No, Encryption Is Not Enough to Protect Your Data

MPK : = "What is suggested is the same that's been suggested for years. And it's obviously not working.  "

hmmmmm

This morning's Suggested Reading is on Secure Business Intelligence and deals with the Blackhole Virus Kit

There is so much good stuff on this thread this morning I'm going to just add a little of my own rather than trying to answer individual items -- of which there are so many really good ones!

as I see it, part of our problem is one of perception.  If you see your computer like this:

then you may try to defend the entire perimeter : (light blue ) . this is not feasible because your application programs: web browser, spreadsheet, e/mail, &c -- are constantly taking in new data files -- which may -- and often do -- contain executable scripts, such as Java, Visual Basic, .php ,,, &c

as soon as you read an infected file: you are sunk.

you should view your computer more as follows:

The above depicts a system that is "sandboxed": each application runs in its own "sandbox" and does not have general access to the whole machine. if it wants to update anything it has to ask the O/S to do that. The reader should remember that this security is built into the x86 chip architiceture and has been there since 80386

most attacks will attempt to "drop" malware on you; i.e. they will attempt to install some un-authorized programming on your computer. This is where User Account Control (UAC) comes into play: UAC will ask you if you want to allow an update. You could then use an anti-virus product to "vet", i.e. check the known reputation of -- whatever it is you want to install.

and this will help

Remember though: while "sandboxing" was part of the original IBM System/360 (1965) RACF was added in 1974. RACF was used to answer the key question: should we allow User "X" access to resource "Y"

In Advanced Windows environments today one would consider "AppLocker". Applocker will allow the system administrator to decide what programming is authorized. This is a "whitelist" approach.

Good thread. The added key is: Do not allow un-authorized programming.  For this you must take control of the list of authorized programming.  Only after you have control over the programming in the machine does encryption and authentication come into play.

Michael,

I get what you are saying -- from an end-user perspective.  However, my article was addressing Data Security from a corporate perspective.  A corporate website should, in my opinion, not have 3d party companies serving up ads.  If they want a clickstream revenue then perhaps they should create their own interface into the data stream -- something I know can easily be done.  From a corporate computer perspective -- use DNS to block ad-sites and that filters out the problem of sites like Yahoo having their adstream hijacked.  And while there was mention of browsers in the best practices -- the majority of the information was built around what a company would need to do to keep its internal data safe from malicious loss.

I have no doubt that these exploits exist.  However, I have been lucky enough (in the last 22 years) to not get infected because I don't click on links that have a different or suspicious URL in the status line.  I don't show images in my spam box, and I'm exceedingly careful about what my family downloads (and they are not IT professionals).  I also keep my antivirus updated on a daily basis (and I pay them to be up to date).  So while I do not doubt what you are saying, from a corporate perpective, these thing can be avoided and mitigated if the business takes the business of IT seriously and intends to educate rather than blame its employees.

Hendry, I like this post.  Plenty of information, and a good reminder of just how much most of us are letting slide.  But this is like the auto industry -- the car builder can tighten every nut but the one behind the wheel.  Fortunately, training people to be wary of social engineering may be one of the easier tasks.  Being nice and wanting to help is good, but teaching people to stop a second and wonder who we're helping to do exactly what can be easily inculcated.  And it works.  Perfect example: last week in my wife's company, a person called her boss to expedite access to some data, claiming to be from the company's "fraud" department.  When the boss mentioned this to her, her first response was, "Oh, HELL no!"  Her second response was to IM a contact in the Data Security department, who contacted the party to ask what was really required.  Access was then granted only to the specific file needed.  Helpful, courteous, and quick response to the request, without exposing any additional data.  Educating users is as important as any firewall, and it makes them better, more valuable employees (and better human beings, too).  Or, we could scrap all that, and just have them sign the Corporate Loyalty Oath.  That'll work, right?

You cannot educate people about the unknown. Some major "outside the box" advancement will be required to solve this if it's even possible. Security has been playing catch up as long as we've been around. 

That might be true but it doesn't change the fact that an educated user base is still better than an uneducated one.  What exactly are you trying to promote? 

The point of the article is to realize that relying on a single sytem to protect data is not enough.  No matter what the next step in security is, the users need to be on board either to support its implementation, practices, or continued development.

That's only going to happen if users are aware of how big the threat is and that's part of education.

I've been in IT for 35 years -- been writing about IT security for 15. Right now the fastest-growing ploy of bad guys is to subvert websites or ad networks displayed on websites. 

Visitors do not have to do anything other than accidently hover their mouse over an ad or a small pixel image and the malcode is installed. Keeping their computer up-to-date and abiding by all best practices does not help when this happens, because it is a zero-day malware -- there are no updates or patches. I have more examples if you wish.

I'd prefer to have a more seasoned I.T. security professional jump in here, but a lack of education is what gets the majority of the computers infected in the first place. 

Users clicking dangerous links, users falling for phishing scehemes, users not installing security software on their home machines so they don't wind up part of a botnet, users using really weak passwords, CEO users not valuing security so their companies are breeched...  all comes back to education. 

That all of the computers being infected at this time are due to users being insufficiently educated in IT security? 

Michael P. Kassner:  You didn't specifiy on what you said "wasn't working" but your first post on the subject was "I submit that what you ask to happen -- particularly with social engineering -- will require a change in human nature.".  Thus it sounded like you were saying that education wasn't working.

Now it sounds like you're trying to support your argument by submitting that education can't help against zero-day malware, but that doesn't have too much to do with social engineering which seemed to be the focus of the first comment.

Still, education can help thwart even zero-day malware by ensuring best practices are followed and one breech doesn't mean total data exposure (depending on circumstances), and ensuring users can identify suspicious activity and its threat.  Education can also minimize exposure to malware in the first place. 

Education is the core of any security because if the users don't play along the security isn't going to happen.  So yes, educated users help minimize the damage of zero-day malware in comparison to what would happen in a situation with uneducated users.

Yes.  You can hire bodies to sit and watch log files (in Unix tail -f) Are they up to what tools can do? No.  Automation allows for fewer people to consume and analyze more data and keeping costs down (TCO) is really what business and IT are all about [when the business is not IT itself].

For larger companies where the threat of data compromise is presumed to be real, the manual processes have already led to the use of tools that automate some of the network monitoring.

But for small and medium companies, that may not understand the threat or the cost to the company (both real and in reputation), I don't think they should just go out and purchase a tool without understanding what it does and having the right staff to make best use of the tool. This idea of tool usage represents a fine balancing act.  

Many executives have been sold on a tool and its capability at a show.  They purchase the tool but don't have the in-house knowledge to implement it.  And so they are stuck with a software albatross that does nothing.  Their choice -- throw it away (and eat the loss) or educate the IT team (or even develop an IT team) and then actually make use of the tool they purchased.  I've seen both done.