Postini’s background technology stems from threat assessment and message parsing capabilities, grown through several years as a primary mail provider. There are two major patents, with a variety of [...]]]> Postini is Google’s 2006 acquisition for secure messaging, and a direct competitor to IronPort. All of their offerings surround Software As A Service (SAAS), matching directly with Google’s overall technology strategy. They provide several services, including web security, anti-spam/malware, mail filtering, and archival with indexing. The Data Leakage Prevention capabilities provide privacy protections through outbound communication filters. Additionally, there are management tools and continuity procedures appropriate for enterprise use.

Postini’s background technology stems from threat assessment and message parsing capabilities, grown through several years as a primary mail provider. There are two major patents, with a variety of claims following each one. The first patent surrounds on-demand message scanning and routing. The geographically distributed Postini data centers proxy all communications (corporate, wired, wireless, portal, etc) and filter the communications appropriately, removing viruses, spam etc. The second patent centers on threat detection and control, and methods for generating and processing a sender/ISP/country’s reputation and then acting accordingly.

The technology doesn’t seem that revolutionary today, and the online documentation frequently references the existence of prior art not mentioned in the patents. However, from a security perspective, the techniques Postini uses are sound. Communications between Postini and corporate mail servers are TLS encrypted. This allows additional features for Data Leakage Prevention by both companies. The Intrusion Detection, Anti-virus, and Anti-spam filters are all independent of the networking infrastructure, and likely include best of breed solutions whenever there’s not a better trade secret/patent in-house. Postini uses portals and web services for sending messages to non-subscriber recipients. The portals guarantee messages are not susceptible to a man-in-the-middle attack.

The Message Security and Message Delivery services offer content filtering for Data Leakage Prevention. There are consoles and rule engines for policy definition, as well as canned Personally Identifiable Information (PII) controls for things like Social Security Numbers or credit card information. The GUI apparently delivers enough rule granularity to at least filter attachment types and perform in message word detection.

Postini’s technology does not address malicious insider activities and could be its biggest weakness. This becomes more of an issue when examining the Google addition of archival and search. Site administrators may configure Postini for secure communications between corporate partner mail servers, and even make this a policy based requirement for some message delivery. This secure communication eliminates privacy issues between the corporate email servers and the Postini data centers. It does not, however, account for a messages time on disk or in use. Trusted insiders at the sender’s or recipient’s locations may manipulate or view messages. From a third party point of view, administrators at the Postini sites could possibly have enough access to circumvent many of the same protections. On Postini’s provider end, at least within Google, record access rights are strictly controlled with procedure.

Google’s approach to pricing is the most attractive part of the Postini product.  It follows the principals of scale, expecting more consumers at a lower tipping point. For $3 annually per user, Postini provides inbound email filtering (Message Filtering) for viruses, trojans, spam, etc… At $12 annually, Postini does the same for outbound messaging and adds content and attachment conttrols as well as policy monitoring and centralized administration (Message Security). The $25 per year includes the archival and search features Google threw into the mix (Message Discovery).

No matter how you slice it, the weakest point in any security program ends up being the end user. User training seems to work with frequency of message, but without hearing the importance of security it seems quickly forgotten.

That is of course, unless the message starts at the top with a strong corporate policy, well understood [...]]]> The Mitnick attack. The 10 attack. Social Engineering. Each of these emphasize how readily people part with valuable information to someone posing as an IT staffer, a very attractive member of the opposite sex, or someone friendly. You may now add candy bars and women…

No matter how you slice it, the weakest point in any security program ends up being the end user. User training seems to work with frequency of message, but without hearing the importance of security it seems quickly forgotten.

That is of course, unless the message starts at the top with a strong corporate policy, well understood consequences, and swift consistent enforcement. During my security training (I believe my CISSP), the instructor shared an example of a large, Canadian company with a zero-tolerance policy toward password disclosure. A Sr. V.P. within the company did just that with his secretary. During an audit, the IT staff discovered the VP logged in while on travel in 2 separate places, checking email. The VP was immediately terminated, the secretary put on probation.

This information trickery is the same idea as pre-texting in the privacy world . A caller (typically) phones a target under some false pretext, such as a survey or sweepstakes winnings. After ‘verifying’ enough publicly available information, such as name, street address, phone number, additional information is provided incorrectly or incompletely, typically date of birth, mother’s maiden name, bank where winnings may be deposited or social security number to report the winnings to the IRS.

Once armed with this information, the assailant calls in to the bank after ‘losing’ their checkbook, or simply requesting a change of address. From there, enough information is in in hand to (hopefully only) clear out the checking account, or continue with a complete identity theft. Banks and retail merchants are recognizing this trend and are putting further and further measures in place to protect their customers.

Security is one of the five domains integral to the Certified Information Privacy Professional (CIPP) and for good reason. The chocolate and the sweepstakes winner are the same problem, and mitigated through the same policy and training. Now if we could just convince the user populous – if it seems to good to be true – it probably is.

What I don’t get is the recent hack of the Epilepsy Foundation forums, changing posts so that they displayed flashing strobes and trippy patterns. I find this behavior reprehensible. To sully a non-profit’s reputation, and attack unsuspecting seizure disorder suffers, many of whom may be incapcitated by the strobes or patterns. Thankfully most of them probably don’t know what happened, essentially blacking [...]]]> I find ‘America’s Funniest Videos’ entertaining. I get ‘Jackass’… They scare people, gross them out, or generally bewilder. But they don’t intentionally go out and drop toilet bowls on people’s heads or put others lives in danger.

What I don’t get is the recent hack of the Epilepsy Foundation forums, changing posts so that they displayed flashing strobes and trippy patterns. I find this behavior reprehensible. To sully a non-profit’s reputation, and attack unsuspecting seizure disorder suffers, many of whom may be incapcitated by the strobes or patterns. Thankfully most of them probably don’t know what happened, essentially blacking out, except for an awful headache or coffee covered keyboard. The Epilepsy Foundation responded quickly, impresive for a Sunday, holiday, and a non-profit.

Seizures consist of multiple neurons in the brain firing out of sequence. The random firings may be localized and cause an absence episode, or generalized Tonic Clonic events (previously known as Grand Mal) where the afflicted lose muscle control and physically convulse.

After the main event, there are typically aftershocks. Just as after an earthquake the ground may move a little more easily, so too is the case for epileptics. People may be epsiode free for a year or more by successful diagnosis, drug therapy, or even brain surgery. They may have just resumed a normal lifestyle of heading to the grocery store or walking to the park, and now have to worry about something they would have been resistant to a week earlier. Imagine a fear of seizing in a crosswalk, or while chopping celery.

For a demonstration, do something honorable or with meaning. I find it one thing to engage in protests: ruin a fur with red paint, DoS or defile a website, or even common financial thievery. The Epilepsy Foundation attack is the digital equivalent to randomly finding a guy on the street and beating them up. Lawless anarchy must not be tolerated from a bunch of little hooligans.