[iwar] [fc:Protecting.Electronic.Data.Becomes.A.Burning.Issue]

From: Fred Cohen (fc@all.net)
Date: 2001-11-11 06:37:00
Next message: Fred Cohen: "[iwar] [fc:Banks.reject.student.hacker.claims]"
Previous message: Fred Cohen: "[iwar] Passive OD fingerprinting"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Message-Id: <200111111437.fABEb0q13186@red.all.net>
To: iwar@onelist.com (Information Warfare Mailing List)
Organization: I'm not allowed to say
From: Fred Cohen <fc@all.net>
Mailing-List: list iwar@yahoogroups.com; contact iwar-owner@yahoogroups.com
Precedence: bulk
Date: Sun, 11 Nov 2001 06:37:00 -0800 (PST)
Reply-To: iwar@yahoogroups.com
Subject: [iwar] [fc:Protecting.Electronic.Data.Becomes.A.Burning.Issue]
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit

Protecting Electronic Data Becomes A Burning Issue 
By Tom Sawyer, Engineering News-Record, 11/9/2001 No URL available.

The range of threats to business data has sharply increased in recent
months, pushed by the increasing sophistication of hackers and thieves,
and now by the specter of terrorism and cyber warfare. 
There are micro and macro issues here -- issues of employee data theft
and vandalism and the bad luck disasters of storm and fire. But there
are also sinister threats to the communication infrastructure that could
have tremendous impact on business, even by just impeding the flow of
electronic data. Relentless cyber assaults by viruses, worms and Trojan
horses not only bedevil systems administrators, may do far more harm in
the future as hackers improve their nefarious skills. 
''People don't realize how unbelievably dependent we have become on
these systems,'' says John Voeller, chief knowledge and technology
officer at Black &amp; Veatch, Overland Park, Kan. The Internet serves
businesses so well that some are discarding older skills and tools, such
as plotters, he adds, and becoming totally dependent on electronic
transmissions instead. 
Hacker assaults on the Internet in recent months are ''babycakes,''
Voeller says, compared to the damage conceivable with software sitting
around today. The rapid spread of last summer's Code Red worm and the
''Nimda'' virus, which clogged servers and degraded service reliability
on Sept. 17, reveals the perils of Internet dependence. ''What contract
liability are you exposed to if it takes three days to get your drawings
into the system?'' asks Voeller. ''What happens if you miss the
evaluation date because of a slowdown of the network?'' Business data is
clearly at risk, but businesses are not without protection. Maintaining
redundancy is probably the first line of defense. 
In the widest sense, business data encompasses all of a company's
information stored on paper or in electronic files. Electronic project
documents obviously need to be safeguarded, but also of critical
importance are accounting systems, archived records, contracts,
insurance policies, software registration codes, correspondence, contact
lists, photographs and employee records. The need to protect data, much
of which is on servers just across a firewall from the Internet or
bottled up in hard drives or storage vaults, has never been greater.
Incidents of data theft and vandalism by disgruntled employees are on
the rise. Now, worries about fire and destruction by natural disasters
have been joined by real concerns and similar losses, from terrorists. 
''It is a myth that buildings and people were the sole target Sept. 11.
It also was the economy,'' warns Ed Jopeck, director of security
analysis and risk management with Veridian, an Arlington, Va.-based
information technology security consultant. Jopeck's Information
Solutions division has 1,900 engineers, trainers and specialists
providing security services and information and infrastructure
protection for the U.S. Defense Dept. and various intelligence agencies,
as well as some state and local governments and companies. 
Jopeck spoke Oct. 18 to a Business Week-sponsored symposium in Chicago
discussing the future of the Internet. Business Week is owned by the
McGraw-Hill Cos., which also is ENR's parent. ''An attack on one sector
of the economy has a cascading effect,'' he told attendees. ''Our
economy lives on proprietary information -- it's our competitive edge --
and those things are at risk.''

IMPACT Principals of companies physically impacted by the destruction of
New York City's World Trade Center know exactly what Jopeck means. They
are taking lessons from the experience even as they rebuild. ''Our
biggest worry before this was the potential disgruntled employee,'' says
Michael Gelfand, a partner in the architectural planning and interior
design firm Gruzen Samton LLP. 
The firm's two floors of offices across the street from 2 WTC were
gutted when the collapsing tower showered the building with burning
debris and blew out windows (ENR 10/8 p. 20). The 120 employees were
evacuated safely and data backed up in the company's Washington, D.C.,
office was secure. But not so lucky were files, plans and tapes stored
in a fireproof cabinet and safe in Manhattan. The safe utterly failed to
protect its contents. ''It turned into an oven,'' says partner Jordan
Gruzan. 
Despite being a direct victim of history's most devastating terrorist
assault, Gelfand is sanguine about one thing: A simple fire in the
office could have done the same thing. ''I guess we are more worried
about terrorism than we ever used to be,'' he says. ''But it will do the
same thing a potential accidental fire or gas explosion would do. It has
brought the whole concept of losing our data closer to the surface.''

RECOVERY Gruzan Samton is recovering through determination and flashes
of good luck. Almost all of the contents of one fireproof cabinet were
rescued and restored. One small section of the office was saved because
recent renovations had partitioned it with a two-hour firewall, which
kept the flames at bay. Gruzan says that among the lessons his firm has
learned is to compartmentalize operations just that way, and to use
offsite back-ups religiously. It also plans to go for total redundancy
between its New York and Washington offices. Hardware, by comparison,
was easy to replace. 
''I don't know how the guys did it. In six days we were back in
operation scattered across eight different offices with several servers
and everybody on a computer,'' Gruzen says. Meanwhile, recovery
continues. The firm took possession of new Manhattan space on Oct. 28. 
Planning to enhance data security is an 'on the one hand, but on the
other hand' situation, because there are many levels of risk for which
to plan. The security of the Internet itself is, at some levels,
questioned. Under some scenarios, Internet-based business practices are
seen as a safeguard but overdependence may also be a serious liability. 
Jopeck and other experts say offsite data back-up has become a
first-line defense for corporate security. But it requires either a
routine system for transporting tapes to a secure, remote location, or
assured connectivity to do it electronically. Other primary defensive
strategies are aggressive IT systems management, virus protection
disciplines, cautious hiring and employee awareness training. But the
one issue that has really jumped to the forefront after Sept. 11 is the
need for Internet-reliant companies to make sure they have robust
communication links to secure data centers. 
''One who loses the ability to communicate minimizes the ability to
maintain network security,'' says Victor de Joy, executive vice
president of Lexent Technologies Inc. and president of its subsidiary
engineering and construction division, National Networks Technologies.
The company has been restoring and upgrading connections to businesses
in lower Manhattan in the wake of the WTC disaster. 
''I am seeing an increased focus on last-mile connectivity, on having a
direct fiber-optic link to the end user, as opposed to leasing through a
third party like a local exchange carrier,'' de Joy says. 
Prior to the attacks, typical arrangements had fiber-optic networks
handing off at node points to local carrier's ''twisted pair'' copper
service for final routing. Many of Lexent's clients are replacing that
entirely by fiber optics, eliminating one vendor from the critical loop.
''In New York City, there is demand to accelerate the last 300 ft into
that commercial building so there is no dependence on a third party,''
de Joy says. Clients in Boston, Philadelphia, Chicago, Florida and Los
Angeles are also pushing up their last-mile timetables, he says.

TWISTED One difference between reliance on twisted pair-based
telecommunications and the Internet, which dispatches transmissions as
packets of data scattered across a variety of routes, was pointed out by
Adam Haas, executive director of telecommunication services at W&amp;H
Pacific. The Beaverton, Ore. engineering and construction firm
specializes in land development, landscape architecture, planning and
telecommunications. ''Telephone calls [on Sept. 11] were very difficult
to make, but sending e-mail by the Internet turned out to be one of the
most robust communications methods because of the Internet's distributed
architecture,'' he says. ''Standard telecommunications are Point A to
Point B, and if you get a break, you're in trouble.'' 
Establishing a universal end-to-end fiber system should enhance business
security, but it is a daunting task. ''It's expensive,'' says de Joy.
''We are looking at ways to engineer and perhaps bring together carriers
to share the costs to light buildings.'' Only about 10% of the nation's
buildings are serviced by an optical connection, he says, adding that
the costs can range from a few thousand dollars to well in excess of
$100,000 per building. ''Over the past five to 10 years, an enormous
amount of optical communications infrastructure has been deployed,''
says de Joy. ''The last thing to do is finish the job, which is to build
that complete optical- based network from end-user client to end-user
client.'' 
Such a system not only would have almost limitless bandwidth, but
significantly greater security, he says. Compared to copper cable,
optical systems are easy to monitor for tampering and are almost
impossible to tap into physically. 
Bill Moroney, president and CEO of the United Telecom Council,
Washington, D.C., says the utilities and pipeline companies his
organization represents have made broadband reliability one of their
highest priorities and have met it by building private systems. ''As an
industry, critical infrastructure companies probably have the biggest
private networks,'' he says. ''They own the switches, fiber optics,
everything. It's just the nature of the reliability that is needed.''
Some large companies are now turning to utilities that have developed
needed construction and management expertise to build similar systems
for large private networks. 
Moroney, however, is one expert with a high degree of confidence in the
resilience of the Internet. ''Theoretically we are susceptible, but
there is an enormous amount of redundancy,'' he says. ''To say we
couldn't be attacked is silly. Of course we could.''

REDUNDANCY, REDUNDANCY Beyond the last mile linkage lurks the question
of local routing diversity, a question experts say companies need to be
asking. ''Generally speaking, the long-haul and backbone infrastructure
is diverse,'' says de Joy. ''If one cable gets cut, there are
prescription backup plans to reroute another way. The issue is if you
lose your last mile. It's not a security flaw, it's a diversity flaw.'' 
Those flaws are being addressed not only at nodes and data centers, but
on corporate campuses and individual office buildings, says Haas.
''People are going to have to think about placing additional conduit
into their properties and coming in from multiple points within a
building to provide true divergent routing,'' he says. 
Haas also predicts more carrier oversight by the federal government for
emergency recovery planning. ''It is really about knowing where the
faults are in your network,'' he points out. ''The government is going
to have a role in it because there is certainly going to be an increase
in tapping into information that might be related to homeland
security.'' 
Haas also says that data centers are strong, dispersed and redundant
enough not to be a serious weakness in the system. Taken individually,
however, data center security is a high priority. Centers are being
built with layers of protection against intruders, but also are tied in
with geographically diverse communications links. They also have power
feeds from separate grids, backed up by on-site emergency generation.
''We have redundant conduit, both for electrical power and
telecommunications equipment,'' says Jerry Valencia, partner of Valencia
Commercial Properties, Del Mar, Calif. The firm is finishing development
of a new data center for the Rockefeller Group in nearby Santa Ana. The
center also has back-up generation for at least 72 hours and uses
biometric security in the most sensitive area, he adds.

ROUTING AROUND Thomas Rossiter, president of Chicago-based design-build
firm McClier, says the key to securing the Internet isn't in building
blast-resistant data centers but in guaranteeing the capability to
switch operations very quickly from one to another. He says the
nationwide scope of the Internet, and its routing redundancy, are its
best security. Localized disruptions, even the loss of multiple
transmission lines or Internet data centers, can quickly be minimized by
rerouting communications. ''If there is a disaster, one can be
switched,'' he says. ''If you go down in Chicago you process out of
Saint Louis or Milwaukee.'' 
Just when dependence on the Internet is seen as a risk factor, others
point out that it can be a security agent as well. Ryan Watts, a
software engineer and security officer at Atlanta-based Constructware,
and Jeff Albertine, developer of the firm's Application Service Provider
software, point out that such services focus resources on protecting
data and systems far more aggressively than most of their clients can. 
System administrators implement anti-virus updates continuously, and the
software constantly scans uploaded files and repairs or quarantines
infected ones. But the architecture of ASPs such as Constructware also
offers protection, they say, because data hosted on such system's
project Websites is never actually touched by users. Only HTML
representations of it are affected, so the user and database servers
holding project information are never directly linked.

VULNERABLE Veridian's Jopeck urges businesses to take very seriously the
need to back up and safeguard data. He warns that U.S. systems are
vulnerable to economic espionage by foreign governments, whose
capabilities to cause damage and disruptions far outweigh those
experienced from hackers so far. ''Can you imagine your company business
as a subject of spying by a foreign intelligence service?'' says Jopeck.
It ''would take pretty much everything you've got,'' he adds. ''If
foreign governments take part, it's going to be much more significant
than anything your corporate security officer has seen.'' 
Jopeck further predicts that ''when the time comes, we will be a
battlefield in war. We will have computers behind enemy lines -- your
computers -- because they are connected to the global network. Your
computers could become casualties of war.'' He describes the September
attacks as part of a shifting and escalating pattern of assault that is
likely to continue. He adds that our dependence on electronic storage
and transmission of corporate information is a vulnerability that our
enemies will surely exploit, and that includes targeting the Internet. 
''Someone is going to know that he or she can do greater damage to us by
attacking the Internet than in any other way, perhaps even greater than
by bringing down buildings or killing people,'' says Jopeck. 
The Veridian executive warns that security precautions will increase
business headaches and interfere with performance. The burdens may pull
down weak or unprepared companies. He urges companies to take an
analytical and proactive approach to assessing their risks. ''Seek out
vulnerabilities and create defenses, rather than wait to respond to
attacks,'' he says. 
The need for excellence in security staffing is another area experts say
is not being given enough attention. ''Most companies do not have
top-notch IT people,'' says Voeller. ''They're sloppy, and even the very
best are having significant difficulty.'' He says that as the level of
hacker sophistication goes up, the level of difficulty will be like the
difference between checkers and chess. ''Make sure you have a very
unemotional network manager,'' he advises. ''If that person is doing
their job well, you won't have to worry that you won't be able to do
yours.'' 
________________________________________________________________________________

PLANNING FOR EMERGENCY RELOCATIONS: -- Keep data backed up offsite. --
Examine your company and rate data and functions for criticality . --
Determine the minimum time you have to get each critical function
restored and prioritize. -- Document plans and processes. -- Train your
employees. -- Test plans and arrangements regularly. Source: Adapted
from OnlineEnvironments.com
________________________________________________________________________________


URL: http://www.enr.com 
GRAPHIC: Table, Photograph: FRIED Contents of fireproof safe at Gruzen
Samton turned to ashes after WTC attack. PHOTO COURTESY OF JORDAN
GRUZEN, GRUZEN SAMTON LLP, ARCHITECTS: ILLUSTRATION BY NANCY SOULLIARD
FOR ENR; Illustration: Graph: NUMBER OF HACKING INCIDENTS REPORTED
Source: CERT Coordination Center ; Photograph: EDWARD JOPECK PHOTO
COURTESY OF VERIDIAN ; Illustration: Graph: A FEW HOURS WORK BY THE CODE
RED WORM Source: CERT Coordination Center ; Photograph: DATA MINING A
second fire-proof box protected crucial data at Gruzen Samton. PHOTOS
COURTESY OF JORDAN GRUZEN, GRUZEN SAMTON LLP, ARCHITECTS

------------------------ Yahoo! Groups Sponsor ---------------------~-->
Universal Inkjet Refill Kit $29.95
Refill any ink cartridge for less!
Includes black and color ink.
http://us.click.yahoo.com/XwUZwC/MkNDAA/ySSFAA/kgFolB/TM
---------------------------------------------------------------------~->

------------------
http://all.net/ 

Your use of Yahoo! Groups is subject to http://docs.yahoo.com/info/terms/
Next message: Fred Cohen: "[iwar] [fc:Banks.reject.student.hacker.claims]"
Previous message: Fred Cohen: "[iwar] Passive OD fingerprinting"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
This archive was generated by hypermail 2.1.2 : 2001-12-31 20:59:59 PST