Is Two Factor Authentication for internet banking a flop or success?

Q: Is Two Factor Authentication for internet banking a flop or success. read ard some articles regarding two factor authentication, studies shown that two factor authentication does not address some present issues and with man in the browser attack shown and also recent cases like ABN ambro, one may wonder is two factor authentication tat safe, would like to hear ur views on this guys

A: Hi …,
I agree with the previous answers.
2-factor authentication is more secure than password-only single factor authentication.
• Does it answer some security problems? Yes.
• Does it answer all security problems? No.
This is the fact. I do recommend increasing security levels to mitigate the risk (You can go up several factors but you cannot eliminate the risk)

If you have the second factor on a hardware (token, smart card etc) or biometrics it is even more secure. It is like the ATM card... You loose your PIN, no problem; you still have card in your pocket. You loose your ATM card, no problem; because you still keep the PIN. If you loose both of them, yes you have a problem.

Having 2nd factor on the same media (e.g. on your computer, or 2 passwords) is not as safe as tokens, smart cards etc.

During online transactions the problem of man-in-the-middle, man-in-the-browser threats can bypass 2-factor authentication but this does not mean that the financials should rely on static passwords only.

There are also a lot of creative “virtual” 2-factor authentication systems like Tricipher (more links in the DHS link below).

FFIEC :Single factor authentication methodologies may not provide sufficient protection for internet-based financial services; Bank Web sites are expected to adopt some form of "two-factor" authentication by the end of 2006, regulators with the Federal Financial Institutions Examination Council

In financial sector, after the FFIEC requirements above, many banks implemented cheaper pseudo 2-factor systems (sitekey, captcha type) . Tokens/Cards are better but when the cost is the important factor, sitekey type systems increase security relatively. Mutual authentication systems are better but very difficult to manage (e.g. PKI). I like out band authentication a lot. When I try a high-risk transaction my banks sends a one-time-password to my cell phone.


Here are some links that may help:
http://www.schneier.com/blog/archives/2005/03/the_failure_of.html
http://www.forrester.com/Events/Content/0,5180,1429,00.ppt#418,1,Slide 1
http://www.cyber.st.dhs.gov/phishing-dhs-report.pdf


Let me know if you have a specific question,
Cheers,
- yinal

Routing protocol in IPSEC tunnel mode?

Q: Why can't you run a routing protocol in IPSEC tunnel mode? why do you need GRE to run a routing protocol?

A: Hi …,
You can run routing protocols in IPSEC tunnel mode. You don't have to have GRE all the time.

In the past we could not do this due to the limitation on the IPSEC termination gateways...The gateways could not participate in routing and tunnel mode encapsulated on IP headers. In order to eliminate the problems we were tunneling traffic in GRE

Today many of the modern IPSEC gateways (e.g. Check Point, Juniper, Cisco etc) do support route based VPNs via virtual tunnel interfaces (VTI). Implementation does not have a standard (most functions are proprietary) so intra device (e.g. Check Point to Juniper) route based VPNs are very difficult. But if you have a single brand of gateways, you can route in VPN tunnels easily. We have migrated proprietary TELCO MPLS networks to IPSEC VPNs with keeping the redundancy with dynamic route based VPNs.

On the other site Cisco is trying to reinvent the wheel by bringing the 10 year old transport VPNs (encrypting only the payload not the IP header) in order to make MPLS network more secure and scalable. This Cisco Group Encrypted Transport VPN is promising to address multicast VPN problems as well.

All vendors have several solutions for several scenarios so it would be best to run proof of concept before production deployment.

cheers,
- yinal

Do you consider web scraping a threat to your organization?

Q: Do you consider web scraping a threat to your organization?
We have a client whose physician finder page was being scraped. A competitor was regularly sucking all of the doctors out of it and probably importing them as leads right into their own CRM database. We found a good solution but I also found out there are many software tools and service companies now who claim to be able to "collect data from the competition and track their behavior over time". I wondered how wide spread this might be and how much people were concerned about it in general. Any war stories or thoughts on web scraping ? Thank you!

A:
Hi ...,
Internet domain is named "public" for a reason. On the long term no protection (applets, images. scripts etc) is valid if the information is on Internet. There is a very common principle for information security. Security through obscurity is not real security.

The only information you may protect on an online directory system maybe the phone numbers and e-mail addresses (by not using them) You can proxy them via some web applications, but even if you do this, it is not very difficult to figure out all e-mail addresses if the names of the doctors are displayed on the pages (assuming that you follow a standard naming convention).

I have been working with enterprise security and web development teams for years and I remember stories from 1996. After the search engines (which are another kind of scrapers) the web/screen industry was legitimized

Scraping technology is relatively simple (programming 101) and in the long run there is no permanent fix. Yes, you can slow them down (no queries in 10 minutes from the same IP address?) but is not the solution.

I do recommend having very strict data classification, and privacy policies
• Identify the classified/sensitive/unclassified etc data
• personally identifiable information
• business and legal requirements (e.g. compliance)
• internal policies
at your operation and design your internet facing content according to your requirements. On public pages, classification is quite straight, so label all internet facing non-authenticated pages “public/unclassified”.

You can protect your private/high security demanding competitive data inside the perimeter, and protect your sensitive information with several DRM solutions.

If you have any question I would be happy to elaborate more.

cheers,
- yinal

Commercial products for "breakglass" account control

Q: Commercial products for "breakglass" account control
Has anyone reviewed commercially available "breakglass" tools for account control of privileged system and application accounts?. If so, please advise.

A: Hi ......,
There are several ways to achieve your goals. Entitlement and Privilege Management (Authorization Management) is a very active topic and there are several creative approaches to deliver the solution. You can control privilege at the client level, network level and application level.

I will skip the client level applications (yes there are plenty of VB magic out there), and discuss the network and agent based policy/audit/privilege control tools for centralized management.

The idea is very simple, targets systems lack required native controls or the native controls are not centrally manageable, or granularity of the controls are not deep enough for security/compliance requirements, so you need to proxy the authentication requests and authorize the privileged access based on your policy.

Basically all “identity management” shops (IAM, SSO, Entitlements) offer some sort of privilege control (CA, IBM Tivoli, BMC, Novell, EMC (RSA), SUN, Oracle and Microsoft - http://static7.userland.com/oracle/gems/nishantKaushik/gartnerUPQ07.jpg). But the solutions may require some tweaking and coding.

But if all you need is “break-glass” control, you can use some specific applications/appliances like CA’s Access Control, Symark PowerBroker, Cyber-Ark, Securent, Password Auto Repository or Bayshore Networks etc.. These solutions also integrate closely with the applications for entitlements management as well..

If you need a quick and dirty solution, build a SSH proxy server (public domain) with strong authentication, and authorize all system management access via SSH Proxy. But that won’t be a complete solutions like runas, sudo variants

In the past I worked with CA, they have an extensible solution.

cheers,
- yinal

Defining the Endpoint Security UTM

Endpoint security is getting more complex... At the end of the day we have only 1 endpoint to integrate all those glorious safeguards. The target (laptop, desktop, pda, Smartphone, blackberry) has limited resources.

This makes the perfect case for endpoint unified threat management (UTM) concept. Clientless control is golden so OS specific safeguards such as GPO or remote enforcement tools such as promisec would be great. Or the utility based offerings such as Postini and Scansafe will decrease the load/tax on the client.

Here is my list for the endpoint security functionality list for the UTM (a single executable or everything in the cloud are the golden wishes)

- Port Control (USB, CD, Floppy, Bluetooth, IR, Wi-Fi, Ethernet etc)
- Location awareness
- Encryption (file, disk, mail), key/cert management
- Firewall
- IPS
- Antivirus (http and SMTP)
- Antispam, Phishing, Malware control (http, SMTP, SMS)
- URL filtering
- Application control, and tripwire type change control
- Remote device management (in a secure manner :)
- Biometrics/TPM/SSO/802.1x support
- Easy to scale on multiplatform esp. on mobile

Of course all should be managed centrally.

Do I ask for too much? I already see several initiatives before Microsoft, Nokia, and RIM wakes up.

Deployment is a topic for another post.

cheers,
- yinal

Running a Security Operations Centre

Q: Running a Security Operations Centre
Can anyone tell me is they have had any success is setting up an internal SOC (security operations Centre) compared with outsourcing / smartsourcing it to a third-party to manage or partially manage

A: Hi ......,
We have set up several SOCs for ourselves (us being MSSP) and for our clients.

I assume you are interested in a SOC type that our clients use for internal security operations.

Yes, an internal SOC is very tricky and can be very expensive based upon the initial scope.

Here are the initial problems that we faced for internal SOC initiatives

1) Developing the redundant infrastructure. Real time active-active SOCs are recommended, this makes the infrastructure complex
2) Finding right people: It is tough to find people who can work in 7x24x365 work schedule with a lot of stress. It is tough to keep trained security experts in-house. It is tough to run follow-the-sun or 3-shift teams. If this is the first time for the client, expect major problems for the first year
3) Developing operational procedures: Unless you mimic a working operation, starting from the scratch will not be easy. Security monitoring and management procedures are dependant on the toolsets, resources and the architecture. Internal SOCs require a long learn by mistake period..
4) Integration with internal workflow. All internal IT procedures must be updated to work with the new SOC
5) Integration with existing IT infrastructure. All existing systems and policy should work together.
6) Achieving the certification and compliance for the new SOC (SAS 70 type II, ISO 27001, PCI etc)

If you have any specific questions I might give more definite details. I think the link below will help you for the SOC operation scoping on the technical side:

http://infosecforum.blogspot.com/2007/08/ideal-managed-security-service-provider.html

regards,
- yinal ozkan

Classification of Information Security Products

We usually use 4 main solution categories... Perimeter, Threat and Vulnerability, Content, and IAM... But if you want to look at the solutions with product categories, here is my high level view:

Security Product Areas
• Firewall
• IPS IDS
• Antivirus,Antispam, Malware(email)
• Encryption
• URL Filtering (and AV AS Malware)
• Proxy-Cache-WAN Acceleration
• Web/XML gateway frontend security
• VPN management
• Remote Access (SSL ,client)
• DRM
• Authentication
• NAC, 802.1x
• Wireless
• UTM
• Endpoint UTM
• DDOS
• NBAD
• SIM
• Risk Management
• BCP/DR
• Vulnerability Management
• Patch Management
• Virtual Machine - Vmware
• Compliance / Policy management
• Identity / Provisioning Management
• Incident management
• Secure Application Development
• Platform Security (e.g Sap, Mainframe )
• Database

There are also generic areas, and a detailed endpoint products area which I will discuss in another post.

What benefits have you received from ISO 17799 certification?

Q:What benefits have you received from ISO 17799 certification?
Other then usual (managerial and legal) benefits of getting standards compliant, what exactly have you gained from doing 17799? Would it really improve security for small organizations, or those with distributed working environments?


A: Hi ...,
ISO 27001 certification is very useful for any company whose business requires information security.

What I see in thousands of organizations is the unstructured security practice. Or the malpractice.

This (Information Security) discipline requires maturity like any other and ISO 27001 is a one nice way of getting maturity in practice.

Here are the characteristics of Information Security operations that we see everyday:
Information security operation does not have a clear defined scope (e.g. is accounting in your scope?),
information security does not have well defined process/lifecycle model,
information security operation does not have a risk management model and risk analysis,
information security operation does not have document management,
information security operation does not enforce regular audits,
information security operation does not have metrics and measurement in place..


ISO 27001 like many other security frameworks promotes one main idea; a more secure operation.. You may individually applying one or two of the missing components but having everything organized under 1 framework , having this certified by a 3rd party ha a different value.

Your organization gains a very important thing for information security operation: Governance.
With the certification you and the rest of the world will know the scope, processes, policies, documentation, risk management, audit plans, metrics and measurement, where you can continuously improve your security level.. As you know according to the very basics of information security principles, you cannot improve a system where you do not have a well defined scope, where you do not know the assets and risks and where you cannot measure the metrics.

ISO27001 actually delivers a security program to address your organization’s information security requirements. You can check CMM offerings to value the changes in information security with ISO27001.

My organization gained a lot with the certification in terms of certification and we still do because every year we go through it again.. The certification is not for compliance, we actually improve our security posture and this progress is verified/certified by 3rd party accreditors.

Let me know if you have a specific problem
cheers,
- yinal