9/11 and What We Learned

Despite the unparalleled carnage and inestimable impact on our national economy and psyche, there were a few worthwhile byproducts of 9/11.

First among them was the realization of what America’s reputation and standing was in the Middle East and the rest of the world in the few days and weeks after the attack. (Why do they hate us?) As is the case with most tragedies, it becomes quickly evident who your friends are and aren’t. Every once in a while it helps to take stock of your allies and know where you stand with everyone else.

Instantly after 9/11, the boon to privacy and security professionals become evident, especially business continuity and disaster recovery practitioners. Suddenly, the departments and disciplines that were hidden deep in the bowels of the IT department, that used to be thought of only as cost centers and road blocks to getting access to fun web sites at work, now became the rising stars of the organization. Every CEO and Board of Directors now wanted to know what their company’s plan was if they were to be attacked or lose a data center. How would they stay online? How would they recover services after a terrorist attack? Could they?

The most interesting dividend to arise from 9/11, in my opinion, however, was, the suspension of disbelief in the ‘anything is possible’ scenario. On September 10^th 2001 you could not have a credible conversation with anyone whom you tried to convince that you needed to plan for a scenario where a plane might crash into your building or data center affecting your ability to continue your business. With good reason, before 9/11 no one really thought this would ever happen. Historically, when a plane was hijacked, you waited until the hijackers asked that the plane be taken to Havana or Cairo or wherever, and then landed, and then began negotiation with them. No precedent had prepared anyone for the possibility of the hijackers actually taking their own lives in the hijacking. What would that accomplish? How did that advance their interests if they were dead?

Now of course, the approach is much different. No possibility is impossible. No scenario is too far-fetched too imagine or plan for. When I talk to service providers about how they will maintain continuity of business to my company in the event of a disaster, I expect to hear them talk about what they’ll do in the event of everything from a earth quake, hurricane, tsunami, water spout, flash flood, lightening strike, terrorist attack and even a zombie uprising. (Hey, you never know!)

So are we any better off now after 10 years of diligence and ‘saying something if we see something’? Are we safe? Are we safer? Has our alertness kept us out of harm's way from any additional attacks on our soil, or was it just that one small group of lunatics just got lucky while we naturally had our guard down? America has habitually talked itself into one counterfeit panic after another (anyone remember killer bees from South America, SARS, bird flu, or mad cow disease?). The threat from terrorism is unfortunately not one of those red herrings; it is real and it is probably here to stay. Though every tragedy on any scale is regrettable and lamentable, we can always find a lesson or two that comes from it.  At least we can find something that we can possibly benefit from or a lesson to be learned that may not have ever been probable or foreseeable.

Bite the Apple. Just be sure it isn't wax

Though the debt ceiling fiasco may be hogging the headlines today, there was one little story that may have been only an esoteric IT-related ditty, but it is worth retelling here.

If you have ever bought a Louis Vuitton knockoff on the street corner of a big city, or bought a fake Rolex on Craigslist, you usually know it to be the case in advance. Your expectations are muted. The quality of the product, and the cost of the item relative to a real article are always a concession you make for the low price of admission to faux-luxury.

Now, imagine you are in an Inception-like shopping scenario where the products you see for sale on the shelves and wall are indeed genuine, but nothing else around you is. In a little town in China, Kunming, there is apparently an Apple store just like the ones we have here in the U.S., complete with blue shirted staff members, high ceilings and IKEA-like pine woodwork throughout the place. The problem is, Apple has not opened a store in this city yet.   What has occurred, actually, is that an entire Apple store, from floor to ceiling has literally been faked. Though the inventory of Apple products for sale in this store is ostensibly real; even the staff thought that they were really working for Apple! (Reselling Apple merchandise is not a crime, even in the U.S.).

What I find most interesting and relevant to security about this news item is that the level of sophistication of this fraud is, frankly, almost admirable. If you are an American and used to visiting Apple stores, even you may have been challenged to realize that this store is not what it appears. (One sign on the window that said “Apple Stoer” might have given it away for you English majors.) Only now, that this story has become worldwide news, has the Chinese authorities stepped in to shut down the phony establishment.

But say you had only a smattering of English understanding, only knew the Apple brand by the iconic white apple logo, or never really pay attention to detail, you would be hard-pressed in deciphering that this place was bogus. My point here is that if we can barely detect a full-blown store front with all the trappings as being fake, how can your average internet user be expected to know when to not click or an e-mail or go to an unfamiliar and dangerous website? If people can be easily deluded by a ruse such as the re-creation of an entire store, who among us can be sure that we’d never be so stupid as to input our credit card number or social security number in a elaborate and almost perfectly-crafted website that looks exactly like the bank website we’re used to seeing every time we bank online? Unless you know what you are looking for, you can’t.

We all know people who are afraid to bank online or engage in e-commerce for fear of being bamboozled by bogus phishing sites. Imagine some one in the Chinese town of Kunming saying something to the effect of “I’m afraid to buy a MacBook Air online, so I just go down to my local Apple store and buy it in person. That way I’ll be safe!”

Though the owner of the doppelganger Apple store may not have necessarily had deception as his primary motive as he was deceiving everyone from his landlord to his blue-shirted Genius bar staff members, the incident itself is telling on many levels. Chief among my points here is that fraud is occurring on such an increasingly sophisticated level, that it is almost incomprehensible to ponder how the good guys can begin to catch up, let alone wholesale stop it. If someone will go to such lengths and efforts to recreate the bricks and mortars of an entire store in almost every dimension in the real world, imagine what chicanery is already happening in the online world, and worse, what the future holds for us! If not for the second-rate sign painter who didn’t have spell check available when he was painting “Apple Stoer,” we would never have been talking about this. It reminds me of the greatest line in the movie ‘The Usual Suspects:’ The greatest trick the Devil ever pulled was convincing the world he didn't exist.

Corollary Risks & Unintended Consequences

The global nuclear watchdog agency, the IAEA, said last week that the Japanese government was remiss in their risk assessment duties by not failing to fully anticipate what dangers a giant tsunami might pose to a nuclear reactor in that country. In fact the head of the IAEA, Michael Weightman, actually said that he could not understand how a country that has excelled in the prediction of earthquakes could have failed so spectacularly in predicting a giant tsunami. He went on to say that "Perhaps, their methodologies or data didn't allow them to predict that this size of tsunami could occur."

Huh?

I am under the impression, and operate as such, that in the aftermath of  9/11's lesson, no risk scenario is too remote or unlikely to reasonably plan for and reasonably anticipate. How is possible that Tokyo could not or did not fail to see the corollary between a large earthquake - which Japan undergoes with regular frequency - and the quite likely consequence of a tsunami. Japan is, after all, an island nation that is surrounded by water, so tsunamis would be one of the most likely threats to consider planning for. The city of Topeka, Kansas can be excused for not having a tsunami response plan, but not any city in Japan.

If you plan a beer garden event, you better have a corollary plan to address the risks of full bladders; if you plan a vacation to London, you better plan for rain; and if you plan to buy a Bugatti Veyron Super Sport ($2.7 million), a car that has 16 cylinders, has 1001 horsepower and gets only 8 miles to the gallon in the city, you had better be prepared for the consequences of higher fuel bills, higher car insurance and significantly less disposable income for other luxuries (Four new wheels and tires $50,000; Annual routine maintenance $20,000).

With the Bugatti's top speed at about 253 miles per hour, need we even broach the subject of the increased risk of dying in a crash?

For Privacy & Security, when Technology and Intelligence compete...it's no contest

With the recent news of the capture and death of Osama Bin laden, one thing was evident and overwhelmingly clear: our brilliant and sophisticated technological superiority notwithstanding, at the end of the day it was pure, simple human intelligence that produced the dramatic results.

Take away: though technophiles like me love to layer on security tools and controls to maintain data and privacy security throughout the organization, it is the simple sentence and/or concept that hits home to the end user employee who sits on the frontline of the trench warfare between customer confidence and blaring headlines that it is he and she who really determine our long-term success.

Being able to translate the importance and criticality of security being 'everyone's job' (and not just InfoSec's) within the company, is the single most valuable ROI of security & privacy awareness a company can realize. Forget DLP, NAC, anti-virus, encryption, etc. translating 'intelligence' into accessible and actionable steps your employees can take to protect the company's 'crown jewels' will ultimately be the reward your business folks will be looking for, appreciate, and best of all, value.

Bring Your Own Device to Work and Help Put the IT Department Out of Work?!?

I was a having a conversation with another fellow security professional at the CSO Perspectives seminar a few weeks ago and he used the word “disintermediation” to make a point about his website. We had a bit of a chuckle about how that word that was used (rather, overused) during the dot-com days. The context back then was that the new, online world was going to obsolesce the traditional world of bricks-n-mortars through the ‘disintermediation’ process of cutting out the no-value-adding, costly infrastructure of middle-men.

This got me to thinking about the topic I was speaking about at the conference: the way to bring about a culturally acceptable balance between security and the use of consumerized IT. That is, how could IT departments allow users to bring and use their own equipment in the work environment and still maintain a modicum of security and privacy?

Why is this issue even a concern? In this cost-conscious environment where businesses are constantly being pressured to reduce expenses as much as possible, doesn’t consumerized IT actually make sense?

In some ways, yes. The primary downside of this veritable technological tsunami is the impact it has had on the dynamic between the typical user and the IT department. The user demand (especially among C-level types) of bringing in a new iPad, iPhone, Droid, Xoom, etc. that they got for Christmas and expecting it to be hooked up to the company network, inevitably highlights the tension and traditional IT resistance of allowing unknown/untrusted devices into the inner sanctum. The risks are obvious and myriad. These risks have led many organizations to firmly resist consumerization by restricting personal devices/consumer electronics into the workplace.

I argue that regardless of the formal or informal position of the IT department, or even the company policy in general, this faction of users is growing and is in fact disintermediating the IT department by working around them to get their devices to work at work. The ‘Just Say No’ position of many IT departments is in fact making the company less secure overall as it is causing employees to circumvent the rules blockades put up and kept in place from years past. 

The driver of this form of insubordination is clear: these days, the boundaries of a company’s information network are not as clearly defined as they were in the recent past  - the mobile phone is now the mobile office, for example. The ultimate objective of consumerization is simply work and personal life converged onto a single device. There is no longer credibility in walking around with five devices clipped to your belt, looking like something out of Batman Beyond. Today, if you walk into a meeting and plop down more than one device on the table, you are immediately branded a dinosaur.

The primary theme of my speech was that that the trend of consumerized IT is irreversible and futile to resist, so CIO/CISO/CTOs need to seek a culturally acceptable middle-way of accommodating the movement, while still setting reasonable guidelines.  The benefits of cooperation with a workforce who is more tech-savvy than ever are numerous, not the least being the reputation of IT as supporter of the business will be greatly enhanced. No longer IT will be identified as the “Dept. of No.”

Here are few more reasons why it makes sense to listen to the sound of inevitability that’s coming at us at 100 mph. It’s all about productivity via familiarity of the toolset. Think about how life was like 15 years ago: you had use of all the great technology and software at work. When you came home, all you had was some stripped down versions of that machinery and applications – toys, really.  Today, the scenario is reversed. Employees who have state-of-the art technology at home can’t reconcile the fact that when they come to work they have a Windows XP, or worse, Windows 98, machine that takes 2 days to boot up.  Pent-up user demand (I want my MTV!), especially of the Gen X & Y and Millennials should not be underestimated,  and consumerized IT can be the Holy Grail of employee satisfaction.

The toothpaste is now out of the tube, folks.  Employees are a lot more productive when they have a say on the tools they use every day. What we as IT professionals need to do is to show leadership & get it right so that the company is protected & users are happy. At least for now.

Fare thee well, Epsilon…A future case study for brand & reputation risk

Like me, maybe you have received a notice in the last few days from one of many institutions that were affected by a major data breach of Epsilon, an online marketing firm. So far, we are told, mostly e-mail addresses were compromised, but in some cases so were customer names. You might not think this sounds terribly alarming, unlike, say, the T.J. Maxx episode in 2007 that included the loss of 45 million debit and credit card numbers. But you would be wrong

In the T.J. Maxx scenario, only the reputation and brand of T.J. Maxx was impacted. In this case, Epsilon is the service provider to a significant list of top-tier financial institutions including Barclays Bank, U.S. Bancorp, Walt Disney, Marriott, Ritz-Carlton, Best Buy, L. L. Bean, Home Shopping Network, TiVo and Target. The ongoing concern is that customers of these institutions can now be specifically targeted for fraudulent e-mail threats know as ‘spear phishing.’ (Though notice of the breach was sent to me by e-mail, oddly enough

In the T.J. Maxx case, the credit cards and debit cards were quickly canceled and replaced by the issuers (Visa, Mastercard, etc.). And in most cases these days, unlike in the recent past, the customer is not even responsible for the first $50 of fraudulent charges (Bank of America tells me that I will not be responsible for any fraudulent charges!). This lack of material and financial impact on a customer of T.J. Maxx helps explain why after their breach, not only did the sales of the company continue as before, but their stock price suffered no long-term ill effect. Average customers liked what the stores offered in terms of fashions and prices and disassociated the breach itself from the stores and the merchandise.

In the Epsilon case, however, I fear the result will be much more disastrous for them. The publicity around this episode alone is more significant than most other ones like it. Rush Limbaugh actually used the Epsilon example today to sell one of the identity theft products he touts on his show. The actual service offered by Epsilon can easily be replaced, but the untarnished reputation of the brand whose customer falls prey to a fraudulent e-mail cannot so easily be restored. If my identity is stolen after I click on a fake e-mail from my bank, I am going to remember and negatively associate the experience with the bank, not the e-mail marketing vendor who didn’t encrypt my e-mail address and name in their database.

We are not sure yet just how lax Epsilon was in their security controls that led to this incident. Whether or not they were as lax as T.J. Maxx was, will be uncovered in brutal detail in the process over the next few weeks, especially in the security world. Security folks will be using this very case as a way to reiterate the internal message of due care and the need for this or that software or hardware to help protect their own shop from suffering a similar fate.

This unfortunate series of events highlights the kind of brand and reputation risk a firm can suffer when outsourcing even the most seemingly innocuous service. Proper vendor management and due diligence of service providers will be the talk of the town over the next couple of months. Your clients will be asking what and how you do it in your shop, without a doubt. So be ready with a solid response.

Things Worth Fighting For

I came across a little publicized story this week that presents an interesting parallel to my constant message of privacy & security diligence. Here is the story: The Yamaha Motor Manufacturing Corporation has been making an all-terrain vehicle (ATV) in the U.S. called the ‘Rhino’ since 2003. The Rhino is different than its single-passenger predecessor since it allows for two passengers to sit side-by-side.

Four years later, the company added a few safety updates like more passenger hand-holds. Lawyers for some injured drivers (plaintiffs) jumped on the company’s move insisting that the reason the safety features were added was because the vehicles were not safe in the first place. Naturally, lawsuits piled in. Overwhelming a company with so many lawsuits that it figures it’s easier to settle then fight was the approach the plaintiff’s attorneys took. The attorneys attacking the company even petitioned the Consumer Product Safety Commission (CPSC) to aid their suits by trying to force Yamaha to recall their vehicles.

Yamaha did not feel a recall was warranted and even worked with the Consumer Product Safety Commission to make other modest safety changes that would satisfy the agency.

Most importantly, the company responded to the litany of lawsuits in an uncommon way: It decided to fight back.

The company was ultimately vindicated as it proved that in a significant number of instances, the drivers of the vehicles were grossly at fault due to their own behavior. Though riders are cautioned to operate the vehicle properly, the CPSC investigations indicated that product defects, insufficient warnings, negligence, etc., was not the cause of the injuries.

What’s the takeaway then? The company believed in its product, it believed it had provided sufficient safety and precautionary advice to its customers to operate safely, and it had decided to stand its ground and fight back on a principle of having done the right thing. (How unorthodox!)

And what is the connection to privacy & security? Companies create and publish rules and guidelines all the time for their employees on why and how it expects the employees to follow those policies. Some times the rules aren’t followed. Often, the rules are only words in a document on the company Intranet to make Legal or HR happy. Sometimes the Information Security team is only a paper tiger with little enforcement power or ability to bring about change and assure compliance.

But in some cases, the company itself, usually with the tone set at the top, decides to practice what it preaches and enforce the rule; make examples of those who purposely attempt the flout the rules, and inform those who do it unwittingly.

These days, consumers are savvier than ever about information. They know the value of their information and they want it protected. A customer will walk away from a company who only pays lip service to the principles of privacy & security, and they will excoriate the company online in blogs and forums for doing so.

The twin pillars of privacy & security in a company can easily be an asset and competitive advantage to a company who knows how to leverage that expertise, and maintain its diligence. I know it’s not always easy to keep up the pressure. Employees get comfortable; employees get lazy. IT can sometimes be a hindrance and not a help to getting the business of the company done, so creative employees will go around the roadblocks to meet deadlines. Privacy & security sometimes suffers.  When a company becomes lax, or inertia sets in, the guard gets let down and rules are no longer followed or enforced. That’s when incidents happen; that’s when headlines happen.

If a company believes in its principles, believes it has provided reasonably sufficient safety and precautionary advice to its employees to treat and handle information securely, and it decides to stand its ground and fight back against the perpetual inertia of letting violations slide by because its easier than making a fuss, then it has done the right thing. It will fight back and should fight back. Why? Because privacy & security is worth fighting for.