Encryption, Data-Centric Approach Needed To Secure Cloud, Mobile Users

Encryption, Data-Centric Approach Needed To Secure Cloud, Mobile Users

Posted by Chris Talbot
February 08, 2012

The ever-growing mobile workforce with its head in the cloud has created what seems like an endless list of IT challenges to overcome, and with anywhere, anytime access to information a necessity for many enterprises, the new IT world is having an impact on the kind of encryption enterprises need to protect their sensitive and proprietary data. InformationWeek's "Data Encryption: Ushering In a New Era" report found that cloud and mobility are adding new challenges to security, but only 47% of 506 IT professionals that responded to a survey on data encryption stated that have mobile-device encryption has been made a priority. Another InformationWeek survey, "Research: 2012 State of Cloud Computing," of 511 IT professionals regarding cloud computing found that 64% of enterprises using cloud services are dealing with between two and five different providers. As the number of servers and applications move into the cloud, the more the use of encryption drops off. "The problem of mobility and cloud is it forces policies, processes and encryption technologies to have to scale to an outside device, organization, and too many more use cases," says Michael Davis, CEO of Savid Technologies and author of the report. "This usually means the governance/audit team isn't ready, the security team gets bogged down in details related to deployment, but in the end we don't see users impacted too much by encryption in these spaces as the technology is usually transparent." All of the encryption technologies require keys, but in the case of mobile devices, the keys are usually controlled by end users when they turn on their phones, Davis explains. In that case, the user must have a lock/password screen or encryption isn't able to do its job. IT can create policies around using lock/password screens, but end users frequently ignore policies. In the case of mobile devices, it leaves potentially sensitive data open to anyone who comes into physical contact with the phone. Of the 506 respondents to the data encryption survey, 38% said their organizations have comprehensive formal policies in place that expressly require encryption of personally identifiable information (PII) or confidential data on certain devices within their networks. They said the policies are strictly enforced. Another 38% noted that although they have policies, enforcement is limited or done on an application-by-application basis.

"If the organization doesn't start looking at their data in terms of who, what, why and where the access to that data needs to occur, they won't be able to properly encrypt the data and know what devices need to decrypt the data," states Davis. "Furthermore, when it comes to cloud, if you don't encrypt and have control of your keys, you are basing your security on the fact that the cloud provider promises to implement security at or above the level your organization does, and, sadly, most organizations don't check to see that the cloud provider actually meets the same level of security requirements."
From a mobility perspective, enterprises have been lucky because of the type of data typically being stored on mobile devices, Davis says. End users have not wanted to work with large documents, spreadsheets and other files not easily viewable on mobile devices, but as the form factors, available applications and performance of mobile devices have increased, users are becoming more likely to work with such data on their smartphones and tablets. "Mobility has enabled anywhere, anytime access. I call it the Starbucks problem. Every Starbucks is now the corner office for most workers, and mobility is going to continue to demand that employees access files anywhere from any device," he says. IT organizations need to ask themselves some tough questions about security and encryption, with a focus on securing data that is not under their control (because most of those mobile devices aren't). The solution to the problem is usually taking a data-centric approach to security instead of the traditional premise-based model, says Davis. Learn more about Strategy: SIEM by subscribing to Network Computing Pro Reports (free, registration required).

ICO Blog: Why encryption is important to data security

By Simon Rice
28 August 2013


Storing any personal information is inherently risky. By recording it, you risk losing it, and that risks upsetting people, and no-one likes upsetting people. But quite often, if you don’t store personal data, you can’t provide a proper service. And that risks upsetting people too.

This is why, if you are collecting personal information, you must make sure you are looking after it in a safe and secure manner.

In order to do this effectively action must be taken to reduce the risks of inappropriate disclosure. Given that a large amount of data can now be stored on something as small as a smartphone or tablet PC, there is a real danger that personal information could be compromised should such a device end up being lost or stolen.

Using appropriate encryption can be a simple and effective means to protect personal data in these circumstances, and one which we advise all organisations to take if the loss of the data could cause damage and distress to the individuals affected. However evidence shows that data controllers are still not addressing the problem.

This blog article aims to provide you with a useful insight into how encryption works and the encryption options available to you and your organisation to help you keep personal information secure.

The big misconception

Let’s get this one out of the way first. A common misconception is that just requiring users to login to a device, or service, with a username and password provides an equivalent level of protection to encryption. This isn’t the case. A password or PIN to control access to a device isn’t encryption and it isn’t enough to protect against unauthorised or unlawful access. In practice a password can be easily circumvented and full access to the data can be achieved.

How does encryption work?

Encryption software uses a complex series of mathematical algorithms to protect and encrypt information. This hides the underlying data and prevents any inadvertent access to, or unauthorised disclosure of, the information. This means that even if a device containing personal information is lost or stolen, the information will remain secure as long as the would-be data thief isn’t able to access the encryption key required to crack the algorithm.
Appropriate encryption products are widely available, but it is important that organisations understand the type of protection a particular encryption product offers and the circumstances under which personal data will be protected from unauthorised or unlawful access.

What encryption software should I use?

There are a variety of different encryption options available. The option that will be the most appropriate for your organisation will depend on the sensitivity of the information you are using and how it is being stored and processed.

For this reason it is difficult to provide a comprehensive list of software as everyone’s needs are different. You can however look out for internationally recognised standards such as those described on the encryption section of our website.

Full disk encryption

This is a process which encrypts the entire disk including all of the information and personal data it contains. It is commonly used when encrypting laptops, desktops and mobile devices, such as mobile phone and tablets. The disk will need to be decrypted with a key, which is often protected by a password entered by the user, before the operating system boots up.

However, this may mean that there are circumstances when the data could still be at risk. For example, if someone left a tablet unlocked and unattended in a restaurant then anyone who picked up that device would have an opportunity to extract the unprotected data. It is also important to recognise that if a file is transferred off the disk, for example if you sent the information in an email or saved it to a different device, then the file will no longer be encrypted.
Full disk encryption is provided through a range of widely available third-party software and some modern operating systems have a full disk encryption mode built-in, but they will usually require the user to enable the protection.

Individual file encryption

This is a process which will encrypt an individual file or create an encrypted container into which a set of files can be stored. When the container is closed it is encrypted. This means that if the container itself is transferred to a different device, for example if it is emailed or saved to a USB drive, then the personal data remains encrypted. However once the file is removed from the container it is no longer encrypted.

Some modern operating systems are able to create encrypted containers, while a range of third-party software can also offer the same level of encryption. However it is important that this encryption technique is not confused with adding password protection to a file or folder, as this process will not result in the data being encrypted.
Most email client software will also support sending emails with the message content and any attachments in an encrypted format. This approach does however require some initial configuration of both the sender and recipient’s email software.

Encrypting data in transit

It is also important to know the difference between the encryption techniques used for data storage and the encryption techniques used in data transfer.

You can transfer data using an encrypted data transfer protocol, such as Secure Sockets Layer (SSL) or Transfer Layer Security (TLS). This is the technology that displays the padlock symbol in protected web browsing. It provides assurance that the communication between client and server cannot be intercepted. Furthermore it provides you with a means to validate where the data is being transferred to.
The use of an encrypted transfer protocol does not provide any guarantee that data will remain encrypted, or otherwise processed securely, once it is received at its destination. This will need to be assessed separately.

The importance of keeping the key secret

You wouldn’t install high end locks on your house, only to leave the front door key under the mat. The same applies for storing a laptop encryption key or password in the same bag as an unencrypted laptop, or equally, sending encrypted data as an email attachment with the means to decrypt it included in the body of the email.

If you do any of these then the safeguards provided by the act of encryption are illusionary, because all of the necessary information required to decrypt the data is readily available. The secrecy of the key used to encrypt the data is therefore of paramount importance.
To ensure the maximum level of protection offered by encryption, the key or password should be transmitted using an alternative means of communication. For example the encrypted data could be sent by email and the key provided over the telephone once the intended recipient has confirmed that the data has been successfully received. By adopting this approach, even if you accidentally send the data to the wrong recipient, the information will remain secure as the person will not have the necessary key to access it.

And finally…

While encryption sounds like a complicated means of protecting sensitive personal information, the crucial aspect to making it work is to identify the most suitable form of encryption and follow a common sense approach to keeping the key, and therefore the data, secure. Using effective encryption is usually easier to manage than adopting an alternative means of providing a similar level of data security.

And the time and cost of proper encryption is put into sharp perspective by a quick glance over the penalties issued in three recent cases where encryption wasn’t used (£700,000 in total). The price of getting it wrong could therefore extend well beyond upsetting people…

Simon Rice
Group Manager, Technology
28 August 2013

If you'd like to get in touch with feedback or comments please find us on Twitter @ICOnews or email blog@ico.gsi.gov.uk.

< << Blog homepage

 

 

U.S. Secret Service: Five Retailer Breaches Are Linked

U.S. Secret Service: Five Retailer Breaches Are Linked

Written by Frank Hayes

August 28th, 2013

 

If it seems like this spring and summer have seen a rash of supermarket-chain security breaches, it turns out there’s a reason. Five recent cyberattacks against smaller retail chains all appear to have come from the same overseas criminal gang, according to the U.S. Secret Service. That includes the breach at Schnuck Markets that netted thieves as many as 2.4 million card numbers, four other breaches at chains a Secret Service spokesman declined to name, and a collection of retailers in Kentucky and Indiana who all shared the same local reseller who provided the POS remote-access software that thieves exploited.

While investigators wouldn’t finger the victims other than Schnuck’s, it’s easy to make a short list of likely suspects who reported apparent remote-access breaches over the past six months. They include regional grocery chains Bashas and Raley’s, restaurant chain Zaxby’s, convenience store chain Mapco Express (NYSE:DK) and discount hardware chain Harbor Freight Tools. Craig Hutzell, a spokesman for the Secret Service’s Kentucky Electronic Crimes Task Force, told Bank Info Security that the malware used in the attacks and the methods of entry all trace back to a single hacker using an overseas IP address. “It’s the same [modus operandi], and the malware matches what we had here in our breach,” Hutzell said. Hutzell confirmed the connection between the Schnuck’s breach and attacks on a group of retailers in Kentucky and southern Indiana, but would not name the other four retailers, saying it was not clear if all of those incidents had been made public. But the attacks on the Kentucky and Indiana retailers all exploited an unpatched vulnerability in the same POS software. That strongly suggests that all the other attacks used what’s essentially the same vulnerability, exploited by the same malware, whether it’s actually the same POS software or not. Investigators haven’t named either the software or the local reseller who provided it. And that, of course, leaves every other chain, large or small, twisting in the wind. The thieves know about the vulnerability, and they can keep testing remote access to more chains’ POS systems to see if they have the same security hole. But without knowing what the vulnerability is, how it’s exploited or even the POS software involved, chains (and, in the case of small chains, resellers) can’t check to confirm that everything is properly patched, and test to make sure the POS systems are secure. That can’t continue. Knowing as much as possible about current common attacks is critical for any retailer trying to defend against them. (Again, for smaller retailers who don’t have in-house security expertise, we’re talking about resellers and consultants. They’re the ones who are doing the actual defending.) And knowing current attacks is going to be even more crucial when PCI 3.0 kicks in, four months from now. That’s when penetration testing joins more traditional PCI security verification. It’s essential for pen testers to have as many of the bad guys’ weapons as possible in their testing arsenals. After all, that’s what pen testing is for: to mimic what real attackers will do if they get the chance. Right now, cyberthieves are getting too many chances. If a single eastern-European attacker really is responsible for a five-chain, six-month card-siphoning spree, that PCI pen-testing requirement comes none too soon. Even better will be the point when smaller chains doing self-assessments also start hiring pen testers for low-end services. There’s a lot of potential revenue for little work by pen testers with a comprehensive automated script that probes for vulnerabilities—and that’s what cyberthieves are going to be using anyway. But that still depends on investigators being a little less stingy with information on how breaches happen. The active thieves already know, and they’ve probably already shared vulnerability details with other potential thieves. By keeping security people and retailers in the dark, who are investigators protecting—well, besides the resellers who failed to patch their customers’ software and the software vendors who sold buggy POS systems in the first place?

Read more: http://storefrontbacktalk.com/securityfraud/u-s-secret-service-five-retailer-breaches-are-linked/#ixzz2dM4swkNm

Technology

The Biggest Data Thefts In Recent History [Infographic]

It's a big-data look at the loss of lots of big data. That's pretty big.

By Kelsey D. AthertonPosted 07.29.2013 at 10:00 am3 Comments

Major Breaches in 2013:  Information is Beautiful

The internet is a giant vault where people store some of their most private information, trusting that the company holding on to it can keep it all safe. That's not always the case, as this infographic of data breaches in recent history--by Information is Beautiful--reveals. Viruses, hacks, lost computers, accidental publishing, inside jobs and more have all been sources of major leaks over the last 9 years. The infographic identifies breaches by amount of information stolen, type of organization that was breached, year of theft, and the sensitivity of information lost or stolen. An intriguing upshot: By showing major breaches over time, the infographic illustrates how internet use has changed over the past decade. AOL (remember AOL?) has the first major breach in 2004, healthcare providers dominate leaks around 2009, and gaming companies had the major data losses in 2012.

Major data breaches in 2004-2007:  Information is Beautiful

Wikileaks shows up big in 2010:  Information is Beautiful

Militarysingles.com leaked sensitive information: I get that dating is important, but is it more important than national security?  Information is Beautiful

How encryption and tokenization help with cloud services adoption

How encryption and tokenization help with cloud services adoption

Posted on 23 August 2013.

Today’s CIOs and CISOs are facing continued pressure to adopt the cloud enterprise-wide while managing the increasing operational and security risks associated with it.


While the challenge can be daunting, a new Gartner report highlights the role that encryption and tokenization technologies can play in helping enterprises adopt cloud services, even those in highly regulated industries or in regions with strict data sovereignty requirements.

CIOs and CISOs should simplify audits such as the Payment Card Industry Data Security Standard (PCI DSS) when using cloud services by implementing access controls and encryption or tokenization of sensitive data.

Gartner highlights sector-based data compliance requirements, such as PCI DSS, as drivers for organizations to consider adopting encryption and tokenization technologies. Another catalyst is referred to as data residency requirements, where the protection is required to prevent access by government authorities and agencies while data resides in or is passing through other jurisdictions.

Regarding this issue, an alternative is to avoid storing the data in those jurisdictions, such as the U.S. and U.K., which use legal access or interception of data through laws such as the USA Patriot Act and the U.K. Regulation of Investigatory Powers Act.

But the report cautions enterprises to clearly think through the implications of deploying these technologies in their environments. Gartner’s research helps enterprises understand these risks and highlights the following:

• Protect sensitive fields/columns while using cloud SaaS applications
• Do not store keys or use keys in other jurisdictions, or use a third party; otherwise the encrypted data could be accessed if the keys are available
• It is important to review the claims of vendors carefully due to the novel and unique implementations of encryption solutions. … Enterprises should always check the claims of vendors that their solutions are based on proven security models
• When keys or tokens are managed on-premise, always check the impact on the access and availability of the cloud service provider (CSP) and the performance of appliances
• A growing best practice is emerging where enterprises encrypt data stored in the cloud and manage the keys locally.

“This Gartner report is timely because of the increased concern about data ownership and privacy in the cloud fueled by ongoing reports of data surveillance and the implications these revelations will likely have on future regulations and compliance mandates,” said David Canellos, CEO of PerspecSys.

“The security strength of the underlying data protection techniques that an enterprise uses is critical. This is why PerspecSys has refused to use any of the weakened security approaches that the report urges CIOs and CISOs to fully understand. I’m astonished to see some competitors tell enterprises they need to use modes of encryption modules that have not been opened up to public scrutiny and do not have well-vetted security proofs when they want to preserve cloud application functionality. This is a totally unacceptable position that opens these organizations to security risks as well as compliance and audit challenges. We do not force this tradeoff on our customers, which is why we are seeing our approach win in the marketplace,” Canellos added.

Architecten willen groot deel internet versleutelen

zaterdag 24 augustus 2013, 18:18 door Redactie,

Een aantal voorname internetarchitecten heeft een plan bedacht om grootschalige surveillance op het internet door overheden en inlichtingendiensten tegen te gaan. Het gaat om leden van de Internet Engineering Task Force (IETF), een regulerende organisatie voor het internet die allerlei standaarden opstelt en ontwikkelt.
Als het aan de architecten ligt zal een groot deel van al het internetverkeer standaard worden versleuteld, net zoals nu het geval is als internetgebruikers een website via HTTPS bezoeken. Dat moet het lastiger voor overheidsdiensten maken om de inhoud van het internetverkeer af te tappen. Op dit moment versleutelt in verhouding nog altijd een klein deel van de websites op het internet het verkeer tussen bezoekers en de server.

Leven en dood

"Er heeft een grote verandering plaatsgevonden in hoe mensen de wereld zien" sinds klokkenluider Edward Snowden de omvang van het Amerikaanse surveillanceprogramma begin deze zomer openbaarde, aldus Mike Belse, een software engineer en IETF-lid, die meehielp bij het ontwikkelen van Google Chrome.
"Geen encryptie op het web vandaag de dag is een kwestie van leven en dood", zo laat hij tegenover de Financial Times weten. Naast de roep van het IETF om meer encryptie, vragen ook privacygroepen om fundamentele hervormingen van de wetten die op internet worden toegepast.

Aantasting privacy

"Online privacy wordt in een razend tempo door een deken van surveillance aangetast, en tenzij we direct hervormingen doorvoeren, zal de notie van vrije en veilige online communicatie naar de geschiedenisboeken worden verbannen", zo pleitte onlangs nog Tim Berners-Lee, de geestelijk vader van het web, in een brief.

https://www.security.nl/posting/361261/Architecten+willen+groot+deel+internet+versleutelen?channel=rss

The death of the cloud has been greatly exaggerated

    

By Theo Priestley, Software AG

 Aug. 24, 2013 -    

    

Summary: After the revelations of NSA spying on internet data, analysts think the cloud market will take a hit. Here’s how to get the benefits of using the cloud, but protect your data.

 

There has been a lot of speculation about the impact of PRISM on data security and cloud computing; just this week alone two influential articles have been written quoting wildly different predictions on how much the revelations will cost cloud vendors, but there’s no denying that the ripples in the industry are starting to rock the boat.
The Information Technology and Innovation Forum (ITIF) recently announced that due to the fears over data privacy and security that PRISM has highlighted, the cloud computing industry stood to take a hit in the order of $36 billion by 2016. But Forrester Research has come out to say this estimate is too low and the impact could be far deeper to the tune of $180 billion.

Taking into account that by 2016, ITIF calculates the global cloud market to be worth $207 billion (Forrester estimates $270 billion by 2020) this is a staggering number to hit a maturing industry where a lot of enterprises have already invested. But now that investment is starting to crack. Only this week I learned from an analyst source that some 50-plus cloud service contracts have either been put on hold or cancelled altogether because of concerns around cloud security raised by PRISM.
These are localized issues to the U.S. presently, and foreign investment in U.S.-based cloud services are the ones taking the hit due to the American government having access to data that sits on U.S.-based servers. However, given the far-reaching implications of the NSA program and the alleged complicity of other governments in supplying data, it is safe to assume that the fear over cloud security will spread to other countries.
But this isn’t the end of cloud by any means, and we can ignore the people crying “It’s the death of cloud,” the same way we ignored those that exaggerated the death of on-premise software. It is still possible to develop a cloud-based strategy that will ensure scalability without compromising security. Here are five key considerations for any cloud strategy going forward:

1. Bring your own encryption – Secure third parties like Lavabit and Silent Circle have now closed their services because they cannot ensure privacy if the U.S. government asks them for information. In order to secure your data it is essential that you investigate your own options for in-house encryption and not rely on a third-party service outside the firewall to do it for you.
2. Examine the cloud contract – This is often ignored and placed in the hands of the legal and procurement teams who may not fully appreciate the implications of the responsibilities under a cloud contract. For example, just who is responsible for your data should something go wrong ? Use a specialist lawyer who is well versed in cloud-related negotiations to ensure you don’t run afoul of the small print.
3. Know where your servers are – Right now U.S.-based services are a prime concern for the enterprise, but it’s already been shown that other countries’ governments are involved in data sharing and data access. But this doesn’t stop you from knowing which countries have the more stringent data protection policies in place with financial penalties for misconduct. The UK and Germany for example have two of the strongest acts in place for this.
4. Private, public, on-premise, or hybrid? – We’ve seen that moving everything to the public cloud is a no-no and that the death of on-premise deployments has been greatly exaggerated. The clear choice is to use a hybrid model. Hybrid works because of the combined benefits each bring individually:
   • Public for maximum flexibility and efficiency
   • Private for maximum control
   • On-premise for compliance and privacy
   What you choose to automate will be guided by your own data security requirements and ultimately will determine how much of the public cloud you will use, and what you keep private or on-premise.
5. Don’t ignore the importance of cloud integration – Integration platforms provided through companies such as Software AG, Informatica and Mulesoft to connect software-as-a-service applications to the enterprise are the lynchpin in powering a hybrid cloud strategy. Don’t treat integration as an afterthought because the security of the connection to these services is as important as the service itself.
There is no denying that the Snowden leaks have had a massive impact on the IT industry in general, and that cloud services are now under enterprise scrutiny, but with strategic and tactical decisions made with intelligence these ripples can be navigated easily.
Theo Priestley is Vice President and Chief Evangelist at Software AG. You can follow him at @ITredux.

Business booms for cloud encryption provider after PRISM revelations

CipherCloud CEO said the company has opened an Australian office due to accelerated growth in the local market

Rohan Pearce (Techworld Australia) 22 August, 2013

Cloud encryption provider CipherCloud has seen accelerated growth in the wake of revelations by whistleblower Edward Snowden of the massive level of surveillance of Internet traffic by the US National Security Agency, according to the company's CEO, Pravin Kothari.

"We've seen a lot of growth specifically in Q2. When that announcement came out, it was at the beginning of June when Edward Snowden leaked his first piece of information around PRISM and our end of quarter is the end of July," Kothari said. In the wake of Snowden leaking documents that outlined the scope of PRISM, CipherCloud had "the best quarter in our history," Kothari said.

A survey conducted by the Cloud Security Alliance (CSA) found that 10 per cent of 207 officials at non-US companies cancelled contracts with US-based cloud service providers after Snowden's revelations.

CipherCloud provides an on-premise encryption gateway for enterprises. An enterprise retains control of its encryption keys, and data is encrypted before it's sent to a cloud service provider.

The subscription-based service, which can be installed as a virtual appliance or on hardware, includes plug-ins for a number of major SaaS offerings, including Salesforce, Gmail and Office 365, as well as support for private- and public-cloud-based databases and a framework, Connect AnyApp, that can be used with other third-party or custom applications.

CipherCloud senior vice-president Paige Leidig said that the gateway typically has a performance hit of under 2 per cent, and that in some cases, because of a static object cache incorporated into the gateway, users see better performance from some applications.

Growth in the last quarter was 200 per cent, but CipherCloud's growth in Australia was twice that, according to Kothari.

"I think we'll continue to see a lot of growth globally simply because more and more organisations at the enterprise level are continuing to adopt the cloud for all the advantages that the cloud providers.

"I don't think we're going see any particular area that's not growing, but we are seeing countries, specifically because of this [NSA PRISM] news, in Europe and here in Australia and New Zealand, that are growing very rapidly."

Globally the company's service has around 2 million users and encrypts some 250 million customer records. Customers in Australia include two of the big four banks and a health insurance company. Much of CipherCloud's growth has been in heavily regulated industries, such as banks and other financial services companies, health care and government.

Although CipherCloud has customers in the $250 million-$500 million annual turnover range, most of the company's customers have turnover of over $1 billion.

The company earlier this year established an Australian-based sales operation. "One of the reasons we're setting up shop in Australia is we can't meet demand," Kothari said.

"All the customers we have to date that are live with our product we actually sold through a sales rep based in New York City."

The local office currently comprises two sales reps, but Kothari said based on the level of growth CipherCloud was seeing in Australia it would "absolutely" set up a local customer support operation in the future. (Support is currently provided out of the US and a support centre in India.)

Kothari said that the company sees two future axes of growth for its product offerings. One is increasing the number of cloud-based applications CipherCloud supports 'out of the box' through plug-ins. "The other axis is around different security controls," the CEO said.

"So we provide AES 256 encryption capabilities. We also do tokenisation, we also do key management, we also do Cloud DLP or data-loss prevention, malware detection and activity monitoring. And you'll see us continue to grow along that dimension as well."

NCTb: 'DDoS-aanvallen waren wake-upcall in Nederland'

                

24 aug. 2013 door Tonie van Ringelestijn

Nieuws - De recente DDoS-aanvallen op banken en overheden moeten een wake-upcall zijn voor bedrijven en overheden om cybersecurity meer prioriteit te geven, vindt Nationaal Coördinator Terrorismebestrijding en Veiligheid Dick Schoof.
Na de recente DDoS-aanvallen op banken en overheidsinstanties is snel een betere aanpak van cybercrime gewenst, vindt Nationaal Coördinator Terrorismebestrijding en Veiligheid Dick Schoof. "Als Nederland economisch een topspeler wil blijven, dan moet de cybersecurity op korte termijn op orde worden gebracht. Niet in 2020, maar nu meteen. Veiligheid en economie zijn meer dan vroeger onlosmakelijk met elkaar verbonden", zegt hij zaterdag in een interview (paywall) met Het Financieele Dagblad.

Banken zijn nu wakker

De DDoS-aanvallen waren volgens Schoof een 'wake-upcall'. "Ten eerste hadden ze een omvang die een halfjaar daarvoor nog onmogelijk was. En tegelijkertijd is duidelijk geworden dat het nog niet mogelijk is het hele betalingsverkeer plat te leggen. Maar de banken zelf zijn wakker geschud en nemen hun verantwoordelijkheid." Volgens de terreurbestrijder heeft hij na de aanvallen een bijeenkomst gehad met alle topmannen van de grote Nederlandse banken. "Ze hebben ons verzekerd dat het nu een board­roomactiviteit is en nemen de noodzakelijke investeringen voor eigen rekening."

Kosten

Extra beveiliging betekent voor bedrijven meer kosten maken. Schoof: "Tja, het kost geld, maar is het duur? Het is een noodzaak. Laten bedrijven het als een competitief voordeel zien als hun beveiliging op orde is. Nederland is hyperconnectief, we hebben de hoogste graad van mobiel bankieren en mobiel internetten. Willen we die positie beschermen, dan zullen we aan de voorkant met cyber security dienen te acteren."
Schoof roept ook op tot een modernisering van wetgeving. "Die is gebaseerd op de fysieke wereld en gaat uit van een klassieke inbraak. We hebben er honderden jaren over gedaan te bepalen wat er in de opsporing mag als we een crimineel pakken. Bij een digitale inbraak lopen we nu tegen allerlei problemen op."

Introducing Lloyd's Risk Index 2013

Introducing Lloyd's Risk Index 2013

• Overview
• Methodology

High taxation is now seen as the number one threat to global business according to the third Lloyd’s Risk Index.

The survey of more than 500 of the world’s most senior business leaders also suggests executives are focusing on more pressing problems including cyber-attacks and increased material costs, rather than longer-term strategic decisions. 

First published in 2009, this year’s Risk Index provides an in-depth picture of how global business leaders prioritise and prepare for major risks:

• High taxation is identified as the biggest risk faced by business leaders after prolonged public and political exposure and debate. It has soared up the Risk Index ranking from 13th to 1st place in the last two years.
• Cyber security now sits squarely towards the top of the agenda for boards around the world with cyber risk  moving from 12th to 3rd place in the index. Business leaders have woken up to the importance of cyber security following a series of high profile incidents since 2011.
• Loss of customers has slipped to 2nd place, down from the number one risk two years ago as businesses struggle with the continued effects of economic turbulence.

http://www.lloyds.com/news-and-insight/risk-insight/lloyds-risk-index

DDoS Attacks Strike Three Banks

But Experts Say Defenses Are Proving Effective

By Tracy Kitten, August 20, 2013.  

 

Izz ad-Din al-Qassam Cyber Fighters' so-called Phase 4 of distributed-denial-of-service attacks against major U.S. banks hasn't stalled, it's just been ineffective at disrupting online availability, security experts say (see Whatever Happened to DDoS Phase 4?).
         
The latest attacks have been sporadic and seemingly less targeted. U.S. banking institutions, which have been under attack since September 2012, have adapted their defenses, making their online-banking sites hard to take down, experts say.
But Brobot, the botnet used by al-Qassam Cyber Fighters, is still active; it targeted banking institutions as recently as last week, says John LaCour, CEO of cybersecurity and intelligence firm PhishLabs.
"PhishLabs can confirm that we detected QCF [Qassam Cyber Fighters] related DDoS attacks on Wednesday [Aug. 14] and Thursday [Aug. 15]," LaCour says. "Three large banks were attacked that we have seen targeted previously."
LaCour would not name the banks that were hit. He did say, however, attacks last week were linked to Brobot, and that Brobot still appears to be controlled by al-Qassam.
Experts say they don't feel Brobot has been leased out for hire, and that al-Qassam is still the group using the botnet against banks.

Disruptions at 2 Banks

JPMorgan Chase and Citigroup suffered intermittent online disruptions last week, according to Fox Business. Neither one of those banking institutions responded to Information Security Media Group's request for comment. But according to tweets posted last week, Chase and Citi both acknowledged suffering site issues Aug. 15.
"We're experiencing issues with our website and Chase mobile," Chase tweeted. "We apologize for the inconvenience. Please stay tuned for updates."
In its tweet, Citi said: "We are aware of system issues at this time. We are working to get the issue resolved."
Keynote, an online and mobile cloud testing and traffic monitoring provider, confirms both banks' online banking sites did experience intermittent issues Aug. 15. But the cause of those online interruptions is not known, says Keynote's Aaron Rudger.
"The Chase banking website appears to have been unavailable from 8:55 a.m. ET until 10:21 a.m. ET," he says. "Our monitoring agents reported DNS [Domain Naming System] lookup errors throughout that period, across the U.S."
DNS is the system that translates a website's name, such as www.chase.com, into an Internet protocol address that's assigned to a Web server for that site, Rudger explains.
"Our monitoring agents did observe only a very small number of errors trying to download the Citibank homepage, starting at 12:52 p.m. ET," he adds. "But that only lasted until 1:09 p.m. ET."
But other experts who asked to remain anonymous say the outage at Citi was not linked to Brobot; it was an internal technical issue.

What's Next for Brobot?

Because attacks against banks are increasingly ineffective, some question what's next for Brobot.
Rodney Joffe, senior technologist at DDoS-mitigation provider Neustar, believes the attacks against banks are nearing an end. What's next is anyone's guess, he adds. But Joffe and others have suggested Brobot will likely soon be used to target other industries, especially those impacting critical infrastructure.
The attackers will take aim at other targets to avoid admitting their campaign has been a failure, some suggest.
"We'll start to see disruptions that cause a little more fear in the U.S. public," Joffe says. "We have heard about the compromise of water systems in small towns. I wouldn't be surprised if we really start to see attacks like that."

Follow Tracy Kitten on Twitter: @FraudBlogger

The State of Security

The State of Security « IT Security and Data Protection « Risk Management « Key Metrics for Risk-Based Security Management

 

Key Metrics for Risk-Based Security Management

July 24, 2013 9:00 pm Published by Shelley Boose

Share on google_plusone_share

Share on kindleit Share on email 14

Tripwire has released the results of an extensive study focused on the state of risk-based security management with the Ponemon Institute.
The study examined the key risk-based security metrics IT security managers used most frequently to gauge the effectiveness of their organizations’ overall security efforts.
Top Metrics included: time taken to patch, policy violations, uninfected endpoints, data breaches, reduction in the cost of security, end users training, and reduction in unplanned system downtime.
The survey respondents included 749 US and 571 UK professionals in the following areas: IT security, IT operations, IT risk management, business operations, compliance/internal audit and enterprise risk management.
In the compliance arena, leading metrics included mean time-to-patch (49 percent), policy violations (33 percent), and reduction in audit findings and repeat findings (27 percent).
The study also found that only 19 percent of respondents viewed the number of records or files detected as compliance infractions, and only 16 percent identified reduction in expired certificates — including SSL and SSH keys — as an effective metric.
“There’s a strong correlation between security products and metrics,” noted Tim Erlin, director of IT and risk strategy for Tripwire.
“Organizations most often build security metrics programs from the data up, rather than the business down, resulting in metrics supported by available security products, rather than focusing on those metrics that are meaningful to the business.”
Among threat management metrics, the percentage of endpoints free of malware and viruses led with 45 percent of security managers citing it as a key metric for threat management.
Thirty-five percent consider reduction in the number of data breach incidents an effective key metrics, with another 35 percent noting that reduction in the number of known vulnerabilities is an important metric.
However, only 13 percent use the mean time-to-detect security incidents as a metric, with only 8 percent using mean time to resolve security incidents.
“In light of the maturity curve in deployment of risk-based security management, it’s not surprising that the majority of organizations are not using metrics oriented towards higher order outcomes,” said Dr. Larry Ponemon, chairman and founder of the Ponemon Institute.
“Respondents are still focused primarily on operational aspects. And, while many executives are focused on more visible outcomes, like reduction in data breaches, very few organizations are tracking more proactive metrics.”
Key metrics for cost containment included reduction in the cost of security management activities (52 percent) and reduction in unplanned system downtime (40 percent). Only 5 percent of respondents use the length of time to contain security breaches and security exploits.
Staff and employee key metrics included a number of end users receiving appropriate training, which 44 percent of respondents named a key metric in this arena. Thirty-seven percent of respondents named the reduction in the number of access and authentication violations a key metric.
The study also found that only 8 percent of security managers use user performance on security retention awareness tests as a means of measuring security effectiveness.
Spending relative to total budget is used as a key metric for security efficiency by 49 percent of respondents. Thirty-seven percent use reduction in total cost of ownership as a metric, and 36 percent of security managers use return on security technology investments as a means of measuring security efficiency.
Survey respondents averaged 10.7 years of experience and represented a wide variety of organization sizes and industries including financial services, healthcare and pharmaceutical, technology and communications, retail and the public sector.
For more information about this survey please visit: http://www.tripwire.com/ponemon/2013/#riskmetrics.

5 Areas of ROI on Data Center Security

Evelyn de Souza | August 14, 2013                      

As data center operations managers and business owners analyze their budgets to uncover economic headwinds, the importance of deriving ROI from each purchase and initiative is considered.
To better understand the costs and benefits of the Cisco Secure Data Center Solution, we engaged with analyst firm Forrester to interview and study one of our customer’s data center security implementation. Here are five areas of ROI that were uncovered in this study:

• 20% reduction in security threats –
The customer noted the reduction in port scanning attacks, denial of service attacks, SQL inception attacks and others. The security team can now spend much more time keeping business systems at optimal performance levels versus reacting to security issues post incident.
• 25% less time spent mitigating each issue –
With automated firewall rules sets, the security team now spends far less time reacting to individual issues and manually updating policies.
• 50% reduction in help desk calls –
A smooth implementation allowed the customer to install additional security without impacting end users.
• 25% in hardware cost savings –
With the ability to cluster multiple modules on a single hardware blade, the customers expects to avoid having to make additional hardware purchases for up to three years. Additional savings stem from having a highly efficient datacenter footprint that will be realized in terms of energy and backspace savings.
• Upgrading tasks 50% faster –
Built in security means that the network topology does not have to be retrofitted to accommodate security. The customer can now complete installation, expansion and upgrade tasks 50% faster, meaning that IT security teams can concentrate on more strategic functions instead.

Many times as InfoSec professionals, it can be difficult to associate security investments with ROI, but in today’s world the savvy professional will see that by doing so, it will help to gain funding for other parts of the business you have been dying to invest in.

We’ve created an infographic that illustrates these issues that datacenters face today and how a comprehensive security system can help: Additionally, for more news and discussions, head over to @SecDatacenter or Secure Data Center Trends

http://blogs.cisco.com/datacenter/5-areas-of-roi-on-data-center-security/

Top 7 Cloud Security Questions to Ask

By Gretchen Marx  |  June 19, 2013 |

We’ve reached the point that most enterprises have moved past “If we deploy a Cloud,” to “When we deploy a Cloud.” Often the next statement is, “We’re going to start small, try it out and see how it goes, before we expand to broader deployment, more users and applications.” What’s the challenge? Usually it is a concern over security, and that may be coming all the way from the Boardroom.
Cloud is seen as very important for business innovation while at the same time there is increasing executive awareness and scrutiny over how the Cloud will be secured. You can start thinking about Cloud security by asking seven questions:

1. How can we manage the registration and control the access of thousands or even millions of users of our Cloud in a cost-effective way?
2. Can we ensure the safety and privacy of critical enterprise data in Cloud environments without disrupting operations?
3. How can we make sure that Web applications are secure and are not vectors for attacks?
4. How do we manage patch requirements for thousands of virtualized systems?
5. Can we provide protection against network threats and vulnerabilities in the Cloud?
6. How do protect virtual machines?
7. Can we achieve visibility and transparency in Cloud environments to find advanced threats and meet regulatory and compliance requirements?

With all of these questions, it is no wonder that organizations are reluctant to embark on a Cloud journey.
From our work with thousands of customers over the years, we believe that with integrated solutions that cover the security domains of People, Data, Applications, Infrastructure, supported by Threat Information and Security Intelligence, organizations can safely reap the benefits afforded by Cloud innovation.
Check out future blogs as we answer each of these questions in turn. You can also learn more about IBM’s approach to Cloud security in this Solution Brief: Safeguarding the Cloud with IBM Security Solutions.


http://securityintelligence.com/top-7-cloud-security-questions-to-ask/

The Legal Side to Risk Assessment

Courts Want to Know Banks Are Testing Technologies

By Tracy Kitten, July 18, 2013.  

         

Former federal banking examiner Amy McHugh says detailed risk assessments have to be a priority. And recent legal decisions handed down by courts in disputes involving incidents of corporate account takeover prove just how critical those assessments are, she adds.
Ongoing and regular risk assessment allows banking institutions to test their technologies and adjust to the changing threat landscape - two points to which regulators and the courts are holding banks and credit unions more accountable, says McHugh, a bank adviser and former IT examination analyst for the Federal Deposit Insurance Corp. during an interview with BankInfoSecurity [transcript below].
         
"The FFIEC agencies are requiring more of their financial institutions, as far as performing detailed annual risk assessments of their online banking services, making sure that - particularly for their business customers that perform higher-risk, electronic transactions online for ACH and wire transfer origination - they are really risk-assessing those products and ensuring that they have implemented appropriate security measures to address the increasing risks for those services, as well as the risks that are becoming more apparent in the industry," she says.
McHugh says the clear message from the courts is this: Ensure online controls align with the Federal Financial Institutions Examination Council's updated authentication guidance, as well as Article 4-A of the Uniform Commercial Code.
"What I see emerging is the court's increased reliance on guidance, particular the FFIEC's 2005 and 2011 guidance," she says. "I also see the fleshing out of the UCC's 4-A analysis of what constitutes a secure procedure."
Banking institutions must constantly re-evaluate whether they are adequately addressing their risks and meeting the minimal requirements of the FFIEC's guidance, McHugh says. That means they also must focus on customer education - an area where many institutions have, to date, been lacking, she adds.
"The 2011 supplement requires financial institutions to implement some types of customer security awareness education program, meaning that they should be informing their customers, particularly those that perform high-risk transactions, about the fraud environment," McHugh says. "Are they ensuring that they have up-to-date and effective antivirus and patch management procedures for their system, so that if they do get some kind of a virus or a keylogger, for example, they can catch it and neutralize it as soon as possible?"
During this interview, McHugh discusses:

• The role agreements with commercial banking customers are playing in court decisions and settlements over ACH and wire fraud incidents;
• Why the onus for security is increasingly falling on the shoulders of the banks;
• A review of recent ACH and wire fraud cases.

McHugh, an attorney and former regulatory examiner, is now a banking institution adviser for CliftonLarsonAllen, a professional services firm. Her areas of specialization include Gramm-Leach-Bliley Act compliance; information systems review; risk assessments and policy development; information security program development and implementation; vendor management; cloud computing; and corporate account takeover fraud.

Courts' Reliance on FFIEC

AMY MCHUGH: What I see emerging is the court's increasing reliance on regulatory guidance, particularly the FFIEC's 2005 and 2011 guidance on authentication in the Internet banking environment. And, also, the courts' reliance on the FFIEC's IT examination handbooks. These are kind of the de facto industry standards and are assisting the courts in their determination of what constitutes commercially reasonable security procedures. I also see developing kind of the fleshing out of the UCC 4A's analysis of what constitutes a commercially reasonable security procedure, as well as reliance on the good faith prong of UCC 4A. While the security procedures may be commercially reasonable, are the financial institutions acting in good faith in their dealings with their business customers?

Banks' Focus?

KITTEN: What should banks and credit unions be focused on when it comes to some of these decisions and or settlements?
MCHUGH: Well, I think all financial institutions should be reviewing those two FFIEC guidance documents on authentication in the Internet banking environment, particularly the 2011 supplement, because of the increasing level of electronic funds transfer fraud in the industry. The FFIEC agencies are requiring more of their financial institutions, as far as performing detailed annual risk assessments of their online banking services, making sure that - particularly for their business customers that perform higher-risk, electronic transactions online for ACH and wire transfer origination - they are really risk assessing those products and ensuring that they have implemented appropriate security measures to address the increasing risks for those services, as well as the risks that are becoming more apparent in the industry.
And, also, the 2011 supplement requires financial institutions to implement some type of customer security awareness education program, meaning that they should be informing their customers, particularly those that perform high-risk transactions, about the fraud environment. What is existing out there? What additional steps should those particular business customers take in their own environment, meaning, how do they protect their computers? Are they limiting their electronic funds transfer operations to a particular computer? Are they limiting Web surfing on that computer? Are they ensuring that they have up-to-date and effective antivirus and patch management procedures for their system, so that if they do get some kind of a virus or a keylogger, for example, they can catch it and neutralize it as soon as possible?

Choice Escrow's Appeal?

KITTEN: The Choice Escrow ruling is likely to be appealed, you argue. Why?
MCHUGH: I think it will be appealed is based primarily on the court's analysis of PATCO. I think that in the Choice Escrow case it was a case of a small business that would initiate electronic funds transfers, and that because they only had two people who were doing these funds transfers, they did not want to implement a dual-control system. One of the two people may be out of the office and so it just wouldn't be feasible for that organization. And the court kind of relied on that in determining whether the bank had actually implemented commercially reasonable security procedures. UCC 4A talks about if a security procedure is considered commercially reasonable, and if a customer has been offered that feature and then turns down, then another security procedure must be used. So any security procedures that are still left in place, in this case the user ID and password, and I believe a secure device token, which is a cookie on their computers, would then be considered commercially reasonable. This kind of bothered me, in a sense, about whether or not this was an actual issue for Choice Escrow; meaning, we won't have both people in the office at the same time for most of the time to allow us to perform these electronic funds transfers. There are situations where you are going to have small business customers and that truly may not be a feasible option for them. Going back to the PATCO case, BancorpSouth kind of offered this one-size-fits-all solution. So you take dual control; if you can't use dual control, yet nothing else is offered, then how can that be reasonable? I found that kind of questionable in the sense that the UCC 4A and the FFIEC guidance both say that financial institutions, when determining what security procedures to offer their customers, have to consider the circumstances of that particular customer. So, I see that there might be an option here for a potential appeal, in the sense that these security procedures were not sufficiently tailored to this particular customer's circumstances and that something else, maybe, should have been offered.

Leaning on UCC 4A

KITTEN: And then what about some of the Article 4A implications here for commercial customers?
MCHUGH: This has been stated before - the increasing awareness that customers, business customers, definitely have some responsibility for protecting their own systems, which I totally agree with. While the bank is in what is considered the "better position" to be aware of these particular security procedures and risks, business customers still have some responsibilities, as far as being aware of basic security procedures for their location. Again, going back to effective antivirus maintenance, patch management on their systems, limiting, as much as possible, any kind of Internet activity on a particular PC that is used for online banking transactions. And basic things such as appropriate password configuration complexity. I definitely think that business customers differ from consumers, in the sense that they are in a slightly better position to be aware of general risks and things and should be able to implement security into their system. But, what I found, and again this is from smaller institutions, is that the banks themselves are not necessarily as aware as I think they should be about security procedures and risks to their Internet banking systems. That then kind of filters down then to the customers. I think that while banks definitely have a better position and should be able to communicate to their customers what they should be doing, the business customers should also start taking some responsibility for protecting their own systems.

Security at Smaller Institutions

KITTEN: What recommendations do you offer to some of these smaller banks and credit unions, when it comes to practices that they could implement that would not be tasking or a burden on their budget?

The Rules: 10 Things Every Entry-level Security Person Needs to Know & Every Pro Forgets

There are principles which are inherently the same no matter what discipline of security you practice. Although, for some reason, some of us tend to forget them to our detriment. I blame 99.9% of all practitioner -caused security failures on this. What's worse is that rookies aren't the only one's who miss them. A lot of these issues come from pros who should know better. Like everything else, we need a refresher.

1. Our business is about risk. This profession isn't just about assigning widgets to fix people's security issues. We deal with asking and solving really tough questions the end-user is often scared to address or doesn't know exist. If you're just selling a product to meet a quota or performing a security function to satisfy a job description, you're wrong. Start by asking the client about the resources he's protecting and what he's willing to do to protect it. Next, ask him if it's worth protecting. Most people believe EVERYTHING needs security. Precious time and resources are sometimes wasted defending something no one cares about to include the bad guys.
2. Security is a state of mind; not an objective. Do you know how many of us believe the mythology that tells us we can attain security as if it were quantitative? Of course you do. An entire industry is built around this ridiculous premise. Nothing is 100% secure - ever! It can't be. There's always a vulnerability. I'm not saying not to bother with security. I'm just asking you to consider what it is you're trying to do and to consider if you and the client have realistic goals.
3. Know your tools. I'm surprised by the number of practitioners who know so little about the tools that are available to protect their assets. People have this problematic tendency to learn from vendors about the tools offered but fail to educate themselves. Venture to some trade shows. Join ASIS. Ask around the Internet. Become a sponge. Too many of us are bricks. There aren't enough of us taking in knowledge in order to give knowledge back.
4. Know your limitations. Face it, there are some problems you can't fix. Seriously. If you can't do the job, be honest. Say you can't and find someone else who can. You'll keep your integrity and impress the client more by being honest. You'll also develop a good rapport with trusted colleagues you refer. Trust me this is a good thing. After the referral, tag along. Be that sponge I mentioned previously.
5. Define your goals. When I was a supervisor in the Air Force, I can't tell you how many of my troops' professional failings came from forgeting this simple step. Look, no one likes writing goals except for those insanely productive people who live inside Lifehacker.  But what's the harm in sitting down and mapping out your weaknesses, what you can to do to fix them, and assigning a goal to reach them? Absolutely nothing. So get started.
   
   This can and should also be applied to security projects. Define what the project is, what the client's expectations are, determine how you can meet them, and then set goals in order to meet each objective. It's simple but few people do it. Failing to do it guarantees you'll lose an opportunity to work on future projects. 
6. Know your terrain. Do you really understand the security environment? I'm not just talking about the threat. So often, we ignore the internal and external impacts of our measures which undermine our ability to properly protect these assets. For example, in many businesses, there is a key exchange. If you need access to a secure area, you have to leave a badge to receive a key into the area. This seems like a perfectly harmless idea, until users grow tired of giving up their badges and the person conducting the exchange is increasingly wary of having to do it. Security lapses occur as the "inconvenience" outweighs the security concerns. Don't believe me? Three words - Transportation Security Administration. Learn the terrain and figure out what will work the smoothest.
7. Education begins with exposure. My take on security education is simple - you don't know what you need to know because you're not out there asking the right people. I know some people may be scratching their heads at that. But it's the truth. So many of us are ignorant of the threat, the tools, and the terrain because we haven't taken the steps to "get smart" about them.
8. Befriend your enemy. I'm not telling you to "friend request" al-Shabab on Facebook or chat with MS-13 members on Twitter. What I'm suggesting is that you not only read up on their operations but try to get some basic understanding of their collective psychology. Learn how they conduct target selection, who they work with, how they recruit, their tools, etc. This will not only give you an idea as to how to build a better security plan but it will also enable you to ensure it's both comprehensive and adaptive.
9. Everyone has a sales pitch. My first venture into private security was interesting, to say the least. I learned a lot from that gig. One of the lessons that stood out the most was to always be on the lookout for the sale pitch. Learning your client's pitch will enable you to ensure how you protect his resources won't effect his "bottom-line". Would be it a good idea to have dome cameras installed over tables at restaurants? Of course not. What most restaurants sell, in addition to food, is a friendly environment where you can dine among friends. A dome camera over your table robs you of that, thus killing the restaurant's sale pitch. I've never seen that happen but it does illustrate how quickly we can lose the client's respect and business by forgetting they have a business to run as well. 
10. Vigilance is demanded. When I wrote the first draft of this article, I originally wrote "vigilance is expected." That was a HUGE mistake. Why? Because "expected" means you accept a margin of failure. In this business, apathy is where all good security measures go to die. I recognize the fine line between hyper-vigilance and vigilance. Certainly, there needs to be a balance. Just remember, at the end of the day, when there is a breach, you'll be forced to address why you violated this most sacred of security "rules". If you're a supervisor, your vision of how your people practice their profession should have this rule at the forefront. Julius Ceasar had a special patrol he conducted before battle to catch wayward soldiers sleep on their post. The maximum and usual penalty? Death. While the consequences aren't quite as dire as this in the real world at times, complacency will destroy our ability to adequately protect the client and their resources. This is a compromise we can't afford to allow - EVER.

http://blog.thesecuritydialogue.org/2013/08/the-rules-10-things-every-entry-level.html

Overheid zet in op DigiD-smartcards met nfc

Door Olaf van Miltenburg, dinsdag 20 augustus 2013 14:29, reacties: 114, views: 13.914 • Feedback

De overheid gaat voor 2018 alle Nederlanders voorzien van DigiD-smartcards met nfc-chips voor contactloze communicatie. De kaarten voor het eID-platform zullen voor zowel publieke als private diensten gebruikt kunnen worden.

De overheid heeft zijn eisen en wensen voor de DigiD-kaarten kenbaar gemaakt in een marktconsultatie-document. Fysieke kaarten als onderdeel van een eID-platform moeten het bestaande DigiD opvolgen en vanaf 2015 gebruikt kunnen worden voor de afhandeling van digitale zaken met de overheid, zo maakte minister Plasterk van Binnenlandse Zaken in mei bekend.
Het Ministerie van Binnenlandse Zaken heeft een voorkeur voor smartcards, omdat deze niet afhankelijk zijn van een bepaalde dienstverlener of bepaalde apparaten. In de toekomst moeten de kaarten niet alleen gebruikt kunnen worden voor authenticatie met kaartlezers, maar ook in combinatie met smartphones en bankkaarten. De DigiD-kaarten moeten ondersteuning voor contactloze communicatie krijgen en momenteel is de standaard hiervoor nfc, constateert de overheid.
Verder zou een voordeel van de smartcard zijn dat de gebruiker de fysieke controle over de drager van de gegevens heeft en de kaarten zouden zich al bewezen hebben als authenticatiemiddel. Onder andere in België worden ze voor eID gebruikt. Speciale aandacht vestigt het ministerie nog op het gebruik van de kaarten in combinatie met middleware en pc's die besmet zijn met malware. "De integriteit en vertrouwelijkheid van de uitgewisselde data moet immuun zijn voor malware-infectie", schrijft de overheid, "Het moet mogelijk zijn om jezelf veilig te identificeren en diensten af te nemen, zelfs op een pc die geïnfecteerd is met malware." In Duitsland bleek een applicatie voor updaten twee jaar geleden te leiden tot een beveiligingsprobleem bij id-kaarten.
De smartcards moeten voor overheidsdienstverlening authenticatie bieden op het hoogste Europese betrouwbaarheidsniveau: STORK 4. Voor privaat gebruik zou STORK 3 in sommige gevallen voldoende zijn. Om de privacy bij privaat gebruik te garanderen moeten de smartcards pseudo-id's kunnen genereren. Ten slotte moet eID straks gebaseerd zijn op de standaarden en specificaties van de European Citizen Card.
Naast het eisenpakket staat ook de tijdslijn voor de uitrol in het document. De verwachting van de overheid is dat voor de aanvankelijke uitrol tien miljoen kaarten en drie jaar nodig zullen zijn om de Nederlandse bevolking van de kaarten te voorzien. De uitrol gaat in 2015 van start. In de twee jaar erna zouden ongeveer 200.000 nieuwe kaarten nodig zijn voor vervanging en nieuwe aanvragen.
Hoewel de markconsultatie in gang is gezet is het nog niet zeker dat het eID-systeem er in de voorgestelde vorm komt. De Tweede Kamer moet zich nog over de introductie buigen. Dit zal na de zomer van dit jaar gebeuren. In Nederland wordt al jaren gewerkt aan een elektronische identiteitskaart, maar vlotten wil het nog niet echt. In 2005 schreef Alexander Pechtold, destijds minister van het inmiddels opgeheven Ministerie van Bestuurlijke Vernieuwing en Koninkrijksrelaties, dat een elektronische identiteitskaart, eNIK, wellicht al in augustus 2006 kon worden ingevoerd.