These posts discuss general tech topics; outside of SAP Basis Administration.
Keep Regular with Security Audits
Routine Security Audits can help things stay routine.
Security audits are one of the most important things you can do to protect your network. Security breaches happen all the time, and it’s up to you to stay ahead of these breaches with regular security audits. Security auditing is not just about checking logs – it’s about actively looking for changes on your network so that if something happens, you’ll know what was changed and how it happened. Security audits also provide peace of mind by showing that the right level of security is in place at any given time.
An audit includes reviewing firewall settings, software updates, antivirus/anti-malware status, account permissions (including Active Directory) domain controller health checks, password strength requirements, file share permissions including NTFS[1] permission changes, DHCP/DNS/WINS settings, user rights, Windows Security auditing settings, SharePoint Security Settings, anti-malware scanners to ensure virus signatures are up to date, patch statuses (including WSUS[2]) change logs and even checking for unauthorized software.
A security audit is a process of evaluating the effectiveness of information security policies. Many businesses now depend on technology for their day to day operations and consequently, they expose themselves to various risks. Security audits are now an integral part of the security policy and it is important that they be made routine. The scope of the audit is determined by the level and type of risk identified in the organization and also is based on certain standards that have been developed.
Types of Security Audits & Auditors
Security audits are an important part of keeping your company safe. But there are many different types to choose from, and each type has its own set of benefits and drawbacks. The process begins with analyzing the environment that needs to be audited, then matching the audit to the need. That’s why it’s crucial to understand what kind of security audit is needed before getting started. And while some audits may seem more difficult than others, they all have their place in a comprehensive security plan.[3]
These employees work inside the company looking for vulnerabilities or signs that something could go wrong within their departments or areas of responsibility which can be anything from the water cooler to the data center. They are employees who are trained in spotting red flags or inconsistencies that, when addressed early on, can prevent crisis situations down the road.
These auditors don’t work for your company but examine your systems and equipment regularly to look for security gaps in policies and procedures. These audits are performed by a hired third party or government agency.
These audits can also take the form of either Black Box or White Box (or Glass Box) Penetration Testing. With Black Box, the auditor has no knowledge of your systems and is testing from a position outside your network, looking for vulnerabilities by attacking them from the internet. With White Box, the auditor knows everything about how your systems are put together.[4] Each method has its pros and cons, but the goal with both is to harden[5] the system.
Manual Audits
A manual audit can be performed by an internal or external auditor. During this type of auditing, the interviewer will interview your employees to evaluate physical access and vulnerability scans for security as well as application, network and operating system controls that may need adjustment if necessary in order to make sure you’re up-to-date on best practices. These audits require extensive knowledge of the type of environment being audited and the ability to generate reports based on their findings.
Automated audits are a Computer-Assisted Audit Technique, also known as CAAT that produces comprehensive, customizable reports. They can be used internally by management and externally for auditing purposes. Advanced programs will monitor the IT environment continuously so you’re always in the know about any suspicious activity taking place within your networked devices.
The security audit standards ISO, HIPAA Security Rule, PCI DSS Compliance and SOX Compliance are designed to help businesses comply with their own internal data security protocols.
ISO Compliance is a process of verifying that an organization meets the requirements of the ISO/IEC 27001 standard. This standard covers the Information Security Management System (ISMS).[6] An ISMS is a framework that allows an organization to manage and control its information security risks. ISO Compliance is necessary for organizations that want to protect their customers’ data.
The HIPAA Security Rule is a set of regulations that are designed to protect the privacy and security of electronic health information. The Rule requires covered entities to implement a variety of security measures, including:
- Access Control
- Audit Logging
- Password Management
- Data Encryption
PCI DSS compliance is a requirement for any business that accepts credit cards. In order to be PCI compliant, a business must implement certain security measures to protect its customers’ credit card data. These security measures include things like firewalls, anti-virus software, and data encryption.
Businesses that are not PCI compliant can face fines and other penalties from the credit card companies. It’s therefore important for businesses to ensure that they are PCI compliant at all times, especially if they hand credit card data.
One of the most important audit standards is SOX compliance.[7] This stands for “Sarbanes-Oxley Act of 2002” and it demands that any company with over $10 million in assets or sales must produce an annual report, or ER. One of the mandates is to establish an internal control to keep track of risks and vulnerability to fraud, waste and abuse. There are many other mandates in the SOX standard to help protect a company and its stakeholders from fraudulent activities.
When it comes to auditing your network security, there are a few key steps that you need to follow in order to get the most comprehensive results. Here’s a quick overview:
- Start by assessing your current security posture. This will help you to identify any weak spots that need to be addressed.
- Next, perform an audit on the devices that are being used to manage security. You need to know exactly how many of each type of device you have, what they do, and where they are. This step will help you to create a standardized configuration across your entire network.
- After creating a standard configuration for all of your devices, you can run vulnerability scans against them in order to see if any holes have been opened up due to lack of updates or new patches.
- Once everything has been inventoried and patched as needed, it’s time for another assessment so that you can see if the changes had the intended effect and whether there were any unexpected consequences.
- Finally, review your firewall and Active Directory settings to make sure that they are configured correctly.
- Rinse; repeat…
How often should you do security audits? It depends on your organization’s risk level. If you’re dealing with sensitive data, you should probably be doing audits at least once a quarter. If your organization is less risky, you can get away with doing them every six months or even once a year. However, it’s always a good idea to be proactive and do audits more often than you need to. This way, you’ll catch any issues before they become a problem.
A security audit is an important component of network management. It’s also one of the most overlooked areas in many organizations. Without regular audits, you can’t be sure if your system is secure enough to protect data and meet compliance requirements. You don’t want to wait until there has been a breach before taking action. If you’re interested in learning more about our services or would like help with designing a custom security plan tailored specifically for your organization, contact us today!
Sources:
[1] https://docs.microsoft.com/en-us/windows-server/storage/file-server/ntfs-overview
[2] https://en.wikipedia.org/wiki/Windows_Server_Update_Services
[3] https://www.dnsstuff.com/it-security-audit
[4] https://teskalabs.com/blog/security-audit-white-box-vs-black-box-penetration-testing
[5] “In computing, hardening is usually the process of securing a system by reducing its surface of vulnerability, which is larger when a system performs more functions.” https://en.wikipedia.org/wiki/Hardening_%28computing%29
[6] https://www.itgovernanceusa.com/blog/what-exactly-is-an-information-security-management-system-isms-2
[7] https://www.soxlaw.com/sox-compliance/
Picture Credits
https://pixabay.com/images/id-4189560/
https://pixabay.com/images/id-265130/
https://pixabay.com/images/id-5382501/
WhatsApp with Encryption
Securing Data In-Transit and At-Rest
“Let’s say I’m emailing about ‘Black Panther’ within WhatsApp … do I get a ‘Black Panther banner ad?”
The answer, from Facebook[1] CEO, Mark Zuckerberg was, “No, we don’t see any of the content in Whatsapp, it’s fully encrypted.” The continued line of questioning in the same vein asking if some algorithm “reads” the message betrays how much the term “fully encrypted” is misunderstood. But that’s only half the story. Any data, even Whatsapp messages, is either data in motion across networks, or data at rest, on a server or storage device. Data in transit is considered more vulnerable, but data at rest is a juicier target.[2] Data encryption is so pervasive today that it is virtually impossible to send information electronically without using some form of data encryption.
Data Encryption
Data encryption is defined as: the use of an algorithm to obfuscate information so it can be securely transmitted between two parties without being deciphered. Data encryption began with the advent of computers, and has become necessary thanks to hackers who have taken advantage of their ability to tap internet communication. Data encryption can be broken into two categories: Data At Rest and Data In Transit.[3]
As you may know, data travels in packets with headers that serve as address labels with information about how to reassemble the data once it gets to where it is going. The most secure form of data transmission is fully encrypted on a point-to-point tunnel.[4] The idea is that encrypted data packets are unreadable by anyone without a quantum computer or a billion billion years to try all the possible combinations to decipher them.[5] Tunneling can be done in several different ways using different protocols and levels of the OSI model (like the Transport- or Data-Link Layers) and each provide their own level of security vs performance.
Data in Transit
Data in transit refers to data that is being transmitted between two or more devices. Data in transit can be encrypted using a variety of different algorithms, but the most common algorithm is Transport Layer Security (TLS). TLS is a protocol that is used to encrypt data that is being transmitted over the internet. TLS is a successor to Secure Sockets Layer (SSL), which was the most common encryption protocol until it was usurped by TLS in 2011
Data at Rest
Data at rest refers to data that is stored on either a hard drive or any other storage device. Data at rest is usually encrypted using a key that is known only to the owner of the data. This type of encryption is used, for example, when someone wants to store files on a computer. Data at rest can also be stored in the cloud, which is a service that allows users to store their data on remote servers. Data that is stored in the cloud is also encrypted using a key that is known only to the owner of the data.
AES
AES is one of the most common encryption methods. It uses a key to encrypt and decrypt data. The key can be a password, a number, or a string of text. AES is considered very secure, and is often used for sensitive information such as bank details and credit card numbers.
There are several different AES encryption methods, each with its own strengths and weaknesses. AES-128 is the simplest form of AES encryption, while AES-256 is the most complex. AES-128 is faster than AES-256, but less secure. AES-256 is more secure but slower.
Symmetrical vs Asymmetrical
There are two main types of Data Encryption: symmetrical and asymmetrical. Symmetrical encryption uses one key, called “shared secret”, to both encrypt and decrypt information. Symmetric algorithms are fast and efficient but also have a major drawback: The user must exchange keys securely before two parties can communicate with each other. Symmetric encryption solutions provide confidentiality as long as the shared secret remains private. Symmetric encryption solutions are best suited for applications where secure key distribution is not an issue and where data can be safely held for extended periods. Symmetric encryption is not the best choice to secure network traffic, but it can be used if absolute performance and throughput are required.
Quantum Computing Implications
Quantum computing has the potential to change how data encryption and security are handled. Because quantum computers can theoretically break many of the current encryption algorithms, researchers are working on developing new algorithms that are quantum-resistant.
One example of a quantum resistant algorithm is called Quantum Key Distribution (QKD).[6] QKD uses photons to exchange keys between two parties. The keys are generated by each party separately and are never shared online or in any other way that could be compromised. This makes them virtually impossible to hack.
Other proposed quantum resistant algorithms include lattice-based cryptography and hash-based cryptography.[7] However, it is still unclear which of these methods will be most successful in resisting attack by quantum computers.
Despite the potential for quantum computing to break current encryption algorithms, it is important to remember that quantum computers are still in their infancy. It is likely that they will not be able to break all encryption algorithms for many years, if at all. In the meantime, we can continue to use existing encryption methods with confidence.
Conclusion
Data encryption is a complicated topic. It’s not just about encrypting data at rest, or in transit or even when it leaves your company and goes to the cloud-based storage provider. There are many different types of encryption algorithms that you need to be aware of as well as what type of key management strategy best suits your needs for accessing encrypted files on demand from anywhere around the world without compromising security. In this blog post we discussed some basic concepts behind AES, one popular algorithm used by organizations with sensitive data. If you want more information about how 1st Basis Consulting can help keep your organization safe from cyber attacks contact us today!
[1] Facebook bought Whatsapp in 2014. These Confidential Charts Show Why Facebook Bought WhatsApp https://www.buzzfeednews.com/article/charliewarzel/why-facebook-bought-whatsapp
[2] https://digitalguardian.com/blog/data-protection-data-in-transit-vs-data-at-rest
[3] https://docs.aws.amazon.com/whitepapers/latest/logical-separation/encrypting-data-at-rest-and–in-transit.html
[4] Actually data on a storage medium is probably more secure, but that violates our definition of “in transit”
[5] https://www.kryptall.com/index.php/2015-09-24-06-28-54/how-safe-is-safe-is-aes-encryption-safe
[6] https://www.nsa.gov/Cybersecurity/Quantum-Key-Distribution-QKD-and-Quantum-Cryptography-QC/
[7] https://www.isara.com/blog-posts/hash-based-cryptography.html
PHOTO CREDIT
https://pixabay.com/images/id-1863880/
https://pixabay.com/images/id-5475661/
https://pixabay.com/images/id-3044387/
SECURITYBRIDGE BROADENS U.S. REACH WITH NEW 1st BASIS GROUP PARTNERSHIP
Press Release
Ingolstadt, Germany, February 22, 2022 – SAP security provider SecurityBridge—now operating in the U.S.,—today announced a partnership with Wisconsin-based 1st Basis SAP Services Group, (1st Basis). The partnership enables 1st Basis to provide SecurityBridge’s integrated SAP Security platform and services—the most advanced cybersecurity to SAP managed services, and S4HANA migration projects—to their customer base.
“It’s no secret that SAP often holds an organization’s crown jewels and needs to be given the utmost protection. However, according to the latest research 43% of data breaches are at the application layer and we are finding that this is the greatest area of weakness,” said Doug Pastrich, CEO of 1st Basis.
SecurityBridge provides the most advanced cyber-platform with real-time threat detection, vulnerability management, custom code scanning, and patch-management in a seamless one-stop-shop solution, built on a single technology layer. With real-time dashboards based on SAP Fiori, SecurityBridge provides actionable intelligence that can be relied upon to make critical security decisions.
“SecurityBridge provides the most comprehensive functionality and seamlessly integrates within the SAP technology stack. Its agile and holistic approach enables us to provide transformation and managed services very quickly and smoothly. 1st Basis will be building on our solid reputation of providing our clients with the utmost quality of managed services as security is becoming more urgent. With this partnership, we will provide significant speed to security in our ability to reduce the attack surface for our customers by utilizing the power of SecurityBridge,” added Pastrich.
“Threats against SAP systems are becoming more prevalent and more sophisticated. The most effective, proven approach is to combine constant real-time threat monitoring and vulnerability management into a holistic security process’’, said Christoph Nagy, CEO of SecurityBridge.
“The partnership with 1st Basis will be highly synergistic for both parties, as we see the increasing migration towards managed services for SAP clients. We value the expertise and excellent reputation that 1st Basis provides, and we look forward to an exciting year ahead.”
About Security Bridge
SecurityBridge is an SAP Security Platform provider, developing tools to extend the SAP ecosystem. The company takes a radically different approach to traditional security tools, believing SAP applications and custom code will be infiltrated no matter how diligently security hygiene is applied. In response to this belief, SecurityBridge created the world’s only natively integrated real-time solution for constant monitoring. Powered by anomaly detection, the SecurityBridge platform can differentiate between accurate results and false positives so that security teams can better focus on real issues. For more information, please visit securitybridge.com.
About 1st Basis
Founded in 2006, 1st Basis provides affordable, high-quality SAP Basis managed services at SAP Best Practices standards. For over a decade, we have kept that promise. We leverage our unmatched expertise to keep our customers’ SAP systems secure, stable and highly available. For more information, please visit www.1stbasis.com.
Video Conferencing is the COVID-19 ‘New Normal’
In the case of videoconferencing during the time of COVID, necessity is the mother of adoption as much as invention. Video Conferencing platforms have been around for a while, and they’ve been used in business quite a lot, but the pressure to continue day-to-day operations as much as possible while preventing the spread of the Coronavirus and protecting the health of employees has spiked their popularity for day-to-day use in all kinds of business settings.
Before COVID, many businesses were reluctant to have their employees regularly work from home. Management was concerned that they would not be as productive as in a normal work setting, where they could be monitored. They were concerned that employees working from home would be easily distracted and spend more time, unproductively. Studies have shown that both assumptions are probably untrue, but managers were reluctant (with some notable exceptions) to try working from home in large numbers without a significant reason to attempt such an experiment—COVID-19 has given them that reason.
Working from home has significant advantages, however. People in densely populated areas save themselves the expense and aggravation of tedious commutes to and from work, which saves a lot of psychological wear and tear. In cases of bad weather, provided broadband stays up, people can still ‘get to work.’ In many cases, it is the workplace itself that offers more distractions than the home. From home, you are much less likely to spend time socializing with co-workers or being interrupted by micromanaging supervisors. Getting a meal is easy (maybe too easy) rather than a one-hour lunch break. During break times, employees can attend to personal business, freeing up more of their time after their work is done for the day; a win-win.
The past decade has seen a lot of government policies and directives aimed at pushing people into cities to minimize urban sprawl and other negative environmental impact. The severity of the pandemic in urban areas is causing some people to reconsider living in cities and the emergence of work-from-home options afforded by videoconferencing and other platforms and systems for tracking, aiding, and integrating workflow, may fuel a reversal of this push. Less commuting means less congestion and pollution. Less time spent at physical sites means less need for expensive of offices.
Many of the IT tools that companies rely on work much better on non-portable hardware than on highly portable devices such as smartphones. This is one area of opportunity for IT developers. Improvements to predictive text and voice-to-text transcription will be key to this next migration. Videoconferencing is also limited in conveying people’s full presence, though it is certainly closer than text or audio-only. Some developers are working to move meetings from video conferencing platforms to virtual reality platforms. What seemed a futuristic pipe dream when Princess Leia was imploring Obi-Wan for help in an R2-D2 holographic projection may soon be coming to the virtual business space—sans the droid.
Let’s hope that COVID-19 is in our rearview mirror soon, but some of the changes it has wrought to how we work are certain to persist.
Security Concerns with Zoom and SAP
This is a companion piece to our other post on TikTok and potential security concerns with SAP. The geopolitical background issues are the same. China has a history of corporate and other espionage and a history of inserting its interests into the affairs of corporate entities, even technically private ones, at home. It is also the world’s most developed surveillance state, and recently, it and the United States have been increasingly at odds on a variety of issues.
Unlike TikTok, Zoom is not headquartered in China. Its owner, Eric Yuan is originally from China, but moved to the United States in 1997.
The Rise of Zoom
As most people now know, Zoom has been one of the greatest beneficiaries of CoVid lockdowns, seeing an almost twentyfold rise in usage over the past year. People isolating to slow the spread of ‘the virus’ have flocked to the platform for social and work purposes. The subsequent discovery by many workers (and some businesses) that much of what they do doesn’t depend on their being on-site has contributed to its continued expansion. Lots of educational institutions and social services and primary medical services have adapted to employ video as well.
The ease with which Zoom can be accessed and its full but intuitive feature set have spurred its widespread adoption, but that same broad suite of functionalities and ease of access have made it a broad target for hackers and other online bad actors.
The Problematic History
There have been a series of security issues with Zoom that are, perhaps, not surprising given the nature of the platform. Early on, many people using the platform were declining to use the password option, which gave an opening to bombers and grifters to bust in to meetings and wreak havoc. In one infamous example, a major university’s graduation, held online because of CoVid, was interrupted with racial invectives. The platform has been used for information scraping, malware injection, password stealing, and just about anything else a hacker might want to do. At one point, Zoom partnered with a Chinese firm to generate cryptographic keys, which threw up warning signs among politicians and security experts. Additionally, Zoom agreed to de-platform several well-known Chinese dissidents at the request of the Chinese Communist Party (CCP).
The list of exploits and possible vulnerabilities is very long, and you can read about them in depth in this excellent compilation at Tom’s Guide. The most problematic thing about Zoom, though, has been its lack of candor at times, for instance claiming to have inaugurated end-to-end encryption when it hadn’t done so. In response to various criticisms, Zoom has taken steps to mitigate its vulnerabilities, but very few of these steps seem, from an outside perspective, to have been taken proactively. A variety of alternatives to Zoom are available. If you share sensitive information on such a platform, you might be better off to look elsewhere until Zoom has established a more robust security track record, and this is probably more likely to be true of businesses that employ SAP services than those that do not. Zoom’s vulnerabilities make it not just problematic in view of the Chinese, but also corporate espionage, sabotage, and sundry black-hat exploits. As with TikTok, your vulnerability profile will depend entirely on the potential value of the information that you share to those who shouldn’t have it.
TikTok Security Concerns and SAP
Geo-Political Background
Recently, the Trump administration has kicked around the possibility of banning the use of TikTok in the United States. This comes against a backdrop of increasing tensions between the United States and China due to China’s emergence as a military and economic rival superpower, and exacerbated by what some in the West view as China’s military and economic expansionism against a backdrop of long-time institutional infiltration, technological and other espionage, and unfair trade practices. Recently, relations have been further strained by internal Chinese crackdowns on civil dissent, reneging on the conditions of its treaty with Great Britain regarding the status of Hong Kong, and what some (though not all) view as blame for not having blown the whistle earlier about CoVid-19, which has had devastating health, social, and economic consequences around the globe.
India, which has recently clashed with China above the disputed Galwan Valley between China and Indian-administered Kashmir, has banned the popular short-form video plus sound application. There have been rumors, though denied, that Australia and the Philippines might also follow suit. Both of those nations have been alarmed by Chinese expansionism in the South China Sea.
Does TikTok Pose a Danger?
Does the application pose a danger? It’s hard to say. Like most such applications, new versions often are filled with security issues that need to be patched, and TikTok does a comparatively decent job of doing so. The company that owns TiKTok, ByteDance, is headquartered in China, but not ‘owned’ by the government per se. ByteDance swears up and down that it would never convey any user information to the Chinese government, but the rights and responsibilities of ‘private’ corporations in China vis-a-vis the government are more . . . negotiable, let us say, there than they are in the West.
At present, there’s no reason to believe that TikTok collects any more information than other ‘free’ social media applications, such as Facebook and Twitter, which monetize metadata from their users to target ads and such, but following revelations of what Cambridge Analytica was able to infer from access to Facebook’s information during the 2016 election, there is some concern about how China might use such information for similar purposes (or worse) such as: wargaming, propaganda/disinformation and election meddling. We have already seen that they take a very aggressive line against their own citizens at home and abroad who use online platforms to criticize the government, and like the Russians they seem to be cultivating their own troll farms.
With Regard to SAP Users . . .
The problem here is that many SAP users are companies whose information is not only valuable to themselves, but potentially also to others. One of the things that TikTok was criticized for was maintaining access to clipboard information. They were criticized, when found not to have fixed the problem. They excused the delay by saying that there was a conflict with the spam filter. Theoretically, a government with access to such information might leverage it either through simple data mining or blackmail. A surveillance state such as China might exploit or introduce backdoor methods of accessing data on devices with the TikTok application, as they are said to have done with Huawei, their 5G cellphone network.
So there is no clear-cut answer on whether to prevent employees from using TikTok on devices that also might be used for work purposes. As a precaution, and partly because of the conflict, India has banned certain Chinese apps (including TikTok). The State Department would like Microsoft or some other US-based company to buy it. They have given a deadline before it is banned. For the moment, we advise caution.
