a PIN. The good news is an approach with endpoint encryption and in-transit encrypted data means that your vulnerable points are decreased to points owned by the issuing bank, and that PCI compliance would become much simpler. The comments are well worth a read for the technically inclined.

When CAPTCHAs fail - phpBB Drug Spam

As many forum owners quickly discover, there is a reason that most popular forum software allows CAPTCHAs as a requirement for user creation. The image above shows what appears to be an automated tool seeing heavier use recently that posts to phpBB forums. A quick Google search for coreod offers examples of the spam - but the gotcha here is that at least some of the forums that these were posted to use CAPTCHAs, and that many usernames are used.

There are a number of tricks that can help:

1. Ask the bot additional questions: "Are you a bot?" or "How did you find out about this forum?" often net responses using the userID that the bot fills forms in with.
2. You might also add a hidden form field in the new user form - bots will fill it, users won't.
   
3. Delete users who do not respond to verification email within a reasonable timeframe.
4. Use an RBL (Realtime Block List)
5. Use user limitation plugins - Russel John's blog has an older post with some good starting ideas. The phpBB support site requires registration, but has a number of posts on the same topic.
   

If you're a forum admin, you'll have to commit to some time spent cleaning up your user list. You may also want to use a Google Alert to help monitor for spam on your site.

Security Humor: Password Character Requirements

NotAlwaysRight, a site that posts stories of customers causing woe has a great password reset story today:

Customer: “Are their any requirements for the password?”

Me: “The only requirement is that the password has to be at least 6 characters in length - numbers, letters or both.”

The punchline isn't what you'd expect - but should bring a smile to the face of any helpdesk or security staffer who reads it.