The Blind Spot of Insider Threat

October 29, 2015 | Leave a Comment

By Paul Calatayud, Guest Blogger, Code42

Code42_Insider_ThreatSecurity threats from inside the organization are increasing, but too many organizations hesitate to address the issue. They’re afraid that monitoring employee behavior implies they don’t trust employees. Today, the reality is that employees are often unintentional actors. They’re increasingly being used as vectors and vessels by sophisticated cyber organizations, which want employee credentials to access valuable data.

We’re seeing an increase in employee-targeted phishing attacks and credential theft, because the credentials allow hackers to bypass a huge amount of security investment—the firewall, the perimeter, the encryption—essentially 90% of your security strategy.

As CISOs, we need to get past the insider blind spot to adequately protect our organizations. The first step is to define insider threat more accurately and more tactfully—as either a known actor with motive and opportunity or an actor who unknowingly becomes a conduit, who is essentially a victim.

I try to take an approach that defends against both scenarios, an approach that says: “I’m not sure if your credentials were handed to the bad guy or harvested through malware. Regardless of how it happened, if there’s a deviation or situation where a credential is suspect, then we will detect and respond.”

The bigger challenge is how to detect the deviations. And that requires understanding what the normal state looks like. If you were to look at Edward Snowden and say you wanted to protect against that type of data breach, then you have to be able to understand at what point his access and his abuse occurred. At what point did he go from his normal three years as a contractor to someone behaving maliciously.

Or in the case of Anthem, in which a database administrator’s credentials were stolen, when did that administrator’s normal network behavior change. If the admin logged in every day from 9 to 5 p.m. and then all of a sudden was logging in at 3 a.m., that would tell you something.

To understand what normal looks like at Surescripts, we’ve invested in advanced analytics and other technologies that allow us to profile good behavior. So if we had an Edward Snowden, I would have been able to see and potentially detect the moment he started to abuse his privilege, because I’d have a historical view of his digital behavior over the past three years.

The key for any CISO to gain support for this type of internal profiling strategy is not to focus on distrust. Rather, focus on the need to find the anomalies that lead to internal data breaches—by both intentional and unwitting internal actors.

Paul Calatayud is the Chief Information Security Officer for Surescripts.

Spread the Message Beyond the Experts

October 28, 2015 | Leave a Comment

By Andrew Wild, Chief Information Security Officer, Lancope

PrintOctober is National Cyber Security Awareness Month. But if you’re reading this blog, chances are good that you are an experienced information security professional and that you’re focused on awareness every month! So, how do you explain security awareness to others, especially co-workers, family members and friends that are not information technology experts? In this article, I will share some of the tips that I pass along to my family and friends.

A funny but accurate analogy I’ve read on the Internet that seems to work with non-IT folks is:  Passwords are like underwear…

  • Change them often.
  • Don’t share them with anyone.
  • The longer the better.
  • Don’t leave them on your desk.

All kidding aside, the three most important points to share about password security are:

  1. Ensure you create a strong password. There is a lot of information on the Internet that defines a strong password.
  2. Don’t reuse passwords. Many people still use the same password on multiple accounts.  Stress the importance of not reusing password across accounts.
  3. Don’t share your password with anyone. Surprisingly to IT security professionals, there are many people that don’t know that support staff from an organization will never ask you to give them your password.

Most people hate passwords though, and telling them they have to use a different password for every site and that the passwords have to be strong isn’t likely to be advice that will be followed.  Whenever I talk about password security, I always follow up by recommending the use of a password vault. There are many password vault solutions available at low or no cost that can help people manage their passwords. Most of the vault solutions also provide a mechanism to generate secure passwords too.

And finally, encourage people to take advantage of stronger authentication options that are now available. Many banks, email service providers and file sharing services now support some kind of stronger authentication for password security. The use of multifactor authentication significantly reduces the likelihood of your account being compromised.

We’ve been telling people for years not to open email attachments, and most people do understand the risks of opening unsolicited attachments, but now it’s not only about attachments, it’s also about not clicking on URLs contained inside email messages. We can tell people to be careful about clicking on links, but the reality is that it is often difficult to tell if a link is good or bad. A resource that I have found to help people understand the thought process for evaluating a link is the nice flowchart from Intel Security. They also have an online test that is a useful way to check your understanding.

Cyber Monitoring
Inside our Enterprise environments, we’ve implemented extensive cyber monitoring capabilities to quickly and proactively detect anomalous behavior within our networks (check out Lancope’s StealthWatch® System). Many online IT solutions have capabilities for detecting unusual activity and notification. Banks and credit card companies can send notification by SMS (text messaging) or email for a variety of events including financial transactions over a user-defined threshold. Many online service providers allow users to configure multiple email addresses for an account and can send an alert by SMS or email when a password is changed. Monthly online account activity information is also available for many services, showing geo locations from which the service was accessed (obtained by examining the source IP information). Encourage friends and family to enable and use these cyber monitoring capabilities to proactively look for anomalous activity on their accounts.

Patch Patch Patch
Encourage the frequent updating of operating systems, applications and plugins for computers and mobile devices. Updating web browser software and their plugins has become very important given the extensive use of web applications. A tool that I find very useful to help friends and family check the health of their web browsers and plugins is the Qualys Browser Check. This easy-to-use tool can identify vulnerabilities in browser software and the plugins used by browsers.

These are some of the ways that I help my friends and family secure their online assets. I hope these are helpful, and remember that the Stop Think Connect message is not just for National Cyber Security Awareness Month, it is a year-round approach that everyone should adopt.


Consumer IoT Security Impacts

October 27, 2015 | Leave a Comment

By Brian Russell, Co-Chair, CSA IoT Working Group

Within the CSA Internet of Things (IoT) Working Group, we are researching various topics related to securing IoT implementations within an enterprise. One of the more interesting aspects to consider on this subject is the role that consumer IoT devices play in regards to enterprise security.

News of exploits against consumer IoT devices is common, and research into vulnerabilities related to poor development and configuration choices continues. Rapid7 recently published a significant research report on baby monitor exposure and vulnerabilities, which showed that many leading brands are still highly vulnerable. Download their report.

Another interesting aspect of consumer IoT security is the apparent inability to rely upon the consumer to safeguard the underlying network that IoT devices use to communicate. Consumers are often proponents of usability over security, and in the past some consumer IoT device makers have purposefully chosen to value usability over security. This is somewhat understandable, as most people would prefer not to have to configure unique security credentials for each IoT device that operates within their home. Of concern though is that adding new (non-secure) points of connection into the home provides an ability for malicious parties to gain access to other computing resources in the home – potentially leaving sensitive data such as passwords exposed. This is concerning for an enterprise security practitioner because many people choose to use the same passwords to protect both corporate and personal information and application access.

What’s interesting also is that consumer IoT devices do not always stay within the home. A report this year by OpenDNS provided a great deal of data that showed that IoT devices, or the associated applications installed on staff computers, were often found to be communicating with services over the internet from the Corporate network. In some cases, Smart TVs were brought into the enterprise, and these devices were pre-configured to talk with service addresses/ports on the internet. In other cases, fitness trackers were associated with applications that were loaded onto laptops or mobile phones, and then those applications began communication with the manufacturer through the corporate network. Read the OpenDNS report.

At this point, education is likely the best defense against the exposures that consumer IoT devices introduce to the enterprise. Security staff should be educated to identify when inappropriate devices and software is being used on the network, and all staff should be educated on the need to secure their connected home systems as part of a larger effort to keep data secure.

Join the CSA IoT Working Group.

Brian Russell is the Chief Engineer/CyberSecurity for Leidos. 

The Definition of Cloud Computing

October 26, 2015 | Leave a Comment

By Ross Spelman, Group Technical Services Manager, Espion

Ross_Spellman_HWhat is the cloud and why should I go there?
The transition to cloud services offers major opportunities for your organisation. Significant scalability, flexibility and cost-efficiency can all be achieved through the adoption of cloud-based solutions. Migrating to the cloud can be a scary prospect for many organizations. In fact, the question is often asked: What actually is cloud computing, and why do I need to go there? Drawing on our consultants’ wealth of knowledge, we have put together a comprehensive definition of cloud computing, outlining how to get the best out of this new technology.

Cloud Computing Defined
Cloud Self ServicesOn Demand Self Service
At the touch of a button your cloud environment should be there for you. For example, if your IT team were to come under pressure to add or change software, platforms or infrastructure and make them available to your users, they should be able to make these additions instantly. It’s an instant access environment provision.

Ubiquitous Network Access
Internet cloud, conceptThis is the beauty of cloud – you can access it from anywhere via the Internet. You don’t need any specialized ingress point into your environment; it’s readily accessible for anyone with Internet access. You can access it anytime, from anywhere. This benefit is crucial to all aspects of your organization. All your team needs is an Internet connection and they can log in and use all their enterprise applications and systems, including all their data and resources from any location. This can be vital for remote workers, such as salespeople on the road who are trying to close that quarter-defining sale.

There are risks with this of course; companies need to keep control of who has access to the cloud and what data they are able to access. The benefits that come from having ease of access also create risks. Our experts regularly work with organizations to define the criticality of their data and then categorize it, based on their requirements. It’s important to apply controls to your environment to ensure the right people are accessing the right data.

Location Transparent Resource Pooling
Location transparent resource PoolingThe cloud allows you to pool your resources, so an organization can exploit its assets 24 hours a day. By pooling your resources in a cloud you can utilize your software, platforms and infrastructure through shared services, allowing your users to get the most out of your assets. Pooling strategies include the likes of data storage services, processing services and bandwidth provision services. This provides huge economies of scale for organisations and provides the means to really embrace the global office. As your workforce shuts down for the day on one side of the world, your team on the other side can get up and continue working from the same platforms, applications and infrastructure. The cloud allows you to sweat your assets from anywhere.

Rapid Elasticity
The beauty of being in the cloud is the ability to scale up and scale down your infrastructure at a moment’s notice. The ability to auto-scale in the cloud eliminates much of the risk associated with scoping requirements for technology projects. With traditional environments on premise, if you under-scope the design for an environment and the demands on it prove higher than expected, you lose revenue. Conversely, if you over-scope and sales are lower than expected, you increase costs unnecessarily. The ability to scale your infrastructure at will allows you to design environments with a degree of confidence not available with traditional models.

Once again, this benefit comes with its own risks. It’s imperative that this is monitored on a regular basis. The ease of scaling up and down environments brings financial rewards but also heightens the risk. If an environment is scaled up to meet peak demand and left as such when it’s not needed, this can have negative implications.

Proper, consistent management of this service is the key to success.

Measured Pay Per Use
When in the cloud, you only pay for what you use. This means you can offset your operational savings against your capital expenditure and truly reap the financial benefits. Resource usage can be monitored, controlled, and reported, providing transparency for both the provider and consumer of the utilized service. In addition, this allows for a much more predictable and closely-controlled method of financial accounting, moving from Cap-Ex to Op-Ex budgeting.

Three Ways to Improve Your Personal Cyber Safety

October 23, 2015 | Leave a Comment

By Gavin Reid, Vice President/Threat Intelligence, Lancope

For National Cyber Security Awareness month there a couple of relatively easy-to-do things that I highly recommend if you want to improve your personal cyber safety. These important protections are easily available but not well documented.

One of the biggest cyber security problems impacting users today is the reuse of easy to guess passwords across multiple sites. All it takes is for one site to be compromised and the hackers can then use your password to log into others. This process is often automated and run against all sites. To help combat that ensure that you have a *unique*! password for each site. No one can remember multiple unique complex passwords so invest in using a tool like roboform or 1password to manage these passwords and keep them safe. Once you have installed a good password manager go back to each site you use and replace your common password of “petname123″ and let the password manager create a long and complex password for you like “yott2&uv0ugs7.” Save that password and go on to change the next one. Set a complex password that you DO remember for your password manager. It’s only one and it can be recalled from memory.

Don’t be afraid of the cloud! Losing all of your newly-created complex passwords to a hard drive crash would be a terrible loss. Make sure you sync your password file in the cloud to be able to access them across multiple devices (phones, tablets, laptops) and always have a backup. Roboform has its own cloud storage built in and 1password uses Dropbox or iCloud. Your passwords are encrypted with AES encryption so even if someone somehow broke into the cloud provider and stole your password list, they cannot decrypt your passwords without the one complex password you committed to memory.

The next step to ensure you won’t be an easy victim is to set up two-factor authentication for some sites that are more important to your personal cyber security like Gmail, eBay and PayPal.

You may not have thought about it, but your personal Gmail account ties many things together. For example if you use Gmail as your email address for your Amazon account, if someone hacks your Gmail they can force a password change to access your Amazon account. Similarly, your bank and many other systems may use your email as a way to allow for password resets.

Criminals can also use your Gmail account to send out legitimate looking email requests for emergency help to all the people in your address book like the email below:


How you doing? I made a trip to London (United Kingdom) unannounced some days back, Unfortunately i got mugged at gun point last night! All cash, Credit card and phone were stolen, i got messed up in another country, stranded in London, fortunately passport was back in our hotel room. It was a bitter experience and i was hurt on my right hand, but would be fine. I am sending you this message cos i don’t want anyone to panic, i want you to keep it that way for now!

My return flight leaves in a few hours but Im having troubles sorting out the hotel bills, wondering if you could loan me some money to sort out the hotel bills and also take a cab to the airport about ($1,550). I have been to the police and embassy here, but they aren’t helping issues, I have limited means of getting out of here, i have canceled my credit cards already and made a police report, I wont get a new credit card number till I get back home! So I could really use your help.

You can contact the hotel management through this telephone number (+449444045232), you could wire whatever you can spare to my name and hotel address via Western union:

Name: John Hastings
Location: 201 Bunaby Street, Chelsea,
Greater London
SW10 0PL.
United Kingdom

Your Gmail account plays an important part in your overall internet safety. It is very important you set a strong password and enable two-factor authentication. Here is how to do it:

  • Login to your Gmail account then go-to the following URL
  • Click on “Get Started” then “Start Setup.” Enter the number for your phone and verify the number by entering the numeric code that Google sends to the phone by either text message or voice call.


  • You can also choose to use the smart phone app Google Authenticator, which you would register through the same wizard shown above. To install Google Authenticator click here for iOS or here for Android. Either way works and will stop people from easily taking over your personal email (and of course your online identity!).

PayPal and eBay
If you use either of these services, they are high-value target accounts for crime. PayPal is especially problematic as it links directly (in most cases) to your bank account. EBay accounts, on the other hand, are often hijacked then used fraudulently to sell nonexistent items, leaving the account owner to work out the mess. I highly recommend you protect yourself by setting up two-factor authentication for both accounts.

Setup instructions for PayPal:

Go to


This will give you the option to set up a secondary authentication method. You have three choices, pay a small amount and they will ship you a small fob that will provide one-time passwords to use as a secondary authentication for your account (i.e. a hacker can’t get into your account by just guessing your password or resetting it). The second choice is a more convenient one if you have a smartphone. You can download the Symantec VIP Access program for smartphones. Or you can just have PayPal send messages to your mobile like we did with Gmail.

When you get the token software installed on your smartphone, authenticate it to your PayPal account and register its unique ID. Now when anyone wants to use your PayPal account, they will have to have both your username and password and the one-time token password your phone or fob would generate. Note: you can also tie this token to your eBay account.

There was a lot of work to do to get to this stage. It is unfortunate that this process is obscure and not built-in or easier to enable. I am sorry to say that there is one more step if you use Gmail with any applications that auto-check email. I have several, such as the Microsoft Outlook client for Mac. These applications do the authentication automatically. For convenience with only a small security risk I can use Gmail to set up application- or device-specific passwords. These fixed passwords can ONLY be used by the same app on the same device. You can do this by editing the “authorizing applications & sites” button in the Gmail account settings.

When you click edit, it will force another authentication then allow you to set up, manage and track application-specific passwords.

So that’s it. I wish it was easier, but these are a couple of steps that can make your internet identity much harder to abuse.

California Leads the Way with Data Privacy Ruling

October 22, 2015 | Leave a Comment

By Rachel Holdgrafer, Business Content Editor, Code42

Code42_CA_Digital_Privacy_Rights (1)Should electronic communications and metadata be afforded the same legal protections as printed correspondence? The State of California thinks so.

Introduced in February 2015 and signed into law on October 8, 2015, the California Electronic Communications Privacy Act prevents law enforcement agencies from requiring a company to turn over metadata or digital communications without a warrant. Home to a large majority of technology-based companies including Apple, Google, Facebook, Dropbox, LinkedIn and Twitter, the State of California recognized the need for updated state privacy laws. In the wake of the NSA scandal and the resulting decline in consumer trust that vendors would (and could) protect individual’s digital privacy, California took action to avoid further negative impact on its technology businesses.

The California Electronic Communications Privacy Act is a move toward instating meaningful digital privacy rights. It is also the clarion call for lawmakers to take up the mantle of privacy protection by proactively changing existing privacy laws to include digital communications. The legislation echoes recent decisions by the Supreme Court in which Fourth Amendment privacy rights preventing unreasonable search and seizure were upheld and expanded to include GPS trackers and cellular phones.

Requests for access to electronic communications are growing at exponential rates. Google reported a 250% jump in government demands for access to digital data in the past five years. AT&T reported a 70% increase in demands for location information in the past year and Verizon reported that only 1/3 of the 15,000 requests it received in 2014 included a warrant. Twitter experienced a 52% increase in access demands in 2015 as well.

The California Electronic Communications Privacy Act takes a ground-breaking stance on digital privacy that the American Civil Liberties Union (ACLU) hopes will spread to other states in coming months. The ACLU urges individual states to take action rather than wait for sweeping federal legislation due to glacial progress in Washington, D.C. Despite having 300 supporters in the House, the Email Privacy Act has failed to receive a floor vote. Clearly, technology companies cannot wait for federal legislators to tackle this issue.

Data privacy is at the heart of every cloud-based or security-based business. Without updates to current legislation—at the federal or state level—technology companies and their customers are left in a precarious position. Other states would do well to follow California’s lead and implement data privacy legislation that accounts for how people communicate in the 21st century while we wait for Washington, D.C. to get moving.

EU-US Safe Harbor: Model Clauses – Not All They’re Cracked Up to Be…

October 21, 2015 | Leave a Comment

By Willy Leichter, Global Director, Cloud Security, CipherCloud

eggIn a recent blog post, we referred to the now defunct EU-US Safe Harbor framework as a house of straw, while comparing the European Commission (EC) Model Clauses (the theoretical replacement) to a house of sticks – better, perhaps, but still vulnerable to wolf-force winds.

It turns out we are not the only ones falling back on children’s story analogies. In a webinar last week, a prominent privacy lawyer from DLA Piper stated that “it will take a while to put Humpty Dumpty back together again” implying that Model Clauses were not going to instantly fix a fractured EU data privacy system.

While cloud vendors including Google, Salesforce and Microsoft have rushed to offer customers amended contracts with Model Clauses, there is increasing evidence that this approach will not be acceptable to many of the EU data protection authorities (DPAs) as a simple replacement for Safe Harbor. Initial statements from a number of DPAs highlight how fragmented and subjective European data protection has become:

  • The Austrian DPA initially stated that it would accept EC Model Clauses as basis for transfers of personal data to the US. Subsequently it clarified that the DPA would still have to approve specific transfers based on Model Clauses.
  • Authorities in Spain have opposed the idea that EU Model Clauses could be used as the sole basis for exporting data to the US.
  • One of seventeen German regional DPAs (in Schleswig-Holstein) announced its view that because of the European Court of Justice (ECJ) decision, data transfers based on the EU Model Clauses are not permitted anymore.
  • The UK ICO issued a statement that businesses will need to review how data is transferred to the US but “we recognise that it will take them some time for them to do this.”
  • DPAs in Ireland, France, Italy, Netherlands, Belgium, and Portugal have issued statements that they are studying the issue and hope for a “shared position” from authorities across Europe.

The core debate is that the ECJ decision striking down Safe Harbor was based largely on the Snowden revelations regarding NSA programs. While the EC Model Clauses provide clearer jurisdiction for EU DPAs, they still make exceptions for “legally binding law enforcement requests” which could still include compelled disclosure to government agencies.

So what should multi-national businesses do with all this uncertainty?

  • You could stop using the cloud or transferring data across the Atlantic. That might make the DPAs happy, but it’s unlikely to be practical, sustainable, or make business sense.
  • You can ignore the issue, wait for the dust to settle, and hope a new blanket Safe Harbor replacement is agreed upon. That may take a while, and privacy advocates like Max Schrem now have the green light to challenge other data transfers.
  • You can take proactive steps to reduce you exposure by anonymizing sensitive personal data before it leaves a country. Many of our customers have taken this approach using a Cloud Access Security Broker (CASB) to encrypt or tokenize sensitive data and are confident they can avoid this legal quagmire.

CASBs: A Better Approach to Cloud Encryption

October 20, 2015 | Leave a Comment

By Anurag Kahol, Founder and CTO, Bitglass

Widespread enterprise adoption of public cloud applications like Office 365 has not come without security and compliance concerns. Most cloud apps function like a black box, providing little visibility or control over the handling of sensitive data. When cloud applications leave security gaps that the enterprise simply can’t live with, thoughts often turn to cloud encryption options.

This data may exist as structured data in an app like Salesforce, or as unstructured data in file sharing apps like Box or OneDrive. In either case, a cloud access security broker (CASB) provides a way to encrypt the data using keys that you control. A CASB also provides a central point for monitoring and managing access to those resources.

Encrypting cloud data at rest with CASBs
CASBs provide a central point of visibility and control across any cloud app used in an enterprise. Control comes in various forms, including contextual access control, data leakage prevention, and of course encryption for data at rest. A CASB works by mediating connections between cloud apps and the outside world, typically via a combination of proxies and API connectors to applications.

A CASB, or cloud access security broker, mediates the connections between end users and cloud applications,
providing a central point of visibility, access control, and data security.

CASBs have become the de facto answer to encryption for cloud data at rest. Unfortunately, in order to make data searchable when encrypted and stored in the cloud, early CASBs cut down on the number of initialization vectors used in their products which limits the number of possible encrypted versions of a given string. This same approach makes the encrypted data subject to attacks, such as a chosen plaintext attack. Why bother encrypting if you use weak schemes that can easily be cracked?

Full-strength cloud encryption with Bitglass
Bitglass takes a patented “split index” approach to searching cloud-based content that allows you to have your cake and eat it too — that is, full-strength crypto and search. In a nutshell, Bitglass brings the trusted security of a private cloud to powerful and flexible public cloud applications, allowing you to safely take advantage of apps like Office 365, Salesforce, Box, and ServiceNow.

Unless a user accesses the cloud application through the Bitglass service,
he or she will see nothing but meaningless ciphertext.

With a few clicks, CASBs like Bitglass can replace sensitive data inside of the application with copies encrypted using keys that you control using the encryption algorithms of your choosing — which means your existing key management system works out of the box. The encrypted data can be stored in the cloud app or on-premise; in the latter case, the only thing stored in the cloud application is an encrypted pointer to where the data lies in the local data store.

When a user searches for data, the search query is executed against a local search index, returning all of the associated pointers to Bitglass. Bitglass then searches the application for those pointers and retrieves the encrypted files or records, decrypting data for the user on the fly.

Because data is encrypted in the app, it’s not readable by prying eyes. Even within your organization, access is provided by policy. In fact, unless the user is accessing the application securely through Bitglass, they will see nothing but meaningless encrypted pointers.

Many enterprises forgo the power and flexibility of public cloud applications for the sake of data security and compliance. With a split-index approach to cloud encryption, these businesses can have both without undermining the strength of the encryption or sacrificing the functionality of the applications. It’s an approach to cloud encryption that should make a cloud-first strategy more attainable for the most security-conscious of organizations.

Want to learn more? Watch our Glass Class on Cloud Encryption.

Managing Shadow IT

October 14, 2015 | Leave a Comment

By Rachel Holdgrafer, Business Content Editor, Code42

Code42_Shadow_IT“Shadow IT,” or solutions not specified or deployed by the IT department, now account for 35 percent of enterprise applications. Research shows an increase in IT shadow spend with numbers projected to grow another 20 percent by the end of 2015.

Experts agree that shadow IT is here to stay, particularly the growing tendency to use cloud services for collaboration, storage and customer relationship management.

Enterprise organizations can’t afford to bypass the productivity and profitability that comes with a happy and enabled mobile workforce. However, the utilization of SaaS that IT has not vetted and approved may expose regulated or protected personal data, which a business is responsible for remediating.

California leads the way in the privacy arena with the Security Breach Notification Law and Online Privacy Protection Act. The Federal Trade Commission is the primary U.S. enforcer of national privacy laws, with other national and state agencies authorized to enforce additional privacy laws in vertical industries such as banking and health care.

Sanctions and remedies for non-compliance with FTC data protection laws include penalties of up to US $16,000 for each offense. The FTC can also obtain an injunction, restitution to consumers, and repayment of investigation and prosecution costs. Criminal penalties include imprisonment for up to ten years. In 2006, a data broker agreed to pay US $15 million to settle charges filed by the FTC for failing to adequately protect the data of millions of consumers. Settlements with government agencies can also include onerous reporting requirements, audits and monitoring by third-parties. A major retailer that settled charges of failing to adequately protect customer’s credit card numbers agreed to allow comprehensive audits of its data security system for 20 years.

So, what is the answer? How do you start to get a handle on shadow IT?

Ask employees which cloud services they are using. You might also need to utilize a combination of automated and manual discovery tools to get a complete picture of what programs employees are using and what data is hosted and shared in provider clouds. These “cloud consumption” dashboards can monitor and assess cloud usage and detect encryption tools at each host.

Protect your data.
Implement automatic backup of all endpoint data in the enterprise to capture a real-time view of where employee data lives, when and where it moves and who has touched it—even as it moves to and from non-approved clouds.

Act fast when the inevitable happens.
The reality is a breach may be inevitable, but you can recover. With continuous and automatic endpoint backup, IT can quickly evaluate the content of files believed to have been breached and act in good faith to lessen the impact. Additionally, understanding what was stolen allows a company to make an accurate disclosure and manage consumer confidence issues.

For CIOs and IT staff accustomed to maintaining complete control over their digital ecosystems, relinquishing even a bit of this control can be terrifying—even in the name of productivity. And yet, with a security strategy that focuses on complete data visibility, they can empower mobile workers while minimizing the risks associated with the dark side of shadow IT.

CSA Release Cloud Forensics Capability Maturity Model Report

October 12, 2015 | Leave a Comment

CSA’s Incident Management and Forensics Working Group today released its “Cloud Forensics Capability Maturity Model”, a new research report that describes a Capability Maturity Model (CMM) that can be used by both cloud consumers and Cloud Service Providers (CSPs) in assessing their process maturity for conducting digital forensic investigations in the cloud environment.

Even the most capable enterprise cannot avoid data breaches entirely. As such, there is a rising need for enterprises to adopt mature forensic security processes. This need will rise at least at the speed at which adversaries improve their attack strategies and techniques. This situation is even more complex in the world of cloud computing. Only with close cooperation between the cloud consumer (who has given up some control) and the CSP (who has inherited it) can adequate, timely and accurate forensic analysis occur.

The target audience for this paper is enterprise users that deal with all aspects (technical and organizational) of their forensic processes, and that plan to or have already integrated cloud IaaS services into their IT infrastructure. The starting point for the model was the Carnegie Mellon University Software Engineering Institute’s (SEI) “Software Process Maturity Framework” which identifies five progressive levels of process maturity:

LEVEL SEI Capability Forensics Question
1 Initial How are we ever going to do this?
2 Repeatable Have we done this before?
3 Defined What is our process for doing this?
4 Managed What resources did this require?
5 Optimizing How can we do this better?


The report provides detailed guidance for each question via scenario planning and recommended process mapping.

To download a free copy of the report, visit: