Hashing Out Your Agency’s Social Media Policy

Facebook, Twitter, Pinterest and YouTube.  These are a few of the many sites that employees are logging into every day, often causing anxiety among IT departments and management.

Market Connections, a market research firm focused on B2G, recently did …

View full post

Shooting phish in a barrel: Attacks grow among government agencies

Could it be as easy as shooting phish in a barrel? We’ve seen a number of threats against government agencies this past year, many of which have been targeted by organizations looking to prove a point. Hacktivists have shined a …

View full post

Department of Veterans Affairs Embraces Telehealth for Extended Care to Veterans

With 2012 being a pivotal election year, it seems no topic, political or not, is safe from a heated bi-partisan debate. One item not up for a debate however, has been an increased desire to make sure our men and …

View full post

Big Data, Little Data, Secure Data and Destruction

Data. Lots of it, and everywhere. From massive data warehouses to a plethora of flash media, we are surrounded by incredibly huge amounts of data thanks to the consistently decreasing costs of storage. Regardless if it’s the DoD or a …

View full post

The Army App Store: We Have an App for That

Bring your own device (BYOD) and mobility have taken on a new spin in the defense sector. Instead of trying to manage your employees’ mobile devices and all available applications, defense agencies like the U.S. Army have embraced the development …

View full post
Hashing Out Your Agency’s Social Media Policy Shooting phish in a barrel: Attacks grow among government agencies Department of Veterans Affairs Embraces Telehealth for Extended Care to Veterans Big Data, Little Data, Secure Data and Destruction The Army App Store: We Have an App for That

May
14

Hashing Out Your Agency’s Social Media Policy


by



Facebook, Twitter, Pinterest and YouTube.  These are a few of the many sites that employees are logging into every day, often causing anxiety among IT departments and management.

Market Connections, a market research firm focused on B2G, recently did a study that noted government workers primarily use Facebook, followed by YouTube and LinkedIn. About half of the respondents in the study said they have access to social networking sites at work but 12 percent were unsure if access was allowed.

Why the uncertainty? Most of the organizations we talk to are still determining their social media usage policies. The initial reaction to these sites is to shut them down and block all access from the network due to security, network bandwidth and productivity concerns. In fact, with Facebook being the most commonly used social network, it also has the most potential for productivity drain as Farmville and Mafia Wars are the most used applications on the popular site and the biggest driver for malicious code and malware.

But as we know, blocking access to these sites can impact morale—especially among the military where connections with friends and family is critical. Often, when a customer calls us in to discuss best practices, we remind them that security is not about saying no; it is about providing access safely.

Here are some best practices to consider that enable secure, effective social media access without affecting network performance:

  • Identify a WAN optimization solution that gives your IT department control over the percentage of bandwidth allocated to social applications. For example, 90% of bandwidth could be allocated for mission critical applications and 10% for social use to limit the constraints on the network
  • Enable next generation firewall and web content filtering solutions to prevent malicious code from running on a browser. Not only does this control nefarious activities but also allows network administrators to use granular controls and parameters around Internet usage. For example, administrators can ban the use of gambling, game applications, job searching, etc.
  • Educate the users. Many users view these social sites as safe and don’t realize that malicious code could be running in the background

There is no denying that social media networks and applications will continue to infiltrate agency environments. It is an easy way to communicate and share information. Agencies can embrace this movement by following best practices and ensuring that policies and best practices are in place.

 

 

 

Tags: , , , , , , , , , ,

Leave comment

May
08

Shooting phish in a barrel: Attacks grow among government agencies


by



Could it be as easy as shooting phish in a barrel? We’ve seen a number of threats against government agencies this past year, many of which have been targeted by organizations looking to prove a point. Hacktivists have shined a spotlight on agencies like the FBI, CIA, often taking control of the agency’s website.  Yet, according to the United States Computer Emergency Readiness Team (U.S. CERT), the most common threat against government agencies in 2011 came from phishing attacks.

The U.S. CERT’s mission is to improve the nation’s cybersecurity posture, coordinate cyber information sharing and proactively manage cyber risks to the nation while protecting the constitutional rights of Americans. The team collects security incident reports across federal and local agencies and correlates the data to report on risks. In the past year, the team reported that nearly half of all the incidents that have occurred used phishing techniques.

What is phishing and why is it so common among attackers?

Phishing is an attempt to lure an unsuspecting user to provide personal information by using social engineering techniques. Fraudulent emails often appear to be sent from a legitimate organization or known individual and attempt to entice users to click on a link that will take the user to an illegitimate website that often contains malicious malware. In most cases, the user is asked to provide personal information such as account usernames and passwords that can further expose them to future compromises.

Now more than ever, these techniques are easier to employ due to the rapid adoption of social media. An attacker can scan simply look up a Facebook account or Foursquare location and make references to a recent outing or vacation.

In fact, Government Computer News reported that a new phishing scam was launched targeting military personnel, retirees and civilian employees receiving disability compensation. This specific attack alludes to the potential of securing additional disability compensation in an effort to get recipients to give up their personal information.  The Defense Finance and Accounting Service has issued warnings and posted details to their site.

Here are a few additional recommendations we provide our customers to ensure that they address all components in the security ecosystem: people, process and technology:

  • Educate your employee base. Do not click links within emails. Even if the URL is reputable, it is best to type in the URL into the web page manually.
  • Create and implement security policies across your agency and ensure that these policies are monitored and enforced.
  • Update and monitor. Most agencies believe they are protected if they have antivirus protection, firewalls and intrusion detection / prevention systems in place. However, these technologies must be tuned, updated and monitored on an ongoing basis. Additionally, web and email content filtering systems are a must since 80% of threats today are still web-based. These filtering solutions will prevent malicious links from coming through the network.
  • Prepare for the worst – attacks are inevitable – so have an incident response plan in place.

Have other questions or concerns about protecting your agency from the latest phishing scams? Drop me a comment below.

 

 

Tags: , , , , , , , , , , , , ,

Leave comment

May
02

Department of Veterans Affairs Embraces Telehealth for Extended Care to Veterans


by



With 2012 being a pivotal election year, it seems no topic, political or not, is safe from a heated bi-partisan debate. One item not up for a debate however, has been an increased desire to make sure our men and women in uniform—past and present—are receiving the medical care they need and deserve.

We’re finally realizing that the traditional way of providing medical care to our veterans is not always the most effective way to serve them. In the past, medical providers have set up traditional brick-and-mortar sites with a “build it and they will come” mentality, expecting veterans to come to them. However, the reality is that veterans are often not able to reach the services they may need with ease.

In response, today’s collaboration solutions are enabling patients, doctors and medical facilities to provide care through emerging technologies such as video teleconferencing (VTC).

When Secretary Eric Shinseki began his tenure as head of Veterans Affairs (VA) in 2009, he embraced the use of technology to improve patient services and immediately outlined a plan to improve America’s care of its men and women in uniform. One of the most innovative ways the VA is fulfilling this mission is through the use of telemedicine.

The Veteran Health Administration’s (VHA) Office of Telehealth Services is using telehealth to improve access to care and, in turn, improve the health of veterans. By using telemedicine, the VA is able to ensure patients get the right care, in the right place, at the right time.

The VA is providing telemedicine solutions in three main ways. Real-Time Clinical Video Telehealth (CVT) allows patients and doctors to communicate remotely using solutions like video teleconferencing. Thanks to CVT, veterans are able to avoid traveling to large, centralized VA hospitals or medical centers that can be located several hundred or even thousands of miles away and still receive the same specialized care.

For other patients where traveling to the local outpatient clinic is not convenient or possible for them, they have access to Care Coordination/Home Telehealth (CCHT) solutions that provides monitoring solutions within their own home. This is especially ideal for older veterans who have more difficulty  traveling and need more frequent attention to their medical needs.

Not every veteran, however, is located hundreds of miles away from a facility or is unable to travel. At times, technology simply offers a more convenient alternative to routine or unnecessary tasks.

Store-and-forward telehealth is an innovative use of technology that involves collecting and storing clinical information, which is then forwarded to an alternate location for review by a medical professional. In essence, a patient is able to take a picture of a problem, like a rash, and send it to their doctor for diagnosis. This technology prevents multiple, routine visits to a facility while still providing monitored care to the veteran patient.

Through these innovative solutions, veterans won’t sacrifice the medical attention they deserve merely because they are not located in a specific geographical location. These men and women faithfully served us, and now, thanks to telemedicine, the VA is proudly serving them.

To learn more about how Iron Bow Technologies is supporting the Department of Veteran Affairs, view this video.

 

 

 

 

 

 

 

 

 

 

Tags: , , , , , , , , , , , , , , , , , , , ,

Leave comment

Apr
26

Big Data, Little Data, Secure Data and Destruction


by



Data. Lots of it, and everywhere. From massive data warehouses to a plethora of flash media, we are surrounded by incredibly huge amounts of data thanks to the consistently decreasing costs of storage. Regardless if it’s the DoD or a Fortune 100 entity, somewhere within their infrastructure, is a repository with petabytes, if not zetabytes, of data in some state of digital decay. Let’s not even begin discussing the amount of information held in various “public clouds.”

Within the information security domain, we’ve begun utilizing various business intelligence (BI) tools to visualize/analyze, and in general, begin dealing with the “Big Data” challenges that are currently facing our federal and corporate information security communities. While Big Data, Digital Decay and the hazards of data retention are interesting discussions, this post isn’t a piece on analytics. This is about the data destruction issues in the modern age of solid-state media. Furthermore, if you believe your organization doesn’t have solid state drives (SSDs) and flash media in production, you may consider speaking to your SAN admin or virtualization guru to confirm your assumptions.

As the resident security guy, lately I’ve been having a number of conversations with customers about data destruction. Before I go much further in depth, let me say that we primarily work with federal government customers and have deep ties to the usual suspects whom you might assume would have more than a passing interest in information security. Knowing this, we can also state with a certain amount of veracity, that many of our discussions have relevance to national security.

So let’s take a look at data destruction in the old days and today, and discuss some best practices and tips.

Data Destruction of Yesterday 

In the old days, data destruction was “easy.” I grew up during the days of boot disk destruction where we would create a DOS or *NIX boot disk, load the requisite kernel data destruction apps (such as DBAN), make certain the floppy had a bootable sector and off we went.

For magnetic media such as hard disks, the standards were consistent: overwrite the drive a number of times, execute the built-in secure erase command and destroy or degauss the drive.

Magnetic media has a particular method to the data destruction and what we as practitioners would do is use some disk scrubbing utility (DBAN, srm, shred, PGP) to wipe either the file or the entire disk via the Gutmann method, or something along the lines of the Airforce System Instruction 5020.

Below is a screen shot from the PGP 10.x client with file shredding capabilities on OSX.

 

 

 

There were a number of clear-cut options of how to execute a data destruction process:

A) Single file overwrite with an option to overwrite with random data 1-35 times

B) Whole disk overwrite with an option to overwrite with random data 1-35 times

To quote Gutmann’s original paper, “A good scrubbing with random data will do about as well as can be expected.”

Lastly, there was arguably at least one other effective method of data sanitization:

C) Degaussing via some specialized hardware

Degaussing requires the termination of the disk itself, which magnetically destroys the media, as well as the drive motor. How?  By rotating some multi-K gauss field co-planar to the chips and a multi-K gauss perpendicular alternating field. The point is, you put a hard drive in or on the device, it creates a magnetic field and ruins the media and the drive heads.

Data Destruction in the Present Day

Presently, we have a plethora of cheap, high-density disks that happily respond to the usual ATA and SCSI destruction commands.

We tend to use these plentiful disks as backend storage, and for any system that requires rapid response or quick boot times, we use SSDs or disks, which don’t require any moving mechanical components. And with that, the fun begins.

When presented with some data destruction questions from one of our more interesting clients, I was forced to dig into whitepaper land. Short of incinerating a USB memory stick, I had never attempted performing data destruction on solid-state media, and it is most certainly an animal of a different color.

Also worthy of note: All of the above data destruction ideas (Gutmann, AF, etc.) are irrelevant, as SSDs do not play by any of the old rules. Per the Wei whitepaper, the above methods of data destruction are either ineffectual, falsely effective (showing destruction successes with full simple recovery possible) or a waste of energy.

According to the whitepaper:

“None of these solutions are satisfactory: Our data shows that overwriting is ineffective and that the ‘erase procedures provided by the manufacturer’ may not work properly in all cases.”

So what does work? Scrubbing. For details on how SSDs read/write, please read the summary of University of California’s whitepaper here.

“Programming individual pages is possible, so an alternative is to re-program the page to turn all the remaining 1s into 0s.”

And what is the net effect of using an only marginally effective data destruction method on the SSDs? The eventual destruction of the disk OR a heavily increased latency of the read/writes—meaning, you ruin the disk.

“Overall, we conclude that the increased complexity of SSDs relative to hard drives requires that SSDs provide verifiable sanitization operations.”

For the layman, this translates to what exactly? Overwriting doesn’t work.

So based on this perspective, we have a few take-away points for your organization to keep in mind when considering data destruction:

  • Right now, there are few, if any, controller based integrated provisions for performing data destruction operations on SSDs
  • Traditional hard disk or file-based destructions do not work. Read the source document and make operational decisions based upon these findings
  • Do not consider decommissioning SSDs and releasing them into the public domain. If you can handle the degradation of speed, consider using FDE on all SSD endpoints, devices and drives

In summary, unless there is a large crucible with which you can melt your SSDs, we recommend reviewing and revising your organization’s data destruction policy with regard to SSDs.

 

 

 

 

 

Tags: , , , , , , , , , , , , , , ,

Leave comment

Apr
16

The Army App Store: We Have an App for That


by



Bring your own device (BYOD) and mobility have taken on a new spin in the defense sector. Instead of trying to manage your employees’ mobile devices and all available applications, defense agencies like the U.S. Army have embraced the development of their own mobile applications store. This is not meant to compete with Apple or Google Play; rather to streamline the use of apps in an efficient and secure manner.

The Connection Soldiers to Digital Applications initiative gives personnel access to tested and approved applications to be used Army-wide. Not only has the Army embraced mobile technology, but it also understands the benefits of giving the war fighter accessibility on the go through smart devices.

From developing new training approaches to learning anytime from anywhere to accessing critical information at a fraction of the cost of traditional methods, the Army’s new arsenal of apps is creating greater efficiencies across the organization.

We expect that other agencies will implement a similar model in developing customized apps for employee use. It gives the agency greater control over the information that users share. However, it also requires that agencies implement policies and best practices to ensure that personal smart devices with agency information on it are not at risk of being hacked. In addition, if a device is stolen or misplaced, sensitive information must be properly secured to ensure that the information cannot be accessed.

Many of our customers are starting to have conversations with us about this approach. As a result, we are constantly searching for new and more efficient ways to enable our customers to create their own App Stores. Many wonder if this approach is right for their organization. Before you go this route, here are a few things to consider:

Know your Audience

Understanding and knowing what your customer or end-user needs in terms of functionality is critical to rolling out any application. If the end-user is unhappy, or if it does not meet their requirements, then you could kiss that app goodbye. After an app gets a bad reputation, people won’t use it.

Application Size

If your app is too large in size (typically over 20mb) then you would most likely need a Wi-Fi connection to download and install. The larger the application is in size, the more limited you are with your potential download audience.

It’s About the Look and Feel

Remember when you were told that looks don’t count? When it comes to applications, the look and feel is critical to satisfying the end-user’s wants and needs. The app should have that “pop” and look visually satisfying to ensure that the end-user engages and uses it often. For example, a typical IOS app background should be 640px X 960px. You would think it would be smaller, but that is not the case.

Update, Update, Update

Understand that your app will require regular updates. Listen to your audience and the feedback they provide. By optimizing the application in real-time and making critical adjustments along the way to improve your app, will go a long way in terms of usability.

Test it

Especially when it comes to the defense community, it is critical to test often and ensure that information is up-to-date. When a warfighter needs to use information through an app, they need to know immediately if that information is old or out-dated.

Make it Easy

Where the agency decides to place the most critical controls or information is a big deal to the warfighter in the field. Humans naturally gravitate toward the top of any page or document to look for the most critical information or controls. The same holds true with an app. Make it easy for our troops out there to configure any settings for apps with the controls toward the top of the screen.

Have any other questions about best practices in developing apps for your agency?  Leave a comment below.

Tags: , , , , , , , , , , , ,

Leave comment

Apr
10

VDI: It’s all about the end-user experience!


by



When it comes to technology, we have all heard the phrase “it’s all about the end-user experience.” That experience has pushed the limits of technology. The perfect example of this was back in the 90’s and early 2000’s when the traditional personal computer was making tremendous strides not only in chipsets, motherboards, memory and drives, but with the implementation of graphic cards that grew by leaps and bounds. Gaming was in its height and it was all about the experience you would receive as an end-user while playing your favorite graphic intensive game or looking at your favorite 3D models.

In today’s high tech industry, we are constantly striving for the perfect gaming session or that perfect Google Earth session where we can see our house from “outer space.” This user experience is now demanded in the virtualized desktop environment. In the age of virtual desktops where the traditional PC at the work place is slowly disappearing, the end goal is to have that perfect end-user experience that we had in the previous two decades, but on a machine that doesn’t exist physically before our eyes.

Virtual desktops have grown tremendously over the years and continue to lead the way in the technical field not only on the commercial side but the government side as well. There are several developments that are contributing to this growth and ensuring continued expansion.

One such protocol that enables this perfect virtualized end-user experience is Teradici’sPCoIP that works with VMware View. PCoIP technology allows all enterprise desktops, from task workers to power users, to be centrally located and managed in the data center, while providing the remote user with an exceptional user experience. The PCoIP protocol compresses, encrypts and encodes the entire computing experience at the data center and transmits it, ‘pixels only’, across any standard IP network to stateless PCoIP zero clients. Your data never leaves the data center.

The PCoIP protocol is implemented in silicon for hardware accelerated performance, and in software in VMware View. It supports high resolution, full frame rate 3D graphics and HD media, multiple large displays, full USB peripheral connectivity and high definition audio, all connected over the corporate local area network (LAN) or wide area network (WAN).

When tuned correctly, PCoIP allows for an exceptional end-user experience thus pushing forward the virtualized desktop infrastructure (VDI) implementation through the company or government agency. Once end-users see that they can watch many different formats of video, browse 3D data and view precision graphics, there is no turning back.

VDI is here to stay and will improve as the technology gets better. As the end-user experience advances, we will see more demand for this new form of computing and employees will be screaming for more. So, sit back and enjoy the next wave of computing with a PC that does not exist right in front of you.

Tags: , , , , , , , , , ,

Leave comment

Apr
02

New Federal CTO to Harness “Raw Material” of Untapped Employees


by



The White House blog confirmed recently that President Obama has appointed Todd Park as the new federal Chief Technology Officer (CTO) after Aneesh Chopra stepped down.

Park spent the past three years as CTO for the U.S. Department of Health and Human Services (HHS) where, according to the White House blog, “he was a hugely energetic force for positive change.”  He is credited with a number of initiatives, perhaps the most innovative being the creation of HealthCare.gov, an easy-to-use tool created to provide consumers with a comprehensive inventory of the public and private health insurance plans available across the nation.

Technology enthusiasts got a preview of Park’s energy and creativity at the recent South by Southwest (SXSW) conference, where Park addressed attendees and outlined his vision for his new position. Park clearly recognizes an untapped resource of federal-minded entrepreneurs in the government and he believes these innovators merely need a leader to give them permission to put their ideas into action. His plans are to tap into this spirit and find the innovators that can drive change to better serve the American people — and he’ll do it “start-up style.”

Park knows a thing or two when it comes to startups. Prior to his time at HHS, Park co-founded athenahealth in 1997, a health information technology startup that eventually went public. He also served as a management consultant with Booz Allen Hamilton, focusing on health care strategy, technology and operations. Additionally, Park served in several volunteer positions including Senior Fellow at the Center for American Progress, and as senior health care advisor to Ashoka. At Ashoka, Park was instrumental in starting a venture to bring affordable telehealth, drugs, diagnostics and clean water to rural India.

Park made it clear at the recent SXSW conference that he plans to bring this expertise and practical knowledge of private sector best practices to apply to the federal government. According to Park, “Not only is it possible to do lean startup in federal government, but it’s the most effective way to drive change.”

 

 

Tags: , , , , , , , , , , , , ,

Leave comment

Mar
26

CRN 2012 Tech Elite 250


by



In today’s economic environment of budget deficits and cuts, there is an immediate need for efficiency, streamlining and value in the workplace. Federal agencies across the board are looking for ways to reduce costs and increase employee productivity, and government mandates are adding to the pressure that our customers are facing.

In light of these pressures, we have partnered with leading technology manufactures such as Cisco Systems®, Dell®, EMC®, HP, McAfee®, NetApp® and VMware® to provide solutions that enable government agencies achieve their goals. These partner relationships are key to our success, which is why we are honored to be recognized by CRN as one of the 2012 Tech Elite 250.

The CRN 2012 Tech Elite 250 list represents an elite group of IT Solution Providers that have made a significant investment in training and education to earn the most technical certifications in the areas of data centers and infrastructure.

In compiling the list, CRN editors worked with the UBM Channel research group and a team of outside experts to define the most customer-beneficial technical certifications in the IT channel. These technical certifications have enabled solution providers to deliver premiere products, service and support to their North American customers.

To be included on this list is an honor and we remain committed to working with our partners to deliver best-of-breed technology solutions.

 

 

 

Tags: , , , , , , , , , ,

Leave comment

Mar
21

RSA Conference 2012: Inside the Event


by



By Daniel Nowak, Lead Security Architect

I spent late last month in the San Francisco Bay area imbibing the energy of the original Sin city—the energy, the Golden Gate, the flavorful culture, the Blue Bottle Coffee.

Oh wait, that was a previous visit, or perhaps some other person. I, on the other hand, was spending my time basking in the overpowering fumes of a seemingly well-funded and a well-recovering information security market. The RSA Conference was the place to be for most information security professionals looking to network and learn about the latest and greatest in the security field. Most spent the earlier part of the week at BSidesSanFranciso before digging into the annual RSA conference at the Moscone Center in downtown San Fran.

What was interesting to me, was how this show, despite economic conditions, continues to draw not only the large players in this space, but the smaller vendors as well.

This year was no different. The traditional vendors put up their mega-floor-to-ceiling booths and made several announcements on partnerships, products and offerings.

 

But the incumbents, would not be outshined. Many announced their stealth plays including Crowdstrike, which was founded by Dmitri Alperovitch and George Kurtz formerly of McAfee. The company is approaching information security marketing with a focus on actionable intelligence technologies. ClickSecurity also showcased a new model for approaching big-data collection and analytics—which is rapidly being acknowledged as one of the core challenges within the modern infosec landscape.

Lastly, there was an interesting group of Chinese companies marketing all sorts of cyber solutions—but that isn’t really the most interesting part. They were handing out CD’s that contained software that allows you to connect to their “secure cloud systems.” I looked at mine, and left it in the wrapper….

But despite the announcements and the fanfare, the best part of RSA for me is the networking and conversations with peers. In sum, the general “street commotion” from this year was a different energy than the previous few. It reminded this audience that cyber-security is at the forefront of the mainstream media news outlets, and is one of the core topics raised in any national security discussion on Capitol Hill. The difference this year was the maturity of the industry and the realization that information security as a practice is finally coming of age.

RSA Conference 2012 is over, but if this event is a sign of the times, we are at the start of a new and very interesting intelligence-based age within our industry.

Tags: , , , , , , , , , , , ,

Leave comment

Mar
19

HIMSS 2012: GlobalMed Supports Department of Veteran Affairs Telemedicine Initiative


by



Last month at the annual HIMSS conference, we connected with some of our partners and discussed the latest telemedicine initiatives.  Our own Eric Silvernail discusses the Department of Veteran Affairs’ telemedicine program. We also stopped Rick Dinger, Eastern Regional Manager for GlobalMed, and asked him to share his insights on delivering telemedicine initiatives to the Department of Veteran Affairs.

HIMSS 2012: Iron Bow & GlobalMed from Iron Bow on Vimeo.

Tags: , , , , , , ,

1 comment