in

This Blog

Syndication

Tags

News

AlertBoot offers a cloud-based full disk encryption and mobile device security service for companies of any size who want a scalable and easy-to-deploy solution. Centrally managed through a web based console, AlertBoot offers mobile device management, mobile antivirus, remote wipe & lock, device auditing, USB drive and hard disk encryption managed services.

Archives

AlertBoot Endpoint Security

AlertBoot offers a cloud-based full disk encryption and mobile device security service for companies of any size who want a scalable and easy-to-deploy solution. Centrally managed through a web based console, AlertBoot offers mobile device management, mobile antivirus, remote wipe & lock, device auditing, USB drive and hard disk encryption managed services.

September 2007 - Posts

  • Governator Wants to Plug Up Holes - Unless You Have Encryption

    It looks like businesses in California and, if history serves, in the rest of the United States might soon have an incentive to really start taking a look at their security policies (things seem to spread from California to the rest of the country).  A bill in California will force retailers to reimburse banks and credit unions for breach notifications and credit card replacements.  The bill only requires the signature of California Governor Arnold Schwarzenegger.  Many people have pointed out the retailers do not have an incentive to be more aggressive in how they handle customer data despite the recent spate of ongoing data breaches.  Yes, the ensuing public relations nightmare would be enough for some companies to take a look at how they protect their data.  However, the costs shouldered by credit card companies and other financial institutions due to security breaches are humongous in comparison to the unquantifiable PR damage.  If this bill passes and is made a law in California, and similar ones are passed across the other states, an immediate and direct financial burden that hasn’t been present heretofore will be placed on those responsible. 

    However, there will be a way for the retailers to avoid liability: if they can prove that they are in compliance with state data security laws.  This is a great incentive for retailers to start catching up on any security holes that they might have throughout their organizations, especially considering that the cost of data breaches is rising sharply, even without having to shoulder the actual financial burdens mentioned in the paragraph above.

    Will the governator sign this bill?  I’d imagine so.  It’s backed by him.

    Among other things included in the bill is complete disclosure on the details of any breaches, including what type of personal data was compromised, and limiting the long-term retention of authentication data found on credit cards. 

    It sounds like data security companies can expect a great deal of business for some time to come.  Based on the latest string of security breaches that were reported in the media, mobile device encryption as well as port control (through which an administrator can control which devices can hook up to a computer) will probably be popular (perhaps even necessary by law). The good news for retailers is that the soon-to-be-approved law will go into effect in July 2008, so it gives them plenty of time to do some research and implement any policies to plug up holes.

     
  • Application Control - Whitelists for Controlling Malware

    There is news that security vendors are beginning to rethink their philosophy on how to protect computers.  The current practice is for security vendors to create blacklists of software that is not allowed to run on a computer.  This protects computer users from the installation of malicious software.  The problem with such a strategy is that the rate of malicious software being created is quite high, so the blacklisting in question will not be comprehensive.  Plus, there is the additional problem that malicious software has to be identified as such; if it’s not detected, it will not be placed on the blacklist.

     

    Because instances of malicious software is growing at higher rates than the release of legitimate software, security vendors are beginning to think that maybe blacklisting is the wrong approach.  There is talk in the industry of using a white list, i.e., a list of legitimate software that can be run on computers.  Such a list would include the usual suspects such as Microsoft Word or Adobe Acrobat.  If it’s not on the list, it cannot be used.

     

    One problem with such an approach, of course, is how to include peripheral yet non-malicious software.  For example, I have quite a significant list of freeware that I use in my personal computer at home.  And remember, this white list is being managed by the security vendors, in software offered by companies such as Symantec or McAfee.  Since all companies have to coordinate their efforts, an “approval committee” of industry heavyweights will probably be created.  Critics say that problems might appear in the form of delays, since there’ll only be so many people to judge the legitimacy of hundreds of thousands, perhaps millions of programs.  The free programs on my PC might not make the cut, or at least not right away.

     

    Due to the problems posed to end-users, I would imagine that the end-user would have the ability to approve the use of any software that they own that is not yet part of the vendor’s white list, a flexible white list, if you will.  If one wanted to be truly comprehensive, a combination of a flexible white list and a blacklist could be used: allow the end-user to add software programs to the white list in question, but not if it matches something that is placed on a black list.  This probably will be much harder to implement, but it would protect the accusers from approving any software nilly-willy.

     

    Thankfully, the use of white lists in a business is not as complicated.  The number of software programs with a legitimate use is quite limited.  They might be different from company to company, but within a company itself, the list of approved software doesn’t change that often.  Application control, another way of saying “white list,” is a feature offered by AlertBoot, along with other disk security and data protection features, such as full disk encryption and file encryption.  They even offer port control to ensure that unapproved devices cannot be hooked up to a computer (say, like an iPod, which could be used to steal digital files).

     

    While the big guys are debating whether this change in philosophy is a right path to take, your business can proceed forward with a white list strategy if you choose to do so today.

     

    For total security, however, you’d also want to combine the above with the proper encryption solutions such as full disk encryption or content encryption to ensure that your data is protected if the entire computer is lifted from the office.  Malware is not the only threats to your data, after all.

     
  • Who Protects Those Who Police Us? Law Enforcement Needs File Encryption In More Ways Than Expected

    The need for data protection might be highest for those who protect us.  I recently read an article concerning an accident that happened in York, England.  A spreadsheet containing the personal information of police constables and deputy constables was posted to the York county’s website.  Among the information listed were Social Security numbers and home addresses.

     

    The mistake was caught about a week after the incident, but that was enough for the page with the data to be cached into various search engines including Google and MSN.  Needless to say, a lot of time and effort was expended to get rid of this information from public eyes.  At one point a US senator had to get involved to make sure this information was taken out of circulation.

     

    Social Security numbers aside, this incident is potentially dangerous for law enforcement officials.  Due to the nature of their work, such personnel go to great lengths to keep a lot of their information private: unlisted phone numbers, not using their home addresses for correspondence, unpublished addresses, etc.  These officers are trying to protect themselves and their families by not having this information out in the public.  Accidents as the one in York obviously work against these careful safeguards.

     

    This particular incident was a mistake, and an isolated one at that.  However, the problem with mistakes and accidents is that they cannot be foreseen; otherwise, they’d be called premeditations.  Knowing this, the only logical solution is to make sure that the consequences of mistakes will have a limited impact down the line.

     

    The encryption of contents when it comes to sensitive files and data would be the first step to take.  This way, if any future accidents do happen, at least the information will be protected.  Content encryption in AlertBoot allows administrators to specify whether a specific file type ought to be encrypted.  The encryption of files is fast enough that end-users barely notice an impact when working with files.

     
  • A Different Take On The Consequence Of Ineffective Data Security - Employees Sue, Too

    Some of you might remember a case from almost 2 years ago where unencrypted computer disks and tapes containing the information of patients, close to 350,000 of them, was stolen from the backseat of a car.

     

    Well, it looks like the saga continues.  The IT worker who blew the whistle on this particular data breach was fired two months after the incident, and he has filed a lawsuit for wrongful termination.  $1 million in damages is being sought for lost wages as well as emotional distress caused by the firing.  The $95,000 paid to settle patient claims from the actual loss of the disks and tapes certainly pale in comparison.

     

    This happened in the state of Oregon, where the whistleblower law forbids companies from firing employees because they file reports with the authorities.  However, Mr. Shields, the IT worker, might be overreaching in this case: The car that was broken into was his.  Even if he were employee of the month, every month, for 10 years in a row (that’s how long he worked at Providence Health System), I would imagine that the fact that he kept all that information in his car might be justification for dismissing him from his job.

     

    I find it hard to blame him entirely for the fiasco, however.  As I remember it, the company did not have an actual policy to store the patient data in a secure offsite location.  Which is not suprising, since they didn't have a policy for encrypting the data, either.  Anyone knows that data breaches can happen en route to the secure, off-site location.  I guess it’s for the courts to decide who was to blame: the company for not setting the correct policy, or Mr. Shields for not exercising better judgment.

     

    This entire episode could have been prevented by encrypting the contents of the disks and tapes.  Content encryption offered by AlertBoot allows administrators to select individual files for encryption or to specify that an entire file type is to be encrypted—existing ones as well as any future ones created.

     
  • Application Control Is An Effective Method To Stem Malware For Endpoint Security

    There is news today that Germany’s Federal Crime Office has busted a gang of phishing scammers.

     

    The gang has been under surveillance for about 18 months, and the arrests have been in several German cities.  The gang was actually composed of people from Germany, Russia, and the Ukraine.

     

    Unlike the initial phishing techniques used years ago, where a simple e-mail would ask you for funds to be deposited at a foreign bank or where they would try to get your bank account number and passwords by redirecting you to a mockup of an actual financial institution, these particular phishers had attached malicious Trojan horses to the e-mails.  Click on those attachments, and malicious code is installed in your computer, reading your data or saving every stroke of the keyboard.  Obviously, these are a different breed of scammers.  While there is no way to corroborate it, this is probably another example of organized crime getting involved in cybercrime.  The payoffs for such illegal activity are huge.

     

    As it was pointed out in the article, computer users need to learn how to defend themselves from such threats.  Growing rates and instances of individuals getting scammed in such a fashion indicates that people are not exercising due diligence to protect their data and their identity.  Even in the regular news the coverage of such crime is declining or hardly existent.  Most of the coverage seems to come from online media sources, particularly the media involved with computers and security issues.  In other words, while all these articles are generated, most geared for pretty much anyone who can read, they are only reaching the people who are probably practicing proper security measures.

     

    Is there a way that AlertBoot could have protected any of the victims?  The answer is yes.  AlertBoot offers application control, which dictates which applications are allowed to run on your computer.  With application control, the malware wouldn’t have been installed in the first place, protecting end-users (and potential victims).

     

    Such security breaches and ensuing crimes affect not only individuals but companies as well.  For example, TD Ameritrade revealed last Friday that they had “unauthorized code” on one of their servers where names and e-mail addresses as well as Social Security numbers were stored.  While it hasn’t been revealed what kind of unauthorized code it was, there are some who point out that this would be a case of malware being installed and raking the data in for nefarious purposes.

     
  • The Dark Continent Suffers from Cyberattacks, Just Like Any Other Country. Why They Need Data Encrytion

    Here’s a new twist on an old problem.  Many of us associate phishing scams coming from some part of Africa.  This is in no small part due to all the spam e-mails that, if we were to allow them to introduce themselves, we certainly would end up assisting them financially, for we might end up assisting ourselves as well.

     

    Well, it looks like businesses in Africa are also targets of such scams as well as more elaborate security breaches.  Earlier this month the government of Kenya withdrew a proposed bill because there was a need to introduce clauses dealing specifically with cyber crime as well as a protection of optical fiber cables.

     

    While most of the world views the entire continent of Africa as a poor, backward country, the truth is that there are pockets of extremely high-tech, modern civilization as we know it.  Usually, these are concentrated in the major cities.  I should know.  I spent some time in Kenya back in 2003.  Nairobi, the capital of Kenya, is a city no more different than others.  It is congested, people wait in ATM lines to withdraw money, and inconsiderate people will litter parking lots with empty shopping carts.  You won't confuse Nairobi with New York City, but you won't feel out of place if you're used to walking on concrete pavements.

     

    Anyhow, African businesses also find the need to invest heavily to ensure the security of their data. Major businesses already invest in expensive physical security systems as well as software to prevent data theft and manipulation by vandals as well as competitors.  The need to secure data might be driven by the latter.  Kenya does not have a legal framework for protecting businesses against digital fraud and theft.

     

    Will the African governments come through?  I believe that the answer is yes.  When you consider that many foreign companies are increasing their investment in the African continent, and especially in the more highly developed economies in Africa, such as South Africa and Kenya, the government will be forced to recognize the real problems they will face as they update their country’s infrastructure.  So, the day will come.

     

    In the meantime, domestic and foreign businesses in Africa, could rely on data security options provided by AlertBoot.  The encryption of devices as well as content should be imperative for businesses in a country where competition is fierce, the laws need to be updated, and internal business data must be protected.  Theft of devices is a problem in any part of the world.  Plus, most of the heavy industries and commercial business are extensions of US and European Fortune 500 companies.  A *** in a company's global armor could potentially affect all.

     
More Posts « Previous page - Next page »