Medical records under threat

Just saw a disturbing article on how folks are targeting medical records. Apparently Finjan (a security vendor) was trolling for malware and came across a large chunk of data with patient information etc - and get this, it was available for purchase for the highest bidder!

By now all of us are aware that hackers are no longer kids looking for laughs or thrills - they are the new criminal organizations. These organizations make it a business buying and selling data - be it credit cards, bank account information etc.

I suspect medical information can be used for many things - identity theft, blackmail, maybe even insurance fraud. Who knows?

But the main point here is this - it does appear that medical and patient information has value to criminal organizations and this is something to worry about. They will do anything to get their hands on this...

Data security and the "chasm of protection"

I was thinking a bit more about the notion of data-centric or information-centric security and why this is absolutely the future of data protection...

Say you are a retailer. You have data in your POS devices, encrypted with the POS application as cards are read in. As this data is required by another application, it has to be first decrypted so this in-store application can read it. It may then encrypt it again as it stores on in-store servers. Now assume you have another application in the data centers that is used for card settlement. Another decrypt-encrypt cycle from the store to the data-center!

This scenario is not limited to a retail environment. Consider a similar cycle repeating itself in most companies as data is moved from location to location, analyzed and processed by multiple applications and on multiple devices and multiple internal and external networks - each time being decrypted, stored or transfered in the clear till it gets encrypted again. Each time this cycle repeats, there is a weakness that can be exploited - since there is a gap in the consistent protection of data.

Being data-centric however, brings in persistence and consistency in the protection of that data element, thereby removing this "chasm".

Adaptive security from the Gartner IT Security Summit

I was at the Gartner IT Security Summit in DC last week - very interesting sessions.

Liked the Neil MacDonald keynote on the second day. He talked a lot about the current challenges or point products, silos and the decreasing importance of the perimeter. He also talked about how security would evolve and his vision on model based security, proactive approaches to security and how we could learn from the adaptive mechanisms of a biological system. Very interesting.

Most of it made sense - however, it seemed hard to see how we could build adaptive/proactive security systems just yet. We are still figuring out security based on signatures and we cant build them fast enough - adaptive might mean too many gray areas in the short term. And it necessitates learning from mistakes - I think it will take a bit of time before we will fully trust this, seemingly AI models, for security.

The one topic that did intrigue me was his statement on protecting the information and not focusing on devices - near and dear to my heart this information-centric security view! This trend does seem clear - more on this soon...

The Blackberry keys

Lots of news over the past few days on the back/forth between the Indian government and RIM. And apparently the latest is a retraction - last week RIM apparently had said it would make the crypto keys available.

Apparently, the reason is that RIM itself does not have the keys - therefore they cannot hand it over. The company says, "The BlackBerry security architecture for enterprise customers is purposefully designed to exclude the capability for Research in Motion (RIM) or any third party to read encrypted information under any circumstances"

If this is true, I wonder if any government has these keys...

Jeez - State department laptops missing..

This is bad news - folks with some of the most sensitive information seem to be willy-nilly with their laptops. How can we expect plain old corporate folks to take protection seriously?

And this snippet takes the cake "...about 400 missing laptops belonging to the Anti-Terrorism Assistance Program ..."

I wonder how many of these were targeted and stolen... If so, is a cold boot attack more likely against these types of assets?

To believe or not - new research from Ponemon

New research from Ponemon on consumer behavious post breach breach - apparently over 31% of those surveyed terminated ties with an organization that had a breach.

Not sure to fully believe it when consumers say such stuff (I did not mean the Ponemon research itself:)) - I think consumers say what they think is the right thing to say. I think folks are still lukewarm when it comes identities getting stolen, card numbers being breached. There is not yet enough pain directly resulting from this.

However, I do hope this is true though - high time we took such breach information more seriously.

More on functional encryption and two-level keys

Following up to my previous post on functional encryption. Just read another interesting article on the subject.

The gist of it is in using policy as a way of granting acess and reducing the reliance on a "trusted server". From the article..

"In a functional encryption system, keys are personalized and only one is needed for a person to gain access to all the data that should be available to them. In addition to simplifying the key process, this idea allows users—with proper access rights—to search encrypted volumes for specific information. "

The key used here is a personal key which contains attributes of a person which is used to unlock the document... Seems intriguing, but I am not sure how multiple people (or even groups such as HR) can be given access to a document based on such keys... Would like to understand this a bit more...