Simplifying the Web Site Security Issue

Web site security vulnerabilities are a common problem but few web site owners, business operators or even web designers truly understand the nature of the problem. 

I wrote some time ago about why web site security is important for everyone but it is a hard concept to communicate to people who have little or no understanding of the technology involved in hosting a web site, Internet service or e-commerce business. 

So this article is an attempt to make a non-technical comparison which can be understood by anyone. 

Imagine you own a Conference Centre (your website). This facility has lots of rooms (pages) and attracts hundreds of attendees (visitors or customers computers) every day. Some attendees will come regularly for different courses or will cover the same course over and over again. 

Other attendees may have a quick look around and decide they aren't ready to do a course just yet. But may come back later. 

Unbeknown to you, one of the training rooms has a broken lock on the fire exit (vulnerability) through which every day a hypnotist enters. 

This hypnotist is a nasty person (malware) and he quickly hypnotises (infects) everyone in the room. He tells them to gather as much information on the financial transactions of those around them as they can. Then, when they hear the keyword "download", they will divulge all the information they have gathered and forget what they have done. 

So the attendees go off about their day-to-day activities and, without realising what they're doing, quietly gather the information. 

They collect the bank statements and account details of their family and loved ones, they watch as people enter PIN numbers at the checkout and they copy down and skim credit card details. 

They also collect security codes, PIN numbers and password used for non-financial purposes because they know people reuse them frequently and they may be useful. 

Then, a few days later a phone call arrives and the keyword is mentioned. The attendee passes everything they have gathered to the hypnotist. 

Days, weeks or months pass before anyone starts noticing. First it's a card transaction declined. Then it's bailiffs calling round and before long the reason is understood - the family and friends of the attendee have been the victims of identity theft and fraud, and have lost thousands. 

Tens, hundreds or even thousands of people have been robbed of thousands or even millions of pounds. 

Eventually, the auhorities trace the cause of the problem back to the Conference Centre but there's no sign of the hypnotist. 

All that happens now is the attendees lose confidence in the Conference Centre and stop coming. Very quickly the centre goes out of business. 

And all because the owner of the conference centre didn't make sure the facility was secure. 

Secure Thinking When Online

If you run a small business or you manage the HR department of a large organisations you may well be aware of some of the issues surrounding staff use of social networking sites.

Social networking sites such as Facebook, professional networking sites like LinkedIn, and the various personal and professional blogging facilities, not to mention the micro-blogging sites like Twitter provide everyone with an opportunity to communicate with others with whom they have an affinity, voice their grievances and raise awareness of issues.

The problem for businesses and employers is when employees over-step the professional/social boundary.

If employees use social networking to make comments about the company, fellow employees, management or customers it can have a dire effect on business, perceptions and relationships both inside and external to the organisation.

Whilst many companies are aware of this and take some steps to mitigate the risk, it is often only done using a stick.  The general approach appears to be to discipline anyone who oversteps the mark - even when those marks aren't clearly defined.  This leads to further frustration and ultimately a breakdown in relations between employer and employee.

At Secure Thinking, we believe that this approach is wrong and have now decided to do something about it.  We are therefore offering a new awareness service - Secure Thinking When Online - where we will come on site at your company, or other location, and present to your staff about the risks of online behaviour, why the rules exist and how to protect themselves in their everyday internet based activities.

New Year's Resolution

It's that time of year again when we all make new year's resolutions.  It's pretty much par for the course.  We will be all enthusiastic for the 1st few days or maybe even weeks (if you're really keen).  Then it will all tail off into nothing.

The same story happens every year - why should this be any different?

Well how about setting a New Year's Resolution you can stick to?  One that will enhance your professional and business reputation?  One that will bring huge benefits to your organisation?

The New Year's Resolution I'm talking about is to call Secure Thinking and let us see if we can help you improve the Information Security within your business.  We can look at your current  information security policies, procedures and controls and investigate whether they are effective and are protecting your business interests.

We can also help you out with ongoing information security management which can plague businesses and is frequently ignored by busy owner managers.

So whatever information and IT security needs you may have, whether you require help with business processes such as security policies, procedures and standards, with employee education  in the form of awareness, guidelines and training, or with technical solutions such as anti-virus, encryption and secure backups, contact Secure Thinking now and make this year's resolution one that truly benefits you and your business!

10 Information Security Tips for Businesses

Businesses are recognising the importance of the information they manage, and more companies than ever deal with sensitive information on a regular basis.  So whether you are a one-man-band or a multi-national corporate entity here are Secure Thinking's 10 Information Security Tips for Businesses:

1. Implement policies and guidelines
Implement policies, processes and guidelines - the rules of the game - that are appropriate for your organisation.  This means a top-down approach to information security showing that your organisation is committed and willing to invest in protecting it's data.  Remember that often, the simplest solution is the best so keep your rules simple because doing so makes them easier to follow.

2. Lead by example
Senior level buy-in is vital but business owners and senior management must also follow the same policies and guidelines, otherwise it becomes a pointless exercise as staff will bypass them in the same way.  That means it's vital to lead by example, showing your team that you take information security seriously.

3. Staff education and training
It may seem obvious, but if you don't educate your staff on their information security roles and responsibilities then you can't expect them to provide effective protection for your data.  You should not only teach your staff what they have to do and the rules they must follow but also why it is important to you, how they do it and who they should speak to if they have any questions or issues.  It is important here to make the process as entertaining and fun as possible as it is seen often as a very dry, if not dull topic.

4. Business processes
It is important to implement appropriate business processes in your organisation and to align them with your information security policies as much as possible.  Otherwise it may become easier to bypass the controls you have implemented in order to achieve your business goals.

5. Technical solutions
In the same way as it is important to have appropriate business processes, it is also vital to implement appropriate technical solutions.  Many organisations see IT as the driving force in protecting their data.  However, this is not the case.  IT is simply one of the tools available and you therefore have to ensure your technical solutions and IT systems provide your organisation with the protection it desires in line with your information security policies.

6. Spot checks
A good way to ensure your staff follow your information security rules is to employ a regime of spot-checks.  It is important that this should be done to raise awareness of issues and not as a method of punishing those that fail to follow the rules, after all you need your employees to buy-in to the spirit of the program not merely follow instructions like sheep.  A great way of achieving this is to encourage staff to come up with ideas for improving security and reward the best ideas.

7. Test and measure
In addition to performing your own spot-checks, it's a good idea to employ an external agency or consultancy to test your security controls on a regular basis.  Many corporate bodies have regular penetration tests of IT infrastructure and less frequent tests of physical security.  Smaller businesses might see this as overkill but unless you actually test your controls you have no idea as to their effectiveness!

8. Check your suppliers
Most companies make use of 3rd party service providers.  Whether it's for your IT, web hosting, accountancy or legal operations it's important to ensure your suppliers take the same care and consideration over their information security (and yours) as you do.  It's no use having fantastic information security controls only for every Tom, Dick and Harriet at XYZ IT Support Company to have access to your sensitive data because they provide your IT support services.  Take the time and ask questions - ask to see their policies, how they vet their staff, and what controls they employ to protect your data.  At the end of the day, protecting your data is your responsibility.

9. Plan for the worst, hope for the best
In the same way that it's a good idea to have business insurance, all companies should invest in a Business Continuity Plan.  This means looking at the threats to your business, the risks posed by them and how you respond in order to continue operating should the worst happen.  Your Business Continuity Plan needs to cover all the high risks to your business and should be tested and reviewed on a regular basis to ensure it meets your changing operational requirements.  Obviously, testing a Business Continuity or Disaster Recovery Plan completely may be prohibitively expensive but there are ways of assessing the plan without necessarily having to buy hardware or pay for office space.

10. Incident response
Although having all the policies, processes and guidelines, the correct technical solutions, and excellent staff awareness will give you the best chance of not having an information security breach, it doesn't guarantee it.  Therefore, it is essential that you have a clearly defined process for responding to an incident.  This should include reporting points, escalation, evidence gathering and media management.  It should also clearly define the roles and responsibilities for relevant personnel and how your organisation reports the breach to the relevant authorities - be they law enforcement, the Information Commissioner or regulatory bodies - and of course how you inform the individuals or companies concerned.

10 Social Networking Security Tips

Social Networking is the biggest thing to hit the internet since it began.  The sheer numbers involved are staggering.  If Facebook was a country it would be the 3rd largest in the world behind India.  It can be a massive force for good, yet it comes with inherent dangers, not least of which is to your security.

As such Secure Thinking have produced our 10 Social Networking Security Tips, to keep you safe and secure whilst chatting with your mates!

1. Don't publish too much
Don't publish too much information about yourself, your personal life, and your family online.  Things to avoid if possible are full dates of birth, mother's maiden name, 1st pet's name, 1st school, or make sure you lie to these types of things.  After all, they are all used by major institutions as "security" questions, so don't make it easy for someone to target you.

2. Assume everything is public
Always assume that everything that you post on the internet will at some point become public domain.  The rules and settings employed by the service provider now might change in the future.  Never post or say anything online that you wouldn't want your mum, your boss, future employers or future partners to find out about!  This includes "chats" with other people and "status updates", all of which have the potential to be public or become visible to others.

3. The internet never forgets
Unlike you an I, who have a habit of forgetting things on a regular basis, the internet won't forget.  That means the embarrassing photo's from your stag/hen party will still be hanging around the next time you get married!  And even if you delete images or remove content, there's a good chance it's been copied, backed-up or cached by another internet service.  This is an important fact that people tend to forget.

4. Don't "connect" with people you don't know
Don't accept "friend" or "connection" requests from just anybody unless you're aware of the risks.  Accounts of users are regularly monitored and targeted for malicious purposes with the intention of gaining something - either identity information or more often money in some way.

5. Don't trust even your "friends"
Remember, unless you can verify the identity of a user account without simply trusting they are who they claim to be don't trust them!  A genuine friend could have had their account compromised or someone may have set-up an account in their name with the intention of gathering information on you and others you know.

6. Don't announce your plans to the world
If you're going on holiday to Thailand for a fortnight, that's great, but don't tell the world and his wife when you're going, when you're returning, which hotel you're staying in and who's traveling with you!  This information is brilliant for burglars, muggers, identity thieves and anyone else who fancies free board and lodgings in you home while you're away.  Remember points 4 and 5!

7. Be wary of "apps"
"Apps" are great fun, what harm could they do, they're all provided by the site?  This isn't true.  Many "apps" are developed by individuals and companies external to the social network you're using and they often re-use code segments from other apps.  As such there's no guarantee the apps you're using are simply there for your enjoyment and aren't harvesting your data.  Now some harvesting is done for legitimate marketing and research purposes, but some of it is also done with not so innocent intentions.  As such be wary and don't download/install/add the "app" unless you really need to.

8. Avoid location based services
I know they're the new up and coming "thing", but I personally don't like the idea of having my movements tracked, even if it means I save a few quid at Starbucks.  Again, like point 6, you don't know who else has access to the information and who knows if the terms of service might change at some point in the future?

9.  Check your settings
All of the current social networking sites come with some form of privacy or security settings.  Now these might seem confusing and a bit pointless, but it's worth taking some time to go through and understand them to ensure you're protecting yourself to the best of your abilities.  If you need help then see if there's an FAQ, speak to someone who understands how they work or simply stay off the site.  Either way, make sure you have the settings at the level you feel comfortable with and that protects your data.

10.  Never post anything sensitive
The last point is almost the same as point 2, but here we're emphasising the need to avoid posting potentially sensitive personal or business information which could cause you or your company/employer harm.  This could be something as innocuous as a tweet saying "Off to meet XYZ corp now, back in an hour".  There is the potential that this could be privileged information and might allow your competitors to see who you're dealing with or who your clients are.  It could provide them with a competitive advantage or it could land you in trouble with your bosses, regulators or courts, depending on the issue at hand.


Now all of this might seem a little to paranoid for some of you, but as "they" are out to "get you" surely it's not paranoia!?

The importance of having an Information Security Awareness Programme

Most businesses are starting to recognise the importance of information security, both from the perspective of regulatory or legal responsibilities, and from a viewpoint of good business practice and brand protection.

But information security policies, procedures and practices are only as good as the people and systems that operate them. If the people who work in the system don’t understand their role, their responsibilities and why the controls are in place, then the results can be as bad for your organisation as not having them there in the first place.

Over the last few years there have been many stories in the press about information security failures within major organisations and government bodies. These organisations almost certainly had information security policies in place at the time of the failure. So why did it still occur and what can we learn from the mistakes of others?

As already stated, information security policies are only any use if they are understood, are adhered to and ultimately enforced as part of the culture within an organisation. Many of the well publicised information security failures have occurred because either the staff involved didn’t know their responsibilities, weren’t aware they were breaching the policies, or were operating without adequate supervision.

Another common failing is that information security policies do exist but are complex documents, unlikely to be thoroughly digested and understood by staff, even where they have apparently ‘signed them off’. This often means that staff ignore, or at best pay lip-service to the policies and the only time they are truly understood is following a security failure.

In most cases, a programme implemented to raise awareness of information security may well have prevented the failure, either partially - reducing the impact of the failure; or completely, by preventing the breach from occurring in the first place.

A carefully implemented information security awareness programme, encompassing properly documented, easy to understand security policies, standards, procedures and staff guidelines, along with ongoing training and evaluation, is a proven method for reducing information security failures.

It ensures your staff are aware, not only that the policies exist and that they are expected to adhere to them, but also why they exist, what their responsibilities are and how to operate on a day-to-day basis to maintain the required level of security. It also allows management to understand the levels of awareness within the organisation and provides them with the ability to target any specific issues which may arise.

Finally, even a good information security awareness programme needs to be backed up with a policy of open reporting. Having a ‘blame culture’ is not a good environment in which to raise information security issues. Staff need to feel they can report actual or potential problems without the threat of some kind of retaliation or witch hunt!