Today begins an epic journey. From Austin to Delhi, Delhi to Jaiselmer, Jaiselmer to the rest of the Indian sub continent and Sri Lanka beyond. My climbing training (thank you Allen) tells me I’ve doubtlessly over packed. I’m in less that 40 ltrs in size and at less than 20 lbs in weight. We shall see. I am traveling with a micro yoga mat and the self-promise that I’ll practice every morning in an attempt to save my back from Rickshaw L4/L5 Armageddon 🙂
Our book on Identity Attack vectors is finally in print at Apress and available from Amazon here. It was fun writing this with Morey – his third book in a series. I’m glad he asked me to join him on the book, it turned out to be a really fun project and overall experience. If you know Morey, he’s a pleasure to work with and super smart guy, so I had it easy!
The book covers where and how Identity management technology (and more specifically Identity Governance and Privileged Account Management) are an attack point AND how this key security technology can be used as a significant point in prevention, detection and mitigation of attack. Chapter 7 covers a pretty decent breakdown on the Identity Governance process. It covers what IGA is and how best to approach it – soup to nuts.
We’re doing a book release webinar on February 4th and a book signing event during RSA on Thursday 27th at the Thirsty Bear at noon in San Fransisco. I’ll re-post a link for the signing event as soon as I have it.
Imagine yourself and 4 friends in two single donkey powered rolling tin cans, desperately trying to traverse India…
Well, I’ve committed to help drive two auto rickshaws across the Indian sub-continent from Jaisalmer in the far north to Kochi is the far south. This unsupported run of over 2,600 kms must be completed within 14 days. There is no set route, no back-up and no way of knowing if we’re going to make it. The only certainty is we will get lost, we will get stuck and we probably will break down!
At the time, this seemed like a sensible way to raise funds and awareness for Athletics for Kids and Cool Earth – now I’m not so sure ☺ But thanks to SailPoint and our other corporate sponsors, we are well on our way to meeting our fund-raising goals, so we’re going for it! You can help, by contributing to the cause or by simply following along here or on the SailPoint blog page – I’ll be sending in regular updates as we traverse the country.
There’s a PDF flyer with the proposed journey and information on our selected benefiting charities available here and (giving links below). If you’re based at the SailPoint Pune office, we’re planning to stop by – hopefully Wednesday the 8th of January – fingers crossed we make it on time and stay on three (yes that’s three) wheels!
Cool Earth – https://www.coolearth.org/campaigns/31235/rickshaw-run-india-january-2020/
Athletics for Kids: https://www.canadahelps.org/en/charities/athletics-for-kids-financial-assistance-bc-society/p2p/rickshaw-run/
In the midst of the holiday season and as we get ever-closer to the new year (and 2015 tax filing), it’s important to remind ourselves how to stay safe online. Just because it’s a time of giving (and hopefully receiving) fun new electronics, toys and other goodies, it doesn’t mean that those who would steal your personal information and do you harm are taking time off. Luckily, there are some easy ways to help keep your information safe and guard yourself against potential attacks.
Electronic Gifts
With all the deals going on and the potential for presents to be shiny and electronic in nature, a good number of us will probably receive a new phone, tablet, or other piece of tech in the next few weeks. But before you simply throw away or sell any of your old devices, keep in mind that most of us practically live on our devices and a lot of information naturally collects there. Pictures, GPS data, calendar events, emails, contacts… the list goes on and on. Unfortunately, though your latest cooking achievement may not be of much import to hackers, there is a real and growing market for buying used devices solely for harvesting personal information.
Whenever selling or simply detaching yourself from an electronic device, it’s incredibly important for you to perform a full factory reset. While the process varies depending on model and manufacturer, the general idea is to format the phone and erase any possibility of the retrieval of data. If it’s an old device and not worth much money, it’s much safer to simply submerge it in some water or treat it like the printer from Office Space.
Now, when it comes to setting up your shiny new device, there are a couple things to keep in mind. Use disk or device encryption whenever possible and choose a good password. This means straying from your pets and relatives’ names, birthdays, or anything else that could be easily guessed after reviewing your social profiles.
Internet Access while Traveling
During the holiday season, a good number of us will find ourselves working from home or from remote locations. While the locale may be a nice change of pace, you must consider the security of the networks to which you connect. One easy way to secure your connection to the world-at-large is through a VPN. Some companies provide this to their employees, but you can also find several commercial and free VPN services (just be sure it’s a reputable company and if you really care about data privacy check their logging policy first!). If a VPN isn’t available to you, a good alternative is to simply use your phone’s data connection. Many plans nowadays allow tethering your phone to your other devices to provide a mobile hotspot, and taking advantage of this can provide you with one of the most secure connection mechanisms available. But of course, check your rates and plan restrictions first.
On a more general note, it’s always a good idea turn off your Wi-Fi and Bluetooth when not in use. This will not only save some battery life, but it will also prevent your phone or laptop from inadvertently connecting to unknown Wi-Fi hotspots. This is particularly important with a modern smartphone: most people walk around broadcasting their current location and arbitrarily connecting to networks everywhere they go. Unfortunately, the bad guys now put out their own public Wi-Fi hotspots specifically to catch the unaware. If your device supports it, turn off the “automatically connect to networks” option, and always make your connections to a Wi-Fi hotspot a considered and deliberate action.
Tax Season
Last May, the IRS suffered a large-scale data breach, and in the resulting forensics analysis it was found that there were not only direct attacks on the IRS systems themselves but also social engineering attacks on individual taxpayers. This means that while you should always be on the lookout for unsolicited calls from anyone asking for personal information, you need to be especially cautious during the upcoming tax season. These calls may ask to “confirm” personal info such as social security numbers and addresses, and usually will end up asking for tax filing fees to be paid via credit or debit card.
Also be on the lookout for phishing emails posed as e-file confirmations. Just like you would under normal circumstances, don’t respond to links in these emails or call the phone numbers provided. Contact the IRS using their publicly published contact methods if you have any concerns. If you’ve ever been the victim of identity theft or if your personal info has been leaked in a data breach, you may also be at increased risk of having a false tax return filed in your name. If your information has been exposed (you can check using haveibeenpwned.com), keep an eye out for any suspicious activity in this area.
Hopefully these tips can help to make sure your holiday season goes off without a hitch… at least where your online security is concerned.
The National Institute of Standards and Technology (NIST) is once again considering the death and eradication of the traditional password. NIST’s senior standards and technology advisor Paul Grassi recently stated that the agency is debating updating the password usage requirements set forth in NIST guide 800-63 to recommend stopping the use of passwords in both government and private enterprise systems.
Grassi notes that a driving factor for the shift is that passwords are becoming increasingly vulnerable to attack. Poor end-user password practices and weak administrative system policies continue to make password-authenticated systems the subject of brute-force attacks.
But the question remains, is a world without passwords truly an achievable goal?
The simple answer – in a perfect world – is yes. What would be ideal is for every app, website and SaaS vendor to subscribe to a common standard of strong authentication and/or federation which would eventually make passwords obsolete.
However, given the current enterprise landscape (even into the near future), I’d caution executives not to hold their breath. The world we live in is imperfect, and legacy vendors are slow (if ever) to adopt standards around authentication. In addition, newer applications, including SaaS and mobile, are more focused on delivering functionality than on delivering secure solutions.
Another challenge is the lack of a common, non-password-based standard. It’s one thing to support initiatives to make passwords a thing of the past, but it would be wise to also pragmatically recognize that for the vast majority of enterprise systems, passwords remain a reality with which we must cope. With the presence of this current paradigm, enhanced password management and governance are of paramount importance.
We continue to hear that password management is a pain point for most organizations and ultimately, their end users. With the right tools in place, organizations can enforce enhanced practices including: robust password policies like password strength, complexity and expiration, and easy to use end-user password management tools. With these capabilities in place, organizations can ensure that all users have more secure passwords across all applications – reducing the risk of a data breach
On December 3rd the public beta starts for Let’s Encrypt. When it does, I’ll be the first on the list for a free digital certificate and (hopefully) this site will become HTTPS only. The EFF kicked off this effort last year, and the fruit is ready to eat for the December holidays.
Anyone that’s administered a web domain with TLS knows that the process of obtaining a digital certificate to HTTPS secure your site is 100% manual and somewhat costly. That’s basically the reason why blogs and public content like this site is not encrypted . Let’s Encrypt provides a simple protocol that automates most if not all of the process. It lets you obtain a browser-trusted certificate, sets it up on your web server, keeps track of when it’s going to expire, and automatically renews it for you. It also handles revocation should that ever becomes necessary.
BUT the best bit of all is that the certificates it provides are 100% FREE! So no reason not to encrypt EVERYTHING. It fully supports certificate transparency and so provides a truly enterprise-class HTTPS solution even for the web hobbyist like me 🙂
I recently recorded a webinar on putting IAM at the center of security. It covers how the seven core tenets of successful IAM help create a “governance-based approach to IAM and how this helps. The recording is available on youtube here.
It’s a long 50 minutes with the Q&A on the end, AND it’s a pretty technical look at what makes up a next generation IAM solution, BUT if you’re into what we all do, I think it’s well worth a listen…
While speaking at an industry event in DC last month I made a comment that “even my mother now understood the concepts of password entropy” because I had made the point of calling her in England to explain them. In recalling that conversation with my mother, I wanted to share the three things I told her she needed to do to securely use passwords on the internet.
My mum is a spritely 70 year old who lives in the UK. We stay in very good touch via Skype and email. She loves her iPad for the web and chatting to me, and especially likes the fact that she download and store endless amounts of Ukulele sheet music. Yes, my mother is one of “those”. The Ukulele Reformers. They’re like a cult; one that smiles a lot and puts on a gig at the drop of a hat whenever they can all stand together.
So our conversation that day had been about why she needed to be more diligent with passwords on the internet. To make things easier to remember, I gave her three basic best practices that would help keep her passwords safe. I wanted to share that advice here.
My first was that “long is strong”
I explained that, unfortunately, the longer and more complex the password the safer it will be. Twelve characters should be thought of as an absolute minimum. Avoid using dictionary words unless as part of a complex passphrase, and add special and mixed case characters wherever you can. She immediately said “so how do I remember my password then”? I explained a couple of simple mental models that can help, like using the first characters of a memorable phrase. The example I used was “Mary had a little lamb its fleece was white as snow 987654” would then become a password of “MhallifwwaS98754”. I explained how this created what we called “password entropy”, basically complexity, that made it hard for the bad guys to guess her password.
I also told her that writing down long passwords was better than using short ones just so she could remember them. Ironically if you’ve been in the security space for a while, you’ll recall how “the yellow password sticky note” was the cartoon joke of the late 90’s! Odd how things change but stay the same isn’t it?
My second was to “be unique”
To make things harder for the bad guys, the best thing she could do was to use unique passwords at every site. Again her reply was “so how do I remember them all?”. Again I said writing them down and keeping that list safe was ok, but explained that putting sites into mental groups (by value or name or something else) she could have fewer passwords and share them that way. I also explained that she could easily add something about the individual site to the middle or end of her “high entropy password” to create something unique for each site. So, for instance, her Google password would then become MhalGOOGLEifwwaS98754.
Fortunately there are, of course, good commercial tools and solutions that make this overall process much easier. As for me, I am lucky enough to have SailPoint’s IdentityNow solution to help capture, store and replay my complex passwords. Fortunately her US based tech support team (that would be me, by the way), was subsequently able to set her up with a consumer password management solution (she’s now a Lastpass user) so she had that benefit too.
My third was to “watch the road”
Basically this was to always be aware of where she was on the internet and to take specific note of anything and anybody that asked her to “login” or provide any of her “secrets” and personal information. Again her US tech support associate did have to show her how to setup strong, multi-factor authentication where it was available on her favorite sites. She does now understand the importance of HTTPS and what to do if there’s not a “little lock in the URL bar” – so she’s in much better shape than most.
On a slightly broader security note…
I should also point out that her US based tech support team, (again that would be me), had previously talked her through installing a browser-based web filter / adblocker (I’m a big fan of UBlock Origin) – so she had some degree of content protection. Plus we had, awhile back, had our “the birds and the bees of the internet” conversation – I distinctly remember telling her to “trust no one”. I recall she was a little disappointed by that statement. She said she was surprised that “you computer types hadn’t worked this security thing out yet!”. About all I could say was “Yes, I wish that too…”. She was a little annoyed, but not for long. After all it was already time to hang up Skype and take her iPad song-book and Ukulele to a local gig.
After breaking a finger back in the fall, I’m back on the wall and climbing again! I’ve signed back up for the Main Event membership and plan to get up there a couple of evenings a week.
Turns out that the increased girth of my repaired knuckle works rather well in a finger crack, a bit like a small Wild Country rock 🙂