Human error leads to Virginia Tech computer server breach

A computer server within the Department of Human Resources at Virginia Polytechnic Institute and State University, popularly known as Virginia Tech, was breached as a result of human error.

 

How many victims? 144,963.
What type of personal information? Names, driver's license numbers, employment history and prior criminal records.
What happened? The computer server, which contained information on 144,963 individuals who applied for positions at the university, was illegally accessed on Aug. 28.
What was the response? The university has contacted the applicants who provided their driver's license numbers.
Details: Of the 144,963 individuals affected, only 16,642 provided their driver's license numbers. According to school officials, the breach was a result of “human error” involving compliance protocols when dealing with the personal data. A forensic investigation into the issue revealed that the information was “partly” accessed through a Virginia Tech server in Italy.
Quote: “The issue here is that someone on our staff goofed,” Larry Hincker, associate vice president for University Relations, said.
Source: collegiatetimes.com, Collegiate Times, “A decade of sensitive VT job applicant information illegally accessed,” Sept. 24, 2013.

0

Small businesses warned about importance of encryption, after London sole trader fined £5,000

Latest news

• Small businesses warned about importance of encryption
• Barclays Bank employee prosecuted for illegally accessing customer’s account
• ICO carries global data protection enforcement resolution
• ICO appoints new non-executive members
• ICO responds to Michael Gove article in today's Daily Telegraph
• ICO calls for law change to help clampdown on nuisance calls

Related items

• Monetary penalty notices

News release: 26 September 2013

A The Information Commissioner’s Office (ICO) has warned small businesses that they must make sure they have adequate measures in place to keep customers’ details secure, after a sole trader was fined £5,000.

Jala Transport Ltd, a Wembley-based loans company, received the penaltyafter the loss of a hard drive containing financial details relating to all of the sole proprietor’s approximately 250 customers.

The hard drive was lost after it was stolen from the business owner’s car while it was stationary at a set of traffic lights in London on 3 August 2012. The external hard drive was in a case with some documents and £3,600 in cash. The hard drive was password protected, but crucially not encrypted, and included details of the customers’ name, date of birth, address, the identity documents used to support the loan application and details of the payments made.

The ICO expects all information to be encrypted where the loss of the data could lead to those affected suffering damage and distress. The initial incident would have resulted in a penalty of £70,000 being imposed, but the limited financial resources of the company resulted in the penalty being lowered to £5,000. The ICO also considered that the data breach was voluntarily reported.

ICO Head of Enforcement, Stephen Eckersley, said:

“We have continued to warn organisations of all sizes that they must encrypt any personal data stored on portable devices, where the loss of the information could cause clear damage and distress to the customers affected.

“While the circumstances of this case are unfortunate, if the hard drive had been encrypted the business owner would not have left all of their customers open to the threat of identity theft and would not be facing a £5,000 penalty following a serious breach of the Data Protection Act.

“The penalty will have a real impact on this business and should act as a warning to all businesses owners that they must take adequate steps to keep customers’ information secure.”

The ICO’s Group Manager for Technology, Simon Rice, has published a blog explaining the importance of encryption and the options available to organisations that need to encrypt their data.

In the blog Simon Rice explains that:

“Encryption software uses a complex series of mathematical algorithms to protect and encrypt information. This hides the underlying data and prevents any inadvertent access to, or unauthorised disclosure of, the information. This means that even if a device containing personal information is lost or stolen, the information will remain secure as long as the would-be data thief isn’t able to access the encryption key required to crack the algorithm.

“Appropriate encryption products are widely available, but it is important that organisations understand the type of protection a particular encryption product offers and the circumstances under which personal data will be protected from unauthorised or unlawful access.”

Notes to Editors

1. The Information Commissioner’s Office upholds information rights in the public interest, promoting openness by public bodies and data privacy for individuals.

2. The ICO has specific responsibilities set out in the Data Protection Act 1998, the Freedom of Information Act 2000, Environmental Information Regulations 2004 and Privacy and Electronic Communications Regulations 2003.

3. The ICO is on Twitter, Facebook and LinkedIn, and produces a monthly e-newsletter.

4. Anyone who processes personal information must comply with eight principles of the Data Protection Act, which make sure that personal information is:

• Fairly and lawfully processed
• Processed for limited purposes
• Adequate, relevant and not excessive
• Accurate and up to date
• Not kept for longer than is necessary
• Processed in line with your rights
• Secure 
• Not transferred to other countries without adequate protection

6. Civil Monetary Penalties (CMPs) are subject to a right of appeal to the (First-tier Tribunal) General Regulatory Chamber against the imposition of the monetary penalty and/or the amount of the penalty specified in the monetary penalty notice.

7. Any monetary penalty is paid into the Treasury’s Consolidated Fund and is not kept by the Information Commissioner’s Office (ICO).

Data broker databases breached, stolen info used by ID theft service

Data broker databases breached, stolen info used by ID theft service

Posted on 25 September 2013.

 

Stolen users information is regularly sold and bought online by cyber crooks and attackers, and many services have sprung up to meet the demand for information that can be used to compromise online accounts and facilitate identity theft.

Among them is SSNDOB (located at ssndob[dot]ms), which has been around for at least two years and has been used by some 1,300 customers to look up personal data and financial data - including Social Service numbers and date of birth - of millions of US citizens.

We know this because of journalist Brian Krebs, who has been following the workings of the service for the last seven months and has reviewed a copy of the SSNDOB database that was compromised several months ago by a number of attackers.

"Frustratingly, the SSNDOB database did not list the sources of that stolen information; it merely indicated that the data was being drawn from a number of different places designated only as 'DB1,' 'DB2,' and so on," he writes.

"But late last month, an analysis of the networks, network activity and credentials used by SSNDOB administrators indicate that these individuals also were responsible for operating a small but very potent botnet — a collection of hacked computers that are controlled remotely by attackers."

Among these computers were five that have been traced to the internal systems at several of the largest US data brokers and aggregators:

• LexisNexis - a company that apparently has the world's largest electronic database for legal and public-records related information,
• Dun & Bradstreet - a company that, according to Wikipedia, licenses information on businesses and corporations for use in credit decisions, business-to-business marketing and supply chain management, and
• Kroll Background America - a company that, among other things, provides employment, health and mortgage screening.

When contacted, all three companies said that they were working with the authorities and forensic firms to investigate how the compromises came about. There's evidence that some of the compromises go back to April 2013.

What Krebs discovered is that the malware used to rope those computer into the botnet and to allow the intruders to continually access the internal systems of the companies was specifically created to fool all the most used AV solutions (and it did for months).

"SSNDOB also appears to have licensed its system for use by at least a dozen high-volume users. There is some evidence which indicates that these users are operating third-party identity theft services," says Krebs.

"A review of the leaked site records show that several bulk buyers were given application programming interfaces (APIs) — customized communications channels that allow disparate systems to exchange data — that could permit third-party or competing online ID theft sites to conduct lookups directly and transparently through the SSNDOB Web site. Indeed, the records from SSNDOB show that the re-sellers of its service reliably brought in more money than manual look-ups conducted by all of the site’s 1,300 individual customers combined."

RSA advises customers to stop using NSA-influenced encryption algorithm

RSA advises customers to stop using NSA-influenced encryption algorithm

7 Biggest IT Compliance Headaches and How CIOs Can Cure Them

IT, security and compliance experts discuss the biggest issues facing companies these days -- and what steps organizations can take to minimize potential regulatory compliance risks and security threats.

               

By Jennifer Lonoff Schiff
Tue, September 17, 2013                      

CIO — As if IT departments didn't have enough to worry about these days. They also have to ensure that the organization is in compliance with various industry and federal regulations (PCI, Sarbanes-Oxley, HIPAA) designed to keep sensitive customer data safe. An increasingly difficult task in today's decentralized, mobile, app-filled world. It's enough to give a CIO or CTO a headache.

"Compliance is a hot issue in IT, and for good reason," says Andrew Hodes, director of Technology at INetU, a cloud and managed hosting provider. "Failure to meet rules and guidelines set by compliance standards could mean fines, penalties and loss of trust."

The Biggest IT Compliance Challenges

But keeping the organization in compliance with industry and federal rules can be difficult, especially with more companies allowing workers to bring their own devices (BYOD). So what are some of the biggest challenges to keeping compliant? Dozens of technology pros and compliance experts share their top seven answers.
1. Employees. "Employees play a key role in protecting a company's sensitive data," says Jim Garrett, chief information security officer at 3M. "Low-tech methods like snooping, social-engineering or phishing are common techniques used by hackers against employees to gain unauthorized access to corporate information," he says.
"To overcome this threat, it's important to educate all employees on different ways information can be acquired through very low-tech methods and give them tools they can use, like protecting corporate data displayed on a laptop with a privacy filter while traveling or how to recognize phishing attacks, to help mitigate any risk," Garrett says.
"Having up-to-date security policies that are understandable to employees outside of IT is crucial," adds Scott Peeler, managing director, Stroz Friedberg, which specializes in investigations, intelligence and risk management. "Information security policies should cover the creation, transmission, transport and retention of information; when and how information can be disposed of or removed from corporate servers/storage; remote, wireless, electronic and physical access to the corporate network; and security precautions to use while traveling."
2. Laptops. To avoid the potential theft of data from mobile workers, "provide travel laptops to employees... and create specific information security policies to protect the network from cyber infiltration," says Peeler. "Travel laptops fully capable of executing vital business functions but stripped of proprietary, sensitive or secure information can mitigate risk of infiltration."
3. Mobile Devices. Mobile devices also pose serious security and compliance risks. "Regulated data isn't subject to a lower standard of protection just because it ends up on a mobile device," notes Ryan Kalember, chief product officer at WatchDox, a provider of secure mobile productivity and collaboration solutions.
Yet according to the recent 2013 Ponemon Institute study on The Risk of Regulated Data on Mobile Devices, "most organizations [have] weak controls in place to protect regulated data on mobile devices... and most employees, at one time or another, have circumvented or disabled required security settings on their mobile devices."
Therefore it is critical that "preventive measures should be taken to restrict unauthorized access to corporate data should a mobile device be lost or stolen," says Ray Paganini, CEO, Cornerstone IT, which provides managed IT services and support.
"These measures should be taken whether the device is enterprise-issued or not," he says. "However, it is best for security purposes to have a company mobile standard." His advice:

• Enable devices and provide IT departments with the tools to perform a remote-wipe of sensitive data.
• Configure mobile devices so that only authorized applications can be downloaded and/or accessed on them.
• Invest in storage and data transmission encryption and other endpoint security tools.
• Prevent data storage and transmission to devices that lack adequate security clearance."

4. Third-Party Apps (aka Shadow IT). "The biggest compliance-related issue facing CIOs today is shadow IT -- a threat caused by the use of unseen third-party solutions including devices and apps," says Orlando Scott-Cowley, Messaging, Security & Compliance Evangelist, Mimecast, a provider of email management, compliance and archiving solutions.
"Corporate IT has grown to be complex and cumbersome, so end users have started using their own third-party services to get their jobs done, such as large file sending services," Scott-Cowley says. But oftentimes these apps or solutions are out of the organization's control, causing the IT department a major headache. "The best medicine to cure the headache? Educate end users; give CIOs the controlled power to constantly assess services for suitability; and deploy modern enterprise cloud solutions to solve overall compliance problems."
5. Cloud Service Providers. To ensure that sensitive data is being properly protected in the cloud, "choose a trusted service provider," says George Japak, managing director, ICSA Labs, an independent division of Verizon, and Verizon's HIPAA security officer.
"Cloud services present significant benefits in [terms] of cost savings, scalability, flexibility, etc." However, to ensure that your or your customer's data is properly protected and in compliance with all relevant regulations, "the vendor/service provider should...meet the underlying regulatory requirements, whether the cloud is engineered to be HIPAA-ready or to comply with PCI or FISMA standards, for instance," Japak says. Also check to see if vendors are SSAE 16 certified.

6. PCI. "Not only is it against card brand regulations if you're not Payment Card Industry (PCI) compliant when accepting credit/debit cards, but it's also an absolute must in today's economic climate of increasingly intelligent payment card theft," says Rob Bertke, senior vice president of product management, Sage Payment Solutions. "PCI certification provides assurance that a processor has passed a robust set of best practices for securing information when credit card payments are made."
"As IT professionals, we are often faced with the challenge of creating a secure cardholder data environment that can be proven compliant against multiple tests and PCI assessments," explains Ray Paganini, CEO, Cornerstone IT. To protect sensitive customer data, "use [a] firewall to segment cardholder information from the rest of your corporate network," he suggests. "Network segmentation limits the parts of your network that have contact with sensitive cardholder data and, when configured correctly, can reduce risk and costs, and narrow the scope of a PCI DSS audit."
[ Slideshow: Top Challenges Facing Healthcare CIOs ]
7. HIPAA and HITECH. "Compliance mandates such as HIPAA [the Health Insurance Portability and Accountability Act and HITECH, the Health Information Technology for Economic and Clinical Health ACT] require all data to be digitized [and meet specific security and privacy standards]," says Brian Christian, the CTO of Zettaset, a Big Data management company. "However, as more patient data is captured and data volumes grow, increased complexity will require more sophisticated data management approaches."
[ Sept. 23 deadline looms for business compliance with HITECH Act on patient privacy ]
"HIPAA has also placed an increased emphasis on the management of vendors, which directly affects healthcare CIOs' compliance obligations," adds Japak. Therefore, it's necessary for IT departments to perform due diligence and make sure they work with HIPAA-compliant cloud service vendors.
Jennifer Lonoff Schiff is a contributor to CIO.com and runs a marketing communications firm focused on helping organizations better interact with their customers, employees, and partners.
Follow everything from CIO.com on Twitter @CIOonline, on Facebook, and on Google +.

http://www.cio.com/article/739897/7_Biggest_IT_Compliance_Headaches_and_How_CIOs_Can_Cure_Them?page=1&taxonomyId=3161
                                                      

JPMorgan heeft al miljard besteedt aan regels

Bewerkt door: Redactie
17-9-13 - 16:28  bron: ANP

Een voorbijganger passeert het hoofdkantoor van JPMorgan Chase in New York. © reuters.

 

JPMorgan Chase heeft dit jaar al een miljard dollar besteed aan interne controles en veranderingen om aan alle mededingings- en bancaire regels te voldoen. Dat zei topman Jamie Dimon van de Amerikaanse bank.

Dimon liet dit in een e-mail weten aan de meer dan 250.000 werknemers van de financiële instelling. Volgens de topman van de bank is JPMorgan er overigens nog lang niet. De komende weken en maanden kunnen de werknemers nog nieuwe regels en aanpassingen verwachten, aldus de directeur.

http://www.ad.nl/ad/nl/1013/Buitenland/article/detail/3511300/2013/09/17/JPMorgan-heeft-al-miljard-besteedt-aan-regels.dhtml 

If anyone needs a tranaslation, please ask at pmunsterman@srcsecuresolutions.

Can encryption still be safe?

Security

by Ben Sullivan| 09 September 2013

In light of the most recent Snowden revelations, experts weigh in on how security companies can capitalise on NSA snooping
Two sides have emerged from the NSA/GCHQ encryption hacking story. One that is convinced we are in an Orwellian-inducing end of times and we should all just stop using the Internet now, and one which says that this has obviously been happening all along, and now's a good time, more than there ever has been, for companies to improve their security and boast what would surely be great-selling software: NSA-proof encryption.
On the latter side, security experts are touting what Snowden has said all along:

"Encryption works. Properly implemented strong crypto systems are one of the few things that you can rely on."

"Actually, I see Snowden's encryption revelations as a positive for the crypto community because it gives experts an opportunity to address some misconceptions surrounding the technology. Chiefly, there's a big difference between asymmetric and symmetric encryption," says Paige Leidig, SVP at CipherCloud.
"Most of the Internet is based on asymmetric RSA encryption which is public key cryptography that requires two separate keys one of which is secret (or private) and one of which is public, but both are mathematically linked. Public key is for encrypting the data and the private key is for decrypting the data. Most of Internet encryption e.g. HTTPS and email, are based on asymmetric encryption.
"On the other hand, symmetric encryption is based on single key which is useful when you want to keep information within a single system and not sharing with external parties e.g. Storage, Backup, and Databases. Advanced Encryption Standard (AES) is the most advanced symmetric encryption."
But what about the NSA's tailored access programs? These attacks have a number of exploits that can be used against your computer - whether you're running Windows, Mac OS, Linux, iOS, or something else - and a variety of tricks to get them on to your device. Your anti-virus software won't detect them, even if you knew where to look, it'd be a tough job to find them.
What Leidig says about symmetric encryption, though, is that any surveillance would have to go through the customer first since they retain the key. Yes, they'll be forced to turn it over, but at least the customer is then aware of any such access. So could we be looking at a boom for companies flaunting symmetric encryption storage?
The sentiment of a business opportunity is also echoed in other comments.
Naeem Zafar, chief executive at mobile security startup, Bitzer Mobile, says a ripple effect may be about to spur innovation.
"This is a wake up call that old security and encryption standards are outdated," says Zafar. "We need a new encryption standard. We can no longer sit on our laurels . Security is a changing game and we must come up with new strategies. The ball is in the entrepreneur's court."
Chris Petersen, chief technology officer at security analytics company LogRhythm, says: "What this will really do is put our adversaries on notice that they need to invest in stronger encryption."
Security technologist Bruce Schneier commented in the Guardian that "the NSA has turned the fabric of the internet into a vast surveillance platform, but they are not magical. They're limited by the same economic realities as the rest of us, and our best defense is to make surveillance of us as expensive as possible."
If symmetric encryption is used, NSA has to turn from mass traffic surveillance to these tailored attacks, which cost money and time.
One problem with using this software though, is that how do you know it hasn't already been compromised by the NSA. It's pretty obvious that most encryption products from large US companies have NSA-friendly back doors, and many international ones probably do as well. How do we separate them from the ones who haven't associated with NSA/GCHQ? Furthermore, traget-rich environments are being created by users who want their data securlely encrypted. I presume these areas would be targeted first and foremost by the government for monitoring suspicious activity.
However, other security experts are claiming that we really have nothing to worry about, and that it's better for governments to be able to spy on data, as there's far worse people out there with actual malicious intent.
"The people who work on PRISM are working to protect us," says Tom Kellermann, Trend Micro's vice president of cybersecurity.
"They don't care what movie you're going to or whether someone is cheating on his wife."
Phil Lieberman, president of security firm Lieberman Software says: "I wish the NSA had a monopoly on these techniques. Consumers should be more worried about the criminals of the world who have similar capabilities. The criminals are certainly not using these capabilities in a narrow way, and they're not going through any approval process."
Pravin Kothari, chief executive at encryption company CipherCloud, agrees:
"The average consumer has more to lose from malicious hackers and spammers out to score a quick buck than from government technologists," says Kothari. "The government is focused on hunting down would-be terrorists and criminals who are intending to disrupt the general welfare."
But are they missing the point? Surely it would be better to have nobody having access to your data, data that was promised to be private by companies that we all had trust in.
Bruce Schneier, writing on the Guardian, gives us five points of advice:
"1) Hide in the network. Implement hidden services. Use Tor to anonymize yourself. Yes, the NSA targets Tor users, but it's work for them. The less obvious you are, the safer you are.
2) Encrypt your communications. Use TLS. Use IPsec. Again, while it's true that the NSA targets encrypted connections - and it may have explicit exploits against these protocols - you're much better protected than if you communicate in the clear.
3) Assume that while your computer can be compromised, it would take work and risk on the part of the NSA - so it probably isn't. If you have something really important, use an air gap. Since I started working with the Snowden documents, I bought a new computer that has never been connected to the internet. If I want to transfer a file, I encrypt the file on the secure computer and walk it over to my internet computer, using a USB stick. To decrypt something, I reverse the process. This might not be bulletproof, but it's pretty good.
4) Be suspicious of commercial encryption software, especially from large vendors. My guess is that most encryption products from large US companies have NSA-friendly back doors, and many foreign ones probably do as well. It's prudent to assume that foreign products also have foreign-installed backdoors. Closed-source software is easier for the NSA to backdoor than open-source software. Systems relying on master secrets are vulnerable to the NSA, through either legal or more clandestine means.
5) Try to use public-domain encryption that has to be compatible with other implementations. For example, it's harder for the NSA to backdoor TLS than BitLocker, because any vendor's TLS has to be compatible with every other vendor's TLS, while BitLocker only has to be compatible with itself, giving the NSA a lot more freedom to make changes. And because BitLocker is proprietary, it's far less likely those changes will be discovered. Prefer symmetric cryptography over public-key cryptography. Prefer conventional discrete-log-based systems over elliptic-curve systems; the latter have constants that the NSA influences when they can."
Schneier concludes by saying:
"Trust the math. Encryption is your friend. Use it well, and do your best to ensure that nothing can compromise it. That's how you can remain secure even in the face of the NSA."

http://www.cbronline.com/news/security/can-encryption-still-be-safe?goback=%2Egde_38412_member_272957563#%21

Cybercrime-as-a-Service, the rise of hacking services

August 19th, 2013

 

        

Security expert Dancho Danchev profiled one of the numerous hacking services offered in the underground highlighting new trends in the cybercrime ecosystem.

With the term attack-as-a-service model is indicated the practice to outsource all the phases of an attack to specialists instead to rent tools and architecture to conduct personally the illegal activities (Malware-as-a-Service). Danchev has recently profiled a newly launched underground service that could allow for cybercriminals to automate the penetration testing process against any target. The providers of the hacking service sustain that using their own exploitation techniques are practically able to compromise any website.
As usual the authors of this service provide an excellent marketing model, they propose a demo for the attack useful to penetrate several vulnerable websites.
The model on sale for service is very attractive, hackers analyze in a first phase the target for a very cheap price (5$) and only in the presence of vulnerabilities they hack it for a price nearly 50$, of course for large architectures to attack the prices soar from $1000 to 50000.
This type of hacking services is an example of unethically pen-testing activity, the criminals seem to not use any automated tool neither Google services to discover vulnerabilities, another singularity is that they do not operate against website and service of their country, a habit already seen in the sale of Kins and Zeus malware.
Following the key features proposed by Danchev in his post:

• the service offers a demo of the hacking process for several (vulnerable) Web sites
• the price for scanning a single Web site is $5, and if a scanned Web site can be hacked using the service, the price becomes $50
• the instructions of the service state that – “We don’t touch our (country’s) Web sites, and our law enforcement doesn’t touch us”
• the service doesn’t utilize Google for finding vulnerable Web sites on a mass scale, instead it allows the cybercriminal to manually enter the Web site about to get unethically pen-tested
• even if the service cannot automatically hack into the Web site (based on what the service claims are private techniques for exploitation) the specially displayed output is supposed to increase the probability for a successful compromise
• the service also offers consultation for hacking into any given Web site, with the prices varying between $1000 to $50,000
• the service successfully detects Microsoft SQL Server, Oracle, MS Access

Following an image of the profiles hacking service:

At the moment the impact of the specific service is limited due its actual inability cause widespread damage but the availability of a huge quantity of tools and hacking services represents an alarming reality that is causing a sensible increase in blended, automated attacks.
Recently FireHost Secure cloud hosting company issued Q2 2013 Superfecta report that revealed the concerning growth for automated attacks against web applications.
The same Danchev already profiled other DIY tools such as Google Dorks Web site exploitation tools, brute forcing applications and stealth Apache module for backdoor distribution, the greater the number of these tools on the market and the greater the number of cyber criminals who provide for the complete outsourcing of attacks.
According last McAfee report “Cybercrime-as-a-Service” security experts observed a sensible increase for attack-as-a-service proposal, the study profiled as example Password cracking services and Denial-of-services.

“If the budget allows, a budding cybercriminal can skip the process of conducting research, building appropriate tools, and developing an infrastructure to launch a cyberattack by choosing a service that will outsource the entire process.” the report states.

No doubts that hacking services will catch in the medium term a good portion of the offer for cybercriminals on the underground.
Pierluigi Paganini
(Security Affairs – cybercrime, hacking services)

I’ll complain about privacy as I tweet where I am, post it on Instagram and share it on Facebook

I’ll complain about privacy as I tweet where I am, Ipost it on Instagram and share it on Facebook

 

Follow me, just not my data

Babbling on social media but boiling about data privacy

Just checked in on social media–updated my friends about my upcoming vacation plans, tweeted about a new job offer, noticed the updated relationship status for a close friend and printed off an email coupon before heading to my favorite store.

This is a totally random ‘day-in-the-life scenario’ of a not-so private, tech savvy consumer updating their social media status.  Given such a scenario,  why are consumers getting so bent out of shape about privacy when retailers start tracking their smartphone MAC address to serve up some sweet deals as they wonder around the store?  Aren’t they interested in the best deal and isn’t that why they became a loyalty customers in the first place–to take advantage of a personalized shopping experience?
Privacy has been a hot topic this summer, and major retailers who are tracking consumer movement throughout the store are feeling the heat. When it comes to being tracked and having your location information and private shopping habits used to proactively push ads to smartphones, consumers are doing an ‘about face’ and taking exception.
A London based company recently discontinued a trial test of a location based technology because of negative reaction from the public.  The company was testing a Wi-Fi enabled recycling bin, with an embedded LCD screen, that displayed personalized ads to passer-bys, using their MAC addresses and some real time analytics. London-ers went crazy and the company stopped the test.

Consumers want to control how personal data is used

It’s just another example of consumers wanting and needing to be in control of how their private and personal data is used.  It’s apparent that social media fanatics are OK if they’re the ones to expose the inner-most details of their life, but they go berserk if their information is used in an unexpected  ‘surprise attack’ manner…like tracking your location as you move throughout the store — isn’t that what the video cameras are doing? In many cases, shoppers have no idea they’re even being tracked — or for that matter that they have the opportunity to opt-out of such a service, if they were asked in the first place.
This privacy issue is likely to stick around for awhile or at least until someone comes up with a 99 cent app that will automatically encrypt or anonymize a MAC address to eliminate the privacy issue or need for an opt out service

Experts: Despite NSA Actions, Stick With Encryption

Keeping Communication Secure in New Era

Experts: Despite NSA Actions, Stick With Encryption

By Fahmida Y. Rashid, September 9, 2013. Follow Fahmida Y. @ITsecuritytech  

                                                                                                                             
Even with the latest disclosures that the National Security Agency is regularly subverting the cryptography used to secure large swaths of Internet communications, there is no reason for enterprises to give up on encryption, experts say. Enterprises can still retain control over their sensitive information by implementing encryption correctly, improving key management and auditing software for vulnerabilities.
The National Security Agency has intercepted encryption keys to stealthily decrypt and eavesdrop on secure communications on the Internet, according to a news report from The New York Times and Pro Publica, which was based on leaked NSA documents (see: Report: NSA Circumvented Encryption). The NSA used several methods to bypass encryption, including exploiting software vulnerabilities, hacking into servers to steal keys and using brute-force attempts to crack weak implementations, according to the report. These attempts enabled the NSA to unlock the data and access it without the involved parties being aware they were being monitored.
         
The prospect of the NSA eavesdropping on Internet traffic by exploiting software vulnerabilities and weak encryption keys is, indeed, alarming. But it is important to remember that the same techniques are regularly used by cybercriminals to breach organizations, says Chris Wysopal, a security researcher who is chief technology officer of Veracode, an application security company.
"The NSA news raises awareness among organizations that if the NSA is getting into the network using these methods, it's likely the criminals are getting in the same way, too," Wysopal says.

Encryption Still Works

Experts point out, however, that while the NSA has devoted plenty of resources to cracking the underlying mathematical algorithm, the bulk of its effort went toward bypassing the cryptography entirely. This means encryption still works.
"There is no reason to stop using encryption. I still lock my car doors even though a professional thief can still bypass the locks," says Tom Walsh, an independent healthcare information security consultant.
Many organizations, however, still rely on weak cryptographic algorithms, such as MS-CHAP, that are known to be vulnerable. Many also use weak passwords when generating their keys, which makes it easy for the NSA or cybercriminals to use dictionary attacks to recover the keys. If the key generator is not configured correctly when deployed within the enterprise, the resulting keys may be improperly formed and susceptible to being cracked, security experts say.

Manage Encryption Keys, Certificates

The NSA has a group dedicated to hacking into servers and seizing encryption keys, according to the news report. The agency likely took advantage of poorly designed key management processes to grab the keys without the organizations being aware of the theft, says Dave Anderson, a senior director with Voltage Security, a provider of data security software.
While properly implemented encryption essentially provides unbreakable security, "if the key management processes are not sound, this security can be reduced to the level where a hacker with a mid-market PC can crack [the keys] in a few hours at most," Anderson says.
Key management systems enable organizations to identify all the keys and certificates used within the enterprise, the users who have access to the keys, and where the keys are all stored. By ensuring the keys are stored securely, organizations can make it more difficult for attackers to waltz off with these important cryptographic pieces of information. Proper key management also alerts the organization if any of the keys are intercepted and used by unknown parties.
The National Institute of Standards and Technology recently issued guidance on cryptographic key management (see Tips for Cryptographic Key Management). The goal of the framework is to guide designers in creating a complete, uniform specification to build, procure and evaluate cryptographic key management systems, NIST says.
Market research firm Forrester recently said every enterprise is a "sitting duck" because attacks against encryption keys and certificates are so powerful, and organizations are generally unprepared to identify and respond to these attacks.

Organizations must be aware of how they use keys and certificates and have the ability to identify risks, and respond and remediate, says Kevin Bocek, vice-president of marketing at Venafi, a key management company. "Otherwise, Forrester's 'sitting duck' warning will be more than a warning," he stresses.

Audit Software for Vulnerabilities

The NSA also took advantage of software defects to gain access to the endpoint and user data, according to the news report. In some cases, the defects were vulnerabilities the NSA discovered and didn't disclose to the vendor. In other cases, the vendor intentionally introduced the defect at the request of NSA or was instructed by the agency to not fix a flaw, the news report said.
So organizations need to ask the companies whose software they use about the secure coding and testing processes they have in place, says Wysopal of Veracode. Instead of relying on the vendor's promises that the software is secure, organizations should take the extra step of demanding that all software undergo third-party scanning to identify potential defects, Wysopal says.
If a software company refuses to undergo scanning, the organization using the software should consider switching vendors, Wysopal recommends. "Stop trusting that the provider has done it [security] right," he says.
When it comes to encryption, using public domain encryption, such as PGP and TLS, may be the better option than closed-source, proprietary solutions because it is easier to verify the that public domain encryption hasn't been modified or broken, Bruce Schneier, a leading cryptography expert and author, wrote in the Guardian newspaper when discussing the NSA revelations.
Schneier predicts most encryption products from large U.S. companies have NSA-friendly back doors. So he recommends implementations based off open standards, such as SilentCircle, GPG, Tails, OTR, TrueCrypt and BleachBit.
(See related story on the latest developments in quantum key distribution, which might eventually provide a more cost-effective and efficient way to securely share encryption keys.)

Dear SSL CA providers, please follow @globalsign's example to reestablish basic trust in SSL/TLS.

Trust the math.
Choose your friends wisely.

in Secure SSL by Ryan Hurst

https://www.globalsign.com/blog/trust-the-math-choose-your-friends-wisely.html              

Sep102013

Just like you, over the past months, we have been watching the coverage on the Edward Snowden leaks. Each leak has provided unprecedented insights into both the capabilities and practices used by the intelligence community today.
While I personally find some of the details in these leaks both surprising and disappointing, the fact that the intelligence community has continued to develop its abilities around cryptanalysis and cyber defense is not surprising at all.
This is a problem that is literally thousands of years old: as long as cryptography has been applied, there have been people developing techniques to break that cryptography or work around it.
I won’t go into the details of these leaks in this post as I believe they have been well covered by others like The Guardian, ProPublica, The New York Times, Mathew Green (a research professor in Cryptography at John Hopkins), and Bruce Schneier.
But I do want to talk about our commitment to you and the rest of the Internet, provide some insights to our perspective on this problem, and provide you guidance on what we feel you should be doing to protect your privacy and the privacy of your customers when on the Internet.
First, I want to assure you that we have never received a request from any government to forward any key material or to certify any keys with any identity, domain name or organization information that was not legitimate, and if we did we would fight that request to our fullest ability.
Furthermore, we are the only certificate authority that I am aware of who has committed to provide notice to customers when we receive any requests for their data and it is (and always has been) expressly against our policy to use the fact we are a publicly trusted CA to facilitate a MiTM (man-in-the-middle).
Simply put, we believe we have a responsibility to represent your interests to the best of our ability, and we believe that responsibility requires us to act honorably and transparently – even when that is not the easy path.
In the name of transparency we also will be adopting a proposal from Google called Certificate Transparency in our platform update next year. This will make it possible for the public at large to monitor all the certificates that we issue.
One part of how we believe this responsibility manifests itself is how we design, build and operate our services. When building our services we proactively consider state-sponsored attacks as part of our threat models. This means that sometimes we have to do things that are less efficient and more time consuming, but it also helps us protect against compromises from a well-funded and highly skilled adversary. This extends itself beyond our own engineering and operations practices to the service, hardware and software providers we choose to work with.
As history has proven, we cannot be perfectly immune from attack or suggest that there are not vulnerabilities in cryptographic algorithms, hardware or software we leverage in our operations.
However, it does mean that we do our best to design our systems so that no single failure can bring down our services or compromise them. In fact we are in the process of making what is likely one of the largest investments made by our industry in the last decade to better scale and secure our services.
This takes us to the math, like Bruce Schneier said after reviewing the leaked papers. I trust the math. Our understanding of cryptography is constantly evolving, as is the definition of what is “secure enough”. With that said, the cryptographic algorithms used in digital certificates have undergone and continue to undergo extensive cryptanalysis review the world over. However, due to improvements in cryptanalysis as well as faster hardware, they are considered weaker today than they were just a few years ago. With that said the consensus is that they are still fundamentally sound.
We are actively working with industry partners to accelerate the adoption of more modern cryptographic algorithms that have the potential to be strong enough for the future and will continue to push for the migration to these algorithms as quickly as possible.
It is important to understand the problem does not stop with the cryptography that is used within certificates; the cipher suites that are used with those certificates represent a large attack vector as well. Today, according to the Trustworthy Internet Movement’s data, nearly 33% of the top 200,000 sites are using weak cipher suites and very few have deployed suites that offer Perfect Forward Secrecy (PFS), a mechanism that protects sessions from later key compromise.
To help address these issues we have worked with Qualys to provide the internet a free tool to help server administrators address these issues in their configuration and are working with the open source community to provide examples of proper server configurations.
For me, though, one of the larger issues where we see too little progress is that of key management. We now know definitively from these leaks that adversaries maintain databases of compromised keys. This too isn’t exactly a surprise as security researchers maintain similar public repositories.
The deficiencies in key management practices that exist today are valuable to attackers for a few reasons; one of the largest is that sites maintain the same keys for far too long making them a valuable asset. For this reason we explicitly allow unlimited re-issuances and do not allow the same key to be used request to request. We also provide APIs and plug-ins to help customers automate these changes.
There is still a lot of work for us to do as an industry, and you have my word this is an area that you will see us invest more.
As for my recommendations to you as you look at your own infrastructure relative to the news:

1.	When you are buying a certificate you are picking a partner, understand their motivations and what their commitments are to you.
2.	Maintain a policy for what cryptographic algorithms can be used in your environment, how often keys must be changed, how strong they are, and how they should be generated and secured.
3.	Maintain an inventory of your cryptographic keys, their age, strength and ensure each one of them is managed in accordance to your policies.
4.	Be mindful of the fact that deploying SSL/TLS securely requires more than just a certificate with a sufficiently large key. Be sure to:

• Run the most recent stable version of web server and SSL/TLS libraries available.
• Deploy ciphers that offer Perfect Forward Secrecy when possible.
• Ensure that all SSL configurations in your environment follow current industry best practices.

5.	Review the security of any and all machines that have access to key material used, ensure they are fully patched, hardened and only those necessary personnel have access to them.

NIST releases FIPS 201-2

05 September, 2013 By: Zack Martin

See more at: http://secureidnews.com/news-item/nist-releases-fips-201-2/?g=email#sthash.r7qpVeZF.dpuf

The latest smart card specification for U.S. government employees was released by the National Institute of Standards and Technology. Federal agencies will have 12-months to issue cards that comply with the revised standard. As expected, FIPS 201-2 will enable derived PIV credentials on mobile devices as well as a virtual contact interface that expands the functionality of the contactless portion of the card, says Hildegard Ferraiolo, a computer scientist in the Computer Security Division, Cryptographic Technology Group at NIST. The derived credential specification will be detailed in a special publication due out soon, Ferraiolo says. At a high level the derived credential will enable an agency to place a type of PIV credential on a mobile device so the user can access enterprise application, virtual private networks or other uses. The virtual contact interface will play a role with mobile devices as well. This interface will enable some of the contact functionality of the credential on the contactless interface. A special publication detailing this portion is being circulated as a draft. One possible use for this could be the tapping of a PIV onto a NFC mobile device to gain access to secure networks and services, Ferraiolo says. “It’s taking advantage of the NFC channel,” she explains. “The virtual contact interface will protect that channel if it’s used with the mobile device.” Biometric updates FIPS 201-2 mandates that the cardholder’s facial image be placed on the smart card, Ferraiolo says. The facial image could then be used at guard checkpoints and for automatic comparison when reissuing credentials. Facial images were an option in the previous specification. The spec also offers iris biometric and match-on-card fingerprints as additional authentication options. Post-issuance updates The new spec also enables post-issuance credential updates, Ferraiolo says. Agencies had run into problem because digital certificates on the device would expire before the card and post-issuance updates were not enabled. Certificate changes FIPS 201-2 also lessens reliance on the Cardholder Unique Identifier and puts the focus on the Universal Unique Identifier, which will bring the PIV and PIV-I closer together. - See more at: http://secureidnews.com/news-item/nist-releases-fips-201-2/?tag=email#sthash.r7qpVeZF.dpuf

With crypto being insecure, whom do you trust?

Posted on 09 September 2013.

 

 

 

Last week's revelation that the NSA has for years now concentrated on subverting the encryption that protects commerce and banking transactions, sensitive data, e-mails, phone calls, web searchers and so on would have not come as such a shock were it not for the array of questionable methods they used.

Between the hacking and the forcing Internet and telecom firms to collaborate and to allow the NSA to create back doors into the companies' products and services, the biggest blow by far was that the agency has influenced the US NIST and the International Organization for Standardization to adopt an intentionally weakened encryption standard.

But there is one person that has not been surprised by the disclosure. John Gilmore, one of the founders of the Electronic Frontier Foundation and a major contributor to a number of free software projects and to GNU/Linux has shared his insider knowledge about the influence NSA employees exerted over the IPSEC IETF standards committee.

"Every once in a while, someone not an NSA employee, but who had longstanding ties to NSA, would make a suggestion that reduced privacy or security, but which seemed to make sense when viewed by people who didn't know much about crypto," he wrote in a message to the Cryptography mailing list.

He noted that "the resulting [IPSEC] standard was incredibly complicated -- so complex that every real cryptographer who tried to analyze it threw up their hands and said, 'We can't even begin to evaluate its security unless you simplify it radically'," but that the simplification never happened.

Finally, he said that there were situations where NSA employees lied to standards committees and that, among other things, it resulted in poor and easily breakable cellphone encryption standards.

In the meantime, Der Spiegel reporters have come out with a new claim backed by leaked NSA documents: the agency is able to access user data (contact lists, SMS traffic, notes, GPS data) from iPhones, BlackBerry devices and smartphones running Google's Android OS.

"The material contains no indications of large-scale spying on smartphone users, and yet the documents leave no doubt that if the intelligence service defines a smartphone as a target, it will find a way to gain access to its information," they write.

And, as another blow to the credibility of the Foreign Intelligence Surveillance Court, recently declassified materials have revealed that it allowed the NSA to retain intercepted US communications for six years instead of five (and more if "special circumstances" warranted it), and that the agency was allowed "to query the vast majority of its email and phone call databases using the email addresses and phone numbers of Americans and legal residents without a warrant."

Lastly, it has been revealed that the NSA has intercepted phone calls and emails of the current Brazilian president Dilma Rousseff, and the state-controlled Petroleo Brasileiro as well as Google Brazil.

What's even more interesting is that in the documents, the reasons for the spying were listed as political, diplomatic AND economic, and that clashes with the oft repeated statement by the NSA and US Department of Defense that they don't engage in economic espionage.

Ultimately all of these revelations have, as Bruce Schneier has correctly pointed out, resulted "in us not trusting anything the NSA says, anything the president says about the NSA, or anything companies say about their involvement with the NSA," and have created a fertile ground for conspiracy theories.

Users don't know who to trust anymore, and even advice, insights and explanations from well-regarded security and cryptography experts are contradictory in some points - most likely because not all have had the chance to peruse all the leaked documents and are forced to conjecture based on the limited information they do have access to.

Documents Reveal NSA Can Crack Online Encryption, 'Last Bastion of Privacy'

http://www.pbs.org/newshour/bb/government_programs/july-dec13/surveillance_09-06.html?utm_medium=referral&utm_source=t.co

Agency capable of cracking most online encryption

Agency capable of cracking most online encryption

Who owns the Internet? That is one question humanity hasn’t been able to answer with any degree of certainty hitherto and things are unlikely to change anytime soon. Now, it may be difficult for us to say who truly controls the Internet, but we can definitely tell you who’s currently behaving like they are the ones who own it.
Thanks to Edward Snowden, skeletons are tumbling out of the National Security Agency’s closet almost on a daily basis. And if you think you have already seen the most shocking bits of the this whole surveillance scandal pass you by, brace yourselves for you’re about to get shocked on a massive scale once again.
According to recent reports published by The Guardian and the New York Times, the National Security Agency and its British chum the Government Communications Headquarters (GCHQ) have  “cracked much of the online encryption relied upon by hundreds of millions of people to protect the privacy of their personal data, online transactions and emails.”
The documents accessed by the two media outlets reveal that, at the turn of the century, the NSA began pouring in billions of dollars into a furtive program codenamed “Bullrun”. Aimed at defeating online encryption, it stumbled on a major breakthrough 10 years later, in 2010, when the agency acquired the ability to decrypt “vast amounts of Internet data” that had been considered unexploitable up until that point. The fact that the agency has made great strides in its war against encryption is clear from an internal GCHQ memo which describes those briefed about the the NSA’s eavesdropping repertoire for the very time as feeling “gobsmacked.”
The most worrying bit, though, is that the agency owes a lot of its eavesdropping capabilities to its success in secretively influencing tech companies to alter their product designs, "insert vulnerabilities into commercial encryption systems” and weaken security standards. All these activities are part of the SIGINT (signals intelligence) Enabling Project, a program the NSA has spent around $800 million on since 2011.
Although none of the companies that the NSA has been able to successfully influence are named in the documents, it is now known that its British counterpart, GCHQ, is keenly working on “understanding" Hotmail, Google, Yahoo and Facebook. In fact, in a quarterly update from last year, GCHQ seemed particularly excited about some new “access opportunities” where Google was concerned.
All the above-named companies, save for Facebook, have now issued statements on these new revelations. Microsoft says it is seriously concerned and will press the government for answers. Meanwhile, Google says it hasn’t seen any evidence of its security systems being circumvented in any way and insists that “the security of our users' data is a top priority.”
Image Credit: Decrypted Matrix

http://www.maximumpc.com/exposed_nsas_war_encryption250?utm_medium=referral&utm_source=t.co

How to Fight Back in the NSA's War on Encryption

 

In one of the most significant leaks to date regarding National Security Agency (NSA) spying, the New York Times, the Guardian, and ProPublica reported Thursday that the NSA has gone to extraordinary lengths to secretly undermine our secure communications infrastructure, collaborating with GCHQ (Britain's NSA equivalent) and a select few intelligence organizations worldwide.

These frightening revelations imply that the NSA has not only pursued an aggressive program of obtaining private encryption keys for commercial products—allowing the organization to decrypt vast amounts of Internet traffic that use these products—but that the agency has also attempted to put backdoors into cryptographic standards designed to secure users' communications. Additionally, the leaked documents make clear that companies have been complicit in allowing this unprecedented spying to take place, though the identities of cooperating companies remain unknown.

Many important details about this program, codenamed Bullrun, are still unclear. For example, what communications are targeted? What service providers or software developers are cooperating with the NSA? What percentage of private encryption keys of targeted commercial products are successfully obtained? Does this store of private encryption keys (presumably procured through theft or company cooperation) contain those of popular web-based communication providers like Facebook and Google?

What is clear is that these NSA programs are an egregious violation of our privacy. We can and should enjoy a future where it is still possible to speak privately with fellow citizens, to freely associate and engage in political activism, and to be left alone when we want to be. If the NSA is allowed to continue building backdoors into our communications infrastructure, as law enforcement agencies have lobbied for, then the communications of billions of people risk being perpetually insecure against a variety of adversaries, ranging from foreign governments to criminals to domestic spy agencies, which would have disastrous economic consequences.

Faced with so much bad news, it's easy to give in to privacy nihilism and despair. After all, if the NSA has found ways to decrypt a significant portion of encrypted online communications, why should we bother using encryption at all? But this massive disruption of communications infrastructure need not be tolerated. Here are some of the steps you can take to fight back:

• Sign the petition to stop NSA spying. Let Congress know that It's time for a full accounting of America's secret spying programs—and an end to unconstitutional surveillance. If you are not in the US, please take the time to sign our international petition.
• In addition to signing our petition, take the time to call your elected representative using the dedicated call line: 1-STOP-323-NSA ( 1-786-732-3672 begin_of_the_skype_highlighting 1-786-732-3672 FREE  end_of_the_skype_highlighting ) to voice your opposition.
• Use secure communications tools (read some useful tips by security expert Bruce Schneier). Your communications are still significantly more protected if you are using encrypted communications tools such as messaging over OTR or browsing the web using HTTPS Everywhere than if you are sending your communications in the clear.
• Finally, the engineers responsible for building our infrastructure can fight back by building and deploying better and more usable cryptosystems.

The NSA is attacking our secure communications on many fronts and we must oppose them using every method we have at our disposal. Engineers, policy makers, and netizens all have key roles to play in standing up to the unchecked surveillance state. The more we learn about the extent of the NSA's abuses, the more important it is for us to take steps to take back our privacy. Don't let the NSA's attack on secure communications be the end game. Let it be a call to arms.

Republished from the Electronic Frontier Foundation under Creative Commons

 

http://gizmodo.com/how-to-fight-back-in-the-nsas-war-on-encryption-1270158751?utm_medium=referral&utm_source=t.co

Wat kunnen we leren van excellente organisaties op het gebied van compliance? – 6 tips

Wat kunnen we leren van excellente organisaties op het gebied van compliance? – 6 tips

1. Identificatie van relevante wet- en regelgeving
Voordat een onderneming compliant kan zijn, dient men te weten aan welke wet- en regelgeving men moet voldoen. Dat is nog niet zo eenvoudig. De toepasselijke ordeningswetgeving verandert snel en de hoeveelheid nieuwe regels neemt nog altijd toe. Het is daarom van belang dat ondernemingen zich laten informeren over de geldende wet- en regelgeving.

2. Kennis omtrent geldende wet- en regelgeving binnen de onderneming waarborgen Ondernemingen doen er goed aan ervoor te zorgen dat ook de individuele werknemers, leveranciers en anderen die diensten aan de onderneming verrichten, zich bewust zijn van de wet- en regelgeving die op hun specifieke terrein van toepassing is en waarop gehandhaafd kan worden. Het zijn immers vaak de werknemers die op dagelijkse basis met de betreffende wet- en regelgeving in aanraking komen. Kennis over wet- en regelgeving moet op passende wijze beschikbaar worden gemaakt in de gehele organisatie. Dat kan op verschillende manieren, waarbij de wijze van beschikbaarstelling moet aansluiten bij de werknemers die met het voorschrift moeten werken. Bijvoorbeeld door het organiseren van een training, het verplicht stellen van een online cursus, het opstellen van een gedragscode die werknemers dienen te ondertekenen wanneer of zij in dienst treden, of iets simpels als het ophangen van een bordje. Aandacht voor de wijze van informeren van werknemers is het halve werk.

3. Identificatie van risico’s en aandachtsgebieden binnen de onderneming
Nadat betrokkenen met de geldende wet- en regelgeving bekend zijn geraakt, is het raadzaam om aandachtsgebieden binnen de onderneming aan te wijzen en eventuele risico’s te identificeren. Zo kan het voor ondernemingen die veelvuldig zaken doen met het buitenland, van belang zijn om een analyse te maken van het corruptieniveau in de betreffende landen, van de sectoren en projecten waarin de betrokken ondernemingen opereren en van hun buitenlandse zakenpartners en de daarmee gesloten overeenkomsten. Een ander voorbeeld is de situatie waarin binnen een onderneming medische gegevens worden verwerkt. Op grond van de privacywetgeving worden hieraan strenge eisen gesteld. Het is dan zaak om de bedrijfsprocessen zo in te richten dat zulke beperkingen te allen tijde strikt in acht worden genomen.

4 Toezicht binnen de onderneming Vaak zijn overtredingen het gevolg van gebrek aan toezicht binnen een onderneming, waardoor werknemers hun werk naar eigen inzicht verrichten en in onvoldoende mate door hun collega’s of leidinggevenden worden gecontroleerd. Het is van belang dat er binnen de onderneming duidelijke rapportagelijnen bestaan en dat voorts duidelijk is welke informatie aan welke leidinggevenden wordt gecommuniceerd.

Andersom dienen leidinggevenden zich actief te laten informeren over de gang van zaken op de terreinen waarvoor zij verantwoordelijkheid dragen. De eerdergenoemde identificatie van aandachtsgebieden en risico’s kan bijdragen aan de kwaliteit van het toezicht van de leidinggevende. Alleen wanneer leidinggevenden van relevante zaken op de hoogte zijn, zijn zij in staat bij eventuele onregelmatigheden in te grijpen en processen waar nodig bij te sturen.

5. Adequaat handelen bij signalen van overtredingen
Wanneer er zich signalen voordoen dat er binnen de onderneming overtredingen plaatsvinden, dient te worden besloten hoe de onderneming met deze signalen omgaat. Wordt een signaal als een eenmalig incident bestempeld of dient er nader onderzoek te komen? Beperkt de onderneming zich in het geval van een onderzoek tot een gesprek met de betrokkene(n) of wordt er een diepgaander intern onderzoek ingesteld?

In het laatste geval moet worden beslist of de onderneming dit onderzoek zelf verricht of dit bijvoorbeeld laat uitvoeren door een gespecialiseerd advocatenkantoor, dat over de uitkomsten van het onderzoek geheimhoudingsplicht heeft en zich kan verschonen van het beantwoorden van vragen door toezichthouders en opsporingsinstanties aangaande het onderzoek.

Bij het maken van deze keuzen dient de onderneming zich ervan bewust te zijn dat een onderzoek zowel positieve als negatieve consequenties kan hebben. Zo kan een intern onderzoek enerzijds belastende informatie opleveren, maar anderzijds tot verzachtende omstandigheden leiden, omdat toezichthouders en opsporingsinstanties onder omstandigheden waarde hechten aan de mate waarin de onderneming op onregelmatigheden heeft gereageerd.

6. Voorbereid zijn op onderzoek door toezichthouders en opsporingsinstanties
Indien er signalen zijn waaruit volgt dat er zich binnen de onderneming overtredingen hebben voorgedaan, dient de onderneming te bepalen of, en zo ja, in hoeverre deze signalen met de toezichthouder of de opsporingsinstantie worden gedeeld en/of in hoeverre aan het onderzoek van dergelijke instanties wordt meegewerkt. Deze keuze zal sterk afhangen van de omstandigheden, zoals de ernst van de overtreding, de hoeveelheid bewijs, de op te leggen sancties en de consequenties die een dergelijke sanctie voor de onderneming heeft.

Het strekt tot aanbeveling om advies in te winnen bij specialisten op het betreffende rechtsgebied om zo op goede gronden te beslissen welke proceshouding wordt ingenomen. Deze proceshouding wordt bij voorkeur ruim op tijd bepaald, zodat de onderneming voorbereid is indien er zich een (onverwacht) onderzoek van de toezichthouders en opsporingsinstanties voordoet.


Maatwerk
Excellente ondernemingen zorgen dat ze compliant en in control zijn. Daarnaast hebben ze in beeld hoe ze met gevallen van non-compliance omgaan. Maar alle regels en voorschriften ten spijt zal het bestuur van een onderneming op zichzelf niet in staat zijn de risico’s van non-compliance geheel uit te bannen. De gehele organisatie moet zichzelf op de rails kunnen houden. Dit wordt niet bereikt door alle mogelijke risico’s op non-compliance door middel van een waslijst van regels te mitigeren, maar door medewerkers te informeren over de specifieke regelgeving die voor hen concreet van toepassing is. Zo bezien is compliance maatwerk.

Daarnaast is het van belang om medewerkers inzicht te verschaffen in de principes die achter de geldende regelgeving schuilgaan. Op die manier wordt een cultuur gecreëerd waarin mensen niet blind regels volgen, maar leren handelen conform de voor de onderneming relevante principes. Excellente ondernemingen stimuleren hun werknemers tot nadenken en proactief handelen. Zo weet de hele onderneming hoe gevallen van non-compliance zo veel mogelijk worden voorkomen en wat er moet gebeuren als er onverhoopt bezoek voor de deur staat.

Muriël Rosing is advocaat bij Stibbe

http://financieel-management.nl/content/view/19104/6-tips-om-te-excelleren-in-compliance/5/7/page_number:1/