A few years ago, a company I worked for had to upgrade their MS Office version to a more recent version. They had to, because they wanted to move to a new Sharepoint vesion, so they could use Sharepoint as the new document management system. Of course, using Sharepoint as a central document management system only works if all employees learn how to use Office and Sharepoint in the manner that Microsoft designed it. Until today I never saw any company where Sharepoint was implemented in the right way. In many cases documents are stored just like documents are stored on a file server, in a hierarchical way. Resulting in the same mess that you find in any organisation that uses documents: lots of copies, versioning problems, corrupted files and, not in the least, compatibility problems, because MS Office is not capable of storing files in a transparant way. Update and you're doomed...
A long time ago I wrote a report for a company advising them to do away
with documents and move to a content management system based solution. Write and store your documents in a cms or (enterprise) wiki. I love wiki's. There is only one current version of any document, old versions are available always, with track changes, no compatibility problems, since all text is stored in the most simple way, using a simple markup language and, not in the least, there is are great full text search features. Try that on a file server or in Sharepoint...
Anyway, the company never followed my advise. They really wanted the Office lock-in, so that you could check the presence of people involved in the document creation process...
But now there's a new incentive to ditch documents. Cryptolocker.
Cryptolocker is malware, intended to extort people by means of encrypting documents on a computer. Or on a server. On Skydrive and perhaps an a Sharepoint server (MS claims that Office365 is not vulnerable). The criminals claim to decrypt the documents after payment of a large amount of money. There have been some reports of cryptolocker software malfunctioning, whose crypto functions can be bypassed, but in most cases an infection with cryptolocker is very bad news for a victim.
The only way not to fall prey to these criminals is by not having any documents on a pc or server, or on sharepoint. If you don't have documents, they cannot be locked. In order to do so, move to cms based text creation and storage, use a cms, use a wiki, use presi-like presentation solutions, use ethercalc instead of desktop software. And don't misuse Excel for data manipulation or statistical analysis, use databases and BI tools. Output: why print it? Use a live data viewer or pdf generators if you need a hardcopy.
And if you really want to use documents, move to platforms that are not vulnerable. Much cheaper than paying for ransomware.
dinsdag 24 maart 2015
vrijdag 20 maart 2015
AD is EOL
Recently I had this discussion, about managing identities in a
company and what strategy to follow towards future developments like
Attribute Based Access Control. A very interesting discussion,
because this company was quite big and employs several tens of
thousands of personnel. And only a few thousand of those have a
Windows account. These people need an account because they have an
email address and need access to folders and shares. The others don't
have a Windows account, because they don't use any information
systems.
During the discussion the IT manager of the company stated thet he wants every employee to get an Active Directory account, because he feels that in the near future everyone need to access some information resources on a Windows server or Sharepoint. Everyone needs an AD account (no, licensing costs is not yet a problem, as long as they don't use the account actively).
In my opinion this is not the right strategy. In the near future we don't access data on Windows of Sharepoint servers anymore. We will use web services on web servers that we access with a digital identity that can come from any (trusted) source. Active Directory will become Passive Directory.
It already happened: my company doesn't even have an AD anymore. I think it will be end-of-life before it's end-of-support...
Yes, I know, I must be wrong, everyone is expanding AD and so growing their legacy base. And we all move to Azure AD. But just think about this mind experiment...
AD is a silly tool: it's a user directory, a domain controller, an authentication service, an authorization server, a federation server. Too big too fail, but no focus.
During the discussion the IT manager of the company stated thet he wants every employee to get an Active Directory account, because he feels that in the near future everyone need to access some information resources on a Windows server or Sharepoint. Everyone needs an AD account (no, licensing costs is not yet a problem, as long as they don't use the account actively).
In my opinion this is not the right strategy. In the near future we don't access data on Windows of Sharepoint servers anymore. We will use web services on web servers that we access with a digital identity that can come from any (trusted) source. Active Directory will become Passive Directory.
It already happened: my company doesn't even have an AD anymore. I think it will be end-of-life before it's end-of-support...
Yes, I know, I must be wrong, everyone is expanding AD and so growing their legacy base. And we all move to Azure AD. But just think about this mind experiment...
woensdag 25 februari 2015
OpenBadge Based Access Control
A while ago I posted a few entries about using attributes instead of roles to grant access to resources. At the same time I wrote that the current way of providing attributes is limited. So far attributes are provided by identity providers, hence only parties that trust an identity provider know what attributes can be used and may decide to trust the attributes provided by the identity provider. But as I stated, there are many cases that you do not want to get an attribute from your identity provider. You may have passed an exam, received a compliment or endorsement, or you may be part of another community than the one you work for and the one who provides your (digital) identity. Your digital identity provider may not even know all these attributes. And rightly so, an identity provider needs to provide trustworthy (within the trust framework) identities.
So I came up with the idea to make it possible to receive and collect attributes, much in the same way that we are used to receive and collect badges for gaming, or scouting...?.
And I showed that such a mechanism is in use at this very moment, although not yet in the way that I want: Isaca provides digital badges to certified members. And you can collect these badges in a digital wallet, that you can also use to present youor badges.
It's a pity that there is no use other for these Isaca attributes yet. I would like to use my CISA and CISM badges to be elegible as a candidate for a security consultancy project with prospective customers. How easy it would be to just so show my Isaca badge, instead of writing a resume or pointing to my LinkedIn profile. If you need an IT Auditor, here's my Isaca CISA badge... Or if you need a CISM, just search LinkedIn for CISM badges...
Today I learned that there is a another organisation contemplating to provide badges. LibreOffice volunteers may get badges in the OpenBadge format, the same format that Isaca is using. This wil most certainly mean that we will see OpenBadge become a default adopted open standard.
We probably have to come up with use cases for access control based on OpenBadges. Currently these badges are just that, they just show that you are member of a community, but there are no permissions connected to badges. Yet...
So I came up with the idea to make it possible to receive and collect attributes, much in the same way that we are used to receive and collect badges for gaming, or scouting...?.
And I showed that such a mechanism is in use at this very moment, although not yet in the way that I want: Isaca provides digital badges to certified members. And you can collect these badges in a digital wallet, that you can also use to present youor badges.
It's a pity that there is no use other for these Isaca attributes yet. I would like to use my CISA and CISM badges to be elegible as a candidate for a security consultancy project with prospective customers. How easy it would be to just so show my Isaca badge, instead of writing a resume or pointing to my LinkedIn profile. If you need an IT Auditor, here's my Isaca CISA badge... Or if you need a CISM, just search LinkedIn for CISM badges...
Today I learned that there is a another organisation contemplating to provide badges. LibreOffice volunteers may get badges in the OpenBadge format, the same format that Isaca is using. This wil most certainly mean that we will see OpenBadge become a default adopted open standard.
We probably have to come up with use cases for access control based on OpenBadges. Currently these badges are just that, they just show that you are member of a community, but there are no permissions connected to badges. Yet...
donderdag 26 juni 2014
"Authentication versus authorization" - Axiomatics blog
woensdag 28 mei 2014
All your passwords are belong to criminals
Again a few issues with password being copied by criminals. This week alone saw mentions of ebay, avast (forums) and spotify. In all cases the managed passwords were said to be hashed, so criminals have to brute force the passwords. But that is just a matter of time. And since Moore's law extends to password crackers, chances are that the copied passwords will be guessed shortly.
What does this mean? The Avast case looks not very critical. As I wrote earlier, many people create account with little security, just for the purpose of connecting to services that are not very critical. But the ebay case is a severe incident.
ebay is not just any website, it's a site that allows you to make transactions and it keeps lots of files and records about you. It's like a digital identity and they know your behavior. And the criminals not only stole the password and userid, but other sensitive data as well.
Of course you should change your ebay password. But: since your ebay account is important for you, you may well use the same account information for other sites too.
If by any chance you use the same ebay password with any account that is connected to the same email address that you registered at ebay, you should change the password for those accounts too!
What does this mean? The Avast case looks not very critical. As I wrote earlier, many people create account with little security, just for the purpose of connecting to services that are not very critical. But the ebay case is a severe incident.
ebay is not just any website, it's a site that allows you to make transactions and it keeps lots of files and records about you. It's like a digital identity and they know your behavior. And the criminals not only stole the password and userid, but other sensitive data as well.
Of course you should change your ebay password. But: since your ebay account is important for you, you may well use the same account information for other sites too.
If by any chance you use the same ebay password with any account that is connected to the same email address that you registered at ebay, you should change the password for those accounts too!
maandag 12 mei 2014
Still running XP? Bad for you...
Last month I wrote that, despite all warnings about the imminent death of Windows XP, until May 13th Windows XP could still be used in a relatively secure way. In fact, the recent off-schedule security patch by Microsoft proved my point. But I also said that from that day on XP is doomed. If you still use an XP system, chances are that the system will be a victim of an attack.
On May 13th, Microsoft publishes some security patches that will not be published publicly for Windows XP systems. Only a few organization, who pay dearly for extended extended support, will enjoy the benefit of keeping their XP systems alive. But for the rest of us, XP will be at risk.
What happens every month: if Microsoft publishes a security patch, criminal minds reverse engineer a vulnerability based on the changes in the patch. They try to figure out ways to penetrate systems that are not (yet) patched. And in many cases within a few days the first exploits are around. Since all Windows generations from NT onwards are very alike, chances are that a vulnerability in a recent Windows version exists in Windows XP too. And if a system is not patched, such an exploit will be a zero-day exploit for ever.
Can you protect XP systems that are not enjoying extended extended support? No, not unless you never connect it to the outside world directly or indirectly. Even anti-malware software may not guard an XP system against exploits.
What should you do? Migrate, migrate, migrate, to whatever more recent operating system that you can think of. If you're in a company: get your management fired asap. They are the next vulnerability that will not be patched.
On May 13th, Microsoft publishes some security patches that will not be published publicly for Windows XP systems. Only a few organization, who pay dearly for extended extended support, will enjoy the benefit of keeping their XP systems alive. But for the rest of us, XP will be at risk.
What happens every month: if Microsoft publishes a security patch, criminal minds reverse engineer a vulnerability based on the changes in the patch. They try to figure out ways to penetrate systems that are not (yet) patched. And in many cases within a few days the first exploits are around. Since all Windows generations from NT onwards are very alike, chances are that a vulnerability in a recent Windows version exists in Windows XP too. And if a system is not patched, such an exploit will be a zero-day exploit for ever.
Can you protect XP systems that are not enjoying extended extended support? No, not unless you never connect it to the outside world directly or indirectly. Even anti-malware software may not guard an XP system against exploits.
What should you do? Migrate, migrate, migrate, to whatever more recent operating system that you can think of. If you're in a company: get your management fired asap. They are the next vulnerability that will not be patched.
zaterdag 10 mei 2014
Attribute management
In my previous post I said that I need a facility to manage attributes issued by third parties. I have plenty digital identities, but most of them can only be used for a specific purpose. A limited number can be used in a multi-purpose fashion.
There's DigiD, the Dutch digital identity that was provided to me by the Dutch government and that can be used in my relation with a number of national and local government transactions and for a few transactions beyond that, like for my health insurance business. But these services can use only one specific attribute of my DigiD identity, the 'BSN', a unique identifier, like the American SSN.
Another multi-purpose identity is my Twitter account. But it also only has some predefined attributes, but if a service provider needs extra attributes, he needs to capture those through other channels. But there are no attribute providers beside the identity providers we know and love...
But, a few weeks ago I received an invitation from ISACA to download digital Badges that can be used to indicate that I am a Certified Information Systems Auditor (CISA) and a Certified Information Security Manager (CISM). These badges can then be imported in an 'Acclaim' account, that I can use to present my badges to others. And ISACA mentioned that presenting these badges in my LinkedIn profile is a preferred way to show my certifications.
How about that? ISACA issues a badge that proves my qualification. It is an attribute of my profile, it belongs to me. Not to one of my identities, but it is an attribute of me as a professional. And ISACA is qualified to issue these attributes, ISACA created these attributes, ISACA is the owner of the CISA and CISM titles.
ISACA issues badges in the form of an Open Badge, an open standard, created by Mozilla. And Mozilla created it's own backpack facility in the Mozilla Persona digital identity. The backpack can be seen as a wallet that contains the badges. Acclaim is another form of a digital badge wallet. Here is the acclaim page with my ISACA badges.
I really liked this idea, so I created my own badge issuing process. As you may recall I started the #ditchcyber campaign and this campaign is supported by the @CyberXpert account. I decided to offer CyberXpert badges to followers of this Twitter account. Any follower who uses the RCX or CCX title can get a digital badge and import that badge in a Persona Backpack. Here's my backpack, showing a CyberXpert badge.
Next thing we need to find out is if an Open Badge attribute can be collected by a digital identity and combined to a SAML message.
There's DigiD, the Dutch digital identity that was provided to me by the Dutch government and that can be used in my relation with a number of national and local government transactions and for a few transactions beyond that, like for my health insurance business. But these services can use only one specific attribute of my DigiD identity, the 'BSN', a unique identifier, like the American SSN.
Another multi-purpose identity is my Twitter account. But it also only has some predefined attributes, but if a service provider needs extra attributes, he needs to capture those through other channels. But there are no attribute providers beside the identity providers we know and love...
But, a few weeks ago I received an invitation from ISACA to download digital Badges that can be used to indicate that I am a Certified Information Systems Auditor (CISA) and a Certified Information Security Manager (CISM). These badges can then be imported in an 'Acclaim' account, that I can use to present my badges to others. And ISACA mentioned that presenting these badges in my LinkedIn profile is a preferred way to show my certifications.
How about that? ISACA issues a badge that proves my qualification. It is an attribute of my profile, it belongs to me. Not to one of my identities, but it is an attribute of me as a professional. And ISACA is qualified to issue these attributes, ISACA created these attributes, ISACA is the owner of the CISA and CISM titles.
ISACA issues badges in the form of an Open Badge, an open standard, created by Mozilla. And Mozilla created it's own backpack facility in the Mozilla Persona digital identity. The backpack can be seen as a wallet that contains the badges. Acclaim is another form of a digital badge wallet. Here is the acclaim page with my ISACA badges.
I really liked this idea, so I created my own badge issuing process. As you may recall I started the #ditchcyber campaign and this campaign is supported by the @CyberXpert account. I decided to offer CyberXpert badges to followers of this Twitter account. Any follower who uses the RCX or CCX title can get a digital badge and import that badge in a Persona Backpack. Here's my backpack, showing a CyberXpert badge.
Next thing we need to find out is if an Open Badge attribute can be collected by a digital identity and combined to a SAML message.
Abonneren op:
Posts (Atom)