EU General Data Protection Regulation (GDPR)

Before I start on this blog piece, I have to make it clear that I'm not a lawyer and I have no legal training.  The blog piece below does not constitute as law, but these are areas I have researched and may make some assumptions along the way, especially with the uncertainty in the UK and it's relationship with the EU.

Data Protection Directive

The EU Commision were looking at replacing the Data Protection Directive.  So we are clear, an EU directive is a goal that the EU must achieve, but it's up to the individual countries to devise their own laws on how to reach the goal.

In January 2016, a draft form of the EU General Data Protection Regulation was released.  The difference between a directive and a regulation, is that an EU regulation is a binding act, that is applied in its entirety across the EU.

Why GDPR important?

GDPR is there to strengthen and unify data protection for individuals in the EU.  It addresses the export of personal data outside of the EU.

When will GDPR happen?

The regulation has now been released and enters into force on 25th May 2018

What is the impact of GDPR?

• A Data Protection Officer is needed if an organisation processes 5000+ EU data subjects; or employs more 250+ employees
• Mandatory disclosure of incidents within 72 hours to the national authority
• Maximum fines of up to €20 million or 4% of worldwide revenue
• “Right to be forgotten”: The data subject will have the right to retract consent, request data erasure or portability
• EU Referendum has no impact to organisations – If you hold personal data on an EU citizen, GDPR still applies
• Live May 2018 – Two budget cycles left

The Data Protection Officer

If the core activities of an organisation involves “systematic monitoring of data subjects on a larger scale”, or large scale processing of "special categories", such as racial/ethnic origin, political opinions, religious/philosophical beliefs, biometric data, heath/sex life or sexual orientation, then a Data Protection Officer is required.

The function is also there to advise on, and the monitoring of GDPR compliance, as well as representing the organisation when contacting supervising authorities.

Disclosure and Notification

The controllers are required to notify the appropriate supervisory authority of a personal data breach within 72 hours (at the latest) on learning about the exposure if it results in risk to the consumer. But even if the exposure is not serious, the company still has to keep the records internally.

According to the GDPR, accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data, the EU’s term for PII is considered a breach.

The GDRP notification is more than just reporting an incident, there is a need to include categories of data, records touched, and approximate number of data subjects affected. This will require detailed intelligence on what the hackers and insider were doing.

There is a term known as "Dwell time", which is the period of time that someone malicious is on your network and systems undiscovered.  Most people are shocked to learn that this on average is 206 days (from Cost of a Data Breach Study: Global Analysis, Ponemon Institute, 2015)

Fines

The GDPR has a tiered fine structure, so a company can be fined up to 2% for not having their records in order, not notifying the supervising authority and data subject about a breach or not conducting impact assessments, while more serious infringements merit a 4% fine. This includes violation of basic principles related to data security and conditions for consumer consent. 

The EU GDPR rules apply to both controllers and processors that are in “the cloud”. So cloud providers are not off the hook when it comes to GDPR enforcement.

"Right to be Forgotten"

Individuals can request the erasure of their personal data without undue delay by the data controller in certain situations. 

Consent can be withdrawn and no other legal ground for processing applies. This topic has attracted a huge amount of interest, particularly following the CJEU decision in the Google vs. Spain case.

Alongside this obligation is one to take reasonable steps to inform third parties that the data subject has requested the erasure of any links to, or copies of, that data.

Outside of the EU

The law applies to your company, even if it markets goods or services in the EU zone.  If you don’t have a formal presence in the EU zone but collect and store the personal data of EU citizens, GDPR still applies and the extra-territoriality requirement is especially relevant to ecommerce companies.

Is GDPR still required now that Brexit may happen?

If Article 50 is initiated in July 2016 & UK exits July 2018; GDPR will apply from May 2018. Also the UK were instrumental to writing and strengthening the GDPR.  Receiving personal data from EU member states would need to demonstrate to the European Commission that the law provides an adequate level of protection through its domestic laws or international commitments.

Source: Absolute Strategy Research Ltd

As you can see from the chart above, with many of the options open to the UK, compliance with EU regulation is required in order to trade with Europe.  In my opinion, GDPR will be relevant to the UK, and will need to be in place with UK organisations holding data of EU citizens.

Adopting GDPR

I believe there are some steps that will need to be taken with all organisations that wish to comply with GDRP:

• Locate the critical data for GDPR
• Protect the data (and the applications that access it) through segmentation and/or encryption
• If encryption is used, ensure the encryption keys are secured
• Use strong Access Controls to servers holding the data, such as two factor authentication
• Use DLP/Insider Threat technology to prevent data exfiltration
• Monitor all exfiltration data channels, including web and email
• Collate logs from the network, so they can be analysed
• Secure domain and local administrator accounts
• Penetration test the environment

Final Thoughts

GDPR goes live in May 2018, which means there are two budget cycles left to get the education, processes, workflow and technology in place.  One of those budget cycles are underway already, so if GDPR planning hasn't begun, start it now, so you'll be ready for next years budget.

General Data Protection Regulation – what you need to know [Link - MTI Bytes]

This is a blog piece for the company blog site around the new General Data Protection Regulation: http://blogs.mti.com/blog/general-data-protection-regulation-what-you-need-to-know

===============================================

Signed into law in May 2016, the European Union’s General Data Protection Regulation (GDPR) act will force change in the way businesses approach data protection when it is enforced in two years’ time.

The scope of the act, which replaces the EU Data Protection Directive, will increase significantly as it standardises and unifies data privacy requirements not just across member states, but for any businesses that markets to EU data subjects.

Carrying heavy fines for non-compliance, either €20 million or 4 per cent of global turnover, whichever is greater, the GDPR enacts stricter guidelines for getting consent for data collection, individual profiling and also contains more comprehensive definitions of data.

GDPR also enhances the current legislature around data security and breach notification standards, so it is imperative the compliance teams, CIOs and data protection officers take notice of these changes.

Breach notification

As part of the new rules set by the EU, companies must alert the authorities without undue delay and have up to 72 hours – where feasible – to provide notification of a breach of EU national’s data, or risk a fine for non-compliance.

Currently, UK firms are not under any such requirement to announce a data breach, with many choosing not to as the cost of doing so for a business can be enormous. For example TalkTalk and Carphone Warehouse saw their profits and trust in their brands fall dramatically following public data leaks.

This will be a significant change for many businesses, and will see current systems overhauled in order to ensure breach protocols are compliant with the new legislation. It will also apply to all UK firms trading in Europe, as any company that holds the personal details of an EU ‘data subject’ will have to comply.

The devil is in the detail and the final text of the new directive needs to be closely studied.

Getting technical

The GDPR also separates responsibilities and duties for both data controllers and processors – requiring controllers to only engage processors that provide sufficient guarantees to meet the GDPR’s standards of protecting data subjects’ rights.

Article 32 of the GDPR outlines these responsibilities. While it is similar to the Directive’s Article 17, the GDPR expands this by providing specific suggestions for the type of security activities which might be ‘appropriate to the risk’.

From encryption of data to testing and assessing security systems – everything needs to be compliant with the GDPR’s new code of conduct.

Looking forward

There are just under two years and in turn two budget cycles remaining until the law enforces the act, yet GDPR readiness is not a priority amongst IT professionals in Europe.

There is a lot to assess in that time, especially in terms of the security aspects of GDPR, so now is the time to be getting systems ready for compliance and for implementing new breach notification policies.

This will require working with legal teams and other branches of the business to ensure compliance is watertight to prevent heavy fines for businesses.

TalkTalk Breach

On Friday 23rd October 2015, it came to light that TalkTalk, the telecommunications and internet provider was subject to a significant cyber-attack.

Some facts have come to light since the disclosure of the attack:

Third time’s a charm

The latest attack was the third cyber-attack in the past 12 months.  It is believe that that this attack has allowed the attacker to steal four million records.  It may also have been up to ten weeks, since the cyber-attack had occurred. 

DDoS as a cover

A DDoS (Distributed Denial of Service) attack was used to overwhelm the existing perimeter solutions.  The large volume of traffic will overwhelm perimeter solutions such as firewalls and IDS/IPS solutions which are there to scan and protect an organisation from malicious traffic.  It seems there was either no or an inappropriate/inadequate DDoS mitigation solution in place.  DDoS attacks are often used as a subterfuge to mask the real nature of the attack.  In this case, it looks like the attacker is flooding a website, whereas the underlying attack is to exfiltrate customer data.

SQL Injection?

It is widely believed that the attack was on the application available on the internet, and using web application testing tools, such as a form of SQL injection attack, were able to access the data.

SQL is a database application, and an SQL injection is the ability to run a query on a database.  Although very useful for database administrator, it gives malicious attackers the ability to query and export a whole database.  The ability to run SQL injection attacks, are typically due to bad administration practices and not properly protecting the database.

Comprehensive data on people

The customer data lost is incredibly comprehensive.  The list below shows the data the attacker was able to obtain.

• Name
• Address
• Email Address
• Telephone Number(s)
• TalkTalk Account Number
• TalkTalk Password
• Bank Details
• Partial Credit Card Details

Encryption?

The TalkTalk data wasn't encrypted, meaning the attacker was able to read all the above information.  The data was in clear text, offering no protection to the customer.

Aftermath

It is believed that the Police and BAE Systems are carrying out a forensic investigation on the attack, but this relies on how much of a digital footprint was left during the attack and whether it was recorded at the time.

BEFORE THE ATTACK

As an organisation handling customer information, there are many actions that would help prior to an attack:

Identification of Data

With numerous databases, server shares, cloud storage solutions and user created data; identifying important information, such as customer’s PII (Personal Identifiable Information) and financial information is paramount.

Protection of Data

Once the important information has been identified, methods of protecting the data should be used.  Encryption of data, where the data is encoded using a unique key and can only be decoded with this key, makes the data useless without it.

Testing of Systems

As applications are exposed the internet, such as customer portals, these need to be tested by a third party organisation with little or no knowledge of the application.  A Web Application Penetration Test could have highlighted some of the shortcomings of the web facing applications, including testing for SQL injections.

DURING THE ATTACK

When an organisation is under attack, a number of solutions could have prevented an attack similar to TalkTalk’s. 

Administrative Rights

It is often said that 100% of attacks have used administrative rights.  There are Privileged Access Management solutions, which will safeguard the administrative accounts, and will offer full traceability of which administrator has done what.  A typical attack will either use administrative credentials they have gained, or to elevate the administrative privileges of a normal user.

Protection from DDoS

A DDoS (Distributed Denial of Service) is normally used by a malicious attacker to take a web presence offline, making a web service inaccessible.  In the case of TalkTalk’s attack, it was use to cloak the underlying attack.  A hybrid DDoS mitigation solution could have prevented such an attack.

Intrusion Detection

There are Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS) which is used to detect and identify malicious activity on the network, then try to block or stop that traffic, and report back.  These are available as standalone solutions or as part of a UTM (Unified Threat Management) or Next-Generation Firewall solution.  Sometimes the early warning of an attack can help prevent the loss from being so great.

Data Exfiltration

The data will need to be taken for a breach to have occurred, so a DLP (Data Loss Prevention) solution will monitor the vectors from which data can leave, such as web, email, USB, screenshots, printers, etc and if the monitored data leaves in an atypical fashion, it will be quarantined and administrators alerted.  

AFTER THE ATTACK

After the compromise, what options are available?

Logs & Forensics

Post attack, it’s important to know what has been lost and preventing it from happening again.  A SIEM (Security Information & Event Management) solution would be able to aggregate the logs from the various components of the network, and apply a level of intelligence to the data.  Some will be able to carry out a forensic analysis on the logs.

Understanding the attack will allow a more effective remediation plan to be created.

What now TalkTalk?

Reading the press following the TalkTalk attack, there is no understanding to the significance of the data loss.  Although there is no demand to encrypt the data, it doesn't mean that the information of your customers should not have been encrypted.

As a minimum, by pentesting the application to prevent the vulnerability, and encrypting the data so it's useless to the attacker, would have prevented TalkTalk from the media attention. 

There is a call for the government to do more to prevent the cyber-attacks, but as highlighted here the technologies are available to help prevent, gain visibility or slow down the attack.  The onus should not be on governments to protect the customer’s data, it should be the service provider.

Social Engineering - The Art of Deception

After a friend read my blog post about securing your virtual identity, he recommended that I read the book "The Art of Deception: Controlling the Human Element of Security" by Kevin Mitnick, which can be purchased from Amazon.

The book is structured with stories and anecdotes about how people have fallen for social engineering, and what lessons can be learnt from these situations.  Having worked in an IT security environment for nearly a decade, I am aware of vendor and technical solutions to tackle issues that IT environments without security measures.

Growing up I watched a number of films, including the likes of Wargames, Hackers, The Net and Swordfish.  They may not be great films, but they gave a romantic view of hacking.  I was interested in this realm of IT when I first started my career nearly two decades ago, but I'd say I was a failed script kiddie.  I didn't understand the systems well enough to penetrate the security measures, and struggled to get the tools to work correctly.  

I'd hear the stories of social engineering conquests and I'm in awe of the confidence and arrogance to manipulate people to test an organisations security!  Reading this book shows how easy it is to manipulate people and how easy it is to have them carry out tasks in isolation that seem so insignificant, but when couple with a number of tasks, you have all the pieces of a jigsaw to manipulate a company!

The book was incredibly easy to read and even though I'm not a big reader, I finished it in less than two days.  It's real page turner, and even though it was written nearly 12 years ago it is still very relevant.  If you just read the book about what you shouldn't do, anyone with IT security awareness will tell you they have been told this already.  Taking the story of the manipulation and how to con worked and why is eye opening.

The book ends on how to create a security awareness program, including how to train staff.  Following all the advice will not mean you are secure, but it will certainly help and have people think about who is requesting the action.  All the technology in the world will not secure you and your organisation, but stopping the people from being the weak link will certainly help.

Kali Linux - Installed, what next?

As The X-Factor returns to UK television, I needed to find something else to occupy my time!!

I found a Kali tutorial site called kalitoutorials.net which is great at explaining how and why.  I started with the basic commands, then started to look at how to hack WEP wireless networks.  I used the toolsets to see what they can do and how the results are displayed.  As my wireless network is running WPA2, some of these tools don't work.

My next job is the create a a new wireless network for me to hack.  I have a number of wireless routers and access points I can use. Once I've set one up, I'll write a step-by-step guide with what I've learnt.  I will state now, DO NOT hack any wireless networks that are not yours, or you do not have the expressed permission of the wireless network owner.

Kali Linux - Getting Started

Being a newbie to penetration testing, I was introduced to BackTrack a few years ago, but struggled to find time to investigate further.

After a few years, I now look after a team of engineers and penetration testers, so it seems like an opportune time to take a Kali.

Digging through some old hardware, I managed to get a working netbook from a couple of non-working netbooks.  One started life as an MSI Wind U100 and the other an Advent 4211C.  These are relatively low powered machines, with the first generation of Intel Celeron 1.6GHz processor, 1GB RAM and 80GB SATA hard drive.  They are compact with their 10" screens, and the keyboard although a little smaller than most laptops, perfectly usable.

I have made some modifications to the hybrid device, which include an additional 1GB RAM, bringing it up to 2GB RAM.  I've also changed the existing 80GB 5400RPM SATA hard drive for a 40GB Intel SDD, which I hope will extend the battery life of the machine and reduce the amount of heat it generates.  Talking of batteries, the standard 3-cell battery is appalling, so this has been replaced with a 9-cell battery from ebay, so the battery life is now beyond 5 hours, rather than less than an hour!

With the hardware in place, the next step is to get the software installed.  There are some well written instructions to get the Kali Linux installer on to a USB stick here: http://docs.kali.org/installation/kali-linux-live-usb-install

Once the USB stick has been created, I ensured the computer would boot from a USB stick and let it install onto the computer.  If you have some experience with installing Linux, such as Ubuntu, then this will seem very familiar.  If you have a Windows background, you can probably muddle your way through (I did when I first tackled Ubuntu!)

All being well, you will end up with Kali Linux installed on your computer.  The only issue I had was that my hidden wireless network could not be picked up during the installation, so I reverted to using a network cable to complete the installation, then configuring the wireless settings after the installation had completed.

The next step is update the software and then start learning how to use Kali!

There is some great documentation here: http://www.kali.org/official-documentation/ 

There is also official training here: http://www.offensive-security.com/information-security-training/penetration-testing-with-kali-linux/

Clickjacking and UAG

I got an email from a customer and friend, regarding penetration test results on a Microsoft UAG environment.  The report highlighted that Clickjacking is way of tricking web user into revealing confidential information or allowing their computer to be controlled while clicking on seemingly harmless web pages.  Clickjacking can be embedded code or a script that executes without the web users knowledge.

I took this opportunity to learn a bit more about this and found a couple of interesting websites.  It seems that other UAG users have encountered this during penetration testing before, and there is a fix:  http://forums.forefrontsecurity.org/default.aspx?g=posts&m=2788

The following code needs to be added into the UAG login.asp script:

<script type="text/javascript">
if(top != self) top.location.replace(location);
</script>

Adding the code is fine, but I had to find a way of testing the Clickjacking.  I found this site, which allowed me to test the vulnerability:  https://www.codemagi.com/blog/post/196

By creating an HTML page with the following code, and replacing the red text with the URL that you want to test, it will show if the website is vulnerable to Clickjacking:

<html>
<head>
<title>Clickjack test page</title>
</head>
<body>
<p>You’ve been clickjacked!</p>
<iframe sandbox="allow-scripts allow-forms" src="http://localhost:8080" style="width:100%;height:90%"></iframe>
</body>
</html>

With a little experimentation, I found the best place within the UAG login.asp to put the additional line of code was here:

var capsLockNote = "<%=GetString(111, "Note: The Caps Lock key is on. Passwords are case-sensitive.")%>";

</script>

<script type="text/javascript">

  if(top != self) top.location.replace(location);

</script>

<script language="JavaScript" src="/InternalSite/scripts/capsLock.js"></script>

I have to stress that it may be different on your UAG deployment, so remember to test it works, rather than assume!