Just back from Infosecurity Europe held in London, the largest computer security event in Europe. The usual suspects were there, including Symantec, Sonicwall, Sophos, TrendMicro, Fortinet and McAfee. But, the real highlight was the workshops, product demonstrations, speakers and of course meeting I.T. peers from across the world gleaning tips and best-practice ideas. Here are some of the highlights.
Eugene Kaspersky Speech
I have always been a great fan of Kaspersky security products. They tick all the boxes when it comes to well-written and effective software. Their threat detection rates are some of the best in the market. Compared to competing products, their CPU footprint is pint-sized and their products are user-friendly. More importantly, Kaspersky security products are robust. I have yet to see Kaspersky products get damaged by viral or malware processes in the same Symantec or McAfee products do. It was great to hear the co-founder Eugene Kaspersky talk in person about the current threat landscape and his vision of the future of computer security.
Mac Users – welcome to Bill Gate’s World!
He started his talk about the over how computer threats are now omnipresent. Just because you own a Mac, it does not mean to say you are protected, he reminded every Mac user in the room. “Finally, you are in the same world as Windows users” he said in a tone of voice spookily reminiscent of a Russian baddie in a James Bond movie. “It is possible to infect Mac in the same way as Windows” he continued with a hint of glee in his voice. (Kaspersky launched their Anti-Virus for Mac two years ago)
He continued to talk about the ever increasing role of cyber-warfare and the Stuxnet virus (discussed in this blog, November 2010) “I don’t have to explain what Stuxnet is” he said. (Stuxnet was a virus, most probably created by an Israeli-American designed to hinder production at Iranian nuclear plants) “Cyber weapons are much cheaper to design than traditional weapons” he said, reminding us that it took a paltry €10 million to design the Stuxnet virus. Relatively cheap, I suppose compared to what it would cost to send in an army to destroy Iranian nuclear capability.
International Bodies being setup to Prevent Cyber Crime
How do you prevent cyber-crime? he mused. “We have to set up international bodies in the same way the UN setup the International Atomic Energy Agency” to mitigate against nuclear misuse. Thankfully, he informed the audience what international steps are already being taken. Interpol are set to open up their Global Cybercrime Centre in Singapore in 2014. The UN already have setup their ITU-Impact group to bring members countries and expertise together to detect, analyse and respond to cyber threats. As for prosecuting cyber criminals, if they are found, he said “I am not sure we would have enough space in our prisons” he said ruefully.
Meeting Bruce Schneier
Talking also at Infosecurity Europe was computer security expert Bruce Schneier. He is famous for writing the seminal book on cryptography Applied Cryptography (1995). It is still considered by many I.T. security experts as the book on cryptography.
Having read his Secrets and Lies book a couple of years ago. Bruce can teach businesses many things about implementing robust computer security policies. Some of the key tenets of his I.T. security philosophy is that security is a process not a product. Proper security for your computer cannot be bought in box. Every year, I hear users ask the question “how did I get infected, I got anti-virus on my computer?” This is really like saying “I bought a Volvo that was Euro NCAP 5 star-rated but it still crashed”. Just as road safety is not just determined by the type of car you have, computer security is not just determined by the type of anti-virus protection or firewall that you have. Sure, some security vendors might sell their products under the pretence they will protect you from everything, but these claims have to taken with a pinch of salt. It is the security policies that you have in place in your business that ultimately determine the level of security. Do you have a policy for secure passwords for your staff? Do you have a policy what websites your staff can visit? Do you have a policy about mobile device encryption? The list goes beyond the scope of this short blog post…
Another thought that businesses can learn from Schneier is that security is made of three key components – prevention, detection and response. Firewalls, anti-spam, anti-malware, anti-phishing and anti-virus products are all just one denominator of the security equation. If your business does get attacked by a DDOS attack or phishing attack. It is the swift detection of that attack that will be nearly just as important as prevention. (This is a thought to keep in mind considering that five the of best-selling end-user computer security suites only have an average detection rate of 76 per cent). It is the user’s fast response or lack thereof that will ultimately determine the damage incurred. How quick are your employees to respond when it comes to detecting strange or possible malicious behaviour on your computer systems?
Complexity as the enemy of security is another idea espoused by Schneier. Humans are complex animals. But, when you make security policies too complex for them, instead of working with them, they will begin to circumvent them. To take a simple example, if a business has a door entry/exit policy that is too complicated and too time consuming, you risk that your staff will start using backdoors or fire exits in lieu.
(This concept of self-defeating security policies was perfectly illustrated during the conference by another speaker, Pravin Bhagwat, CTO of Airtight Networks. He told the delegates of how, when you disallow users from using the company wireless network for connecting their own devices like smartphones and laptops, users will just start bringing in their own wireless access points and start connecting devices this way. When users start to bring in their own AP’s to work with them, this is where the real security problems begin.) The lesson here is, if you are going to implement computer security policies for your business, they must compliment the existing work practices of your employees not work against them.
After a quick chat with Bruce Schneier, he kindly gave me a free signed copy of his new book Liars and Outliars which I look forward to reading. Bruce does have a rather cryptic signature, doesn’t he? (see photo)
The Importance of Tablet / Laptop Encryption
We always remind our customers, that if you have important information on a mobile device such as a laptop or tablet PC, a login password is not sufficient. You should have the device encrypted. Pen Test Partners from Buckingham, UK gave an excellent presentation on the security of the iPad. A lot of ordinary users of these devices think that if they have their device password protected, they are safe. Think again. Pen Test Partners did what David Blaine or Uri Geller can only dream about. While Blaine levitates and Uri bends spoons – Pen Test Partners crack iPad passwords with amazing speed. During their live demonstration and with a little bit of help from Elcomsoft’s iOS Forensic toolkit, they were able to crack the password of an iPad 2 in under 4 minutes. I am sure there is more to their portfolio of skills than this but the lesson here is – if you have sensitive data on a laptop, tablet or smartphone – make sure it is encrypted.

