Security zou volledig over data moeten gaan

28 jul. 2014 door Taylor Armerding

28 jul. 2014 door Taylor Armerding 

                        

Achtergrond - Deelnemers aan een paneldiscussie die donderdag in Boston onder Dell securityexperts, partners, analisten en klanten werd gehouden, stelden dat ingebedde security in data niet alleen wenselijk is, maar op termijn zelfs noodzakelijk.

Tijdens het evenement, de Dell 1-5-10 Series, werd ingegaan op de vraag wat over 1, 5 en 10 jaar de risico's zijn op gebied van security en wat bedrijven daartegen kunnen doen.

Hoewel altijd lastig is iets binnen IT te voorspellen, waren de panelleden het met CTO Don Ferguson van de Dell Software Group eens dat het securitymodel voor applicaties, dat al decennia lang ongewijzigd is, in de toekomst niet langer houdbaar zal zijn.
Het huidige model, waarin het programma verantwoordelijk is voor de identificatie van de persoon en de omgang ermee, hoort in de prullenbak thuis, zegt Ferguson. "Data is overal. Op een apparaat, in de cloud, op netwerken. Je kunt niet alle plekken overal beveiligen, dus data moet zichzelf beveiligen. De huidige generatie applicaties is niet geprogrammeerd om daarmee om te kunnen gaan."

Data overal kunnen volgen

Dit model veranderen kan volgens directeur Patrick Sweeney van Dell SonicWALL het BYOD-probleem oplossen. In plaats van je te richten op een apparaat of gebruiker, zou het alleen moeten gaan om de data - niet om het device of het netwerk. "Je moet data kunnen beschermen, er eigenaar van kunnen zijn en het kunnen intrekken."
Om dit binnen een termijn van vijf jaar te bewerkstelligen, zijn er drie dingen nodig, zegt Sweeney. "Allereerst moet data via enterprise key management versleutelt gaan worden. Dat hoort eigenlijk in iedere BYOD-strategie thuis."
"Daarna moet de data staan in een virtuele container waarover ik controle heb, net als een ambassade die rekening houdt met mijn regels en mijn wetten. Iemand anders kan het niet een andere betekenis geven, het uitsturen via e-mail, of wat dan ook."
"Tot slot moet ik eigenaar zijn over de policies die controleren wie toegang heeft. Als ik de sleutel wil intrekken, moet ik op een rode knop kunnen drukken en de bytes op afstand onleesbaar kunnen maken", zegt hij. Sweeney haalt daarbij aan dat als de NSA zulke controle over zijn data had gehad, dan had dit Edward Snowden kunnen verhinderen data te verzamelen en te verspreiden aan journalisten.


Sweeney ziet het liefst dat het toegang hebben tot data hetzelfde gaat zijn als "het kijken van tv".
Fellow en directeur van de Dell Software Group Tim Brown zegt dat dit van de data vraagt dat het "zelf begrijpt wat de policy zou moeten zijn, hoe gevoelig het is en wat de regels moeten zijn voor toegang". Hij zegt: "Pas als we op dat punt geraken, dan pas kunnen we informatie meer vrijelijk laten rondstromen."


Zulke doorbraken in security zijn, hoe significant ze ook mogen zijn, nog niet de uiteindelijke oplossing. Een reden dat het risico toch groter zal worden, is de komst van het Internet of Things.
Fellow en CTO Jon Ramsey van Dell SecureWorks zegt dat de samenkomst van cyber en fysieke domeinen - smartphones, smart cars, smartgrid - zorgen baart. "Het geeft kansen aan criminelen in het fysieke domein die die kansen niet eerder hadden", zegt hij.
"Er worden dingen met elkaar verbonden die oorspronkelijk niet ontworpen zijn om in verbinding te staan, wat betekent dat we de risicoafweging sterk negatief beïnvloeden", aldus Ramsey.
Daarnaast is er nog de menselijke factor. Vice-president David P. Wrenn van Advanced Office Systems vraagt zich af hoe technologie "idioten als ikzelf gaat verhinderen op een kwaadaardige link te klikken. Dat vind ik één van de grootste uitdagingen die onze branche kent."

Gevaar zit in software development

Over het feit dat de menselijke factor in security nog steeds het belangrijkst is en ook zal blijven, waren de panelleden het eens. Wat daarbij volgens Ferguson niet helpt, is dat security nog steeds als een bijzaak wordt gezien in softwareontwikkeling. "Als civiele ingenieurs gebouwen zouden bouwen op de manier waarop programmeurs applicaties ontwikkelen, dan zouden spechten de beschaving ten gronde kunnen richten", zegt hij. "In die zin maakt het Internet of Things me bang."
Executive director Brett Hansen van Client Solutions Software is iets optimistischer ingesteld. Hij denkt dat security van IT naar de boardroom verplaatst. "Het zal een fundamentele businessdiscussie gaan worden waarin gezocht wordt naar een balans tussen productiviteit en veiligheid."


http://cio.nl/beveiliging/83347-security-zou-volledig-over-data-moeten-gaan?utm_source=+SIM&utm_medium=email&utm_campaign=20140728-15%3A10%3A02_webwereld_daily_cron&utm_content=&utm_term=_7815

25.07.2014 Only 16% of fund managers believe AIFMD regulations have a positive impact

25.07.2014

Only 16% of fund managers believe AIFMD regulations have a positive impact

A significant 47% of real assets fund managers believe the Directive will have a negative impact on the industry, and 37% believe it will have no noticeable impact
Only a small proportion of fund managers active in infrastructure and real estate think that AIFMD regulations will have a positive impact on their firm and industry, following a recent survey of over 140 managers active in the asset classes.
Nevertheless, almost half (49%) of infrastructure managers and 34% of real estate managers worldwide indicated to Preqin in June 2014 that they would be compliant by the AIFMD’s July 2014 deadline.
Other AIFMD Key Facts:
-          36% of real estate fund managers believe regulation in general is having a negative impact on their industry, compared to 16% of infrastructure managers.
-          Almost two-thirds (63%) of infrastructure managers felt the AIFMD will have a negative impact on the industry, with 41% of real estate managers feeling the same way.
-          A greater proportion of real estate managers will not market within the EU. 38% of real estate managers indicated they will not market their funds in the region, compared to 26% of infrastructure managers. This may present opportunities for other managers to secure capital from investors based in the EU, with over 2,000 European institutional investors investing in real estate or infrastructure.
JOBS Act Key Facts:
-          A notable proportion of real estate managers, 30%, believe the JOBS Act is having a positive impact on their firm and industry, although only 1% of managers surveyed have registered and will market under the Act.
-          18% of infrastructure managers believe the JOBS Act is having a positive impact, with 8% of respondents either already registered or planning on registering under the Act.
-          Over 70% of both infrastructure and real estate fund managers either will not market their funds under the JOBS Act, or do not plan to at the moment.
-          Increased scrutiny from the SEC was named by the greatest number of real estate managers (18%) as the main reason preventing them marketing under the JOBS Act.

“The recent implementation of various regulations on the alternative investment industry has received mixed reviews from fund managers, with many wary of the additional costs and administrative requirements associated with compliance. In particular, fund managers appear to have a negative outlook on the AIFMD, with many unhappy with the additional cost and administrative burden required in order to be compliant and to continue marketing their funds within the EU.
Regarding the JOBS Act, although this allows managers to market to a broader audience through registration under section 506©, very few intend to follow this route in the short term, with many firms concerned about increased scrutiny of regulators and the additional costs that advertising would bring, as well as the potential negative perception of wider marketing. Only time will tell whether managers will adapt to and take advantage of the new opportunities created by the JOBS Act.” - Andrew Moylan, Head of Real Assets Products


http://www.iss-mag.com/regulations-and-compliance/only-16-percent-of-fund-managers-believe-aifmd-
 

The Ultra-Simple App That Lets Anyone Encrypt Anything

 By Andy Greenberg 

Original illustration: Getty

Encryption is hard. When NSA leaker Edward Snowden wanted to communicate with journalist Glenn Greenwald via encrypted email, Greenwald couldn’t figure out the venerable crypto program PGP even after Snowden made a 12-minute tutorial video.
Nadim Kobeissi wants to bulldoze that steep learning curve. At the HOPE hacker conference in New York later this month he’ll release a beta version of an all-purpose file encryption program called miniLock, a free and open-source browser plugin designed to let even Luddites encrypt and decrypt files with practically uncrackable cryptographic protection in seconds.
“The tagline is that this is file encryption that does more with less,” says Kobeissi, a 23-year old coder, activist and security consultant. “It’s super simple, approachable, and it’s almost impossible to be confused using it.”

A screenshot from an early demo of miniLock.

Kobeissi’s creation, which he says is in an experimental phase and shouldn’t yet be used for high security files, may in fact be the easiest encryption software of its kind. In an early version of the Google Chrome plugin tested by WIRED, we were able to drag and drop a file into the program in seconds, scrambling the data such that no one but the intended recipient—in theory not even law enforcement or intelligence agencies—could unscramble and read it. MiniLock can be used to encrypt anything from video email attachments to photos stored on a USB drive, or to encrypt files for secure storage on Dropbox or Google Drive.
Like the older PGP, miniLock offers so-called “public key” encryption. In public key encryption systems, users have two cryptographic keys, a public key and a private one. They share the public key with anyone who wants to securely send them files; anything encrypted with that public key can only be decrypted with their private key, which the user guards closely.
Kobeissi’s version of public key encryption hides nearly all of that complexity. There’s no need to even register or log in—every time miniLock launches, the user enters only a passphrase, though miniLock requires a strong one with as many as 30 characters or a lot of symbols and numbers. From that passphrase, the program derives a public key, which it calls a miniLock ID, and a private key, which the user never sees and is erased when the program closes. Both are the same every time the user enters the  passphrase. That trick of generating the same keys again in every session means anyone can use the program on any computer without worrying about safely storing or moving a sensitive private key.
“No logins, and no private keys to manage. Both are eliminated. That’s what’s special,” says Kobeissi. “Users can have their identity for sending and receiving files on any computer that has miniLock installed, without needing to have an account like a web service does, and without needing to manage key files like PGP.”
In fact, miniLock uses a flavor of encryption that had barely been developed when PGP became popular in the 1990s: elliptic curve cryptography. Kobeissi says that crypto toolset allows for tricks that haven’t been possible before; PGP’s public keys, which users have to share with anyone who wants to send them encrypted files, often fill close to a page with random text. MiniLock IDs are only 44 characters, small enough that they can fit in a tweet with room to spare. And elliptic curve crypto makes possible miniLock’s feature of deriving the user’s keys from his or her passphrase every time it’s entered rather than storing them. Kobeissi says he’s saving the full technical explanation of miniLock’s elliptic curve feats for his HOPE conference talk.
Despite all those clever features, miniLock may not get a warm welcome from the crypto community. Kobeissi’s best-known previous creation is Cryptocat, a secure chat program that, like miniLock, made encryption so easy that a five-year-old could use it. But it also suffered from several serious security flaws that led many in the security community to dismiss it as useless or worse, a trap offering vulnerable users an illusion of privacy.
But the flaws that made Cryptocat into the security community’s whipping boy have been fixed, Kobeissi points out. Today the program been downloaded close to 750,000 times, and in a security ranking of chat programs by the German security firm PSW Group last month it tied for first place.
Despite Cryptocat’s early flaws, miniLock shouldn’t be dismissed, says Matthew Green, a cryptography professor at Johns Hopkins University who highlighted previous bugs in Cryptocat and has now also reviewed Kobeissi’s design spec for miniLock. “Nadim gets a lot of crap,” Green says. “But slighting him over things he did years ago is getting to be pretty unfair.”
Green is cautiously optimistic about miniLock’s security. “I wouldn’t go out and encrypt NSA documents with it right now,” he says. “But it has a nice and simple cryptographic design, with not a lot of places for it to go wrong…This is one that I actually think will take some review, but could be pretty secure.”
Kobeissi says he’s also learned lessons from Cryptocat’s failures: miniLock won’t initially be released in the Chrome Web Store. Instead, he’s making its code available on GitHub for review, and has taken special pains to document how it works in detail for any auditors. “This isn’t my first rodeo,” he says. “[MiniLock's] openness is designed to show sound programming practice, studied cryptographic design decisions, and to make it easy to evaluate miniLock for potential bugs.”
If miniLock becomes the first truly idiot-proof public key encryption program, it could bring sophisticated encryption to a broad new audience. “PGP sucks,” Johns Hopkins’ Green says. “The ability for regular people to encrypt files is actually a valuable thing…[Kobeissi] has stripped away the complexity and made this thing that does what we need it to do.”


http://www.wired.com/2014/07/minilock-simple-encryption/

Why senior leaders are the front line against cyberattacks

All companies are aware of the growing risk of cyberattacks, yet few are taking the steps necessary to protect critical information. The key? Senior managers need to lead.

June 2014 | byTucker Bailey, James Kaplan, and Chris Rezek

Why isn’t more being done to protect critical information assets? Senior executives understand that the global economy is still not sufficiently protected against cyberattacks, despite years of effort and annual spending of tens of billions of dollars. They understand that risk alone undermines trust and confidence in the digital economy, reducing its potential value by as much as $3 trillion by 2020.¹ 1.Tucker Bailey, Andrea Del Miglio, and Wolf Richter, “The rising strategic risks of cyberattacks,” McKinsey Quarterly, May 2014. They understand most institutions have technology- and compliance-centric cybersecurity models that don’t scale, limit innovation, and provide insufficient protection. And they understand that institutions need to develop much more insight into the risks they face, implement differential protection for their most important assets, build security into broader IT environments, leverage analytics to assess emerging threats, improve incident response, and enlist frontline users as stewards of important information.

    

McKinsey’s James Kaplan explains what executives can do to protect their companies against cyberattacks.

Play video

The importance of cybersecurity is no secret to anyone who’s opened a newspaper or attended a board meeting. So, senior executives may ask, what’s the holdup? The answer is simple: understanding the issue is quite different from effectively addressing it. A number of structural and organizational issues complicate the process of implementing business-driven, risk-management-oriented cybersecurity operating models, and only sustained support from senior management can ensure progress and ultimately mitigate the risk of cyberattacks.

Structural hurdles to addressing cybersecurity

There are a number of factors that make getting the right cybersecurity capabilities in place difficult for large institutions. First, competitive imperatives mean executives must accept a certain level of cyberattack risk. As a chief information-security officer (CISO) at an investment bank said, “If I did as thorough a security assessment as I would like before we nailed up a direct connection to a hedge fund, our prime-brokerage business would cease to exist.” What this means is that in order to protect themselves without limiting their ability to innovate, companies have to make sophisticated trade-offs between risks and customer expectations.
Second, the implications of cybersecurity are pervasive—and that alone impedes the adoption of risk-mitigation strategies. Cybersecurity touches every business process and function, not only in operations but also in customer care, marketing, product development, procurement, human resources, and public affairs. Just two examples: product-development decisions often increase the volume of sensitive customer data that is collected, while procurement decisions can create the risk that vendors will treat sensitive intellectual property with less care than required.
Third, cybersecurity risk is difficult to quantify. There’s no single quantitative metric such as value at risk for cybersecurity, making it much harder to communicate the urgency to senior managers and engage them in required decisions. As one chief financial officer told us, “It feels like we’re constantly spending more on security, but I have no idea whether that’s enough or even what it does.”
Finally, it’s hard to change user behavior. For many institutions, the biggest vulnerability lies not with the company but with its customers. How do you prevent users from clicking on the wrong link, allowing their machines to be infected with malware? How do you stop them from transferring incredibly sensitive information to consumer services that may not be secure? Breaking through the noise at most institutions to communicate with frontline managers about cybersecurity risks is tough enough, let alone mitigating risks that are ostensibly beyond your control.

Senior managers must lead

Cybersecurity is a CEO-level issue. The risks of cyberattacks span functions and business units, companies and customers. And given the stakes and the challenging decisions posed by becoming cyberresilient, making the decisions necessary can only be achieved with active engagement from the CEO and other members of the senior-management team.
As part of research we undertook with the World Economic Forum on cybersecurity,² 2.David Chinn, James Kaplan, and Allen Weinberg, “Risk and responsibility in a hyperconnected world: Implications for enterprises,” January 2014. we had the opportunity to interview executives from more than 200 institutions and perform deep dives on cybersecurity risk-management practices with more than 60 of the world’s 500 largest companies. Senior-management time and attention was identified as the single biggest driver of maturity in managing cybersecurity risks—more important than company size, sector, and resources provided. Our research also found that senior-management engagement varies dramatically. In some companies, the CISO meets the CEO every few weeks. Yet in others, the CISO has never met the CEO. In fact, the CISO may report to the chief technology officer, who reports to the chief information officer, who then reports to the CFO.
So what does senior management need to do? Among those companies that are making the most progress toward developing cyberresiliency, we identified four actions common among senior managers:

• Actively engaging in strategic decision making. Just as with other types of enterprise risk, CEOs and the rest of the senior-management team must provide input on the organization’s overall level of risk appetite for loss of intellectual property, disclosure of customer information, and disruption of business operations. Subsequent to that, business-unit heads—and their management teams—must engage with cybersecurity managers to help prioritize information assets and make specific trade-offs between risk reduction and operational impact.
• Driving consideration of cybersecurity implications across business functions. Senior managers at leading companies ensure business managers incorporate cybersecurity considerations into product, customer, and location decisions, while functional leaders are responsible for addressing cybersecurity considerations in human-resources and procurement decisions. In addition, they make sure that the disclosure of cybersecurity priorities is incorporated into the company’s public-affairs agenda.
• Pushing changes in user behavior. Given how much sensitive data senior managers interact with, they have the chance to change and model their own behavior for the next level of managers. This can begin with simple steps, such as becoming more judicious about forwarding documents from corporate to personal e-mail accounts. In addition, senior management can and should provide the communications “airtime” and reinforcement required to help frontline employees understand what they need to do to protect critical information assets.
• Ensuring effective governance and reporting is in place. No matter how thoughtful a set of cybersecurity policies and controls may be, some managers will seek to circumvent them. Senior management obviously needs to make sure that policies and controls make sense from a business standpoint. If they do, senior managers then need to backstop the cybersecurity team to help with enforcement. In addition, senior management should put in place effective, granular reporting on how the company is progressing against specific milestones in its cybersecurity program.

Pervasive digitization, open and interconnected technology environments, and sophisticated attackers make cybersecurity a critical social and business issue. If inadequately addressed, it could materially slow the pace of technology and business innovation in the years to come. That’s why companies must make rapid progress toward cyberresiliency, and only sustained focus and support from top management can overcome myriad structural and organizational hurdles. We know it’s possible—at some companies, this process is already under way. But it must take place on a broader scale if companies are to protect their critical information assets while retaining the ability to innovate and grow.

About the authors

Tucker Bailey is a principal in McKinsey’s Washington, DC, office; James Kaplan is a principal in the New York office; and Chris Rezek is a consultant in the Boston office.

Study: 97% of companies using network defenses get hacked anyway

Current network defenses are like the Maginot Line, analysts find.

by Sean Gallagher - May 20 2014  

A security study drawing data from more than 1,600 networks over a six-month period found that 97 percent of the networks experienced some form of breach—despite the use of multiple layers of network and computer security software. The study, performed by analysts from security appliance vendor FireEye and its security consulting wing Mandiant, compared current network defenses to the Maginot Line, the infamous French fortress chain that the Germans bypassed during their May 1940 invasion.
The data collected from network and e-mail monitoring appliances from October 2013 to March 2014 also showed that three-quarters of the networks had command-and-control traffic indicating the presence of active security breaches connected to over 35,000 unique command-and-control servers. Higher-education networks were the biggest source of botnet traffic.
FireEye and Mandiant analyzed real-time data from 1,614 FireEye appliances that had been placed on networks as part of “proof of value” trials; the devices provided monitoring. Each of the networks already had a “defense in depth” architecture, combining firewalls, intrusion detection and prevention systems, and antivirus software. Despite that, the appliances detected over 208,000 malware downloads across the monitored networks, of which 124,000 were unique malware variants.
On average, each network was subjected to 1.6 exploits and 122 malware droppers during the six-month period. FireEye and Mandiant analysts also reported that 27 percent of the monitored organizations in the study “experienced events known to be consistent with tools and tactics used by advanced persistent threat (APT) actors”—inferring that they were being attacked by either state-sponsored organizations or sophisticated criminal networks.
 

Sean Gallagher / Sean is Ars Technica's IT Editor. A former Navy officer, systems administrator, and network systems integrator with 20 years of IT journalism experience, he lives and works in Baltimore, Maryland.


http://arstechnica.com/security/2014/05/study-97-of-companies-using-network-defenses-get-hacked-anyway/?utm_content=5453676&utm_medium=social&utm_source=twitter

OpenSSL krijgt nu wel serieuze aandacht

30 mei 2014 15:57 Thijs Doorenbosch NIEUWS                                                                                                                                                                                   

De nasleep van het Heartbleed-debacle heeft tot gevolg dat OpenSSL fors onder handen wordt genomen.

De Linux Foundation kondigt aan dat er geld beschikbaar is voor een grondige beveiligingsaudit van OpenSSL, de basis voor de beveiliging van veel internetverkeer. Het Open Crypto Audit Project (OCAP) gaat de software doorvlooien op zoek naar beveiligingslekken. Daarnaast gaan nu twee mensen zich full-time bezig houden met het actualiseren en controleren van het OpenSSL-protocol.  

De organisatie heeft ook de ruimte gekregen om andere belangrijke open source initiatieven ruime aandacht te geven, zoals OpenSSH (het protocol voor remote command line inlog) en het Network Time Protocol (voor de synchronisatie van computerklokken).

De Linux Foundation heeft de mogelijkheid gekregen doordat de Heartbleed-bug veel grote bedrijven en organisaties heeft doen beseffen hoe belangrijk het werk aan de opensource-protocollen is. Gezamenlijk hebben zij 5,4 miljoen dollar ingelegd, voor projecten in de komende drie jaar.

http://www.automatiseringgids.nl/nieuws/2014/22/openssl-krijgt-nu-wel-serieuze-aandacht 

Locked In: Keeping Your Enterprise Encryption Keys in Order

Posted by Joe Sturonas on Thursday, 22 May 2014 in Data Security

 

Every year, spring cleaning results in a few re-discoveries around my house (“I own a weed whacker?”). This year, it also led to a new, nerve-racking game, “What Could These Keys Possibly Belong To?”

What does this key go to? Key management is the tricky part of encryption, though vital to keeping control over security.In a shelf in the basement, I found a ring with two keys of unknown origin. I shuffled around the house, garage and shed trying to match them up to every lock and door. Nothing. Keys without a lock … or a lock somewhere else without a key, put another way. Given my background in encryption and enterprise key management, my mind went to paranoid circumstances where I’d soon be locked out by a new lock in my own front door, or a situation where I’d go mad looking for buried treasure in my yard.

Key management is the really hard part of enterprise encryption. Encryption, in its own right, remains the most impenetrable data security option in your wider “defense in depth” approach. The best encryption also comes with sensible, easy key management. If you lock down data, you need to make sure you (and only you) can unlock it, too. In that same sense, you don’t want to start handing out crypto keys to the point where encryption is more rampant than useful. Too many keys can be just as damaging for you, your customers and your sensitive business documents.

We often share the story of one customer who came to us initially asking to “unlock” encryption from another vendor. Unfortunate for this German manufacturer, the other vendor’s encryption did not come with a “contingency” key (kind of like a master decrypt key for security administrators). So, when a rogue employee sent off docs he had encrypted, the manufacturer was without a matching decryption key to find out just what had left its company firewalls. Contingency key goes by a few terms – we’ve heard “private key escrow” with one big financial services client as well as controlled encryption; we’re all ears to what term makes sense for you. The important aspect of contingency key, however, is that your CISO, department head or info sec team has an emergency decrypt capability for the host of issues that can come up from unchecked encryption.

Free Data
Security Guide

Strategies to protect business files on any device

There are enough potential leaks and breaches coming at your business information every day. Make sure that the protection you employ doesn’t lock you out of the very data you’re securing


http://www.pkware.com/Blog/2014/05/22/locked-in-keeping-your-enterprise-encryption-keys-in-order