Editor's note

analysis that should not be made by the IT area alone,
where all organization’s areas should be necessarily
involved. These kinds of analyses typically require
of an external vendor’s assistance with a team of
experts who contribute with their skills, experience and
qualified human resources to accelerate information
gathering and classification.
I believe every organization should implement this kind
of analysis, and at least should update them on a yearly
basis. This is something stated by several international
standards for many years now (ISO 17779, ISO 27001,
BS 7799) as well as for the methodologies that support
this task (MAGERIT, COBIT).
Lack of analyses to assess an organization’s assets
and exposure risks has several impacts on IT and
Information Security strategic planning, though it hits as
well everyday matters, i.e. investment rationale!
Ghosts do Exist
I have tried to reinforce the secret characteristic of APT
attacks. This is something that should make us think
that chances of having our organization’s components
infected are very high (or are on their way to being
infected).
In fact, many experts go a bit further and propose
working based on a specific assumption; that their
organization has already been infected. So they
suggest working as from there. I must confess that I
agree with this approach!
Assuming that company has been infected by some
kind of silent threat does not mean to check that you
have the latest antivirus version in place or review
the list of open ports at the firewall; this is an indepth
insight and self-awareness process where all
technological aspects, processes and human resources
of the organization should be involved.
Controlling Is Not The Same Than Prohibiting
Many organizations have decided to limit (or directly
prohibit) access to social networks, messaging, and a
growing number of websites and applications to their
employees; in most cases this is the plain result of
categorizing these sites as dangerous, and in the best
case scenario reveals a deep unawareness of how
social networks and individuals work.
It’s been widely proven that any ban triggers a
countermeasure; if users want to access a forbidden
site they will certainly find their way to do it, and most
likely while trying to do so new problems will arise.
Some organizations, further to a risk analysis make
a quantitative decision to prohibit one or several
applications based on a tangible business risk. Well,
those organizations are in the right pathway; however
starterkit 02/2011(2)
they represent a minimal amount out of the aggregate;
and those who have really made it usually opt to forbid
the least possible number of sites.
Before prohibiting, organizations should first evaluate
what the benefits are of controlling use of these
potentially hazardous applications; social networks are
growing sources for revenue generation, in addition to
relatively low-cost and widespread promotion sources!
Many companies have people devoted to managing
promotion and sales channels in social networks.
If companies are going to increasingly use this kind
of communications channels as an alternative to the
traditional ones, maybe the wisest thing to do would be
recognizing those potential benefits and opportunities
of encouraging a controlled use to minimize risks, rather
than trying to prohibit something that sooner or later, in
one way or another we will have to allow, without the
skill and experience we would have gained if we had
cleared it from the very beginning.
On the other hand, the fact of prohibiting something
makes us feel we don’t have to worry for that anymore,
something that may turn into a double-edged sword!
Although Devices Are Not Company-owned, They
Still May Have Company’s Information
Some years ago it was very easy to draw an imaginary line
between the organization and the outer world (perimeter),
and focus our protection efforts in safeguarding the
traffic through this line. The regulating principle for this
approach was that everything inside the line belonged
to the company and therefore had to be protected, while
everything on the other side of the line belonged to the
outer world and it was the source of any threat.
Even though we should have quit that myth several
years ago due to some statistics showing that above
70% of attacks perpetrated against an organization
had their source on the intranet (i.e. the inner side of
the perimeter); over the last years we have seen that
line blur at a high-speed pace; first due to timework
expansion, followed by Business to Business interconnections;
and more recently the Coup de grậce
(finishing blow) fostered by the increasing adoption of
Cloud Computing.
Well then, in addition to everything known and
mentioned in this paper, a new kind of threat is knocking
on our doors; and we’d better take it into account; let’s
welcome Smartphones, PDAs, tablets and alike!
These devices, that in most cases are not property of
the organization, usually have access to email and other
systems, and possess organization’s critical information
that not only are outside organization boundaries, but
travelling directly who knows where, without any kind of
security control whatsoever.
Page 33 http://pentestmag.com