Re: Data in transit (with a twist)...

[Vic Vandal <vvandal () well com>]

If your company handles sensitive data of the types mentioned (PCI, HIPAA), and if independent regulatory or business 
partner audits occur, be ready for negative findings regarding the security of the unencrypted media in transit.  The 
company I work for had negative audit findings on that years ago, even though backup tapes and drives were being placed 
into locked metal boxes and then transported by a secure offsite storage vendor to a secure offsite storage facility.  
The concerns raised were around the plausibility of some of those metal containers "falling off" the truck in transit, 
or the data being accessed by rogue employees of the secure storage vendor.  So we were forced to invest in tape backup 
encryption as well as in-line data storage encryptors, and now we have encrypted backups of storage-encrypted data that 
still is transported in locked metal containers.

However if you can somehow avoid that encryption overhead in the UK, then what you'll need (as evidentiary support of a 
secure process) are written policies and procedures that state something like;

- tape backups and other data storage devices will be locked in metal containers before being removed from the secure 
data center
- only [your company name] data center employees will have access to the keys to unlock the media transport containers
- logs will be created and maintained that track all transport container possession and movement, which will include a 
media inventory of each container that leaves or is returned to the secure data center

That's only a few high-level bullet points.  You'd have to elaborate by adding a policy title, purpose section, scope 
section, policy detail/guidance section, personnel responsibilities section, enforcement section, and document revision 
history.  Ideally your policy/procedure will stipulate the use of encryption, as well as the locked containers either 
in companion to media encryption or as the only control measure where encryption is not feasible.  That way you account 
for the possibility of using encryption in the future.

As for media disposal you'll need written policy/procedure language that specifies approved options of;

- data over-writing, using Guttman or DoD 5200.11 compliant technologies
- strong magnet or electric degaussing, using NSA compliant devices
- media destruction (shredding, drilling, etc.), using NCSC-TG-025 approved methods

Good luck.  And be prepared to put forth the expense and effort of strengthening the security controls as time goes on. 
 New regulations routinely come out that push the security bar higher, which dramatically increases the cost of doing 
business.  It's unfortunate but that's the world we live in.


-Vic


----- Original Message -----
From: "cribbar" <crib.bar () hotmail co uk>
To: pen-test () securityfocus com
Sent: Wednesday, November 23, 2011 11:11:35 AM
Subject: Data in transit (with a twist)...


Hey Guys,

This is not so much a pen testing question (although perhaps you pen test
physical transfers) – but as many of you are absolute security experts, some
I assume will be CHECK/CREST approved – it is a valuable resource I’d like
to tap into for some general brainstorming and advice. 

I need some best practice controls, ideally in the form of a best practice
checklist that will satisfy internal and external auditors - for when our
data is in transit. The twist is, I am not on about “In transit” in terms of
electronic transfer; – I am on about backup tapes and redundant drives
physically being transferred from one site to another. The data on such
falls into “fairly sensitive”, i.e. no credit card details, but a degree of
personal data non the less. 

I’ve got 2 scenarios really – 

(1) All “servers” and backup facilities are in a secure data centre (lets
say building A). When they are physically taken out of this environment and
transferred, I class this data and media as “vulnerable”, whereas on site,
in terms of physical security I have reasonable assurance the data is
“relatively safe”. 

Redundant (those flagged as ready for disposal) drives out of the few
remaining physical servers (some process/store sensitive data) are initially
transferred to local HQ (building B). These drives ARENT encrypted. Also,
backup tapes (again NOT encrypted) are transferred from building A >
building B as part of disaster recovery ops. 

(2) We also have building C which is where the main employees office is.
> From here redundant IT kit, such as old PC’s are flagged up as ready for
collection. IT collect the kit and it is stored in building B. Once the
store in building B is high enough, a local 3rd party service will collect
the PC’s, and “data-wipe” them. Workstation drives ARENT encrypted. Laptop
devices ARE encrypted. 

We need some procedural safeguards in all of this. Especially around
accountability, integrity, and confidentiality.  I am struggling to locate a
really detailed best practice guide around physical collection, physical
transfer and storing of redundant hardware and backup media in an
unencrypted state. I assume this falls under “asset management” but again I
am struggling to find a comprehensive best practice checklist that I can
align procedures around. I want to align our procedures with best practice
in this area from a reputable source, but to my surprise there doesn’t seem
to be much out there. However, perhaps searching asset management is the
wrong terminology in IT circles. 

The risks are obvious. We are essentially transferring highly sensitive data
from different sites in an unencrypted state (issue in itself). There are
accountability, integrity and confidentiality risks to the hardware AND data
resident on this media. There is also potential availability risks in
relation to the backup media, as well as the integrity and confidentiality
risks to the data and backup media. This must fall into compliance for
issues like PCI and HIPAA. 

Any best practice or comments will help no end. 

Thanks for your time in reading this.

Cheers,

Cb

-- 
View this message in context: http://old.nabble.com/Data-in-transit-%28with-a-twist%29...-tp32874247p32874247.html
Sent from the Penetration Testing mailing list archive at Nabble.com.


------------------------------------------------------------------------
This list is sponsored by: Information Assurance Certification Review Board

Prove to peers and potential employers without a doubt that you can actually do a proper penetration test. IACRB CPT 
and CEPT certs require a full practical examination in order to become certified.

http://www.iacertification.org
------------------------------------------------------------------------


------------------------------------------------------------------------
This list is sponsored by: Information Assurance Certification Review Board

Prove to peers and potential employers without a doubt that you can actually do a proper penetration test. IACRB CPT 
and CEPT certs require a full practical examination in order to become certified.

http://www.iacertification.org
------------------------------------------------------------------------