What's going on in your IT infrastructure?

When anything happens in your network infrastructure it can be logged. Servers have log files, firewalls have log files, routers and switches have log files, every single PC has a log file. That's a lot of log files! In fact, that's so many log files with such a vast amount of logged information that it becomes a complete, unintelligible, amorphous mass of data. In fact most organisations probably turn logging off because it's too hard and too time consuming to evaluate.

But what can these logs tell you? Actually, the question is probably better "what can't these logs tell you?". There is a vast amount of very useful information that can help direct your IT services in solving technical issues, access issues, security issues and generally the health of the systems being monitored.

We've been working with one of our clients to implement a SIEM (Security Information and Event Management, although possibly substituting System for Security may be quite appropriate) pilot across their estate of well over one hundred servers. It's early days but the amount of interesting information coming through already is quite staggering. Identified attacks on the infrastructure from China, Germany, Taiwan and a few other places, a SQL service failing but not spotted elsewhere, potential vulnerabilities uncovered are all in a days work for the SIEM.

This information helps direct the IT team to priority areas to look at as there is now a constant visual display (dashboard) of what is happening throughout their infrastructure. How are the servers and services coping? What happens at the start of the day when everyone logs in? Checking changes that have taken place to servers to ensure that they comply to change management control.

It's a tough job ensuring compliance against company policies, proving to the auditors that you know exactly what has been happening in your infrastructure, pro-actively closing off potential vulnerabilities in your security and checking to see what the users have been up to. Being able to display, in real-time, the state of play within the network to board members is a real bonus. It's a very difficult call to request spending on anything that is deemed non-productive and security is usually deemed as such. However, with the information now being correlated and displayed for all to see, the task gets a great deal easier.

We've been working with AlienVault on this pilot and extremely pleased to see the kind of information being presented to our customer. There's a lot to do, but at last there is some real intelligence to make sense of the vast amount of data that is being collected. Intelligence that will improve the day to day operations of this customer, will help to secure the system from outside and inside attacks and to help prevent any loss of intellectual property. SC just posted an article here.

http://www.vioptim.co.uk

The drive towards implementing an information security standard

ISO27000 and the Need for a Standards Approach

It’s been interesting to note that in recent weeks, several customers have expressed the need to incorporate some information security standards within their organisation. The reason behind this has been the requirement from their customers to have certain minimum qualifications in place in order to bid for business.

Not untypical of supply chain management, it’s often the crucial missing ingredient that gives certain standards a push.  Although there are a number of standards around, perhaps the most widely used is the ISO 27000 family.  Derived from a British Standard (BS7799), it has been adopted – with a few adjustments – by ISO. In the retail sector, businesses using credit cards have been forced into adopting and complying with PCI DSS (Payment Card Industry Data Security Standard) in order to continue offering them as a form of payment.

True of most standards, their impact is often felt years after the initial adopters have bought into them by the supply chain. Also true, standards are often not taken aboard as a “must have” until there is either supplier, customer or regulatory pressure applied. It’s an understandable situation as there is a cost involved in achieving a standard’s accreditation and the benefit of so doing may not be altogether obvious. With Information Security, there are, perhaps, some compelling reasons for incorporating best practices into the organisation and formalising the approach, starting at the board and working down through the layers of the business.

Computer Weekly reports that Cyber attacks on the UK have reached "disturbing" levels, according to Ian Lobhan, director of communications intelligence agency GCHQ. The attacks are targeting sensitive data on government computers and defence, technology and engineering firms' designs, he said in The Times.  According to Lobhan, "Such intellectual property theft doesn't just cost the companies concerned; it represents an attack on the UK's continued economic wellbeing.”

Speaking at the London Conference on Cyberspace earlier this month, William Hague stated that “it will become harder to protect users and prevent defences from being swamped as the scope for malignant activity widens alongside advantages.” Putting this in perspective, more than six million unique types of new malware were detected by industry in the first three months of 2011 alone, according to Hague.

Heavy stuff.  Scary too, especially if you haven’t got your corporate defences in good shape, which is  quite likely given current cost, time and understanding constraints.   Worst of all, it’s the good old IT department’s neck on the block.  But if you look at how information security standards, like ISO27000, are shaped, it’s actually a business problem that is - or at least should be - owned by the CEO and their heads of departments. It’s not the IT that’s at risk: it’s the business.  Too many organisations are too slow in getting this message through to their senior management.

By taking a high level look at what ISO27000 and other information security standards are aiming to achieve, senior management should start to get the picture, taking a great deal of pressure away from the IT department as well as making budgetary funds available to implement mitigation strategies and solutions.

Vioptim is positioned to help promote this high level view and engage with the necessary consultancies to move towards standards compliance and accreditation.

 http://www.vioptim.co.uk

Dotting the i's and crossing the PC's

The recently published figures for Apple make for some eye watering reading. The quarter to 24th September 2011 resulted in a total of 17 million iPhones and, get this, 11 million iPads sold. Wow! The Guardian produced an interesting article on 22/9/11 which showed the actual and forcasted growth in tablets compared to the PC market:

Whilst there's a good deal of speculation in where the figures are going in the future, one thing is for sure and that is that the tablet market, which is forecast to be 50% Apple iPads, is going to shake up the entire industry as we know it today. But, so what?

The increase in the use of mobile technologies, which includes smartphones as well as tablets/pads, is going to have a fundamental impact on:

• corporate access, data loss prevention & confidentiality
• use of wireless and roaming
• what is company owned v. what is privately owned
• lifestyle

From a technology point of view, the first two points are incredibly important. I was interested in an article by Joanie Wexler entitled "iCloud to Test Wi-Fi Performance Mettle" (you may need to register with Webtorials to see this) in which she asks the question whether the existing Wi-Fi infrastructure is going to be able to cope with all of the automatic synchronisation of devices, citing Apple's new iCloud as the primary example. If you add to that the cost of using 3G, whilst roaming when no Wi-Fi is available, it's food for thought.

Aligned with the increase in mobility solutions comes the protection of information either on the device or being accessed by the device especially in corporate environments. Make no mistake, these mobile devices are going to have a significant impact in the corporate environment. There is absolutely no way that the IT department is going to fend off the use of corporate provided and privately owned devices from accessing corporate information. There will be delaying tactics, no doubt, but like King Canute and the sea, the tide is coming in and you're going to get wet!

So it's time to get serious with the issues surrounding the use of mobile devices in the corporate environment. In fact, it's time to rethink the corporate IT strategy to take account of the development of mobility, the use of the cloud (public and private) and all of the security issues surrounding this change in direction.

We're already doing our bit at Vioptim

email signatures - a legal reminder

Most organisations are already aware of the legislation associated with appending information automatically to emails, but I thought it worthwhile just providing a reminder here in the blog.

The following is courtesy of Pinsent Mason's outlaw.com, the full text of which can be found at http://www.out-law.com/page-5536. In short If your business is a private or public limited company or a Limited Liability Partnership, the Companies Act 1985 requires all of your business emails (and your letterhead and order forms) to include the following details in legible characters:

•     Your company's registered name (e.g. XYZ Ltd)
•     Your company registration number;
•     Your place of registration (e.g. Scotland or England & Wales); and
•     Your registered office address

So, if you're not already doing so, update your signature files straight away. If you're using a service that sends emails on your behalf then go and check their standard templates and/or automatic service for adding this information. Chances are, you're in for a shock.

Vioptim is a SaaS security specialist, providing information security services and solutions in the UK www.vioptim.co.uk

Meta Compliance - taking the heat of compliance

According to my sources, if it comes to a court case involving employees mis-use or abuse of using corporate Internet facilities and confidential information, it's very hard to prove that the relevant policies were communicated, understood and signed off. This came as a bit of a surprise given that much is made of Acceptable Use Policies, company confidentiality, data loss prevention, customer information and the like. Surely organisations are ensuring that they communicate this information properly and manage the sign-off's by staff?

Nope, more often than not, this information is there, possibly published on the Intranet but with little ability to ensure that it is read, that it is understood and that it is signed. That means it's pretty much unenforceable in a court of law.

With our collaboration partners, Bridgeway Security, we're offering a very effective means of managing compliance, ensuring that policies are known, are read and are accepted. Furthermore that they are updated and re-circulated in an appropriate way to ensure that everyone is up-to-date. This really does take the heat out of the problem faced by a majority of organisations that need to keep track of this type of activity.

Here's what MetaCompliance can do:

 

		Enterprise	Advantage
Automate policy communication		•	•
Intelligent desktop delivery to ensure self-certification		•	•
Enforcement capabilities		•	•
Policy lifecycle management		•	•
Policy adoption reporting		•	•
Integration to E-learning/intranet, email and file launch		•	•
Intelligent scheduling		•	•
Unique targeting capabilities via Active Directory		•	•
Non Electronic module (additional costing)		•	•
Vendor/Partner Risk Management		•	•
User/Employee Compliance self-management		•	•
AD Replication for multi level targeting		•	•
Dynamic Intercept/Situational Awareness		•	•
Governance Lifecycle for Joiners & Leavers		•	•
Policy awareness & understanding assessment		•	•
Policy Exchange		•	•
Information Governance Approvals Workflow		•	•
Automation of Information Governance Maturity Model			•
Extensive Risk Assessment capabilities			•
User behaviour improvement reporting			•
Information Assurance Headline Reporting			•
Extensive Governance & Compliance Reporting			•
E-learning Connections			•

 

There's a lot more more to information security than securing your perimeter, it's very much a top down approach to resolving some of the difficult issues through modern means. We all use computers to do our day to day tasks but MetaCompliance can ensure that everyone that needs to know about policies are informed and the audit trail managed.

Not all organisations feel that they must be watertight in this regard and that's fine, but those that do, really do need to investigate how best to make the process work.