Sending confidential emails in Gmail

We are pretty used to sending encrypted emails in office or work environment with outlook or other mail clients and PKI and S/Mime certificates in place.

I was trying to explore how to make my email from Gmail more secure (of course can't ask for moon on a free service). Look what I found Gmail does offer confidential mode. Here are the settings.

First feature observed here is that you will not be able to forward, copy, print, or download such emails. 

You could send the mail without passcodes where another Gmail user can open it without passcodes but the ones on other services would be mailed a passcode to open the mail.

If you choose SMS passcode then you would get a screen to enter the recipient phone number on hitting send (would not work if your don't have the number this option will not work).

An option to set the expiry on mail (the mail auto deletes) is also present.

Although this feature looks more like a two factor authentication rather than encryption, something is better than nothing.

PS - Thanks Google for considering such a feature on personal email service.

List of Enterprise Security (Information) Architecture Frameworks

There a many ways in which an enterprise information security can be designed. There are multiple architecture frameworks that can be followed. Below is a list of some open frameworks.

›SABSA - Sherwood Applied Business Security Architecture

›DoDAF – The U.S. Department of Defence (DoD) Architecture Framework

›Extended Enterprise Architecture Framework (E2AF) – from the Institute For Enterprise Architecture Developments

›Federal Enterprise Architecture –The United States Government (FEA)

›MODAF –The UK Ministry of Defence (MOD) Architecture Framework

›NIH Enterprise Architecture Framework

›Open Security Architecture

›IAEAF – Information Assurance Enterprise Architectural Framework

›SOMF – Service-Oriented Modelling Framework

›TOGAF –The Open Group Architecture Framework

›Zachman Framework

Our lives in days of technology

How much is your personal data worth?

I was reading the news when I came across 'Verizon - Yahoo' deal where the former want to buy out core business (flickr, Tumblr etc) of the latter. Some interesting stuff caught my eye and I wanted to share it with readers of this blog. This would be more of a back of envelope calculation and the views expressed are my personal opinion.

So Verizon plans to buy Yahoo (core business), who failed to mention some significant data breaches in the past.

There had been two but I would be talking of the 1 billion record breach in 2013. The records stolen are  names, email addresses, telephone numbers, dates of birth, hashed passwords and, in some cases, encrypted or un-encrypted security questions and answers.

Verizon asked for a $350 Million rebate in the asking price after the breach was revealed to them. This might be a seemingly low figure but according to a Washington Post Article Verizon studied user behavior after the breach and found that number of users leaving Yahoo services were not significant enough to demand a Billion Dollar rebate. The article also states that Verizon would split liabilities with remaining Yahoo business (after sale).

So if we take this figure of $350 Million and double it considering split liabilities, it amounts to $700 Million. Then divide it by 1 Billion which is the number of records breached we get a figure of $0.7 or 70 cents a record.

It is however of a lot more worth to the user of Yahoo whose records were leaked, as these records can be used to wreak a lot of havoc.

Impact of human error in breaches

We tend to blame a system for security breach. Reality is that human error voluntary or involuntary is the number one cause of cyber security breaches. Here are some points to consider:

1. Social engineering: This is currently the biggest cause of leak in the system still. Phishing is an example of social engineering. In simple language any means by which a human can be coerced to divulge confidential information is social engineering. Abject lack of infosec awareness still plagues most organizations and individual. Honestly basis of cyber security is mere common sense.

2. Backdoors or zero day hacks: These are attacks that either take advantage of a poor piece of code or  ill configured devices. Again who configured or coded them in the first place?

3. Lack of stakeholder commitments: Small and medium scale businesses that are not heavily into IT tend to ignore the presence of cyber threat to their business as usual. These are most likely to fall prey to scam, spam and malware. They do not realize that it is not the IT infrastructure that faces threat, it  is the information that is vulnerable to attacks.

4. Security is a virtue not a product: Decades of research and effort to improve quality has been put in as people realized its importance in the industrial revolution era. In information revolution era people should understand that security has the same importance as quality.

5. To err is human: True that humans cannot be 100% all the time but a conscious effort can bring numbers close to that. Plus there are means and measures like continuity plan and disaster recovery for the rest of the percentage.

6. Information security is nerdy gobbledygook: May be so is theory of aerodynamics. Does it prevent anyone from flying? You have an information that you have to protect, all you need to know is how. Leave the rest to the researchers.

7. I have antivirus syndrome: Just get over it man! They are not enough. Like I said earlier it is your data that is vulnerable. There are 100 more ways in which you share your personal data willingly to unintended audience.

To add to this I am putting an interesting number here: "... potential annual cost to a company in the event of a successful phishing attack is around $3.7 million.." (Source). What is interesting is that most of the loss is due to loss of employee productivity, so there goes your quality!

Backdoor

 

Backdoor: Gaining unauthorized, often hidden, access to a system after bypassing security measures in place. Users are unaware a lot of times. Anomaly detection could be used to scan for existing backdoor.

Detect Phishing / Malware in an Email

There are countless mails for promotions or otherwise in your inbox, a lot of which have malicious intent. Some of them try to extract your personal information. Others might just carry a file that can infect your computer. Here are some tell tale signs to detect a spurious email.


This is a classic social engineering trick to make it seem like the mail is from a reliable source. In below figure it says it is from Reserve Bank of India. It also carries an attachment and has no subject.

This is the first sign as RBI does not send such emails. One should not open such emails and mark them as spam or delete them right away. 

Modern email services do filter many such mails automatically but some emails do pass the filter.

On opening the mail you can notice the email id as something completely unrelated to RBI, confirming that it is a potentially dangerous email.

You can see that there is an image file attached. This file should not be opened or downloaded. The file could be of any format (.zip, .doc etc.) This is a clear sign of a malware and opening it on your system might have severe effect. 

Small pieces of  code can be easily embedded in the file to install on your system and can vary from doing nothing to installing a keylogger or a virus.

 

On opening the header of the mail we can see complete details of the sender. This is called mail header showing complete details of the sender. 

It is easy to understand that a central government institute like RBI would not have an email id as shown in the image.

 

What to do if you see such a mail?

 

This part is simple. Just delete or mark the message as spam. If your email is handled by an IT team, notify them.

 

Detecting Emails such as the one discussed in this post is pretty straight forward. Sometimes even the email id also seems to be genuine. It can happen in case a mail server is hacked and is used to send spurious emails. It might also happen that you receive such emails from a person you know! This happens when their email account or the device where it's client is configured is compromised

 

Best policy for emails is to follow these simple steps:

1. Be very careful with emails from unknown senders.
2. Check the email header for clues.
3. Do not open the attachments in unsolicited mails before checking.
4. If you have a doubt that your friend's account is compromised, verify.
5. Delete or spam such mails.

Many of us are not aware about such threats and even aware people fall prey to them, so please be careful.

 

Denial Of Service (DoS) Attack

DoS attack: When someone or something prevents the user from accessing desired services. While the shop would open only after repairs, there are many ways of preventing/mitigating the attack in cyber security! Load balancing is a prevention technique.

Dumpster Diving

Dumpster diving is a term in information security. It means going through trash to look for useful data or clues to find it, without owner consent.

Phishing

Phishing: To dupe someone to divulge sensitive or personal information

Man in the middle

Man in the middle is a kind of attack where an attacker tries to listen or alter communication between two parties.

Penetration Testing

Penetration testing: is a method of offensive security. Someone knowingly tries to break into a security system and tries to find vulnerabilities in the process. Of course, with owner consent.

Lack of User Training - Worst Vulnerability

Evolution of Security Tools

Did 'Sauron' in 'Lord of The Rings' have a Single Point of Failure?

Disclaimer: The views expressed in the blog are personal. It is not meant to hurt any sentiments. Any connections direct or indirect to anyone, any place or anything is purely coincidental. It is only meant to be fun to read and possibly portray me as a great thinker ;)

Most of us have been regaled by the works of JRR Tolkien - 'Lord of The Rings', 'The Hobbit', be it movies or books. I am a big fan and claim to have gobbled through the whole LOTR book and cannot get tired of watching the movies over and over again.
The last edition of 'The Hobbit' movie drove me into some research on characters. One character that never seems to give up and keeps coming back again and again since the beginning of Tolkien's mythical world is Sauron/Necromancer there are other names for him that can be found in other books of his. Kudos to his tenacity! If this has piqued your interest in him and you don't want to trawl through books you can read a short biography on this link (Thank you IMDB).
What if Sauron had learnt lesson from his previous failures and hired a consultant to have a look at his plan of conquering the world? What would the process flow look like? I put myself in the poor auditor's shoes, kept my hate aside for all his wrong doings and objectively looked at his strategy. Here it is in brief:

Process map of Sauron's conquest of the World.

Sauron had accumulated the resources and invested the required time into putting his plan in action and the plan went on for the first two eras (approx 2000 yrs). We could get into analysis of each individual step and discuss the pros and cons of each but since the focus of this topic is to identify the failures let us stick to that.

A close look at the stories that took place in various eras reveals one thing in common i.e. Sauron launches a mass attack on other kingdoms. All of them revolt individually or for an alliance against him. Then a war ensues and ultimately Sauron loses. An even closer look at the end of these battle would show that Sauron is about to win the battle when he some how manages to lose the ring leading to his loss of power and hence the war. Following is a brief flow of events across ages:

Event flow leading to Sauron's defeat

What does this have to do anything with practical world anyway? We can say that the ring in this case is a 'Single Point of Failure' or 'Bottleneck' in business terms or 'Achilles' heel' in literary terms. A single point of failure (SPOF) is a part of a system that, if it fails, will stop the entire system from working. (Wikipedia).
Any industry best practice warns an organization against such SPOFs. There are three basic principles in security: Confidentiality, Integrity and Availability. SPOF has a direct impact on system or process availability and the effect is easier to comprehend. Example, Say all the organization data is stored in a single server. Then the server is an SPOF. In case of server failure, data becomes unavailable for everyone. Another example from a different industry, say a hospital is situated in a place with only one approach route. In case a natural calamity like snow storm or landslide blocks the route the services of the hospital would be cut off when it is needed the most. Even confidentiality and integrity are affected by such failure points. Any audit has a clear directive to identify and report such single points of failure in the organization.

What to do? There is no single shot to cure it all. Careful monitoring of systems and processes is required. A common practice to circumvent the issue is to maintain redundancy. If a bottleneck is unavoidable the onus is on the organization to have special continuity and recovery strategies in place. Special care should be given to prevent such points in the process flow from failing. In manufacturing critical machine components are always on standby and continuous and proactive/preventive maintenance is carried out. Imagine if Sauron had backup rings and could whip it out when in dire straits and remotely deactivate the lost ring instead of frantically searching for it! Well then the story won't be so much fun and I like happy endings in my story.

I would go even further and say that Lord Voldemort (Harry Potter Series) was more sensible, if compared to Sauron, as he had created backup Horcruxes stowed away here and there as backups. Although I am happy that both villains suffer the same fate in the end but the same is not true when it comes to business processes.

Ciao!

Experiment to study 'High Impact Low Probabitlity Risks' using R

Here we would have a look at an experiment to understand how quantitative risk analysis can be used for simulation. An open source tools ‘R’ was used to perform the experiment.
This experiment deals with High impact low probability risks.

Model

This model utilizes the basic principle of risk definition which is product of likelihood of occurrence and impact. The impact parameter is binary i.e. either there is an impact or there is no impact at all. For the purpose of satisfying our basic premise of high impact and low probability we would assign high probability for no impact case and maximum impact value (10 on a scale of 1 to 10) for a case where event has occurred.
In a single experiment 100 samples would be taken from the population of 0 and 10 and the impact values would be summed up. This experiment would be replicated for 1000 times and impact vs. frequency mapping is created.
Following is the R code to depict the model

# This function simulates the single experiment of occurrence of event

high.impact = function(n=100){

  impact = 0

  p1=<probability of non occurrence>

  p2=1-p1 #probability of occurrence

  impact = sample(c(0,10), size=n, replace=TRUE, prob = c(p1,p2))

   sum(impact) # total impact in a single experiment

}

#single function call to simulate single experiment

high.impact()

#perform the experiment 10000 times

F=replicate(1000,high.impact())

#tabulate results

table(F)

#plot results

par(mfrow=c(1,1))

plot(table(F), type = "l")

Output

Since events have low probability of occurrence the probability of occurrence would be kept low, for which probability of non-occurrence would be high. For this simulation probabilities of non-occurrence were kept in range of 0.90 to 0.99.  Outputs of above simulation for different probabilities are as follows:

Probability of Non-Occurrence P1=0.90 (Use the probability p1 in R code above)

Probability of Non-Occurrence P1=0.95

Probability of Non-Occurrence P1=0.99

Observations

Based on the above data following observations were made:

1. As the probability of occurrence increases net impact on organization increases.
2. Even at very low probability of occurrence i.e. P2 = 0.01 or 1% the full impact of the event i.e. 10 can be seen for more approximately 50% of the time (~ 400 out of 1000)
3. Since such events are not frequent even the tail risk needs to be seen

Risk Assessment Methodologies - A Comparison

There a number of risk assessment methodologies. This post defines briefly some widely accepted ones and would make a comparison of these methodologies. Different risk assessment methodologies are as follows:

 

CCTA Risk Analysis and Management Method (CRAMM):

Central Computer and Telecommunications Agency (CCTA) now renamed as Office of Government Commerce (OGC) developed this methodology for the British government. It incorporates Securing IT Hardware and Software with physical and human resource controls. 3 stages of CRAMM risk analysis are:
1. Identifying and valuing assets
2. Assessing threats and vulnerability
3. Selecting and recommending counter measures

  Failure Modes and Effect Analysis (FMEA):

It was originally developed for Hardware but can be effectively used for analysis of systems and software. Manufacturing industry has found FMEA to be useful for their risk analysis too. In this methodology potential failure of each part, process or module is identified. Modes can be the cause of the failure like man, machine, processes etc. Then effects these failures would have on immediate level, the intermediate level and across the system are examined. Total impact of failure in specific modules is calculated. A severity is assigned to it and personnel responsible for the module are identified. This has to be revised at regular intervals.

  Facilitated Risk Analysis Process (FRAP):

It enables organizations to pre-screen security related systems and processes to determine if risk analysis is needed. It is a method to help focus organizations on critical security issues. It consists of a range of tested approaches for conducting a qualitative risk assessment. It is simple and inexpensive to use hence it can be used for initial analysis.

  SP 800-30 and 800-66 by National Institute of Standards and Technology (NIST):

NIST developed 2 sets of Qualitative risk assessment techniques SP 800-30 and SP 800-66 for regulated industries like healthcare industry. SP 800-66 was written for clients who need to adhere to Health Insurance Portability and Accountability Act (HIPAA) in the US. Steps involved in this risk assessment are:
1. Characterize systems
2. Identify threats
3. Identify countermeasures
4. Determine likelihood
5. Determine impact
6. Determine risk
7. Recommend additional countermeasures
8. Document results

  Operationally Critical Threat, Assets and Vulnerability Evaluation (OCTAVE):

The OCTAVE approach was developed by the Software Engineering Institute (SEI) at Carnegie Mellon University in 2001 to address the information security compliance challenges faced by the US Department of Defense (DoD). This methodology uses self-directed, interdisciplinary team to analyze and evaluate security risks by reviewing operational risk and security practices. Technology is examined only in relation to security practices. It outlines set of principles e.g. to use the self-directed team to evaluate risk. Based on these principles it defines required attributes or characteristics of evaluation process. It generates outputs which are required outcomes of each phase of analysis.

  PUSH:
It is an acronym for service based risk assessment solution that involves the following 4 Phases
1. Preparation - Defining the audience and purpose of risk assessment
2. Universe definition - Identifying and characterizing the most critical assets, risk and controls
3. Scoring - Choosing a consistent scale to rate the importance of assets, the impact of risks, and effectiveness of controls
4. Hitting the mark - ensuring the risk assessment fulfills the purpose set out in the planning phase using a documented methodology

  Spanning Tree Analysis Methodology

In this a map or tree of all possible threats to and Information system is created. Branches denote general categories of threats e.g. physical or network threats. More detail is added as leaves for each branch. When assessing risk, organizations prune tree branches that don't apply to their situation.

  Security Officers Management and Analysis Project (SOMAP):

It was developed by a Swiss Non-Profit Organization. They created a guide and risk assessment tool to guide in risk assessment analysis for open source systems or enterprises. It discusses both quantitative and qualitative risk assessment methods and the importance of aligning goals with the business goals of the organization.
It is a 5 Stage cyclic workflow for risk assessment as depicted below:

 

 

Value at Risk (VAR) methodology:

VAR is a theoretical quantitative measure of Information Security risk. This methodology helps create a summary of worst loss due to a security Breach and create a workable balance between cost of implementing controls and reducing risk. In this methodology both tangible and intangible assets are considered. Examples of intangible assets include copyrights, collaboration activities, IP, public perceptions, and structural activities. It requires a 4 stage cycle as depicted below.

 

Comparison of methodologies

The table below compares various methodologies mentioned above:

Features Methodologies	Type	Industry	Characteristics
CRAMM	Qualitative	IT Hardware	Contains a very large countermeasure library consisting of over 3000 detailed countermeasures organized into over 70 logical groupings Old methodology. Limitation of language (available in English and Dutch)
FMEA	Qualitative (Rating based formulae used)	Any	Used extensively by quality professionals Aims at finding root cause and is used in conjunction with fish bone diagrams Helps in early identification of single point failures Does not deal with multiple failures in subsystems Does not give an exact idea of how bad the risk is as it uses ordinal scales
FRAP	Qualitative (Uses expert panel opinion to identify critical risks)	Any	Used to pre-screen risks quickly and at low cost. Increases org. focus on critical issues Can limit org. view of risks it faces Difficult to find an efficient panel of diverse experts who can reliably come up with reliable estimates. Also prone to personal opinions and prejudices. Multiple teams are formed to perform FRAP to counter above limitations
NIST (SP 800-30, 800-66)	Qualitative	Regulated Industries	Developed for industries regulated by HIPAA and FISMA Extensive process and stresses on proper documentation The complete process suggested might not be cost effective for less regulated industries with higher risk tolerance
OCTAVE	Qualitative	Any	A suite of tools, techniques, and methods for risk-based information security strategic assessment and planning There are 3 OCTAVE methods suited to different industry needs
PUSH	Qualitative	Any Enterprise System
Spanning Tree	Qualitative	Any	Simple to use. Easy way to map risks and subsets of risks. Graphical method. Cannot be used for detailed analysis purpose other than identifying and prioritizing threats. Has to be used simultaneously with other techniques.
SOMAP	Qualitative & Quantitative	IT	It is an open source IT risk assessment and management methodology. Freely available to customers. Stresses on collaborative development. Comes with a suite of tools.
VAR	Quantitative	Financial primarily. Can be used in any industry.	Capable to produce accurate results for valuation of risk. Can be used to create simulations and predictive models of risk. Extensive research already done on methods related to calculation of VAR. Mathematical model dependent so errors in estimation can lead to catastrophic effects especially in financial and banking sectors. Difficult to incorporate complex and intangible risks e.g. human behavior, political effects

 Bibliography

• CRAMM, http://en.wikipedia.org/wiki/CRAMM, 25 July 2013
• FMEA, http://en.wikipedia.org/wiki/Failure_mode_and_effects_analysis, 16 December 2013
• FRAP, Hadley J, http://decision-analytics-blog.lumina.com/risk-assessment/is-facilitated-risk-analysis-process-frap-just-silo-thinking/,18 July 2013
• OCTAVE, http://en.wikipedia.org/wiki/OCTAVE, 18 December 2013
• OCTAVE, http://www.cert.org/octave/, 17 September 2008
• Mathew Scholl et al, October 2008, SP 800-66 Revision 1 An Introductory Resource Guide for Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule
• SOMAP, Retrieved on 23 December 2013, http://www.somap.org/ 
• VAR, http://en.wikipedia.org/wiki/Value_at_risk, 16 December 2013