Secure Value

Gap between what employees think and do versus what employers think and do

Last week I gave a Lunch and Learn Presentation to a group of business people and enterpreneurs at the Dublin Chamber of Commerce on Living Securly in a Digital World. 

Researching the topic for fresh material I tripped across a Unisys study that shows a disturbing gap between what employees and what employers think about data use in the  enterprise:

• While 67% can access non-work-related websites only 44% of employers agree.
• While 52% of workers say they can store personal data on the company network only 37% of employers agree.

Do you have that same perception gap in your company?

As an employer it may mean behaviors you don't want, non-productive sites visited during work time or worse, malware introduced into the company network. As an employer, it may also mean extra storage costs or extremely awkward moments during terminations (can I have my data back?!).

As an employee, it may mean a disciplinary action for what you think is approved or allowed behavior.  And more importantly it might mean loss of personal data an information if you lose or leave your job (or the company closes).

It is in the best interests of both sides of this divide to close the gap.

What life tasks do you do online?

I am giving a talk to the Dublin Chamber of Commerce this Thursday on Living Securely in a Digital World.  As I've started preparing my presentation I've come to realize that almost everything we do or have done in the analog (fancy name for "real world") we can now do in the digital world.  I'm going to talk from  frmy experience, but I'd like yours as well.  Here are some things I do online that used to be real world things for me ... would you share your list?

• Communicate with friends
• Search for employees
• Plan and record my workouts
• Plan travel
• Maps
• Look up recipes
• Bank
• Invest
• Pay bills
• Stay informed
• Monitor boys homework
• Write and publish

ISACA-Central Ohio Luncheon RSA Anatomy of a Attack this Thursday, September 8th

The ISACA-Central Ohio Chapter hosts its first luncheon seminar for the 2010-2011 program year on Thursday, September 8.

RSA will be sharing Anatomy of an Attack discussing details fot he attack they suffered earlier this year.  If you aren't an ISACA member yet are keyed in on info sec topics this might be a good meeting to check the group out. 

Please see the ISACA website at http://www.isaca-centralohio.org/meeting.cfm to register. Registration deadline is Wednesday, September 7 at noon.

Presentation Abstract:

On March 17, 2011,  RSA disclosed that it was the target of a sophisticated attack.  During this presentation, RSA will share the specifics of the attack including the details on the initial infiltration, exfiltration of data, and how RSA identified the attack in progress.  In addition to the attack details, RSA will provide lessons learned and best practices that many organizations can use to protect themselves from these targeted attacks.  Finally, the discussion will focus on potential attacks against RSA SecurID  deployments and how organizations can protect themselves. 

Agenda:

• RSA Attack Overview
• Security Best Practices/Lessons Learned
• Social Engineering Attack Vectors against Enterprise RSA SecurID deployments

Location

Brio - MAP

1500 Polaris Parkway

Columbus OH 43240

Times

11:15am - 11:30am: Sign-in

11:30am – Lunch Served

12:10pm – Speaker Presentation Starts

 Cost

$20 - Members

$30 - Non-Members

$5 - Students

Speaker

Kevin Flanagan, CISSP, CISA

Manager, Sales Engineering

RSA, The Security Division of EMC

 

Menu

Brio Chopped Salad, Pasta Pomodoro, Chicken Limone, Roasted Vegetables, Vanilla Crème Brulee, Milk Chocolate Caramel Cake.

Jacadis Participates in August 23rd ISACA e-Symposium on Protecting your Enterprise with Comprehensive Application Security'

Jacadis' own Jerod Brennen on panel for ISACA e-Symposium, 'Protecting your Enterprise with Comprehensive Application Security' will start at 8:00am PDT / 11:00am EDT / 4:00pm BST.

Please go to http://isaca.brighttalk.com/ click on the enter event button on your screen to launch the live event. If you hear music, the event hasn't started yet.

If you are not logged in already, you will be prompted to input your username and password under the 'Profile' area and hit submit.

Conference Speakers & Topics:

Ted Julian, Chief Marketing Officer, Co3 Systems speaking on
"When Application Security Fails: Data Loss Incident Management Best Practices"

Jerod Brennen, Principal Security Consultant, Jacadis speaking on
"Application Security 101 - Back to the Basics"

Steve Hunt, Senior Manager, Crowe Horwath LLP speaking on
"Application Controls: An Internal Auditor's Perspective"

Mike O. Villegas, Director of Information Security, Newegg speaking on
"Advanced Web Application Security Techniques"

Closing Comments by
Aleese Eckenrode, Education Coordinator, ISACA

This e-Symposium qualifies for 3 CPE points.

Protecting your children online

Summer is well upon us.  In Columbus as I write this we are under a heat advisory and a storm warning.  Screens as we call them in our house or that collection of devices with monitors such as computers, gaming systems, phones and, of course, the old stand-by television offer an attractive way for many of our kids to while away their days (and sometimes nights).

Online gaming, social media and texting offer an easy way for our children to stay in touch with friends out of school.  But those same tools also offer our kids a touch of danger.

How do you protect your children online?

First, be aware that there can be an issue but that being online doesn’t mean that there are issues.  There is more good than bad online.  My kids use their “screens” to interact with friends and family long distance, share music, learn new things about their hobbies in sports and music as well as entertain themselves.  I think they get more benefit than danger. 

But you still need to be aware of the dangers:

1. Data theft such as stolen passwords, Social Security numbers, credit card numbers and other financial information.  Children are great targets for identify theft.  They have clean credit histories and can go years without knowing they have been compromised. 
2. Malicious software  such as adware, spyware, viruses, and the like.  Children aren’t any more susceptible to malicious software than adults are but often when we are hired to clean an executives computer we find that a game download was the beginning of the problem as kids just want to get back to their online fun and are more apt to just keep clicking “OK” until their game returns.  And then if the computer “blows up” after the last “OK” click they quietly leave the computer for someone else to find the problem.
3. Inappropriate content such as pornography, content focused on violence, hate propaganda or other things that are inappropriate to your family’s values. 
4. Cyberbullying which is just a fancy name for when the old school yard bully takes to the online world.  Cyberbullying can take on the guise of bullying peers via instant messages, texts, social networking sites, online games and other public forums.
5. Predators which NBC’s Dateline has done a good job of highlighting through several episodes can hang out in social networking sites and chat rooms looking for vulnerable kids.

Second, help your kids use social media safely.  As a society we talk to our kids about stranger dangers and about the dangers of Halloween candy.  We don’t do was well talking to them about some of the real dangers of social media.

1. Be friends with and interact with them online.  Read their posts.  Comment back.  Ask about the friends they have.  Don’t feel like you are interfering with their development to hold them accountable.  I can in fact tell you which of my boys’ friends have parents who read their Facebook wall and those that don’t.
2. Set some basic rules for use.  Set an expectation that you can read their messages whenever you want.  Limit the times and the amount of time they can access screens.   Have them only be online in public areas of the house so that you can see what is on the screen.
3. Caution them about choosing their online friends wisely.
4. Encourage kids to keep passwords and personal information to themselves.  Teen Angels of Wired Safety.org reports from one of their studies that 75 percent of 8- to 9-year olds shared passwords with someone else, and 66 percent of girls, grades 7-12, said they shared their password with someone else.  Kids are also more open to sharing personal information online. 

 Here are some sites that provide additional details in helping you protect your kids online:

FBI

OnGuard Online

Microsoft Family Safety

 

 FBI

 

 

Related articles

• Ten Safe Social Networking Sites For Kids (npr.org)
• Bullying Prevention: At School and Online (education.com)

Columbus Breakfast (Coffee, too!) and Learn: HIPAA/HITECH Panel Discussion

Image via CrunchBase

Are you facing HIPAA/HITECH concerns? Come join in open discussion with the panelists! 

HIPAA/HITECH Panel Discussion - Sponsored by PacketMotion and Jacadis Information Security Solutions

When: 

Thursday, June 23rd, 2011 from 7:30 am — 9:00 am

Breakfast will be provided (coffee too!)

Free to attend, space is limited

Where:

TechColumbus, Main Conference Room
1275 Kinnear Rd
Columbus, OH 43212

Click here to Register:

http://www.techcolumbus.org/hipaahitech-panel-discussion-sponsored-packetmotion-and-jacadis

Discussion Topics:

• IT management perspectives on HIPAA/HITECH and medical record privacy
• HIPAA is a floor, what state level considerations should you also be concerned with?
• How to operationalize your privacy and security programs for continuous compliance?
• Join legal, privacy and compliance experts in live discussions

 

Related articles

• Are you HIPAA Compliant? Are you sure? How do you know? (secure-value.com)
• HIPAA Compliance Requires You Know Something About HIPAA (secure-value.com)
• HHS Proposes Changes To HIPAA Privacy Rule (informationweek.com)

Epsilon and Consumers Discussion with Gail Hogan of Daytime Columbus on WCMH

Image via Wikipedia

This is the video of my April visit with Gail Hogan on her show Daytime Columbus on WCMH.  Gail's been great in helping us share with the average technology user some of the things that must be done to live securely in a digital world.

 

Jacadis Finalist for 2011 Ohio Chamber Excellence in Entrepreneurship Award

Today my wife and I attend the Ohio Chamber of Commerce's annual meeting.  Our 
local community through the Hilliard Chamber of Commerce nominated Jacadis for the 2011 Ohio Chamber Excellence in Entrepreneurship Award. 

I am generally cynical about awards in the technology space because so many are self nominated.  Our nomination for the Ohio Chamber Excellence in Entrepreneurship Award as well as our 2010 Hilliard Chamber Emerging Business award and our 2008 Campus Technology Security Innovator Award are special because others were motivated by who we are to nominate us.  That extra attention feels good for the whole Jacadis team.

The Ohio Chamber Excellence in Entrepreneurship Award was designed to identify, honor and financially assist a company in Ohio which is demonstrating the historical innovative spirit of our state. We think we do that in our market and we think we do it in a way, with more than 60% of our clients being outside of the state of Ohio, that promotes Ohio's economy.

I work with business leaders fearful that they aren't operating securely and, more and more, just as fearful they aren't following government regulations.  Jacadis helps those leaders and their technology teams determine whether they are secure in today's digital world.  If we find the are not we provide a roadmap to follow to get there -- and stay there.

SecureSight, our flagship assessment service, was developed to help organizations ensure the confidentiality, integrity, and availability of their critical information systems. Many firms rely on a "best practice" security assessment where they have a third party, a Jacadis or one of our competitors, review their security posture.

Many of our clients have found that the traditional process of an annual security assessment leaves them exposed for months at a time, with little to no visibility into that exposure. SecureSight closed that gap, bringing visibility & increased security to our clients, preventing slippage into an insecure state.

It is simple and practical really. 

We conduct an annual assessment, set up tools for your technology team to have visibility to the security of your environment and identify your gaps and recommendations to close them.  We recommend technologies or process changes for your team to make, and then are available to work alongside you as needed to implement those changes.

We like to say the Threats to your Data never go away. 

Well neither do we. 

The unique part of SecureSight is we maintain a coaching or mentoring relationship throughout the year.  That uniqeness saw Jacadis recognized by Campus Technology in 2008. 

SecureSight 1.0 answered the questions are you secure? And are you vulnerable?

In 2011, Jacadis will introduce SecureSight 2.0.

With the advent of SecureSight 2.0 we will be answering an additional question: Are you compliant?

Companies today need to be concerned with being compliant as well as being secure.  Focusing solely on compliace creates insecure pockets in your business.  Focusing solely on security may mean your business runs the risk of fines, penalties or some other loss simply because you are not doing the mandated way.  A well founded risk management program balances both security and compliance so that your business, as efficiently as possible, can proclaim we are both secure and compliant.

We are applying the same thinking to answering the "Are you compliant question?"  Government regulations never go away.  And neither should your compliance partner.

It is this new innovation in our award winning service that we are competing for Excellence honors with 25 other Ohio firms. 

Are you HIPAA Compliant? Are you sure? How do you know?

If you are looking to answer that question and others surrounding your HIPAA compliance please join me on Wednesday, May 4th for Jacadis' webinar "Are you HIPAA Compliant"? 

Preregister so we can expect you coming.  I'll make sure we cover content specific to your type of business (provider, business associate, etc.).

A detailed agenda is available on the registration page, here is a quick outline of what we cover:

• Review Health privacy and security including HIPAA, its history and the updates from HITECH
• Learn about major changes brought about by The HITECH Act
• Learn practical, actionable steps to take today to mitigate risk and help assure compliance           

Related articles

• HIPAA Compliance Requires You Know Something About HIPAA (secure-value.com)
• We Don't Think We Are HIPAA Compliant, Where Do We Start? (secure-value.com)
• HIPAA-HITECH Compliance -- Jacadis Webinar: Are you compliant? (secure-value.com)
• HIPAA Privacy Compliant in 2003? What about now? (secure-value.com)
• HIPAA Information Inventory Requires 2 Perspectives to Get it Right (secure-value.com)

Spring Cleaning Your Computer

Image via Wikipedia

Today we are joining Gail Hogan on Daytime Columbus.  We do a spot about once a month.  We were going to do a spot on Spring Cleaning your computer for security recommending that before the nice weather hits you do a quick clean up of your computers to make sure your workspace and playspace is secure. 

But some news from last week changed our approach somewhat.  With the following announcement on its web site, Epsilon sparked an internet buzz the first week of April:

On March 30th, an incident was detected where a subset* of Epsilon clients' customer data were exposed by an unauthorized entry into Epsilon's email system. The information that was obtained was limited to email addresses and/or customer names only. A rigorous assessment determined that no other personal identifiable information associated with those names was at risk. A full investigation is currently underway.

Last week, the week following this announcement the internet world was abuzz.  More than 50 companies were affected by the breach including such brands as Kroger, JPMorganChase, Victoria’s Secret, and Verizon.

The entire list of companies wasn’t immediately published.  The announcements came in ones and twos of companies joining the slowly growing list which fanned the flames.   The story was in major news outlets, was a major search item on google and caught the attention of many geeks on Twitter.

As the week ended many of us had received email notices from the companies we do business with that had made the list.  For those without security chops there was a lot of confusion.

What was lost?

Emails and emails associated with names.  Based on preliminary investigations generally everyone agrees that no confidential data was compromised. 

What if I got a notice?

It truly isn’t the end of your digital world.  At worst case the hacker got your email address and your name.  No account information or other confidential information from any of the companies affected or their customers was taken.  So there is no immediate threat.

Does that mean it is perfectly safe?

If you are going live a digital life your private information is never going to be “perfectly safe.” The information stolen could be used to send targeted attacks to the customers of Epsilon's clients and that might put you at risk in two ways:

• Targeted phishing or spear phishing attacks that look like legitimate messages from any of these companies are likely to be in our future. Know how to protect yourself from phishing attacks.

(NOTE: Sorry, we in the computer industry just make up words and then expect everybody to know what we are talking about.  Spam is unwanted email.  Phishing is when spam is sent as bait with some call to action to trick you into giving up valued information usually personal details and account information.  Spear phishing are emails targeted at individuals with some call to action to trick you into giving up that same kind of information.   An email from a bank you do business with addressed to you personally is much more likely to trick you than an email addressed to “Dear Bank Customer”.)

• Accounts that depend on your email address might be at risk.  If you have one of those accounts and you likely do I suggest you follow the recommendations below.

What should I do?

• Take the time to list your critical accounts.  Do it on piece of scrap paper.  Tear it up and throw it out when you are done.  My list includes my bank, my 401k, my company’s benefits site, my blog and about 25 other web sites .  For each of those accounts change your passwords and make them strong passwords.

• Update your operating system and any installed software.  You’ll do this by going to each software publisher (Microsoft, Apple, Adobe, etc.) and loading service packs, patches and updates.
• Update each of the web browsers installed on your computer.  You can do this manually or use a handy tool from one of our partners, Qualys.
• Remove programs you no longer use.  My kids install games and get bored.  My wife plays around with demo software to support her photography hobby.  I download tools for a specific client project and then don't use them again (OK, I also install games and get bored).  Those old unused programs take up resources on your compture.  They may be a security vulnerability. Two good reasons to get rid of them.
• Back up your data! 

We are on Daytime Columbus about once a month.  My firm, Jacadis, is an information security firm that works with business clients.  We participate with Gail's show sharing what we know to consumers and other computer users.  Are you a Daytime Columbus regular? Have you seen us more than once? Are we answering your computer security questions? Do you have others? I'd love to hear from you.