“Here I (we) go Again…”; GlobalCerts.net hacked August 27, 2012
Posted by Chris Mark in cybersecurity.Tags: anonymous, cyber war news, data breach, globalcert.net, hack, mark consulting group, PCI DSS, security
add a comment
On this lovely Monday morning on the opening week of College Football (WAR EAGLE!)…I open with some classic Whitesnake and their awesome song from 1987: “Here I go Again”. It seemed appropriate since here ‘we’ go again with another hack and data compromise. According to Cyber War News, GlobalCert.net was hacked and their data posted to Pastebin..according to the report, GlobalCert.net’s web database was hacked and over 1000 clients’ data posted online by Anonymous. GlobalCert.net’s website says the following about their website:
“GlobalCerts provides a comprehensive solution that meets a full range of secure messaging needs—including an automatic, transparent, inter-organizational secure messaging product, the SecureMail Gateway. GlobalCerts also offers a trusted, scalable, user friendly solution to overcome the hurdle obstructing many organizations from deploying a standards-based, secure messaging solution. SecureTier is a hands-off global, certificate management solution for key creation, discovery, and revocation. No other key distribution and discovery system is as effortless and efficient as GlobalCerts’ solution.”
Seems that GlobalCert.net should practice what they preach 😉
“A Rose by Any Other Name…” – Selecting the Right InfoSec Professional August 22, 2012
Posted by Chris Mark in cybersecurity.Tags: CISA, CISSP, cybersecurity, data security, experts, information security, mark consulting group, qualfications, Social media
add a comment
Last week I had an experience that left me chuckling and shaking my head at the same time. I had been approached by a company that had some infosec needs. According to the person with whom I spoke, they had found me on LinkedIn and wanted to talk. This company had recently settled with some regulators over some privacy and other regulatory practices and were looking to beef up their security and compliance. I spoke to one person for about an hour and a half and was asked to send more info. Later that week I received a call from the person with whom I had spoken an was informed that the company was looking for someone with INFORMATION SECURITY experience. I (likely not so politely) asked what they thought I did for a living? His response was that the company was looking for someone with a computer science degree. It was curious that they did not say an information assurance degree, or cybersecurity degree…or…list an certifications or skills…simply computer science. Well then…there you have it. Apparently, this company feels the only real qualification for ‘infosec’ is a computer science degree. Considering their previous issues, you would think they would have a better handle on info sec and their needs.
When looking for an infosec professional understand that there are technical skills which are certainly important (encryption, configuring firewalls, devices, systems, app layer security etc., etc., etc.) There are other aspects which are important, as well. Understanding the compliance mandates as well as the various regulatory requirements and regimes is critical in today’s world. While not specifically defined as ‘infosec’, an understanding of privacy issues (how data is used) is also important. While understanding technology is critical, being a skilled infosec professional is about more than simply understanding technology and about more than computer science. While I may not have been right for that particular engagement for other reasons, the company’s laser focus on a ‘computer science’ degree at the exclusion of the other aspects suggests this company may be focused on the wrong areas. Maybe they should question why they had issues to begin with.
“You Can’t Unring That Bell!” – What is a”Data Breach” and When Should I Notify? August 21, 2012
Posted by Chris Mark in cybersecurity, Data Breach.Tags: cybercrime, cybersecurity, data breach, FISMA, HIPAA, HITECH, NPI, PCI DSS, PHI, PII, privacy, risk management, state breach notification
add a comment
There are currently over 45 state breach notification laws, several data protection laws, and numerous regulations including PCI DSS, HIPAA/HITECH, FISMA, and more. I frequently find myself working with companies on data breach notification plans. One of the more interesting (and heated) discussions comes when I ask them to define a “data breach” or “data compromise”. More interesting is when I ask them to define a “suspected data breach”. Visa’ rules state that “suspected” breaches must be reported within 24 hours of identification or there could be penalties. Consider the following example. You, as CSO, are informed of a malicious software outbreak in the customer service department. Does this require notification under the state breach notification laws, or relevant regulatory regimes? Maybe, maybe not. It is dependent upon a number of factors including access to data, data protections (ie. encryption), segmentation, the various laws etc. In short, it is not easy to decipher yet it is critical to be as accurate as possible.
Understanding what is, and what is NOT, a data breach or data compromise is the first step in defining your company’s data breach notification plan. The reason it is so critical is in the titled of this article. Once you notify that your company has been ‘breached’ you cannot ‘unring that bell’. The genie is out of the proverbial bottle and things start moving quickly. Most company’s would absolutely hate to make an announcement only to find that, while they may have experienced a security incident, it did not impact sensitive data (PII, CHD, NPI, PHI, etc.). It is important that you work with your compliance group, legal (don’t forget legal!), and the infosec & risk department to ensure you have a solid understanding of when, and under what conditions your company is required to notify of a breach or suspected breach. Here are some basic definitions to use as a starting point. (check with your legal council and don’t simply use these…there..that should protect me!;)
Security Incident/Event – Any event that compromises the availability, accessibility, or integrity of any asset. This includes systems, personnel, applications, services, etc.
Data Breach – Any exposure of or unauthorized access of sensitive and/or protected data to include PHI, PII, CHD, and NPI.
Suspected Data Breach– In the absence of direct evidence (identified fraud, or misuse of data, for example), any Security Incident in which it can be reasonable assumed that sensitive and/or protected data was exposed or accessed without authorization.
Remember, some state breach notification laws do not consider a breach of encrypted data as a trigger for notification…others do 😉 If you need help unraveling these issues (insert shameless marketing plug)…contact Mark Consulting Group…www.MarkConsultingGroup.com
graphic by Hippacartoons.com
“Old Ironsides & The War of 1812” – 200 Years Ago Today August 20, 2012
Posted by Chris Mark in Uncategorized.Tags: barbary, HMS Guerriere, old ironshides, USS constitution, war of 1812
add a comment
Many Americans would likely be surprised to learn that the US has a ship built in 1797 that is still in active service. The USS Constitution, known as “Old Ironsides”, was launched in 1797 and fought in numerous battles and wars including the First Barbary Wars and the War of 1812. Here is a previous post I wrote about the Barbary Wars.
August 19th, 2012 marks the 200th anniversary of one the battle that gave the ship her nickname. In 1812 the Constitution waged a fierce battle with the HMS Guerriere in which the Constitution was victorious and the the HMS Guerriere, too badly damaged to bring into port, was burned at sea.
“Wanna Bet?..Yup…Straight8 I wanna CombatBet!”…Now You Are Asking What the Hell? August 15, 2012
Posted by Chris Mark in Uncategorized.Tags: challenge coin, combatbet, free fall, jason swarr, Marine, MFF, Recon, security, straight8
add a comment
So I just had an opportunity to catch up with an old Marine buddy named Jason. Jason owns Straight8 Photography. He is a retired
Recon Marine and was an instructor with me at the Basic Reconnaissance Course in late 1990’s. As I am talking, he mentions that his wife owns CombatBet. I couldn’t believe it! CombatBet is the “new” challenge coin. For those unfamiliar, ‘challenge coins” have been around for years and are coins carried by people in units that identify their membership etc. (too much history to explain). Long and short, it sucks to carry 10 coins to hand out. They are also expensive and not super customizable. I have been handed a half dozen of these over the last couple of years and didn’t know who was behind them! If you are looking for either a great photo or some kick ass poker chips, you have to take a spin by Straight8 Photography or CombatBet.com…BTW…if the pic looks familiar it is Jason with his daughter and was in the scrolling credits of Act of Valor…courtesy of Straight8…
Global Security, Privacy, & Risk Management 