Does 'storage security' buy you anything?

I sat in on a webinar the other day and reviewed the sponsors' product data-sheets and other product materials. This was a 'storage security solution'. What is a storage security solution?

To sum it up, it's a data encryption solution that secures data at the SAN/NAS storage layer. In other words, it encrypts the data stored within the SAN and also includes access controls to restrict access to certain data within the SAN by certain hosts. Sounds kinda neat, huh? I found it interesting that the vendor was touting that their product addresses the encryption and data security requirements of the PCI (Payment Card Industry) Data Security Standard. I have to completely disagree with this positioning.

The product does encrypt data at rest within the SAN. But this is not really where the threat exists. The solution does nothing in regards to protecting data once a host is authorized to access the data within the SAN. And the threat of someone getting physical access to your SAN in order to attach to an existing volume is, shall we say, not very probable. And, if you are following the other requirements of PCI, you have your SAN and servers secured within a data center with appropriate physical access controls. So the chance of someone walking off with servers and your SAN also has a low probability.

With a solution like this in place, the Oracle database server has complete access to the encryption keys and all of the data in the SAN that it needs in order for the database to operate. And the web application that's connected to this database has access to all of the data it needs in order for the application to operate. So, even with such a solution implemented, you are still completely dependent on the security and access controls (and inadequacies) of those systems to protect the data. If someone can circumvent the controls in the web application or the database access controls, is doesn't really matter if the data is encrypted in the SAN. Implementing a database encryption solution would be a much more effective and secure solution.

But a solution like this isn't all bad. Where I do see value is in highly virtualized environments. Since the data is encrypted with the SAN you will have the capability to restrict access to only authorized hosts. Another great feature of the solution I reviewed is the ability to apply this technology to backup media. This is an area that's fraught with vulnerability, and it's good to see a product that addresses this head-on. What bugs me is when vendors get a little over zealous in their marketing strategy, attempting to position themselves as a solution to problems they don't really solve.

Copyright (c) 2007 Kenneth M. Smith

Network Security Checklist

20 Things That You Should Be Doing (at a minimum) to Protect Your Network From Threats
Kenneth M. Smith CISSP CISA QSA

Nothing can guarantee complete protection from the threats that exist on the Internet. Worms, viruses, malware and other malicious attacks are making this battle more complex every day. But it’s important to make a concerted ‘due-diligence’ effort to protect your information systems. Here is a preliminary checklist of 20 items that can help reduce your exposure to the top Internet threats.

1. Stay informed – Monitor security-related web sites and subscribe to mailing lists so you are aware of the latest threats. You need to know about it before you hear it on the television or radio news. I recommend the following:

SANS Newsletters: There are two weekly Newsletters and one monthly to choose from. The Security Alert Consensus (CAS), for example, lets you customize the content to your environment. You can choose to only receive news that pertains to the operating systems that you use. To subscribe to the SANS Newsletters, visit: https://portal.sans.org/

SecurityFocus Mailing lists: There are currently 26 lists to choose from. At a minimum, I would recommend the ‘bugtraq’ mailing list. To subscribe, to the SecurtyFocus lists, visit: http://www.securityfocus.com/archive

Incidents.org: This site provides daily updates and alerts on the latest threats, acting as an Internet Storm Center. Here you can access the latest CID Graph, probing statistics, and access the DShield Database. DShield is a system that acts as a central logging and analysis repository for IDS and Firewall logs. For more information, visit http://www.incidents.org/.

2. Know the SANS/FBI Top 20 List – Using the combined knowledge of dozens of leading security experts, this list was developed to identify the top twenty vulnerabilities that account for the majority of system compromises. The latest version of the list, “The Twenty Most Critical Internet Security Vulnerabilities” can be found at the following URL: http://www.sans.org/top20.htm

3. Protect your e-mail systems – Use an e-mail content filtering solution to protect your mail systems from malicious messages, SPAM, and malware attachments. It’s preferable that this be a separate system located in a DMZ network. This solution should, at a minimum, allow filtering based on text strings within messages as well as the ability to monitor and restrict attachments. Many systems also provide the ability to block unsolicited commercial email (UCE), a.k.a. SPAM. This system should integrate with an anti-virus product so that all attachments are virus checked, both inbound and outbound.

4. Triple-check your firewall configuration – Your firewall is a critical component of your security strategy. It’s configuration and rule-base should be closely guarded. On a regular basis, a ‘reality check’ should be performed by multiple security administrators or a security consultant. Use the comments field for each rule to indicate what the rule is for, and who requested and authorized the rule. Question any unexplained rules. Verify that your rule-base includes a ‘Stealth Rule’. This is a rule that prevents anyone from talking with your firewall directly. This is usually placed as early in the rule-base as possible.

5. Test for vulnerabilities – Perform frequent vulnerability assessments or penetration tests to identify vulnerabilities that may exist on your systems. Tests should be performed with multiple assessment tools from the Internet as well as from inside the network. As part of this test, run a password-cracking tool to test the strength of user passwords.

6. Test backup systems – You know that feeling you get when you need to restore critical data and find that it hasn’t been backed up in months? Avoid these situations by reviewing backup logs and performing regular test restores. Consider having the system or data ‘owner’ also review the logs for an added measure of confidence. While performing these tests, make note of the restore speed. If it takes many hours to restore a critical system from backup, then it’s probably time to start thinking about a more robust data integrity solution.

7. Keep the operating system and applications current – Have you ever tried to quickly install a security patch, only to find that you needed to install an Operating System Service Pack first? Keep all OS and application revision levels up-to-date. Not only does this usually provide a more stable system, but it also makes it easier to deal with hot-fixes and security patches later.

8. Educate your users – Employees expect that the company will keep their personal information secure. It’s your company’s duty to exercise diligence to make sure that social security numbers, health information, and other personnel information is kept private. You should expect the same level of security from your users when it comes to corporate data. Regular Security Awareness training provides the opportunity to make users aware of best practices, corporate policies, and to review some do’s and don’ts. In addition, it serves as a forum to allow users to ask questions.

9. Monitor your network – Review router, firewall, and host logs on a regular basis. If this task takes too much of your time, then consider an integrated log management and reporting tool. If you have a central syslog logging server, be sure that it’s kept up-to-date and secure. An Intrusion Detection System will let you see and correlate activities that will go unnoticed when using simple logging only. Better yet, and Intrusion Detection and Prevention System can block the malicious traffic. If you have an IDS or IDP system, be sure to keep signatures current. If there is no IDS or IDP in place, you should immediately start looking into something that will meet your requirements.

10. Keep Internet accessible hosts on a DMZ – Any host that can be directly accessed from the Internet should be in a Demilitarized Zone network, not your internal LAN. For example, web, mail, and ftp servers should be on a separate network segment that is connected to the firewall only. Firewall rules are then created to allow access to these systems from the Internet, and to allow these servers to communicate with systems on your LAN.

11. Apply those security patches! – Lately this seems to be a daunting task, keeping up with vendor provided security patches and hot-fixes. Whatever it takes, it must be done. There are some tools available to help manage this process for large numbers of servers. Some OS and application vendors are providing better patch distribution functionality, but for most systems it’s primarily a manual process. You should be keeping current with security-specific patches for all hosts, firewalls, routers, and appliances on your network. Monitor security and vendor web sites and mailing lists for the latest news on security patches.

12. Anti-Virus everywhere – All systems, from notebooks and desktops to mission-critical servers need to be protected from viruses. If you have Anti-Virus software running everywhere, make sure it is configured to properly protect your systems. It should be against corporate security policy for users to disable Anti-Virus protection, unless authorized to do so. Virus signatures should be updated often. In light of the recent barrage of malware, it’s a good idea to check for signature updates on a daily basis.

13. Closely guard modem remote access services – A single host with a modem connected to an analog line can completely circumvent your security strategy. Although it doesn’t get the attention it used to, finding a host running PcAnywhere with a weak or non-existent password will usually result in full access to the companies’ internal network and applications. Systems that must be made available in this manner must be closely monitored, and full auditing and logging capabilities should be enabled. Regular WAR-Dialing exercises should be performed to inventory modem usage, and to identify weak authentication requirements.

14. Harden all production systems – Any system that will be used in a production environment, whether internet-facing or internal, should be hardened. Tests should be performed to assure that baseline security requirements are met before system deployment. After hardening, be sure to also test the applications that the system will run. Once you’ve developed a procedure that meets your requirements, you can automate the process using scripts or third party automation tools.

15. Categorize and segregate systems – Organize systems into categories based on their importance to the organization, and their function. Next, segregate systems into secure ‘zones’ based on these categories. This allows you to provide countermeasures that are better aligned with each systems security requirements. Additionally, more extensive countermeasures will be efficiently deployed, exactly where they are needed the most.

16. Get working on those security policies – If you have written policies that relate to corporate information systems, they probably need to be updated. Many things have changed in a short period of time. If your company has no written policies, first create an Information Security Roadmap that outlines the current risks and how they can be addressed. From this, security policies can be developed for the topics that are pertinent to the environment.

17. Locate and secure wireless networks – If you have wireless access points connected to your corporate LAN, be sure to change the default SSID and require the use of strong encryption. A wireless local area network (a.k.a. WLAN) should be treated as an untrusted network, and secured as a Demilitarized Zone (DMZ). If you don’t think you have wireless in use at your company, running a WLAN scanning tool might surprise you.

18. Provide regular security training for your IT staff – On a regular basis, your IT staff should be exposed to training that will increase their knowledge of information security best-practices. This is one of the best investments a company can make when it comes to protecting their environment. Learning on the fly to deal with a major incident, that could have substantial financial ramifications on your business, just doesn’t make good business sense. The ROI of this type of training is always very high.

19. Implement network time services – Implement a central time management system in your environment. One or more Network Time Protocol (NTP) servers should be installed on your network and configured to pull accurate time from a reliable reference server. At a minimum, all network architecture and security systems on your network should point to your NTP time servers to coordinate time. This will assure consistent timestamping of log data across platforms. This is especially important when researching firewall, router, and intrusion detection and prevention logs while investigating suspicious activity.

20. Be prepared for an incident – If your network were attacked today, would you know what to do? Procedures should be in place to help assure proper identification, containment, eradication and recovery to get your company back in business. If you don’t have a plan in place then a good place to start would be to read the ‘Computer Security Incident Handling Step-by-step Guide’ published by SANS. This 74 page guide is available in printed and electronic PDF format from the SANS Store at: http://store.sans.org/store_item.php?item=62. Also, have the phone numbers of important contacts (ISP, Firewall Support Vendor, Company CIO, Human Resources, Legal, etc.) printed out and kept in a safe place just in case.

Copyright (C) 2004 Kenneth M. Smith

Checklist For Protecting Your Credit Card Information Online

Kenneth M. Smith CISSP CISA QSA


I am an information security consultant and a PCI Qualified Security Assessor. I have worked with companies to help them lower their risk when it comes to protecting customer card data and personally identifiable information (PII). I have seen some pretty interesting things, some of which I would rather not share or will not share due to non-disclosure agreements. I will let you surmise what I mean by "interesting".

But an important part of the equation is consumer awareness and good practice when it comes to using credit cards, whether online or at retail establishments. Below is my first attempt at a checklist for consumers when using their credit cards to make purchases online. I assume that you are practicing basic safe computing by using a Firewall, Anti-virus, and Anti-Spyware software. There are 18 items and they are not in a specific order of importance.

Note: In a future installment I will provide a checklist specifically related to retail purchases as there are also plenty of steps you can take to protect yourself when visiting your local restaurant, gas station, or other retail establishment. Dealing with a case of card fraud and identity theft is also quite a chore, not nearly as easy as some might make it sound. I am also working on a checklist for dealing with such an event.

1. Avoid using your email address as your login name. Don’t use your email address as your login ID on web sites that you use your credit card to make purchases from. It’s a common practice now that web sites default to using your email address as the login name. This is for convenience and to help address the problem of users forgetting their login name. The problem is that if your login information is compromised on just one site, it could be assumed that you used not only the same login name (email address) but the same password too. Now all the attacker needs to do is to try this same login name and password on other sites.

2. Delete online accounts you no longer use. Remove your credit card information and your login account from sites you no longer frequent. It will only take a moment and it will reduce your exposure. If the site does not make this easy to do this online, call them or send them a letter with your request.

3. Change your password regularly. And I don’t mean once a year here. A reasonable time frame is probably every few months or even more frequently depending on your online buying habits. If the site does not make it easy to change the password, contact them for assistance on how to do this yourself online.

4. Use complex passwords. This goes without saying but I continue to be amazed when performing security audits at how many people use very simple passwords. Consider using passphrases instead of passwords and mix it up with numbers, upper and lower case letters, and other punctuation characters. If a web site doesn’t allow the use of characters other than numbers and letters in the password, complain! This just isn’t good security practice.

5. Don't log in using your SSN or account number. Do not log into sites using your full social security number or account number as the login ID or password. If any sites you use require this, contact them and demand that they change this practice. There is really no reason for this.

6. Perform initial web site registration for services that provide online access as a benefit. You likely have credit card, bank, medical, insurance, 401k, and other sites that make online access to your accounts possible as an additional benefit. You may not even be aware that you have online access to your account as a counterpart to your standard account management method. The first time sign-in to some sites may use a portion of your social security number or other personal information as part of the initial sign up confirmation process. If you don’t plan on using such sites, contact the company and request that they disable online access to the account. If you do plan on using the site, perform the initial login as soon as you can and assign a complex password to the account. Also, as mentioned above, avoid using your email address as your login name.

7. Read the security and privacy policies of web sites that you use for card transactions. A number of large well known sites clearly stipulate that they are not responsible if your account or data is compromised and that there is no expectation of security or privacy on their part. Most users of these sites are probably not aware of this. Consider the consequences of using such sites.

8. SSL doesn’t mean your data is secure or that the company follows best security practices. Don’t trust sites that have a security and privacy statement that simple says “this site is protected with the latest SSL security technology so your information is secure”. This really bugs me to see this as a security statement on a web site. SSL only protects your information in transit between your web browser and their web server during your session. This means nothing when it comes to protecting your information once it is saved to their server, or leaves their server to be processed or stored elsewhere. Read their policy on protecting your information after the transaction.

9. Don’t make online card transactions from an untrusted computer. This includes Kiosks, Internet Cafes, or even a friends computer. You just don’t know what might be running in the background capturing your transaction information.

10. Use online payment services. Use an online payment service to reduce the number of merchants that have your credit card numbers. These services reduce the possible ‘attack surface’ of your card information by keeping your credit card and identity information with the payment service, not with each of the merchants.

11. Don’t ignore warnings from your web browser. They appear for a reason and you should read them. Don’t get in the habit of clicking Ok or Cancel before you know what the warning is about. An error could be a sign of a malicious site redirect, man-in-the-middle, or phishing attack.

12. Use additional security features offered by the site. If the site offers additional security features, like those that confirm the authenticity of the site and the user computer, use them. They help ensure that you are connected to the actual site you intended, not a spoofed site.

13. Watch for the lock. You’ve probably been reminded of this hundreds of times. But it’s worth mentioning it again. If there is no lock, then the site is not using SSL. If the lock indicator does appear but it looks “broken” or there is a line across it, then there is a problem with the web sites SSL certificate. Click on the lock for more information about the problem.

14. Avoid logging in from the main page of web sites. There are some sites that provide login fields on their main web site page which are not initially secure (no lock displayed). This, they claim, is for user convenience. In most cases, the actual login will usually then be carried out encrypted with SSL, but not until you enter your login information and click login. This behavior is inconsistent with the idea of ensuring that the site is secure (you see the lock) before providing your login information. A simple workaround is to click on the login button without providing a login name and password. You will see a login error but you will immediately be redirected to a secure login page where you can login as usual.

15. Do not use the ‘remember me’ feature for sites in which you use credit cards. For many sites, this means that they will store a persistent ‘cookie’ on your computer so they will know it’s you the next time you connect to the site. If your system were to be compromised, that ‘cookie’ is all that’s needed to login to your account without a login name and password. Note that this is different than the new feature of some sites that let you 'register' a computer as a system that you normally use to login. Also, after an online card transaction, remember to always click on the “log out” button and then close the browser window.

16. Do not use a debit card for online purchases. Most credit cards provide some form of protection in case fraud were to occur. For example, you are usually not liable for any fraudulent purchases if you notify the card company quickly. But you don't normally get these protections and liability limits if you use one of the many types of debit cards available that can also be used as if they were a credit card. They are not truly a credit card.

17. Check your credit report often. Many victims first learn of fraudulent accounts created on their behalf while reviewing their credit report. One of the tell-tale signs is a new address showing up in your credit report that is obviously not yours. At a minimum, you should be requesting your free credit reports from http://www.annualcreditreport.com/ or by phone at 1-877-322-8228 every 12 months.

18. Check your card statement as soon as it arrives. Many victims first learn that their card has been used fraudulently while reviewing their monthly statement. Be diligent and read it as soon as it arrives. Also, if you don't get your statement around the time it normally arrives, be concerned. Contact the card company to make sure the delay is on their end, and that someone didn't fraudulently change the address on the account.

Contents Copyright (c) 2007 Kenneth M. Smith