Information Security Tips from Westfield Insurance

Great Browser Add-ons for Better Privacy and Security

Have you ever dabbled in Firefox, Chrome or Opera web browsers?   These are all popular alternatives to Internet Explorer (IE).

Firefox (FF) burst onto the scene a few years ago as a vibrant successor to the aging Netscape communicator. What made Firefox unique is that, unlike the largely monolithic structure of IE, Firefox is built in layers like an onion.  There is a small kernel of basic browser functionality and then some default outer layers that give it the familiar FF look and feel.  But because of this onion-like structure, and because it is open-source software, users that had the technical skills could modify just about anything else about it!  By far the most popular way to modify it was to add visual themes to change the shape and location of buttons and the overall color scheme.  The next most popular modification was so-called add-ons.   Add-ons change the fundamental way the browser works and, for our purposes, how security and privacy aspects function.

On behalf of their end users, security-oriented developers knew that browsers are one of the primary conduits for malware to get onto and take over systems and their contents.  But with FF’s architecture they realized they could enhance browser security by leveraging the fact that add-ons “have dibs on seeing” incoming web site content as it comes into the browser kernel!  Thus, add-ons could give the user back control over their privacy and security.  As always – these add-ons do cost a little more in terms of user attention to their configuration and alerts.  But such is the price of increased control.  By and large the suggested add-ons below do an exemplary job of letting users tune them so security and privacy is improved without being overous.

So, here are some of my favorite FF add-ons that will raise your awareness of all things security and privacy on the web:

LastPass – truly superior, genuinely secure, browser password vault

If you allow your browser to save your web site account names and passwords then you should switch from the built-in function to using LastPass.  LastPass uses genuinely strong encryption methods to encrypt your personal information.  Furthermore, all the encryption is based on your   master pass phrase, which only you know, and all of your information is encrypted before leaving your local system – not on the LastPass web server!  This means that even LastPass employees have no access to your information (nor would anyone that successfully hacked them).  However, because your personal info is stored “in the cloud” all of your personal information is available across different browsers (FF, Chrome, IE) and across different systems (work, home, mobile).

Adblock Plus – eliminates ads in your browser, period, end-of-story

Without screwing up the appearance web pages, AdBlock Plus simply eliminates 99% of ads from your browsing experience.  It is highly controllable via a little pull down menu so if you go to, say a not for profit web site that you know is ad-supported, you can tell it to not block ads on that site.  This is security-related only insofar as that ads are a conduit for spyware entering your browser.  In addition to turning on your browser’s pop-up blocker this will go a long way towards improving security and lessening annoying unsolicited ads.  As a side effect, it will also speed up web page loading times.

Collusion – graphically exposes tracking and selling information about your browsing habits

Collusion shows you what companies are collecting information from your browser about where you go on the Net.  The graph is color coded to distinguish between the web site you went to for content (e.g., www.nytimes.com) versus partner sites which collect information about where you have been on the web (e.g. doubleclick.com).  It literally connects the dots so you can understand how the NYTimes is connected to CNN through both having cut deals with some third party tracker like Google’s DoubleClick subsidiary.  It’s purely informational, but when combined with No-Script below, it gives you control over who can learn what about your browsing.

Certificate Patrol – detects changes to secure browsing certificates (websites you access via HTTPS)
For those not familiar with HTTPS certificates, they are the heart and soul of how your browser decides it is safe for you to trust that the web site you are buying a new golf club from really is Callaway’s web site.  Certificate Patrol is a mostly passive/informational.  It tells you about the certificates your browser has seen and what has changed about them since the last time your browser was at that site.  So, while it is just nerdy to find it is interesting to discover that  Google uses several certificate authorities for different Google products (Google+, Gmail, Google Apps, etc.),  it is concretely security enhancing that it will tell you if a site’s certificates are either revoked (by the signing certificate authority), expired or forged before you input your credit card information!

NoScript – makes visible and/or stops unseen chatter between the browser & 3rd parties

Of these add-ons, NoScript is the most in-your-face.  However, in exchange for a little bit of extra interaction with web pages you gain a ton of awareness and/or control about what third party web sites your browser is “secretly” interacting with on virtually every web page you visit!  That’s right – virtually all commercial web sites have links or bits of JavaScript embedded in them which, if allowed to execute, send information about you, and the page you just landed on, off to third parties.  NoScript takes the attitude that the user should remain in control of their browser communicates, therefore, by default, it stops script execution.  As with the other extensions mentioned it provides a drop-down menu that lets you control which site’s scripts to allow.  This is a little annoying at first since it interrupts the seamless loading of a lot of web sites.  However, it has options that allow you to tune it’s default behavior to be significantly less intrusive.  In any case, the information about all the different linkages to third party tracking sites, etc. is a real eye-opener!  If you install it with the aforementioned Collusion extension you will start to see patterns of firms that track you as you browse the Net!  Another nifty feature, if you have no idea which of these “third parties” (the ones in the NoScript drop down menu) to trust, you can shift-click on their names to research, from a variety of trusted sources, what each one has a reputation for doing with tracked information such as shopping your email address around or selling information about which ads you click on.

You can get these add-ons to FF by using the Tools >> Add-ons menu item, and searching for each by name.  Then follow the installation procedure for each.  To remove an add-on on FF, just go to Tools >> Options >> General tab >> Manage Add-ons button.

What are your favorite security and privacy related plug-ins for FF or other browsers?

Credit to Steve Gibson of Gibson Research for pointing out some of these add-ons by name in his excellent Security Now!  podcast (part of the This Week in Tech network of podcasts):  http://grc.com.

John Brady is Information Security Architect Engineer at Westfield Insurance.

Do You Know the Security of Your Smartphone? (Part 3 of 3)

This is the final post in a three-part series on smartphones and information security. The series has covered overall security of the BlackBerry, Apple and Android mobile operating systems.

Continuing from our earlier posts on the advantages and challenges of the Blackberry and Apple iOS, we are concluding with Google’s Android operating system (OS).

Android is a Linux-based open-source platform whose unified progress is sponsored by Google. Android Inc. developed Android OS circa 2004 and was purchased by Google in 2005.  The OS caught on like wild fire and is used by literally dozens of companies who are creating tablets, phones and myriad other form factors around it.  Despite competition from Apple and Blackberry, 2010 was a huge year for Google. With more than 250,000 apps available on the Android Market, the platform saw an 861 percent increase in app sales.

Additionally, customer intelligence firm Market Force Information recently released findings from a survey on smartphones, which indicated Android’s current appeal over its competition. According to a Feb. 22, 2011 Market Force press release, “When asked which smartphone they would purchase, 34% of survey respondents said Android, while only 21% said iPhone, and 12% said Blackberry.”

 

Android OS Security Concepts

A major aspect of the Android security model resdies in the interface of the platform’s OS application layers and is implemented by running each application in its own efficient Dalvik virtual machine.

From the end user's perspective the effect is quite similar to sandboxing in Apple’s iOS.  Each application’s default view of the device is that it has the entire device to itself, i.e., unless it is explicitly permitted to see other apps, its default view is that it is the only application on the device.

How this works is that when a developer is coding and packaging an application, they must declare what device resources, e.g. GPS, Bluetooth, W-Fi, etc. the application needs to use. This is necessary to build the application but that information is then also used when the end-user installs the app!  This user notification takes the form of an install-time dialog that indicates the list of resources needed on the device to run that application.  So, depending on what resources are listed, the user can either accept, or refuse, installation. For example, if you can’t figure out why the first person shooter game “I Spy On U” wants access to the GPS information on the phone, then you could simply terminate the installation. 

 

Android vs iPhone – Swiss Army Knife vs Sabatier Fine Cutlery

The Android environment is much less centrally controlled than Apple’s iOS.  For example, users can skip the Android Market altogether, and download an application directly from a developer’s web site.  Of course, you do so at your own risk.  The developer might have bad intentions or, if the developer’s download server has been compromised, and his downloads tampered with, you may be getting “more than you bargained for”.  Many Android fans suggest that the healthy skepticism that the Android openness encourages is the only sane default attitude and that Apple users dangerously naïve to believe that “because it came from iTunes App Store it must be safe and well-behaved.”

Incidentally to take complete and utter control of your Android device from the carrier you will need to “root” the phone.  “Rooting” is the equivalent of  jailbreaking an Apple iOS device, which, as described in the iOS edition of this blog, pretty much lets the end user do anything the hardware is capable of. 

 

Android Virtual Phones

Improving upon the user and developer experience with Android, virtualization software company VMware has created a new offering that changes the platform interface, called Mobile Virtualization Platform (MVP).

MVP is similar to the Dalvik VMs of Android; however, whereas the virtual machine presented by Dalvik is an idealized JVM-like set of resources, the VMware VM is more like a thin layer of virtualized hardware implemented as a so-called hypervisor.  This allows a carrier or end-user to install multiple virtual phones!  E.g., on a phone model sold by multiple carriers or by one carrier with multiple versions – like an HP phone that runs either WebOS or Win 7 Mobile – if there was a version of the MVP hypervisor for HP mobile phone hardware, one could run both a Win 7 Mobile and a WebOS phone instance on the same hardware at the same time and “flip” between them.  The Win 7 and WebOS phones don’t even “know” the other personality is resident on the same hardware.  This example is hypothetical but intriguing.

These “guest virtual phones”, running atop the MVP hypervisor, look and act like full-fledged phones!  Besides being interesting technology, VMware’s mainstream concept is that a device owner can have one phone with multiple “personalities” – like a work phone and a personal phone but on a single handset.  With this ability, a corporate IT department could manage the “work phone,” while the owner could have complete control over the personal side.  The MVP platform is mature to the point of being released for some of the most popular phone hardware and it only remains for the phone manufacturers and carriers to embrace it.

 

What has your experience been?

Have you experienced any issues with your Android device?  Have you felt the need to “root” the device? If so, what drove you there; curiosity, annoying carrier apps which you couldn’t delete?  How many apps have you installed?  Did you get them straight from the developer’s site or the Android Market?  Have you ever refused application installation because of the resource the app was asking to use?  We’d like you to share your thoughts and questions with us.

Check out the other posts in this series, and stay tuned for more posts on information security with the leading smartphone operating systems:

• BlackBerry
• Apple iOS

----------------------------

John Brady is an Information Security Architect Engineer at Westfield Insurance. Sharing Knowledge. Building Trust.

 

IMAGE SOURCE: http://www.flickr.com/photos/osde-info/4623612094/

 

Do You Know the Security of Your Smartphone? (Part 2 of 3)

This is the second post in a three-part series on smartphones and information security. The series will discuss overall security of the BlackBerry, Apple and Android mobile operating systems.

Continuing from our previous post on the advantages and challenges of the BlackBerry operating system, we now move on to Apple mobile operating system (iPhone, iPad, iPod Touch), known as iOS.

As mentioned previously, the iPhone has been making waves in the industry concerning its recent introduction to the Verizon Wireless network. Regardless of the initial customer turnout for Verizon’s in-store release, the iPhone is still considered one of the most highly respected and coveted smartphones in the market.

 

Exclusivity of the iPhone iOS

The iPhone, iPod Touch and iPad now run iOS 4.2.  Apple has not only changed its major version, but also changed its name — from iPhone OS to iOS — in recognition of the fact that voice phone functions are a shrinking fraction of their mobile devices’ functionality.

So, what's the main differentiator between early smartphones and iPhone?  I believe the essential “newness” was that Apple inserted the iPhone into its maturing iPod/iTunes content ecosystem and added the App Store.  This closed environment gives users a unified device experience within Apple’s “walled garden.”  Apple prides itself on having created a trusted, friendly device that, conveniently for Apple, only downloads music, videos, podcasts and apps from the iTunes App Store.

While most iPhone owners find this state of affairs comforting, some find it frustrating. The ultimate form of challenging the control of Apple and their carrier at the device level is a process known as “jailbreaking”. Jailbreaking removes the controls, limitations and safeguards put in place by Apple, thus enabling the device to access and run applications, extensions and themes available outside of Apple’s App Store.  However, the added freedom comes with a tradeoff because the App Store is part of the Apple “cocoon of security.”  While Apple makes no guarantees (in their end user agreement) that apps will not misbehave, they do take more effort than any other vendors to assure that an application does what it says it does and only that.  They also restrict content they deem explicit.

 

iOS Security Benefits and Weaknesses

In addition to scrutinized applications, Apple’s iOS uses a “sandboxed application” philosophy. A sandbox is a default installation state of no access to OS level objects, such as persistent storage or executable.  The sandboxed app can, of course, access its own data and network resources freely, but can’t reach into the phone’s OS or even “talk to” other applications except in very controlled ways. This makes it harder to write applications that cooperate via drag and drop, etc., but improves security significantly. It makes it harder for applications to spy on and export each other’s data, and more straightforward when uninstalling an application and cleaning up its associated data.  If an employer controls the apps and deletes the CRM app, the CRM’s database of company confidential customer information is deleted with it.

Of course, retaining our healthy skepticism, iOS is just a device operating system and like all large complex software systems is not exempt from bugs and security issues:

• Erik Sherman’s post, “Want to Protect Your Emails? Don’t use these 11 Android and iPhone Email Apps” cites, in particular, issues with Microsoft’s Windows Live Messenger on the iPhone.

• Just this month (Feb. 2011) the Frauenhofer Institute SIT, exploited an iOS stored password/encryption vulnerability. Via the aforementioned jailbreaking process, the SIT research team was able to crack into stored iOS password vault, called the Keychain, in as little as six minutes.  In addition to the hardware encryption key for that device's storage, where application data would be stored, the Keychain contains user account/password pairs for such things as websites, email accounts, wi-fi hotspots, etc.  Optimistically, since Apple controls the ecosystem from the hardware up, they can rework the affected encryption architecture and system libraries to use the hardware in a different way to restore security to the iOS devices out there.  This should be an advantage of a monolithic device provider.

Apple continues to make iOS more enterprise friendly with hooks to email and other corporate services considered critical.  For example, companies can control whether the device locks its screen after an idle  interval and requires a password to get in.  Or, after say, ten failed attempts to get into the device, it wipes itself (data and applications or just the corporate controlled data and applications).  It can now be remotely wiped on demand by a command sent from a company IT security department.

 

What has your experience been?

Do you love the security of Apple’s walled garden or is it driving you nuts?  Are you excited or worried about switching from your current smartphone to an iPhone?  We’d like you to share your thoughts and questions with us.

Check out the first post in this series, and stay tuned for additional posts on information security with the leading smartphone operating systems:

• BlackBerry
• Google Android

----------------------------

John Brady is Information Security Architect Engineer at Westfield Insurance. Sharing Knowledge. Building Trust.

 

Do You Know the Security of Your Smartphone? (Part 1 of 3)

This is the first post in a three-part series on smartphones and information security. The series will discuss overall security of the BlackBerry, Apple and Android mobile operating systems.

Today, it seems like everyone has, or is planning to get, a smartphone. From recent buzz surrounding the much-anticipated Verizon iPhone, to speculations on the staying power of the Android’s market dominance, the focus has been on smartphones and their presumed takeover of the mobile market. 

The Basics of Smartphones

 A smartphone combines the elements of a normal mobile phone with the additional features of a personal digital assistant (PDA). The convenience provided by the marriage of these technologies is huge, especially for those needing constant connection to personal or professional communication systems. For more information, read Liane Cassavoy’s article: What Makes a Smartphone Smart?

Be it the stalwart BlackBerry, the utopian Apple iOS, or the Swiss army knife Android platform, increasing numbers of corporate users — from the C-level to the mail room clerk — are becoming enamored, if not attached at the hip, to their mobile devices. 

Not only are they used for personal communications, such as calls, texting, email and web browsing, but we have also grown to rely on them for work.  If your business information is being shared via smartphone, it’s important that you understand the security models of the leading smartphones.

                                                                        

BlackBerry - Apparent Strengths can Become Weaknesses

Long the paradigm of tight control and the only smartphone approved for use by the US Government employees, the BlackBerry has to some extent been rendered a victim of its own success.

The BlackBerry OS (BBOS)/BlackBerry Enterprise Server (BES) system implements an exquisitely fine-grained security layer that allows administrators to define hundreds of configuration settings.  For example, you can set the encryption of the device contents down to the level of the key length and algorithm to use. On other devices, “whole device encryption” or “application encryption” is either on or off and the device maker has chosen the algorithm and key lengths.  BlackBerry’s placing this control in the hands of the users  results in an embarrassment of riches of sorts because when a configuration setting can be controlled, there is a tendency to change the default to something “more secure.”  But as a consequence, going forward, the complexity of dozens of such choices must be managed.  Managed in the sense of brought forward to hardware models, tested on new versions of the BB OS, etc.  For the customer this is a potentially huge time sink.  For the device and OS maker it creates an enormous burden of legacy compatibility.  We have seen this sort of phenomena occur with MS Windows.

In BlackBerry’s defense, they have tried to control management complexity.  For example, these customizations can be bundled into named configurations (e.g., “Sales Config”, “IT Config”, etc.) and distributed to the BlackBerry population based on job role.  But remember, BlackBerry has been playing hardware catch up with touchscreen phones, and now tablets, and has re-versioned it's operating system through from 4.x to 6.x in the space of 36 months.  Bringing the aforementioned custom configurations forward though revisions of the BBOS,BES and dozens of new device models is quite challenging.  Moreover, over the next couple years, RIM is moving new devices entirely from the proprietary BBOS to QNX, a real-time microkernel OS!

 

BlackBerry Availability

In general BlackBerry has been a very robust and reliable platform although they have had some bobbles (not surprising due to their long lived number one smartphone position).

As with any device, you run the risk of experiencing system failures and service blackouts, which can result in serious problems for highly dependent users. For some BlackBerry customers, this dreaded occurrence became a reality in late January 2011, as the BlackBerry Internet Service experienced a brief outage.

Another source of potential concern over availability and security is that much of the comfort and control/monitoring behind BlackBerry use resulted from the fact that all network traffic to and from the device was forced to loop all the way back through the corporate LAN (one of the main functions of the MDS service that runs in the BES) before going, say out to the Internet.  The upside was that all of your corporate safeguards put in place for email and web filtering were automatically in place for the BB traffic.  However, newer BB models have to some extent shot this model in the foot by including Wi-Fi which supports direct attachment to the Internet (if the corporate admins permit it) which of course means that the BB can make direct connections  to potentially infected web sites.

What has your experience been?

We’d like to hear about any security issues you’ve faced with your BlackBerry, or concerns with the BBOS that have swayed you to consider an alternative smartphone system.

Stay tuned for the next two posts on information security with the leading smartphone operating systems:

• Apple iOS
• Google Android

 

John Brady is Information Security Architect Engineer at Westfield Insurance.

Photo - Cheon Fong Liew

The Trusted Insider

The U.S. military’s response to all the problems it has been having with sensitive documents appearing on WikiLeaks is to prohibit the use of removable media such as USB drives.  They are even threatening court marshals.  Here is an article on CNN that gets into more detail on this:

http://www.cnn.com/2010/TECH/web/12/10/military.stops.leaks.wired/index.html?hpt=Sbin

Will this be an effective way to stop information loss?  It will certainly make things a little harder to get large amounts of data out of their secure networks.  But, in order to be useful, information does need to move around and be accessed on multiple platforms by multiple people.  As the information moves around, there are opportunities for it to move out of your organization's control.  Is there an effective technical control that could be put in place to mitigate this risk?

The problem here is not technical.  No technical control failed; it’s that a trusted user, with appropriate credentials and the required access needed to perform their job, has decided to violate their organization’s (the U.S. military) policies and trust.  The people who are uploading this information are intentionally misusing the access that they have been granted.  This is probably the worst risk that Information Security professionals everywhere have to deal with: the Trusted Insider.  You know them: the high performers with positive attitudes who have been around a long time, are working on important initiatives and who would never do anything wrong.

We can monitor logs, block websites, restrict network protocols, ban USB drives, disable DVD burners, encrypt data at rest, layer on more and more technical controls …  Will this address the issue and mitigate the risk?

Putting technical controls in place, like banning USB drives, makes it harder for the Trusted Insider to do bad things, but they are still there in your organization, accessing your most sensitive information.  How do you mitigate the risk of information misuse by the Trusted Insider? 

We'd like to hear your thoughts on this issue - please comment below.

Bill Murray leads the IT Risk Security and Compliance team at Westfield Insurance.   Sharing Knowledge. Building Trust.

Securing Mobile: When a Phone is as Powerful as a Laptop

There seems to be a disconnect between want and need with respect to smartphones and information protection.  Securing mobile is a “downer” along at least two main axes of mobile phone interaction: convenience and cost.

If your phone is as powerful as your laptop; meaning the operating system, the peripherals and the applications on your phone are as – or are more - sophisticated than those of your laptop then shouldn’t the security measures that protect the contents be similar?  The real question here is, if you’re using your phone to process the same information as your laptop, then we have to ask – how can one justify not securing it to the same degree as your laptop?

My opinion is that the only logical answer is yes.  For an increasing number of functions, phones are replacing laptops.  I believe that there are ways to secure mobile phones to the same standard as laptops while minimizing the inevitable inconveniences and extra cost. The solutions require thoughtful re-evaluation and sensible compromise.  Rather than slapping the old products from the laptop onto the smartphone, we should look at it as a qualitatively different platform. 

Drawbacks to Treating a Smartphone like a “Small Laptop”

Here’s an example of when it may be typical to treat a smartphone as a “small laptop”.

Many companies now use URL filtering perimeter systems, such as WebSense, to prevent employees from accidentally going to infected websites.  When an employee uses their laptop outside the company network, you may tell them they must “VPN into” the network before using the web. (This way, once the VPN tunnel is established, their browsing goes through the URL filter.)

It is possible to treat the smartphone like a laptop in this scenario, because there are VPN clients that work as well as the laptop version.  Employees could be told to “VPN into” the corporate network before web surfing on their smartphone. 

However, there are drawbacks: a) VPN clients take a fair amount of computational horsepower to run, and b) from a network architecture and management standpoint, why tunnel all that traffic from every mobile browser into the corporate core in order to turn around and go back out to the Internet? 

Rather than treating the smartphone like a laptop, the solution may be to change how your URL filter works.  So perhaps, instead of bringing the traffic to the filter, bring the filter to the traffic!  Put the URL filter on the Internet, and everyone’s computer (smartphone or laptop) can get to it from everywhere.  Companies such as WebSense and zScaler advocates and vendors of such solutions.

Speaking of changing the place where the processing happens – how about using another ancient solution?  How about moving where the applications run and so, where the information is processed?  I am speaking here of just using the phone as a window into the corporate computing environment.  This is déjà vu all over again, the fat client/thin client debate of the 1990s – the Unix X Window system and Citrix ICA.  The fact is that this class of “collapsed data center” solution, which once suffered complaints about bandwidth and server capacity issues has become increasingly viable not increasingly outdated.  Since the days of the mainframe terminal sessions, the thin client paradigm was always attractive from cost, administrative and data security perspectives.  Now the protocols for computing in the data center core and transmitting just the display have become more efficient and bandwidth has come down in price. Similarly, multi-core servers with dozens of gigabytes of RAM are the rule not the exception.  This makes it very attractive indeed to just load the thin client app onto the smartphone and have it connect securely to the core to process corporate information which is also on the core.  If the organization wants people to be able to drag and drop files or query results from the core within apps that run on the endpoint – then the endpoint needs heavy securing as described above.  But if the thin client is set up so that information cannot be transferred from the core to the endpoint then one has a lot less to worry about in terms of “information leakage.”  The “drag and drop” tradeoff being that the information the employee wants to transmit to their smartphone is not directly usable by other apps on their smartphone that make them more productive (e.g., transferring an address to the smartphones contact management system or its GPS app).

So where does this leave us?  I think, for now, the choice is between:

a.    Smartphones with powerful processors and awe-inspiring local apps and local corporate data loaded down with classical malware protections like encrypted file systems, anti-virus, URL filtering, anti-spam, personal firewalling (local or in the cloud)

b.    Collapsed data center where the employees log into a virtual desktop running on a big server and all the employee ever has on their smartphone is a thin interface to corporate data on a far-away desktop

The convenience trade-off is clear – I would much prefer to be able to download a spreadsheet to the app on my phone and then hop on a plane and “play with the numbers” versus having to be on the network and constrained by my company's standard spreadsheet program.  

Cost wise, the price of buying and administering standalone smartphones with high performance client software on them is much higher risk and less cost-effective than standing up a big server with desktop OS licenses, a few licenses for each app and issuing a thin client for each employee’s corporate or privately owned smartphone, laptop or desktop.

Is there is a happy medium?  What do you think?

Next time we’ll discuss modifications to these paradigms that may remove some of the downsides to both, namely, data centers in the cloud and always connected mobile  networking.

----------------------------

Some links to others thinking about the same topics:

http://www.isaca.org/About-ISACA/Press-room/News-Releases/2010/Pages/Mobile-Devices-May-Pose-Greatest-Threat-to-Confidential-Information-New-ISACA-White-Paper.aspx

http://isc.sans.edu/diary.html?storyid=9787

----------------------------

John Brady is Information Security Architect Engineer at Westfield Insurance. Sharing Knowledge. Building Trust