This is an exclusive provided by SLC Security Services LLC the leader in Medical, Compliance and DOD Auditing Solutions.
Number 10 on the list is attacks on your Disaster Recovery Plan or Third Parties that handle your data. We are seeing more and more third party vendors of large companies open them up to compromise due to standards not being in place and no auditing of third parties that you share data.
If you remember Target this was a perfect example whereas their air conditioning contractor failed to secure their network and malware was introduced via this path. Many times businesses open up firewalls to vendors without any auditing and verification of what data is moving through those trusted connections. Here are some recommendations to prevent your vendors from allowing a hacker to jump through a third party and gain access to unauthorized resources.
1. Even though a vendor may be "trusted" they should only be trusted to particular systems. The systems should not reside in your network. Host that data in a separate network segment that you can introduce DLP or monitoring protections such as IPS and IDS and make sure you are alerted if any attempts are made to access resources other than the destinations you have authorized.
2. Grant the least access required. Open only single IP and services in your firewall. Don't completely allow them to access any resource on your internal networks.
3. ENCRYPT YOUR DATA as it leaves your network. Ensure that information that is taken is encrypted. This prevents somebody other than your vendor from accessing data in which they are not authorized to view. Use time based encryption so that the keys are generated and discarded daily using security devices made for this purpose.
4. Require 2 factor authentication to view or access systems. Sure it may be inconvenient but so is losing your customer base to hackers.
If possible use hardware based network cards (INTEL makes a great solution) that only allows one device on your customer network to access only the single device on your internal network that they require to carry out authorized functions and processes.
Another great idea is to use an endpoint firewall solution.
If you would like to audit your third party vendors contact SLC Security at (919) 441-7353 to schedule an audit.
The purpose of this page is to provide awareness to individuals and organizations that are leaking information and the information of their customers. The entities listed on this site are verified to be leaking personal information sometimes without the company even being aware. SLC Security is now owned and operated by Jigsaw Security Enterprise. We are currently in process and as such this blog will eventually be taken offline and merged with Jigsaw Security resources.
Showing posts with label Tips. Show all posts
Showing posts with label Tips. Show all posts
Sunday, December 14, 2014
Friday, December 5, 2014
EXCLUSIVE: The Top 10 Items Missed During an Audit (Article 2 of 10 in a series)
This is an exclusive provided by SLC Security Services LLC the leader in Medical, Compliance and DOD Auditing Solutions.
Issue 9 - Inadequate security of network path and access control systems
Yes we are jumping around a bit that's just because we have been really tied up with some clients this week. So here goes...
The number 9 issue on the top 10 list of items missed during audits is something most auditing companies never even check. When doing audits one of the items we check as part of our TSCM sweeps are the network, phone and cable paths. What we are referring to here are network cables that actually are accessible outside of your building, telephone connections in shared closets or alert system components in public areas that can be manipulated without gaining physical access to your secure space.
How many times have you been in a building and seen a closet labeled "Telecom Closet" or some similar title? These areas are troublesome for many of our clients that lease space in buildings. One of the things we have had to do at some client locations is request separate telephone lines and communications lines be brought directly into our customer space. We also insist on full metal conduits into the building as to prevent wire tapping and similar physical attacks on the lines. Full metal conduits also prevent some really neat tricks in which you don't even have to cut the phone lines to be able to monitor them.
At one bank recently we noted that in the walk in area beside the ATM was a network jack on the wall. When we tested the network jack it was connected directly to the customers network switch and the port was active. The port gave us an IP address and through passive network monitoring we are able to run wireshark and get at a ton of very sensitive information to include the domain information for network that the tellers in the branch were logging into. With some arp poisoning we were able to capture login credentials, needless to say the client disabled the port after the audit.
One important thing to note: 95% of the companies that we initially audit are not even aware of the TSCM threats that exist. Many times our audits are eye opening as we can tell who is in a building, login information to networks, etc, etc. just because they are not aware of some of these attack vectors. I can't tell you the number of wireless networks we find. It's very surprising and somewhat easy to obtain access to these networks when we do stumble upon these links.
So there you have it. Check your cable paths and make sure your devices are not going into shared space. If you really want to ensure the security of your communications here are a few other tips.
1. Do not use fax machines to send medical, PII or sensitive information over the telephone network. While most people think telephone networks are secure there are many stops along the way whereas your competition can get at your information and reconstruct your faxes, emails, etc.
2. Do not allow employees to bring personal electronic devices into areas that house PII or PHI. It has been proven that this is an attack vector that can be exploited.
3. Ensure cable paths are properly secured.
4. Do not use wireless handsets even if they are DECT "secure". DECT can be reconstructed it just takes the know how and tools to do it.
5. Do not send PII over wireless networks.
6. Do not allow third party vendors into any network that houses PII, PHI or PCI.
Have a great day folks and be sure to look for the next article in this series.
Issue 9 - Inadequate security of network path and access control systems
Yes we are jumping around a bit that's just because we have been really tied up with some clients this week. So here goes...
The number 9 issue on the top 10 list of items missed during audits is something most auditing companies never even check. When doing audits one of the items we check as part of our TSCM sweeps are the network, phone and cable paths. What we are referring to here are network cables that actually are accessible outside of your building, telephone connections in shared closets or alert system components in public areas that can be manipulated without gaining physical access to your secure space.
How many times have you been in a building and seen a closet labeled "Telecom Closet" or some similar title? These areas are troublesome for many of our clients that lease space in buildings. One of the things we have had to do at some client locations is request separate telephone lines and communications lines be brought directly into our customer space. We also insist on full metal conduits into the building as to prevent wire tapping and similar physical attacks on the lines. Full metal conduits also prevent some really neat tricks in which you don't even have to cut the phone lines to be able to monitor them.
At one bank recently we noted that in the walk in area beside the ATM was a network jack on the wall. When we tested the network jack it was connected directly to the customers network switch and the port was active. The port gave us an IP address and through passive network monitoring we are able to run wireshark and get at a ton of very sensitive information to include the domain information for network that the tellers in the branch were logging into. With some arp poisoning we were able to capture login credentials, needless to say the client disabled the port after the audit.
One important thing to note: 95% of the companies that we initially audit are not even aware of the TSCM threats that exist. Many times our audits are eye opening as we can tell who is in a building, login information to networks, etc, etc. just because they are not aware of some of these attack vectors. I can't tell you the number of wireless networks we find. It's very surprising and somewhat easy to obtain access to these networks when we do stumble upon these links.
So there you have it. Check your cable paths and make sure your devices are not going into shared space. If you really want to ensure the security of your communications here are a few other tips.
1. Do not use fax machines to send medical, PII or sensitive information over the telephone network. While most people think telephone networks are secure there are many stops along the way whereas your competition can get at your information and reconstruct your faxes, emails, etc.
2. Do not allow employees to bring personal electronic devices into areas that house PII or PHI. It has been proven that this is an attack vector that can be exploited.
3. Ensure cable paths are properly secured.
4. Do not use wireless handsets even if they are DECT "secure". DECT can be reconstructed it just takes the know how and tools to do it.
5. Do not send PII over wireless networks.
6. Do not allow third party vendors into any network that houses PII, PHI or PCI.
Have a great day folks and be sure to look for the next article in this series.
Saturday, October 11, 2014
THOUGHTS: Our Thought on POS Systems and the Security of Such
We have been getting calls all week from clients that are in the retail business. We have been working on a shim that may prevent some (but not all) of these leaks or the potential for these leaks. Of the POS systems we have recently examined over 90% of them have no firewall configured or if it is configured it setup in such a manner as to allow pretty much anything to communicate. One of the easiest methods to stop malware would be application whitelisting. On POS systems there is usually the base operating system, additional software installed by the vendor and the POS system itself.
One of the defenses that a business could implement is application whitelisting whereas only the POS system and any security software is authorized to executed on these systems. We understand that testing such a system is time consuming but it would eliminate or minimize the likelihood that malware introduced to the system could be executed.
By configuring a known list of authorized software and installing an OS and Network Shim you can monitor what attempts to run and quickly identify if you have been a target of a breach.
Some recommendations for POS system vendors:
1. Do NOT utilize big box bundles OS installations on your POS systems
2. Ensure that you have application white listing enabled and only allow your POS software to run
3. Disable any services not required by your application
4. Turn off MS Network protocols if not needed (we are seeing Microsoft networks propagating malware on local networks in our lab on POS machines)
5. Configure your firewall to only allow point to point communications to systems that are required for operation and explicitly block everything else
6. Remove unused Windows or Linux based utilities that are not needed
7. Configure your devices on a separate network that your other devices. POS systems should be on a segregated and closed network
8. Secure the POS network with ACL's on routers and switches and ensure that only authorized destinations are authorized. We are seeing many organizations with ANY/ANY and that's just plain stupid for many reasons.
9. Centralize your logging so you can detect if something tries to execute on your OS/Network Shim solution and alert administrators to any attempts to run non whitelisted software.
Normally we do not recommend whitelisting software but in the POS world it just makes sense. If the malware is not authorized to run it can't harm your systems. If your networks are properly configured they cannot be attacked with MITM attacks and even if a POS system get's infected they won't be able to reach out to the attackers systems because your network devices are providing another layer of protection.
If you need assistance in securing your POS systems feel free to contact SLC Security Services LLC or visit our website at www.slcsecurity.com.
One of the defenses that a business could implement is application whitelisting whereas only the POS system and any security software is authorized to executed on these systems. We understand that testing such a system is time consuming but it would eliminate or minimize the likelihood that malware introduced to the system could be executed.
By configuring a known list of authorized software and installing an OS and Network Shim you can monitor what attempts to run and quickly identify if you have been a target of a breach.
Some recommendations for POS system vendors:
1. Do NOT utilize big box bundles OS installations on your POS systems
2. Ensure that you have application white listing enabled and only allow your POS software to run
3. Disable any services not required by your application
4. Turn off MS Network protocols if not needed (we are seeing Microsoft networks propagating malware on local networks in our lab on POS machines)
5. Configure your firewall to only allow point to point communications to systems that are required for operation and explicitly block everything else
6. Remove unused Windows or Linux based utilities that are not needed
7. Configure your devices on a separate network that your other devices. POS systems should be on a segregated and closed network
8. Secure the POS network with ACL's on routers and switches and ensure that only authorized destinations are authorized. We are seeing many organizations with ANY/ANY and that's just plain stupid for many reasons.
9. Centralize your logging so you can detect if something tries to execute on your OS/Network Shim solution and alert administrators to any attempts to run non whitelisted software.
Normally we do not recommend whitelisting software but in the POS world it just makes sense. If the malware is not authorized to run it can't harm your systems. If your networks are properly configured they cannot be attacked with MITM attacks and even if a POS system get's infected they won't be able to reach out to the attackers systems because your network devices are providing another layer of protection.
If you need assistance in securing your POS systems feel free to contact SLC Security Services LLC or visit our website at www.slcsecurity.com.
Wednesday, October 1, 2014
TIP OF THE WEEK: Don't trust fax machines
Fax machines have been around for nearly 100 years (yes we were surprised too). Faxes are a great tool to send and receive information but those in certain industries such as legal, medical and law enforcement should understand that they could be putting their organizations at risk when using faxes.
Every year in the US over 1.6 Billion USD is lost due to breaches or interception of information not protected by corporations, Government and private industry. The threat is real and growing as the cost of quality software tools and hardware is constantly going down. Faxes for a long time have been considered secure but you should evaluate the risk in your organization.
Faxes are sent via telephone and other methods such as wireless and through computers and the Internet. These faxes can and are intercepted sometimes by persons not authorized to see this information. The goal of this tip is to remind organizations that the fax standard has been posted and that there are freeware programs available to reconstruct fax images from recordings, sniffing software that can detect faxes and pull them off of VOIP networks and then the mishandling of printed faxes after they are received.
Your organization should have a clear policy on the use of fax machines. Medical entities should be especially concerned when sending PHI or PII covered under HIPAA or CMS. These documents may not be handled correctly after they are received or may be intercepted enroute. Here are some tips to protect your organization.
Every year in the US over 1.6 Billion USD is lost due to breaches or interception of information not protected by corporations, Government and private industry. The threat is real and growing as the cost of quality software tools and hardware is constantly going down. Faxes for a long time have been considered secure but you should evaluate the risk in your organization.
Faxes are sent via telephone and other methods such as wireless and through computers and the Internet. These faxes can and are intercepted sometimes by persons not authorized to see this information. The goal of this tip is to remind organizations that the fax standard has been posted and that there are freeware programs available to reconstruct fax images from recordings, sniffing software that can detect faxes and pull them off of VOIP networks and then the mishandling of printed faxes after they are received.
Your organization should have a clear policy on the use of fax machines. Medical entities should be especially concerned when sending PHI or PII covered under HIPAA or CMS. These documents may not be handled correctly after they are received or may be intercepted enroute. Here are some tips to protect your organization.
- Ensure cover sheets on all faxes include a disclaimer
- Ensure that you verify the person you are sending the fax to receives the fax by voice or other method.
- Mark and label fax data appropriately if it contains sensitive information
- Use secure fax or other methods when sending patient information to ensure your not violating rules
- Email is just as fast or faster than the fax machine, use encryption and send documents securely through an encrypted service
- Have regular TSCM checks of your communications facilities to ensure your not inadvertantly sending faxed information to the wrong party
- Verify the fax number before sending information. Fax numbers change and you don't want to disclose information to the wrong party
- Remember the fax information is sent via encoded audio, use secure 2 way communications when you absolutely have to send faxes
Monday, September 29, 2014
BLOCKS: Suggestions - Already updated in the SLC Rulesets
Suggested Domains to Block:
adexprt.com
exoclick.com
seethisinaction.com
valu-traffic.com
We have been seeing malware being pushed out in droves from these domains.
adexprt.com
exoclick.com
seethisinaction.com
valu-traffic.com
We have been seeing malware being pushed out in droves from these domains.
Wednesday, September 17, 2014
TIP OF THE WEEK: How misdirected email can harm your business (and bottom line)
Too often when conducting security assessments we make some rather
telling discoveries. Many times businesses are not even aware that they
have problems and by then it may be too late. As part of our annual
security training we are taught to use the resources at our disposal to
maintain efficiency. We have come to rely on technology to speed up the
processing of medical claims, to place orders online and to maintain
required records for business use. Corporations create policies to try
and give guidance to employees and contractors in safe data handling as
well as enforcing strong passwords, policies on data storage and
handling as well as regulatory assistance in regards to Sarbanes Oxley,
HIPAA and Classified data handling. All of these measures are in place
to limit the liability of the company and ensure that information does
not end up in the wrong hands.
In this article we will focus on email and the typical use in business. I will cover some of the issues with email systems in use today and we will go over some of the ways in which you may be able to protect your company from costly mistakes.
In this article I will focus in on 5 key areas:
1. Verification of Identity
2. Encryption
3. Storage for Auditing Purposes
4. Misdirected Email
5. Detection of the Insider Threat
Verification of Identity
It goes without saying that you should go without saying that when you leave your workstation you should ensure that you lock it with a password. Often times when performing security audits we note upwards of over half of the employees in the organization fail to perform this simple step to ensure that nobody can look at your email or see what documents and other sensitive information that you may have open that they may not have a requirement to see or read. What is to stop someone from sending an email on your behalf? What is to stop them from deleting the message from your sent folder and deleting your trash? If this were to occur at your organization could you recover the sent message if there were a legal issue or requirement to do so?
We seriously doubt it as we have only seen a handful of companies in the 20 years we have been doing security auditing that actually could reproduce the sent email message after it was deleted from the senders mailbox. You remember the IRS scandal that has been all over the news. Lois Lerner claimed that she had a hard drive crash and that the IRS could not recover her email messages. This brought about many hours of Senate inquiries, investigations and it's still in the news today. The problem here is two fold.
Due to sunshine laws and other Federal regulations public officials must maintain records of their email for a period usually of 2 years at minimum. The IRS claimed that the backups were unavailable at first and then claimed that they did not exist even though there are rules and laws that require this information to be archived. We will use this example in this section to talk about some of the reasons having access to old email is critical for businesses.
What were to happen if an employee were to accidentally delete a contract received through email. The person that executed the contract has a copy of the contract but your only copy was deleted accidentally. Then as part of the services being provided said second party cannot produce the contract that was executed. An unethical company may alter their copy of the contract to include terms different than the original but if you cannot produce the contract it may be hard to prove that the terms of the contract have been modified so you are putting your companies assets and resources at risk because an employee made a simple error.
What would happen if a threatening email was sent out of your organization to a third party and the action was reported to law enforcement. Do you have a definitive way to ensure that the sender was the actual person that sent the message? If the message was a spoofed email do you have proof that the employee was not the source of the message? Do you have a written policy that is signed stating that the employee will be responsible for the use of your email infrastructure solely? Do you have a disclaimer on your email messages stating that the organization may not hold the same views as the sender? Just a few things to think about.
Partial Solution: Smart card email authentication is a very good way to verify the sender is who they claim to be. Two factor authentication will prevent the unauthorized sending and unauthorized reception of email not intended for the intended individual.
Encryption:
Encryption is a good tool for maintaining organizational security. The use of encryption can prevent unauthorized access to information in the event that a laptop is stolen or a communication is intercepted. It can also be used to verify the identity of the sender and receiver. When using encryption however the organization MUST maintain the master key to be able to decrypt any communications in the event of a court order or legal requirement. Encryption of email allows you to ensure that messages are not being intercepted in transit and also ensure that only persons with the appropriate keys can decrypt the message. Encryption is not 100% effective every because there may be remnants of decrypted messages on a laptop, computer or smart phone depending on the product being used. Encryption should be viewed as a safeguard and not a final line of defense. Given enough time and hardware encryption can be defeated rather easily with the advent of powerful GPU cards that are not all that expensive today.
Storage for Auditing Purposes:
It should be said first off that in business things happen. Too often businesses are in a reactive mode when it comes to liabilities and security and they only become proactive when it could cost them reputation points or financially. One common recommendation that we make to many of our customers is to ensure that you have email archival in place and verify frequently that messages can be recovered from the archives.
There are commercial solutions and inexpensive open source programs designed to intercept and store email in archives for long term accountability. If you can't confirm or deny that an email originated from your company you may be in trouble if a problem arises.
What are some of the downsides to the archival of email?
Misdirected Email:
In the event that an address is transposed you must ensure that you notify the recipient and request that the message be deleted. Keep in mind that you have lost control of the information in the email and it could now be shared out by the untrusted third party. While there is nothing to prevent that if you keep your email you have proof that you have notified the recipient and requested that the information be deleted. If that information shows up down the road as a compromise or helps a hacker to compromise a system you have done all that you can do. You have to evaluate the value of the message and take the appropriate actions to minimize the risk to your organization after you discover that a message went to the wrong party.
In some instances you may not even realize that it went to the wrong address so that is why disclaimers on ALL email messages are really helpful in showing due diligence on the part of the sending organization. Mistakes happen and email gets misdirected due to typo's, email accounts not being present on the receiving system (in which case the postmaster of the receiving organization receives the message in most cases), DNS errors or many other situations which may be out of your control.
There may be reporting requirements if there is financial, confidential or if you are a HIPAA covered entity. Check with your compliance department to ensure what steps must be taken immediately to ensure that you are in compliance with State and Federal regulations even if you think you know what steps must be taken.
Insider Threats:
Every year over 80 Billion USD is lost by US Corporations due to insider threats that may consist of Corporate Spies, Governments, Terrorist, Hackers and your Employees. Yes you heard that right. Your trusted employees are a huge threat to your organization and misuse of communications systems and email may cost your organization profits, embarrassment and legal issues. There are many areas of our security auditing that address the technical aspects of protecting your resources but it's difficult without the right systems in place to electronically detect when proprietary information is leaving your company often times without your knowledge or approval.
Do you allow thumb drives in your company?
Do you allow employees to print out documents and check to ensure they are accounted for?
Do you allow personal cell phones in the business and at computer terminals?
Do you have public printers and faxes in common areas?
These are some of the warning signs that information may be leaving without your knowledge. It's easy these days to take a picture of a computer screen or screenshot and email or upload a document to a cloud provider or similar service.
Mitigating the Insider Threat: There are some things you can do to ensure documents, sensitive proprietary information or PHI is not leaving your organization. Having the right training, technical controls, monitoring and auditing in place will help to alleviate the threat but not completely prevent it as nothing is 100% fail safe in the digital age.
The goal in bringing up these topics is to educate and provide guidance and assistance to companies that are at a high risk for disclosures, data breaches or leaks of information by unauthorized personnel and to provide the training, technical safeguards and training needed to keep your company in compliance and as secure as possible without affecting employees ability to do their jobs in an efficient manner. Security is always a balance between available funding and risk management and it's a tightrope act to maintain security while not wasting profits on safeguards that you may not truly need. The only way to be sure is to have an audit done and assume the risk that you choose not to secure and document the gaps in such as manner as to show that you have done as much as you can to prevent possible future disclosures while realizing that nothing is 100% secure and nobody expects it to be.
You must be able to hold individuals responsible for actions and minimize your corporate risk when dealing with technology use in the workplace.
In this article we will focus on email and the typical use in business. I will cover some of the issues with email systems in use today and we will go over some of the ways in which you may be able to protect your company from costly mistakes.
In this article I will focus in on 5 key areas:
1. Verification of Identity
2. Encryption
3. Storage for Auditing Purposes
4. Misdirected Email
5. Detection of the Insider Threat
Verification of Identity
It goes without saying that you should go without saying that when you leave your workstation you should ensure that you lock it with a password. Often times when performing security audits we note upwards of over half of the employees in the organization fail to perform this simple step to ensure that nobody can look at your email or see what documents and other sensitive information that you may have open that they may not have a requirement to see or read. What is to stop someone from sending an email on your behalf? What is to stop them from deleting the message from your sent folder and deleting your trash? If this were to occur at your organization could you recover the sent message if there were a legal issue or requirement to do so?
We seriously doubt it as we have only seen a handful of companies in the 20 years we have been doing security auditing that actually could reproduce the sent email message after it was deleted from the senders mailbox. You remember the IRS scandal that has been all over the news. Lois Lerner claimed that she had a hard drive crash and that the IRS could not recover her email messages. This brought about many hours of Senate inquiries, investigations and it's still in the news today. The problem here is two fold.
Due to sunshine laws and other Federal regulations public officials must maintain records of their email for a period usually of 2 years at minimum. The IRS claimed that the backups were unavailable at first and then claimed that they did not exist even though there are rules and laws that require this information to be archived. We will use this example in this section to talk about some of the reasons having access to old email is critical for businesses.
What were to happen if an employee were to accidentally delete a contract received through email. The person that executed the contract has a copy of the contract but your only copy was deleted accidentally. Then as part of the services being provided said second party cannot produce the contract that was executed. An unethical company may alter their copy of the contract to include terms different than the original but if you cannot produce the contract it may be hard to prove that the terms of the contract have been modified so you are putting your companies assets and resources at risk because an employee made a simple error.
What would happen if a threatening email was sent out of your organization to a third party and the action was reported to law enforcement. Do you have a definitive way to ensure that the sender was the actual person that sent the message? If the message was a spoofed email do you have proof that the employee was not the source of the message? Do you have a written policy that is signed stating that the employee will be responsible for the use of your email infrastructure solely? Do you have a disclaimer on your email messages stating that the organization may not hold the same views as the sender? Just a few things to think about.
Partial Solution: Smart card email authentication is a very good way to verify the sender is who they claim to be. Two factor authentication will prevent the unauthorized sending and unauthorized reception of email not intended for the intended individual.
Encryption:
Encryption is a good tool for maintaining organizational security. The use of encryption can prevent unauthorized access to information in the event that a laptop is stolen or a communication is intercepted. It can also be used to verify the identity of the sender and receiver. When using encryption however the organization MUST maintain the master key to be able to decrypt any communications in the event of a court order or legal requirement. Encryption of email allows you to ensure that messages are not being intercepted in transit and also ensure that only persons with the appropriate keys can decrypt the message. Encryption is not 100% effective every because there may be remnants of decrypted messages on a laptop, computer or smart phone depending on the product being used. Encryption should be viewed as a safeguard and not a final line of defense. Given enough time and hardware encryption can be defeated rather easily with the advent of powerful GPU cards that are not all that expensive today.
Storage for Auditing Purposes:
It should be said first off that in business things happen. Too often businesses are in a reactive mode when it comes to liabilities and security and they only become proactive when it could cost them reputation points or financially. One common recommendation that we make to many of our customers is to ensure that you have email archival in place and verify frequently that messages can be recovered from the archives.
There are commercial solutions and inexpensive open source programs designed to intercept and store email in archives for long term accountability. If you can't confirm or deny that an email originated from your company you may be in trouble if a problem arises.
What are some of the downsides to the archival of email?
Misdirected Email:
In the event that an address is transposed you must ensure that you notify the recipient and request that the message be deleted. Keep in mind that you have lost control of the information in the email and it could now be shared out by the untrusted third party. While there is nothing to prevent that if you keep your email you have proof that you have notified the recipient and requested that the information be deleted. If that information shows up down the road as a compromise or helps a hacker to compromise a system you have done all that you can do. You have to evaluate the value of the message and take the appropriate actions to minimize the risk to your organization after you discover that a message went to the wrong party.
In some instances you may not even realize that it went to the wrong address so that is why disclaimers on ALL email messages are really helpful in showing due diligence on the part of the sending organization. Mistakes happen and email gets misdirected due to typo's, email accounts not being present on the receiving system (in which case the postmaster of the receiving organization receives the message in most cases), DNS errors or many other situations which may be out of your control.
There may be reporting requirements if there is financial, confidential or if you are a HIPAA covered entity. Check with your compliance department to ensure what steps must be taken immediately to ensure that you are in compliance with State and Federal regulations even if you think you know what steps must be taken.
Insider Threats:
Every year over 80 Billion USD is lost by US Corporations due to insider threats that may consist of Corporate Spies, Governments, Terrorist, Hackers and your Employees. Yes you heard that right. Your trusted employees are a huge threat to your organization and misuse of communications systems and email may cost your organization profits, embarrassment and legal issues. There are many areas of our security auditing that address the technical aspects of protecting your resources but it's difficult without the right systems in place to electronically detect when proprietary information is leaving your company often times without your knowledge or approval.
Do you allow thumb drives in your company?
Do you allow employees to print out documents and check to ensure they are accounted for?
Do you allow personal cell phones in the business and at computer terminals?
Do you have public printers and faxes in common areas?
These are some of the warning signs that information may be leaving without your knowledge. It's easy these days to take a picture of a computer screen or screenshot and email or upload a document to a cloud provider or similar service.
Mitigating the Insider Threat: There are some things you can do to ensure documents, sensitive proprietary information or PHI is not leaving your organization. Having the right training, technical controls, monitoring and auditing in place will help to alleviate the threat but not completely prevent it as nothing is 100% fail safe in the digital age.
The goal in bringing up these topics is to educate and provide guidance and assistance to companies that are at a high risk for disclosures, data breaches or leaks of information by unauthorized personnel and to provide the training, technical safeguards and training needed to keep your company in compliance and as secure as possible without affecting employees ability to do their jobs in an efficient manner. Security is always a balance between available funding and risk management and it's a tightrope act to maintain security while not wasting profits on safeguards that you may not truly need. The only way to be sure is to have an audit done and assume the risk that you choose not to secure and document the gaps in such as manner as to show that you have done as much as you can to prevent possible future disclosures while realizing that nothing is 100% secure and nobody expects it to be.
You must be able to hold individuals responsible for actions and minimize your corporate risk when dealing with technology use in the workplace.
Friday, September 12, 2014
TIP OF THE WEEK: Proper Disposal of Proprietary Documents
First of all you want to make sure your properly storing documents that you wish to keep. Ensure that only authorized personnel can access proprietary information and that the information kept at your facilities has some sort of access controls such as locked cabinets and/or keypad entry to the storage facility. Once you have the documents secured in house you need to ensure that the lifecycle of the documents are maintained.
When discarding documents ensure that they are shredded and/or incinerated. You do not have to have an incinerator on site but ensure that your vendor has a written guarantee that documents they take from your facility for destruction are actually destroyed. Many times you will want to ensure that even shredded remnants are destroyed in this manner.
Ensure that your employees know not to simply throw documents in the normal trash. This begins with proper training and you should have annual training and spot checks to ensure that documents are being destroyed in accordance with appropriate handling policies. You do have a policy right?
Another good idea is to have a document check in and management system for the handling of PII or sensitive proprietary information. Corporates face corporate espionage at an alarming level these days and are subject to theft of information from competitors as well as foreign interest.
When discarding documents ensure that they are shredded and/or incinerated. You do not have to have an incinerator on site but ensure that your vendor has a written guarantee that documents they take from your facility for destruction are actually destroyed. Many times you will want to ensure that even shredded remnants are destroyed in this manner.
Ensure that your employees know not to simply throw documents in the normal trash. This begins with proper training and you should have annual training and spot checks to ensure that documents are being destroyed in accordance with appropriate handling policies. You do have a policy right?
Another good idea is to have a document check in and management system for the handling of PII or sensitive proprietary information. Corporates face corporate espionage at an alarming level these days and are subject to theft of information from competitors as well as foreign interest.
Subscribe to:
Posts (Atom)