Scott Wright’s Security Views

In the last while, I haven’t heard much about Data Integrity in the news. I guess that’s a good thing. Nothing to worry about, right? I doubt it. What is one of the worst threat scenarios you could imagine in your enterprise? Identity theft, credit card fraud, data compromise? Maybe. But what if someone is able to gain access to a key database server in your operations zone? Has anyone considered what could happen if the culprit was sympathetic with your competitor, or had an axe to grind with your organization’s management? Continue Reading »

Policy is such a strange word. It can mean so many things in different contexts. Doing a Google search for “What is a security policy?”, I got some interesting results… including “A set of rules that says who can do what to whom”… really? The vast majority of search results I obtained relate to IT Security Policies. That’s not a bad thing, necessarily. But suppose you’re a Chief Security Officer. There’s more to your world than IT Security. Doesn’t a Security Policy deal with other things in “meatspace” (see my “Vernacular” section)? Continue Reading »

Sometimes even the most innocent little thing has a security risk attached to it. When you are sent a good joke or, heaven forbid, a cool animated novelty email, it’s easy to imagine that many of your friends would like to see it, too. While some are legitimate, many of the novelty emails are hiding a malicious program that will infect machines when opened. Let’s assume that you, or your organization have had it drilled into your head not to open email attachments from people you don’t know or trust. That’s great. Now, take a look at the recipient list on those emails you have received and forwarded on to all your friends. Does it show the names and email addresses of others who received it? That’s a BAD thing. Continue Reading »

What’s interesting to me is the difference between what we think we need now, and what will help us get to a better place. The questions we ask may be what determines how soon we get there. (Deep, I know, but there is a simple point I’m leading to.) To paraphrase Bruce Schneier, we shouldn’t worry too much about the bad things in the news because they hardly ever happen… that’s why it’s called NEWS.

If we had a better security awareness model, we might start asking better questions. Continue Reading »

It seems that Voice-Over-IP (VOIP) is a technology that will inevitably spread to every corner of the space-time continuum. Things like this don’t spread unless there is a real economic value to somebody. So, what does this mean for enterprises? Are employees installing VOIP phone software like SKYPE on your organization’s computers? Are they loaded with spyware? It’s probably not as bad as it might sound, but there are VOIP security issues that impact the enterprise, regardless of whether it is a sanctioned practice or not. Continue Reading »

Mike Rothman, the Pragmatic CSO, feels that McAfee is making a big Hullabaloo (my paraphrasing - with the obligatory apologies to any Hullabaloonians in the crowd) about Mobile Security Risk Management that nobody is likely to buy. I agree that there’s probably nobody to sell the idea to right now who has the money to do anything about it except the carrier networks. But as I understand it, once SPAM, SPLOG and SPIT become somewhat less easy to exploit (isn’t VISTA supposed to help there?), the perps will move on to the next easily exploitable medium. Continue Reading »

One aspect of IT Security that always seems lacking is in the treatment of Security Awareness, both within organizations and with individual citizens. The book that led me to create this blog, What No One Ever Tells You About Blogging and Podcasting : Real-Life Advice from 101 People Who Successfully Leverage the Power of the Blogosphere by Ted Demopoulos, had a lot of great ideas that can apply to creating a blog on IT Security. One valuable use of blogs can be to enhance Security Awareness within an organization. Continue Reading »

In the last of 6 episodes in the podcast series at “Security Round Table“, there was a great discussion on Instant Messaging security issues. One of the most interesting aspects of the discussion was on whether enterprises would try to completely lock down IM facilities so that people couldn’t use it for personal “unproductive” chatting. Continue Reading »