Report-back: Infosec user group meeting on 27 October

If there was one message that came through loud and clear at the Information Security Group of South Africa (ISGSA) meeting on 27 October at the SITA head office in Pretoria, it was that simple, inexpensive methods can go a long way to reducing the risk of security breaches in companies.

Summary of presentation:

1. Awareness is key

Mike van der Walt, an Information Security Consultant from First Rand, spoke on awareness, which he said was critical in the battle for security.

"Awareness, in the security context, refers to a learning process that changes individual and organisational attitudes and perceptions to realise the importance of security and the adverse consequences of its failure. Awareness is not training, but rather a presentation or briefing. Awareness relies on reaching a broad audience through marketing and attractive packaging techniques," said Van der Walt.

In America, he pointed out that the top three dollar losses in 2005 from cyber crime came from viruses, unauthorised access and theft, which can all be reduced by increasing awareness. It`s therefore not surprising that user awareness, training and education came in at number two on the top 10 information security issues of 2004.

Whether by posters, weekly newsletters, videos on security or more seminars, Van der Walt said the important security messages needed to be communicated to employees.

"To do this, you need to keep the audience`s attention, appeal to the target audience, keep communication simple and memorable, encourage feedback, reflect on current issues, give credible information to users, repeat information and allow variety," he explained.

In order to drive the security message home in organisations, Van der Walt said there needed to be buy-in from exco level, a constant drive by security officers and a clear, repeated message.

"Everyone should understand the role they play in securing an organisation, from the top to the bottom. This is a team effort and all the team players must know the game plan. This is the power of a security awareness programme," he concluded.

2. Ensuring Enterprise Security from the Inside Out: Network Forensics and Incident Response

The second speaker was Adrian Culley, technical manager for Guidance Software and a former member of the Scotland Yard Cyber Crimes Unit.

Culley spoke about the importance of standards in dealing with information in an incident response.

Referring to the American National Institute of Standards and Technology (NIST) Computer Security Incident Handling Guide of 2004, Culley said there were a number of key elements in dealing with data.

"There needs to be an immediate response to the incident; an initial snapshot of the target machine and the investigation must be minimally invasive and therefore affect nothing on the machine. During the investigation, forensic hard drive acquisition and analysis must be done with the latest technology, which must be court approved, and the data must be maintained in a manner acceptable to the court. Lastly, one of the most important parts of the investigation is that volatile data in the RAM of the machine must be captured," he said.

"There are a number of principles which need to be applied in an investigation," continued Culley. "Firstly, no action taken by law enforcement agencies, or their agents, should change data held on a computer or storage media, which may subsequently be relied upon in court.

"Secondly, in exceptional circumstances, where a person finds it necessary to access original data held on a computer or on storage media, that person must be competent to do so and be able to give evidence explaining the relevance and implications of their actions.

"Thirdly, an audit trail or other record of all processes applied to computer-based electronic evidence should be created and preserved so that an independent third-party could examine these processes and achieve the same result.

"Lastly, the person in charge of the investigation (the case officer) has overall responsibility for ensuring that the law and these principles are adhered to," said Culley.

3. Specific policy can drastically reduce spam and virus attacks

While virus protection and spam can be a major headache, SITA says these threats can often be countered in an organisation without increasing spending on information security.

Sampie Pretorius, SITA Chief Information Security Officer, says SITA managed to reduce the number of viruses infecting users` machines by over 90% in the last six months.

"For many companies, the security threat is believed to come from outside. In SITA`s case, we`re also connected to the whole of government - there, different people are connecting internally to the government network all the time. Therefore, SITA has the challenge to manage and to protect its own internal network from viruses and exploits.

"SITA implemented a policy to lower virus attacks by addressing the source of the problem. We reduced users` access rights and completely stopped resource sharing on workstations by uninstalling the file and print sharing service (among others). Along with that, we started publishing `top scorers` in an internal communiqu'es," he says.

"This helped to reduce the amount of infections as show in the monthly reports." Pretorius says when controls were reversed, the number of virus infections escalated, when they were re-applied, the number of infections decreased once more.

These measures helped to increase bandwidth availability by approximately 75%, thereby raising the network`s performance to about 98% availability, Pretorius says.

"By following SITA`s example, government will be able to save at least R2.5 billion per three-year cycle, by implementing a policy like this across government departments. In doing so, information security justifies its costs," he says.