<?xml version="1.0" encoding="UTF-8"?><rss version="2.0"><channel><title><![CDATA[SDS Newsroom]]></title><description><![CDATA[Articles]]></description><link>http://www.securedigitalsolutions.com/news/</link><copyright><![CDATA[Copyright SDS Newsroom]]></copyright><generator>SDS News</generator><item><title><![CDATA[Secure360 Conference]]></title><description><![CDATA[  Look for SDS at the upcoming     7  th   Annual Secure360 Spring Conference     - May 8th &amp; 9  th   . Come visit booth # 301 to pick up your exclusive Cyber Incident Response card and talk face-to-face with our consultants about the latest in Information Security. Each consultant at Secure Digital Solutions has over 10 years of experience, and can offer you great insight on any of your security concerns. There&rsquo;s nothing better than free advice, right? Come check us out!  
  Interview with attendee     Tim Pearson    , Security Consultant at   Secure Digital Solutions    
    Is this your first Secure360 attendance?   No, I have been attending Secure360 for the last 5 years. The last 2 years have been as a employee with SDS.  
    What was the most memorable topic from last year?   There was a talk about Chris Palmer of the Electronic Frontier Foundation (EFF) about the issues surrounding our SSL certificate infrastructure. More importantly, how many of the certificate authorities that are trusted by most browsers are located in untrustworthy locations, issue certificates without much or any verification, or are completely controlled by a government.  
      What do you hope to learn about at this year&rsquo;s conference?     I am looking forward to hearing Douglas Hubbard, the author of How to Measure Anything, at the keynote on Tuesday. There are several other talks on risk management that look interesting  
    In your opinion, what is the most important /overlooked aspect of data security?   Teaching users common sense, the majority of the security issues I have seen in the past year have been caused by users downloading malicious content or receiving and opening malicious email. We need to do a better job of educating users on how to recognize situations that are not secure or correct without resorting to fear mongering.  
  Secure360 is the premier educational conference for the information risk management and security industry. The conference is supported by the Upper Midwest Security Alliance (UMSA). The Event will be held May 8-9th, 2012 at the St. Paul Rivercentre. For more information visit       Secure360.org     or call us at (952) 544-0234.    
  
    Join the conversation:       @SDS_Advisor @Secure360       
  
  &nbsp;  ]]></description><pubDate>Wed, 02 May 2012 13:29:31 +0000</pubDate><link>http://www.securedigitalsolutions.com/news/more/secure360/</link><guid>http://www.securedigitalsolutions.com/news/more/secure360/</guid></item><item><title><![CDATA[Minnesota High Tech Association Spring Conference]]></title><description><![CDATA[  Look for SDS at the upcoming MHTA Spring Conference&nbsp; - April 25th  
      Session 1E: Data Security Risks &amp; Strategies        
Sponsored by:       Robert Half Technology          
    The  strength of any system is no greater than its weakest link. In the era  of exploding electronic data and aggregation threats from all sides  present new challenges to organizations  straining the expertise and resources of the teams charged with the  protection of critical data assets. Join us for a discussion of the  nature of new threats facing organizations in the age of cloud solutions  and hear best practices for keeping data safe,  reducing the risks of data breach and critical breach incident response  strategies.    
  
        Moderator &ndash; Jennifer Hamri, Robert Half Technology    
        Glen Newton, PhD, CISSP, Consulting Software Engineer, Unisys    
        Chad Boeckmann, Secure Digital Solutions    
        Bryce Austin, Wells Fargo Business Payroll Services    
  
  More info &gt;   www.mhta.org/events/    ]]></description><pubDate>Tue, 24 Apr 2012 13:08:05 +0000</pubDate><link>http://www.securedigitalsolutions.com/news/current-sds-news/minnesota-high-tech-association-spring-conference/</link><guid>http://www.securedigitalsolutions.com/news/current-sds-news/minnesota-high-tech-association-spring-conference/</guid></item><item><title><![CDATA[Importance of Application Security]]></title><description><![CDATA[  According to Verizon&rsquo;s preview of its 2011 annual data breach report1 92% of breaches reported were from external attackers.&nbsp; As the sophistication of network level protection has increased, hackers have discovered a target rich environment in vulnerable websites.  
  In the rush to get online, many small-to-medium sized businesses (SMB) have hurriedly built websites that enable their customers to order products and services.&nbsp; Most of these SMBs are not aware that they have exposed their most sensitive data to potential online theft.&nbsp; Now, as the trend continues toward mobile applications, astute SMB owners are asking: &ldquo;How vulnerable are my publically facing products and services to attack?&rdquo;&nbsp;  
    
Key steps can be taken to help SMB owners answer these questions.&nbsp; A comprehensive application security program will help SMB owners understand their exposures online and provide specific steps that they can take to reduce the risk of breach to acceptable levels.&nbsp;  
    
Increasing regulatory pressure, along with a wave of massive data breaches in 2011 has caused many companies to increase their budgets for security measures, usually as an afterthought.&nbsp; SDS&rsquo; position is&nbsp; that a more effective and cost efficient&nbsp; approach to improving application security is to incorporate security requirements and security testing into a company&rsquo;s baseline application development process This approach will yield better results overall compared to the more frequent approach of operating security controls separately from application development.  
Here are some key components of an application security program:  
      
1.&nbsp;&nbsp;&nbsp; Secure Software Development Lifecycle (sSDLC)    
It has been well documented4 that the cost to repair a software defect increases dramatically, the later in the Software Development Lifecycle that the defect is detected.&nbsp; Considering that penetration test findings are essentially &lsquo;missed requirements&rsquo;, a number of steps can be taken to reduce these costs by becoming more pro-active.&nbsp; Reference methods for establishing a Secure Software Development Framework (SSF) are available in the Building Security in Maturity Model (BSIMM3)5.&nbsp; Figure 1 shows how application security controls can be added to a company&rsquo;s existing SDLC.  
      
      Figure 1. Secure Software Development Lifecycle      
    
  2.&nbsp;&nbsp;&nbsp; Application Security Design Review    
The purpose of this service line offering is to examine the full technology footprint of a new or existing product or service.&nbsp; The high level intent is to understand whether all of the technology layers (application, data, network, use of third parties, physical access) used by the product or service are adequately secured.&nbsp; Of particular importance is to identify whether sensitive data stored, processed or transmitted is adequately protected.&nbsp; Any regulatory requirements such as PCI, HIPAA, GLBA and others are identified.  
    
3.&nbsp;&nbsp;&nbsp; Web Application Penetration Test    
Penetration testing of websites will identify the most widely recognized application vulnerabilities.&nbsp; These have been documented in the OWASP Top 102 and CWE Top 253.&nbsp; Examples are Cross Site Scripting and SQL Injection.&nbsp; Test findings are prioritized using a 5 point risk score based on the industry standard Common Vulnerability Scoring System. A report is prepared of findings and presented to the client.  
  
  4.&nbsp;&nbsp;&nbsp; Server&nbsp; Vulnerability Scan    
The vulnerability scan is applied to all network attached devices such as servers, routers and switches.&nbsp; The focus of this automated test is to identify operating system level deficiencies such as missing security patches and inadequate cipher strength of the underlying servers on which the application is installed.&nbsp; This scan can quickly provide a view as to how vulnerable the network is to attacks initiated from inside the network, or alternatively, once an externally facing server is breached, the degree of vulnerability of the remaining network.&nbsp;   
  
  5.&nbsp;&nbsp;&nbsp; Application Code Review    
Many errors in programming logic cannot be detected using vulnerability scanners.&nbsp; This service consists of two parts, (1) source code review by a security expert, (2) for larger volumes of code, the code is scanned using specially designed source code scanners .&nbsp;   
  
  6.&nbsp;&nbsp;&nbsp; Remediation Support    
Conducting the tests is not effective unless there is a reliable follow through to remediate findings from the security reviews and scans.&nbsp; Adequate line of sight must exist between the security group and key management who provide the organizational power needed to prioritize remediation efforts and ensure that they are completed in a timely manner.&nbsp;   
  
  In Summary    
As an organization matures and aligns its' information security program with business process and support of core objectivces the application development process must not be ignored.&nbsp; Many organizations begin their application security program by simply documenting application security standards. Others engage third-party firms specializing in application code reviews or penetration testing to find defects and mitigate risks. The point is to understand clearly how information security is involved in the entire software development lifecycle and take appropraite actions to start engaging in some form of an application security program today and not wait until tomorrow when it may be too late for prevention.   
  
    References      
  1.&nbsp;&nbsp;&nbsp; Verizon 2011 Investigative Response Caseload Review.&nbsp; www.verizonbusiness.com/resources/whitepaper/WP_verizon-2011-investigative-response-caseload-review_en_xg.pdf  
2.&nbsp;&nbsp;&nbsp; OWASP Top 10: https://www.owasp.org/index.php/Top_10_2010  
3.&nbsp;&nbsp;&nbsp; CWE Top 25: http://cwe.mitre.org/top25/archive/index.html  
4.&nbsp;&nbsp;&nbsp; Software Engineering Economics, Barry W. Boehm, Prentice-Hall, 1981, P. 40.  
5.&nbsp;&nbsp;&nbsp; The Building Security in Maturity Model:&nbsp; www.bsimm.com  
&nbsp;  ]]></description><pubDate>Mon, 26 Mar 2012 16:29:09 +0000</pubDate><link>http://www.securedigitalsolutions.com/news/application-security/importance-of-application-security/</link><guid>http://www.securedigitalsolutions.com/news/application-security/importance-of-application-security/</guid></item><item><title><![CDATA[Privacy Parking Tickets &amp; Technology]]></title><description><![CDATA[  Parking Tickets, Technology and the Driver Privacy Protection Act, 18 U.S.C. &sect;2721 et seq. (&ldquo;DPPA&rdquo;)  
  
If you have recently received a parking ticket, the kind where a peace  officer, or other public safety official, electronically looks up your  vehicle registration, pulls your driver&rsquo;s license information, combines  the two and then prints out all of the results neatly on a piece of  paper, places it, unprotected on your windshield and then leaves.  From a  privacy and security perspective this seems problematic, but may be a  good example of technology outpacing standards, the &quot;what can we do?,&quot;  outpacing the &quot;how should we do it right?&quot;  It may also likely be a  violation of DPPA, and, as least the goals promulgated when Congress  passed it.  
  
Not only does the parking ticket writing official query protected  personal information (presumably wirelessly), information which is  typically not releasable without explicit consent, but, then, they take  the information, print it on a piece of thermal paper, and then place it  on the windshield of your car for anyone in the public realm to see.    Think of it as a calling card with all your personal information  available for anyone with a curious mind.  
  
Ask yourself if you would mind if the below information was queried,  printed out and left at a coffee shop unprotected and open for anyone to  see:  
  
Complete drivers license number, full name (first name, middle name,  last name), home address, date of birth, height, weight, eye color,  gender, and your vehicle type, vehicle make, model, color and license  plate information.  
  
This type of thing is happening every day, and is likely the result of  the fast pace of technology offerings and its adoptions not being  properly used and/or configured for the best and most reasonable  information.  From a security perspective we would ask, inter alia, if  the request is made securely, what type of encryption is being used, are  the users of the machines tracked by their individual ID or is it a  generic ID used by many, is each query tracked.  Also, how are we to  know if our information was reviewed or not when it is left on a public  street?  Finally, we would ask, is there a way to print off less  information and still meet the need of the parking ticket intent?  
  
The Driver Privacy Protection Act, 18 U.S.C. &sect;2721 et seq. (&ldquo;DPPA&rdquo;) of  1993, upheld by the U.S. Supreme Court, and which appears to be even  more relevant today given the rise of identity theft etc.., is supposed  to  protect the information identified above from being publicly  available.  
  
The lesson for companies is this, the next time you or your company is  presented with great new uses of technology and information mining,  database access etc..., a key first question must be, okay great, &quot;how  can we do this to help our business, and not cause our business undue  problems with handling the data, and privacy or security or other  compliance laws as they relate.&quot;  
  
  
Joshua W. Carlson, Esq.  
  
Mr. Carlson is a data security and data privacy attorney and advises  companies on security, privacy and compliance in areas such as SOX,  GLBA, FISMA, HIPAA, HITECH, PCI-DSS and other areas.  ]]></description><pubDate>Tue, 24 Jan 2012 14:40:08 +0000</pubDate><link>http://www.securedigitalsolutions.com/news/more/privacy-parking-tickets-technology/</link><guid>http://www.securedigitalsolutions.com/news/more/privacy-parking-tickets-technology/</guid></item><item><title><![CDATA[Health Care Privacy Panel Addresses Information Assurance]]></title><description><![CDATA[    
  
    
  The First Annual Health Privacy Summit will take place on November 30, 2011 and is hosted by Medtronic at their Minneapolis headquarters. Chad Boeckmann, President of Secure Digital Solutions will host a special panel discussion addressing Protected Health Information (PHI) Incident Management with Business Associate Agreements. Mr. Boeckmann will facilitate the discussion with an organization responsible for vendor assurance.  
    &nbsp;    
  The panel will address business cases in which the Business Associate (BA) is not well informed or equipped to detect data breach incidents, is reluctant to harm the relationship, or conducts a disagreeable risk assessment. The discussion will seek to identify a collaborative reporting model that yields positive results.  
  &nbsp;  
  According to a report by Ponemon Institute titled &ldquo;True Cost of Compliance&rdquo; the health care industry loses an average of 43,869 records over a 12 month period. Comparing health care to other industries such as the financial industry at an average 21,776 records lost or stolen and technology at 71,737 records lost or stolen, health care industry appears to be average in terms of records lost or stolen in a 12 month period.  
  &nbsp;  
  &ldquo;Over ten percent of data breaches reported in the past five years have involved a health care service provider. Under HITECH regulations, business associates now must comply with the HIPAA Security Rule and report these incidents to their covered entities. But are they doing this? We need to create better processes to manage and report incidents,&rdquo; says Mr. Boeckmann.  
    &nbsp;    
  Secure Digital Solutions is a Minnesota-based information security and compliance management firm. With a focus on building efficiencies through expert knowledge, SDS delivers information security, privacy and compliance management services.  ]]></description><pubDate>Wed, 23 Nov 2011 14:01:05 +0000</pubDate><link>http://www.securedigitalsolutions.com/news/current-sds-news/health-care-privacy-panel-addresses-information-assurance/</link><guid>http://www.securedigitalsolutions.com/news/current-sds-news/health-care-privacy-panel-addresses-information-assurance/</guid></item></channel></rss>
