Once again under the BIG TOP of Information Security

134 Pages·2014·26.31 MB·English

1 Cyber Warnings E-Magazine–January 2014 Edition
Copyright © Cyber Defense Magazine, All rights reserved worldwide
CONTENTS CYBER WARNINGS
Published monthly by Cyber Defense
Being One Step Ahead of the Next Threat….............................3 Magazine and distributed electronically via
opt-in Email, HTML, PDF and Online Flipbook
Encryption as a Service.............................................................6
formats.
Effectively removing the obstacles to cloud adoption.................6
PRESIDENT
How Government Organizations Can Stay Secure When Going
Mobile........................................................................................9
Stevin Victor
Don’t Get Washed Away by the Perfect Storm.........................11 [email protected]
Cloud Providers, Security Vendors, and You: Working Together EDITOR
for the Best Cyber Defense......................................................15
PierLuigi Paganini, CEH
Let’s Be Careful Out There: Securing File Transfers................18
[email protected]
Are You Flirting with Data Disaster?........................................21
Best Practices in Cybersecurity: Adopting a Cyber Playbook...23 ADVERTISING
Microsoft Leads the List of Most Vulnerable Vendors for 2013.26 Jessica Quinn
[email protected]
The Best Defense is aGood Offense.......................................31
BYOD security challenges: Protecting your enterprise data.....34
KEYWRITERS AND CONTRIBUTORS
Cyber Security ideas for small businesses...............................36
Pierluigi Paganini
How Proper Cyber Security can ensure a safe business?........39 J.R. Cunningham
The Next Generation of SIEM Can Be Found In Security Keith Ross
Analytics..................................................................................41
Håkan Saxmo
Understanding and Combating “Cyber Terrorism” at Jim DeMerlis
International Level...................................................................48
Shawn Sweeney
Effective use of DRM...............................................................51 Richard McMunn
One-stop Shopping Service for Storage System Configurations54 Milica Djekic
Amarish Pathak
Moving Security From the Mobile Back Burner........................57
Vinod Mohan
Reinforcing The Human Firewall..............................................59
Tony Perri
SaaS–A growing industry with a change of heart...................61
Peter Simon
State of Mergers and Acquisitions in the Cyber Defense World64 and many more…
Software-Based Authentication Delivers More Modern, More
Interested in writing for us:
Reliable and More Cost-Effective Security...............................71 [email protected]
IT Security: Not just important, it’s essential.............................74
CONTACT US:
A three step process to ensure there is no backdoor access to
your encrypted data.................................................................77 Cyber Defense Magazine
Top 3 Myths About Antivirus Software.....................................84
TollFree: [phone]
NSA Spying Concerns? Learn Counterveillance......................87 Fax: [phone]
SKYPE: cyber.defense
Top Twenty INFOSEC Open Sources......................................89 Magazine: http://www.cyberdefensemagazine.com
National Information Security Group Offers FREE Techtips.....90 Copyright (C)2014, Cyber Defense Magazine, a
division ofSTEVEN G. SAMUELS LLC
Job Opportunities....................................................................91 848 N. Rainbow Blvd. #4496, Las Vegas, NV 89107.
EIN: 454-18-8465, DUNS# 078358935.
Free Monthly Cyber Warnings Via Email..................................91 All rights reserved worldwide.
[email protected]
Cyber Warnings Newsflash forMarch2014.............................94
Executive Producer:
RSA Conference 2014 Trip Report: Special Supplement......124
Gary S. Miliefsky, CISSP®
2 Cyber Warnings E-Magazine–March2014 Edition
Copyright © Cyber Defense Magazine, All rights reserved worldwide
Being One Step Ahead of the Next Threat…
As spring is finally here, some of us will spend less time staring at our
SEIM and more time in the fresh outdoors. Financially, it’s in the best
interests of the unethical hackers and cyber criminals to step up their
game now. As the earth begins a rebirth of plant and animal life, we
should think about doing the same with our networks. Take a fresh look
at things this quarter –is it time for cyber spring cleaning? Yes. It is time
to begin scrubbing, cleaning, deleting, tuning, improving our computers,
our smartphones, our networks, etc. While every DNS cache needs a
daily refresh, so does our thought process on taking a more proactive approach to cyber security.
As we watch the numbers of cyber crime personally identifyable information (PII) breaches skyrocket
(see: http://www.privacyrights.org), we should realize that there could not be a better time to take a short
breather – a refresher. Maybe visit a trade show like RSA Conference or InfoSec World or plan for
Blackhat or Defcon and ultimately step up our game to be one step ahead of the next threat.
While mobile malware has been a big subject of late, I believe a deeper study of encryption, cloud
computer, cloud hardening, virtual machines and their vulnerabilities will be helpful for the year to come.
Even if we think our mobile devices don’t ever touch the cloud–they do every day.
Whether it’s running a netflix player, accidentally connecting to a command and control channel for a new
bitcoin harvesting botnet or working on a salesforce utility, we’re always ‘in the cloud’. Even some of the
largest Banks, to handle volume transactions have moved their servers into cloud-computing, for the
benefits of elasticity and scaleability. Let’s, in turn, take this spring to step up our game – to learn about
new tools and techniques and spring clean our networks for the year ahead.
We hope you enjoy this month’s edition, as we cover these and other exciting topics as well as a little
surprise trip report by our Executive Producer, from the RSA Conference 2014, where I wished to have
been but was unable to make the journey this year. I shall read his update and follow his leads and hope
you will do the same.
To ourfaithful readers, Enjoy,
Pierluigi Paganini
Pierluigi Paganini, Editor-in-Chief, [email protected]
P.S.CongratsCourtney Archibald(USA)–this month’s contestwinner!
3 Cyber Warnings E-Magazine–March2014 Edition
Copyright © Cyber Defense Magazine, All rights reserved worldwide
4 Cyber Warnings E-Magazine–March2014 Edition
Copyright © Cyber Defense Magazine, All rights reserved worldwide
5 Cyber Warnings E-Magazine–March2014 Edition
Copyright © Cyber Defense Magazine, All rights reserved worldwide
Encryption as a Service
Effectively removing the obstacles to cloud adoption
Although virtually all organizations from small businesses to large enterprises to government
departments see cloud as a vital element of their IT strategy, the reality is that for many years to
come, applications and computing will be distributed on a hybrid cloud architecture. The hybrid
cloud includes both the private cloud and a variety of public clouds that customers can change
out or add to the mix as business needs evolve.
Regardless of the deployment model, the cloud is clearly on its way to becoming the next
generation computing paradigm. If that’s the case, why aren’t more critical workloads running in
the public cloud? Is it possible there’s a storm brewing in the cloud that’s postponing
deployments?
The Cloud, Security and Cloud Security
While cloud deployments continue to take off, several challenges are thrown into the mix –cyber
surveillance, data remanence concerns, regulatory compliance laws, shared multi-tenant
infrastructure and advanced cyber-attacks. In fact, recent headlines reveal the obstacles for
keeping data safe include risks of intellectual property theft, insider data leaks and breaches, as
well as regulatory compliance fines. As organizations look to the cloud and forfeit elements of IT
control on the way, C-level executives and board members are sure to begin asking questions.
Who is watching their data? Are they still acting in accordance to compliances? What do we do
if we need to switch providers in the near future?
While not all of the questions need to be addressed at time of deployment, they are something
that must be thought through for the long term. For the initial deployment, the main issue when
moving critical enterprise workloads to the cloud—security—requires careful and some possible
forward-thinking planning. A new class of security is needed for the hybrid cloud environment.
Ideally, one that is easy to deploy, scales on demand, is adaptable in any environment, requires
minimal specialized IT training and ensures technology does not get in th`e way of business
operations.
Encryption for Cloud Security
The idea of encryption is not a new technology; in fact, it’s been securing connections for online
activities including banking, shopping and accessing email accounts for quite some time. Use in
the enterprise has been slower to adopt, however. Enterprise encryption has, traditionally, been
reserved for “elite” organizations with highly skilled IT staff, big budgets, targeted use cases and
implementations that place the burden of deciding when and what to encrypt on the end user.
6 Cyber Warnings E-Magazine–March2014 Edition
Copyright © Cyber Defense Magazine, All rights reserved worldwide
With the introduction of virtualization and transformation in how security is deployed, next-
generation data encryption solutions optimized for the cloud have emerged, allowing cloud
providers and managed service providers (MSP) to offer Encryption as-a-Service (EaaS). This
new offering provides all organizations with a simple and effective way to secure their sensitive
cloud data. Encrypting data in the cloud can help companies address a broad range of concerns
by protecting data from unwanted eyes and internal and external data theft as well as providing
a realistic way to destroy your data.
EaaS use cases are quite numerous with examples including:

securing hosted virtual desktops and associated user data;

securing content repositories such as MS SharePoint;

protecting the integrity of boot volume images;

encrypting critical workgroup files, folders;

and securing entire application stacks in very sensitive work environments.
Whatever the case may be, the concept of EaaS offers an elegant and effective solution to
segregate and protect data in a multi-tenant cloud architecture.
Offering Encryption as a Service
Although there are many technical approaches, typically EaaS involves the cloud service
provider deploying a virtual storage encryption appliance that logically resides between the
customer’s application and/or workload and cloud providers physical storage array. Provisioning
and deployment is easy as customers merely need to mount the storage encryption appliance
as the target storage location using standard interfaces such as NFS, CIFS & iSCSI.
Vital to success in encryption is the key control as the key manager ultimately determines who
has access to the encrypted data. Best practices place encryption and security keys in the
hands of the data owner and not the cloud provider. More mature EaaS offerings offer the ability
for the customer to extend data encryption to secure workloads in other parts of their cloud,
including the private data center or even other public cloud instances. As a result, the customer
has full control over their data wherever it may be hosted throughout their hybrid cloud.
EaaS provides cloud customers a simple data security solution that solves some of the top
hesitations associated with moving enterprise workloads to the cloud. Essentially, by instilling
trust and removing barriers, EaaS becomes a cloud-enabler. For cloud service providers, the
technology enables new value-added services to be offered on top of existing as-a-Service
offerings, driving new revenue streams and providing competitive differentiation from other
service providers in a crowded marketplace.
7 Cyber Warnings E-Magazine–March2014 Edition
Copyright © Cyber Defense Magazine, All rights reserved worldwide
Moving to the Cloud
Ultimately, the benefits of moving to the cloud can outweigh the concerns over security. When
looking to secure critical workloads, keep in mind these simple questions:

What levels of encryption granularity are supported? For example, block storage, file
storage, data volume, boot volume, file, folder, or full application lockdown

Does the solution span private, hybrid and multi-tenant clouds?

How is the solution deployed? Does my company need to modify its workloads or is it
transparent?

How is key management supported? Can customers control the keys?
Whether your cloud strategy involves simply backing up enterprise data to a service provider or
is as elaborate as building a multi-tenant hybrid cloud that includes a mix of private data center
and multiple public clouds to support a group of internal departments, data encryption designed
specifically for virtualized environments offers a simple and effective approach to securing
sensitive data.
Commentary provided by: Mike Byrnes, AFORE Director of Marketing
Mike Byrnes serves as AFORE Director of Marketing with 20 years’ experience in technology
product marketing with a focus on internet security and business communication systems. Prior
to AFORE, Mike led product marketing for Entrust multi-factor authentication and fraud
detection product lines and held previous roles with Nortel Networks and Mitel Networks.
8 Cyber Warnings E-Magazine–March2014 Edition
Copyright © Cyber Defense Magazine, All rights reserved worldwide
How Government Organizations Can Stay Secure When Going
Mobile
by Mark Williams, Director of Government Solutions, AirWatch by VMware
As mobile devices continue to infiltrate government organizations, the demand for secure
mobile solutions is growing rapidly. According to a Mobile Work Exchange report, 41 percent of
government employees are putting themselves and their agencies at risk with their existing
mobile device habits. With this rise in demand for mobile devices within government
organizations, an increasing number of employees are utilizing consumer-grade solutions to
secure mobile devices for work purposes. Encouraging employees to use mobile devices at
work without the right resources is an intimidating prospect for government groups whose
highest priority is protecting sensitive data. However, resources such as mobile device
management (MDM), app scanning and the shift to the personal cloud can be deployed to
manage the devices within the organization. Once a government organization is armed with the
correct tools for MDM, it can empower employees with mobile devices while ensuring that
sensitive data and employee information is secure.
Increase Data Protection with Multiple Layers of Security
As more government processes are extended to mobile, many organizations are finding uses
for both MDM and containerization, either for different deployments or on the same device.
Government organizations that have highly sensitive or proprietary content may prefer the
added security that MDM and containerization on the same device provides. A corporate
container deployed on a managed device provides an extra barrier to access government
content. Users are required to enter both a device-level passcode and a container-level
passcode, and administrators have both device-level controls and application-level controls that
enable app-to-app collaboration with other managed and secure applications within the
container.
This approach creates a sense of segmentation between work and play for end users, bringing
a dual-persona feel to managed devices by isolating government content inside a secure
container. MDM and containerization are often thought of as mutually exclusive security
solutions, but today’s most innovative organizations are taking a layered approach to security by
using the two in conjunction.
Adopt App Wrapping to Protect Personal Privacy and Information Security
In addition to third-party applications, many government organizations are building internal
applications for specific business and employee roles. However, IT must ensure the applications
are secured and data isn’t compromised, whether applications are installed on corporate-owned
or Bring Your Own Device (BYOD) devices.
App wrapping gives existing internal applications an extra level of security and management
capabilities, without further requiring development or code change. With injected code,
developers benefit by not spending time coding for additional features. Possible app wrapping
9 Cyber Warnings E-Magazine–March2014 Edition
Copyright © Cyber Defense Magazine, All rights reserved worldwide
capabilities include, restricting application access and securing data at rest with data encryption
and in transit. Data loss prevention (DLP) restrictions can prevent copy/ paste, printing, screen
capture, Bluetooth and opening files in other applications. Administrators can restrict access to
an app based on network connectivity like cellular connection or roaming status. IT can wipe
local app data and block app access completely if a device is compromised. Additionally, a
simplified user experience can be enabled with single sign-on user authentication.
Shift to Personal Cloud to Increase Data Protection
The personal cloud is the realization of four different types of experiences that enable users to
store, synchronize, stream and share content on a contextual basis, moving from one platform,
screen and location to another. The era of personal cloud will bring about a shift away from
devices and toward services. The specifics of devices will become less of a concern for
businesses, although they will still be a necessity in the workplace. A PC will remain one option
for employees, but they won’t rely on it as a primary device when a multitude of options are
available - the personal cloud will take on that role. Access to the cloud and the content stored
or shared from the cloud will be managed and secured, rather than solely focused on the device
itself. To prepare for this shift, IT administrators should identify potential security risks early on,
including data leakage from non-corporate devices.
When it comes to adopting any new technology, the less time government organizations spend
worrying about the security on devices, the more they can focus on driving core business
strategies. Therefore, understanding the best mobile practices empowering government
organizations becomes vital to the mobility strategy. With the right mobility tools and secure
access to data, government employees can become even more effective, productive and
efficient.
About The Author
Mark Williams, Director of Government Solutions, AirWatch by VMware
Mark Williams manages product development and sales activities for government customers at AirWatch
by VMware, the leading enterprise mobility management (EMM) provider. During his time at the company,
he has won various contract awards for some of the most notable accounts in the government sector.
Williams brings more than 20 years of mobility experience to AirWatch with technology sales focusing on
federal government clients.
Prior to joining AirWatch, Williams led Federal Government sales for Good Technology, building
successful sales teams and driving record results in the government vertical. He has also held senior
sales and management roles at AT&T and Octel Communications. While at AT&T, he initiated
government contractor sales in Washington, DC. During his tenure at Octel, he built out the company’s
sales teams before the company was acquired for $2 billion by Lucent.
Williams is a proud member of the Armed Forces Communications and Electronics Association (AFCEA)
and the Northern Virginia Technology Council (NVTC). He earned his bachelor’s degree in business
administration, majoring in marketing and management at James Madison University.
10 Cyber Warnings E-Magazine–March2014 Edition
Copyright © Cyber Defense Magazine, All rights reserved worldwide