The lady doth protest too much, methinks.

From the headlines of the worldwide press:

Chinese DM urges stronger information security
China says it will take measures to uphold its information security in ...
China to step up own security after new NSA allegations

This is getting old. All countries spy on each other, and, IMHO, German (and France and Israel, for that matter) has never been a good ally, just a benefactor of American largess. And, China ... well, it's China.

I suspect much of this is theater for local enjoyment. No government can appear soft on something as "ungentlemanly" as this.

TSA Expanding Its Screening of Passengers before They Arrive at the Airport

So, according to the NY Times, the TSA "is expanding its screening of passengers before they arrive at the airport by searching a wide array of government and private databases that can include records like car registrations and employment information."

I find this far more worrisome than the masses of information the NSA is capturing, or Google, Apple, Facebook, and others of their ilk. It won't be long before the TSA is screening rail travel, buses, using the ubiquitous roadway surveillance cameras to prevent us from driving, (use your imagination here), ...

Unfortunately, it'll never stop. Like the DEA, which has a vested interest in ensuring that the war on drugs never ends, the TSA needs to insinuate itself into every aspect of our lives in order to guarantee its existence beyond the Rapture. God help us all.

GAO: Centers for Medicare and Medicaid Services Needs to Pursue a Solution for Removing Social Security Numbers from Cards

The GAO recommends that CMS initiate an IT project to develop a solution for SSN removal and incorporate such a project into plans for ongoing IT modernization initiatives. HHS agreed with GAO's recommendations, if certain constraints were addressed. However, GAO maintains that its recommendations are warranted as originally stated.

What they really need to do is de-identify and anonymize data.

Of course, we have books that will help solve the problem.

Guide to the De-Identification of Personal Health Information 

In this book Khaled El Emam, the founder and CEO of Privacy Analytics, Inc., offers compelling practical and legal reasons why de-identification should be one of the main approaches to protecting patients’ privacy, this book outlines a proven, risk-based methodology for the de-identification of sensitive health information. It situates and contextualizes this risk-based methodology and provides a general overview of its steps. The book supplies a detailed case for why de-identification is important as well as best practices to help you pin point when it is necessary to apply de-identification in the disclosure of personal health information.

The Complete Book of Data Anonymization: From Planning to Implementation

Data anonymization provides a systematic and integrated approach to privacy protection that goes far beyond simple data-masking or network security from external or internal theft. In book, Balaji Raghunathan of Infosys Ltd. discusses the analysis, planning, set-up, and governance, this timely manual illuminates the entire process of adapting and implementing anonymization tools and programs to increase the success of privacy protection in vulnerable organizations. Providing a 360 degree view of data privacy protection, it details data anonymization patterns, automation/tool capabilities, and the key factors for success in disguising the person behind the data.

Jay Trinckes to Speak at Financial, Operations Management/Information Technology Conference

Jay Trinckes will speak at the Financial, Operations Management/Information Technology Conference, November 12-14, 2013.

His topic is “Avoid Penalties: Ensuring Compliance with the September23, 2103 HIPAA Privacy and Security Omnibus Rule.”

Jay is the author of The Definitive Guide to Complying with the HIPAA/HITECH Privacy and Security Rules and The Executive MBA in Information Security.

CRC Press Books on IEEE Best Readings in Communications and Information Systems Security List

The IEEE recently added the following book to its Best Readings in Communications and Information Systems Security List.

Alessandro Acquisti, Stefanos Gritzalis, Costos Lambrinoudakis, and Sabrina di Vimercati  (eds.), Digital Privacy: Theory, Technologies and Practices 

Peter Stavroulakis (ed.), Chaos Applications in Telecommunications

Mohssen Mohammed  and Al-Sakib Khan Pathan, Automatic Defense against Zero-day Polymorphic Worms in Communication Networks  

Al-Sakib Khan Pathan (ed.), Security of Self-Organizing Networks: MANET, WSN, WMN, VANET

 

Just Published! Information Security Management Handbook, Sixth Edition, Volume 7

This is the first annual edition of the Information Security Management Handbook since 1994 without the guidance and the insight of Hal Tipton. Hal passed away in March 2012. He will be missed by a lot of people for a lot of reasons.

It seems that every year is an interesting one for information security, and 2012 was no different. It is interesting, too, how perceptive Kaspersky Labs, for example, was with its forecast. It also foreshadows the end of online trust and privacy. If you cannot trust digital certificates, what is left to trust?

Cyberwarfare has jumped to the front pages of every newspaper, both print and virtual. Stuxnet spawned Flame, Duqu, and Gauss. While we were all focused on attacks and espionage by China, France, and Israel, Iran mounted a DDoS (Distributed Denial of Service) attack against US banks in retaliation for sanctions that appear to be working. At the same time, Iran’s central bank was attacked. Added to the online attacks is the growing threat of supply chain security, and products shipped with back doors or embedded systems that let them phone home. Witness the difficulty Chinese telecom equipment suppliers like Huawei are having with gaining toeholds in the United States by purchasing the US suppliers.

While Russians and Eastern Europeans are not singled out for cyberwarfare, crime syndicates based there continue to threaten commerce and privacy.

Theft of passwords from LinkedIn and Dropbox, and what seems like daily reports of attacks on or by Facebook show (not to mention Zuckerberg's Facebook page being hacked) the lure of social media to hackers, and the dangers to the rest of us. And while Facebook and others do not install rootkits as Sony did, their data collection efforts, combined with the apparent insecurity of the site emphasizes the growing dangers of Big Data and the Cloud.

We saw a huge increase in hacktivism as Anonymous and LulzSec launched various attacks on both government and private sites around the world.

It was only a matter of time until Mac OS X became a profitable target. Once critical mass was reached, hackers could not resist investing the time to own it. As with Mac OS X, mobile devices are becoming even more alluring targets. We have seen the same types of attacks and malware used against PCs adapted to mobile, plus new threats like SMS (short message service) spoofing. Not surprisingly, Android, Google’s open platform, has suffered the most. Plus, the growing number of apps for all platforms introduces a level of threat that is hard to estimate, but definitely growing.

M2M and the Internet of Things are creating more opportunities for hackers. From NFC (near field communication) payments to utility sensors sending unencrypted data, this is a potentially lucrative area for fraud and identity theft. Sensor networks are now in the DIY (do-it-yourself) arena, which creates yet a new class of threats.

BYOD (Bring Your Own Device), IT consumerization, whatever you call it, is making life so much more fun for black hats. It has given new meaning to “insider threats.” With portable digital devices being introduced into the enterprise, both with and without permission, we are seeing a manifold increase in threats. Clearly, policies alone are not sufficient to deal with this, and it is unclear how draconian management wants to be with forcing compliance. The products exist, but does the will to use them?

Looking at 2013, the promise of more surveillance, both from governments and online data collectors, means less privacy, even for the most careful users. Short of totally disconnecting from the grid, if such a thing is possible now, it is apparent we do not and would not have privacy.

This edition of the Information Security Management Handbook addresses many of these trends and threats, plus new areas such as security SDLC (software development life cycle), as well as forensics, cloud security, and security management. Chris Hare takes an in-depth look at hacktivism, identifying the motivations and the players, and providing advice on how to protect against it. Becky Herold analyzes the security and privacy challenges of social media. Sandy Bacik looks at the security implication of BYOD, and the challenges of managing user expectations. The Smart Grid offers its own security and privacy challenges as Terry Komperda explains. Noureddine Boudriga explains attacks in mobile environments.

There is new guidance on PCI and HIPAA/HITECH compliance. In addition to forensics and e-discovery, a chapter looks at cell phone protocols and operating systems from the perspective of a forensic investigator.

I have heard it said, “You can’t patch stupid.” So many of these attacks are successful because of clueless or irresponsible users. In what I hope is not a vain effort, Ken Shaurette and Tom Schleppenbach look at human firewall testing, social engineering, and security awareness. We also look at security and resilience in the software development life cycle, managing the security testing process, and SOA (service-oriented architecture) security.

Here is a shout out to my friend Jim Tiller, head of Security Consulting, Americas for HP Enterprise Security Services, for his help in preparing this edition. Jim’s done a lot for the Handbook over the years, and I am hoping he will continue.

All-in-all, this is a good volume of the Information Security Management Handbook. We are working on the next edition now. If you would like to contribute, please contact me at rich.ohanley@taylorandfrancis.com.

You can order a copy here.

Is there anything really new happening?

I just received a flyer for another information security conference. Is there anything really new happening? I'm seeing sessions on the same old stuff, mostly at a introductory level. Sure, there are new threats and vulnerabilities popping up every day, but how different are they really? Even cloud, mobile, and big data are getting old, and we'll never solve the user problem. I mean, who doesn't know about this 

I've been trying for a long time to get someone to write books on DLP, SEIM, APT, GRC, ..., but am beginning to believe that these topics have jumped the shark. Aside from, maybe, identity and access management, what's going to drive people's need for information and, one can hope, books sales?

BTW, if anyone wants to accept the challenge of writing a book identity and access management, let me know. It's a sure way to immortality (or at least as long as the Library of Congress exists).