Securosis

Menu

Research

Twitter security for media companies

Rich April 29, 2013 1 Comment

Twitter is worried about all the media company accounts being hacked, and has released some guidance. These aren’t exploits of Twitter itself, but of media companies, typically through phishing. Twitter suggests that companies employ a pretty standard set of password security practices in response: changing current passwords, using new ones that are at least 20 characters long and are made up of either randomly-generated characters or random words, and to never email said passwords, even internally … Given that email accounts are used to reset passwords, Twitter also suggests users change those passwords and implement two-factor authentication on their email accounts if available Here is what I suggest on top of Twitter’s suggestions: Use a dedicated email account for your Twitter account, and don’t make it public. Disable all Twitter email updates to that account, and rely on in-app notifications. Use strong authentication for that email account, and limit access. If you need to authorize a new app or employee for Twitter, change the Twitter account password to a new random password after every time you use it to authorize an app. Check your app authorizations daily. You are a media company, and this is one of your biggest channels. I don’t make this recommendation for everyone, but if you are the AP you need to take super extra precautions. Have an incident response process for suspicious tweets or account access, and make sure you pre-contact Twitter with the right contact info for those authorized to check on the account. Again, if you are a big media company, use a designated device for tweeting that isn’t used for other things. Notice I said “device”. An iPad is great because you don’t need to worry about background malware. I’m sure people have other good ideas to add in the comments… Share:

Share:
Read Post

Google Glass Has Already Been Hacked By Jailbreakers

Rich April 29, 2013 2 Comments

Courtesy of Forbes: Freeman, who goes by the hacker handle “Saurik” and created the widely-used app store for jailbroken iOS devices known as Cydia, told me in a phone interview that he discovered yesterday that Glass runs Android 4.0.4, and immediately began testing previously-known exploits that worked on that version of Google’s mobile operating system. Within hours, he found that he could use an exploit released by a hacker who goes by the name B1nary last year to gain full control of Glass’s operating system. As David Mortman said in our internal chat room: Love that it’s a slightly modified year old exploit. Google couldn’t even bother to release an up to date version of android with the device. Here is why it matters – Glass will be open to most, if not all Android exploits unless Google takes extra precautions. Glass is always on, with a persistent video camera that isn’t blacked out when you drop it in your pocket. This offers malware opportunities beyond even the risks of a phone. Since every jailbreak is a security exploit, this is a problem. Share:

Share:
Read Post

Gaming the pirates—literally

Rich April 29, 2013 No Comments

This is too good not to share, albeit only tangentially related to our usual SMB and enterprise focus: A software development company posted a cracked version of their new game to pirate sites, but with a twist: However, in the pirated version, the in-game developers begin to run into crippling piracy that eventually drives them into bankruptcy. In-game CEO’s receive this message: “Boss, it seems that while many players play our new game, they steal it by downloading a cracked version rather than buying it legally.” If players don’t buy the games they like, we will sooner or later go bankrupt. Players who downloaded the game illegally then began posting questions in the game’s support forums asking how to better fight the pirates. After the first weekend, the company had 3100 gamers playing the cracked version, with 214 playing the genuine edition. Pay for your f-ing software, people, that’s all I have to say. Heck, I have even started paying for things I can get free review licenses for, when they are something I use on a regular basis and want to support. Share:

Share:
Read Post

Security Funding via Tin Cup

Mike Rothman April 29, 2013 No Comments

Folks struggling to get funding to implement security programs are a hot button of mine. I know it’s hard. I know we are expected to protect stuff with tighter budgets and fewer resources. A cornerstone of our research is effective prioritization so you can focus on the things most important to your organization. I get all that. But most folks aren’t a lot more sophisticated than passing around a tin cup during the budgeting process and hoping they get sufficient funding. If you want any chance of success in security, you need to be able to get funding for your key projects. And passing a virtual tin cup doesn’t cut it. I recently saw an article on NetworkWorld that hits on these topics, 10 tips to secure funding for a security program, and figured it was another one of these lightweight slide shows meant to drive a bunch of page views. But when I started reading and almost immediately saw a discussion of ROI for getting security funding I was a bit chagrined. If you talk ROI you have very little chance of success. Although the author (Dominic Nessi) makes a good point: However, cyber security budget requests are more difficult to quantify. Security ROI is typically expressed by comparing security investments with the potential liability caused by security breaches. This is similar to calculating the financial benefit of insurance for physical assets, such as buildings and equipment. Insurance. Awesome. But it is what it is. It’s about risk – either minimizing or transferring your risk. Don’t even waste time thinking about eliminating risk. Dominic talks about putting a program framework in place and relating the goals of the security framework to the goals of the business. Yup. So read these 10 tips, and understand they aren’t really 10 tips – these are all basic things that go along with having a strong security program. But I’m not sure why getting a CISSP is important for getting funding. If you are looking at a certification to prove competence to your senior management you’re doing it wrong. But railing on certifications is another topic for another day. Photo credit: “Beggar girl” originally uploaded by Taifighta Share:

Share:
Read Post
dinosaur-sidebar

Research

view all

Sign Up for Our Newsletter

Totally Transparent Research is the embodiment of how we work at Securosis. It’s our core operating philosophy, our research policy, and a specific process. We initially developed it to help maintain objectivity while producing licensed research, but its benefits extend to all aspects of our business.

Going beyond Open Source Research, and a far cry from the traditional syndicated research model, we think it’s the best way to produce independent, objective, quality research.

Here’s how it works:

  • Content is developed ‘live’ on the blog. Primary research is generally released in pieces, as a series of posts, so we can digest and integrate feedback, making the end results much stronger than traditional “ivory tower” research.
  • Comments are enabled for posts. All comments are kept except for spam, personal insults of a clearly inflammatory nature, and completely off-topic content that distracts from the discussion. We welcome comments critical of the work, even if somewhat insulting to the authors. Really.
  • Anyone can comment, and no registration is required. Vendors or consultants with a relevant product or offering must properly identify themselves. While their comments won’t be deleted, the writer/moderator will “call out”, identify, and possibly ridicule vendors who fail to do so.
  • Vendors considering licensing the content are welcome to provide feedback, but it must be posted in the comments - just like everyone else. There is no back channel influence on the research findings or posts.
    Analysts must reply to comments and defend the research position, or agree to modify the content.
  • At the end of the post series, the analyst compiles the posts into a paper, presentation, or other delivery vehicle. Public comments/input factors into the research, where appropriate.
  • If the research is distributed as a paper, significant commenters/contributors are acknowledged in the opening of the report. If they did not post their real names, handles used for comments are listed. Commenters do not retain any rights to the report, but their contributions will be recognized.
  • All primary research will be released under a Creative Commons license. The current license is Non-Commercial, Attribution. The analyst, at their discretion, may add a Derivative Works or Share Alike condition.
  • Securosis primary research does not discuss specific vendors or specific products/offerings, unless used to provide context, contrast or to make a point (which is very very rare).
    Although quotes from published primary research (and published primary research only) may be used in press releases, said quotes may never mention a specific vendor, even if the vendor is mentioned in the source report. Securosis must approve any quote to appear in any vendor marketing collateral.
  • Final primary research will be posted on the blog with open comments.
  • Research will be updated periodically to reflect market realities, based on the discretion of the primary analyst. Updated research will be dated and given a version number.
    For research that cannot be developed using this model, such as complex principles or models that are unsuited for a series of blog posts, the content will be chunked up and posted at or before release of the paper to solicit public feedback, and provide an open venue for comments and criticisms.
  • In rare cases Securosis may write papers outside of the primary research agenda, but only if the end result can be non-biased and valuable to the user community to supplement industry-wide efforts or advances. A “Radically Transparent Research” process will be followed in developing these papers, where absolutely all materials are public at all stages of development, including communications (email, call notes).
    Only the free primary research released on our site can be licensed. We will not accept licensing fees on research we charge users to access.
  • All licensed research will be clearly labeled with the licensees. No licensed research will be released without indicating the sources of licensing fees. Again, there will be no back channel influence. We’re open and transparent about our revenue sources.

In essence, we develop all of our research out in the open, and not only seek public comments, but keep those comments indefinitely as a record of the research creation process. If you believe we are biased or not doing our homework, you can call us out on it and it will be there in the record. Our philosophy involves cracking open the research process, and using our readers to eliminate bias and enhance the quality of the work.

On the back end, here’s how we handle this approach with licensees:

  • Licensees may propose paper topics. The topic may be accepted if it is consistent with the Securosis research agenda and goals, but only if it can be covered without bias and will be valuable to the end user community.
  • Analysts produce research according to their own research agendas, and may offer licensing under the same objectivity requirements.
  • The potential licensee will be provided an outline of our research positions and the potential research product so they can determine if it is likely to meet their objectives.
  • Once the licensee agrees, development of the primary research content begins, following the Totally Transparent Research process as outlined above. At this point, there is no money exchanged.
  • Upon completion of the paper, the licensee will receive a release candidate to determine whether the final result still meets their needs.
  • If the content does not meet their needs, the licensee is not required to pay, and the research will be released without licensing or with alternate licensees.
  • Licensees may host and reuse the content for the length of the license (typically one year). This includes placing the content behind a registration process, posting on white paper networks, or translation into other languages. The research will always be hosted at Securosis for free without registration.

Here is the language we currently place in our research project agreements:

“Content will be created independently of LICENSEE with no obligations for payment. Once content is complete, LICENSEE will have a 3 day review period to determine if the content meets corporate objectives. If the content is unsuitable, LICENSEE will not be obligated for any payment and Securosis is free to distribute the whitepaper without branding or with alternate licensees, and will not complete any associated webcasts for the declining LICENSEE. Content licensing, webcasts and payment are contingent on the content being acceptable to LICENSEE. This maintains objectivity while limiting the risk to LICENSEE. Securosis maintains all rights to the content and to include Securosis branding in addition to any licensee branding.”

Even this process itself is open to criticism. If you have questions or comments, you can email us or comment on the blog.