Eitex: Protecting Your Data - Laptop Encryption

At Eitex we are being asked more and more about how busy professionals can protect the business critical and often sensitive information they carry around on laptop and netbook computers.

The simple solution to this problem is to encrypt the laptop disk drive so that only the owner of the computer can access the data.

Most computers have a password which is used to prevent access to the software, applications and data in a casual fashion.  Passwords, and particularly strong passwords* are a vital component in preventing unauthorised access to information and applications.  However, they only protect systems that remain in the physical possession of the owner.

Once physical possession is compromised, as in the case of a lost or stolen computer, then there are ways of bypassing the logical access controls imposed by usernames and passwords.  Such bypass techniques can be as simple as using a brute-force password cracking tool or just simply removing the hard disk drive from the machine and plugging it in to another computer.

This can be a particular problem in the case of mobile computers, where the opportunity for loss or theft is far greater than machines protected by a secure physical environment.

Encryption of the hard drive can protect against the dangers highlighted above.  It means that, in effect, if the computer is lost or stolen, the data cannot be accessed by the new owner without the password or pass phrase used to perform the encryption.  In addition, where whole disk encryption is utilised, the system cannot even be started unless it is completely reinstalled - overwriting any data on the disk drive.

So if you want to protect your mobile computers, or even your office based ones should you feel the need, then contact Eitex and we will be more than happy to go through your requirements and help you decide on the best solution for your business.


* Strong Passwords should be at least 12 characters long and consist of upper- and lower-case letters, numbers and special characters such as !'#@"£$ etc.  They should not be made up of dates, names or dictionary words - even obscure ones!

Secure Thinking Opinion: Cyber Crime Costs UK £27bn a Year

News out today that cyber crime costs the UK economy £27bn a year makes
for worrying reading.
Most of the "costs" to the UK economy fall into 2 areas - £9.2bn in
intellectual property theft and £7.6bn in industrial espionage.
Both of these categories are areas where losses would occur with or
without the internet, and indeed the internet may have simply made these
types of activity easier to perpetrate. So blaming "cyber crime" does
nothing to address the issues because it's very likely that technical
solutions will do little to reduce the activity.
Another interesting statistic is that the government is looking to spend
£650m over the next four years to tackle the problem. That equates to
less than £163m a year. So in order to solve a problem that costs the
country one-sixth of its national debt the government is coughing up a
bit of loose change?
If the problem is really as significant as it is alleged, then a
concerted effort must be made to tackle it. Looking at the problem from
both the bottom up and the top down.
How do we do this?
Well, organisations need to build security into their very existence -
educate their staff, design their processes and procedures, their
systems and solutions with security at the very core of everything.
Develop and implement software and hardware, networks and infrastructure
that is secure at inception, not look at security as an afterthought, as
is generally the case now. And this needs to involve ALL organisations
of ALL size because the smaller businesses feed into the larger, and so-on.
This is where the government needs to provide guidance and direction.
Use some of the "loose change" to help fund initiatives which raise
awareness of security issues with people, organisations and businesses
at the bottom of the industrial, commercial and governmental food
chains. We need to educate people from the start, in schools, colleges
and universities, as well as in businesses on how to protect themselves,
their friends, colleagues and associates, their data and their privacy.
Let's make information and "cyber" security a topic for the national
syllabus in the same way that diet and exercise are today.
Improving the understanding of the threats, the risks and the defences
within the population at large will improve security. But this must be
done in a way that ensures the real buy-in and understanding of people.
While security is something done by "someone else" we will see an
increase in the figures released today, with little or no impact from
the government's initiatives.

Eitex: Accountancy Firm Case Study

We have a new client, let's call him John, who runs a small, local accountancy business.  John has become a client of Eitex since the following story occurred because he felt he needed a more reliable IT support solution, as you'll see.

John has a Windows 2008 server he uses for file and print services within his organisation.  The server provides all of the storage for his business documentation, client records, and key financial details of his 1200 accountancy business customers.  This information is critical to his business as an accountant.  The files stored on his server are particularly important in December and January, John's busiest time for completing quarterly VAT returns and personal tax returns for his clients.

However, on the 20th January this year, the RAID controller in John's server failed, causing a random write corruption of his data. 

John called his one-man-band IT support provider (let's call them OMB Inc for the sake of argument - no relation to any real company) to get the system fixed as soon as he realised he couldn't simply reboot the server to fix the problem.  Unfortunately he couldn't get hold of OMB Inc immediately, but as John knows they're usually very busy he left a voice mail.

By lunchtime the next day, John still hadn't heard back from OMB Inc so he called them again but still got diverted to voice mail.  Again John left a message, stressing the urgency as his clients would expect their tax returns to be completed on time otherwise John would be liable for the fines heading their way!

As it was now weekend John decided to leave the issue until Monday morning, but vowed to chase the it up 1st thing with OMB Inc to make sure he had the time to complete the work on behalf of his clients.

So at 9am on Monday morning, John called OMB Inc yet again to try to get his problem solved.  Again the call was answered by an electronic lady asking him to leave a message and to press 1 for more options.  Unfortunately, John knew that pressing 1 wouldn't get his system up and working so he called us here at Eitex.

Now at this point, we were coming in to a situation cold.  We knew very little about the set-up and configuration of John's systems and very little about the problem other than John's machine was down and wouldn't come back up in any useful way.

Our engineer arrived on-site about 11am and spent the 1st hour identifying the problem and attempting to fix it to no avail.  After this time, he realised we would need replacement parts so we ordered them through our approved partner program for urgent next-day delivery - John was happy to pay for this.

The next day, our engineer was waiting on the doorstep for both John and the parts.  Once everything had arrived, the parts were fitted, tested and the system was brought up.  At this point, the engineer along with John performed some integrity checks on the disks and filesystems and to their horror discovered a corruption of the data.

Obviously, having the system up and running was a major step forwards but without a good backup John was in a terrible pickle.

Luckily though, the tape backup solution John had been using proved, in this instance, good enough to recover the majority of his data.  The only actual loss were the updates and changes made on the day of the crash, which had to be made again.

Happily, through a combination of hard work and long hours John managed to complete all of his client's work before they were hit by late submission fines. And you'll also be pleased to hear everything is OK with the chap at OMB Inc - he was happily away on a 10 day skiing holiday in the French Alps at the time.  When he eventually called John on the 29th January he was politely informed that his services were no-longer required.

(This story is a work of fiction based on real events.  Names have been changed to protect the innocent.)

Secure Thinking Opinion: Hackers Infiltrate Oil and Gas Companies

News yesterday that hackers have been wandering round the networks of major oil and gas companies for years may come as a shock in some quarters.

But industrial and national espionage is huge business and the companies involved should have taken steps to prevent such attacks and should have systems in place to alert management far quicker.

The fact that they don't have adequate security controls, a programme of security penetration testing to measure the effectiveness of their controls and appropriate monitoring and alerting systems in place is a damning indictment of their management hierarchy.

Financial institutions implement such systems and testing as a matter of course. And while there's no guarantee that they will stop all such attacks having a defensive mentality improves the overall level of security.

The oil and gas industry is worth astronomical sums of money. This in itself makes the companies involved attractive targets for corporate and national espionage.

But surely, with the sums involved they could afford to invest in a proper programme of security penetration testing, invest in a "defence in depth" approach to their IT infrastructure, implement high quality alerting and monitoring systems and an effective management team?

The costs of not doing so for the organisations in question may be about to be highlighted.

Secure Thinking Opinion: Teachers to Search Pupil's Phones

I have just read an article on the BBC News website about proposed new powers for school head teachers which will allow them to search for mobile phones and even check the content of the devices.

As a parent I'm torn on this matter. I can see the logic and potential benefits of child protection and the prevention of bullying. But I can also see the issues around serious invasions of privacy, data protection and confidentiality.

Mobile phones these days are more than just telephones. They have the power to be used for a huge range of purposes including internet access, email, online shopping and banking, social networking, taking photos and videos as well as the more traditional phone and text uses.

In addition, there is the likelihood that future technology will take us down the route of contactless payments with mobile phones.

So the question is should teachers and school officials have the authority to search devices containing this kind of data? And what if the device is security protected or encrypted as Secure Thinking would recommend? Will schools be given RIPA like powers to force pupils to hand over password?

And then what of accusations aimed at teachers of breaches of privacy where they do access data on a phone? And where is the line drawn with access to social networks and other resources for which a phone can be used as access but isn't a actually "on" the phone?

When you really look into the implications I believe such legislation should be blocked in favour of a more common sense and pragmatic approach.  Perhaps a solution where phones are merely confiscated for the day if they are being used by pupils.

Secure Thinking When Online

If you run a small business or you manage the HR department of a large organisations you may well be aware of some of the issues surrounding staff use of social networking sites.

Social networking sites such as Facebook, professional networking sites like LinkedIn, and the various personal and professional blogging facilities, not to mention the micro-blogging sites like Twitter provide everyone with an opportunity to communicate with others with whom they have an affinity, voice their grievances and raise awareness of issues.

The problem for businesses and employers is when employees over-step the professional/social boundary.

If employees use social networking to make comments about the company, fellow employees, management or customers it can have a dire effect on business, perceptions and relationships both inside and external to the organisation.

Whilst many companies are aware of this and take some steps to mitigate the risk, it is often only done using a stick.  The general approach appears to be to discipline anyone who oversteps the mark - even when those marks aren't clearly defined.  This leads to further frustration and ultimately a breakdown in relations between employer and employee.

At Secure Thinking, we believe that this approach is wrong and have now decided to do something about it.  We are therefore offering a new awareness service - Secure Thinking When Online - where we will come on site at your company, or other location, and present to your staff about the risks of online behaviour, why the rules exist and how to protect themselves in their everyday internet based activities.