Security (b)log - English edition

2022-10-21

Parking in the cloud

Photo by author

It’s there in the distance: the car of the colleague who would take us away. You are looking through a crack in the closed steel gate of the parking garage of the International Criminal Tribunal for the former Yugoslavia in The Hague.

Let’s rewind 14 hours. That's when the two-day ONE Conference started in the World Forum, where nearly two thousand information security professionals from the Netherlands and abroad gathered to catch up on their field of expertise. Our team was also present with a delegation and because we were staying overnight in The Hague, we went to a Chinese restaurant together. After an excellent meal we wanted to take the tram or bus to our hotel, but that one colleague, who lives nearby and was by car, offered to drive us. Arriving at the parking garage (at 10:42 pm) his car seemed impossible to find at first, but after some time searching – and slight doubts about the parking memory of our colleague – we came to that steel gate where we saw it. Unreachable.

The doorman of the associated hotel was kind enough to walk with us. "Ah, I see. You are in the garage of the Tribunal." The garage is used by hotel guests, conference attendees and also by employees of the Tribunal. In the morning, our unfortunate colleague was waved into exactly that part by a traffic controller. The gate in question was then open and there was no indication that this was a special part of the garage. The traffic controller might not have known that the gate would be locked at night, or he might not have expected a conference attendee to pick up his car this late. Via the intercom at the barrier, the doorman contacted the security guard of the Tribunal. His card, with which he could open the gate, was missing. Finally we were able to leave the garage at 11.16 pm. And so by attending an information security conference, you can get caught up in physical security measures. I couldn't have made this up. But I really need to talk about the conference.

The war in Ukraine was a fairly prominent topic there. This is the first real war to be fought not only on land, at sea and in the air, but also in “cyber”, as it is called in military circles. From day one they started to attack each other not only physically but also digitally, and probably earlier as well. One of the speakers, Cristin Flynn Goodwin of Microsoft, told us that a fight against a state actor in your own data center can be compared to a hand-to-hand combat: arduous and bloody. Countries that attack you digitally are preying on the ideas and information governments need to make decisions about important current affairs, Goodwin said. In doing so, they mainly target think tanks, non-governmental organizations (NGOs), diplomats, policy advisors and academics.

Goodwin's point was that as an organization you cannot cope with all that digital violence on your own. It is therefore much better to store your data in the cloud, where you enjoy the protection of a large service provider (where it would have been nicer not just to mention her own company). The idea is that these large cloud suppliers have every conceivable means to optimally protect your crown jewels.

By nature, a country wants to keep its crown jewels close by, on its own territory. Furthermore, the GDPR prescribes that personal data of EU citizens must be stored in Europe (under certain conditions it may also be stored elsewhere). But, Goodwin argued, that's not always wise. She said that Ukraine has stored important parts of its national ICT completely outside its own borders. Other countries should also prepare for such a scenario, and test it. That sounds pretty scary, but I can imagine that it is one less headache for Ukraine. At least, as long as the connections to that distant cloud last.

The Dutch government recently adopted a new policy with regard to the public cloud. It switched from “no, unless” to “yes, provided that”. My biggest concern is the availability of the data. Having your own data center simply gives you a sense of tangibility, of being able to hold onto the data when the going gets tough. But if you think about it, that doesn't make sense. One cruise missile, one ransomware attack and your data is gone. And yet there is an extra dimension to that cloud: what if your country gets into a fight with the country of the cloud supplier?

If your car is parked in your own driveway, you can always reach it. If it is in a parking garage, the manager of that garage will determine whether you can leave. Even external factors can play a role: years ago a Ferris wheel on the Apeldoorn Market Square turned out to be so heavy that the city feared that the parking garage under the square would not be able to bear its weight. People who had parked their cars there could only get back to their cars after the Ferris wheel had been taken down. I see difficult choices coming our way.

And in the big bad world…

This section contains a selection of news articles I came across in the past week. Because the original version of this blog post is aimed at readers in the Netherlands, it contains some links to articles in Dutch. Where no language is indicated, the article is in English.

2022-10-14

The three little pigs

Image from Pixabay

Once upon a time there were three little pigs who went out into the wide world and built each their own house. The first piglet got off easy and built a house of straw. The second built a somewhat sturdier wooden house, while the third went to great lengths and built a solid stone house.

You probably know this fairy tale, but for the sake of completeness I will finish it. The big bad wolf wanted a pork chop and blew down the straw house, after which he devoured the resident. After a while he was hungry again and rang the bell at the wooden house. The resident saw through his smart doorbell who was at the door and did not open the door. The wolf took a deep breath and managed to knock down this structure as well. Piglet number two was also eaten all up. And as happens in fairy tales, not long afterwards it was the turn of the third house. The resident, who had already seen the wolf coming through his security cameras, did not open the door, of course. When the wolf realized that he couldn't possibly knock down this sturdy house, he climbed onto the roof and slid down the chimney. However, the piglet was aware of this vulnerability and had taken measures: a pan of boiling water was ready at the bottom of the chimney. Wolf in, lid on, and the piglet lived happily ever after.

The Three Little Pigs is an English fairy tale from the 19th century and has a clear message: if you’ve done the best you could, you will come out stronger. I am always amazed at the atrocities with which fairy tale writers bombarded children in those days, but it must have been the zeitgeist. However, the fairy tale is not only about zeal, but also about threats. “Watch out, children, there are all kinds of dangers lurking in front of you! The better you arm yourself against it, the greater the chance that you will come out of it unscathed.”

I'm a part-time fairy tale teller. Not only every Friday morning, when I write this blog, but sometimes during my other work as well. Like the unknown creator of the above fairy tale, I also point out threats to people and have them implement measures to reduce risks. Usually with business language and a technical slant, but sometimes I allow myself a story to make something clear. One of my favorite stories is that of Joost Tonino , former public prosecutor in Amsterdam. Tonino had put his virus-infected private computer on the street for the refuse collection, but a taxi driver was ahead of the binman and delivered the PC to Peter R. de Vries (a Dutch investigative journalist who was murdered in the streets of Amsterdam last year). It turned out that confidential business data and child pornography were on the pc. End of career as Public Prosecutor. I tell this story when we discuss the careless disposal of data carriers during risk analyses. But also in other situations I like to use an anecdote or metaphor to explain something.

Yesterday I sat down with a department MT to discuss compliance with certain rules. The point was that that department often receives requests from another department to do something that violates the security policy. They then want an exemption to get it done anyway, because otherwise their system cannot function. When we show them how to do it, they sometimes say: “We can't do that on our system!” However, if they take the time to look at it seriously, it turns out it can be done after all, although sometimes some effort is needed. Oh, they're just like kids, who often say that they can't do something, even though they've never tried it. And if, after some encouragement, they turn out to be able to do it, they are very proud of it.

And so information security officers constantly try to influence people's behavior in such a way that they stick to the rules. This is done through the formal route – policy, standards, instructions – but I prefer to focus on awareness. Because if I manage to make you understand why you should or should not do something, if you understand that you or the organization otherwise run risks, then you will be more willing to take the right turn.

We are still in the middle of the European cybersecurity month. So there are still all kinds of activities going on. Take advantage of it and show that you are actively working on your security awareness.

Thanks to Wendie for the inspiration.

And in the big bad world…

2022-10-07

The history of keys

Image from Pixabay

Your bicycle, your car and your house have one thing in common: they have a lock. And all those locks come with keys. Locks have a long history – they are said to have been around for over six thousand years. Over the centuries, all those locks served the same purpose: to let in those who are allowed in, and to keep everyone else out.

There have always been people who still wanted to go somewhere they weren't allowed in. Most shrug and think “too bad,” but some are really trying to get in. We call those people burglars. They have a whole range of options for breaking down the barrier that has been raised, such as lock picking tools (which can be used to fumble with cylinder locks), the Polish key (used by bicycle thieves) and the time-honoured crowbar. It should be noted that the latter is not used to open the lock, but to work around it.

And then the computer was invented. Soon – in 1961 – it was thought that it also needed a lock. I myself have used PCs that had a physical lock, but the password is still the most common mechanism. The password itself was not new; the ancient Romans used it already, and I remember from old wild west movies that anyone who wanted to enter the fortress had to say the password at the gate.

In the good old days we had one password. You could easily remember that, if only because there were no requirements yet that it had to meet. In modern times, we all have dozens of accounts, at work and in our private life, and their passwords have to meet some of the most horrific requirements, which are different everywhere. For example, last night I found out that my bank does require a special character, but that it should not be a circumflex accent (^). And while I can think of a reason for that, I immediately wonder why using this character is fine elsewhere.

I've written it before: passwords have had their day. Not only because we are tired of it, but mainly because they lose their security value. I'd venture to say that anyone who doesn't use a password manager either writes down their passwords somewhere or uses weak passwords (which includes using the same password in several places). Writing that down doesn't have to be so bad, if you approach it a bit smartly. A notebook with the title “All My Passwords,” as seen on TV nine years ago by Ellen DeGeneres, is not a good idea.

Biometrics is a nice alternative for some applications. You can unlock your phone smoothly with your fingerprint or with facial recognition. Even firearms are equipped with it (although such a smart gun has never been sold, Wikipedia says). There are also more robust – and therefore more expensive – biometric systems that scan your iris, for example, or your palm. The latter technology scans, in addition to the shape of your hand, the pattern of the veins in the hand. Biometrics can literally go deep.

An alternative to logging in to websites is the FIDO standard (Fast Identity Online). When using FIDO, you register once at a website. You can then log in using your mobile device or your computer, possibly using a FIDO USB key, which you only need to touch to log in. But despite roaring texts on the FIDO Alliance website (“FIDO is widespread and growing fast!”), I've never seen it on a website. Major players such as Google, Facebook and Dropbox are connected, but apparently not for Dutch users.

Change is difficult, as it turns out. But one day there will be people who will no longer know what a password is, just as there are already millions of people walking around who have not experienced the time without computers and smartphones, or people who do not know what a floppy disk is. Until then: use a password manager. And wherever possible, activate two/multi-factor authentication (2FA/MFA, also known as two-step verification).

And in the big bad world…

2022-09-30

Fishy coffee

Image from Pixabay

“You're the one who writes those blogs about security, aren't you?” asked a colleague who came to our lunch table. “I need advice from a security officer.” “You're lucky,” I replied with a wide arm gesture, “there's a whole table full of security officers here!”

Earlier that day I had already received an email from someone else about the same matter. Both colleagues had received an email: there was a survey about the coffee in the office. Please complete before the end of the week, fifty coffee packages will be raffled among the first five hundred participants. Click on this link! If you did, you were taken to a page where you were prompted to enter your username and password. Then you proceeded to the survey. Only then did they realize that there was something suspicious going on.

Since I'm writing about it here, you probably already understood halfway through the previous paragraph that this was a typical case of phishing. The special thing about this phish, however, was that we all had it in our mailbox: it was a test, commissioned by the ministry.

Many organizations send phishing tests to their employees, on the one hand to test how alert people are, and on the other hand to make them aware of the dangers lurking ahead of us. It is better for them to fail a test than to fall for a real phishing email, is the underlying idea. Hopefully they don't fall for it the next time, in the event of a real attack.

A few facts about this test. The e-mail was sent to about 30,000 employees, spread over two days. Of these, quite a lot clicked on the link and a significant number of them also entered their password. That's a lot of people, and if a real attacker was after login details, he would have harvested quite some passwords. But if this had been a real attack, no one would have clicked at all – the attack would have been contained by our technical measures. For example, because so many incoming e-mails from one address are suspicious. Or because the link you had to click pointed to an untrusted domain. For this test, gates were deliberately opened that are normally closed.

What could a criminal have done with such a fat catch? Well, basically nothing at all! Our security has several layers and this example illustrates nicely why this is necessary. That is not a reason to loosen any layer. Vigilance remains important.

A test like this one is still quite complicated. For example, I heard that it took some persuasion not to have the entered passwords saved in a file. Some saw this as a great opportunity to investigate how many employees use weak passwords. They didn’t realize at first that storing all those passwords could pose a threat to our security. Furthermore, the privacy of employees has to be honoured; the hired agency will only report at department level, and those departments are anonymized.

At the end of the second day of action, it was revealed via the intranet that this was a test. At the moment there are 69 comments under that article and to my surprise there is not one angry reaction. In fact, people are enthusiastic – terms like fun, eye-opener and top-action have been used. People who failed the test come forward, and I think it's great that they feel that they can do that in our organization. There was also someone who regretted that his manager had warned the team, because now he doesn't know if he would have fallen for it. But as far as I'm concerned, tribute to this manager, who has understood that security goes further than his own laptop.

October has been Europe's cybersecurity month for ten years now. In that month we ask for extra attention for this important topic. We do this with all kinds of internal activities , but all kinds of initiatives are also taking place outside of our organization. This month, the Security (b)logs are aligned with the internal program.

And in the big bad world…

2022-09-23

The law is the law

Image from Pixabay

“Carprof and AA team use the General Data Protection Regulation (GDPR),” the garage's letter read. I burst out laughing when I read this. "Use".

They probably didn't mean it that way, but they wrote it down a bit silly. Like all legislation, privacy legislation is not a candy store where you only put the sweets you like best in the bag. Nor can you ignore the GDPR, or exchange it for, for example, the privacy law of Guatemala (a purely arbitrary example).

The special thing about the GDPR is that it is not a national law – as its predecessor, the Dutch Personal Data Protection Act (Wbp) was – but a European one (apologies if the designation 'law' is wrong in legal speech, but what I mean to say is that there are rules that you have to comply with and if you don’t you can be punished).

Earlier, I wrote about a Greek car rental company that understood that I wanted my data removed after the rental period and had a form for that. And this year I noticed that even in Italian hotels they were not surprised that I did not hand in our passports, but only copies of them. In Italy you have to be registered and they never do that at the hotel reception at the very moment you’re checking in, so they want to keep your passport for a while.

This year, they settled for a copy. I had brought a whole stack of copies with me just to be sure, but I got everything back in good order and so a single set would have been enough. On those copies I had made our social security numbers illegible and written the text 'Copy' over the photos. I noticed that the SSN is no longer on the front of the photo page in the brand new passports of the children. That is a good adjustment, which is completely in line with the GDPR principle of data minimization: do not include more data than is necessary for the intended purpose.

What was the garage company trying to tell me with that somewhat unfortunate phrase? That they have data about me and that they handle it properly – in accordance with the law. And that they don't do crazy things with it, such as selling it on to an advertising company. The fact that they occasionally send me a brochure is inherent in the business relationship I have with them (I think).

In terms of advertising, there is something strange going on. I bought my car from the local Mitsubishi dealer five years ago. That company has not been an official Mitsubishi dealer anymore for a few years; they now work under the Carprof label. The new official Mitsubishi dealer lives a few hundred meters down the road. And they also send me mail, in which they state the type, registration number and year of manufacture of my car, and an offer for that car if I buy a new one from them. I've never set a foot inside their business. Apparently a car brand can request my data purely because I have a car of that brand.

Car companies seem to cherish that data and (so?) they don’t clean up. For many years I received mail from Peugeot, my previous car brand. Until I asked them to stop. That too is an achievement of the GDPR: if you ask for it, a company must delete your data. And no, that does not apply if you have ongoing obligations to that company.

A company cannot choose to use the GDPR; they simply have to comply with it. As a private individual, however, you actually can make use of the GDPR. By knowing your rights and applying them. For example, by requiring access to what data a company has about you, having incorrect data corrected and data removed. The latter is also referred to almost poetically as 'the right to be forgotten'. But if you like all that attention, you can leave it that way. No one is forcing you to use the GDPR.

And in the big bad world…

This section contains a selection of news articles I came across in the past week. Because the original version of this blog post is aimed at readers in the Netherlands, it contains some links to articles in Dutch. Where no language is indicated, the article is in English.

2022-09-16

Security officers

Image from Pixabay

My list of topics for this blog includes the sentence: “Business security officers do exist”. Behind this sentence is the observation that many colleagues do not know this. So it is high time to explain what types of information security officers we have and what their role is.

Let me start with myself and my peers in the IT department. Not because we are so terribly important, but because that's the best way to explain it. You can put many labels on me: my official position goes by the meaningless name of staff advisor, I usually call myself an information security advisor and the title information security officer also suits me. But what do we actually do? We are accountable for the information security of everything that the IT department delivers (applications and technical infrastructure, such as networks, servers and workstations). So we’re accountable, but the responsibility for each individual product lies in the line organization – team, department, unit, in other words: team manager, department head, director. As information security officers, we help the organization in fulfilling their responsibility; we assist them with advice, we help with risk analyses and in determining whether they comply with legislation and regulations and we respond to reports of the type: “Maybe you should look into this”.

Based on our accountability, we also have an opinion about anything and everything. If we notice that something is not as it should be, we dive into it. Our opinion doesn’t come without obligations. So we act corrective, but we also act regulatory. We write and implement security standards for the IT department that give substance to the applicable policy. We try to deliver actionable standards; for this we seek coordination with the people who will eventually have to act upon the standards.

Let’s now talk about the business security officers, the BSOs, because they are the real topic of this post. They are part of the various organizational units and see to it that the security policy is also implemented and complied with there. The BSOs deal with integral security, so in addition to information security, they also deal with physical security. An employee from such an organizational unit, who needs to bring an issue to the attention of 'security', can knock on the door of his own BSO. However, many people don't even know that these BSOs exist. They search the intranet or in the internal telephone directory for someone to contact and they often end up on our doorstep. Sometimes, they come directly to me personally, because as a blogger, I’m a bit more visible. That's okay – I'd rather have a report that doesn't land in the right place immediately, than no report. But it would of course be a good thing if the BSOs would also get some more name recognition. [In the internal version of this blog a link to a list of BSOs is included.]

And finally, there’s the CSO and the CISO, respectively chief security officer and chief information security officer . The first is about integral security, the second specifically about information security. They create the security policy for the entire organization (based on 'higher' policies) and support the organization in implementing and complying with policies, frameworks and guidelines. This is only the short version of the job descriptions, by the way.

The message of this story: if you need to tell something which is security-related, first look for a contact close to home and turn to your own BSO. If you still can't figure it out, my colleagues and I are of course happy to push you in the right direction. And it goes without saying – if a BSO needs advise from the IT department, they are most welcome.

And in the big bad world…

2022-09-09

Blue helmets and high turnstiles

Image from Pixabay

It was sunny, hot and Tuesday two o'clock. An elongated building vomited hundreds of men in blue helmets. Location: the port of the Italian city of Ancona. And the blue-helmeted men were dock workers, who had finished their shift. They hurried home on foot, on scooters, in vans and in cars – ignoring this tourist family, heading for Emperor Trajan's triumphal arch.

A few weeks later it was sunny, warm and Tuesday again. At last there was a business meeting elsewhere. It was wonderful to be somewhere else after such a long time, although I had to spend a two-hour journey by public transport for that. But luckily one can work reasonably well on the train. For example, you could write a blog there.

My host's office was surrounded by a sturdy fence. No wonder, because it was the type of organization where everyone understands that unauthorized persons should be kept out. I had been there before, so I knew that, as a pedestrian, I would be admitted to the site via a turnstile after reporting to the doorman. This time something strange happened: the large gate next to the pedestrian entrance remained open after a car had left the site. So I could have simply walked on. But you see, well brought up and all, I stood by that turnstile anyway. The doorman told me to proceed. Hower, the turnstile didn’t turn. Tried it a few times, really. Finally slipped through that inviting large gate. As far as I can tell, it hasn't had any ill effects on me so far.

Inside, at the reception I quickly received a badge, after all I was registered. I joined others belonging to the same meeting; we were not allowed to go through the gates on our own with our badges, we had to be picked up by our host. Someone in our party noticed that something remarkable happened when an employee presented his badge at the revolving door. His name appeared on a display: “Good afternoon, Martin Apple!” We talked for a while about whether that was a good idea. The owner of the pass usually knows his own name, but someone waiting in that room could read the name also. Then that person knows: Mr A has a badge for organization B.

So what, you might say. But let me take you into an exciting scenario, where someone (for example, a crook or a spy) really wants to get in somewhere. One doesn’t just enter such a bastion, he knows. It also doesn't help him much to simply steal a badge, because employees must, in addition to their badge, also present their fingerprint at the revolving door. And you can't steal that – oh way, not so fast. You can actually steal fingerprints. But there is something to it. Most of us really don't have to worry about someone collecting our fingerprints, making a print of them, and then using them to unlock our phone. No, if you have to take this kind of attack into account, you really are in the domain of organized crime and state actors (spies!) – two worlds that, in terms of capabilities, are getting closer and closer.

A lesser crook can try to collect all kinds of puzzle pieces. If he knows that a Martin Apple* works there, he can try to find out more about this person. It's not that hard – most of us are an open book on the internet and social media. That information can come in handy if you want to extort or threaten someone. When the criminal completes the puzzle, he can strike. For example, by inducing this Martin to grant them access to the building or to provide them with information. I am anything but cramped about my identity, but if my name appears on a screen unnecessarily, I am not amused. People who, given their position, more likely 'qualify' for 'special treatment', must adapt their behavior and their digital presence accordingly, in order to protect themselves and their environment. And that is certainly not easy.

Those dock workers also had to walk through turnstiles. In the building from which they emerged, many of those stood side by side. The port authorities likes to know who is present at the port site at all times, of course. Comes in handy in case of calamities and other irregularities. Thus, every employer has his own considerations about whether or not to implement certain security measures.

*) The name Martin Apple originated from my imagination.