The security double whammy

A lot of the recent news is about how the recession will cause increases in cyber threats. Combining that with reduced investment in security, and you have a true double whammy. And some want to add icing to the cake by suggesting that employees will also become more tempted to steal data..

Nice - a triple whammy!

Organizations should be cognizant of the tradeoffs they are making from a risk management perspective. Even if one cannot get everything complete, use the old 80/20 rule to ensure the high priority and projects that will reduce the most risk get implemented. No use being penny wise and pound foolish...

Crime and the economy

Seems like the prevailing wisdom is that when the economy is in tatters, crime rears up - a negative correlation, if you will. Apparently this is even more true for cybercrime - easier to make a few bucks when folks are scared about their savings, looking for bargains and the always popular, "too-good-to-be-true".

And criminal syndicates are taking advantage of this by providing "help" in ensuring their bank accounts are not in danger, new job opportunities targeting those who might have lost their jobs etc. Just read more of this from news.com.

Larger organizations are also not immune from this - what comes in as malware in only part of the threat and unfortunately seems to be the major focus. And folks are still pushing perimeter security and anti-malware as the main protection against this. I think we should be looking beyond - more defense in depth and more protection focused on the data itself.

New Cybersecurity post recommended

I think this is a long time coming - the idea of a more concerted effort and responsibility to fight all kinds of cybercrime. Be it commercial or against government classified data.

Global cyberspace is fragile and it will take a concerted effort to get the message out about the dangers and the grave responsibility that each organization trusted with information holds. The appointment of a national post in the new administration is welcome! I hope it happens and happens fast!

Scary criminal activity and data theft

Even though one knows that criminals are increasingly behind some of the larger data breaches, it not until we get hit on the head do we pay attention. I just read this recent article from USA Today about the latest attacks on corporate intellectual property - I tell you, this is serious stuff.
Any organization not taking this very seriously is doing a disservice to its stakeholders and shareholders.

The problem seems intractable - for every hole you think you have blocked two open up to allow these criminals to grab data. What does any organization do?

I think the answer lies in the data itself - one cannot go about protecting the periphery to protect the asset. One has to protect the asset itself - in this case the data. If the data itself is always encrypted, at rest as well as in motion (even when it is grabbed of the computer by malware), we might have a shot at preventing this.

Else we are putting our collective heads in the sand thinking that encrypting the laptop drive or USB device is enough...

WPA encryption cracked..

Just read this about the "more secure" WPA encryption for Wi-Fi networks is now cracked. Read all about it here - apparently by the same guys who broke WEP (this is what hurt TJX). I guess the bar has been raised...

A horse's ass approach to virtualization security - Part 3 - Data is the "constant"

The third in the series where I am trying to think through the current approaches to securing virtual environments...

See part one and two here...

Virtualization enables organizations to optimally manage their infrastructure resources. It can provide significant cost benefits (by sharing resources), flexibility (by just-in-time allocation of resources where they are needed), and agility (speed of provisioning resources). Therefore, organizations have been able to virtualize:

• Devices/OS: Companies such as VMWare, Citrix, Microsoft, and Sun are providing hypervisor, virtual machine, and virtual device solutions where several virtual “devices,” “servers,” or “desktops” can mimic separate physical devices.
• Networks: Virtualized networks enable dynamic collaboration by slicing bandwidth into virtual, isolated channels that can be assigned to a particular set of devices, real or virtual. Setting up new connections and collaborative environments becomes extremely easy.
• Applications: Virtual applications can either be streamed down to execute on local desktops (Microsoft App-V or Altiris SVS) or executed remotely from server farms such as Citrix XenApp. This allows applications to be portable and accessible from anywhere while reducing inter-application conflicts.

However, organizations will never be able to virtualize the fourth element, I talked about in teh second blog post — the data itself. The focus of device, network, and application virtualization is about flexibility, resource sharing, and agility. This involves short life spans, since these elements are brought up to fulfill a specific short term task, and upon completion, they are brought down or even deleted. Data, however, has a lifetime beyond the short term and will therefore live on for further use or analysis in a non-virtual or subsequent virtual world.

This makes data the “constant” in a dynamically changing environment — even if the location of data itself is virtualized. Data will also have the longest lifetime of the four elements in the infrastructure and thus will have to live “outside” of the virtual environment. Therefore, from a security standpoint, it is imperative that data becomes the focus of protection - and we dont just continue protecting the infrastructure. Data is the critical asset, and since it travels across boundaries and lives longer than virtual elements, it can be easily compromised.

A horse's ass approach to virtualization security - The four horsemen

I opinioned a bit about the current approaches to virtualization security and how they might be failing to address current and future threats - let me explain further what I mean.

In the previous blog I gave a summary of my argument. In this second blog of the series I want to talk about the four elements that make up every computing environment
(i.e. the four horsemen :)): This will setup the argument I hope to make in my next blog.

• Devices: These are the hardware and operating system combinations that host or store the execution environment.
• Applications: Applications execute on host environments (devices + OS) and transform data into information useful for the business.
• Data: Digital representation of information that is acted upon by applications.
• Networks: Enable collaboration and the sharing of information across multiple devices and/or applications.

All four are absolutely essential to complete any transaction in the modern business world. However, to gain competitive advantage, organizations are looking to optimize the usage of these four elements. Technology, flexibility, and agility are becoming increasingly important in a fast-changing business world and have therefore led to the rise of virtualization.

In my next post I will discuss how these elements are being changed in a virtual environment and what impact it has on security.