Skip to main content

Information Security - What does it mean to you? - Part 1

Sometimes the best way of trying to do something or explain what you want to do is to give it some analysis. Let's take a look at "Information Security" for a little bit today and see what that means to practitioners and companies at this point in time (2010).

First lets start with a trip in the way back machine - Set the way back to 1999!

1999 - The Internet (although not officially new) is "new" to many people and businesses as corporate America and the world begins a love affair with e-mail, "the web", and all things Inter/net/web. Speed and cool whiz-bang ideas are all the rage, few people care or think to care about the risks associated with allowing everyone to see/access most everything. The only folks who are concerned are mostly government officials, people with law enforcement mentalities/backgrounds, and paranoid sysadmins who have been fighting to preserve their systems for years.

In 1999 if you asked "what does Information Security mean to you" you would get different questions from various people who you asked.

If you asked:
a user -
"huh? why should I care about that? it's not like people can see my information"

a law enforcement professional -
"I wish I knew more about how to understand what the Internet can be used for and how I can get evidence and cooperation from ISP's when I have to try to investigate things"

a sysadmin -
"I build my systems securely, it's all of those applications that the users insist on installing that makes things crash!" "If you want something secure keep it off my server!"

At this point the concept of Information Security professionals are few and far between, most organizations are just coming to understand the need (unless they are in one of the more regulated industries like financial services. Even HIPAA at this point is just a theory and the security rules have not "gone live").

If you asked management if they understood Information Security and what they have done to maintain security in their organization you would likely get the response:

"Oh yeah! we have a firewall, and we have a process for rebooting it when it crashes, nothing gets in that we don't let in!"

At this point a lot of people had the mindset that the "good guys" were on the inside and the "bad guys" were on the outside and of course they would do as was expected and follow the unwritten rules of engagement and bounce harmlessly against the firewalls. Nothing could be further from the reality. "bad guys" being of questionable morality, and of uncertain motivations and means had no interest in being detected, or in following any rules. Exploitation of systems happened with astonishing speed and regularity, and eventually tools and malware was created to provide the "bad guy" with many options of how to enter an organization. As for motivation, what was once an academic pursuit evolved into theft (of information, data, intellectual property, personal data that could be resold or used to hack further into someone's accounts or to impersonate someone and benefit from this financially - Identity theft).

The poor folks that had the responsibility of handling any type of "incident" were usually under trained on what to look for, didn't have any tools at their disposal, and had little support from management (heck who wants to fund a team that only had bad news!). It was a tough start for our heroes.

To be continued...

Comments

Popular posts from this blog

Requirements for Information Security

If you want to get into Information Security you HAVE to be a/have this skill... Why this is total BS. Almost daily I see someone posting on twitter, trying to be helpful to folks who are looking to get into InfoSec. Often I see "If you want to be in Information Security (Cyber Security) then you HAVE to be a programmer" or "If you want to be successful you have to be a hacker/have a criminal record/have abused systems without permission" etc. While having technical capabilities (such as programming) and having the ability to compromise a system shows a specific skillset neither are required. When talking to people who are interested in Information Security I often refer to it as a cake, there are tons of slices, many flavors, many pieces and parts you can sample, choose to focus on, will be expected to know something about, etc. Incident Response and Forensics (my current focus) is not the only part of Information Security, and certainly not the only part tha...

Privacy considerations for home users

In light of the recent new stories regarding the recently signed legislation allowing ISP's to be able to sell your data http://www.vox.com/new-money/2017/3/29/15107110/republican-isp-data-privacy Here are a couple ideas and tips about privacy in general. Don't panic - a lot of the info was already being gathered, this isn't that large of a change regarding scope, it's more of a change to who can profit or sell it (which is a shift for sure). Remember a lot of the services you use today already gather your browser, activity, and search info (google, bing, yahoo, facebook, etc.). ISP's haven't implemented this yet, expect to see new terms of service in an upcoming bill, or an email sent to you, etc. If you would like to take some steps to try to preserve your privacy, here are some ideas and examples: VPN (Virtual Private Network) - this in essence creates an encrypted tunnel between two points on the Internet. One point being your system...

Busting the myth of the malicious insider

The Myth of the Insider Threat Too often after the announcement of a new breach, the first reaction from the victim company and the media is "another malicious insider attack".  Case in point, I was catching up on news from various sources and came across the following: http://www.idgconnect.com/abstract/19647/lessons-sage-leak " “We believe there has been some unauthorised access using an internal login to the data of a small number of our UK customers so we are working closely with the authorities to investigate the situation,” the Newcastle, England-headquartered firm said in a statement." Of course an internal login was used to access the data, as part of the attack lifecycle, during your reconnaissance phase you identify accounts to target for possible compromise, based on the access/role of the individual.   Phishing attacks or other simply attacks are often successful in gathering login credentials for individual users, which can then of...