Secure Value

Mobile computing creates business advantage, security issue ... 1-day workshop to learn to manage it all

Mobile computing creates a huge foundation for workforce efficiency and effectiveness as well an interesting toolbox for innovation. It creates an increased attack surface as well. 

Mobility poses many security-related challenges (such as anonymous connections, “always on” connections, cleartext network traffic, wireless networks, etc.), most of which are not usually fully addressed.

We routinely see these issues uncovered in customer security assessments where innovation unknowingly led to security exposures.  We also occaisionally hear from business leaders and innovators that security concerns are slowing innovation. 

Our CTO Jerod Brennen is facilitating a Mobile Security Workshop to help you regardless of where your concerns lie. The content is meant to help those too fearful to forge ahead, as well as for those that have already jumped and are seeing an increase in related security issues.  We are presenting the workshop with Quick Solutions.  

This workshop covers the technical, procedural and administrative solutions available to protect your organization against the risks of mobile computing.  It also includes a class exercise to evaluate a real-life mobile computing policy and forensics procedures to capture and preserve evidence from mobile devices.

Workshop topics include:

•    The nature and criticality of risks involved in various types of mobile computing
•    Risks in using wireless networks and control measures to counter them
•    Security steps to protect handheld devices
•    Exposures in mobile device applications and appropriate control measures
•    Policy, standard, and procedural provisions necessary to counter mobile computing-related risks
•    Procedures for mobile device forensics
•    Auditing mobile computing environments
•    Products and product features that mitigate mobile computing-related risks

Download Mobile Security Workshop or simply register and join us!

Jacadis Security Administrator Position Opening

We have an opportunity to assist a client with a security administration project. 

A detailed job description is attached. 

In summary we are looking for a top performing windows administrator with high integrity, familiarity with information security technologies and topics and a desire to grow into the information security field.

Please send interest to me via email.  Contact information is in the job description.

Download Security Administrator 2011

Business owners, senior managers, entrepreneurs: What is your compliance footprint?

When we started Jacadis in 2001 most work focused on assessing whether client's networks were secured, particularly at the firewall, and helping companies implement servers "hardened" or properly secured to be exposed to the public internet.

Today we still assess client networks to determine whether they are secured properly.  We answer the questions "are you vulnerable" and "are you secure" but those assessments include a lot of other assets that can be attacked such as web sites, mobile devices, remote access facilities, wireless as well as the paper in your dumpster and your employees. 

We are also increasingly asked "are we doing the right things to be compliant with this regulation, this contract, or this industry best practice. 

Every organization has some level of compliance obligation relating to how they collect, store, process, handle, sha and discard data.   An organization's obligations are determined by your organization's unique compliance footprint:

• What is the nature of your business?
• What types of data does your business collect, store, process, handle, share and discard?
• What government jurisdictions do you operate in? have customers in?
• What do your vendor and customer contracts obligate you to?
• What are the nature of your business processes?
• What are risks apply to your environment? business sector? location? technology choices?

Not knowing can lead to inefficiency, breached contracts and lost customers, fines, pain and pestilence. 

Knowing can lead to competitive advantage, new business, efficiencies and costs savings.

What is your compliance footprint?

Associate Security Analyst Internship at Jacadis

Jacadis is on the lookout for a tech-savvy, curious college student with an interest in information security and privacy to join our services team.  There is an opportunity for top performers to be offered a full-time position upon graduation.

Associate Security Analyst Internship

We are looking for a technically astute college student with an interestnd aptitude in information security, above average communication skills who is self-starting and hard working to join our professional services team on a part time basis.

Primary responsibilities may include some or all of the following activities:

• Assist in providing on-site and remote support for customer desktop, server and infrastructure devices.
• Assist in the installation, maintaining, configuring and monitor of customer systems and security controls.
• Assist professional service staff analysts in the performance of their services work.
• Assist the Jacadis IT manager in building and supporting a growing company network.

You will perform work under the guidance of more experienced team members.

Additional responsibilities will be assigned based on work performance and aptitude.
Ideal candidate needs to have a working knowledge of computer technology and an ability to work with people in a variety of settings:

• Basic knowledge in server, storage, hardware, network, operating system, software, application, database or other technologies is a must.
• Basic knowledge in Installing, troubleshooting, operating, testing, planning, and configuring relevant technologies is a must.
• Strong communication skills, customer focused attitude and team oriented disposition are required.
• Ability to pass a background check is a precondition to employment.

We are open to formally trained IT students or those "power users" who have a desire to work in consulting services, information security or IT services.  Top performers may be offered a full-time position on graduation.

Submit cover letter, technical resume and writing sample for consideration.

Armed Robberies Hit Close to Home

Our local business community is up in arms about a recent string of (currently 9) armed robberies that have occcured over the last several weeks. Many businesses are now taking extra precautions to protect their valuables and their employees.

In a community targeted release about the situation, Hilliard City Police Department suggests that

"Every business should take an active part in making their business safe. Here are some suggestions to help prevent robbery:

• Have at least two employees open and close the business
• Install a robbery alarm
• Place a surveillance camera behind the cash register facing the front counter with a digital recorder
• Vary times and routes of travel for bank deposits
• Keep a low balance in the cash register. Don’t leave large bills under the drawer
• Place excess money in a safe or deposit it as soon as possible
• Stay Alert! Know who is in your business and where they are.
• If you see something suspicious, call the police. Never try to handle it yourself.
• Use care after dark. Be cautious when cleaning the parking lot, taking out the trash, or going to your car after work.
• Make sure to post important signs “Clerk cannot open the time lock safe” , “Premises protected 24 hrs by video surveillance”, etc.
• Cooperate with the robber for your own safety and the safety of others. Comply with a robber’s demands. Remain calm and think clearly. Make mental notes of the robber’s physical description and unique characteristics."

Will Information Security & Privacy Compliance Come to This?

Image via Wikipedia

Yesterday a client rescheduled a meeting because "the State" showed up to audit their medical operations.  The State of Ohio regulators conducts spot visits in this industry on a spontaneous basis.  When they come in, typically unannounced, everything stops so that they can conduct their spot audit.

"Hi, I'm from the <FTC/HHS/DHS/ETC> and I need to see your log files and your patch management reports ... "

Do you think information security and privacy compliance will ever get to that point?

 

Why should senior management be involved in security decisions?

I am putting the finishing touches on an executive presention for a client.  Our finding, after a series of technical tests, a review of their policies and their security administrative compents was that they are generally proactive on securty from a technical perspective but any additional maturation or improvement of their program requires management involvement.

I am going to present this to senior management team that has already informed me they don't want to hear that message.

This isn't the first time Jacadis has encountered such a situation.

Why should senior management be involved in security decisions?

At some level security decisions are really risk management decisions and not just technical, information security decisions.  Even the strongest technical team can't know the risks, obligations, contracts and mission priorities that senior management brings to the table. 

Sorry, managers but this isn't just geeky stuff.

Here is a quick list of five questions that my client's technical team needs senior management input, involvement and or leadership on:

1. Are we obligated by law or contract to HIPAA?
2. Are we obligated to PCI?  Are we exposed in the way we handle crtedit card data?
3. How long can your business operate with reduced computer facilities?  Which facilities are most important to the mission?
4. How will we respond to illegal activity on our network? Attacks from outside? In the event of a breach?
5. What are our employees permitted to do with social media outside of work hours on their own computers?

Are you putting your technical team in a spot where you expect them to protect your business but don't share with them critical information or involve yourself in their decision making process?  If you are in a business that is data driven (and which business today isn't) your lack of involvement will likely ensure a high technical team turnover, raise the possibility that you will have security issues interfere with your business, decrease the resiliency of your business and potentially put at risk vendor and client relationship while also opening your business (and perhaps yourself personally) to legal and regulatory liability.

 

Gap between what employees think and do versus what employers think and do

Last week I gave a Lunch and Learn Presentation to a group of business people and enterpreneurs at the Dublin Chamber of Commerce on Living Securly in a Digital World. 

Researching the topic for fresh material I tripped across a Unisys study that shows a disturbing gap between what employees and what employers think about data use in the  enterprise:

• While 67% can access non-work-related websites only 44% of employers agree.
• While 52% of workers say they can store personal data on the company network only 37% of employers agree.

Do you have that same perception gap in your company?

As an employer it may mean behaviors you don't want, non-productive sites visited during work time or worse, malware introduced into the company network. As an employer, it may also mean extra storage costs or extremely awkward moments during terminations (can I have my data back?!).

As an employee, it may mean a disciplinary action for what you think is approved or allowed behavior.  And more importantly it might mean loss of personal data an information if you lose or leave your job (or the company closes).

It is in the best interests of both sides of this divide to close the gap.

What life tasks do you do online?

I am giving a talk to the Dublin Chamber of Commerce this Thursday on Living Securely in a Digital World.  As I've started preparing my presentation I've come to realize that almost everything we do or have done in the analog (fancy name for "real world") we can now do in the digital world.  I'm going to talk from  frmy experience, but I'd like yours as well.  Here are some things I do online that used to be real world things for me ... would you share your list?

• Communicate with friends
• Search for employees
• Plan and record my workouts
• Plan travel
• Maps
• Look up recipes
• Bank
• Invest
• Pay bills
• Stay informed
• Monitor boys homework
• Write and publish

When the snow flies & the power dies will the generator do its thing? You sure?

Forecast is for some snow tomorrow here in Columbus.  One of my clients just last week shared it had taken a couple of months to get maintenance to test the back up generator.  They finally went to fire it up to test that it worked and .... nothing.  Tried again.  Nothing.  Their hardware vendor responded quickly. Turns out that the broken part was under warranty but was 48 hours away.

The test was conducted on one of those warm sunny days we had before Thanksgiving.  We aren't supposed to get much snow tomorrow but you never know here in Ohio.  Had the part failure not been found until it was actually needed the 48 hour shipping wait could have been catastrophic.

Our client did two things right:

1.  They created a policy calendar.  Policies should be formal statements of value supported by the routines  (processes) that must be followed to meet the stated value. Most of the time though policies are dead documents that state something a client would like to do but doesn't get around to doing.  My client's policy calendar lets them manage the normal routines of their "HIPAA year" which operationalizes their compliance.

2.   They actually tested the process.  The IT Director didn't take no for an answer as maintenance continued to put his test request off. 

How are you doing?

Have you operationalized your HIPAA program?

Have you tested your generator, your back up processes and your contingency operations plan?