Data Leaks: The Silent Attacker

Data leaks are increasingly becoming a challenge in security concerns with the unprecedented rise in communication mediums. Most data leaks are unintentional rather than deliberate, but can nevertheless cause irreparable damage to a company's clientele, reputation, or compliance requirements for maintaining confidentiality.

Despite the widespread implementation of security devices such as firewalls and data encryption, data theft is still a relatively common phenomenon. There are many causes of security breaches: one third of data leakages in the previous year occurred because of virus attacks and another third through frauds committed by insiders with access to high security data. Leaks can also inadvertently occur when, for example, an employee decides to take work home for the weekend and uses unprotected mail systems such as Yahoo! to access sensitive work information. HTTP and FTP links can also act as avenues through which your information can leave your premises without your knowledge.

There are a few strategic ways in which you can monitor your data to check for fraudulent or unintentionally subversive activities:

• Know where your confidential information is located. It is critical to know the locations of confidential information in your organization. Always ensure that you close access to these when a project is complete or when the files are no longer being actively used. This is also particularly a concern with removable storage, such as disks and pen drives.
  
• Keep track of how and where confidential data is transferred. Data often travels from person to person via electronic mail and other mediums. It's imperative to keep track of where sensitive data is being transferred and to monitor the channels of communication being used by those who have access to confidential data.
  
• Create standardized data security policies. Data leaks are not just a security concern, they can have an overall impact on your business and the quality of your work ethic. Standardized regulations or data distribution policies can help you guard your sensitive information so that it cannot fall into the wrong hands.
  

Many solutions are targeted toward incident response, but effective measures of prevention also need to be implemented to prevent incidents from occurring. All companies should consider acquiring more stringent methods of safeguarding their data and implement Security Awareness Training for employees to prevent unwarranted or deliberate leaks of information. For some companies, Data Leak Prevention resources are critical. For example, companies under compliance regulations or who regularly work with proprietary client-confidential data, companies that frequently outsource work, or companies with projects being conducted on offshore premises should definitely consider a professional data security package.

Data leaks do not always occur through technology breaches. Always use caution when giving out information about yourself, your clients or your employees over the telephone. Spammers or phishers often penetrate the defenses of their targets by posing as representatives of an organization such as a bank or government office. Managing your intellectual property takes considerable effort and constant monitoring. Never think that your company is too small or your information too irrelevant to be at significant risk of potential pharming or phishing attacks.

Prevention systems need to follow the three key strategies listed below in order to be completely effective. If one or more of these steps is not taken to ensure the protection of your data, you could find yourself the target of various forms of security breaches that could compromise your compliance to regulations or your business as a whole.

1. Discovery
   

   The discovery of sensitive data and its extant locations is the first key process in identifying your data security needs. This includes internal databases and possible avenues through which such information may be released or distributed. Even legitimate channels of distribution such as internal mail servers and intranets should be identified as carriers of sensitive data which are subject to breaches. Only when these mediums are identified can you efficiently create data protection policies and regulations and implement them successfully.
   

1. Monitoring
   

   Once mediums carrying confidential data are identified and the relevant policies have been implemented successfully, it is imperative that such channels be monitored around the clock. Professionally developed data leak prevention tools not only monitor your data, but also create reports so that you are kept constantly updated on the status of your information and its locations.
   

1. Protection
   

   Always ensure that your data leak prevention policies are mapped to the rest of your business processes. Automated regulation policies can monitor and control your databases and run real-time checks on your information to ensure that it is secure and to inform you of any breaches as soon as they occur. DLP tools can make you confident that your data is protected at all times, both when it is in use and also while it is stored.
   

One vendor in particular stands out. Websense provides data leak prevention solutions that can help you manage your databases and the fluidity of your information networks by enabling you to manage your information and the channels through which it is distributed. Websense can assist you in many ways, protecting your data and ensuring that you are the one in charge of who has access to your information:

• Websense uses state-of-the-art technology such as third generation fingerprinting; agentless, situational awareness and discovery of data networks to minimize and preempt threats of data leakage.
  
• Customizable policies and templates can be adapted to suit your needs, and tools, such as those that audit your business processes and monitor your proprietary data, (such as source code) may be implemented to significantly reduce risks.
  
• Protect and control your data with policy regulations, incident management and enterprise solutions that fit into your existing infrastructures.
  

Many providers of professional security data leak prevention systems offer free risk assessments. You might consider such a program to gauge the risks that your intellectual property and sensitive information are exposed to every day. By implementing data leak prevention tools, you can protect your data from external as well as internal leakage and ensure that your business processes run more smoothly.

Why Using Non-Conventional Security Awareness Training is Crucial!

 

By Gale Yocom

Copyright2008

 

Financial Institutions can look to more in-depth examinations this year since the FDIC issued FIL-105-207, which updated the IT Examination Officer's Questionnaire. The FDIC wants to make sure that insured depository institutions have security programs that guarantee the confidentiality of customer information in addition to anticipating and protecting against security threats and unauthorized access of customer information. To ensure that these issues were addressed, there are five sections on the questionnaire, which includes Risk Assessment, Operations Security & Risk Management, Audit/Independent Review Program, Disaster Recovery/ Business Continuity Management and Vendor Management/Service Provider Oversight. Parts 1 and 4, namely Risk Management and Disaster Recovery are much the same as the 2005 questionnaire, with some minor changes. The other sections have a number of significant changes; one of the most important is that the 2007 questionnaire has included an entirely new section that focuses on questions about Vendor Management. One particular topic of concern addresses the FIL, because most institutions do not have standard security awareness training programs in place.

Training Awareness Using Non-Conventional Methods

With so many new complex threats going beyond the standard pharming, phishing and vishing attacks, assaults are now focusing on the end user or client side exploits. These attacks are exploiting and affecting mail readers, Internet browsers and third party applications such as Adobe Reader. Because of these more sophisticated attacks, it is more important than ever to educate users/employees about these risks, which can be achieved by making sure IT Managers have compliant training sessions in place. What we at Covetrix discovered is that most security awareness training programs are simply not enough. They are usually done annually or only when the employee is initially hired. Even with extensive training, the level of absorption of these topics is often forgotten in just a matter of weeks, usually because of a lack of interest or because of the approach of the material presentation. After a while, employees almost get the feeling of someone crying wolf when it comes to phishing / pharming / vishing attacks, which for future reference we will refer to social engineering. The training programs must be adapted so that the critical level of importance remains high. We believe by providing non-conventional, educational and real world examples, a financial institution will not only be able to educate employees with increased absorption, but they will also be able to understand how these scams work thereby being able to spot a scam and then quickly catching it before it impedes on the customer's privacy.

Tracking Employee Review is Critical to Retention

 

As our clients are eager to improve on their security levels, we believe it is vitally important to build strong teams, teams that can provide a quick response to potential threats, keeping security risks from causing havoc in the financial institution. At Covetrix, we see a need to track employee reviews of the security training material. The reason? It has been proven that more often then not, an individual may watch security awareness training videos, read e-mail messages, or review computer use handbooks with the best of intentions, yet their level of retention and absorption of the security knowledge is often limited. Covetrix has designed IT training videos that keep interest high and retention longer. The way they work is the video pauses and asks the viewer questions about the previously viewed content before continuing. This information is also reported to IT staff for compliance during examinations. Trained individuals must be ready and prepared to make quick decisions so that nothing threatens the security of the financial institution. Yet even with willing participants, individuals are sometimes overwhelmed with too much information. Despite the idea of ensuring that videos are watched and questioned and then asked about their understanding of content, we need the information to stick. To ensure that training methods stay in the minds of the users/employees, new ways of implementing the information must be enforced, which means it is necessary to implement non-conventional techniques.

 

How Non-Conventional Methods Work

 

In the event of identity theft scams, placing untrained people in security roles is not going to keep security risks away! What will keep them away is giving individuals the proper training, continually expanding on knowledge through effective training programs. As a well-qualified technology expert and experienced security specialist, it has become very obvious that when individuals are properly trained, they retain and absorb information more readily. And based on my years of experience, one of the best ways to help retain and absorb information is through non-conventional strategies. What do I mean by non-conventional strategies? In most training programs, the user is given a direction of lists which may include things like the following:

1. Don't open bad mail

2. Don't go to a bad website

3. Report all phishing emails

The problem stems from the user's actual understanding of this information. Our videos are using non-conventional training by actually showing a user exactly what is a bad mail, how they are created, or how a hacker creates a phishing site and attacks their institution. Combined with the employee's review of the information and non-conventional training, the knowledge transfers information in a far more effective manner.

The Outcome

As a result of implementing these innovative awareness training video strategies, we have seen a high level of success during our third party penetration testing and audits. Equally important are the individuals who are able to understand and retain information more efficiently. It's very clear that even the most effective training program requires periodic testing to ensure that the training program is serving the ever-changing needs of the financial institution. And just as technological challenges continue to change and grow, so too must training programs grow and change as well. With non-conventional training strategies, financial institutions have a far better chance of keeping customers safe from scams and unauthorized access to private information.

About the Author

Mr. Gale Yocom is a recognized technology expert and President of the Dallas-based security specialist company Covetrix. For the past ten years his company has provided full service networking and security solutions to government entitities, financial institutions, and commercial businesses across the U.S. Performing security audits, asessments and implementation of security measures on ISP networks, he brings a wealth of knowledge and information to Internet security. Mr. Yocom is known for effectively uncovering weaknesses in large institution's security practices and has impressively strengthened the security posture of many financial institutions. Mr. Yocom can be reached by contacting him at gale@covetrix.com or by visiting him on the web at www.covetrix.com

 

Security Awareness Training Video

One of our sales directors said this to our customer in a meeting:
If you have related stories you would like to share please let us know; one organization’s experience is someone else’s prevention.

I though that was a great idea. Send me your stories to share with others so that maybe we can all learn something from someone else tribulations.

First training video from Covetrix is making progress, we decided on the topic to be Incident Response Plan to Pharming and Phishing Attacks. I hope you guys enjoy it.


GY

Share Your Stories.

One of our sales directors said this to our customer in a meeting:
If you have related stories you would like to share please let us know; one organization’s experience is someone else’s prevention.

I though that was a great idea. Send me your stories to share with other so that maybe we can all learn something from someone else tribulations.

First traing video from Covetrix is making progress, we decided on the topic to be Incident Response Plan to Pharming and Phishing Attacks. I hope you guys enjoy it.


GY

Examples from Community Banks

This is an email from the IT Dept of a community bank in Arkansas
From:
Sent: Friday, January 04, 2008 11:49 AM
To:
Subject: Phishing

I just received a phone call from a person who stated that she was a representative from Experian. She said that she needed to update their records. She was given my first name from the teller who transferred the call to me and from my greeting. She asked me for my last name and if I was in charged of my location. She asked for my title, how long I have been with the bank, the last name of the teller who transferred her, and what her position in the bank is. I did not give her any of this information.

I asked her why Experian needed to verify bank information. She told me that she just needed to verify and update the banks information for the New Year. When I told her that I needed to know why she needed to verify my information and information about the bank when she works for Experian. I told her that Experian should have all of the information that they need. She asked if there was anyone else she could speak to who could verify information about the bank.

I told her that I would transfer her to Marketing and she asked for the Marketing person’s name. I gave her the first name. Then she asked for her last name, and if she was in charge of Marketing or just worked in Marketing. I told her that I would not give her that information. But, I would be happy to transfer her. When I began to transfer the call, she hung up.

Please use caution when giving out information about the bank and the Associates. Anonymity in these situations is crucial. It is important to ask questions, so do not be afraid to. Please be aware of the signs of a phishing phone call. If you get one please transfer the call to your Manager or HR.

Sophisticated Attacks on Community Financial Institutions Increasing!

By Gale Yocom

Copyright2007

In today's' high tech world, maintaining the privacy and protection of customers and employees' information grows more and more difficult particularly for many financial institutions. These days' scammers are getting bolder and more brazen in their abilities to get personal information from banking customers as they aggressively target the smaller locally owned community financial institutions. In fact, a recent customer reported a complex, malicious, and targeted attack took place on their institution's customers and employees. A well-recognized phishing activity trends website reported that financial institutions saw a continuing rise in phishing activities with 92.5% of attacks targeted on financial institutions. On average, a phishing site stays online for 3.8 days. The relevance to the number of days online is that the longer it remains online, the more possibilities for the scammer to gather personal information. It is imperative that we are prepared for this type of incident and the response that is needed.

Phishing and Pharming Attacks

There was a time when only the larger financial institutions such as Wells Fargo bank were targeted for phishing and pharming scams, but that's no longer the case. The increase in phishing attacks on community financial institutions stems from the fact that smaller financial institutions are simply more profitable and are usually less protected from fraudulent activities. As mentioned above, one of our local community financial institutions was hit with a complex and sophisticated vishing/pharming/phishing telephone scam that focused on customers as well as on the bank's employees. Fortunately, we have been preparing our client for years for these types of attacks, and therefore they were on the alert, so the attack caused minimum disruption. Sharp customers and employees recognized that the e-mail messages were a scam because of poor grammar and content in addition to the salutation being addressed to "member" or some other non-descript person. A genuine message from a financial institution always addresses the customer by their full name. Furthermore, the scams did not provide a means for contacting the institution if there were any questions, but instead told the customers and employees in the e-mail message not to reply. No legitimate institution would ever tell you not to reply. But even with preparation and after years of working in the Internet security arena, we were surprised at the combination of attack vectors used.

Combination of Attack Vectors

The scammers' used a variety of strategies starting with a mass email and pharming scam as an attempt to steal personal information using a Do-IT-Yourself Phishing kit. The initial attack was then followed up with telephone calls to certain area codes with spoofed numbers and using a technique called Vishing. Besides, using pharming, phishing, and vishing tactics aimed at stealing valuable information such as credit cards, social security numbers, IDs and passwords, the attackers didn't stop there. The scammers also included Spear Phishing, an email spoofing fraud that targets financial institution employees in an attempt to gain unauthorized access to confidential data. Because of the banks watchful eye, they caught it in time, but these types of attacks are getting bolder and more commonplace and require a great deal more vigilance in keeping personal information away from scammers.

Why Customers Are Fooled

Approximately 19% of recipients respond to Spear-Phishing, which today is one of the most menacing threats to Internet users. Unfortunately, users do not clearly understand the importance of checking for authenticity, which should include specific indications that the site they are being sent to is secure. As a busy society, we are so focused on getting the job done quickly and efficiently, we often don't check for important clues, which is why many users receiving messages or paying bills online don't watch out for the clues that indicate whether an e-mail message or site is fraudulent.

An Incident Response Plan

As these scams are on the rise in financial institutions, if a financial institution is prepared, and in today's world, they have to be, the consequences will be minimal. In the event of phishing and pharming scams, staff members in a financial institution should know how to deal with this type of situation effectively. To ensure the customer's safety and privacy, an incident response plan should be in place and is required by examiners to be in place. Included in the plan should be an organized approach as to how the problem is going to be handled as well as having a clearly laid out plan to address the situation.

The following should be considered in regard to an Incident Response Plan:

• Start by assessing the situation so that you know exactly what your bank is dealing with; if an incident has occurred, it's usually up to the CEO and CIO to handle the overall incident response along with members of a CSIRT.
  

• Fight the attacker
  
  • Educating the end user
    
  • Redirecting pharming clicks to an education page (most attacks are pulling images from your site)
    
  • Attempt to shut down the phishing site yourself
    
  • If needed have a competent vendor to respond to the situation for counter attack; this helps identify who will take down the website as well as which agencies to contact.
    
  • Exploit the phising website
    
  • Communicate with customers
    
    • Post Bulletins on Website to ensure customers are aware of the situation
      
    • Have employees assure customers that security controls are in place for the institution.
      
  • Contact authorities such as Secret Service, FBI; in addition, contact Financial Service Vendors for support on abnormal activity on customer accounts.
    
  • Feed bogus information to the pharmed sites.
    
  • Review abnormal activities on Customer Accounts and bogus accounts
    
  • Implement 3^rd party monitoring companies
    

This is not intended to be a complete incident response plan, but trigger the thought process on items to be covered.

Preventative Actions

At one time or another your institution will be affected by a fraud scam, therefore being prepared with a good response plan for employees as well as providing customer education, in addition to having the resources (either in-house or outsourced) to handle the problem efficiently and effectively are the most effective preventive actions. Prevention of course is primary insofar as keeping phishing and pharming scams at bay, and therefore as a preventive measure, customers who use online banking in any financial institution should be warned to use caution when opening any type of email with links that appear to come from their financial institution. Even if the message looks legitimate, prudence is always best. Educate customers to be proactive rather than reactive. Alert customers not to click any links that come in emails, especially if they appear somewhat suspicious. In addition, if the customer has any doubt about the e-mail message, alert the customer to call their financial institution directly to determine whether it could potentially be a phishing or pharming scam.

Provide customers with Security Awareness Training by developing a web page about information disclosure in addition to providing
a closely monitored email address for this activity should be set up by your institution where customers can send suspicious activities.

About the Author

Mr. Gale Yocom is a recognized technology expert and President of the Dallas-based security specialist company Covetrix. For the past ten years his company has provided full service networking and security solutions to government entitities, financial institutions, and commercial businesses across the U.S. Performing security audits, penetration testing and implementation of security controls, he brings a wealth of knowledge and information to Internet security. Mr. Yocom is known for effectively uncovering weaknesses in institution's security practices and has impressively strengthened the security posture of many financial institutions. Mr. Yocom can be reached by contacting him at gale(at)covetrix.com or by visiting him on the web at www.covetrix.com