Category Archives: Security

History, Security

Sleep and the 25% breached

Leave a comment

CDW has published a Data Loss Straw Poll with the headline “One in four organizations has experienced a data loss in the last two years.”

CDW’s Data Loss Straw Poll surveyed 654 IT professionals from business, financial services, healthcare and higher education about data loss and what’s still keeping them up at night.

That is a typically low sample. As I have explained in my RSA presentations since 2009, sample size really does matter. There are nearly 6 million companies in America. Are we confident to extrapolate from these 654 people?

They also make a strange assumption that IT managers actually sleep at night. I thought the whole idea of alerts and mobile devices was to prevent anyone in IT from ever sleeping again. CDW’s report centers around the obvious connection between a device that is always with you, delivering bad news, and a resulting anxiety that makes it difficult to relax or rest.

DATA LOSS = SLEEP LOSS […] MOBILITY TRIGGERS SLEEPLESS NIGHTS

I think it’s more accurate to say change triggers sleepless nights. Mobility is not new, but the changes in mobility that has been driven by consumers keeps IT from settling down. CDW also tries to make a statement of who is less tired, but I don’t buy this analysis at all:

Financial services organizations can sleep more soundly than their colleagues in other markets

I could make the argument, for example, that those sleeping more soundly have their phones turned off, or have their alerts disabled, or are simply unable to detect issues in real-time — they wake up rested and only then discover data loss. So there’s a false dichotomy of sleep versus security. You might actually be more secure when you are losing sleep…SLEEP LOSS = SAFETY?

In my 2010 presentation at RSA I used the Siege of Yodfat in 67 CE as an example of this exact issue.

The sentries slept at a particular time. An insider leaked that information to the Roman armies and enabled them to finally breach an impenetrable perimeter. In other words, they slept soundly because they thought they were safe enough to rest, which actually in itself created a weakness. The flip side of this argument is sustainability. Sleep loss is a resource management issue and begs the question of reserves, offsets (e.g. Basel II), etc. but rather than get into the deeper economics and history of managing loss here (I do that in my presentations) I just wanted to point out that the CDW report needs further analysis.

Security

US Gov Drops Oracle

2 Comments

The U.S. General Services Administration has announced Oracle’s contract is cancelled.

April 18, 2012: Oracle no longer available on IT Schedule 70

Effective May 17, 2012, IT Schedule 70 is canceling [sic] Oracle America’s Schedule contract GS-35F-0009T in accordance with GSAR 552.238-73, Cancellation.

This is a big step up from just issuing fines for non-compliance issues. Oracle has been in trouble with regulators lately, as reported by major news sources.

Le FBI et le ministère de la justice américain ont ouvert une enquête visant le géant du logiciel Oracle, soupçonné d’avoir versé des pots-de-vin pour obtenir des marchés dans des pays africains, révèle le Wall Street Journal.

That’s French for Oracle has been importing a suspiciously large amount of wine to Africa. I have heard people say Oracle databases make them whine, but I had no idea it was criminal…bada bing. I’ll be here all week.

It seems that the recent compliance enforcement efforts related to civil and criminal investigations such as fraud / overcharging the goverment and false advertising has not done enough to course-correct Oracle management so the U.S. government has made the public decision to terminate the relationship.

Energy, Security

Co-tenancy risk for Polar Bears

Leave a comment

I get asked all the time whether it is “safe enough” to run different levels of security on the same physical hardware if you have a hypervisor separating the load. The answer is, of course, it depends. We have complex control models and detailed explanations that prove hypervisors can reach even the highest (e.g. FISMA High) level of measurement. But the issue is really not about controls available, it is about management decisions and configuration.

To put co-tenancy in a broader context, consider the latest decision by the Obama administration regarding the obvious plight of Polar Bears. The U.S. Fish and Wildlife Service today published in the Federal Register a proposed rule and draft environmental study. This new draft is meant to replace a Bush administration 2008 attempt at a rule that was voided in 2011 by federal court. The public has two months to comment and already there is a clear backlash based on broad risks of co-tenancy.

A proposed rule aimed at protecting endangered polar bears doesn’t even mention how the federal government will address global warming, which is seen as the primary threat to the Arctic predators.

[…]

Both the current proposal and the previous Bush rule exclude activities occurring outside the range of polar bears — such as the greenhouse gas emissions of industrial polluters like coal plants — from regulations that could help stop the bear’s extinction.

Unfortunately, it seems bears have no service level agreement with their provider that they can use for leverage against the harm that is coming from their neighbours. The administration also presents an interesting argument against controls that seems completely upside-down.

In the new environmental assessment, Fish and Wildlife managers argued that not issuing an exemption for harm to polar bears outside the Arctic would lead to a plethora of citizens’ lawsuits which, the agency said, had little chance of prevailing. Such suits would take up agency staffers’ time that could better be spent helping polar bears, they said.