Dario Forte Research Articles

Application delivery: pros and cons both virtual and real

The client-server model is currently in decline, giving way to the application delivery (AD) paradigm. AD is now a well-established need in high-level organisations. However, there is a latent risk that certain fundamental aspects may be overlooked. This risk is associated with various factors, including the ever-present quest to cut costs and the need to speed up the rollout of business support solutions. There are some important issues to keep in mind in order to prevent potential problems. Dario Forte discusses some of them. In terms of delivery, demand for applications is characterised by an approach based on three primary objectives: inspection, transformation and routing. These might appear to be easy things to ensure, but there are actually numerous unknowns. The basic topology of the internet may not be suitable for handling delivery of content to customers. With application delivery (AD) it is no longer fully possible, since the inevitable shift is being made toward distributed objects based on an application delivery network (ADN). This is necessary because it is not possible to guarantee acceptable performance levels without using an ad hoc network that also has routing and load balancing capabilities at optimised execution speeds.

Phishing in depth

If an email that we receive appears actually to have been sent by our bank, we are less likely to question its authenticity, says Dario Forte, but we may still be the target of a phishing attack, whose objective is to trick us into revealing sensitive information. In the second part of a two-part article, he analyses the mechanics of a phishing attack as used in everyday cybercrime, and shows just how devious the proponents of this mature but still-effective method can be in their tactics. In the first of this two-part series, published last month, we explained the initial process of how phishers prepare the ground for their attacks. As stated in that article, phishing attacks can be subdivided into three phases: •Creation of a bogus web site that mimics the web site of the bank that is the target of the attack.•Uploading of the page onto one's own site or else the compromising of an existing site.•Mass emailing to lure the unwary to the bogus site. Creation of a bogus web site that mimics the web site of the bank that is the target of the attack. Uploading of the page onto one's own site or else the compromising of an existing site. Mass emailing to lure the unwary to the bogus site. The combination of these three elements allows an attacker to carry out an attack. The success of the attack depends on many factors, such as the credibility of the site, the contents of the email message, and the final user's critical analysis capacity and IT proficiency. This article will go into more depth on these issues.

Security audits in mixed environments

Security audits are now part of the regulatory landscape for many organisations, and it becomes particularly important when dealing with third party providers such as outsourcers. Service contracts must be complemented by documentation clearly explaining the nature of such audits, and the expectations from them. Under such agreements, individuals within the customer and the outsourcing provider must understand the role is that they play in supporting such security audits. Making reference to best practices and international standards, Dario Forte examines the assignment and control procedures for outsourcer authorisation profiles, assessing their potential impact on data confidentiality, integrity and availability and on service levels, identifying potential weaknesses in control measures and the corresponding corrective actions that should be taken. Laws in various countries require multi-level audits, especially for information systems managed wholly or partially via service contract with outsourcers. The documentation describing the logical security controls and methodology for protecting data integrity in the context of such services comprises a series of annexes to the service contracts, as well as a security manual which is usually necessary for setting forth policies and procedures. Both company and outsourcer personnel must be assigned authorisation profiles that are appropriate to their roles in the provision of service.

Different schemes for different teams

There has been a lot of talk recently about ‘parceling’ or ‘parcel mule scams’ whose victims are ‘mules’ who pass on goods acquired with dirty money. Parceling is a variant of ‘money mule scams’, differing from them in terms of dynamics and type of ‘hook’ (job offers, dating services, or even fake charitable organisations that ask the victim to help transfer merchandise). In the early years of digital investigation, the field was dominated by ‘one-man bands’ – solitary professionals with vertical training in specific areas of computer forensics, performing general analyses in areas such as child pornography or petty fraud. As time went on, however, fraudsters displayed new and far-ranging inventiveness, eliciting the need for broad-based teams who could ensure faster reaction times. The current state of the art entails developing investigation protocols and specific investigative expertise for each category of fraud. Regular Computer Fraud & Security columnist Dario Forte provides an overview of the most common types of illicit behaviours and the respective response methods.

Volatile data vs. data at rest: the requirements of digital forensics

Recent legislative changes following the enactment of the Budapest Convention on Cybercrime have created thorny issues for both technical digital forensics experts and legal professionals alike. New requirements have surfaced in the area of data preservation, and forensics workers are also finding themselves subject to new guidelines in the formatting, presentation and analysis of data gathered from target devices. Dario Forte explores the complex world of digital forensics, focusing particularly on the rules outlined in RFC 3227, a document with important ramifications for evidence collection and archiving in digital environments. During the past three years, the lack of data on individual workstations necessary for response measures has become an increasing concern. The data have instead been distributed to a number of different points.

The impact of cybersecurity on real world, big picture, planetary problems

How will cyber security affect the 2008 Olympic Games in Beijing? Our columnists Dario Forte and Richard Power report on the astronomical task of maintaining IT security for the Beijing Olympics as part of their RSA Conference roundup. The real-world topics of electronic voting and climate change are also investigated. IT security professionals can also do their bit to save the planet. Download : Download full-size image Making sure the Olympics is not extinguished by IT security incidents is a big job. Power and Forte report on the Olympics, electronic voting and climate change from the RSA Conference.

Security baselines to give you momentum as you move into the New Year

In our last column, we provided you with security baselines for business process controls, end user controls and mergers, acquisitions and divestitures. To avoid the mistakes (see page 5) made by some in 2007, see our experts' list of baseline security controls to ensure 2008 gets off to a secure start. This month, columnists Richard Power and Dario Forte continue on the subject of security baselines for business process controls. Following on from the December issue of Computer Fraud & Security, they provide further insight into security baselines for business process controls, end user controls and mergers, acquisitions and divestitures. Download : Download full-size image It is important to set baseline security for 2008.

The state of information security towards the close of the first decade of the 21 st century

Return on Investment (ROI) are three words which are expected to kindle executives’ interest in security. And there are ample ROI calculations available – mathematical formulae have been written along with books to produce that Holy Grail equation. But monthly columnists Dario Forte and Richard Power strongly dismiss ROI this month – saying security is a necessary overhead and shouldn’t have to earn its keep until disaster strikes. “Unless you can show us ROI for fire extinguishers, locked doors and burglar alarms, ROI for information security is a sham,” say Power and Forte. Experts Power and Forte look at the highs and lows of IT security.

The ultimate cybersecurity checklist for your workforce

Columnists Richard Power and Dario Forte present seven simple tips to get security awareness through to employees. They advocate merging online security tips for the home with work best practice. This way they begin to see it as a lifestyle change.

A tour through the realm of anti-forensics

Monthly columnists Dario Forte and Richard Power look at the traits, potentials and limitations of an often underestimated or merely rumoured category of malicious software. Anti-forensic behaviour is by no means something new on the information security scene: all attackers attempt to erase or disguise the traces of their intrusion and try to make the investigator's work as difficult as possible. Techniques used to elude computer forensics operations range from the simple deletion of log files to the installation of advanced and nearly invisible rootkits at the system level. The nature and degree of the difficulties faced by an investigator depend on the specific case, but there is no question that the task is becoming generally more difficult as time goes on. According to many experts, anti-forensic actions accompany two out of three attacks. This is a worrisome percentage, especially considering the exponential increase in attacks seen in recent years directed both towards public/governmental targets, and towards the business sector, where most of the resources are. The main objective of anti-forensic actions is to eliminate digital evidence or at least render such evidence unusable for legal purposes. Another objective is to throw investigators off track by modifying the evidence so that it leads to the wrong conclusions. An investigator always has to consider and examine every aspect of the situation in order to avoid falling into traps. This is the first in a series of three articles where we take a look at the traits, potentials and limitations of an often underestimated or merely rumoured category of malicious software.

Profiles in Cyber Courage #2: Tom and Justin Peltier

Father and son consultants Tom and Justin Peltier are quizzed by War & Peace in Cyberspace columnists Dario Forte and Richard Power on certification, laptop security and wireless. Justin describes certification as a “flawed process” but admits it can be useful in applying for jobs. He believes technical certifications are difficult to create so they have practical application. He calls for an IT security review board equivalent to the law exam for lawyers. On laptop security he believes easy to use encryption is best for end-users. He recommends PGP as it is user friendly and transparent. He says one of the most basic laptop security controls is a cable lock, which he uses everywhere. Justin says wireless networking is still part of the “golden age of hacking.” He says “fantastic” security controls are available for securing wireless access points and wireless clients. He has encountered organizations with no awareness of rogue access points or any means of detecting rogue devices. He says old attacks are still mostly used today where common tools such as airsnort and kismet are used against Wired Equivalent Privacy (WEP). He describes client side exploits as the newest wave of attacks saying they leave him “scared about security controls.” He admits the attacks are difficult to prevent and says deep pack inspection is the only measure that works somewhat. He is also fearful of: TOR - Packets travelling across the TOR are impossible to trace back. Anti-forensics (AF) - AF makes hiding an attack easier. Steganography - Combining steg with anti-forensics makes finding an attacker impossible. SSL- SSL is a popular attack vector. This year, every other month, War & Peace in Cyberspace will feature “Profiles in Cyber Courage.” In this ongoing series, we will focus on colleagues who have made significant contributions to the field of cybersecurity, and conduct in-depth interviews on timely and vital issues. Our second “Profile in Cyber Courage” highlights Tom and Justin Peltier ( http://www.peltierassociates.com ), who along with many individual accomplishments share the distinction of being the first father and son to win the CISSP and CISM certifications. The Peltiers consult, train, write and speak both as a team and individually. Tom Peltier's expertise is in the arena of cybersecurity management; Justin's is in the technical dimensions of cybersecurity.

Compliance: with what, and to what end?

Common sense, conscience, ISO and other compliance models Dario Forte and Richard Power ask experts what they think of the rules set forward in the ISO 17799:2005 security standards.

Profiles in cyber courage #1: Fred Cohen

Dario Forte and Richard Power have identified a number of security gurus who have made a difference in the IT security field. Every second month our authors will interview an established expert. The first profile focuses on Fred Cohen, a pioneer who first described a computer virus.

Virtual panel reveals big picture on attack and countermeasure evolution

The entire field of computer forensics must be rethought, believes Justin Peltier. Stone cold, stupid attacks bring down companies as easily as more sophisticated hacks, says Becky Bace. Here are just two of the views of a recent Q&A session with leading infosecurity professionals. An uncertain future is foretold as experts hold vastly different opinions on what threats lie in wait for the industry. Four security gurus join Richard Power and Dario Forte, this month, to thrash out big future threats and necessary countermeasures. They have vastly different views on what is important with one expert predicting a rise in virtual machine attacks, another in desktop attacks and a third believing cyber attacks will have an increasing influence on physical events. Peltier believes the whole computer investigation field needs to be rethought due to the emergence of anti-forensics. He also says we have not seen the worst of DDoS attacks yet, and predicts a resurgence. Peltier foretells a rise in the use of CD-based firewalls making firewalls more resistant to threats that exploit configuration. Infidel CEO Becky Bace believes suppliers watch helplessly as attackers move up the application stack, and fail to keep up with countermeasures. She predicts classic antivirus and worm defences are on their way out to be overtaken by better solutions. Keith Rhodes of the US General Accountability Office thinks the trend of developers not writing code leads to sloppiness in software. And independent consultant Rik Farrow is highly sceptical of Microsoft's inroads into the antivirus market. Richard Power and Dario Forte organize an expert roundtable to answer three big questions about attacks and countermeasures in the past, present and future.

Stalking “cyber terrorists” in Sofia – event report

Experts thrashed out the real likelihood and impact of cyber terrorism at a focused event in Bulgaria. Authors Richard Power and Dario Forte were there.

The cyber dimension of corporate investigations: insights of a 21st century sleuth

If you are late, it could get overwritten Dario Forte and Richard Power grill the founder of the New York City FBI computer crime squad, Ed Stroz about corporate investigations. Ed Stroz believes that computer expertise is fundamental to any investigation. He said that clients need investigators who will know if computerized evidence exists, where it is and how it must be preserved. He believes that the information age has made investigation easier, but only if you have the expertise to do it properly. A computer evidence trail can demonstrate more clearly someone's actions, than surveillance ever could, he says. Often a private investigator with base-line computer expertise is needed to work hand-in-hand with a computer forensics expert. You need to know basics like how packet-switched networks operate, how servers and blackberries communicate, how printers store data and so on. He says that sometimes executives expect staff from the IT department to be computer forensic examiners. A big problem is the delayed reaction in getting the right expertise. If a computer forensic examiner is brought in too late, then sometimes the data needed for evidence has been overwritten, warns Stroz who is now a managing partner of Stroz Friedberg. He also recommends that it is important to have lawyers advising early on. Getting ahead of the curve on cyber forensics, e-discovery and other challenging aspects of corporate investigations into malfeasance (whether perpetrated by insiders or outsiders) is one of the most vital tasks that confronts 21st Century information security professionals. Our intensive coverage of these important issues continues this month, as we conduct an in-depth interview with a leader in the field.

Case Study: a bold new approach to awareness and education, and how it met an ignoble fate

Experts, Dario Forte and Richard Power analyse a real-life radical security awareness program that spanned a 100-country confederation, reaching 100,000 employees. The global entity was initially hostile to security and lacking in command structure. The awareness program tactics were based on 21st century warfare techniques. The program didn't play on fear or talk-down to staff. It empowered them by pointing out how IT security could be applied at home and in their lives. An organization-wide security day took place. Also, the Chief Security Officer headed up a special hierarchy consisting of an Intelligence Officer and a Communications Officer. General staff, IT professionals and executives all received tailored communication. The program delivered training, events, E-learning modules and newsletters. The literature was translated into 20 languages. However, executive briefings were only one-page long. The management team were never told about a problem without also been told what was been done to mitigate it. In addition, new joiners became indoctrinated in IT security as part of their induction. The program started to make security second nature to some. It created a flutter of proactive responses from employees. More than 80% of IT Directors said the program put the organization in a stronger security position. The only problem - it was just a little too successful for the executives to handle. Below is a case study on the launch of a powerful, unique and comprehensive awareness and education program for a global entity, which we will refer to as Entity X. In the course of the case study, we will articulate the essential components of an effective and economical program, and explore some of the critical issues involved in developing it, rolling it out and institutionalizing it.

Ten years in the wilderness — a retrospective Part 2: Cyber Security = National Security

Security experts, Richard Power and Dario Forte believe that it is only a matter of time until there is a serious cyber attack on the National Information Infrastructure. They believe that a cyber attack will occur in tandem with a physical one. Many information warfare attacks have occurred and are likely ongoing. A Japanese cult, which launched a gas attack on the Tokyo subway system, nearly succeeded in getting software that it developed implanted in the Japanese Defence Agency computer system. Al-Qaeda has also reportedly attacked the US infrastructure. In addition, it emerged in December that Chinese attackers made highly professional attempts to penetrate US Government computers without leaving barely a trace. Experts believe the attacks to be state-sponsored. Despite the evidence of information warfare activity, it has gone down in priority in the US Government defence agenda. Under the Clinton administration, the Government released a National Strategy to Secure Cyberspace (NSSC). It also had a dedicated cyber security Tzar - Richard Clarke. But the emphasis fell away after the September 11 terrorist attacks in New York and the appointment of the new Bush administration. And citizens don't only have to worry about foreign information invasions. Information warfare can also be conducted domestically. Some experts believe that it is possible to meddle with electronic voting systems, causing a threat to democracy. The US General Accountability Office has voiced concerns including lack of encryption and memory card problems… This month's column is the second in a three part retrospective on this past decade in the field of Cyber Security. Where are we? How far have we come? Where are we going? Last month, we took inventory with “Nine False Notions About Cyber Security” and “Nine Steps to Success.” This month, we will explore the threat of Information Warfare both foreign and domestic in “Cyber Security = National Security.” Next month, in the third and final section of our retrospective, we will report on outstanding technical issues and industry trends.

Ten years in the wilderness — a retrospective Part I: Nine false notions and nine steps to success

Putting the record straight The dawning of the new year calls for clarity and is a time to dust out the old ways of thinking about security, say experts Dario Forte and Richard Power. They have identified nine false myths that have been associated with the field for some time. And they give much evidence to back up their arguments. They controversially dismiss the widely accepted idea that 80% of all attacks stem from insiders. Many attacks hail from technically competent external hackers who know exactly what they are doing. In addition Forte and Power dispute that cybercrime costs are exaggerated. They point out that this assertion is unfounded. There is no method for accurately measuring economic security losses in the industry, meaning that we are in the dark on the matter. They also point out that many organisations do not want to quantify their losses. And if they did calculate the costs of security breaches, they would keep the figures within corporate walls. But that is only the start of the nine false notions. Recently, we have been looking long and hard, in retrospect, not only at the year 2005, but at the last decade, so that we can understand the year 2006 better and be in a strong position to work alongside our colleagues in meeting the challenges of the decade ahead. Where are we? How far have we come? Where are we going? The answers to these questions are difficult to wrest from within the maelstrom: encouragement, disappointment, vindication, astonishment and despair swirl around the hard facts, and submerge them again and again, just beyond our reach. To provide some clarity, we have exhumed a list of “Nine False Notions About Cyber Security” that we drew up in 2000, at the turn of the century, mid-way throught the tumultuous decade that commenced in 1995.

Outsourced or Outsmarted?

Outsourced callcentres are an inescapable part of many businesses today. Dario Forte and Richard Powers outline the security risks and lay down some basic ground rules that security managers should lobby to enforce.