The SSA Plan
An effective SSA plan mitigates the risk of malicious code, security vulnerabilities, and code defects without standing in the way of creating and implementing programs and applications that function as intended. The best methodology builds security protocols into the application throughout the entire lifecycle.

Creating a Comprehensive SSA Plan
A comprehensive SSA plan starts with the original system concept and continues until the end of the application’s useful life. Here is a list of components to include in any comprehensive SSA plan:
• Training – Every member of the development team should be trained in information security.
• Defining Requirements – Security requirements should be defined during the requirements-definition stage of the application lifecycle and refined as deficiencies are found.
• Design – As the system is designed, potential vulnerabilities should be identified and accounted for.
• Coding – At this point, programmers should use the secure coding practices that they learned during training, but the final code should also be reviewed by another team member and scanned by automated tools.
• Code Handling – Only authorized users should be able to either view or modify code. Separation of duties requires that programmers are not allowed to deploy their own code changes.
• Testing – This can include both internal and external testing to make sure all vulnerable points were identified and handled.
• Documentation – Software documentation should include any explicit security measures.
• Readiness Testing – Prior to final deployment, all modules should be reevaluated for security gaps.
• Response, Evaluation, and Feedback – Any detected vulnerabilities should be evaluated and reported to the developers for correction.
• Maintenance – As the software security industry identifies new issues and methodologies, existing code should be updated to integrate new measures with existing systems.

Automated SSA Tools for the Web
An effective SSA plan uses a mix of team and third-party reviews as well as automated tools to minimize the possibility of missing vulnerable code. While these practices should be implemented for every system, web applications present a higher level of risk than any other type of software. Here are a few of the most popular SSA tools for the web:
• Nitko
• Paros Proxy
• WebScarab
• WebInspect
• Rational AppScan
• N-Stealth

Measuring SSA Effectiveness
Measurement plays a key role in the SSA process. Implementing and using this type of methodology isn’t a cheap endeavor. However, it’s worth ever penny if your resources are protected from security threats. The following items should be measured for further evaluation:
• How well and how often are security objectives met?
• Are processes and controls functioning as expected?
• Did the requirements stage or review process miss any potential vulnerabilities?
• How soon were any security gaps identified? How quickly were gaps closed?

SSA Best Practices
To create an effective SSA plan, keep these best practices in mind:
• Incorporate security measures throughout the entire application development lifecycle.
• Security requirements should be clearly defined and documented.
• Code should be available for review by other team members and third-party auditors.
• Third-party vendors should be required to provide their source code for vulnerability scanning.
• Every program change should be reviewed by a member of the security team in addition to scanned by an automated tool to minimize security risks.

Integrating secure coding techniques into both in-house software development and application procurement is more critical than ever. Hackers and corporate thieves are working overtime to exploit any potential system weaknesses to steal information or disrupt operations.

Anthony Ricigliano

The Exciting Challenges of the New Infrastructure
This new strategy isn’t without challenges and opportunities. Today’s system designers must determine how to fully leverage the strengths of on-demand hardware to build the best data management platforms for their IT shop. At a minimum, these solutions must:
• Provide a high degree of scalability and a low level of latency by taking full advantage of parallel processing and memory capabilities.
• Provide fast and easy methods to expand and contract resources as demand changes.
• Provide exceptional up-time with minimal outages. The system should be designed to expect errors and recover accordingly without impacts to the end-user.
• Create a global experience spanning both time zones and geographical boundaries to unite business systems and partners.
• Support a variety of workload types including transactional, analytic, pull, and push.
• Increase effectiveness, efficiency, and affordability while promoting growth.

The CAP Theorem
A popular theory called the CAP Theorem states that it is not possible for a distributed storage system to be “consistent, available, and partition tolerant” at the same time. At any given point, only two of these goals are achievable. Because of this, tradeoffs must be made when distributed systems are designed and implemented.

The Eventually-Consistent Design Strategy
Some web developers are trading consistency for uptime when designing their applications. In anticipation of the need to partition the network as the system grows, they have relaxed consistency requirements in order to guarantee a higher degree of availability during and after the partitioning. This means that individual network outages could result in stale data or other minor problems instead of a nonfunctional website. These “eventually consistent platforms” were inspired by online icons like Google, Microsoft, and Amazon; many cloud-based services and open-source projects offer products that use this design structure.

A Different Approach: Enterprise Data Fabric
Although the eventually-consistent design is acceptable for many applications, it’s not a viable solution for any process where consistency is a key concern. For example, inconsistent processing in a financial system could spell disaster with multiple downstream impacts to data accuracy and consistency. There will always be some form of CAP tradeoff in a distributed system, but a new approach called EDF, or enterprise data fabric, promises to provide a better solution for core business functions.

EDF solutions use a shared-nothing approach to scalability. Partitioning uses nodes that are connected to create a seamless and expandable “fabric” that can span application, geographic, and machine boundaries. To scale the available storage space horizontally, EDF simply connects additional machine nodes. Within these data partitions, entries are composed of key/value pairs with an exceptional level of thread-based consistency.

By isolating data, related partitions can be organized and grouped into service entities. This larger unit is deployed on a single storage device where it can be accessed transactionally with complete independence from other service entities. This approach allows the EDF to create fault tolerance using a partial failure mode with fault isolation.

EDF-based systems exploit the variable nature of data by building flexible configurations that allow for consistency, partition-tolerance, and availability tradeoffs based on when and where the application workflow processes the information. When implemented correctly, EDF strategies allow businesses to reach all three CAP goals, but not at the same time or in the same place.

With the right approach, data management across a distributed system can be an effective and affordable solution for modern IT departments. Before choosing a strategy, consider the benefits and potential issues that each one brings to the table.

The Need to Evaluate The Benefits of Cloud Computing
The “cloud” has definitely turned into the hot new buzzword of the IT industry. In the same way that “green” has become a standard operating procedure in other areas, an enterprise can be perceived as outdated and out of touch if it doesn’t use cloud computing in some capacity. In order to save money and stay on top of new technology, many IT professionals are being charged with evaluating the use of cloud computing in their specific areas of responsibility.

Benefit 1 – Only Pay for Actual Usage
Cloud computing’s biggest selling point is that it reduces technology costs for IT departments of all sizes. Compared to purchasing enterprise-level servers for data warehousing, the startup costs are low, and this expenditure now moves from capital expenses to operating costs that can be charged off in the same year. In addition to these financial benefits, the pay-by-usage fee structure means that each month’s bill is as low as possible.

Benefit 2 – Scalability is Quick and Easy
In a traditional infrastructure, increasing or decreasing capacity isn’t quick or easy. If more disc space is needed, it usually means buying additional hardware or upgrading existing devices. Even if a system has extra capacity onboard that is only restricted by licensing, obtaining a new, working key isn’t always as simple as it sounds. In the meantime, most cloud computing solutions allow the IT department to instantly scale the capacity up or down within minutes using a simple user interface to modify the settings.

Benefit 3 – Reduces the Need for Upgrades and Maintenance
Similar to buying a new car, most hardware devices begin to depreciate as soon as they’re plugged in. In addition to that sunk expense, upgrades and maintenance are required on a regular basis. This drives up payroll costs and diverts attention from other projects. With cloud computing solutions, upgrades and maintenance are no longer a concern. Clients rely on the third-party service providers to handle the majority of the hardware issues without worrying about obsolete equipment.

Benefit 4 – Internet Based Means Easy Access
Depending on the application, remote access goes from complicated to simple with cloud computing. Because this technology can be accessed via the Internet, both internal and external users could be given authority to work with the company’s information from any computer with an online connection without the need for any additional infrastructure changes.

Security: The Biggest Concern
In a time when hacking and identity theft have reached historic levels, companies are more cautious than ever when in comes to data security, especially when storing their customers’ or employees’ personal information. A breach in this area can result in a damaged reputation, lost business, and other penalties. At first, many IT shops were very skeptical about allowing any third party to store their information on external devices, especially when access occurred over the Internet. The pressure to cut costs has forced most to take another look.

In the meantime, cloud-computing providers have reengineered their security protocols to ensure the safety of the data stored on their servers. Depending on the level of security used at the client’s location, many companies find that their enterprise-level data is safer and more secure in the cloud than on their own servers.

Of course, all third-party providers of cloud computing services don’t offer the same security measures. As part of the evaluation and selection process, every IT department should take a close look at the security features in addition to pricing and storage capabilities before making a final decision when choosing a cloud-computing vendor.

Spyware Identification and Some Simple Solutions

Spyware is generally encountered in three major distinctive forms: Hardware, firmware and software. All three types have various characteristics which can make defeating spyware difficult.

Hardware Spyware

An example of hardware spyware is the unique identification number of an Intel Pentium or later class of CPU. This number can be used to specifically identify any CPU. When combined with appropriate software, this number can be directly linked to an IP address and the precise location – if not the exact user – can be determined. The solution for this problem is using computer motherboards with BIOS setting that are capable of disabling access to those numbers. The solution for hardware devices can be complex, as most firmware and hardware is designed not to be detected nor disabled.

Firmware Spyware

Firmware spyware is semi-permanent software running at the machine hardware level. The BIOS CMOS chip is where it usually resides. Most is relatively innocuous; however, someone with malicious intent can replace the BIOS with a custom-made copy which can contain code to enable access to the computer. The best defense is to use factory-authorized and distributed firmware.

Software Operating System Spyware

Software spyware can exist in either the operating system or in applications. An example of operating system spyware was the recent disclosure of an operating system file that was inaccessible to casual users that recorded the GPS locations of where the device was physically located through its existence. The Apple iPad tablet and other similar PDAs used similar technology. After the spyware was brought to the public’s attention, the manufacturer quickly released a patch to the operating system that disabled the file.

Applications Spyware

This is code embedded within a program which can track and report a user’s activity. Typically, a file is generated within the application’s limited access areas, however, cookies can also be generated such that when the device is online, the recorded data – often in an encrypted form to hide its nature – can be accessed with ease. In theory, the EULA is supposed to disclose any use of data derived from use of an application, however, the legal wording is tedious to follow and it is almost universally ignored by the user installing the application. There are a number of spyware scrubbers available for retail sale that can clean up residual traces of activity and help ensure some modicum of privacy. But, as with any other software backup system, it is only good when it is regularly and routinely run.

The Business Challenge

Awareness and education are the critical components of fighting spyware. It is insufficient to simply install a software application and rest assured in the knowledge that the computer is protected. It is not. It would do absolutely nothing to prevent a spy from installing a wireless hardware keystroke logger into a keyboard and downloading a complete log of all of the keyboard activity on demand and by remote control. Passwords, account numbers, sensitive corporate data all would be compromised. Physical security, situational awareness and constant vigilance are a business’s best and only adequate defense.

Fibre Channel SAN
With a fibre channel SAN, space and distance is no longer a restriction. By utilizing IP protocols, the various storage devices that make up the SAN, or storage area network, can now be distributed over long distances to take advantage of remote data centers and even facilitate disaster recover efforts. Additional benefits include simplified storage administration, increased flexibility with minimal needs for recabling to shift storage resources from one bank of servers to another, and the ability to boot a faulty server from information stored on the SAN.

Tier One Storage
Based on the criticality of the data and the required uptime, computer centers rate their storage from tier one to tier four. While tier four is mission-critical information with the highest level of uptime and often requires redundant storage devices to protect the enterprise from hardware failures, tier one storage is much simpler. Most companies continue to expect that tier one data can be accessed the majority of the time, and operations won’t grind to a halt if they have to make do without it for a short period of time.

Fibre Channel SAN vs. Tier One Storage
When comparing these two types of storage methods, fibre channel San is generally more expensive, more reliable, and higher performing than tier one storage. However, that doesn’t mean it’s necessarily better. For each project, the organization’s needs and goals should be carefully evaluated before deciding whether to implement a new system using fibre channel SAN or tier one storage based on the following criteria:
• Is this a mission-critical task?
• What are the availability requirements?
• What is the cost of an unscheduled outage?
• What level of performance is required?
• Is there an effective and efficient work-around in the event of an outage?

The Current IT Reality
With the current state of the economy, IT budgets are tight and many companies are making do with what they have. For some shops, this situation creates a conflict of interest in that only mission-critical projects are being pursued, but there is little to no room in most budgets for new hardware. This can mean that systems requiring maximum uptime with a high level of risk in the event of data loss are being implemented on tier one storage units at this time. This can lead to higher maintenance costs, frustration for users and business partners, and even the loss of important information.

The Next Wave
We’ve all marveled at how far flash drives have came in a relatively short period of time. Not so long ago, we were amazed by the ability to store gigabytes of data on a thumb drive. Now, this technology has evolved into terabyte hard drives, and Apple has started including solid-state memory in many Macbooks. The next step for this reliable storage media is the banks of tier one storage devices. These new devices are expected to be faster, cheaper, and more reliable than even the best fibre channel SAN units.

Although fibre channel SAN storage provides a higher level of reliability and performance, it does so at a substantially-higher cost. Depending on the system requirements, tier one storage can be just as effective while lowering the overall implementation costs. Of course, both of these technologies will ultimately be replaced with something newer, better, and cheaper.

Industry Regulations
Certain industries are required by law to maintain records of certain transactions for very specific time periods or face strict penalties. To complicate this matter, an individual business may face a different set of regulations on the local, state, federal, and even international level. Although these laws don’t generally refer to emails specifically, this medium is now recognized as the standard mechanism for trading both information and documents. Instead of the banks of file cabinets that were seen in a past era, companies with strict regulatory requirements should now be maintaining a bank of servers dedicated to not only storing business-critical emails, but also providing a fast and easy search and retrieval method.

Businesses that don’t comply with the rules when it comes to maintaining copies of legal documents and financial transactions run the risk of penalties imposed by organizations like the Securities and Exchange Commission, Sarbanes-Oxley, and a host of other government agencies. Not only can these agencies impose strict monetary penalties, they can also halt company operations in many cases.

Other Legal Issues
While the vast majority of businesses do not fall under the shadow of government regulation, every enterprise runs the risk of legal action as a general cost of doing business. These days, even the most impeccably-managed company has virtually no chance of staying out of the courtroom forever. As mentioned previously, email has become the accepted standard for both corporate and personal communications. With this evolution, court-ordered discovery motions have began asking for copies of emails more and more frequently.

If an organization can prove that it has a strict policy of always permanently deleting email messages under certain circumstances, like after a certain time period, they may be able to convince the court that the email messages simply can not be reproduced. However, if there is even one exception to this rule, the company can be subject to sanctions and even losing the case if they do not produce the requested evidence during the discovery period. Of course, an ethical company has nothing to lose by producing the requested emails, and the documents could earn a judgment in their favor. Without them, it could be a very different outcome.

Archival and Retrieval Issues
Although most companies realize that the archival and retrieval of business-critical email communications is necessary, many haven’t taken the necessary steps to implement an effective system. Some companies rely on individual users to maintain their own system of saving important emails. Historically, they have established size limitations on user-level mailboxes to force individuals to file critical messages and delete unimportant communications in a timely manner or face problems processing their incoming and outgoing messages. As document size has grown dramatically, this method is not nearly as effective as it once was as users spend an inordinate amount of time managing their mailboxes.

A more effective method involves an automatic archival system that transparently moves emails to the archive server after a certain amount of time. Although the information is no longer physically stored in the user’s primary mailbox, they continue to be able to access the emails in a timely manner through the retrieval process. The users no longer waste time managing their mailbox, the enterprise has a reliable archival method in place, and all legal requirements are covered.

The one drawback to this method is that many companies are seeing a dramatic growth in storage requirements. To combat this problem, newer methods to separate mission-critical business documents from meeting notices, day-to-day communications, and personal messages are needed. Instead of programming these complicated policies into the archival routine, dedicated mailboxes could be established to hold legal documents and other important communications.

To protect businesses from legal and regulatory repercussions, effective methods to both archive and retrieve business-critical emails must be implemented. By neglecting this important task, companies run the risk of sanctions, monetary penalties, and lost law suits.

The Security Risk of Unauthorized Software
Although most users think that running a self-discovered piece of software is harmless, it can expose the company to viruses and hackers. Freeware may appear to offer valuable tools, but hackers often hide malicious code behind a useful program. It’s true that the user may receive some benefit, but it will be overshadowed by the spyware running behind the scenes that eats company resources and searches for confidential information. In this case, the best scenario could be that the original offender’s machine eventually grinds to a halt. The worst thing that could happen is that a hacker accesses the company’s internal files. Several public relations disasters have made the national news when companies allowed their entire customer database containing personal financial information to become compromised. Not only did this ruin the company’s reputation, it also cost a pretty penny in paying for credit protection for the affected individuals.

What Are Workers Downloading Anyway?
In some cases, employees are downloading tools that they feel they need to do their job. It’s often difficult for non-IT workers to know how to request new software tools, and decreasing budgets are making it harder to purchase new licenses even when the enterprise realizes new software is needed. Whether it’s out of ignorance or out of desperation, some workers feel that they have no choice but to look for free programs to meet their needs. In other cases, employees are using their spare time to continue activities they may enjoy during their off-hours. If they’ve been using peer-to-peer programs for messaging or finding free music at home without a problem, they may not see an issue with loading it on their work machine. The same goes for various browser plug-in and video games. However, this wide-scale practice of installing unauthorized software comes at a steep price to the company. Even if security isn’t breached, these programs often conflict with company-authorized code becoming a maintenance nightmare that only increases support costs. The bandwidth that is used for non-business purposes can even interfere with a customer’s ability to reach the corporate website and result in decreased levels of customer service.

The Need to Lockdown Desktops
Any security-conscious organization should make locking down user desktops to prevent the installation and execution of unauthorized software a high priority. Without using automated methods to prevent these actions, users can risk the health of legitimate applications. This can result in the diversion of valuable resources from revenue generating tasks and quickly impact the bottom line. As a result, customers could be lost and jobs could disappear.

Lockdown Methods
Depending on the needs of the business and the types of desktops in use, several methods can be used to lockdown each machine. Here are a few of the recommended lockdown methods:
• Restricting User Rights
• Setting Software Restriction Policies
• Creating Certificate Rules, Hash Rules, and Path Rules
• Installing Scanning Software that Monitors Programs Installed on any Computer connected to the Network
While each method has pros and cons, security experts are hard at work developing new methods to help IT departments control the actions of their users to protect the core system and reduce costs.

Network Access Policy Defined
While most system professionals understand the need for network security, they may confuse the network access policy itself with network access policy tools. The policy is separate from any tool that is used to implement, enforce, or monitor the rules. In addition to identifying users, devices, and locations, the network access policy should also specify exactly which resources each user can access and at what level. For example, only a small number of employees should be allowed to access human resources or payroll information, and an even smaller number should be able to modify the data. Network access policies should also define the expiration timeframe for user passwords, whether or not users can unlock their own accounts, and rules for new password creation. The network access policy should include strict rules for on-site connections, but even stricter requirements for remote connections. A company policy on connections to outside resources, like the Internet and ftp transfers, could also be included in the network access policy, as well as the virus protection software that must be used by each device. Without defining the network access policy, evaluating and choosing a tool that fully meets the needs of the enterprise is a difficult task.

Improved Network Visibility
While a secure system that prevents unauthorized access is the goal, network access policies should never be so strict that they prevent the efficient use of the system. In some cases, IT shops have locked down their company’s electronic recourses to the point that even the developers could not do their job effectively. By using network access tools, the IT group can expand their network visibility to improve security, easily comply with system security regulations, and enable both the system and users to work together in an efficient manner to achieve the ultimate goals of the individual business model.

Flexibility is Key
When evaluating new network access policy tools, the IT team must look for flexibility. If the new tool does not integrate with existing business processes, customized applications, and the current network infrastructure, the evaluation team should discard it as a potential solution and continue their search. Regardless of the included features or expected value, redesigning the entire enterprise to meet the needs of a new network access policy tool would be cost prohibitive. Even when a specific tool comes highly recommended by another organization, each IT department must decide if it fits their specific needs. Because no two IT shops are exactly the same, each one requires a unique solution to meet their security needs. Of course, the tools with the most built-in flexibility will be able to fit the widest range of system specifications.

Cost Reduction is Another Goal
In addition to a flexible product, the evaluation team should identify ways that a proposed network access policy tool can reduce company expenses. The tool should allow the IT security group to easily and quickly locate and authenticate both users and devices within the network. If security personnel find the new product to be clumsy and slower than their current method, the implementation team will face resistance to its use during installation and training. In addition to ease-of-use and security team buy-in, the network access policy tool that is ultimately chosen should also provide extensive information about each user’s identity and location to reduce the time dedicated to IT support and troubleshooting while minimizing the risk of security breaches to the enterprise.

Operational Challenges
Because WLANs use a license-free radio signal for connectivity, the operational challenges of keeping the network running issue-free are very different from supporting a traditional wired network. The following list details the key wireless performance issues that affect WLAN deployments:
• Coverage and Capacity – Because signal strength weakens as the distance from the transmitting device increases, many buildings experience coverage holes and fading signals. Poor connections or the inability to connect at all can be frustrating and negatively impact productivity. Bottlenecks in the system can affect throughput as Access Points (AP) are overloaded or specific users consume excessive network resources.
• Noise and Interference – Because many other devices, from microwave ovens to Bluetooth devices, use the same type of frequency as the WLAN radio signals, ambient thermal noise and interference can create intermittent problems that are hard to detect. Although equipment does exist to detect these issues, the price tag is usually cost prohibitive leaving many IT departments to guess about the actual source of their WLAN problems.
• Connectivity Problems – When a user reports they are having problems connecting to the network, the list of potential problems is long. On the user’s side, it could be user error, an incorrect security key, or a bad driver. The AP could be having hardware or configuration problems, or the gateway on the wired network could be having a problem.
• Roaming Issues – As a wireless client moves, or roams, it switches from one AP to the next. If the switch doesn’t go smoothly, the user may experience latency or jittery connections. Instead of using a laptop analyzer that makes troubleshooting a connection to a single AP easy, a distributed monitoring system is required to find roaming problems.

Security Risks
The same radio waves that make WLANs convenient and easy to implement create a way for hackers to attack the system. With the growth of identity theft rings, malware attacks, and other internet threats, it’s critical that businesses address the security issues related to WLAN use. There are three primary ways that hackers take advantage of WLANS:
• Denial of Service – The hacker floods the network with signals that impact the availability of resources.
• Spoofing – The hacker assumes the identity of a valid user to steal sensitive information. An attacker may even disguise their connection as an AP.
• Eavesdropping – Because WLANs radiate network traffic into the open air, it is possible to collect this information from a remote location. Hackers are sometimes able to intercept confidential data in this way. Because the information also reaches its original destination, unprotected businesses are often unaware that this has occurred until it is too late.

Best Practices
Every IT department should research the industry’s recommended best practices to manage and mitigate both the operational challenges and the security risks that come with WLANS. Some of these methods include:
• Use APs as network monitors. Within special AP firmware, promiscuous mode can be set so that specific APs serve as sensors to continuously monitor the network for performance issues and security violations. This allows network administrators to research wireless issues from anywhere with access to the WLAN.
• Take advantage of automated tools. Because WLAN use is increasingly prevalent, software development firms are developing new WLAN monitoring tools every day. Evaluate several to find the one that best fits your IT department’s needs to reduce the time needed to troubleshoot operational problems.
• Encrypt wireless traffic. By using protocols like Wired Equivalent Privacy (WEP) or standards like 802.11i, data transmitted across the WLAN is encrypted. Unless the receiver has the correct encryption key, the information is useless.
• Change the default SSID. Because the Service Set Identifier (SSID) works as a password when devices make a connection to the WLAN, it must be changed regularly to maintain high security levels.
• Use Virtual Private Networks (VPN). A VPN provides a secure, encrypted connection to the WLAN from a remote location so that hackers can’t use intercepted information.
• Minimize WLAN radio waves in non-user areas. By restricting radio transmissions to the inside of the physical building as much as possible, hackers will be less likely to attack the system from the parking lot or street.