Rick’s Playground

For the past one month, I probably spent half of my free time in playing Starcraft II on the Battlenet. While I am trying to pull back a bit and get back to the usual IS research stuff I am doing, I just find the two (Information Security & Starcraft II) are amazingly similar in multiple aspects.

In the Information Security world, we always look at People, Process and Technology while in Starcraft - Resources, Troops and Technology are the threesome to win a game. As in both case, an optimal balance of these three factors are the key to successfully manage an enterprise information security or defeat your opponent in a Starcraft 1vs1 game.   Also an objective and adaptive strategy are fundamental in both cases.  As an IS professional, we need to keep a close eye on the current threat landscape, the emerging threat and allocate resources (your budget) accordingly. In Starcraft, scouting and intelligence about your enemy’s strategy is the used to decide how you want to use your minerals and gas.

At the tactical level, a complimentary mixture of your troops are the most basic micro techniques in Starcraft. Similarly in the Information Security, I am a strong believer of multi-layers/tier implementation and diminishing returns of investment in single type of Information Security controls. A single type of IS security controls can only reduce the overall risk to a certain percentage and subsequent return of investment in the same type of control will decrease and reach a plateau. In one of the recent talks I have attended, Dr Peter Tippett from Verizon Business also illustrated this by using the example of safety belt in car safety controls. A nylon safety belt will reduce the probability of fatal car accident by 50% while a high-cost titanium safety belt will only reduce another 3%. Instead, an airbag at a fraction cost of a titanium safety belt, will reduce the risk much more significantly.

Just like Starcraft’s micro (unit controls in battles) and macro (resource planning, map controls etc)management, there are also micro and macro in Information Security. We need Risk framework, Governance, Strategy, Measurements and Metrics etc at a macro level, but we also need micros such as vulnerability research, code analysis, log monitoring, intrusion signature developements,  reverse engineering. Lacking either one will neither win you a Starcraft game nor will protect your enterprise information effectively.

In an era when newsletter from vendors are almost the equivalent of spam emails, I am pleasently surprised by the content of Microsoft Security Newsletter - at least for this issue volume 6, issue 10.

First of all it is of the right length, no chunky huge paragraph and with proper links - it is an absolute turn-off when you see something interesting and yet no links or even worse - the content is for restricted groups.  Next, related articles give the interested readers full picture of tools and their relevant usage - For example, BinScope is introduced in this newsletter together with a how-to article. (BinScope Binary Analyzer and Security Tip of the Month: Using BinScope Binary Analyzer to Improve Code Security ). In the Business Security session, Andreas Wuchner speaks out the exact thought in my mind of “What I Look for When Hiring IT Security Staff “. It is short, precise and very accurate summary of the reality in hiring of IT security staff.

This is the 2nd time in the week I am impressed by Microsoft (the first one is the Microsoft Security Development Lifecycle blog). Probably it’s time to get a copy of Windows 7 ..LOL

I can’t believe this is the first entry in my blog for the past 6 month and we are more than half way through year 2009. It has been … ‘busy’… (err.. i tend to not use this word because everyone is busy and it’s not really justifiable due to the very diverse scale of measurement ..) Anyway I have been travelling around the Asia Pacific region, meeting people from very different cultural background, professions, ways of thinking and life styles. It is fun although there is frastration, boredon and stress. That’s part of parcel for life anyway.

The only reason which triggers me to sit down and write down this post is the inspiration after reading a couple of articles in one of the backlog ISACA Journals. In the “HelpSource Q&A” session, there is a question on how to fight phishing attacks for online banking applications.  Although I have been dealing with process-level controls for the past year, the words “attacks”, “applications”, “phishing” just trigger the technical geeky style of problem-solving thinking in me and ideas of strong 2-factor authentication, SPF (Sender Policy Framework), gateway spam filtering etc immediately come into the picture.

However the very first key control suggested is to have a properly defined e-mail communication policy for both sending and receiving emails to and from customers. Subsequently the advice mentioned a number of very good business process improvement which take fighting spam/phishing emails into consideration. A few small changes to a business process will easily mitigate bunch of relevant security issues which technology alone finds them difficult to tackle. It reminds me of those days when great amount of efforts and resources were spent on network level controls in order to fight application level security issues.  Are we in the same situation nowadays while we are spending too much efforts in creating application level or even information security process level controls in order to tackle business process level security issues?

I believe it’s time to introduce business process security into the information security model and make it a layer-8 practice. It just like buiding security into SDLC and we shall build security into a business process from the very begining. The thought of having a whole new paradigm in the information security model is really exciting. I am sure this will bring drastic changes to the infosec industry - probably soon we will see business process level security penetration testing, business process hardenning etc .

I just read an article “Confessions of a Risk Manager” from economist.com. It is recommended by a featured blog post “Risk Managers Are Just Like Security People” on securityfocus.com.  The article truely and vividly described the kind of difficulties and dilemmas encountered by a Risk Manager, which I can very much relate them the information security folks in the finanical sectors. The situations are amazingly similar between information security folks and the risk managers.

” In their (By Rick: the business people mainly front line traders, bankers, sales) eyes, we were not earning money for the bank. Worse, we had the power to say no and therefore prevent business from being done. Traders saw us as obstructive and a hindrance to their ability to earn higher bonuses. They did not take kindly to this. Sometimes the relationship between the risk department and the business lines ended in arguments. . . .

Tactfully explaining why we said no was not our forte. Traders were often exasperated as much by how they were told as by what they were told.At the root of it all, however, was—and still is—a deeply ingrained flaw in the decision-making process. In contrast to the law, where two sides make an equal-and-opposite argument that is fairly judged, in banks there is always a bias towards one side of the argument. The business line was more focused on getting a transaction approved than on identifying the risks in what it was proposing. The risk factors were a small part of the presentation and always “mitigated”. This made it hard to discourage transactions. If a risk manager said no, he was immediately on a collision course with the business line. The risk thinking therefore leaned towards giving the benefit of the doubt to the risk-takers.

Collective common sense suffered as a result. Often in meetings, our gut reactions as risk managers were negative. But it was difficult to come up with hard-and-fast arguments for why you should decline a transaction, especially when you were sitting opposite a team that had worked for weeks on a proposal, which you had received an hour before the meeting started. In the end, with pressure for earnings and a calm market environment, we reluctantly agreed to marginal transactions.”

Probably I shall replace all the financial terms with information security terms in this articule and come out a new version titled “Confessions of a Information Security Manager”.

(This post does not have any answers, just my personal ranting )

Recently I have attended a few risk management conferences mainly for financial institutions. The most common question asked was “what’s the risk management framework used by your institute?” Then it was usually followed by a round of discussion on Basel II or COSO ERM (Enterprise Risk Management). For IT folks, the topics will revolve around the risk management in IT govenance, COBIT or ITIL. However when it comes to the point of implementation, it becomes an evasive topic and most of the time I hear people complaining about the difficulties in implementing all these established frameworks etc.

Similar to the RM domain, implementation difficulties were constantly mentioned during my last conversation with a couple of Business Continuity folks.  It brings me to the questions - what’s the use of all these frameworks when they are not properly implemented? Are we spending too much efforts in coming out with these framework and methodology?Is it the time for the industry to channel some attention or resources to the implementation for these established frameworks?

I just read from ISACA’s Information System Control Journal that ITGI (IT Governance Institue ) has identified a gap in the current array of risk management framworks for IT: there is no known framework that includes both a holistic look at risk management and, at the same time,  provides adequate depth and details when covering IT. I just hope this ‘depth’ and ‘details’ are refering to the implementation aspect as well.

References and Resources: CONSTRUCTION OF AN IT RISK FRAMEWORK

Recently I visited a number of outsourcing partners in India, Philippines and Malaysia. They are providing various back office operations, sales and marketing services for the bank. It is not a secret that most fortune 500 IT firms have operations in India, however I didn’t expect that in places such as Manila, Philippines, there is a significant presence of the world’s major financial institutions’ outsourced activities. It is true that most of the outsourcing activities were initially cost-driven although it is debatable whether the cost-saving is still significant with the rising operation cost in these emerging economies.(see this) However despite the diminishing cost-saving, there is still a steady growth of outsourcing activities in this region. For example, Infosys - voted the best outsource partner, is still projecting a 20% growth in year 2008. Most of these off-shore services providers have successfully transform the local workforce to be skillful, productive, disciplined and most importantly passionate to their work. I have seen credit card sales teams cheering together whenever they make a successful sale. Their energy level is incredible even in the middle of zombie hours. That’s the attributes which companies are seeking for a successful outsourced business partners.

While benefits of outsourced operation are tremendous, the risk is also significant. Information security risk is very often the first in the list. In most cases, an outsourced operations means handing part of your business to your outsourcing partners and providing an interface for the business partner to have direct interaction with your core business operation. In some cases, while you are lowering your operating cost, you are also lowering the threshold of launching attacks over the confidential information through your outsourcing partners. There are already quite a few cases of ID/accounts theft (see this ), privacy information violation. Sometimes the cause of the incident may just due to cultural differences. In India, personal matters such as marriage status, age, pay package are just common topics during chatting sessions. Measures to mitigate these risks should be implemented as part of the supplier management programs.

1. Clearly define the information wall/boundary between outsourced operation and in-house business operation so that a need-to-know style practices can be established for the outsourced partners.

2. Education, education and education - convey the information security control practice to your outsourcing partners especially if there is a significant gap between the current practices between the two entities. One thing I noticed that outsourcing service providers in this region do have the initiative and willingness to learn from their business partners.

3. Risk Assessment and Contractual obligation - risk assessment/audit should be included as part of SLA or general terms in outsouring contract. It’s critical for both parties practicing due diligence to ensure information security policy, procedures and guidelines are followed and practiced accordingly.

The recent release of Internet Banking And Technology Risk Management Framework version 3.0 by Monetary Authority of Singapore (MAS) includes a specific chapter on outsourcing management. (MAS is the central bank of Singapore and also the regulator of the financial industry in Singapore)

I can’t believe I am writing this post to talk about “IT Governance”, “ITIL” and “ValIT”. For techincal folks like me, terms like “IT governance”, “Value IT” and “ITIL” were always vague, abstract and a lot of “bxxxxxxt”. However after working in a consulting environment for 2 years and now in a regional role of a huge financial institute, I start to see the type of problems which IT Governance, ITIL and “ValIT” are created to address. It’s impossible to cover everything about these three musketeers within a few blog post, so I will keep them as a continuous efforts to share my understanding especially for geeks out there who faces the same challenge as me.

IT Governance comes from corporate govenrnance and the definition by IT Governance Institute is - “The leadership and organisational structures and processes that ensure that the organisations’s IT sustains and extends the organisation’s strategies and objectives.” It is a concept usually includes 2 parts - IT decision making and execution. Firstly it aims to make the right person at right position to make right IT relevant decisions and establish the accountability for the decisions as well. Secondly it requires controls and measures to make sure the decision is properly and effectively executed and meanwhile the risk is controled during the delivery.

Based on ITGI’s definition, there are 5 focus areas of IT governance - Value Delivery, Strategic alignment, performance management, resource managmement and risk management. ValIT is the framework and best practices to achieve the value creation in IT governance. Val IT is derived from Control Objectives for Information and related Technology (Cobit). It’s not surprise that Val IT is one of ISACA’s “product”.

ITIL ( Informatoin Technology Infrastructure Library) currently comes as v3. It supposes to cover 5 Key volumes including service strategy, service design, service transition, service operation and continual service improvement. ITIL is purely a collection of best practices. It aims to be a practice guide for IT governance implemenation, but the word “Infrastructure” indicate a pretty limited scope although I seriously doubt the accuracy of these namings. Also the volumes are only available to commerical users.

References:

• IT Governance in Wiki
• ITIL in Wiki
• ISACA on Val IT

Recently I have been doing some work on risk management mainly information security risk and impact to a medium to large companies in financial sectors. Commonly used risk categories include but not limit to following types:

1. Monetary loss (such as reduced Revenue, inflated expense etc)

• High Risk: Potential for a significant impact on revenue or expense plan (greater than $xxxx per day)
• Medium Risk: Potential for a moderate revenue or expense plan (between $xxxx - $xxxx per day)
• Low Risk: Potential for little/no impact on revenue or expense plan

2. Legal and Regulatory Risk

• High Risk: Risk of potential regulatory intervention and supervisory action or fines (greater than $xxxk per day)
• Medium Risk: Significant compliance gaps with potential serious impact or fines (between $xxxx - $xxxx per day)
• Low Risk: Common compliance findings without serious impact (less than $xxxx per day)

3. Reputation

• High Risk: National or international news segment (Print, TV, Blog or Radio). Repeated news mentions.
• Medium Risk: Makes local news with potential for national coverage
• Low Risk: No external exposure. If leaked externally, unlikely or negligible impact

4. Competitive Ability (For example leakage of new products information etc)

• High Risk: Potential for a significant impact on potential new enterprise-wide customers or incremental fees
• Medium Risk: Potential for a moderate impact on potential new customers in isolated markets or incremental fees
• Low Risk: Potential for little/no impact on potential new customers or incremental fees

5. Customer/internal Staff

• High Risk: Potential for significant loss of existing customers enterprise-wide or significant impact on employees enterprise-wide
• Medium Risk: Potential for a moderate loss of existing customers in isolated markets or moderate impact on employees in certain geographies
• Low Risk: No loss/negligible loss of existing customers or impact on employees

The last time I studied about BCM was during year 2005 when I was preparing for my CISSP exam. The post-SARS period was also the moment companies in Asia became aware of the importance of BC practices. In my current working group, we have a couple of BC experts who are developing and managing regional BC practices. Although I am in the InfoSec side, there is also opportunity for me to get in touch with all the BC stuff and it is pretty interesting.

I have just read a PDF document on “How to Deploy BS 25999″ by Susan Yardis and John DiMaria and pleasantly surprised by a couple of new items in the current BCMS in comparison with those back in year 2004.

For example, the main activities and stages in the current BCMS defined by BS25999 are:

1. Business Impact Analysis - determining the impact of a disruption of critical organizational activities
2. Risk Assessment - understanding the threats and vulnerabilities to the organization’s critical activites
3. Risk Threatment Options - determining the strategy options to mitigate risk by reducing the likelihood of an interruption or limiting its timeframe
4. Business Continuity Options - defining how the organization will recover critical activities, and accounting for those activities not deemed critical
5. Response Activities - determining the process to respond to an interruption and manage the business recovery activities
6. Planning - documenting the process determined in the previous three sections
7. Exercising - validating the plans and arrangements are effective and up-to-date with current information
8. Strategy and Plan Review - updating the plans and arrangements following exercising or review
9. BCMS Review and Maintenance - reviewing and revising the BCMS to ensure the program is meeting objectives in an efficient manner

One significant additional item between this new practice and the old one is item 3 - Risk Treatment Options. It clearly indicates the additional responsibility of BC professionals to be involved with risk mitigation and shift the emphasis from a traditional “find problem and deal with it when it occurs” approach to “find problem and fix it before it occurs”. This is definitely a nice feature improvement, and we shall see the actual industrial acceptance to this.