Cloud Privacy Concerns – Over sharing and Over Collecting

Social Media has quickly woven itself into the very fabric of everyday life and computing. This boom in sharing, even the most banal of details, has had a resounding impact on how our profession manages enterprise security. In this presentation we’ll explore strategies for managing the risks associated with:

• Job loss, revenue loss
• Data Loss Prevention
• Brand Protection
• Privacy Erosion
• Malware Protection

We’ll examine the basic law that governs ALL internet activity in the US.
We’ll further delve into KEY FTC decisions that impact online activity.
Using case studies from the US and around the world, we’ll examine how people have lost jobs, college degrees, fortunes and freedom through social media.
We’ll investigate the rampant OVERCOLLECTION of customer and subscriber data by major corporations.
And finally, we’ll review success stories from the past 300 years, where lone individuals and committed groups have improved security, society and human life spans.

3 CPEs will be offered.

Register at: https://isc2.brighttalk.com/node/914

The FTC has emerged as the leading investigator of privacy and security breaches, and has sanctioned companies and institutions across industries for breaches.  This presentation reviews the FTC’s track record, examines lessons learned from each sanction, and provides guidance based on current and proposed regulations.

Continue Reading

Many firms have chosen to become PCI compliant, others are content to sit by the sidelines and hope they won’t get caught.
Countless other firms have engaged in PCI compliance efforts, only to fall short and have significant breaches while being PCI compliant.

Continue Reading

This presentation discusses trends in financial crimes, and the role of technology in adding a new twist to old crimes.

Information explosion has led to an exponential growth of information security breaches. Information security breach occurs when there is an unauthorized acquisition and disclosure of private information including Social Security numbers, or credit/debit card numbers. These data breaches lead to financial crimes and identity theft.

Continue Reading

PDF Article

It’s no secret that Google retains search data and metadata regarding searches—in fact, it’s quite open about doing so. What’s unsure, though, is the long-term threat to information security and privacy. Let’s review Google’s elements.

Google Search: This search engine is gathering many types of information about online activities. Its future products will include data gathering and targeting as a primary business goal. All of Google’s properties— including Google Search, Gmail, Orkut and Google Desktop—have deeply linked cookies that will expire in 2038. Each of these cookies has a globally unique identifier (GUID) and can store search queries every time you search the Web. Google does not delete any information from these cookies. Therefore, if a list of search terms is given, Google can produce a list of people who searched for that term, which is identified either by IP address or Google cookie value. Conversely, if an IP address or Google cookie value is given, Google can also produce a list of the terms searched by the user of that IP address or cookie value.

Orkut: Google’s socialnetworking site contains confidential information such as name, email address, phone number, age, postal address, relationship status, number of children, religion and hobbies. In accordance with its terms of service, submitting, posting or displaying any information on or through the Orkut.com service automatically grants Orkut a worldwide, nonexclusive, sublicensable, transferable, royalty-free, perpetual, irrevocable right to copy, distribute, create derivative works of, and publicly perform and display such data.

Gmail: The primary risk in using Gmail lies in the fact that most users give their consent to make Gmail more than an email-delivery service and enable features such as searching, storage and shopping. This correlation of search and mail can lead to potential privacy risks. For example, email stored on third-party servers for more than 180 days is no longer protected by the Electronic Communications Privacy Act, which declares email a private means of communication.

Gmail Mobile: Mobile phones are increasingly being sold with Gmail built in, and if not, it can be downloaded. The questions to ask: How uniquely does your mobile phone identify you as the user, and when was the last time you changed your phone and your identifiers?

Gmail Patents: Gmail’s Patent #20040059712 emphasizes “Serving advertisements using information associated with email.” This allows Google to create profiles based on a variety of information derived from emails related to senders, recipients, address books, subject-line texts, path name of attachments and so on.

Google Desktop: Google Desktop allows users to search their desktops using a Google-like interface. All word-based documents, spreadsheets, emails and images on a computer are instantly searchable. Index information is stored on the local computer. Google Desktop 3 allows users to search across multiple computers. GD3 stores index and copies of files on Google’s servers for nearly a month.

Chrome: Chrome is Google’s browser. It’s available for download today and will eventually be installed on new PCs. Some of the risks it poses include:

• Every URL visited gets logged by Google
• Every word, partial word or phrase typed into the location bar, even if you don’t click the Enter/Return button, gets logged by Google
• Chrome sends an automatic cookie with every automatic search it performs in the location bar.

Android: Android is Google’s operating system for cell phones. It retains information about dialed phone numbers, received phone-call numbers, Web searches, emails and geographic locations at which the phone was used.

Google Health: This product allows consumers— such as employees, coworkers and customers—to store their health records with Google. Recently, CVS Caremark, along with Walgreens and Longs Drugs in the United States, agreed to allow Google Health users to import their pharmacy records.

Organizational Threats Uninstalling these products or using competitive tools can mitigate many of these threats. But what about the dangers to your organization? One example is Google Search with its Google Flu Trends (www.google.org/ flutrends).

Google has correlated flu data from the U.S. Centers for Disease Control (CDC) from 2003 to the present with its own search data. Spikes in users’ searches about flu treatments correlated tightly with the CDC data. Flu Trends has demonstrated Google’s ability to analyze search data for a specific term or set of terms. And it can retain this data and where it came from because Google in its privacy policies states that it records IP addresses.

So, what’s to stop Google from analyzing all search data from your organization’s networks? What’s the difference between analyzing flu trends and “Top 100 search terms from XYZ Corp.”? Or what if a company were to correlate regional threats from swine flu with search data from Google Health/Prescription data and then analyze the health of its employees and detect longterm effects?

Overall, the most critical threat is reliance on Gmail— whether the setting is universities, cities, companies or countries switching to Gmail en masse, or the newest employees in the organization using Gmail as their primary or sole email platform. Questions to ask your security team: How big is the organization’s email archive? How many years of emails are saved? If your organization switches its email hosting service to Google Gmail, what happens to the privacy and confidentiality clauses in your employee and customer contracts?

Another area of concern for hosted email is the potential of having to turn that data over to the government. Google, Yahoo and Microsoft have a history of complying with the United States’ and foreign governments’ requests for information. If such data is turned over, how much corporate security is being eroded?

Consider the amount of money and manpower dedicated to handling Microsoft Windows patches, viruses, spyware and botnet detection. Imagine the impact that reliance on Google products could have on corporate privacy and security.

By: Rajesh Goel, Chief Technology Officer, Brainlink International Inc.

Raj Goel, CISSP CTO Brainlink International, Inc. raj@brainlink.com 917-685-7731 Raj’s LinkedIn profile

This article appeared on CPN Online

Q: How effective are Internet security tools these days and what new tools or processes should I be using to protect electronic access to my business records and communications?

A: The first thing to note is that talking about Internet security by itself makes no sense. That’s akin to asking, “How do I protect my car in the garage?” without looking at the overall security of your house, neighborhood and locality.

When people talk about Internet security, what they really mean is,”How do I protect my sensitive information?” That is, information security.

Information security involves:
Determining what and where are your information assets– databases, paper files, online systems, emails, accounting systems, PDAs, laptops, etcetera;
Classifying the assets by value;
Determining who should and should not have access to that information;
Determining which regulations and standards apply to your business. At the federal level, Gramm-Leach Bliley, HIPAA and Sarbanes-Oxley provide written standards that organizations must meet, depending on the nature of their business or clientele. At the state level, 31 states have passed State Privacy Breach laws (California’s SB-1386 was the first, while New York and Massachusetts have the toughest). So if you have clients in any of those 31 states, complying with those laws is a must. At an industry level, two standards stand out: PCI-DSS for any company that accepts credit cards, regardless of industry, and the National Association of Realtors’ REALTOR Secure standard. PCI-DSS and REALTOR Secure are industry standards, and do not have the force of law behind them. However, complying with them can improve business practices, provide competitive advantages and even provide a safe-harbor defense in case of a breach.
Putting systems in place to enforce security, log unauthorized access, etcetera.

Thus, there is no simple answer to information security–each organization is different, as is how they conduct business and the culture of each firm will determine the choice of tools and success of the individual information security program.

In our experience, a good InfoSec program delivers the following benefits:

It requires the organization to become aware of existing laws and how they impacts the organization. E.G. Gramm-Leach-Bliley, for instance, expanded the definition of financial institutions to include real estate firms, auto dealerships and appraisers. So if you appraise property, hold funds in escrow or otherwise lend credit in the course of doing business, GLBA may consider you a financial institution and requires that you safeguard clients’ personal indentifiable information. Failure to secure PII can results in penalties including civil monetary fines of varying amounts as high as $1 million or more, prison sentences of as much as five years, lower examination ratings and increased reporting requirements, and enforcement actions, which can include board resolutions, memorandums of understanding, written agreements and cease and desist orders.

A good InfoSec assessment answers the following questions: – What business are we in?
- Where do our clients come from?
- Who are ARE our key clients?
- Which clients or lines of business should we get rid of, outsource or spin off?

Complying with the laws and standards helps your company stand out from its peers, reduces liabilities and damages in case of breaches and increases profitability.

In our experience, one of the things we uncover is the roadblocks and logjams that are interfering with productivity: for instance, if the way forms are handled or cases are approved or projects are delivered or goods are sold is too slow or too cumbersome or the process was built 10 or 20 years ago.

In many cases, we reduce transaction time, increase deal flow and/or reduce staff and labor costs by analyzing the information flows, diagramming the information-flow touch points and working with our clients to eliminate roadblocks.

When fixing the issues (“remediating the gaps” in InfoSec jargon), new technology and faster systems can be brought in that really show results at the bottom line.

I worked with a large retailer to complete a PCI compliance assessment, and shaving 1/100th of a second per transaction (multiplied by millions of transactions per month) led to a significant increase in profits.

For a health care chain, the result of the PCI compliance efforts was the adoption of a new electronic health record system that reduced errors, eliminated patients filling out the same medical intake questionnaire again and again, reduced keying and transcription costs and led to better health care. Reduced waiting times also allowed the chain to book more appointments.

For a commercial property management firm, we identified systems and services that were being hosted by third-party vendors that were bleeding the business. We moved these critical systems in house and saved the client a fortune. Moving them in house also led to lowered compliance and management costs.

So, what’s your information security policy? What business practices and roadblocks have you been tolerating that, when removed, could increase your profits by 10 to 30 percent?

By: Rajesh Goel, Chief Technology Officer, Brainlink International Inc.

Raj Goel, CISSP CTOBrainlink International, Inc.raj@brainlink.com 917-685-7731 Raj’s LinkedIn profile

This article appeared on CPN Online

A: What are the pros and cons of going with VOIP as my company’s main telecommunications set-up?

B: Here’s why you might want to switch to VOIP:

• The cost of VOIP calls is significantly lower than use of traditional telecommunications. Many providers offer a flat rate and unlimited calls within the continental United States. Some include flat-rate charges to selected countries as well.
• If you have staff that travel extensively overseas or are opening a branch office, many providers will let you ship a pre-configured handset to other countries. All they have to do is plug it into a network with Internet access and immediately, they appear as another extension in your office.

The two key areas where we see VOIP adding tremendous value are office moves and reconfigurations and unified messaging/Outlook integration. With moves, whether of whole offices or cubicles, across the floor or across the country, simply unplug your handset, unplug it, move to new space, plug it in and your phone number just moved with you. This initiative saves tremendously on reprinting costs, since – no new business cards or letterheads need to be printed. This also saves on move costs and setup costs. Unplug/plug—it is not necessary to reconfigure or changie PBX configurations.

When it comes to unified messaging and Outlook integration, VOIP straddles both
voice and data, with the VOIP packet routed the same way as are emails or Web traffic. In addition, many providers allow integration of your VOIP phone with Outlook. Suddenly, your entire Outlook contacts list is your phonebook / speed-dial list. Going a step further, you can have your emails, faxes as TIFF or JPG attachments and emails as WAV attachments with or without automated text-to-speech conversions show up in one place.

Further down the road, we see the next logical step for many companies will be to integrate email + fax + voice + instant messaging + video chat + video conferencing + virtual meetings into a single system. Voice as a standalone product will disappear or become subsumed into a larger communications suite.

There are, though, downsides to VOIP. Among them:

• Services are changing rapidly and there are no large, well-established, single vendors that everyone uses. So you’re going to have to deal with startups or at best mature but small companies. The larger telecommunications players–Sprint, Verizon, ATT, etc.–still haven’t embraced VOIP as a core product to sell to customers (though they all use VOIP internally to route calls).
• Each VOIP company has their preferred handset and backend platform, so if you switch providers, you may not be able to take your handsets with you. Or when you switch providers in 12 or 24 or 36 months your choice of providers may be limited by the handsets you adopted.
• Like PCs, laptops and cell phones, and unlike traditional phones, VOIP technology is constantly changing. What was state-of-the-art just six or 12 months ago is now a paperweight. So if you adopt VOIP, plan on upgrading your phones every few years, just as you upgrade PCs and laptops.
• Regular phones get hacked–that has been true since phones were invented. PBXs have been hacked for ages, whether by the vendors shipping with standard passwords or users selecting weak passwords. VOIP can also get hacked. Just as VOIP makes re-routing calls to new locations or countries easier, it makes hacking easier. VOIP security is a brand-new field, and the IT security community is still wrapping its head around the subject. Meanwhile, we’ve already seen attacks ranging from fraudulent calls to hackers cloning the complete voicemail tree for banks and calling victims from spoofed phone numbers.

Furthermore, unlike traditional phones, where the voice team rarely, if ever, worked with the data team, going forward, the integration between the voice, data and IT services teams will have to get stronger.

Overall, though, the advantages to using VOIP outweigh the disadvantages. VOIP is here, and it is the future. The only question is: When will you adopt it? And will you adopt it proactively or will it be forced on you by the market?

Send your technology questions to Rajesh Goel, chief technology officer at Brainlink International Inc. at Raj@brainlink.com

By: Rajesh Goel, Chief Technology Officer, Brainlink International Inc.

Very often, busines owners ask “How can I grow my business in this economy“?

The most common answer is, networking. Business Chambers, BNI, Gotham, Trade conferences, various societies, alumni groups, etc.

Many marketers will tell you ADVERTISE, use Social Networking – Facebook, MySpace, Twitter, MeetUp, etc. as a component of your outbound marketing activity (e.g. spams your friends, family and strangers you met at the last cocktail party…)

For most white-collar businesses (Accountants, Lawyers, Architects), there are legal or social norms as to why they can’t advertise or solicit as easily as Real Estate brokers, Soda makers, Car manufacturers, etc.

Frankly, if a white collar business got 500 new clients in 6 months, they might go under from the overload.  Most professional firms require 1-10 new clients a month.  Don’t believe me?  Check your sales records.  How many new clients did you get last month?  Last quarter?  Last year? Chances are, you have a long, soft-touch sales cycle.

There’s an old adage that says “Salespeople spent 90% of their time chasing new customers. Smart salespeople spend 50% of their time getting more business from existing customers.”

So, how do you grow your business smartly? Datamining!  Or as we used to call it, competitive intelligence.

Keep tabs on what your

• clients are up to – what new initiatives they’re up to?  Who are they connecting with?
• business connections — who they know?  What they’re working on, etc.
• find new employees or business partners
• Research the people you’ll meet at the next trade show or conference

Here’s a PDF tutorial on using  LinkedIn as a competitive research tool