Stratfor Documents Obtained in December 2011 Breach - Released

The fallout from the December 2011 breach of Stratfor was not fully felt until today, when the website WikiLeaks released a statement that they would begin to publish "5 million e-mails from the private intelligence company Stratfor, starting with a company "glossary" that features unflattering descriptions of U.S. government agencies." 


Stratfor will not confirm nor deny the authenticity of the documents but they do make mention that the documents can now be easily edited by those who release the information.


Wikileaks has stated that the documents will be released through a network of more than 25 news outlets and activist groups in the coming weeks. The first document out was titled "The Stratfor Glossary of Useful, Baffling and Strange Intelligence Terms," featuring brief and sometimes humorous definitions and blunt assessments of U.S. intelligence and law enforcement.


To read more about Stratfor and Wikileaks click here
To read the full text of what was released click here

WikiLeaks - Lessons Learned

Reputation and brand are crucial to an organization’s success.  A single data breach can be crippling to an organization’s image. Brand loss alone is 49% of the cost of a data breach.  Therefore, protection of sensitive data should be a priority for all organizations.  WikiLeaks has caused anxiety for leaders of many organizations, and many are left wondering if their organization is protected.  Just the thought of someone having access to your organization’s or employees’ confidential information is troubling.

Those leaders who have implemented DLP tools are free from the WikiLeaks anxiety.  DLP tools enable us not only to protect standard data types such as PCI or PII data, but fingerprinting techniques enable organizations to protect all data deemed sensitive.  This technique allows for detecting and protecting sensitive data despite alteration, reformatting, or other modification.  Fingerprints enable the protection of whole or partial documents and derivatives of the protected information. Some examples of data organizations fingerprint are executive summaries of documents or specific customer records.

How does fingerprinting work?

“Fingerprinting technology examines the content of documents or raw data and extracts a set of mathematical descriptors or "information fingerprints." These fingerprints are compact and describe the underlying content. By assigning unique identities to each information asset, fingerprinting technology can track information in motion with great precision.”

-          Websense

Start thinking about how a DLP solution might ease some of the concern in your organization. 

Bank of America Prepares for WikiLeaks Disclosure

The Bank of America is on edge about a statement made by WikiLeaks founder, Julian Assange. The statement claims that early this year (2011), a major American bank will suddenly find itself turned inside out. In response to this statement, Bank of America has created a team of 15 to 20 internal and external experts to come up with a damage control plan in the event that WikiLeaks releases documents that would affect its reputation and brand. An internal investigation to determine what internal documents have been leaked to WikiLeaks has already begun.

Since Assange has announced that a company in the banking industry will be affected next, there has been speculation within the industry that the bank he is referencing is Bank of America. Bank of America has stated that its investigations have not lead to any information regarding what documents WikiLeaks may have, but it wants to be prepared.

Being honest about DLP in light of evolving malware and insider risk

We were recently posed the following question on a DLP message board: 

Zeus and other trojans today encrypt data before they get sent over regular channels (HTTP) to the drop sites. It's also easy for users to install open source encryption software (e.g. TrueCrypt) and encrypt files before they get copied to USB drives. 

The issue here is that DLP relies on content analysis and packet inspection, but if it can't be understood, DLP doesn't seem to be helpful.Short of draconian measures like blocking all USB ports or blocking all data that cannot be identified, are there practical ways that DLP or other means can help?

For the sake of discussion, let's leave aside techniques like better access control, application whitelisting, or tighter file permissions for now. I'd also like to leave aside data-at-rest scanning to preemptively encrypt and/or move to secure locations. The assumption is that users keep copies of sensitive files on their local PCs, unencrypted. Let's assume we're talking about a typical large enterprise that can't force their employees to only use certain applications and can't prevent them from using social networking sites.

Mark Mahovlich, Director of Business Development at Attevo, provides his insight:

Outside of the obvious choice of disabling the administrative capabilities of a managed endpoint, the reality is you would have to deploy one, I say all, of the following content security practices:

1. Endpoint Controls - If you have the right endpoint technology deployed, you can stop the user action before it moves to the encrypt or transmit phase.  Policy would define enforcement action based upon the content and the end user activity. For example, "Deny the ability to copy and paste confidential data (even a subset of the data) into any unapproved application (email, IM, HTTP post, etc.)  In your, case, "deny any Encryption Activities that are not my company approved Encryption Technology,"  This would stop any third-party encryption, and allow you to automatically de-crypt and scan data content (for compliance to Policy) for anything the end user did encrypt manually.
2. Content Gateway -  Deploy Content Gateway technology that is capable of de-encrypting SSL Encrypted traffic.  Why is this important?  Google Mail.  In this use case, we will assume the endpoint is not being managed, and hence does not have any ability to block end user activities with confidential data (as in #1).  The end user accesses Google Mail and attaches a confidential document or pastes confidential date into the Email.  Because Google Mail is SSL encrypted traffic, most DLP solutions would not be able to monitor, identify and take action on the confidential data per Policy.  Therefore, you need a Content Gateway to de-encrypt the Google Mail traffic allowing your DLP solution to analyze the confidential data and provide enforcement actions per Policy.  
3. DLP Network Monitor -  Deploy a DLP solution that allows you to monitor, analyze and enforce action on network protocols (HTTP, HTTPS, FTP, IM, SMTP, CIFS, NFS, and other P2P channels).  The solution would detect traffic that was encrypted using a  third-party product, and would be set by Policy to deny that transmission.

Why all three layers?  It provides as much Risk Mitigation as possible, given that end users will find many paths to send data and perform their job function.  Most data leakage is simply misuse (see the Secret Service Findings for hard data).  However real life experience tells us that the truly malicious end user will try more than one channel to reach his goal.  People are very creative. 


In addition, technology moves at a rapid pace.  As seen in the Google example above, organizations will go to great lengths to secure their application driven revenue.  Consider the security concerns and breaches being seen today simply with Web 2.0 technologies.   What will Web 3.0 bring?  Single Point solutions simply will not provide the coverage necessary for an organization to adequately protect itself.

WikiLeaks Threatens Release of Unredacted Documents

For WikiLeaks Founder, Julian Assange, the days following the latest release of secret documents have brought legal troubles, sex crime allegations, and death threats. 

In response, Assange has released an encrypted document to tens of thousands of hackers and open-government campaigners that contains all of the documents that WikiLeaks has received to date. Assange's  lawyer has said that if anything happens to Assange, either physically or legally, the encryption key will be released, and all of the documents will be immediately available. Assange refers to the document as his "insurance policy." 


This file is believed to contain US Government papers on the Guantanamo Bay detention camp as well as damaging private-sector documents pertaining to the energy and banking industries. It is believed that two of the targets are industry leaders BP and Bank of America.


Does your organization have processes in place to prevent data loss?
Start your conversations with Attevo now to mitigate your organization's risk and exposure because your industry could be next. Call (216)928-2800 to set up a meeting today!

WikiLeaks’ Founder Now Targeting Corporate America

According to a revealing Forbes interview with Wikileaks.org founder, Julian Assange, states early next year, a major American bank will “find itself turned inside out.”  Assange has always followed through on his threats and he now says tens of thousands of internal documents from a major U.S. bank will be published on WikiLeaks.org.  These documents will uncover corruption and unethical practices which will stimulate investigations and reforms.  Many unpublished and damaging documents on financial institutions, pharmaceutical companies, and energy companies are currently in his hands.

Individuals can access  incriminating documents on a laptop, USB stick, or portable hard drive and send them out through personal E-mail accounts, blogs, or simply submit them directly to WikiLeaks.

Do you have any processes in place to prevent this?

Start your conversations with Attevo now to mitigate your organization’s risk and exposure because your industry could be next. Call (216)928-2800 to set up a meeting today!

Read more about this story here.