Student information systems rife with security flaws

Here's an interesting story from Slashdot today about a college student being expelled after pointing out flaws in his college's student information system.

What he's seeing is no surprise. Starting with my days working for IBM's EduQuest division, for the past 20 years or so I've seen numerous K-12 and higher education student information systems chock full of security flaws. Stupid, silly security flaws like SQL injection, cross-site request forgery, URL manipulation, no passwords - you name it...none of which should've been around 10 years ago, much less today. But they're there.

Folks, if you work for a K-12 school, university, or you're a parent curious about how your student's information is being handled (and protected), start asking questions like:

• When was the last time this application was tested for security flaws? (their vendor's SSAE 16 report won't cut it)

• What was done about the flaws that have been discovered up to this point? (even when flaws are found, many people still have political, financial, and time management hurdles that get in the way of improvements)
  

Someone needs to be in charge of managing these risks.

Certain people at the school level will tell you that student information is secure because their auditor ran Nessus and everything checked out okay. Need I say more?

The student information system vendors will tell you their applications are secure because they have good programmers. Again, based on what I've seen, they're most definitely not.

Even if the vendors delivered flawless code, there's still integration and customization unique to each school that can introduce some ugly stuff that puts student information at risk.

Be wary and don't be afraid to push the people responsible for making things right.

Read More

Dear Neal Boortz,

With this being your final day on the air, I thought it would be appropriate for me to send you a note of thanks for all you've done for me the past 20 years or so that I've listened to your radio show. Rather than wax poetic in paragraph format I want to list out the things you've taught me that have greatly enhanced my life.

Neal, you have taught me:

• To be an independent thinker
• To question liberals and conservatives - especially those who want to force their ideals upon us and control us using the police power of government
• To work hard, really hard - and then keeping on working some more (the 40 hour work week is for losers indeed)
• To take care of my health
• To appreciate every moment with the people I really like to be around (I really miss Royal too)
• To not be afraid to speak my mind if I feel strongly about something (you helped inspire the name of my company, Principle Logic)
• To read, read, read and take in as much knowledge as possible
• To be a better writer
• To hold people accountable
• To laugh
• To go all out

My late mother, Linda Beaver, used to call me Neal Boortz Junior...all the time. She loved you too. I know she's happy for you as well.
 
With each day that passed this week, I got a bit choked up knowing that I was one day closer to losing the very inspiration and insight that has helped me reach such a great point in my life. Around 11:58am today, as you were signing off, it all came to a head and I broke down.

I owe you a debt of gratitude Neal. A big one. I wish I could repay you somehow.

Most importantly Neal, e n j o y  y o u r  r e t i r e m e n t. You're a very lucky man because of all the luck you've created - now go have some fun! Just know that you'll be greatly missed.

Adios MFer! ;-)

Sincerely,
Kevin Beaver

Read More

How are you getting your points across?

Here's a great point to remember regarding information security:

"A mediocre person tells. A good person explains. A superior person demonstrates. A great person inspires others to see for themselves." -Harvey Mackay

Read More

IT security careers, committees, and corruption

Here are some new pieces I've written on IT and security leadership (or lack thereof). Enjoy!

What to do when the CIO gets in the way of enterprise IT security

How to form a functional enterprise IT security committee

Understanding management gets your IT department what it needs

Five Concepts for IT Security Success

As always, check out principlelogic.com/resources for links to all of my information security whitepapers, podcasts, webcasts, books, and more.

Read More

What do credibility, BYOD, & mobile security have in common?

They're the topics of three new pieces I've written!

I can't believe I've been writing more than ever lately but haven't kept up with my posts accordingly. In the interest of catching up, here's some new content I've written on mobile security, BYOD, and IT/security careers:

Credibility is the cornerstone of your career

As BYOD, cloud change networking, VPN management still indispensible

Top 10 reasons we have our heads in the sand over mobile security

By the way, you'll need to register with TechTarget to access the content but their membership is worth it - lots of great resources on practically every IT topic imaginable.

Enjoy!

As always, check out principlelogic.com/resources for links to all of my information security whitepapers, podcasts, webcasts, books and more.

Read More

Fix for painful authenticated web vulnerability scans requiring MFA

Authenticated web security scans are one of the most frustrating parts of web security assessments. I mean they're downright painful, oftentimes seemingly impossible - especially if multi-factor authentication (MFA) technology is in use. Yet authenticated scans are critically important. It's scary how many times I uncover serious flaws (i.e. SQL injection) while logged-in as a typical user of a web site/application. That is if I can get my web vulnerability scanners to login and work properly!

Side note I have to bring up: I hate to think how many web security flaws are overlooked because people aren't testing their applications as authenticated users. Who am I to question it...

You see, the problem is that web vulnerability scanners are often tripped up with form-based logins. Why? Because they struggle to determine and maintain session state (the browser's/scanner's ongoing communication with the web application). Newer web technologies such as Flash and AJAX are big contributors to the problem, but web applications using MFA can be especially troublesome.

During a recent web security assessment, I struggled - hours on end - to get two different commercial vulnerability scanners to work with Oracle's Bharosa multi-factor authentication technology. I literally lost a day's worth of work trying to get these scanners to record login macros and properly maintain their session state so they could complete their scans.

What a frustrating scenario. The solution was simpler than I thought it'd be. I ended up using a third scanner - NTOSpider, which I've leaned on before to get me out of a bind in such situations - and it worked like a charm! What took me 6+ hours of pain and hassle with the other scanners (with no results, mind you), took just 6 minutes with NTOSpider.

I recorded the login macro, tested it, and got the scan rolling. It was amazingly simple. Given how much NTOSpider got logged out and had to log back in to the application, I could tell it was struggling a bit to maintain state, but it still WORKED! NTOSpider's feature that shows whether or not the scanner is current logged-in to the application is especially nice in these situations.

Side note I have to bring up: I can't imagine how many web security scans are deemed "complete" when they, in reality, failed to authenticate and properly test the application. I suspect this is a huge problem that's being overlooked all the time and people wonder why their web applications are hacked. Who am I to question it...

I'm a big advocate of using multiple scanners when testing web applications...just not in this context! But you've got to do what you've got to do in order to get good results. If you're testing web applications as authenticated users (you should!) and end up struggling to get your login macros to work, know that NTOSpider might just get you out of a bind like it did for me. Or, if it's one of your main scanners, prevent these problems in the first place.

Whether your applications use MFA, form-based logins, or good old-fashioned NTLM pop-up windows, just make sure you're using multiple scanners to test your web applications as they all tend to find unique flaws you probably can't afford to overlook. Oh, and never rely on scanners alone...do that and you'll surely get bitten.

Read More

Are you doing enough to protect your secrets? It's unlikely.

If the person who heads the CIA can't keep his "secrets"; nothing's secret. It's as simple as that.

What are you doing to ensure your intellectual property is protected?

Lawyers will claim their contracts are enough. Management will leave their heads in the sand and claim their IT folks are handling it. Neither are enough.

Fix the silly/ridiculous/inexcusable low-hanging fruit on your network and then put the proper technologies and procedures in place to build things out from there. No matter how much money you've spent, how good your IT staff is, and how much you trust your employees, there's always room for improvement.

Read More