Research

Author’s Note: This was originally posted last year, but nothing ever changes: Backup Backup Backup Did I say backup yet? Backing up home computers used to be little more than a convenience to keep you from losing some old college papers. These days our entire family histories find life on our unreliable home computers. From digital photos of junior, to financial records in Quicken, to love letters in email, our computers store items in ephemeral 0s and 1s that used to be on paper in a box. Sure, paper isn’t perfect, but I suspect more of us have experienced hard drive crashes than house fires. Backup is really a pain, so I suggest prioritizing your efforts to focus on the most important stuff and to make it easy and seamless for your non-geek friends and family. In many cases your best bet is to get an external hard drive and some basic backup software (I use SuperDuper on my Mac, not sure what’s good these days on PCs, so recommendations in the comments appreciated). A bunch of the external drives now include basic software for free, and you can plug in the drive, install the software, and just check up on it every now and then. For digital photos I’ve started recommending the archive features of Photoshop Elements, Microsoft Digital Image Suite, and the like. The advantage here is they get a photo tool they can use for other purposes, while getting basic photo backup features. I just grabbed Photoshop Elements for my Father-in-Law and a bunch of blank CDs. My plan is, every few months, to burn an archive of his photos on CD and store them over at my place (we live 20 minutes away). No- backup isn’t fun or sexy, but today it’s very very necessary. I hear all too many stories of people losing valuable family photos due to a basic hard drive crash, virus, or whatever. Imagine losing ALL your baby pics, wedding pics, or Grandpa’s 80th birthday pics where he flashed back and called Grandma by the name of his long-forgotten French mistress from WWII inciting immediate, if lethargic, violence. Ah, Family. Good times. You really don’t want to let your family lose their memories, do you? It’s also a good idea to print really valuable photos. The rumors of paper’s demise are greatly exaggerated. No Related Posts Share: Posted Mon, November 26, 2007 8:09am • (7) Comments • Permalink Comments Sat, January 05, 2008 2:13am[…] The Best Gift for Non-Geeks that isn’t on their list […] By Network Security Blog » Network Security Pod Sat, December 01, 2007 12:17pmCobian is fab for PC backups.  Easy to configure and schedule backups.  Can setup pre- and post-backup activities (e.g. shutdown and restart Outlook).  Usual range of backup types.  FREE! DVDs and CDs are good for occasional offline backups but are slow.  USB sticks and drives are faster but less resilient.  Use both types to reduce the risk of loss/failure. Make sure to test-restore your backups to a different disk drive (do NOT overwrite the original in case the backup/restore fails!) and make sure the expected data are all there.  This is especially important when you setup or change configurations. Store backup media securely, not with the machine being backed up or a fire or theft may destroy both.  Small fire safes designed to protect computer media are probably worth the money, even for the ordinary home PC user with valuable photos, emails and other files. G. By NoticeBored Tue, November 27, 2007 11:29pm[…] The Best Gift for Non-Geeks that isn’t on their list […] By Latest Network Security Podcast Up | securosis.com Tue, November 27, 2007 9:56am[…] The Best Gift for Non-Geeks that isn’t on their list […] By netsecpodcast.com » Blog Archive » Net Mon, November 26, 2007 10:28pmI had a hard drive die in my laptop earlier this year and ended up only losing a month or so of photos. But it still killed me. I’‘ve now got SuperDuper set to save me but I need another external drive to backup the backup! I also went through and burned a whole bunch of photos to DVD to put in my longterm archive. With enough space on a spare drive, Carbon Copy Cloner is a nice fast way to quickly restore an expired hard drive. By Erik Mon, November 26, 2007 7:54pmMozy is a simple online backup service for Macs and PCs.  (www.mozy.com)  If you’‘ve got a ton of data the first backup could take a while, but it’s incremental from there and totally automatic. If you’‘ve got more than one computer, you might give network attached storage (NAS) a hard look.  There’s cheaper options out there from the usual suspects in storage, but hands down the coolest and easiest I’‘ve seen is the NAS box from Drobo (www.drobo.com).  At $500 it’s certainly not cheap, but it sure makes NAS a no-brainer.  And the ability to pop bigger drives into the chassis as storage prices plummet while the Drobo takes care of everything is pretty sweet. By Ted J Mon, November 26, 2007 7:52pmI am a huge fan of Acronis for PCs. Scheduled backups, the ability to mount the backup as a drive on your PC to grab a previous version of a file. The ability to make SuperDuper-like complete bare-metal restores. It’s a great program. By rbp If you like to leave comments, and aren’t a spammer, register for the site and email us at info@securosis.com and we’ll turn off moderation for your account. Share:

Uh Oh. According to this article in CRN, encryption vendor Neoscale is insolvent and no longer selling maintenance contracts. NeoScale has stopped selling maintenance contracts for its data encryption appliance, effectively killing the line, while exploring “strategic alternatives” in the wake of the bankruptcy of storage VAR MTI, one of its largest solution providers. That “strategic alternative” could be an acquisition of all or part of the company by storage and security giant EMC (NYSE:EMC), or even Hewlett-Packard (NYSE:HPQ), according to former employees. While the encryption market isn’t nearly as big as most of the world wants you to believe, there should be plenty of business to support a company like Neoscale. My only conclusion is that there were serious execution errors, especially an apparently misplaced reliance on a single channel partner. I’ve heard nothing but good things about the Neoscale product line, but upcoming challenges would have forced them to sell to a larger platform vendor within 2 years. Most users I’ve talked with want their tape encryption integrated into their backup infrastructure (preferably at the drive level). The tape vendors have been quite vocal about their future plans, even if current implementations are extremely limited and harder to implement than Neoscale or Decru. Many mid-sized organizations also have difficulty in justifying the cost of an inline appliance. On the SAN/NAS front, where they also have products, there’s basically no market for inline encryption. The security benefits of encrypting a SAN are minimal; it’s only something you want to do if you’re worried about physical loss of the drives (a real risk, but not one all organizations face). That leaves key management- the mystical market all sorts of pundits and vendors are betting on as the next big thing, yet no one is, you know, actually buying. Neoscale’s key management appliance looks extremely interesting but it’s not something most organizations are interested in today. I’m very skeptical that there will ever be a stand-alone market for uber-key management to rule over everything from backup tape encryption to email encryption. I do, however, strongly believe that there are great opportunities for key management, just not as a stand-alone product. We’ll need key management for all that tape encryption, email encryption, database encryption, and even the occasional SAN or NAS encryption, but it needs to be integrated into that product line. Each kind of encryption solves a different business and security problem, and the key management needs to melt into the infrastructure and be tuned for that specific infrastructure. You’ll use one box to manage your storage encryption, another to manage database encryption, and another for email (or whatever). Some larger organizations might have another box hanging out on the back end for key archiving, but that’s about it. No one wants to manage keys, they just want it built into whatever encryption they’re doing at the time. The best opportunities for external key management will be in areas like database encryption, where the encryption engine is built into the various database products but there are no provisions for central management in a heterogenous environment. In those cases the external product will manage both the keys and the encryption implementation, leaving only the raw encryption to the native engine. But back to Neoscale. The Decru acquisition by NetApp hurt Neoscale badly, since large organizations prefer to work with a more established vendor when product functionality is close enough (which it is). Neoscale needed to sell, but either asked for too much or couldn’t find an interested partner. I’ve heard it was a combination of both. As moderate as the storage encryption market is today, Neoscale clearly screwed up execution so significantly that they are effectively out of business, if CRN is accurate. I’m not sure how they could do that and it raises material questions for any acquirer. EMC, HP, and a few others could clearly benefit from the Neoscale technology and integrate the key management across their product lines. It’s better than RSA’s key management (unless RSA has updated it) and well suited for integrating with their current offerings. EMC gains the added benefit of off the shelf datacenter encryption. I’d also consider Cisco, Seagate, IBM, and a few others as potential buyers. But the real question isn’t the technology, it’s the company. Neoscale’s prospects for rescue now depend entirely on the books- such a sudden demise raises very serious concerns for any buyer. If the financial side makes sense, I think EMC could do well to buy Neoscale and their recent acquisition string shows they have a strong interest in data security. I hope the technology survives- it’s good stuff, but it’s up to the accountants and Neoscale’s Board now… (Rob Newby alerted me to this development, but since he’s a nice guy and a competitor he didn’t feel it appropriate to comment himself). Share:

Based on the comments in my last post on DAM, especially the one from Mike Spiers, I want to make it clear that if you are performing Database Activity Monitoring it should be owned and managed by security. It’s fine for DBAs to manage regular database auditing (unless they’re the auditing target), but DAM is a security-specific tool whose primary benefits are to create separation of duties (from the DBAs) and to give security insight into the database. You might need DBAs to get it integrated with the database and confirm performance, but that’s where their involvement stops. Share:

I’m heading out to San Mateo and possibly Palo Alto next week, with a couple openings Thursday afternoon if anyone is around. Share:

Back in the comments to one of my posts on Database Activity Monitoring, Rani asked the question of who should own DAM? I’m going to expand the question to cover all of database security. This is a pretty tough question we can take in a couple of directions. Out at Oracle OpenWorld last week it was pretty clear that database professionals and security professionals don’t overlap nearly as much as we really need for efficient database security. It’s not a failing of any particular group, just the reality that people who do different jobs have different skill sets, even when they come from the same background. Come January I’ll be having an orthopedic surgeon fixing my bum shoulder, not my dermatologist. Security experts don’t necessarily know the difference between DML or DDL, or how to write an outside join, just as DBAs don’t necessarily know the difference between AES and 3DES. Eventually we’ll have a growing cadre of security-aware DBAs and database-aware security professionals. Until then we need to slice up the functions a bit and I highly recommend cross-training when you can. I’m not saying that long term we’ll have some uber-DBA/security experts running all database security without outside influence, but some of the functions might consolidate a bit once those skills are easier to find. Here’s how I slice it: DBAs are responsible for secure design and configuration of the database management system. A security architect can assist with security design review, but this is an ideal area to increase the security knowledge of the DBA. IT Security performs configuration and vulenrability scanning of the database. Results are passed to the database team for remediation, and if a policy violation can’t be fixed for some operational reason, security and the database team need to come up with a joint risk remediation plan that’s documented as an exception. Native database auditing is the responsibility of the DBAs. Management of those logs can be either security or the database team, depending on the purpose of the logs. If separation of duties is required, security becomes responsible for log aggregation and maintenance. Database Activity Monitoring is another joint process. DBAs are involved with the installation, database-side configuration, and maintenance of any database-resident components. Security owns the DAM tool and its ongoing operation. For this to work well, someone on the security team needs basic database training. In summary, DBAs are responsible for securely designing and configuring their systems, and installing and locally managing (just to keep them running) any database-resident security components that affect the database. Security is responsible for external monitoring and ongoing scanning of deployed systems. This creates a good separation of duties and allows each side to do what they’re best at. It relies on any DBA-installed components sending regular health checks/heartbeats back to security to make sure they aren’t disabled. I realize cross-team responsibilities like this can be difficult, but I don’t see any other better approach. In some cases I’ve seen someone on the database team be designated as being responsible for database security, but just remember you’ll lose separation of duties if that individual also has operational database duties. Share:

As most of you have probably figured out by now I tend to expend a lot of hot air trying to define DLP/CMF/CMP (Data Loss Prevention, Content Monitoring and Filtering, or Content Monitoring and Protection). I often take vendors to task for abusing the terms, since they are just increasing market confusion. As Rothman points out it won’t be me, or any particular vendor, that really defines DLP. Only the market defines the market, although some of us influential types occasionally get to nudge it in our preferred direction. While I took Postini/Google to task for calling regular expressions on a single channel (email) DLP, the dirty little secret of DLP is that probably 80-90% of deployments today rely mostly, or totally, on regex for content analysis. Barely anyone deploys the fancy advanced features that I spend so much time talking about, and that the vendors spend so much time developing. So why do I spend so much time fighting for the purity of DLP? It’s because most organizations, in the long run, will only get a fraction of the value of their investment in terms of risk reduction and operational efficiencies without us pushing the products forward with new features and more advanced analysis. But if all you want to do is detect on credit card and Social Security Numbers, and you find that the false positives are manageable, something with a regex engine is probably good enough for you. At least for now. Share:

Apple just released an update to Leopard, version 10.5.1. The support document says the following: Addresses a code signing issue; third-party applications can now run when included in the Application Firewall or when whitelisted in Parental Controls. In Security preferences’ Firewall tab, the “Block All” option is now called “Allow Only essential services” Well, I suppose that’s some kind of progress. At least it’s labelled accurately. I’ve been really slammed this week, but Chris and I should have the instructions for using WaterRoof in combination with our template ipfw rule set and the Application Firewall soon (hopefully today). I’ve tested the update and the application firewall still signs applications, but instead of just failing to launch modified applications, we’re now prompted to allow access manually again if they change. Code signing can be rough because of issues like this, and I think the prompt is a reasonable solution. However, I would prefer it to say, “This application has been modified since its last use; please click to allow network access” so we know that it’s a real change to the application and not just a random prompt to approve again. In a separate document, Apple details some additional security updates to the application firewall. Most notably, the firewall will now block processes running as root if you specify them in the application firewall. Based on these updates I’m now running the application firewall with ipfw, and will try and get those instructions posted soon. Not that any of this matters much since there are no network attacks on Macs in the wild right now, but we all know that can’t last… Share:

While I was off traveling, Martin posted the latest episode of the Network Security Podcast. Rather than posting the show notes here, I’d like to redirect you to our new site: NetSecPodcast.com. This is where we’ll be posting all the show notes, taking feedback on episodes, and posting any content and updates directly related to the show. This week we covered a few quick issues, then we spent 10 minutes playing Mystery Science Theater on Martin’s very first episode. Oh, I didn’t mention this is the 2 year anniversary of the show? Congrats Martin, and thanks for bringing me on- hopefully I’m not dragging the show down too fast… Share:

I’ve been invited to give the keynotes at both the SANS Data Leakage Summit and the Mobile Encryption Summit. Both are at the Dolphin hotel at Disney in Orlando. The DLP event is on December 3rd and 4th, and the encryption event on the 5th and 6th. Here’s my affiliate link to SANS if you’re interested in the events. At the DLP event I’ll be presenting Three Steps To Selecting A DLP Product And The Top Five Features To Look For. I’ll also be releasing Understanding And Selecting A Data Loss Prevention Solution as a white paper, which will also be distributed online by SANS and sponsored by Websense. Over at the encryption event I’m presenting Understanding and Preventing Data Breaches. It’s a general presentation, not specific to just encryption. These conferences are designed for those in the planning or implementation phases for DLP or mobile encryption. There are a couple of presentations like mine, but most of the event is panels with users with real experience using the products. As a preview, here’s a QuickTime movie of the DLP pitch’s opening. I hope to see you there… Share:

I was quite bemused today to read this article in NetworkWorld that Google’s Postini is jumping into DLP. Google”s Postini division today announced that its e-mail-content-filtering service has been enhanced to detect “logical expressions,” such as credit-card data and Social Security numbers. … Adam Swidler, Postini senior product manager, says the e-mail security service includes filtering of more “sophisticated expressions” that extend beyond Postini”s earlier limits to keywords. “This is for compliance and content-policy management, with content-based inspection for inbound and outbound traffic,” he says. “Today it’s for companies using Gmail, but we expect to extend this to instant messaging, the Web and the rest of Google Apps, like Google Spreadsheets.” I don’t see why they can’t just call it regular expressions like everyone else. This is a great example of a vendor hopping on the bandwagon by adding a small part of DLP functionality to a product line. Knowing the problems even established, dedicated DLP vendors have with false positives I suspect this will be a bit more challenging than Google/Postini realizes. Not that a basic DLP feature or two don’t have value in lower-risk environments; something as basic as this might work for some of you out there, as long as you manage your expectations. If anything, I think this, combined with the Vontu acquisition, might finally nudge DLP to the peak of the Hype Cycle. Share: