Category Archives: Law

The State of Security: Net Neutrality Regulation – Does the Past Predict the Future?

The debate over the degree of regulation of broadband Internet providers in the U.S. has been going on almost as long as broadband Internet service has been available. In 2004, the U.S. Federal Trade Commission (FTC) first described a set of non-discrimination principles to ensure that users had access to content on an equal basis. […]… Read More

The post Net Neutrality Regulation – Does the Past Predict the Future? appeared first on The State of Security.



The State of Security

Net Neutrality Regulation – Does the Past Predict the Future?

The debate over the degree of regulation of broadband Internet providers in the U.S. has been going on almost as long as broadband Internet service has been available. In 2004, the U.S. Federal Trade Commission (FTC) first described a set of non-discrimination principles to ensure that users had access to content on an equal basis. […]… Read More

The post Net Neutrality Regulation – Does the Past Predict the Future? appeared first on The State of Security.

MichaelPeters.org: Penetration Tests vs. Vulnerability Scans: Understanding the Differences

Penetration tests and vulnerability scans are related but different cyber security services

The difference between penetration tests and vulnerability scans is a common source of confusion. While both are important tools for cyber risk analysis and are mandated under PCI DSS, HIPAA, and other security standards and frameworks, they are quite different. Let’s examine the similarities and differences between vulnerability scans and penetration tests.

What Is a Penetration Test?

A penetration test, also known as a pen test or a white-hat attack, seeks to simulate the actions of a criminal hacker attempting to break into a network, computer system, or web application, using a targeted approach to see if its security features can be defeated. While penetration tests can be automated to some extent, there is always human involvement somewhere in the process; to meet PCI DSS standards, penetration testing cannot be fully automated, although automated tools and the results of a vulnerability scan can be utilized.

A diligent pen tester does not give up easily. If a pen test is foiled by one defense, the tester adapts and tries another attack vector, just like a cyber criminal would; this is why a human with cyber security expertise must be involved. Depending on its scope, penetration testing may also involve simulated real-world attacks such as social engineering schemes or attempts to breach physical defenses and access hardware.

While penetration testing can theoretically be performed on the entire enterprise infrastructure and all applications, due to the time and expertise involved, this is impractical. Generally, pen testing focuses on the network or application level or on a certain department, function, or asset.

What Is a Vulnerability Scan?

Unlike penetration tests, which attempt to break through vulnerabilities, vulnerability scans seek to identify, rank, and report on security vulnerabilities, not break through them. Vulnerability scans are also far broader in scope than pen tests, covering the entire enterprise. They are also fully automated, though a cyber security professional must examine the issues identified by the scan and determine how to mitigate them. A scan report will typically prioritize discovered vulnerabilities according to urgency, severity, and ease of fix, as well as offer suggestions on how to make fixes.

Vulnerability scans are performed more often than penetration tests, and because they are automated, they can be scheduled to run automatically. The PCI DSS, for example, requires that organizations perform vulnerability scans at least quarterly, while penetration tests are required at least annually. Both tests should be performed anytime significant changes have been made to the data environment.

The cyber security experts at Lazarus Alliance have deep knowledge of the cyber security field, are continually monitoring the latest information security threats, and are committed to protecting organizations of all sizes from security breaches. Our full-service risk assessment services and Continuum GRC RegTech software will help protect your organization from data breaches, ransomware attacks, and other cyber threats.

Lazarus Alliance is proactive cyber security®. Call 1-888-896-7580 to discuss your organization’s cyber security needs and find out how we can help your organization adhere to cyber security regulations, maintain compliance, and secure your systems.

The post Penetration Tests vs. Vulnerability Scans: Understanding the Differences appeared first on .



MichaelPeters.org

Sunset for section 215, but is the world better now?

Section 215 of the US Patriot Act has been in the headlines a lot lately. This controversial section was used by the US intelligence agencies to scoop up large quantities of US phone records, among other things. The section had a sunset clause and needed to be renewed periodically, with the latest deadline at midnight May 31st 2015. The renewal has previously been a rubber-stamp thing, but not this time. Section 215 has expired and been replaced by the Freedom Act, which is supposed to be more restrictive and better protect our privacy. And that made it headline news globally.

But what does this mean in practice? Is this the end of the global surveillance Edward Snowden made us aware of? How significant is this change in reality? These are questions that aren’t necessary answered by the news coverage.

Let’s keep this simple and avoid going into details. Section 215 was just a part in a huge legal and technical surveillance system. The old section 215 allowed very broad secret warrants to be issued by FISA courts using secret interpretations of the law, forcing companies to hand over massive amounts of data about citizens’ communications. All this under gag orders preventing anyone to talk about it or even seek legal advice. The best known example was probably the bulk collection of US phone records. It’s not about tapping phones, rather about keeping track of who called whom at what time. People in US could quite safely assume that if they placed calls, NSA had them on record.

The replacing Freedom Act still allows a lot of surveillance, but aims to restrict the much criticized mass surveillance. Surveillance under Freedom Act needs to be more specified than under Section 215. Authorities can’t just tell a tele operator to hand over all phone records to see if they can find something suspicious. Now they have to specify an individual or a device they are interested in. Tele operators must store certain data about all customers, but only hand over the requested data. That’s not a problem, it is pretty much data that the operators have to keep anyway for billing purposes.

This sounds good on paper, but reality may not be so sunny. First, Freedom Act is a new thing and we don’t know yet how it will work in practice. Its interpretation may be more or less privacy friendly, time will tell. The surveillance legislation is a huge and complex wholeness. A specific kind of surveillance may very well be able to continue sanctioned by some other paragraph even if section 215 is gone. It’s also misleading when media reports that the section 215 intelligence stopped on June 1st. In reality it continues for at least six months, maybe longer, to safeguard ongoing investigations.

So the conclusion is that the practical impact of this mini reform is a lot less significant than what we could believe based on the headlines. It’s not the end of surveillance. It doesn’t guarantee privacy for people using US-based services. It is however an important and welcome signal that the political climate in US is changing. It’s a sign of a more balanced view on security versus basic human rights. Let’s hope that this climate change continues.

 

Safe surfing,
Micke

Image by Christian Holmér