Building High Performance Teams (3 X 3 Framework)

 

When we talk about building a high performance teams, it will always be revolving around these five key characteristics. Trust, Clear Communication, Defined Roles and Responsibilities, Engaged Leadership and Collective Goals.

Trust
This is the key factor that differentiate between the high performing team over the average one. With Trust, they will be more comfortable in taking risks and working through challenges and conflicts positively

Clear Communication

High performing teams find ways to streamline and optimise communication. They know when to call, when to IM, when to email or even pop by your desk. They may also use technology to stay organised and track progresses.

Defined Rules and Responsibilities
Clearly defined roles and responsibilities eliminates confusion. when team members knows their roles and responsibilities well, this prevent conflicts, which will maximize productivity. 

Engaged Leadership
Being Engaged is not micro-managed. It is about providing direction and full support to help the team to succeed. An engaged leader provide positive working environment thru regular communication and building trust and respect among the team.

Collective Goals
Even though each team member has their own responsibilities, but they all are collectively working towards one main goal and contributes to the overall success. High performing teams will step in to help each other to ensure all goals are met.

3 X 3 Framework

Recently, I came across a interesting idea on building high performing team. it changes my understanding on how goals and roles should be defined and how a high performing team should be.

It uses a 3 x 3 framework.There are three foundations that team needs have in place - Goals, Roles and Norms. Then the three elements of ongoing reflection and change - Commit, Check and Close, to maintain peak performance.

Goals
This is main direction for the team. Getting agreement on where the project goes and what to accomplish. Importantly, each team member should have a personal "what's in it for me" connection to the goal.

Roles
Being clear about who is doing what specific activities and how these tasks overlap. In a real team, there should be overlap of tasks. If there are only parallel activities, we only get a "co-acting group" not a team. 

Norms
Norms are ground rules in areas such as information-sharing, decision-making, and conflict-resolution. Others common norms such as respecting each others, avoid hidden agendas are also important.

The ongoing 3 steps function:
Commit - Have good conversation with the team. Getting the team to commit to the explicit goals, roles and norms. 

Check - As our day to day working in multiple teams and/or projects, there are too many distraction, we tend to lose focus and slowly drift from the goals, roles and norms. Check in from time to time. Revisit the committed goals, roles and norms.

Close - As we revisit the goals and commitment, we may find misalignment among the team. We will work to close the gap. Taking small steps on targeted and specific changes. 

Some advice for the high performing team,
- Have good conversations among the team.
- Focus on a few things rather than a lot of things. Teams get overwhelm.
- Paying attention on whats going on in the team.

Common problems
- Relying too much on one person.
- Focus too much on a plan but not thinking about the execution and organising people around that plan.
- Not paying too much attention on individual role.

Finally , leader of high performing team should create a "Psychological Safety" environment, which member will feel "safe" to share their thoughts, able to be creative. To create this environment, you need to build trust in the team, having good one on one conversations, be a good listener and by showing empathy, showing that you care.

Related Articles:
- Forbes: 5 Key Characteristics Of High Performing Teams 
- Forbes: 'Committed Teams' Captures Spirit Of Wharton Teamwork Lab

How to be a CISO?

Being a Certified Information Systems Security Professional (CISSP) and Certified Infirmation Security Manager (CISM) for more than 10 over years. I have been wondering recently, on the quality of being a Chief Information Security Officer (CISO). 

There are many aspects and view on how to be a CISO. EC-Council, one of the leading IT Security training and certification organisation, provide a training and certification program called the Certified Chief Information Security Officer - C|CISO. It is based on the EC-Council CCISO Body of Knowledge, which covers five Information Security Management Domains: 

• Governance and Risk Management 
• Information Security Controls, Compliance and Audit Management 
• Security Program Management and Operations 
• Information Security Core Competencies 
• Strategic Planning, Finance, Procurement and Vendor Management

Whereas (ISC)2 seems to have a more interesting view. They have the idea of CISO Mind Map, which contains seven phases.

It start off with the Architecture, the Framework, the Risk Assessments and the Governance. Then the Threat Intelligence and Vulnerability Assessments fits into the Security Operations and finally to have continuing Education.

Architecture

It is the foundation for the CISO. He got to make sure he understand the enterprise information architecture. How is the network been designed (e.g. where is the DMZ. Are the firewall and control place correctly?). He have to make sure all the part in the architecture fits well and defensible.

Framework

Framework is useful to help in designing the architecture. There are many different types of framework, from ISO to NIST. Each framework helps to serve a specific purpose, which guide and protect your infrastructure. CISO need to find the right frameworks that fits the architecture in place.

Risk Assessments and Governance

CISO going to be identifying risks, eliminating or mitigating them, together with the Governance Committee. CISO need to based on the architecture, the frameworks, the control objectives and the use of risk assessments to present a clear picture on how secure they are, to the Governance Committee.

Threat Intelligence and Vulnerability Assessments

Threat intelligence constantly feeding from multiple sources. Vulnerability assessments are using those threats and make determinations if there are really a problem. CISO need to work on the taken threat intelligence, the vulnerability assessments to risk assessed and come to conclusion.

Security Operations

CISO needs to have great business impact analysis. The foundation of that is to make sure business continuity and disaster recovery are well taken care of. Security Operation also includes the managing of critical systems based on their threat intelligence and vulnerability assessments.

Education

CISO needs to present education budget. He need to show that education is not optional, highlight why his team needs to have certain courses, why these certifications are important and why constant training is required. 

Related Links:

EC-Council’s Certified Chief Information Security Officer Program

(ISC)2 - Creating Your Path to CISO

What is Attack Surface Management?

Attack surface is about all possible security risk exposures, especially all internet-accessible external assets that adversary could discover and gain foothold into your environment.

Attack Surface Management (ASM) is an emerging category of solutions that use an external attacker’s perspective to help organizations better manage these type of risk exposures. 

These include:

• Continuous discovery and Inventory of unknown assets (Cloud and shadow IT)
• Classification and Prioritization of risk and vulnerabilities 
• Continuous monitoring of assets and Threat Intelligence 

Is ASM a Asset Management? or is it Vulnerability Management?
It is actually more of a Risk Management with the following Use Cases.

• Identifying and visualizing external gaps
• Discovering of unknown assets
• Attack Surface risk management
• Risk-based vulnerability prioritization
• Assessing Mergers and Acquisitions (M&A), and subsidiary risk

Evaluating of Attack Surface Management 

SANS recently released a guide on evaluating ASM solution. the guide discuss about 2 major requirements: Product and Operational requirements

Product requirement

• Automated Discovery - An advanced algorithm capable of building a map of assets with minimal input and limited false positives.
• Continuous Monitoring - Ability to detect change by frequently scanning the attack surface. When an asset is removed, the ASM solution should maintain the information in the database for historical purposes.
• Risk Based Management - Create and maintain a risk score for each asset that combines the ASM provider’s external threat assessment with user provided information on relative business value, impact and remediation status.

Operational requirement

• Alerting - Ability to monitor and alert on changes.
• Enterprise Management - ASM solutions should include basic enterprise management capabilities that enable large teams and organizations to operationalize the solution.
• Interoperability & Integrations - Supports third party integrations and custom development using a provided API.

Related Link:

The SANS Guide to Evaluating Attack Surface Management

IPv6 InSecurity. Is your company ready for IPv6?

Everybody is announcing that IPv4 addresses are running out. Countries and major IT companies (such as Google) are encouraging others to move into IPv6. IPv6 have always been portrayed to be more secured than IPv4.

Image from Google

But in the recent talk by van Hauser on "IPv6 Insecurity" in HITB, he share that there are huge grow in the number of vulnerabilities found related to IPv6 in recent years. Several times more than IPv4.

So is IPv6 mature/stable enough? Do you think companies are ready for the change to IPv6? Should we be encouraging our companies to make the change now? These are the questions that I think we need to ask ourselves as a security professional.

Beside worrying about the readiness of IPv6, van Hauser also highlighted the importance for companies (even those in pure IPv4 environment) to be aware and understand the threats from IPv6. Desktop and network devices these days may already support IPv6 and may enabled by default. Attackers may use these "channel" to target companies in IPv4 environment and bypass their network protection (e.g IPS), which is not IPv6 aware.

Related articles:
- HITB slides: Marc Heuse - IPv6 Insecurity Revolutions.pdf

HITB playing AC/DC concert

While waiting for the next speaker during the HITB (Hack In The Box) Conference in Kuala Lumpur, the screen in the conference hall starts to play the song "ThunderStruck" by AC/DC (shown in the video below).



The music video is actually part of the introduction for the presentation titled "Behind Enemy Lines" by Mikko Hypponen of F-Secure. His speech talks about the various cyber "enemy" (Types of hackers) and their motives. He also share with us some of the ways to defend against this "enemy" and avoid being the target.

You can download the slides from HITB website here

The Pwn2Own 2010 Contest

The Pwn2Own 2010 organized by DVlabs was over. But there are some interesting information to share.
(Extract from "10 Lessons From The Pwn2Own Hacker Contest")


Google Chrome the Most Secured?

"The only browser that survived Pwn2Own this year was Google Chrome. This led to numerous news reports like this one suggesting that Google's browser was somehow more secure than the others. This is far from the truth. In fact, the vulnerability that caused the iPhone's downfall was in the WebKit engine and also affected the Google Chrome browser. Chrome's sandbox was also held up as a major CanSecWest roadblock but there's already scuttlebutt circulating that at least two security researchers have found a way to break out of the Chrome sandbox. Keep in mind that the iPhone has a sandbox that didn't help much when hackers hijacked the SMS database at Pwn2Own.

Survival at the Pwn2Own contest simply means that researchers weren't motivated enough to give up their vulnerabilities/exploits in exchange for a smartphone and cash prizes. The iPhone survived in 2008, didn't it?"


IE 8 seems to be Most Protected Browser.

"Despite the survival of Google Chrome and the fall of Internet Explorer 8 (running on Windows 7), all the browser hackers at the contest maintained that Microsoft's browser is by far the most difficult to exploit. For starters, IE 8 is the only browser to fully -- and properly -- implement ASLR. Peter Vreugdenhil, the researcher behind the successful IE 8 hack, needed two different vulnerabilities and several exploitation tricks to get it to work. However, because IE is the world's most widely deployed browser, it will continue to attract the attention of hackers and malware writers. Security doesn't equate to safety."


Apple Safari still the Easiest to Hack?

"For the third year in a row, security researcher Charlie Miller successfully compromised a fully patched MacBook Pro machine with a Safari vulnerability and exploit. Despite Apple's best efforts at making it difficult to exploit the Mac OS X, Miller's exploits show that Safari is still easy pickings because it lacks the mitigations found in Microsoft Windows. For example, Safari does not implement ASLR properly and does not have a sandbox to limit the damage from a hacker attack."

Most Secured VS Cost Effective Security

Have an interesting discussion recently with krag Brotby (editor of the official ISACA CISM review Manual) regarding setting a high baseline and achieving Zero incident. It triggers the thought of Most secured VS Cost effective security.

In Security, most practitioners will try to set a high baseline to achieve zero incident. Getting various security products to protect all possible threats. Many of the times, standard security controls such as Firewall, Anti Virus, etc, were handling 95% of the incidents with about 20% of the total security expenses. The more sophisticated products and solutions such as SIEM, handles the remaining 5% but uses 50% of your total expenses and resource.

Instead of spending so much to handle the minority threats, they can sometime be manage by having a incident handling process to handle the 5% of incidents (which maybe 3 to 5 incidents per year). Majority of the budget and resource could be saved or for better use. It definitely is a good value proposition that will appeals to the management (especially during the economy downturn).

By having zero incident may also have "negative" impact to the management and staff. Management may be too comfortable with the security level and may not increase or may even cut future budget. Security staff may also be complacent on maintaining and improving the current security.

As new security issues emerge constantly, your current security controls will never be enough to maintain zero incident for your organization forever. New threats will be discovered. Additional budget and controls would be needed. Having a few incidents per year could be useful to keep the management and security staff on their toes. Management may also be more acceptable with new threats and staffs are more reactive to new security challenges.

FM200 in action

Most IT security professional should have heard of FM200. System administrator should have seen the FM200 caution sign (shown on left) outside the Data Centre.

If you happen to walk around your data centre, you might see several tanks of FM200 (like those shown below).

When i was working in the Government Data Centre many years back, i was told that it will cost me $20K if i accidentally triggers it.

So unless you have extra $20K to spare or that is a major fire outbreak in your data centre. You are unlikely to see FM200 in action. But i happen to come across this video that will not cost you $20K. :)

A Wolf in Sheep's Clothing

Got a chance to meet Michael Sutton in person. He is in town to give a presentation on "A Wolf in Sheep's Clothing: The Dangers of Persistent Web Browser Storage". He talks about the danger on Web application that uses Client-side storage, which getting common in web application using HTML 5 and Google Gears.

Abstract of his presentation:
As the line between desktop and web applications becomes increasingly blurry in a web 2.0 world, browser functionality is being pushed well beyond what it was originally intended for. Persistent client side storage has become a requirement for web applications if they are to be available both online and off. This need is being filled by a variety of technologies such as persistent cookies, Flash storage and Google Gears. While all such technologies offer great promise, it is clear that the vast majority of developers simply do not understand their security implications.

Researching a variety of currently deployed implementations of these technologies has revealed a broad scope of vulnerabilities with frightening implications. Now attackers can target victims not just once, but every time they visit a site as the victim now carries and stores the attack with them. Imagine a scenario whereby updated confidential information is forwarded to an attacker every time a victim interacts with a given we application. The attacker no longer needs to worry about timing their attacks to ensure that the victim is authenticated as the victim attacks himself! Limited storage? Cookies that expire? Not a problem when entire databases are accessible with virtually unlimited storage and an infinite lifespan. Think these attacks are theoretical? Think again. In this talk we dive into these technologies and break down the risk posed by them when not properly understood. We will then detail a variety of real-world vulnerabilities that have been uncovered, including a new class of cross-site scripting.

If you wanted to know more or looking for the presentation slides, feel free to download here.

Michael Sutton is a regular speaker in Security conference like BlackHat and Defcon. He is also the co-author of the book "Fuzzing: Brute Force Vulnerability Discovery" (which i happens to own one). I took the opportunity to get his autograph on my book (Shown below).

Slackware is it?

Heard from a friend recently about an incident that really make me wonder and decided to share. The story goes:

- An IT professional (likely to be an engineer) from a major System Integrator (SI) in Singapore ("Their job is SO Easy"), wanted to find out about the OS platform of a Appliance-based network device. So he contacted the project manager that is managing the device.

This engineer was informed that the Appliance is running on Slackware version x.x. But not knowing about Slackware and thinking that the project manager might have misunderstand his question, he requested the project manager to check on OS platform again.

That project manager repeat his answer and even provide the Slackware website for his reference. But he still stubbornly reject his answer. -

As an IT professional, it is normal for someone not knowing everything in IT (especially knowledge on area out of your specialized domain). Many IT expert and Guru that i know, will not look down (or make fun) on you if you admit that you don't know on certain technology or knowledge. In fact, most of them will share their experience and knowledge if you are keen to learn.

With information easily available in the Internet, just by searching from Google or Wikipedia, you can basically find information of almost everything. There is not reason for anyone (especially IT professional) for not able to find out on certain knowledge.

This posting is to advise fellow readers that never too shameful to admit that you don't know certain knowledge. As long as you are keen to learn and make effort to read up. It will be really shameful if you try to "smoke" (bluff) your way and spotted by others.

Anti Virus, can be "dangerous"

Recently, there are reports that AVG (anti virus) update deletes critical Windows XP file causing the system un-bootable.

Many users of AVG 7.5 and AVG 8.0 reported seeing a warning that the Windows system file 'user32.dll' was infected with the PSW.Banker4.APSA or Generic9TBN Trojans, with a recommendation that the file be moved to the program's vault and deleted.

With the file 'user32.dll' deleted/quarantined, Windows XP will no longer be able to boot up as it is a critical system file.

AVG has since admitted that the detection was a false positive. " Unfortunately, the previous virus database might have detected the mentioned virus on legitimate files. We can confirm that it was a false alarm," said a company spokesman.

A workaround under Topics 1574 False Positive user32.dll was published in their support website. (Shown on picture on the right)

Anyway, Anti Virus having false positive is not only unique to AVG. Major Anti Virus companies such as Symantec, Mcafee and Trend Micro also had reported to wrongly identity Windows system file previously. Some examples below:

- In May 2007, Symantec Anti Virus cripples thousands of Chinese systems when it mistakenly identify two critical Windows .dll files for malware (Related Article in "ComputerWorld: Symantec false positive cripples thousands of Chinese PCs")

- In September 2008, Trend Micro issued two anti-virus signatures that causes Windows DLL files to be quarantined. (Related Article in "ZDNet UK: Trend Micro gives false positive details")

- In October 2008, a faulty update from Mcafee led to an integral component of the Windows Vista operating system being falsely flagged as a trojan horse. (Related Article in "The Register: McAfee update classifies Vista component as a Trojan")


Related Articles:
- Vnunet.com: AVG update deletes critical Windows file

- The Register: AVG slaps Trojan label on core Windows file

US Election over but more Security lessons to learn

As the US election comes to an end,with Barack Obama being the first black president of United States, there are some interesting things that we can learn from this election.

Months before the election, there were already many concerns on the electronic voting machines. There were reports on "flipping votes" (marking a vote for a different candidate than the one selected) and interface that was misleading, which worried the security experts. These had lead to the push for better checks and audit on those voting machines.

The advises that were given to the voters were to double-check on their votes. When in doubt, not to be afraid to ask for help during the voting.

Beside the problem with the voting machines, there were also reports on ways or "dirty tricks" used to influence the result of the election. There were reports of automated phone calls, sms, email or even flyers intended to convince the receiver that they should vote the day after the election, or providing false polling venue so that they will miss the voting day and their chance to support the candidates (useful on those states that pro their opposition).

- An example of those email:
From: Office of the Provost
Subject: Election Day Update

To the Mason Community:

Please note that election day has been moved to November 5th. We apologize for any inconvenience this may cause you.

Peter N. Stearns
Provost
- End of email

- An example of those SMS:
"Due to long lines if you are voting for Barack Obama you can vote tomorrow"

"Due to long lines, all Obama voters are asked to vote tomorrow".
- End of SMS

While some trying to influence the election results, others were using this election to send out malwares. Emails that were claiming to contains Obama's speech or interview were found to be spamming over the Internet. Video or download links will lead users to download the malware while trying to click on the speech or interview.

Currently the malwares that were found from those email were a keylogger that will sends the stolen keystrokes to the Ukraine and a trojan downloader that will automatically download more malwares into your system.

- An example of those email
From: news@cnn.com
Subject: Barack Obama wins

Barack Obama Elected 44th President of United States

Barack Obama, unknown to most Americans just four years ago, will become the 44th president and the first African-American president of the United States.
Watch His amazing speech at November 5!

Proceed to the election results news page>>

2008 American Government Official Website
This site delivers information about current U.S. Foreign policy and about American life and culture.
- End of email


Every election is not as simple as what we think. There are always someone who is trying ways to manipulate the results, trying to make use of the situation for their own benefit. Just don't blindly focus on the results. Be mindful of others that is taking advantage of the situation.

Related Articles:
- Concerns continue to shadow e-voting (Security Focus)

- Election Hoax Sent Via D.C. Based E-Campaign Group

- US Presidential Malware - Barack Obama Interview Lure (WebSense Alerts)

SSL is not everything

Secure Socket Layer (SSL) or Transport Layer Security (TLS - a standard protocol by IETF) is a cryptographic technologies used for the protection of data transmission streams by encrypting the communications streams between two end points (the client and the server). This provides confidentiality of the communication session, typically used in Web services such as online banking. The term HTTPS is commonly used to referred SSL/TLS implement on web services (which both maybe of different protocol).

Besides providing confidentiality (by having encryption and authentication), it also provide integrity, which ensure that no alteration to the data during transmission.

I wrote this posting is to share on the misconception on SSL/TLS by many people including IT professional. Below are some of the common misconception:

- "Web servers and their data are secure as long as they use SSL"

- "With SSL, applications and web servers are not susceptible to known exploits or vulnerabilities"

The fact is that using SSL don't protect you against systems and applications vulnerabilities. It only protects the data transmission. In fact, even SSL have vulnerabilities and exploits found on their previous versions. Don't blindly implement SSL and thinks that everything is secured.

Related Links:
- RFC2246 on TLS protocol

- Wiki on TLS/SSL

Wireshark 1.0.4 is out

Wireshark (formerly known as Ethereal) had released a new version (1.0.4). The free and most popular network protocol analyzer, among IT professional, had fixed on several security vulnerbilities and program bugs in this new version. No updates on the features but some improvement on the protocol supported.

The details on the updates and patches can be found in this URL - http://www.wireshark.org/docs/relnotes/wireshark-1.0.4.html

This release can be downloaded from their official Website - http://www.wireshark.org/download.html

Can i "undelete" my files?

Recently i did a simple survey among my friends, asking them whether files/data deleted from the computer can be recovered? Most of them (including non-IT profession) knows that it is possible to recover deleted data. They claim that they got to know about it from the "Edison" incident.

But there are still one or two of them unaware that deleted data may still be recoverable (including a IT application analyst with many years of working experience). So i decided to write this post to share some of my knowledge on "file deletion/recovery" (known as Data remanence).

Most Computer system (Operating System, e.g Windows) do not actually remove the contents of a file when it is deleted. Instead, they simply remove the file's entry from the file system directory. The data of the file remains on the storage medium (harddisk, flashdrive, floppy or etc). The data will remain there until the operating system reuses the space for new data. Nowadays with very large harddisk in our system, the space may not even reuse.

Several questions were asked by them during the survey such as "How can we recover those deleted files ?", "Any recommended free tools ?" and "Any ways to delete the files permenantly ?". So below were my answers to those questions.

File Recovery Tools
There are many file recovery tools available in the Internet, some are free and others require license ($$$). I have found 2 Windows-based "freeware" tools (PC Inspector File Recovery and Recuva) to share with you all. PC Inspector File Recovery have better features and personally recommended for IT users, whereas Recuva will be more simple and user friendly.

CONVAR PC Inspector™ File Recovery 4.x - a data recovery program that supports the FAT 12/16/32 and NTFS file systems. Some "special" features -
> Finds partitions automatically, even if the boot sector or FAT has been erased or damaged
> Recovers files with the original time and date stamp
> Supports the saving of recovered files on network drives
> Recovers files, even when a header entry is no longer available

Piriform Recuva - a Windows utility to restore files that have been accidentally deleted from your computer. This includes files emptied from the Recycle bin as well as images and other files that have been deleted by user error from digital camera memory cards or MP3 players. It will even bring back files that have been deleted by bugs, crashes and viruses!

Secure Deletion
To permenantly delete your data/files, you will need to do secure deletion (or data sanitization). I have talk about this in my previous posting "What is data sanitization? - on April 6 2008". Please refer to this posting to learn more about secure deletion and the tools that i recommended.

Related Posts:
- Edison Chan Sex Scandal. Lesson to be learned! - on February 17, 2008
- What is data sanitization? - on April 6 2008

What is Web 2.0??

Many people like me have heard about Web 2.0 somewhere but not really know what it actually is? Is it a new web programming language or a version number of a program?
I got to know more about it after a recent seminar on Web security.

Web 2.0 is actual a concept that uses Internet technology and Web design to enhance creativity, information sharing and collaboration among users.
Web 2.0 technologies enable Web architectures greater access to data and functions. Web 2.0 applications should not be understood as a new technology, but a new use of old technologies.

Web 2.0 websites allow users to do more than just retrieve information. They can build on the interactive facilities of "Web 1.0" to provide "Network as platform" computing, allowing users to run software-applications entirely through a browser. Users can own the data on a Web 2.0 site and exercise control over that data. These sites may have an "Architecture of participation" that encourages users to add value to the application as they use it. This stands in contrast to very old traditional websites, the sort which limited visitors to viewing and whose content only the site's owner could modify. Web 2.0 sites often feature a rich, user-friendly interface.

Some misconception that Web 2.0 is AJAX because many Web 2.0 sites rely heavily on AJAX. But there are many technologies that supports Web 2.0, to list afew:
- AJAX (Asynchonous Javascript and XML)
- XML (eXtensible Markup Language)
- JSON (JavaScript Object Notation)
- SOAP (Simple Object Access Protocol)
- WSDL (Web Services Description Language)
- RSS/Atom feeds
- Flash, ActiveX

Web 2.0 have led to the development and evolution of web-based communities and hosted services, such as Google, Linkin, MySpace to name afew.

What is data sanitization?

I always wanted to write about secure data deletion (or data sanitization), especially when we read news on sensitive data (e.g Credit card numbers) been collected from 2nd hand harddisks and discarded system.

Many people thought that when they empty their "Recycle Bin" in their system, all the data are totally lost and cannot be recovered. The data was only not accessable by the OS but it can be easily recovered using Data recovery software (easily found in the Internet). When you empty the recycle bin, the data was still on the physical harddisk. The data were not "erased", only mark as "overwritable" by the OS and will only be over-written when new data need to be saved in the Harddisk.

Method of Secure Deletion
- Overwriting
It is the most common way of securely deleting data these days. It is commonly known as data wiping. Basically, this method simply overwrite the data with a pattern of all zeros or ones.
But as more and more advanced data recovery and forsenic methods used, simply overwriting with ones or zeros was not effective. More patterns of overwriting were used. Beside the alternating patterns of using ones and zeros, patterns uses the complement, bitwise inverse and NOT of the existing data were also used.The Gutmann method, which uses 35 patterns to overwrite data.

The more patterns you used, the more secure the deletion will be. But more time will also be needed to complete the "deletion" as the system need to overwrite the same amount of data the number of times (patterns).

Previously, overwriting is a DoD (US Department of Defense) acceptable method of secure deletion for magnetic media. DoD 7 passes (patterns) method was widely followed as a best practise. But due to the problem of media degration and errors, overwriting on some areas of the media may not be possible. On Nov 2007, overwriting is no longer accepted as a D0D secure deletion method. Only degaussing or physical destruction is acceptable.

Note:
To recommend a program to securely delete a harddisk, i will recommend DBAN (Darik's Boot and Nuke). It is an freeware (based on open source project), which supports DoD 7 passes and Gutmann method. It can be boot up from floppy, CD or flashdrive. It can also work on IDE, SCSI and SATA harddisk.

- Degaussing
It uses magnetic field that makes the data in the magnetic media to be unreadable. Degaussed harddisks are normally not operational as the magnetic field will erase the low-level formatting(servo control data) that is created during manufacturing.

- Physical Destruction
Physically breaking the media is the most straight forward way of destroying the data. But in order to securely destroying the data, grinding and shredding should be properly carried out. Incinerating of the media can also be used as a way to physically destroying of data.
Using of corrosive chemical, such as acids, can also be used.

- Encryption
With FDE (Full Disk Encryption) harddisk getting popular in the market, encryption became the fastest and probably the easiest way of securely "delete" all the data in a harddisk.
Basically how it works is that since the harddisk is fully encryption, by simply "overwriting" (secure delete) the decryption key, it is almost "impossible" to recover any data from the harddisk. The time taken to overwrite the decryption key is much faster than overwrite the whole harddisk.

Some recommended software (Overwriting):
- Eraser is a secure data removal tool for Windows. It supports DoD 3/7 passes and Gutmann method. It can also be scheduled to securely delete files/folders.

- Darik's Boot and Nuke is used for secure deletion of the whole harddisk. It is an freeware (based on open source project), which supports DoD 3/7 passes and Gutmann method. It can be boot up from floppy, CD or flashdrive. It can also work on IDE, SCSI and SATA harddisk.

Part 1: Two-Factor Authentication?!?

Recently, I was reading an article on One Time Passwords in an IT security magazine called hakin9, entitled "One Time Passwords - New Dimensions in Security". Details of the magazine can be found at http://hakin9.org/. I decided to share some the contents in the article and example of what two factor authentication is about in Singapore context. This will be a simple two parts about two factor authentication.

As most Singaporeans may have experienced by now with Internet banking, there's a secure device that displays a 6 digit numbers that is required each time you logon for Internet banking. An example will be the DBS iB secure device as shown in the picture (compliments of DBS). This will be an example of a two factor authentication where it requires both a password/PIN by the user and the unique 6 digit numbers shown on the DBS iB secure device. I will now share a bit further into the technology behind this simple act of login for Internet banking and how it adds another layer of security for people.

Traditionally, a static password and the username have been used to access resources available. This is no longer sufficient in today's environment and has led to better authentication methods for both online and offline resources. Thus, One Time Password (OTP) technology was used to generate and display a unique password which is only valid for a while was added for authentication. Verification of user credentials and access to resources are done in a safe, simple and efficient way using OTP technology.

The idea of OTP is the brainchild of Leslie Lamport. There are basically two main types of one-time passwords now: the first type is based on time-synchronization between the authentication server and the client providing the password, and a second type where the new password is based on a challenge (e.g. a random number chosen by the authentication server or transaction details) and a counter instead of being based on the previous password.

For the next part, I will show examples of OTP products and their suppliers with an example of the process in OTP generation.

References:
hakin9 Issue2/2008 "One Time Passwords - New Dimensions in Security" by Rajesh Mago
http://en.wikipedia.org/wiki/One-time_password

Edison Chan Sex Scandal. Lesson to be learned!

Last week, the hottest news was seems to be Edison Chan Sex Scandal. TV news, newspapers and various magazines were reporting on it. Colleagues in the office and people in the coffee shop were also talking about it.

For the benefit of those who do not know about this news, photographs of Edison Chan(famous Hong Kong actor) in bed with several top female actresses and singers were circulated in the Internet. According to reports, those photographs were illegally copied from Edison's laptop while it was being serviced. Rumours that the culprit had attempt to blackmail Edison's management company but failed.

I decided to highlight this scandal because i think that there are afew lessons that people can learned from it. As mention previously in my blog ("Mobile Warrior - Part 1, Disk Encryption" by AhTan), everyone should encrypt their important data in their computers. Beside sexy pictures, sensitive documents (such as company proposal, financial data) and personal information (such as Bank accounts number) should be properly encrypted.

Beside properly encrypting your important data, those data should also be properly backup (previous acticle "Mobile Warrior- Part 2: Backup, Backup"). With important data properly encrypted and backup, you will not have much worries that your data be stolen or lost when sending your laptop for servicing.

There were also reports that several spoofed and virus emails, claiming to contain Edison's sex photo, were found "tricking" curious users to download malware. Those emails contains links to "Edison's Sex pictures", which actually lead to websites containing malwares. Those "malicious" links were also found in online forums discussing on Edison's scandal.

Curiosity killed the cat, this is not the first time "hackers" are using "famous" topics (e.g Paris Hilton Sex video, Asian Tsunami video) to trick users to download malware. So be careful when trying to download files from untrusted source.

Related Reports:
- Sex scandal rocks Hong Kong
- AusCERT National Alerts - Tsunami Warning Fraudulent E-mails and Malicious Web Sites

How to get into IT security?

I was reading a very interest column "Skills for the Future by Don Parker," http://www.securityfocus.com/columnists/464/1

It reflected a lot of the security folks that I knew including myself on the road being a IT security professional.

There were not many formal courses, firewall then is still in its toolkit level. Checkpoint Firewall-1 was just starting out. Kiddies were not so simple.

Things had changed so much and entries are much easier but the fundamentals are still the same. It takes the same hard work and attitude to be good any fields, IT security or not.

Well, you can trying getting into IT security but you will need more than just some CCSA or CISSP to know your stuff. So start getting down your nose to the floor and understand those packets flying around.

Sorry, not the red packets for Chinese New Year. Cheers.