Category Archives: Security

Security

OpenSSL Fixes Six CVE

Leave a comment

OpenSSL has announced fixes for the following six security flaws for versions 1.0.0f and 0.9.8s. The first is the notorious “extension of the Vaudenay padding oracle attack on CBC mode encryption”.

  1. DTLS Plaintext Recovery Attack (CVE-2011-4108)
  2. Double-free in Policy Checks (CVE-2011-4109)
  3. Uninitialized SSL 3.0 Padding (CVE-2011-4576)
  4. Malformed RFC 3779 Data Can Cause Assertion Failures (CVE-2011-4577)
  5. SGC Restart DoS Attack (CVE-2011-4619)
  6. Invalid GOST parameters DoS Attack (CVE-2012-0027)

The last CVE has an “original release date of 01/06/2012”, yet the OpenSSL security advisory was released “04 Jan 2012”.

Energy, Food, Security

Breaking Human Limits

Leave a comment

Radiolab has a humorous hour of interviews about how humans can exceed their own limits by studying them and then breaking through (e.g. hacking the body, mind and knowledge)

On this hour of Radiolab: a journey to the edge of human limits.

How much can you jam into a human brain? How far can you push yourself past feelings of exhaustion? We test physical endurance with a bike race that makes the Tour de France look like child’s play, and mental capacity with a mind-stretching memory competition. And we ask if robots–for better or worse–may be forging beyond the limits of human understanding.

Security

Technology and the Workplace: BYOD

3 Comments

The latest buzz word or acronym around the water cooler is BYOD or bring your own device. Use of mobile devices has sky rocketed over the last year with the iPhone, iPad, tablets, Android, etc. Everyone wants the latest and the greatest. But, who wants to carry around two devices, the company’s and your own? Even if you don’t mind carrying the extra device, how many man-hours do employers lose when employees are exploring and surfing their new mobile devices at work?

It may be better, depending on the business, to just allow employees to use their personal devices for work. This issue is similar to the controversy over whether to allow employees to use social media. On that one, cat’s out of the bag. They are. So put a policy in place to set parameters to benefit and protect the company. But BYOD, whoa, how many privacy, security and legal issues does this generate? A lot!

As an employer, what can you do? Again, put a policy in place and do it now. Don’t just throw something together piece meal as you go along, do it right.

Now, this may sound a little self-serving, but, commonsense dictates having it drafted by a lawyer who is familiar with the technology, privacy, and other issues to ensure your company is protected, and consequently so is the employee.

The policy or policies need to address questions such as can you monitor the personal device; implement encryption; require anti-virus; tracking, secure wipe; use of passwords; etc.? The answers, by the way, are yes, yes, and yes.

Best plan is to have a monitoring policy and a mobile device use policy, or BYOD policy, and give employees the option: “if you wish to use your personal device at work you must agree to the terms of the policy.” The alternative would be to use the company device, aka “the brick”, if they are not willing to accept the terms.

Bottom line: a well thought out and well drafted policy or policies are the key! Watch for the next installment of “Technology and the Workplace.”

Security

UCLA Breach of Encrypted Drive

2 Comments

Here’s an interesting breach notification case from 2011.

The UCLA Health System is notifying thousands of patients by mail that on Sept. 6, 2011, an external computer hard drive that contained some personal information on 16,288 patients was among a number of items stolen during a home invasion. Although this information was encrypted, the password necessary to unscramble the information was written on a piece of paper near the hard drive and cannot be located. There is no evidence suggesting that the information has been accessed or misused.

And now for the punch-line:

The individual whose hard drive was stolen, left employment at UCLA in July 2011.

It was their own personal hard drive with three years of data. Not sure if it’s worse to know that a current employee/user is so careless with a password to the encrypted data or that a former employee has retained encrypted data and a password to still decrypt it.

Kudos to UCLA for their reporting (a better response now than what we saw from them in 2008, which resulted in AB 211 and SB 541).

I suspect they will be looking at whether large data sets really need to be on personal removable equipment instead of remotely accessed on virtual desktops and how they should rotate/expire encryption keys. My guess is the user was given the encryption capability for the data so their key should have been revoked (rendering the password paper useless) when they left employment.