Phishing and Social Engineering have been a growing concern. The latest Phishing Activity Trends Report of Q4 2009 from Anti- Phishing Working Group (APWG) shows alarming figures of increasing sophisticated phishing attacks. As per the report, the financial services industry has again topped in all targeted sectors in Q4.

Anti-Phishing Working Group (APWG) Chairman Dave Jevans said, “Spear‐phishing and whale‐phishing, where targeted individuals inside of corporations, or of high net worth, appeared to be increasing. Phishers and malware attackers are sending emails to individuals in a highly targeted fashion, attempting to gain access to corporate online banking systems, corporate VPN networks, and other online resources.”

Consider this scenario: An organization has perimeter security configured. Multiple detective controls like IDS, IPS, firewall etc. are deployed. Still the employee gets an email with embedded link which points to a malicious website. Once dragged to this website; unwitting employee is exposed to an array of risk.

One such risk could be like crimeware (which is designed with the intent of collecting information of the end‐user to steal credentials) or malware is downloaded and installed on the local system without user’s consent. Once installed, it may allow scammers to compromise other network systems, steal sensitive information, create backdoors inside the corporate networks etc. Another significant risk is where the website attempts to sway the recipient to reveal personal information or credentials of online corporate applications. This kind of mails is often pictured as coming from trusted source like HR or IT department, outsourcing partners etc. and makes usage of legitimate layout, graphics, links and content etc. to look like original website.

Most times, it is very difficult to determine the source  of the phishing attacks because a well orchestrated phishing attack understands the weak links in People, Process and Technology inside an organization in order to carry out successful attack. Most worrying, there are no quick, witching tools which can help you mitigate phishing risks overnight. Then how would you address the Phishing Risk?

Organizations can adapt the Deming Cycle [Plan-Do-Check-Act] to best counter phishing attacks and it would improvise over period of a time. Steps to follow -

1. Understand the current level of preparedness of employees and define a strategy to address this gap [Plan]

2. Implement policies, procedures and incident response plan to guide employees  on “How to identify phish websites“ and “What to do” when Phishing attacks actually occur [Do]

3. Conduct drills periodically to check readiness of the employees on phishing attacks and determine who are vulnerable [Check]

4. Provide  awareness training to vulnerable users and also regularly update employees on new threats and techniques used by Phishers by possible means of communication  [Act]

In summary the message is very clear; the key to protect oneself is continuous education and awareness. Organizations should start working towards employee education for its better cure.

Is your organization ready to fight against Phishing Risks?

        

Read the excerpts from our conversation,

        

It is gratifying that our customers have seen immense value in what we have delivered and most customers have come back to us, reaffirming their trust in us.

As we commence our third year, we will add more services to our Information Risk services portfolio and continue to our Information Risk services portfolio and continue our expnasion into international markets.

We would like to thank our customers, employees, partners, management team, Board and Advisory Board members for their continued support in scaling Aujas.

Warm Regards,
M Srinivas Rao
Co-Founder & CEO

        

We are just back from the “CIO – The Year Ahead” event organized by IDG Media. The event is a premier forward looking annual event for CIO’s in India. We had about ~ 90 CIO’s & IT Heads there to examine technology trends for the coming year.

The last CIO event was held at Singapore, but this time it was held in India - at the beautiful locale of Royal Palms, Bangalore. A very nice place and add to it the beautiful Bangalore weather. Maybe that explained the high turnout for the event by senior folks from the IT industry?

The keynote session was from Mr. B. S. Nagesh, MD of Shoppers Stop. It was probably the best presentation of the event. He spoke more from his heart than his head – challenging the present CIO’s on their next role in the organization.

As with all events there were a lot of sessions from industry folks and large technology companies - some good, some not so good. The recurrent theme was around SAAS, Cloud computing and virtualization. Reality or too much hype?

Aujas was one of the knowledge partners for the Security session. Sameer Shelke, co-founder & COO talked about “IT Risk Management – As the Economy Revives”.

He spoke about how organizations, when the economy revives, will start investing in new markets, employee growth and productivity.  But along with planning for growth, companies need to seriously look at the key Information Risk as we plan for more growth. If this down-turn hopefully taught us anything, it would be to look at Risk a little more critically.

You can find a copy of his presentation online at http://www.aujas.com/presentations.html. Feel free to download the same and if you need any more information do drop a mail at contact@aujas.com.

It was a great event. Some of the discussions around lunch and dinner were obviously more interesting than some of the presentations on the stage. Thanks to all the CIO’s for making it an interesting event. Thanks also to IDG Media team from organizing a great event. We look forward to the next event.

        

Background

“The Long Tail" is a concept put forth by Chris Anderson which described the niche strategy of businesses, such as Amazon.com or Netflix, which sell a large number of unique items, each in relatively small quantities. Anderson elaborated the Long Tail concept in his book The Long Tail: Why the Future of Business Is Selling Less of More.

Anderson argued that products that are in low demand or have low sales volume can collectively make up a market share that rivals or exceeds the relatively few current bestsellers and blockbusters, if the store  or distribution channel is large enough. Research showed that a significant portion of Amazon.com's sales come from obscure books that are not available in brick-and-mortar stores. The Long Tail is a potential market and, as the examples illustrate, the distribution and sales channel opportunities created by the Internet often enable businesses to tap that market successfully.

Application to Security

In the Risk management or security world we focus on the “head” which are the common or major risks we face or hear that others faced. Needless to say all our protection efforts & postures are deployed to protect against the “head risks” and rightly so. E.g. when we decide to put up some applications or services on the Internet, we ensure we protect the application against risks such as the OWASP top 10 vulnerabilities, malwares, infrastructure security etc. Content security aspects such as spam filtering, antivirus etc. become “head risks” when we talk of email systems.

Time and again we get faced with risks which lie in the “long tail” which we haven’t thought of or heard of. E.g. Terrorists hacked into the home WiFi network of Keith Heywood in Mumbai and sent out an email about their impending attack minutes before 19 explosions killed 49 and wounded more than 200 people in Ahmedabad. Since then WiFi access point security has got attention all across, with the Mumbai Police now planning to test open WiFi access points across the city and would issue notices & citations to the users found using open WiFi access points. Suddenly WiFi access point security has moved from the “long tail” to the “head” with everyone taking about it and taking appropriate protection measures.

The question which challenges us is would we face a situation where it’s said that “We got attacked more using vulnerabilities today, which were not exploited at all till yesterday than those which were exploited till yesterday”. Like what Amazon said about the Long tail.

Sounds complex isn’t it; well, we are already facing this issue, “How do we protect ourselves against those seemly obscure risks which suddenly might become important?”.

The answer is not simple and its implementation is possibly more difficult. What is required is a comprehensive Risk management framework which would help us identify our assets, its weaknesses, the probability of attacks and hence the risk. We should also consider the current security posture we have and then the residual risk. What is critical is that this framework needs to be “live” and “in use” all the time, doing it once won’t help. This should be part of normal business function which would help us identify new or modified risks all the time

We can never say we are 100% safe and protected, what we owe to ourselves and our business is doing all we can to protect our information technology assets.

        

Annual Conference of ISACA (Information Systems Audit and Control Association), Mumbai Chapter was held at ITC Grand Maratha on 4th-6th September 2009. The theme for this year was “Success in the Challenging Times: Securing the Unsecured – Assurance beyond Audit.”

The conference featured executives from several leading public and private organizations for panel discussions and presentations. Sameer Shelke, co-founder & COO, represented Aujas and delivered a presentation on “Our Psychology & Security: The Way We Think" at the annual conference.

 

In his talk Sameer stressed on the thought process of people in dealing with IT risks.He drew an analogy with various reactions to the H1N1 epidemic, specifically of people and media to this “risk”.  

 

The industry patrons applauded Sameer for his remarkable and meaningful presentation. “Sameer’s presentation was practically related with out of the box approach”, said Richard DeSouza, Head Operational Risk of Reliance Life Insurance Limited

To download a copy of Sameer’s presentation please click on http://www.aujas.com/presentations.html 

        

        

The Information Technology (Amendment) Act, 2008 an act to amend the IT Act 2000 received the assent of the President on 5^th February 2009. Several legal & security experts are in the process of analyzing the contents and possible impacts of the amendments. The objective of this note is to try and study the possible implications and impacts on Indian companies. This note is not intended to be a comprehensive analysis of the amendments, but only certain key points which could impact Indian Companies.

1. Data Protection

The sections under consideration are:

• Section 43A: Compensation for failure to protect data
• Section 72A: Punishment for disclosure of information in breach of lawful contract

Section 43A states

By way of explanation: “Body corporate means Indian companies”

Section 72A:

2. Information Preservation

e.g. Section 67C: Preservation and Retention of information by intermediaries.

Apart from the two aspects discussed in this note, there are other areas which could also be considerations for E.g.

        

Today’s recessionis pushing the business to move to cloud which can convert the CapEx cost toOpEx cost. Here is a glimpse of latest security news from Google Docs.

“We’ve identified and fixed a bug where a very small percentage of usersshared some of their documents inadvertently.”

“We’re sorry for the trouble this has caused. We understand our users’concerns (in fact, we were affected by this bug ourselves) and we’re treatingthis very seriously.”

This is a serious threat to privacy and trust. Think about abusiness confidential document shared with a competitor? Who will takeownership of the losses incurred?  The issueindicates how dangerous cloud can be. 

Security is the biggest factor that prevents organizations fromadopting cloud, but this did not stop the companies from building products thatare less secured. Google’s issue is very simple fundamental design issue. Tounderstand it lets see the three fundamental security design patterns.

•   Single Access Point

• Authenticationand Authorization Point

• User-Role-Privilege

The Single Access Point pattern was implemented but the second and third patterns have been buggy that allowed people to view all the documents. As always security is an afterthought. The lack of security awareness  and not following Secure SDLC will cause havoc in cloud computing business.

The only solution would be to bring in security standards, audits and publically present this information. It's really raining out there in cloud just an umbrella cannot help.

        

Few weeks ago, as part of the DSCI Bangalore Chapter (http://www.dsci.in) one of the Business Leader presented his security concerns of his organizations. When asked what is the one problem that security professionals need to address, he said, the information about people behavioral aspects in terms of security. How does one gather and share the information ? How does one do background checks on the people. He felt and I agree that people are the weakest link and if there is a way to figure out the behavioral patterns than that would help control security incidence.

Cut to last week I attended Emtech 2009 (http://www.emtechindia.in/) a premier technology conference in India. Lot of interesting technologies from Biofuel to stem cell to Nano. One of the interesting and relevant technology demos that I saw was implementation of Analytics, data mining and predictive algorithms to publicly available data on internet say terrorists. For example it is now well known fact that many organizations act as front of terrorist organizations and they are well masqueraded in terms hierarchies of valid and invalid organizations. Individuals working in these organizations may be connected to banned organization. The data is then organized by links and layers and one can do a search on any organization to see if they are connected by any remote link to terrorist organization. 

So what do you think is it time for security analytics in personnel space ? or there would privacy issues in this ?