Category: INFOSEC

Privacy as a concept is considered as a subjective phenomenon because of different factors such as culture and beliefs. For example, the Japanese can see each other naked in an onsen which is considered normal to them culturally. However, it is taboo to do the same in the Philippines. It can be considered a breach of the person’s privacy to see other people naked.

On the other hand, part of Filipino culture is hospitality, which to some extent involves caring and oversharing. Some Filipinos tend to ask too personal questions even if they have just met the person. For the Japanese, this may be breaching their personal privacy.

The universally acceptable definition of privacy can be, “Any information that an individual wants to protect from becoming public knowledge.” Do you agree?

There are different philosophical viewpoints of privacy described in Muzamil Riffat’s paper entitled, “Legal Aspects of Privacy and Security: A Case-Study of Apple versus FBI Arguments.” For this article, however, we will only be focusing on one viewpoint, which is the Privacy Right in the United States. 

Fourth Amendment in the US Constitution

The Fourth Amendment primarily focuses on the protection of the people against illegal searches and seizures by the government. The Fourth Amendment states: “The right of the people to be secure in their persons, houses, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized”.

The amendment is intended for government search and seizures only.  The important questions about the provision are: 1) What constitutes an unreasonable action? (Protected from “unreasonable” searches);  and 2) What is probable cause? (Warrant could only be granted if there is a “probable cause.”)

Katz vs. United States (1967)

One of the landmark cases that helped define the scope of the Fourth Amendment in Katz vs. United States in 1967. To summarize the case, the FBI eavesdropped Charles Katz’s phone conversation in a telephone booth upon suspicion that he was giving gambling information to clients in other states.

The question was whether Katz was protected by the Fourth Amendment against the FBI to eavesdrop the conversation in a public phone booth without a search warrant.

The Supreme Court voted 7-1 in favor of Katz. According to Justice Potter Stewart, “The Fourth Amendment protects people, not places.” The court ruling extended the Fourth Amendment protection beyond homes and properties.

Justice John Marshall Harlan II on a concurring opinion, interpreted the law by passing a two-part test: 1) That a person has exhibited an actual expectation of privacy; and 2) That the expectation is one that society is prepared to recognize as “reasonable.”

The “Katz Test” has been used in thousands of cases related to privacy especially related to communication, media, and the use of advanced devices.

Although it was a triumph for Charles Katz, it also opened so many opportunities for criminals to do malicious activities and get protected by the Fourth Amendment later on.

Further Reading:

1. Legal Aspects of Privacy and Security: A Case-Study of Apple versus FBI Arguments, Muzamil Riffat, SANS
2. Katz v. United States, 389 U.S. 347 (1967), Justia US Supreme Court
3. Katz v. United States, Oyez
4. Katz v. United States, Legal Information Institute, Cornell Law School
5. Katz v. United States, Wikipedia

 

Cybercrimes are criminal activities punishable by law that are done using a computer or the Internet. It could range from identify theft, vandalism/ defacement of websites, scams or even large-scale Distributed Denial of Service (DDoS).

Sample real-life cybercrimes are listed in the further reading below.

Types of Cybercrimes

Primarily, both as an investigator and responder, you need to be able to determine the type of cybercrime committed. It is important for you to be able to determine the correct response (technical and legal) in the incident.

1. Computer-assisted crime (source) – Computer is the enabler in the commission of the crime. (Ex. Stealing of credit card information through sniffing or phishing)
2. Computer-targeted crime (destination) – Computer is the primary target of the crime. (Ex. Denial of Service attacks)
3. Computer-incidental crime (indirect) – The involvement of the computer is secondary but important to the commission of the crime. (Ex. CHILD pornography is stored on a computer. Emphasis on CHILD since pornography in many places is legal but CHILD pornography is NOT)

Issues on Investigating and Resolving Cybercrimes

For developing countries like the Philippines, the cybersecurity infrastructure of the government in combatting cybercrimes is far from maturity.  But even the developed and well-funded cybersecurity programs of other advanced countries still face issues on investigating cybercrimes. The list below are the significant ones:

• Difficult to equate physical and logical assets.

The common misconception is that people don’t equate physical money to virtual money simply because the latter is not tangible. The P1 million in a bag is perceived as really one million. But transferring P1 million online is perceived as just sending bits and bytes using a web application. Due to this perception, cybercrimes are not treated as serious as physical crimes.

• Cyber-law environment has not been fully defined by courts.

For developing countries like the Philippines, cyber-law is not yet fully defined by courts because the basic principles of proving innocence or guilt are different in the cyber world. For instance, the common way of proving innocence is to show proof that you have evidence and witnesses that will show that you are not in the crime scene when the crime happened. However, you can be in the Philippines when you launched an attack in China. It will be hard for lawyers and courts to interrogate further without the proper knowledge in IT.

• Cybercrime spreads global.

Why do you think that even though there is a law that prohibits Torrent sites (P2P) that share pirated films and software, there are still a lot of Torrent sites online? A lot of countries may have laws against piracy, but there are still a lot of countries that don’t. Due to jurisdiction issues, our government cannot control everything on the Internet especially those that are not hosted in our own country.

• Cyber laws are highly technical

To explain Denial-of-Service (DoS) attacks, you need to be able to explain the purpose of port numbers, OSI Model, TCP and UDP to name a few.  The technical aspect of cybercrime adds more challenges in making the courts understand how the incident happened. It is not only the technical knowledge that is crucial but also how you are able to explain it in layman’s term, which is the usual problem in the IT industry. (techy but having a hard time explaining it to normal people)

These are some of the issues when investigating cybercrimes. The bottom line is that cybersecurity professionals need to be involved in the legal aspects of creating and implementing cybercrime laws. Lawyers may be good at putting into words how crimes work but they need expert inputs to ensure that all aspects are covered. On another angle, the need for cybersecurity professionals’ involvement shows the demand for the profession in the industry.

Further reading:

1. Cybercrimes up by 80% in 2018 (Philippine Star, March 2019)
2. Online child abuse top cybercrime in Philippines (Philippine Start, April 2019)
3. That Insane, $81M Bangladesh Bank Heist? Here’s What We Know (Wired, May 2016)
4. Equifax Data Breach Settlement (Federal Trade Commission, January 2020)

 

 

 

The perception of most employees to both the HR and Cybersecurity Department is that they exist so they can look for a mistake and punish you. Some say that HR is the principal’s office, while the Cybersecurity team is the surveillance arm.  Although most of the time during investigations, the cybersecurity team becomes the expert witness to help either acquit or punish the employee. (This will be discussed in another lesson.)

There is truth in perception and claim. To add to that, a lot of the policies in organizational security (discussed in Lesson 6)have overlapped with HR. This means, either the policy was created by HR or both HR and Cybersecurity teams. For example, the Acceptable Use Policy (AUP) outlines the expected behavior of an employee in the organization. A part of the AUP is the Internet Usage Policy (IUP) and other policies related to the acceptable use of the company issued assets such as laptops, mobile phones to name a few. These policies are created and monitored by the cybersecurity team.  The AUP is usually signed by the employee together with his/her job offer/contract prior to onboarding.

Without HR explicitly contributing to information security, they have made an administrative-deterrent control. (Administrative because it’s a policy; deterrent because it discourages people to violate the rules)

Other HR policies that help information security are background checks (administrative-preventive control) because they check whether you are good not only in your CV and mandatory vacations (administrative-detective) to check and audit whether you are doing something not on your job description without you being present in the office.

During operations, HR might have their independent and confidential tasks. But their roles are significant in providing a sound and mature information security environment in the organization.

Coming from a technical team, organizational security might be seen as a domain that only focuses on paper-based policies (sometimes, just copy-paste templated policies), budgets and risk assessment results. There’s also a gap between highly technical security members who have been doing hands-on security and those management guys who may have their MBAs but whose background is not even in IT. However, it is important to emphasize that technical security needs organizational security to exist and vice versa.

In big organizations, a separate C-level position is appointed for cybersecurity. The Chief Information Security Officer (CISO) is responsible for the over-all cybersecurity operations in the organization. He/she usually reports to the Chief Information Officer (CIO) or Chief Technology Officer (CTO).

What does it mean to have a CISO? 

The CISO will have a seat and say on the management level – may it be ManCom (Management Committee) or ExeCom (Executive Committee). He/She will be able to provide insights and expert opinions regarding the organization’s cybersecurity posture vis-à-vis the organization’s business strategy. It is very important to have a person who can voice out and be heard about what the technical members think is the best security for the organization. Without a CISO, it may be difficult for management to understand expensive spending on cybersecurity tools. You might be defending a multi-million peso Unified Threat Management (UTM) firewall and the management will only see it as an additional cost. Since management does not understand the value of the UTM firewall, they decided instead to provide a budget for a home firewall. It’s also a firewall, but way cheaper!

Also, the CISO is ultimately accountable if any security incident happens in the organization.

The Governance Team

Aside from the  Technical Team, the Governance Team reports to the CISO too but they focus on organizational security. They primarily draft policies that the organization must follow. Some of these policies include but not limited to:

• Password Policy
• Time of Day Restrictions
• Classification of Information
• Acceptation Use Policy (AUP)
• Internet Use Policy (IUP)
• E-mail Usage Policy (EUP)
• Disposal and Destruction
• Privacy Policy

They also align with the Technical Team on how they can properly articulate the security requirements in the policy. On the other end, they are also responsible for making sure that these policies are understood by the stakeholders very well.

For more details about policies and policy templates, I highly recommend you visit SANS.org. They have a ton of templates and guides on how to create, modify and implement security policies. Here is the link: https://www.sans.org/security-resources/policies/

Further Reading:

Structuring the Chief Information Security Officer Organization by Allen, J. et al (2015) Retrieved from:
https://resources.sei.cmu.edu/asset_files/TechnicalNote/2015_004_001_446198.pdf

Authentication

Authentication is defined as proving who you are claiming to be. By default, we have 3 types of authentication:

1. Something that you know – A form of authentication coming from what you know (residing in the mind)

Ex. Password, pin

2. Something that you have – A form of authentication that is tangible.

Ex. Token, cellphone, ID

3. Something that you are – A form of authentication where the uniqueness of the part of your body is used.

Ex. Fingerprint, voice recognition, iris scan

Not one of the authentication types can be considered the strongest. Something that you know authentication such as password can be cracked using brute force or social engineering. Something that you have authentication such as ID’s can be stolen or reproduced. Something that you are authentication such fingerprint is prone to false positives (you have sweaty hands etc.)

To make your authentication stronger, it is advised that you use 2 or more types of authentication to provide a layer of security. This is what we call 2-factor or multi-factor authentication. Examples include:

1. ATM + Pin (something that you have and you know)
2. Credit card + signature (something that you have and you know)
3. Cellphone for One-Time Password (OTP) + password (something that you have and you know)
4. Badge + biometric (something that you have and you are)

Note: Usernames and passwords are not considered multi-factor because both are something that you know type of authentication.

Questions to search on:

1. What is the fourth type (or other types) of authentication?
2. What is the most accurate biometric? Why?

Types of Access Control

Access Control or Authorization determines the type of privilege a user has after being authenticated. If you enter the school, an authentication mechanism could be your school ID. Access Control determines which rooms in the school you can access. If you’re a student, you can access the classrooms, computer laboratories and cafeteria. However, you are prohibited from accessing the faculty room and server room. A faculty member can access more rooms compared to a student.

Mandatory Access Control (MAC)

MAC is the strictest type of access control. This access control can be seen in government especially in military. It uses Sensitivity Labels (SL) both for the subject (initiates an action) and object (waiting for action). It is also known as a multi-level type of access control.

SL can be classified as:

Top Secret Secret Confidential Public

Let’s say a File A (Object) has an SL of Secret. Only the subject that has an SL of either Top Secret or Secret can access the file.

To visualize, let’s say a 5-star General has an SL of Top Secret, Colonel with SL of Secret, Lieutenant with SL of Confidential and Sergeant with SL of Public. Only the Colonel or 5-Star General can access File A because they have clearance to do so because of their SL. A subject can access all objects that are below his/her SL. MAC uses a top-down approach.

Discretionary Access Control (DAC)

DAC is the direct opposite of MAC. In this case, this type of access control can be seen in non-military institutions (commercial use, usually). In DAC, the owner of the file determines the privilege of the subjects to the objects. It is also known as a single-level type of access control.

DAC uses an Access Control Matrix (r-read, w-write, x-execute) shown below:

S (down) O (right)	Chicken File Owner: Riza Object 1	Pasta File Owner: Reese Object 2	Beef File Owner: Rex Object 3
James Subject 1	rwx	—	-wx
Ray Subject 2	rw-	rw-	-wx
Ogawa Subject 3	—	rwx	-wx

In the above scenario, we have 3 users (subjects) trying to access 3 files (objects). Each file is owned by a specific individual (owner). It becomes the discretion of the owner on what privileges he/she wants to give the subjects. These privileges may change also.

Role-based Access Control (RBAC)

RBAC is also known as a non-discretionary access control. It gives privileges based on the roles/tasks. It is beneficial for large organizations in organizing group privileges to objects. For example, all students have read only access to File 1, File 2 and File 3. All faculty members, on the other hand, have full access to all the files mentioned. The admin will just add users (subjects) on the groups created for consistency and convenience.

Rule-based Access Control

Rule-based Access Control basically gives privilege based on a list of an enforced policy. A good example is an Access Control List (ACL) in a firewall. The firewall will grant/deny access based on the rules found in the ACL. However, if no rule is present, then no privilege should be given. (implicit deny)

—– NOTHING FOLLOWS —–

You can download the PDF version of this lesson here: INFOSEC_L4_AuthAC

We have agreed that we protect data/information in Infosec. And as we have discussed in Lesson 1, the scope of Infosec is very broad and IT Security is just part of it. We have also learned in Lesson 2 that preventive controls are incomplete without detective controls and response. With former concepts discussed, a more concrete and concise security architecture is formed- Defense in Depth.

The concept of Defense in Depth states that in order for anybody to access the data, it should pass layers of security first. Security controls may vary but it should be in layers.

For example, if you want to access the bank database, you need to pass through frisking of security guards, inspection of bags and proper identification when entering the bank premises. That is what we call Physical Security.

When you enter the premises, you are required to wear your ID at all times. If you are a visitor, a security personnel is required to accompany you wherever you go within the premises. That is the next layer called the Operational Security.

If you connect to their wireless network and your laptop cannot access the Internet because of MAC filtering, that is an example of Network Security.

When desktop computers have disabled USB ports to prevent spread/download of virus, that is an example of Host Security.

When you need to enter a username and password to gain access to your account, that is an example of Application Security.

Diversity of Defense

The Diversity of Defense security concept is quite tricky. Management will always want a cost-effective IT infrastructure setup. For example, Huawei, a known networking product, might offer an IT infrastructure package that may be very appealing. Let’s say they offer the whole IT infrastructure with X pesos. The management may be lured to buy the package because of the cost. However, as an information security professional, you should weigh the possible security issues that may take in place.

In Diversity of Defense, you are compelled to buy different brands of network and IT devices such as firewall, switch, router, etc. But assuming you plan to buy different types of devices, the cost may double (2X pesos) compared to the X pesos if you have a single brand.

So what is the advantage of this concept?

If a vulnerability in Huawei firewall is found, no matter how many Huawei firewalls you have, then your network is vulnerable to that particular attack. You can simply say that the cost of information disclosure is way more expensive than the implementation of diversity of defense when a single proprietary vulnerability is exploited.

Security through Obscurity

If we say that a company is implementing security through obscurity, can we consider it secured? In Security through Obscurity, we rely on the idea that nobody will think that some valuable asset is hidden in an obscure place.

For example, will anybody think that there’s 1M pesos stored underneath the driver’s seat of my car? What are the odds, right? But if I accidentally left my car unlock and somebody randomly opens the door of my car, is my asset still secured?

Security through obscurity is simply hiding something. But hiding something without proper safeguards has no security at all.

Cost-Benefit Analysis (CBA)

In information security terms, CBA refers to the weighing of the cost of safeguards to the value of asset. As a rule of thumb, you are not supposed to buy a safeguard that is more expensive than the asset.

For example, you won’t buy a vault that is valued at 20,000 pesos to safeguard a Timex watch from a buy 1 take 1 sale worth 2,000 pesos. The thief will probably steal the safeguard instead of the asset in it.

—– NOTHING FOLLOWS —–

You can download the PDF version of this lesson here: INFOSEC_L3_GenSec

The CIA Triad

All issues and solutions pertaining to security fall under 3 categories:

1. Confidentiality – Protection against unauthorized access
2. Integrity – Protection against unauthorized modification
3. Availability – Protection against denial of service

The exact opposite of the CIA is the DAD – Disclosure, Alteration and Destruction.

See the following events and solutions:

1. Locking the door when you leave the house – This is a confidentiality solution because only the person who has the key to unlock the door can enter the house.
2. A students overwrites the teacher’s Powerpoint presentation – This is an integrity issue because the content of the presentation is already changed.
3. The system administrator backs up the file server every Friday – This is an availability solution because the backup ensures access to the files when the main file server becomes unavailable.

A security issue can be a result of an accidental or intentional event. In example 2, the student may have accidentally overwritten the teacher’s file because of his negligence. He may also have overwritten the file intentionally out of revenge. But regardless of his intention, it is classified as a security issue.

The Formula for Protection

Some decades ago, the formula for protection is:

This means that in order to protect something, you need to prevent something bad from happening. For example, in order to prevent a home intruder from entering your home, you install a gate around your house. You are preventing the intruder from getting in the house because of the gate.

Similarly in the technical world, you can install a firewall in your network. A firewall is a hardware or software that enforces a security policy. For example, you have a web server in your company and you would like the public only to access the web server, the firewall can filter the traffic going to your network. Only packets/traffic that are destined to TCP port 80 (http) will be allowed to enter the network. That’s because port 80 is specifically opened for web connections. All other traffic will be denied.

Now, what is the problem or limitation with this formula?

In the first example (gate example), what will happen if the intruder climbs using a rope and he is able to pass the gate? Hypothetically, if the intruder is able to enter your house in the middle of the night, will you be able to stop him?

The formula for protection lacks other components.

Let’s say you bought a motion sensor alarm and a gun. You realize that if the intruder is able to enter your house after passing the gate using a rope, the motion sensor alarm will detect his movements and will alert you. Now if you see him and he’s planning to attack you with some weapon, you can defend yourself by shooting him using your gun.

Well, that’s just a hypothetical situation. But the point is, you need to anticipate that your preventive tool may be bypassed. That’s why you need to set up other security controls.

Therefore, the modified and correct formula for protection is:

Protection = Gate + (Motion Sensor Alarm + Shoot using your gun)

This formula can be applied to all domains of information security.

Going back to the firewall example, can you determine the limitation of implementing only a firewall in your network? If the firewall is the preventive tool, what is the detective tool and the response mechanism?

Least Privilege

I think the concept of least privilege is the essence of information security. In least privilege, you only get the privilege and access that you need, nothing more and nothing less.

In a company, there is an Accountant, HR assistant and Sales Agent. When we apply least privilege to these 3 employees, we will give each employees the following access to applications:

Accountant – MS Excel, Calculator, E-mail, Printer

HR Assistant – Telephone, Job Street, LinkedIn, MS Word, E-mail, Printer

Sales Agent – Telephone, Facebook, MS Word, E-mail, Printer

In least privilege, we list the things that each employee needs and we give the needed access to them. However, those applications that are not in the list won’t be given to the users.

Types of Least Privilege

Separation of Duties (SOD)

SOD states that a task (especially critical jobs) must be delegated to more than 1 person. Let’s use the payroll system as an example.

HR Department – Computes your daily time record (DTR)

Accounting Department – Computes your salary based of the DTR submitted by HR department

Management Group – Approves the salary computed and submitted by the Accounting department

What happens if only one person, let’s say Paula, computes for the DTR and salary and approves the computation also?

For instance, if an employee, Gilbert, does not go to work, then it will reflect in his DTR. However, if Paula decides to give Gilbert a salary, then she can freely do so without anybody questioning it. There’s nobody who checks if the task is done correctly or not.

The SOD for the payroll scenario is very important to ensure checks and balances of activities related to work.

Implicit Deny

Implicit Deny is another type of least privilege that is usually seen and applied in a firewall Access Control List (ACL). Assuming we have an entry in an access control list:

This ACL entry allows web traffic (tcp 80) going in and out of the network. If that’s the only rule that we have in the ACL, can we access the file server in the network (tcp 21)?

The answer, of course, is no. But one can ask, will it deny tcp 21 even if there is not rule stating that it should be denied?

The implicit deny states that if there is no rule that states allow, then deny access. So even without a specific rule, it is understood that there is a “deny all” rule after the last entry in the ACL.

Job Rotation

Job Rotation is a not so known type of least privilege. This concept requires that other persons are familiar with the job that you have especially if it is a critical role. Although it is costly because you need to train other employees, this is very helpful in determining what is happening to the tasks assigned to a particular person.

If you are put in an employee’s shoes due to job rotation, you and the management may find a lot of things. For example, why does this employee take 10 hours (with overtime) to do his job when I can finish it in 4 hours when I assumed his role in job rotation? There may be something to investigate in this issue.

—– NOTHING FOLLOWS —–