The Newberry Group Blog RSS Feed

Technical Considerations When Working With Lawyers - Part 5 in a 6 Part Blog Series

Jeremy Wunsch — Thu, 28 Jul 2016 16:32:00 GMT

As a forensic consultant, the phone is constantly ringing. Calls come from law firms and from corporations; you never know who you will be talking to when you pick up the phone. More importantly, the other unknown when you pick up the phone is the level of technical knowledge the person you are talking with has. Over the years, we have worked with people that we have had to educate on technology and in other instances we have dealt with technologically savvy individuals. I am not saying that your legal team needs to understand technology at the same level as your forensic consultant, but it is critically important to your case that whoever is involved, knows how to properly work a theft of IP case.

One of the first cases that I ever worked on for a theft of IP was with a senior partner of a mid-sized law firm. While talking with him, it was readily apparent that his understanding of technology was fairly low. He would never ask questions and wanted me to believe that he completely understood technology he was dealing with. As we worked together, I realized that I would have to mix case details with technology education, without making him realize I was teaching him. Lucky for us, the lawyer on the other side knew even less about technology than the lawyer I was working with. My client won their case and everyone was happy, but I have to share one last question that I was asked by the lawyer I had been working with after the case was completed. He asked - “What is a hard drive?” I was shocked. I didn’t know if I should laugh or cry, as we had been talking about data being stolen from hard drives throughout the entire case. From that moment on, I paid very close attention to the technical knowledge level of everyone that I worked with.

Before I continue, a disclaimer. I’m not here to tell you which law firm or specific lawyer you should work with. I’m not talking negatively about any specific firm or specific lawyer. But as my years of experience have shown me, I have found it very important that when you are selecting counsel for a case; make sure to retain lawyers that truly understand technology and that your case is not the first time that they have been involved with theft of IP. I would encourage asking for a list of theft of IP cases that they have taken to trial and ask for references.

And here is why.

Home Based Employee Case Study Continued:

I’m going to jump back in to our home based employee case study that we have been discussing in previous blog posts. Again, I am not here to say this is a bad firm, nor am I hear to say that the lawyers at the firm that I worked with should not be used again for cases like this. I want to point out opportunities to work the case differently, allowing the case to move along faster. Perhaps more importantly, potentially reduce and maybe even eliminate legal fees for our client.

Let’s recap a few of the key things that happened after we gave our initial findings report to the original law firm:

· Our client thought they would be better represented by having a law firm that was based in the location of the two employees that left.

· The firm that they chose was a very large international firm.

· The transition to the new law firm for our part of the case was not smooth. Weeks passed and no contact was made even though we were the only ones with “smoking gun” evidence in this case.

· Knowing that time was of the essence in order to get a TRO; concern was growing that I had not heard from the new law firm for weeks after I was told about the change.

· When the new law firm called us, it as an associate of the senior partner that the corporation had hired, and we were told that they had received the report and that someone would get back to me.

· Weeks went by and I received another call to “understand” the findings of the report. To the law firm’s defense, because of the home based network that one of the employees had, it was not your typical report and the complexity of the report would have been difficult for all but the most technical lawyers to understand.

· In the end, the new law firm opted not to pursue a TRO against the two departed employees. They wanted to “play nice” assuming that the employees would just turn over their personal devices when requested to do so.

· The employees each retained their own lawyers to fight turning over their personal devices and instead of heading to court to fight this battle of stolen IP, it was decided to opt for arbitration instead.

· Upon the decision to go through arbitration, we did not hear from the new law firm for the next 8 months.

So we pick up the story 8 months later. To be honest, we thought the case had settled and we were not notified, as our emails and phone calls were going unanswered. Then out of the blue, I got a phone call from the associate at the firm. We were told that they were in settlement discussions with both of the former employees and they needed our help finishing up writing a settlement agreement. I asked them to send what they had up to this point and I would make changes and recommendations to it. What she told us next was very alarming. We were told that the agreement was actually in final stages of development and both the arbitrator and the lawyers for the other sides had already seen it. At this point, we knew we had a potential problem.

From the discussions 8 months prior, I had already figured out that both the associate and the senior partner at this firm had limited knowledge about technology. Because of the very technical details of this case with this large home network, concern was growing over what we might see in a settlement agreement that had been drafted without our help. When the document arrived, my suspicions were correct. It was one of, if not the worst settlement agreement that I had seen in 20 years being a forensics examiner. Here are some of the highlights:

1. One employee admitted that he still had the virtual machine (VM) that contained corporate email but yet the settlement agreement stated that they agreed to take at face value the word of the former employees that they had no data in their possession.

2. The employees agreed to send the computers to check for IP, but there was no timeline for when the machines needed to arrive at our facility for forensics investigation.

3. In the initial reports, we listed countless devices that were used and might contain stolen IP, and they didn’t ask for most of those devices to be sent to be investigated.

4. We were prohibited from telling our lawyers and our corporate client what devices were actually coming in.

5. We were prohibited from telling our lawyers and our corporate client how much data we were searching on the devices that came in.

6. We were prohibited from telling our lawyers and our corporate client if we were finding any stolen IP.

7. We were prohibited from telling our lawyers and our corporate client how much stolen IP we had found.

8. We had to redact our invoice to remove any identifiable information that would inform the lawyers or our corporate client anything relating to points 4-7. Basically we were only able to hand them an invoice with a dollar amount and no supporting documentation. Not the way we usually do business.

9. Most importantly, the company that had their IP stolen had to pay.

Horrified does not even begin to describe how we felt about this agreement. This agreement failed to take in to consideration the type of technology in question and how that technology can not only be used to store IP but how we as a digital forensics company can identify our corporate client’s data contained on the machines and drives. We feared this agreement would end up being a very large and costly mistake. We raised our concerns with our client but they said they trusted the new law firm.

We suggested corrections/changes to technical aspects of the settlement agreement and at the same time, we created an internal protocol for how we were going to be handling the data that arrived from these two former employees. We were able to change the settlement so that the individuals would have to turn over anything that they had in their possession or household that could store electronic information. Items that this included were:

1. All laptops/desktop computer (including ones belonging to kids/spouse)

2. All USB devices that were used at the former employer, their new employer and at home (including kids/spouse).

3. Cell/Smart phones that could store email or documents (including kids/spouse)

4. Cloud based storage accounts

5. Online email (ie, gmail, yahoo, etc)

6. All NAS and DAS devices

7. Their new work computer

8. Their new work email and network shares

The reason we created that list is that we had evidence that the stolen IP had been moved and stored on some of the first 6 types of devices listed. Based on our experience, we assumed that the data also made its way to the new work computer and network. It took a few more months, but the technical changes we suggested finally made their way into the settlement agreement. Our requests to remove the language which did not allow us to effectively communicate was not granted so points 4-7 remained in the settlement agreement. I knew this was a disaster waiting to happen as we had never not been allowed to talk to our client about what was happening – especially when they were paying for the work.

Jumping ahead, some of the devices from the large home network started to show up. Surprise! The devices we received had large amounts of storage space and they were all pretty full. We quickly realized that we would not be searching a few GB’s of data; we were going to be searching terabytes and terabytes of data (one device alone had 8 terabytes on it) blowing our price estimates out of the water. But now we have a problem – we can’t tell our client any of this, but they are asking for an estimate of what the cost would be. When we told them a dollar number, there was dead silence on the phone. Then there was anger. Then there was a demand to tell us how we got that number and all we could say was there is a lot of data but I can’t tell you anything else because of the settlement agreement. They had no idea the amount of data that we were being sent, and we had not even received 50% of the data yet. It was finally beginning to sink in to them that this might not have been a very good settlement agreement. The project was immediately put on hold due to cost considerations.

We told them that there was not much we could do unless some part of our hands were untied. The attorneys went back and got part of the settlement agreement removed so I could now tell them how many devices had come in and how much data was on each device. When we told them – their jaws dropped. But yet, I still could not tell them how much IP I was finding.

The law firm decided to have us search for very specific extensions to reduce costs. While this might sound like a reasonable idea to reduce cost, we had already found IP in file formats that were images, audio and video. The only way to search these types of documents is to actually put “eyes on the file”, meaning someone would have to take the time to review each one. The law firm and the client decided in a cost benefit analysis it was not worth having someone review those non searchable files.

The law firm also decided to reduce the number of devices that were going to be delivered to us. They had already agreed on doing the search and delete on a rolling production, meaning we would get a few machines to run the protocol on them and then send them back. Here is the problem with this scenario. If there were other machines still at their homes that were not sent to us, yet contained IP, they could very easily go ahead and move the files between machines. In our initial protocol, we would have looked for this type of file movement, but our original protocol was scrapped. The law firm had limited understanding of what technology could do and at what cost. They also decided not to take a look at all machines and devices in their household. This meant all the former employees had to do was say a computer belonged to their spouse, and they wouldn’t have to send it in for inspection, even if it contained IP.

All along we were ringing alarms bells to our client as much as possible. I even asked our corporate client, if you are not going to do it right, why even do it at all. They went silent and couldn’t answer the question. They finally came back to us confirming their trust in their law firm. Here is the sad reality. We finished the project with the new protocol developed by the law firm, objected to by us. The law firm wasted their clients’ money and after all was said and done; we know that the two employees still have copies of IP that they took.

The mistakes that were made by the new law firm because of their lack of understanding in both technology and IP theft cases were some of the worst we have ever seen. If you remember in my last blog post, the other case that I outlined had roughly 2000 documents stolen and they were awarded $14 million in damaged. In this particular case, there were millions of documents stolen (we assume well over 8 million files were stolen) and we believe that some of them are probably still in the employee’s possession. In the end, our client was awarded nothing due to the settlement agreement, yet they had more than $1 million in legal and third party fees that they had to pay for out of pocket.

The choice not to listen to our expert advice and the decision to “play nice” backfired costing the corporation millions in legal and other associated fees and their competition is probably using their IP as we speak. Had the law firm worked the case differently, understood the forensics process, and understood the capabilities of the technology, the company would have been able to have all the IP identified and removed and have the other side pay for it.

Moral of these stories - when you have a theft of IP case, do your due diligence. Do not assume that the law firm you currently utilize can handle a theft of IP case. Theft of IP is very serious and very costly. Make sure law firm treats it that way also.

Click here for more information.

Reverse IP Theft - Know What's Coming In To Your Organization. Part 4 in a 6 Part Blog Series

Jeremy Wunsch — Mon, 27 Jun 2016 13:00:00 GMT

As you have been reading my blog series about theft of IP when an employee departs, I have mentioned that reports have said that about 50% of all departing employees take intellectual property with them to their new employer. After all, chances are great that they got their new job because of the work that they did at their previous employer.

We have been talking a lot about that departed employee and how to detect if and what data they may have taken. But now let’s turn things around. Your company is the one that has hired an employee that stole Intellectual Property (IP) and they bring it inside your company. How do you know they brought stolen IP in? Do you have some type of legal exposure? When they end up leaving your company, will they also steal IP from you? The list of concerns with employees bringing stolen IP inside can go on and on.

Reverse Intellectual Property Theft is when a new hire brings stolen IP into your company. Chances are that in your hiring process, asking questions about stolen IP is not something that people think to ask about. Most companies that I have worked with rarely do much to discourage or stop IP from coming in until it is too late and they get caught. One simple measure to help discourage new employees bringing in stolen IP is to incorporate some documentation regarding no disclosure or use of Confidential Information of Others. The intent of this language is to make sure that the new employee is aware they are not to bring into your organization IP from another company. It should also address that they not use in the performance of their responsibilities at the Company any confidential or proprietary information, materials, trade secrets, intellectual property, or documents of a former employer or other third party that are not generally available to the public, unless the employee or the company has obtained written authorization from the former employer or third party for their possession and use. In addition, you might consider making random checks of new hires machines to make sure that other companies IP has not been brought in and outlining consequences if they do bring it in.

While this won’t stop you from getting sued if data makes its way onto your network, it should make an employee think twice before doing it.

Internal Employee Case Study Continued:

Now, let’s get back to our case studies. We are going to go back to the case study of that internal employee that left and went to work for the competition. As you may remember we were able to prove multiple things up to this point. The departed employee:

Used a sync function on some of the last days of employment.

The sync function appeared to sync IP to one or two USB devices.

Multiple USB devices (over 20) were used on the computer, and some were only used during his final days of employment.

We put in a request through the lawyers to get our hands on the 20+ USB devices, but only 4 arrived.

One of the USB devices that arrived was never used at his old work.

We asked for and received access to his home computer.

We identified that most of the USB devices had been used on both his home and old work computer.

The home computer showed us that the two USB devices that we were looking for where both used on the home computer after his last day of employment.

Data from his former company had been opened on his home computer after he started his new job.

It was at this point that the judge gave us access to his new work computer. As I mentioned in the previous post, we performed the “New Hire Program” package on his new work computer. This type of analysis is virtually the same as we perform when an employee departs but there is a key difference. We are now looking for data artifacts that show that data is moving onto, and not off of, the device that we are investigating. We also continue to look for USB devices; we are still searching for IP. However this time we are trying to match things up between the old employer’s computer, his home computer and his new employer’s computer.

To correctly match everything up, we created a timeline for the three machines. It is important to note that to do this correctly, you need to make sure that you take into account the time zone of the computer you are analyzing, as some data movement is not far apart.

When we started to look at his new work computer, we quickly identified that the key USB device had been used on the new work computer. Knowing the date and the time that the key USB device was plugged in, we started searching the work computer for data that was created after that date. Looking for files created within an hour of the time the device was plugged in; we found copies of files that appeared to be the stolen IP had been copied down to his new work computer. While this was a nice nail in the coffin, we finish our investigation process and what we found shocked even the new company.

In-between his start date at the new company and the date we received his new work computer, he had already changed the IP taken from our client, his former employer, and updated it with his new employers company information and logos. For example: he took his former employers’ divisions business plan and executed a “find and replace” of the old company name to the new company name. He opened presentations and changed all the footers and logos to the new company. It was determined that he had repurposed roughly 100 of the 2000 files that he had taken by just removing the old companies name and logo.

We reported our finding to our client’s legal team and they reported what we had found to the new company. In turn the new company immediately fired the employee. You might think the story ends there, but it does not. We continued our investigation, as we needed to be able to confirm that the repurposed IP had not made its way to the corporate network or to anyone else inside this company.

Unfortunately, we were able to confirm that data that he had brought with him had already been copied up to the corporate servers and more importantly we found that the data had been emailed out to the team he worked with, his boss and to his peers. It was beginning to look like this data was spreading within the new company.

All of this information was provided to the court. The judge in the case ruled that we needed to go into the new company and search their network shares, the computers of his boss, and all his peers to track down and delete all the IP that was stolen. Due to the volume and the extent of what was found, this deletion of IP took much longer than expected as we found that the people he had sent the data to had forward the data to others in addition to saving it to their network shares. Over time, the trail just kept growing and we kept on following it and deleting the data wherever it was found.

As the search for stolen IP continues, we start the analysis on his boss’s computer and boy, were we surprised at what we found. An examination of the boss’s computer found that he had stolen IP from our client years prior to him starting at the company. We began to wonder if there was an insider that was sending the boss this information. Through deeper analysis of this newly found “old” IP, and from conversations with our client, we discovered that the boss had been an employee of our client. When he left, he also stole IP, brought it into and disseminated throughout the new company. Once this information was given to the new company, he too was fired.

The Final Word of the Court:

Let’s jump forward in time. This case was not just about making sure that the data was removed from the new company servers and laptops and those two employees getting fired. Our client wanted the other company to reimburse them for all that they had spent on legal fees and all third party fees, including for the forensic work that had been done over the entire time period of this case. They were also asking for damages in addition to expenses. After a long trial, the judge ruled in favor of our client and awarded them over $14 million in damages and fees. As you can imagine, our client was very happy with the outcome.

The company that hired these two employees on the other hand was not happy at all. At no time did anyone in the organization think that hiring one individual would cost them over $14 million. So to answer one of my original questions, yes, you do have legal exposure if you hire someone that brings in stolen IP to your company.

Both companies involved in this matter have now taken additional steps during the hiring process to let all new hires know that bringing in outside data from previous employers is not allowed and it is cause for immediate termination. They have instituted simple forensic checks that give visibility to newly used USB devices and data that gets copied off of them. This data is randomly checked to make sure it is not from any of their previous employers. Utilizing the New Hire Program is how they are hoping to never have to experience a situation like this again.

While you might think that awards like the court handed down are rare, they are not. In most cases that I have been a part of, if we prove that data was stolen, it is very common for legal fees and other third party expenses to be awarded back to the company that had their data stolen. We all know that legal fees are going up and cases like the ones I am presenting here are no longer considered anomalies. As I mentioned, employees will continue to take IP out of and bring it into organizations. And, with the increased legal action that is occurring as a result of the ease of identifying those malicious actions through expert forensic analysis, organizations are paying closer attention to the data flowing in and out of employees hands.

The moral of this cautionary tale: Take precautions and make sure stolen IP isn’t being brought into your company.

Coming up – I will finish the story of the second case study. Stay tuned!

For more information on these services as well as other Forensic-related services we offer, please visit our website atwww.newberrygroup.com or email us at [email protected]" style="widows: 1; text-transform: none; text-indent: 0px; letter-spacing: normal; font: bold 14px/21px arial, helvetica, sans-serif; white-space: normal; color: rgb(153,0,0); word-spacing: 0px; text-decoration: none; -webkit-text-stroke-width: 0px;border: medium none;">[email protected]

Click here for more information.

Temporary Restraining Orders. Part 3 in a 6 Part Blog Series

Jerermy Wunsch — Wed, 08 Jun 2016 12:06:00 GMT

In my last blog post, I began two case studies. In both instances, we found that intellectual property had been taken when the employees left the company. Following our process, we created the Departing Employee Report that outlined all of our findings. We gave the report(s) to our clients and their external counsel. It is at this point in the story that these two very similar cases went in completely different directions.

In most cases, after our client and their law firm have a chance to review our findings and determine a course of action we are typically asked to write either an affidavit or a declaration. We take the information in our report(s) and put it into an accepted legal format (the affidavit or declaration) that can be presented in court. Which document we create depends on the law firm we are working with. Typically one of these documents is presented with a TRO (temporary restraining order).

When you hear TRO, many of you might immediate think of some type of harassment or abuse case. However a TRO has other purposes as well. One such instance that I have seen used over and over again in theft of Intellectual Property (IP) cases is requesting a TRO where the employee that left and took IP with them, not be allowed to go to work for the new company until the theft of IP case has been resolved in some manner. Typically in these cases where this type of TRO is requested, the law firm and the forensic company must move quickly so that the legal team has the information that they need to file for a TRO.

I cannot stress enough how important speed is when working a case like this. Because if the new employee has already been working at the new company for a few months, there is a high likelihood that the information that was taken has already been disseminated around the new company and a TRO is less likely to be effective. While I am not saying that you can’t get a TRO after a few months, you can, but you will just have more hoops to jump through. This scenario alone is a great reason to have a relationship established with a forensic company that excels at investigating IP theft cases.

Let’s get back to those two case studies. While these two case studies are of two companies in completely different industries, they are very much alike from a forensic standpoint. Data was taken upon employee departure, the departing employees went to work for the competitor and the companies hired external law firm to help. In both of these cases we were initially hired by the same law firm, a law firm that we had worked with for years and had a well-established process with.

Internal Employee Case Study Continued:

For this case, we wrote an affidavit to go with the TRO and the documentation went to both the departed employee and the departed employees “new” company. The “new” company was a Fortune 100 company, they were large enough that their first response back to the TRO was “if we wanted that companies IP, we would have just bought them”. At this point, the fun really started.

Along with the TRO, it was requested that the employee send all USB drives that they had used at our client’s company so that we could forensically examine them to find and remove our client’s IP. If our client’s IP was found on any of the devices, the court would uphold the TRO and the employee would not be able to work until the case was resolved.

Based on the request, the former employee sent four USB drives. As you may remember from the previous blog post, we were expecting over 20 to show up. So the fact that we only got four devices surprised us and angered the legal team. However, we still analyzed the 4 drives that we were given. Once the serial numbers were identified, we realized that only 3 of the devices that were sent to us had been used at the former company. The one extra USB drive was completely new to us. In addition, the key USB device that we were looking for was not one of the four that was sent to us.

All of this information was sent to the court, along with a request to get access to the former employee’s home computer. When the court learned that only 4 USB devices had been turned over, the court ordered that the home computer had to be sent to us for analysis.

A few days later, the home computer arrived and performed the full departing employee analysis on the home computer. Undertaking a USB analysis on the computer, we were able to identify that most of the 20+ USB devices that we were looking for were also used on his home computer, along with several other USB devices that were used at home but not on his old work computer. During this investigation, it was discovered that the one USB device that we didn’t have information on, showed up as being used on his home computer. What was the most shocking/concerning to our client, was that the key USB device had been used on his home computer just after he had resigned.

Since we had a lot of information about this key USB device, we performed some special searches for files that we knew had, at one time, resided on that device which belonged to his former employer, our client. We were able to determine that these files had been accessed and opened on his home computer, from that USB device after he had already started at the new company. These facts were presented to the court. The court did two things, first they granted the TRO and the employee couldn’t work anymore until the case was settled and secondly, the court gave us access to his work laptop. This upset his new company as they didn’t want to give up his work laptop.

A few days after the court order, his new work laptop arrived in our forensic lab. Once the device was in our lab, we performed the New Hire Program package on his machine. Stay tuned to future blog posts to see what this uncovered and how both companies responded.

Home Based Employee Case Study Continued:

In the case of the home based employee for this case study, things took a completely different spin once we delivered to outside counsel the report and they showed our client that had the employees leave. This company decided it would be in their best interest to change law firms and retain a firm in the state which the two former employees resided. I have worked many cases where our clients have changed law firms mid investigation, but this change did surprise me because the original law firm had a well know reputation for successfully litigating IP theft matters and I knew nothing about the new firm besides the fact that they were a very large international firm.

Our client and the now former law firm had told me that our report had been sent to the new firm and that I would be hearing from them shortly. Weeks passed and I had heard nothing. Knowing that we were initially going down the path of a TRO for both these employees I was getting concerned that I had not heard from the new law firm.

I contacted our client and let them know that I had not been contacted by the new law firm. They were surprised and said someone would reach out to me within 24 hours. Not one hour later, my phone rang. It was an associate at the new law firm. She said the partner asked her to touch base with me just to let me know that they got the initial report and they were working their way through it.

The clock was ticking for a TRO and it still took them two more weeks before they called again. This time they actually asked me to step them through the report so that they could better understand what IP had been stolen. This call ended up being the first of many phone calls to discuss the report and help better understand it.

In the end, the new law firm opted not to pursue a TRO against the two departed employees. They decided to “play nice”, reasoning that the employees would willing turn over their personal devices for us to search and remove all IP associated with their former employer. As you can imagine, that was not what happened. The employees each retained their own counsel, which vigorously fought any request to turn over their personal devices. In the end, instead of utilizing the courts to litigate the stolen IP, the decision was made to continue the “play nice”. It was decided they would pursue arbitration instead. It would be 8 months before I would hear from the new law firm again.

Where to Go From Here:

As you can see, two cases that were nearly identical at the start, have taken off in different directions. Is there are right or wrong way to take these cases? I would say yes… Over the next few blog posts, I will explain why as we continue with these two case studies. In addition, I will take a look at some things you can do to both prevent IP from being taken from your company and from new hires bringing stolen IP into your company.

Newberry Group has services that can support all of your needs in these areas. Our experienced team can conduct investigations that cover both the departing employee as well as the new hire for a fraction of the cost that you could incur should the examples above play out. Our Departing Employee Program and New Hire Program are fixed fee programs that consists of defined computer investigation service packages that identify and report on employee data activity. The packages vary as to scope and cost in order to provide you with a level of assurance proportionate to the value of the employee and the access that the employee had to your IP.

For more information on these services as well as other Forensic-related services we offer, please visit our website at www.newberrygroup.com or email us at [email protected]">[email protected]

Next Blog: Reverse IP Theft

Click here for more information.

When The Threat Strikes. Part 2 of a 6 Part Blog Series

Jerermy Wunsch — Wed, 08 Jun 2016 11:41:00 GMT

As I mentioned in my first blog post, the internal threat is very real and it strikes ALL companies. (Yes, even forensic companies that investigate internal threats.) The smallest company that I have identified theft of IP during employee departure had 5 employees. The largest client was a Fortune 100 company whose name all you would instantly recognize. Even forensics companies are not immune. When I was the CEO at LuciData, I had a former forensic investigator leave and “take” IP with him to start a competing company. It happens all the time. Numerous articles quote statistics that over 50% of departing employees take IP when they leave.

50% is a pretty large percentage of people. Think of how many employees have left your company. Think about what information they had access to. Now assume that 50% did actually take information and brought it to a competitor. What would a competitor be able to do once they got their hands on that data? What would the impact be to your company should that happen? Loss of revenue, loss of competitive advantage?

Theft of your IP has happened to you with or without your knowledge. It might be happening right now and you don’t know it. In this blog and other blogs to follow; I am going to step through two examples of internal theft: an internal employee working at the office and a home based employee that was granted remote access to the network. The blogs will address what was done right and what could have been done better.

There are always lessons to learn with departing employees, and most of those lessons deal with controlling your data better.

Internal Employee Case Study:

This was not the first time that our client had called us to investigate a potential theft of IP from a departing employee. We had put in place a protocol to cover the first initial steps to investigate any departing employee that they suspected of taking IP.

As with all the other cases with this company, a “key employee” had departed, moved across the country to work for a competitor. What caused our clients suspicion was that the competitor did not have a marketable “product” like the employee had been working on for our client, but the competitor was trying to get a foothold into that space. The data that this employee had access to was incredibly valuable to the competitor.

As we were completing the initial first steps of the protocol and started digging into the data, there were red flags that we discovered that started to raise questions for us. The first red flag we found was the sheer number of USB devices that had been used on the computer; including a few devices that were used during the last few days of his employment with our client. While devices used on the last few days of employment don’t always point to a problem, for some of these devices, it was determined that it was the first time that they had ever been used.

The next red flag we saw was that a special folder sync function had been run. This function was setup to sync multiple folders from the employee’s computer to what was labeled as “other device”. This meant that it could sync to something like a network share or to a USB device, basically anything that wasn’t internal to the computer.

What was helpful to us was that this sync function left a log of the folders that it was syncing with, along with the last time that the sync took place. Unfortunately, the folders that were synced were deleted by the former employee. Not to be deterred, using our forensics capabilities, we were able to recover the deleted folders and found just over 2,500 files in those folders that had been synced to other devices. A copy of the recovered files list was given to the client to review and determine the “value” of the data. We determined that most of the files contained documents that had “confidential” or “internal use only” written on the documents, leading us to believe these indeed would be very valuable documents to a competitor – a fact that was quickly confirmed by the client.. Our client asked us to immediately start working on determining if we could tell them where these documents went to (other devices, network share etc.)

Using time information from both the USB and the sync function logs we were able to determine that the data went to one or two USB devices on the same day the employee turned in his resignation notice. We were able to determine the common name of the USB devices (like one gigabyte SanDisk) and we also had the serial number of the devices we could now start searching for. This information was given to our client so their Information Technology department could determine if the devices still resided in the former employee’s office or some other place within the company. When it was determined that the company did not have possession or access to these two USB devices and that the former employee most likely took them when he left, we helped our client’s counsel write the request for the former employee to turn over all USB devices that he used while employed at the company on that computer. Based on our initial USB analysis, we were expecting 24 USB devices to be turned over. With that request, the hunt for stolen IP began in earnest.

Home Based Employee Case Study:

In this case, we have a home based sales employee that was allowed to use his own personal computer for work purposes. His request to use his home based computer was granted by management even though it was in violation of company policy. Because his personal laptop was a Mac, a request was made by the employee for a virtual machine partition to be placed on the machine so that he could use “normal” Microsoft Outlook for work related email. Again, a request granted by management and a violation of company policy.

When the employee left our client’s employment to go to work for a competitor, the company wisely asked for his computer to “image” it to make sure they had access to his email that was in the virtual partition. However, this image was not a traditional forensic image. Luckily the image did capture all the data on the disk; which included all the Mac data and all the data in the Windows virtual machine. Confident that they now had a copy of his email allowing them to answer any customer questions that might arise, they returned his personal computer back to him without deleting the virtual machine that contained years of corporate email. They put the image on the shelf and did nothing with it.

Shortly after this first resignation, a 2^nd sales employee resigned. This employee was going to the same competitor as the first employee that left and this employee would reportto the first employee. Concern was rising that something nefarious might be going on as the competitor they went to work for was the number one competitor of our client. Losing both of these top sales people, was a grave concern in the very tight market that both these companies were in. For the purpose of this blog post and so we can keep them straight, we will name the home based employee with the Mac, Bob and the employee that left second, Steve.

We were sent the work computer (which was a Windows computer) from Steve and we were sent the image of the home Mac computer that Bob used for work. We initiated our departing employee protocol to determine if there might have been any visible signs of solicitation and to determine if any confidential data may have been taken by either of them.

While we did find signs that they were both communicating with each other, we didn’t find any signs that Bob asked Steve to leave and bring data with him. At that point, our investigation turned strictly into theft of IP and we began to look at each of them individually.

Investigating both former employees’ computers, we determined that they both had USB drives hooked up to their computers. Both of them used those USB drives on their final days of employment. There were also signs that data may have been transferred over to those devices. We worked with our client and their legal team to request that Steve hand over all the USB drives that he had used during his employment. This process was pretty straight forward with Steve’s computer, Bob and his computer was another story.

As we mentioned, Bob used his personal laptop for work. This a machine was also used by family members. Because of this, we were not completely sure the best way to ask for access to the devices, given the high likelihood that we would not be granted access to family member’s devices unless we could clearly prove that data had been transferred to that specific device. This computer had been used for years and not only were there traditional USB storage devices that had been hooked up to it, but there were also iPhones, iPads and iPods that had been attached to this machine. These devices, while traditionally used for other reasons, also have the ability to store data.

Which devices were his, which belonged to his wife’s and his kids? As the investigation continued into Bob’s computer, we started to notice references to network storage devices, like network attached storage (NAS) and references to Apple’s Time Machine backup, which appeared to backup his entire laptop. Remember, Bob had the virtual machine that contained all his work email containing confidential information on this machine. We realized that the work email was in the Time Machine backup, so we had to make sure to request access to that backup as well. As it was becoming clear the type of home network that Bob had established, we realized that one of his NAS devices was syncing on a regular basis with his Mac. If you are able to follow the trail - we now know that work email is stored in at least three locations – on his personal Mac in the company provided VM, the Time Machine Backup and on the NAS.

We gave our client a file list of some of the files on the Mac image that contained the word “confidential”. We handed over copies of documents, spreadsheets, PowerPoints and PDFs for them to look through. It was quickly determined by our client those files were very key to the company, and Bob should never have been allowed to leave with that data still on his personal Mac that he used for work. Like with Bob’s email, we were assuming that these files containing the documents, spreadsheets, PowerPoints and PDFs etc. were also on the Time Machine Backup and the NAS and potentially other USB devices.

At that point, the lawyers knew what we needed access to, but with Bob’s non-traditional home network this wasn’t going to be your normal legal request. This was going to be a case with many unexpected twists and turns.

Hurry up and wait.

As with all cases, once we find that IP may have been taken during employee departure we provide our reports, declarations and/or affidavits. The lawyers then take over and it is hurry up and wait while the legal process runs its course. Stay tuned to the next blog post to see what happened with these legal requests and the corresponding TROs (Temporary Restraining Order).

Newberry Group has services that can support all of your needs in these areas. Our experienced team can conduct investigations that cover both the departing employee as well as the new hire for a fraction of the cost that you could incur should the examples above play out. Our Departing Employee Program is a fixed fee program that consists of defined computer investigation service packages that identify and report on employee data activity. The packages vary as to scope and cost in order to provide you with a level of assurance proportionate to the value of the employee and the access that the employee had to your IP.

Our Incoming Employee Package consists of 2 services. 1^st, it verifies that policies and procedures are appropriate so new employees understand that under no circumstances should any IP from previous employers be brought with them. 2^nd, at a predetermined time (usually 30-60 days after the employees start date), we will check the new hire’s drive for signs of external IP. If data is found, you can take immediate steps to remediate the data before any litigation commences.

Next Blog: Temporary Restraining Orders (TRO)

Click here for more information.

The hacker, the departing employee, the new hire. Which one can cost you more? Part 1 of a 6 Part Blog Series

Jeremy Wunsch — Fri, 26 Feb 2016 11:06:00 GMT

After almost 20 years of doing computer forensic investigations, and specializing in investigating data breaches and IP theft, I have realized a few things. Hackers are here to stay and those employees you trust the most can hurt you the most.

The Hacker

Let’s start where most organizations are mistakenly focused, hackers.

Hackers are malicious but most are only looking to steal usernames and passwords but some do try to steal personally identifiable information (PII) to sell or they are looking to run some other type of scam with the stolen information. Rarely, do hackers steal data to create a competing product or service.

Yes, hackers cause harm. They steal identities; people fall for their scams. Hacks have been a daily occurrence for some time now. Most firms spend a lot of time and money trying to prevent them and have a budget set aside for investigating them.

But when we look back, what is the real cost to the organization of a hack? Google “cost of a hack” and you will find countless examples of what it costs organizations. But the numbers are all different. The real answer is that nobody knows. Realistically, unless you are part of some of the largest breaches in the world, the cost of a hack does not create a very large dent on the organizations profit and loss statement. The “official statement” says, sorry we were hacked, change your passwords and move on.

The Departing Employee

This is my favorite person in the company. They are leaving for that new job. Why did they get that job? You guessed it, because of what they did at your company.

Organizations as a whole are still a trusting bunch. “Oh, my employees would not maliciously take information with them.” We hate to be the bearer of bad news – they will and it is probably happening a lot more than you realize. In the thousands of cases we have done over the years, I can count on one hand the number of times during an investigation where we didn’t find the employee stealing intellectual property (IP) and taking it with them.

If the departing employee left to start their own competing business or worse yet – went to your #1 competitor – more than likely they have taken some of your IP (think customer lists, pricing data, product development details, business planning details to name a few) with them to help them hit the ground running. It is time to start an investigation to see what they took.

When do you pull in legal? It all depends on the organization and if legal is in-house or not. But most pull in the legal team after it has been identified that IP may have been taken. Another key question when pulling in the legal team is to ask “do you have an experienced legal team to help you during the investigation?”

The “experienced legal team” is a delicate subject, but it must be brought up. While the organization is going through the investigation, it cannot be stressed enough: make sure your legal counsel – both inside and outside counsel understand the technology, the terminology and the forensics process.

Beware of what I refer to as the “Legal Tech Lawyer”. These are attorneys from firms that got their experience from going to a few conferences and listened to a few webinars yet consider themselves experts in technology cases. In addition, beware of outside counsel that does not have any actual experience in conducting cases that had computer forensics examinations in the area of IP theft.

Having an experienced legal team; especially experienced outside counsel that understand the process and what forensics technology can and cannot do will cost more per hour than an attorney that doesn’t, but in the end, it will be worth it. Not understanding the life cycle of an investigation; the differences in terminology, understanding the limitations of technology and what to ask for during the investigation will most likely cause the organization to incur additional downstream investigation fees because the investigation is not streamlined. Uneducated attorneys are less likely to ask pertinent questions, will have to do additional research to understand what they need to have done, may ask for things to be done that are not necessary, or miss finding critical evidence that is germane to your case. All of this will likely result in increased legal fees.

Legal expenses tend to be a very large chunk of the total cost of an IP theft investigation. Choosing the right attorney (s) is critical not only to the success of your investigation; but also to keeping your costs from spiraling out of control, especially when you are going after a temporary restraining order (TRO), and requesting access to both their home and “new work” computers.

Your New Hire

Let us introduce you to your most expensive hire; the new employee that you just hired away from your #1 competitor. The employee that took IP from their previous employer, who brought IP with them and is currently using that IP in their new job with you.

You didn’t ask them to steal IP from their previous employer, but they did. You hired them because of their experience and their past contacts and connections. They told you they can help you beat their former employer; what they didn’t inform you about is they are bringing data with them that will be housed inside your walls.

This data now resides someplace on your network. It could be a little, it could be a lot. For example, maybe they took a PowerPoint presentation. They changed a few words and logos and now your next project is the exact same project they were working on at their previous company. They shared a copy with their boss. Their boss shared it with their boss who presented it at the national sales conference. You get the picture.

Now imagine this scenario. Their previous employer knows you have hired their employee and suspects that they have taken IP – lots of it. They hire a forensic company to look at the former employee’s work machine and they find IP was taken. They suspect you now have it. They want it back or eradicated and they want monetary damages.

The next thing you know, you are served with a TRO and litigation hold. You are getting sued by your new hires former employer for theft of IP. You know nothing about this, you didn’t ask them to take it, but they did. Courts are starting to open up the doors to allow forensic companies to investigate inside the “new company” to verify that the previous company’s data is or is not inside the new company. The Forensics Investigation Team has been allowed full access to email servers, network servers and storage, laptops and desktop, cell phones, tablets and cloud accounts that may have the stolen IP on them.

If that happens to you; more than likely your organization will be responsible for the cost of that investigation. If IP is found, the costs ramp up even further. The IP will have to be remediated and most likely the courts could issue some pretty large judgment against you. We have had cases where the judgment in 1 IP theft alone was upwards of twenty ($20) million dollars that the “new company” had to pay the “former company” because the departed employee took IP with them and used it at the new company. While judgements of this amount are not common, they do happen. It is becoming more common to get judgements against the new company of a few million plus all third party fees (legal, computer forensics, court costs, etc).

What Can You Do To Be Proactive?

Have an appropriate IT budget to spend on and implement monitoring solutions that watch internal employees in how they use the organizations data. Whether it is device control, DLP solutions or BYOD technology – having monitoring technology is a must these days.

Have current AUP (acceptable use policy) and any other corporate policies governing the use of corporate data. Nothing is more painful than learning that you allow employees to take whatever they want.

Be consistent in enforcing those policies. Precedent is a big word in the legal community and I have seen many cases lost on precedent.

Ask the right questions of legal team on their experience level in conducting forensics investigations.

Get an experienced Digital Forensics team that understands IP theft considerations for departing and incoming employees.

How can you protect yourself?

There are economical ways to forensically determine what data and or IP was taken from an organization or brought into an organization. An excellent program will:

Have a well-defined AUP covering both incoming and outgoing IP.

Consist of defined computer investigation service packages that identify and report on employee data activity

Be able to identify data that was taken from your network as well as brought in to your network.

Conclusion

Hackers are here to stay. Most companies are well prepared to defend against hacks and have budgeted for such an event.

Employees will also continue to take IP. It is not a question of if IP theft will happen, it is a matter of when and at what cost to the organization. Most companies are not as well prepared to investigate theft of IP. Nor have they budgeted for what the potential investigation might cost them or what the effects of a theft might be – loss of revenue, loss of clients, loss of productivity, business interruption – the list goes on and on.

Does an investigation have to break the bank to learn what IP might be taken? No, it does not. Investigations can be streamlined, simplified and be cost effective if an organization has the proper team and services in place prior to kick off of an event.

As to the initial question that we started with, “The hacker, the departing employee, the new hire. Which one can cost you more?” Stay tuned to future posts to learn, but I can tell you, it isn’t the hacker.

Newberry Group has services that can support all of your needs in these areas. Our experienced team can conduct investigations that cover both the departing employee as well as the new hire for a fraction of the cost that you could incur should the examples above play out. Our Departing Employee Program is a fixed fee program that consists of defined computer investigation service packages that identify and report on employee data activity. The packages vary as to scope and cost in order to provide you with a level of assurance proportionate to the value of the employee and the access that the employee had to your IP.

For more information on these services as well as other Forensic-related services we offer, please visit our website at www.newberrygroup.com or email us at [email protected]">[email protected]

Next Blog: Newberry Group’s Departing Employee Program.

Click here for more information.

Keeping Student Data Secure in Education

Gerald Kennedy — Mon, 18 Aug 2014 18:45:00 GMT

#187480288 / gettyimages.com

As students and teachers alike are embracing online learning tools, a need for better internet security in schools is becoming more apparent. The recent report on tech adoption in education by the Consortium for School Networking (CoSN) and the New Media Consortium (NMC), highlights this trend of hybrid learning models that “blend the best of classroom instruction with the best of Web-based delivery.” However, the report also points out that the safety of student data is considered a “difficult challenge” and “solutions are elusive.”

While internet security is a pervasive issue for all industries, schools deserve some extra attention. Along with the increased need for bandwidth to access online courses and tools, students and teachers are all too quick to share personal information through the internet. Schools need to carefully plan their network security in much the same way they plan their physical security. There has to be a good balance between access and security.

The solutions for balancing the security of student data with providing the right level of access required in today’s learning environment don’t have to be “elusive.” There is a full suite of solutions, such as network access controls or web filters, that are available at affordable prices and can offer the necessary protection for K-12 schools up through universities.

So what should you look for in a solution? Here are some good starting points:

URL Filtering – In 2013, 85% of malicious links used in web or email attacks were located on compromised legitimate websites. Controlling which websites can be accessed can limit the possibility of malware infecting your network.
Secure Data Transfer – An estimated 6% of all PCs will suffer at least one episode of data loss per year. 20% of all laptops suffer hardware related data loss in the first three years. A good IT strategy implements an off-site backup solution for important data. In an education environment, that would include student records. Securing this transfer of data is necessary as not only can the physical data be accessed but the transmissions of that data can also be intercepted.
Mobile Device Security – On average, network administrators are only aware of 80% of the devices on the network. In an educational setting, where nearly every student has a mobile device with the ability to connect to a local network, this figure is most assuredly much lower. Utilizing an agentless solution that discovers devices as soon as they access the network will protect vital information such as student records and institutional data while allowing the proper access necessary for the learning environment.
Bandwidth – With the inclusion of streaming media in today’s curriculum and the distribution of network resources across a geographically separated campus, load balancing bandwidth is essential to providing consistent access for both students and faculty
Efficient Configuration – School IT departments are minimally staffed. And often, the staff is simply challenged by time and resources just to maintain let alone implement and improve the network. Solutions that are easy to configure and maintain yet provide robust security features are a must.

Click here for more information.

How to Choose Security Solutions for Mobile Healthcare – Part 1

Gerald Kennedy — Wed, 23 Jul 2014 18:13:00 GMT

#156888012 / gettyimages.com

The last time I visited to the doctor, he recorded everything on a tablet device. While it’s convenient, mobile security is always at the forefront of my mind. I was doing a bit of reading on mobile security and came across the Medicare and Medicaid (CMS) Electronic Healthcare Records (EHR) Incentive Program. This program gives healthcare providers a financial incentive for demonstrating the meaningful use of certified EHR technology or for adopting, implementing, or upgrading EHR technology. EHR technology allows providers to easily record and share patient data so that it’s consistent and readily available throughout the provider chain. This is certainly a great benefit to all healthcare providers as well as patients. No need to transfer records and records can be updated in real time through hand held devices, patient monitors, or diagnostic tools connected to the network.

However, broader access to electronic databases and the use of additional devices to access that data only adds to the already vulnerable IT environment within the healthcare industry. IT components within healthcare are already severely susceptible to hacking and advanced persistent threats. Medical device end points, such as monitors and diagnostic tools, could have severely outdated operating systems that don’t lend themselves to standard patching processes. Even personal healthcare devices, such as insulin pumps, have known vulnerabilities as demonstrated by Jerome Radcliffe when he hacked his own insulin pump. These weaknesses, coupled with the fact that medical practitioners regularly bring their own smartphones and tablets and are often unregulated at many facilities, leaves a provider network open and vulnerable.

The HIPAA Security Rule provides standards for the securing of electronic health information. These rules are in place to protect patient data through access control, audit controls, integrity controls, and transmission controls. While important, they rely on the provider to select and implement the necessary security solutions to prevent a data breach. And without proper security for personal and medical end point devices, it is only one finger in a dam that has many holes.

Stay tuned for Part 2 later this week where I discuss the factors to consider when looking at different security solutions.

UPDATE: Part 2 is live! Check out: How to Choose Security Solutions for Mobile Healthcare - Part 2

Click here for more information.

How to Choose Security Solutions for Mobile Healthcare - Part 2

Gerald Kennedy — Wed, 23 Jul 2014 16:03:00 GMT

#172601351 / gettyimages.com

To read Part 1 of this series, click here.

According to the HIMSS Analytics 3rd Annual Mobile Survey, the top benefit to having mobile tech in facilities is increased access to patient information, and the ability to view data from a remote location. But this means there are thousands of devices accessing a provider’s network. In order to select a proper security solution that not only meets HIPAA requirements but offers the protection for medical device end points in use, medical IT Administrators must look at a number of factors:

What is on my network? This is the first and most important step in providing a secure IT enterprise. Many IT administrators believe they know what devices are on their network. However, healthcare facilities are littered with transient devices such as personal phones and tablets, patient monitors and diagnostic tools that have unique and often antiquated operating systems. These devices may only show up on IT networks once a week or perhaps once a month. It can be a daunting task to know exactly what is connected to the IT enterprise.
Controlling BYOD. Practitioners, nurses, and administrative staff often use their own unregulated devices, such as phones and tablets, to record data and communicate with staff and patients. Add to that the fact that many facilities offer open WiFi to their patients and guests. This creates a massive amount of end points that are not monitored and leave the IT enterprise vulnerable to malware, viruses, and advanced persistent threats. Survey findings shows that 32% of hospitals are not even using technology to enforce their BYOD policies.
End Point Compliance. Knowing what is on the network is one thing. Keeping known devices compliant is something else entirely. Security of an IT Enterprise is only possible through awareness. Once the devices are discovered IT administrators must be certain that they remain compliant. Having the ability to confirm applications and disable those that are unauthorized, verify whether or not the devices meets established security policies, knowing if the device is compliant with the latest security patch and antivirus definitions is essential.
Cost vs. Risk. While the Federal Government provides some mandates that direct medical IT Administrators to protect patient data, the healthcare IT network remains largely susceptible to your average hacker. It is up to each healthcare IT Administrator to protect the physical network to the degree they feel necessary to secure data and network end points. Healthcare budgets, like many vertical industries, are balanced toward production vs. protection. In the HIMSS Analytics survey, lack of funding was the most common barrier to implementing a security solution. An effective solution with low cost of ownership is necessary. And while incentive programs such as EHR Incentive Program may seem to add balance to this in favor of the healthcare facilities, the incentive received is certainly not equivalent to the cost of losing patient data.

Network administrators can’t secure what they can’t see. It is imperative that administrators have access to real-time visibility of everything on their network and be able to control what is on their network at all times. When choosing a solution that meets all of these requirements, look for one that is simple to install on your network, without the need for agents or client software.

If you’d like to talk more about end point security solutions or need help, get in touch with us!

Click here for more information.

Case Study: Optimizing Barracuda Load Balancer to Meet Web Application Demands

Nicholas Trifiletti — Mon, 09 Jun 2014 09:51:00 GMT

Challenge:

A regional energy cooperative wanted a way to provide seamless application availability for their customers and scalable performance for future growth demands. Their current Barracuda Load Balancer and Oracle ERP solutions were deployed by a 3rd party using a method that would significantly impact performance and scalability in their virtualized environments. With a deadline on the horizon, they needed a solution that offered both flexibility and availability while minimizing complexity.

Solution:

Newberry conducted a network and infrastructure assessment and found that the current Load Balancer and ERP deployment would only meet a fraction of the organization’s web application demands. Newberry’s engineer worked closely with the customer to fine tune their Barracuda Load Balancer and rebuild their Oracle ERP system from the ground up while keeping the principles of scalability and application uptime at the forefront.

Results:

Newberry enhanced the organizations ability to manage and scale critical application environments by:

Creating custom Load Balancer services and rules to automate application failover, rewrite URL requests for cross-platform compatibility with Oracle, and utilized URL redirection to simplify end user navigation during their initial orientation.
Tuning the Load Balancer’s application layer for session persistence and Layer 7 health monitoring.
Clustering the Load Balancers together using High Availability for seamless failover and web application availability.
Identifying I/O performance bottlenecks in virtual and networking environments.
Redesigning the customers ERP architecture by reducing complexity and adding additional nodes which resulted in doubling the amount of concurrent users and sessions available.
Training and knowledge transfer with System and Network Administrators covering operations, maintenance and advanced troubleshooting.

Why Newberry Group?

As one of the few Barracuda partners that can support the entire product line beyond what was required by this customer, Barracuda immediately turned to Newberry to make this project a success. Newberry’s Barracuda-certified engineers brought their in-depth knowledge, experience and passion for technology that was needed to exceed the demands of this time critical project.

Click here for more information.

Case Study: Protecting a Large-Scale Federal Network with Sourcefire NGIPS

Tony Hausmann — Tue, 20 May 2014 11:53:00 GMT

Challenge:

A Federal agency recognized that they needed to improve their threat protection by monitoring all traffic as it passes through their gateways without hampering their network performance. This agency knew that malware was entering into their network enterprise but was not able to detect it. Due to client data sensitivity and the need to ensure the security of the network for their customers, they needed to be able to apply customized protections as quickly as possible.

Solution:

Newberry Group partnered with Sourcefire to provide a solution that included multiple Sourcefire Next-Generation IPS Sensors at the four main data centers. The Sourcefire IPS solution provides the agency with real-time contextual awareness and threat protection with the ability to act intelligently and automatically when an internal host is affected by a client side attack.

Results:

With Sourcefire’s NGIPS, Newberry Group helped the customer meet performance and customization demands so that the agency has access to:

Real-time contextual awareness with the ability to see and correlate extensive amounts of event data related to their IT environment—applications, users, devices, operating systems, vulnerabilities, services, processes, network behaviors, files and threats.
Advanced threat protection to discover, assess and respond to hacking activities, intrusion attempts and vulnerabilities in order to stay ahead of threats.
Intelligent security automation with event impact assessment, IPS policy tuning, policy management, network behavior analysis, and user identification. This significantly lowers the total cost of ownership to the agency and enhances their ability to keep pace with changing environments.

Click here for more information.

Case Study: Installing a Websense Web Security Filtering Appliance

Valerie Root — Mon, 21 Apr 2014 10:51:00 GMT

Challenge:

A Federal agency recognized that they needed to improve their current web security solution to allow for better filtering of the Internet traffic coming in and going out of their network. They needed to provide for data loss protection, as well as utilize real-time analysis of malware and recognized advanced threats with the ability to perform forensic activities. They needed the solution to provide protection for local and remote users as well as support multiple campus sites. Additionally, in the end, they wanted to be able to centrally manage the system post-deployment and develop reports for Executive staff and trend analysis. Thus the solution needed to have an easy to use interface that allowed for the monitoring and management of the entire system from a single location.

Solution:

Newberry Group partnered with Websense to provide a technical solution that included multiple Websense appliances and the implementation of the Websense Web Security Gateway Anywhere (WSGA) solution installed at a main campus and a satellite location. The final solution included the following:

Scalable deployment for up to 12,000 users with high availability and automated failover and load balancing.
Deployment of Websense’s TruHybrid solution that protected the agency’s branch offices and remote and mobile users.
Provisioning through a single unified interface.
Deployment of Websense’s TruDLP to prevent data loss and enable compliance with agency and NIST standards and policies.
Real-time analysis utilizing Websense’s Advanced Classification Engine (ACE) and threat intelligence from Websense’s ThreatSeeker Intelligence Cloud.
An advanced threat dashboard providing actionable forensic detail on who was attacked, what data was attacked, where the data almost went, and how the attack was executed.
File sandboxing to protect the environment from advanced malware.
Training of Websense Administrators on system operation, maintenance and report generation.

Results:

Newberry enhanced the agency’s overall environment by optimizing the customers filtering and security monitoring. The agency now has the ability to:

Identify and monitor security vulnerabilities while being supported by manufacturer recommendations, industry best practices and compliance requirements.
Implement security configurations for web filtering policy down to a user level.
Provide reporting documentation to support security investigations or remediation.
Direct reach-back to Newberry engineers and Websense Premium Support

Why Newberry Group?

As a preferred Federal Executive Partner for Websense, Certified Triton Integrator, and Authorized Training Center, Newberry can offer a full scope of products and services to each of our clients. Our in-house certified Websense engineer trainers are able to provide a wide range of professional services that include integration, configuration and installation of Websense technology as well as standard and customized training courses to meet a client’s specific needs.

Click here for more information.

Case Study: Ensuring Network Health with ForeScout CounterACT

Tony Hausmann — Wed, 12 Mar 2014 23:06:00 GMT

Challenge:

A large Midwest firm wanted to allow employees and guests to access to their networks and internet regardless of the device being used. They also wanted a way to ensure anti-virus and security vulnerability patches were up-to-date on their own Windows devices.

The company needed a solution that provided visibility of their network and attached devices, provided an agentless capability, and was easy to install and manage. Compatibility with the client’s current switch and MDM vendors was another key factor as well as ensuring it could move forward with a future global deployment.

Solution:

Newberry partnered with ForeScout to provide a plan around the CounterACT solution. The client tested the solution for more than a month to ensure that the product worked well with the existing infrastructure, that it was easy to use, and that it would not cause network disruption.

CounterACT also provided the organization with a large amount of instant information they did not have access to previously. Now they can see who’s connected to specific switches, see who was the last person to log into the network on a specific Windows PC or user IP address, then enforce policies against those devices and machines attempting to connect.

Results:

Forescout CounterACT enhanced the health of the customer’s network by providing:

A more efficient and effective way to control network access (authority to connect) and ensure endpoint compliance.
Real-time inspection and easy manageability of guests, contractors and employees using a variety of devices to connect.
The ability to enforce security policies to only allow devices on the main network that have up-to-date antivirus, OS, and application patches.
The ability to quarantine any noncompliant devices and devices with viruses and immediately reduce the threat of malware entering the network.
An agentless solution with unprecedented compatibility with over 16 switch vendors and multiple MDM, antivirus and antispyware vendors.
Fewer resources required for network access control (NAC) deployment, maintenance and administration

With ForeScout CounterACT, Newberry was able to quickly improve the customer’s network health and provide an automated solution for network access control, mobile security and endpoint compliance. Do you have a similar network access situation? Learn more about how Newberry can help.

Click here for more information.

Case Study: Optimizing a Barracuda Web Application Firewall cluster

Steve Carney — Thu, 13 Feb 2014 11:43:00 GMT

Challenge:

A Federal agency had recently purchased ten Barracuda Web Application Firewalls (WAF) from another vendor and had installed the devices themselves. However, since the Barracuda WAF solution was new to them and the configurations were transferred from another solution, they were unsure if they had installed the devices in the most optimal setup.

Solution:

The agency relied on Newberry for a technical review of the installation of ten Barracuda Web Application Firewalls to validate operational efficiencies, infrastructure design, and to determine if deployed security policies for protected sites were effective in protecting from external threats.

How We Solved the Problem:

After determining the intended functionality of the configuration, Newberry’s Barracuda-certified team used current network diagrams to review the logical placement of each WAF in their respective data flows to determine correct placement and deployment method.
A full review of the WAF environment was performed to determine if the services, security policies, advanced security protection features, and administrative access controls were appropriately set up to protect against external threats and comply with NIST standards and agency policies. The configuration of enabled services such as High Availability (HA), Load Balancing, Data Theft Protection and Caching/Compression were also reviewed to ensure optimal performance and adherence to Barracuda’s recommended configuration.
Our team also analyzed firewall logs and reports to identify any security vulnerabilities and made configuration recommendations to enhance performance and offer a greater level of security.

Results:

Newberry enhanced the overall performance of the customer’s network and WAF configuration by:

Identifying security vulnerabilities that were supported by manufacturer recommendations, industry best practices, known vulnerabilities, and compliance requirements.
Providing fixes for the identified vulnerabilities
Offering recommendations for enhancing security and performance of the WAF and the overall network
Lastly, providing a report of the assessment/configuration that included a management summary and the technical findings.

Why Newberry Group?

As one of the few Barracuda partners that can support the product line to the extent that was required by this customer, Barracuda immediately turned to Newberry to conduct this review. Newberry’s Barracuda-certified engineers brought the in-depth knowledge and experience needed to perform even the most intricate configuration and troubleshooting tasks.

Need help with your Barracuda product installation? Learn more about how we can help.

Click here for more information.

Building Effective Teams

Christopher Steinbach — Wed, 13 Nov 2013 09:50:00 GMT

Exceptional individual performer, or team player; which is more rewarding and which is more valuable? Most organizations talk “team” but unfortunately many primarily recognize and incentivize individual performance. Further, some organizations unwittingly go out of their way to attract and promote people who actually resist the idea of linking their performance to someone else or the “greater good.” They seek out the lone wolf with the gaudy numbers for that silver bullet fix and regrettably those gaudy results are often achieved at the expense of others and the long term health of the larger organization. It is a fact in both team sports and business that a seamlessly executing team is the best way to accomplish complex tasks and sustain long term exceptional performance. Effectively integrated teams are also central to cutting across boundaries to get things done - - truly becoming organizationally agile and successful.

So in a short-sighted world that glorifies and rewards the individual in spite of the proven negative consequences to sustained performance, how do you assure the building of effective teams? Fortunately experts like Michael Lombardo and Robert Eichinger have some ideas:

Practice #1: Have a Plan. A clearly articulated plan energizes, aligns, brings focus, encourages efficiency, and empowers. Involve team members in creating that plan and you will only enhance their energy and commitment to “The Plan”.

Practice #2: Run Interference. An effective team leader has made the effort to become a “Maze Bright” organizationally agile person and is therefore an extremely good advocate for their team. As discussed in my July 28, 2013 blog on Organizational Agility, no skill is more respected by your team. When you can go off into the wilderness of the organizational maze and consistently come back with results that benefit your team and make their professional lives easier, their loyalty to you, the team, and “The Plan” is assured.

Practice #3: Make a Concerted Effort to Communicate and Inspire. Show an interest in the work of your people, adopt a learning attitude toward mistakes, celebrate successes, have visible measures of success. Invest time in understanding each person uniquely. You don’t have to agree with them, you just have to understand them. Give them the benefit of your thinking, particularly with respect to key objectives.

Practice #4: Build a sense of joy and fun in the team. Learn to celebrate wins. Use humor and support it in others; look for opportunities to build group cohesion outside the office.

Building a “Dream Team” is not an easy task. Blending individual talents and ensuring that you are taking advantage of each person’s strengths and avoiding unreasonable exposure to each person’s weaknesses is hard. However, it is very much worth the effort. High performing teams establish an uncommon trust between the team members in which individuals value the team above their own singular objectives. Weaknesses are not considered “bad.” They simply represent opportunities to cover for each other for the good of the team and take part in achieving a shared ultimate objective. When the team is at its best, this exceptionally valuable behavior happens without any ill feeling, it just happens. In the words of John Wooden, the immortal College Basketball Coach, “The main ingredient of stardom is the rest of the team.”

Click here for more information.

The Responsibilities of Cleared Personnel

Steve Cadogan — Wed, 30 Oct 2013 14:30:00 GMT

With October being National Cyber Security Awareness Month, this is a good time to think about the responsibilities that come with having a security clearance. It’s especially timely with the recent high profile security events of Chelsea Manning, Eric Snowden, or Aaron Alexis. We may seem surprised by their actions, but if we think back to Aldrich Ames or Robert Hanssen, we see that these events are not the first of their kind.

When we obtain security clearances as government employees or contractors, we take on a multifaceted obligation: protect the technology and information that we have access to, ensure that others are doing the same, and ensure that we and our colleagues remain fit to work in a secured environment.

Once we complete the background investigation and possible polygraph process, we are given strict guidelines in how we handle and protect information from both a technological and a philosophical perspective. No matter how obvious it may or may not be, the information we access is directly or indirectly related to the safety and well-being of our warfighters abroad, our allies, our state department representatives, and even civilians. Even if you encounter information or programs that you disagree with from a philosophical, moral, or legal perspective, there are internal government avenues to voice your concern without jeopardizing the information to the general public. Choosing the avenue of public disclosure only serves those who wish to harm our interests or freedoms. That route is very treacherous, possibly traitorous and most likely illegal.

Even though you may be confident and diligent in your efforts to protect information, that doesn’t mean those around you are thinking the same way. It is equally your responsibility to be observant of the actions taken by others working with sensitive information. When suspicions arise, muster the moral courage to approach the appropriate personnel and report your concerns. Quick action could result in stopping a serious security incident.

Lastly, we must be cognizant that we and our colleagues are displaying the mental capacity to operate in a secure environment. Working in a secure setting can easily create a false sense of security and we assume that individuals around us are just as fit to be there as we are. However, secure areas are just as susceptible to criminal activities as an urban street corner, including anything from theft to shootings. There appears to be a growing number of mentally unstable individuals who have somehow slipped through the security screening process or co-workers who are upset by a life event that feel impelled to pursue indiscriminant or directed attacks against co-workers. We must be alert to suspicious signs and have the moral courage to approach or report those who may no longer be fit to work in a cleared environment.

Some view the Mannings and Snowdens of the world as whistleblowers or even heroes. However, the information they released was not theirs to disclose or release and may ultimately seriously affect the freedoms of Americans. Conversely, attacks within a cleared setting, such as the recent Navy Yard shooting attack, raised concerns about the security screening process. These unfortunate recent events can serve to reiterate that protecting information and maintaining a secured environment is an ongoing responsibility for everyone with a security clearance. By following tried and true policies and procedures the right outcome can be achieved.

Click here for more information.

What Can Spiderman Teach Us About Teaching?

Michael Kobett — Thu, 05 Sep 2013 11:23:00 GMT

In 2009, a quick-thinking firefighter, Somchai Yoosabai, disguised himself as the comic book character Spiderman and successfully saved the life of an autistic 8-year boy who was sitting on the edge of a three story tall school house roof. The child was traumatized over his first day of school and would not let anyone come close to him. Overhearing a conversation about the child's love for super-hero's, Mr. Yoosabai quickly returned to his firehouse and put on a full body Spiderman costume which he used to make fire drills at schools more entertaining. Returning to the school, he cautiously approached and connected with the traumatized student. "I told him Spider-Man is here to save you. No monster will hurt you now." The child reacted immediately by walking toward the familiar character and was safely removed from the danger. (Read full story and see photos here)

What does this heart-warming story have to do with effective teaching methodologies? Well, there are some critical similarities between this rescuer's actions and being an effective instructor. Let's review some of key factors of the child's stress.

Apprehension

The child was trying to escape from a learning environment because he was anxious about school. He obviously felt alone, afraid, worried that he wouldn’t fit in, that he shouldn't be there and probably many other feelings that some students feel when starting a new class, regardless of their age.

Unfamiliarity

Many of the feelings that he was experiencing most likely stem from the fact that he was in an unfamiliar place; he could not find anything in the new environment that he could associate with. This feeling only compounded the problem by contributing to his stress and was a significant factor in why he would not allow anyone near him.

Isolation

Because of the factors listed above, the child's "fight or flight" instinct was invoked. He could not fight the fact that the school house was there, nor could he fight the fact that he was there. So he decided to take "flight" away from all of the stress factors associated with the educational process. Unfortunately, the flight option that he chose was a drastic and dangerous one.

The three negative, stress-inducing emotions listed above are experienced by all students at some point, even adults. Despite the misconception, adults who are sent to training sessions don't view the time away as a work-free "vacation"; they are required to come to the training. Based on comments from my previous students, a two-week training class can be one of the most stressful periods of a student’s life. The critical question is how can instructors help combat and at the very least reduce the feelings of: apprehension, unfamiliarity and isolation. I'd like to offer some suggestions.

Apprehension

Surprisingly, it is actually easy for instructors to forget that many of their students are not at all familiar with the class material. Instructors need to address this at the beginning of the class and repeatedly stress that it's OK if they have never used Linux, logged into a router or taken apart a computer. Tell the students to use you as a resource like they would a textbook. I have literally told students that if they don't ask questions, there's no reason for me to be there and I'd be out of a job! I usually see several smiles from students after I've proclaimed this light-hearted statement. Emphasizing that you're there for them and that you're approachable will benefit all of the class members.

Unfamiliarity

It makes sense that students will not be familiar with the class material, otherwise there would be little need for them to attend. One of the main jobs of a technical instructor is to take an abstract and technical subject and parallel the material with something that is "real world" and tangible. For example, try using an office building’s directory as a comparison to a storage media's file allocation table. Compare a real-life highway's congestion and slowing issues to a network's congestion and slowing issues. Try comparing a situation where 16 children want your attention to the way a computer interrupts requested work. I've found using children in analogies to be extremely effective because most adults are parents, or at the very least they were all children at some point.

Isolation

I previously mentioned that many adult learners are required to attend training sessions in order to learn a new task and that training is not a vacation. They will be expected to use the skills they are learning to complete a new responsibility, or in some cases they must pass the class in order to maintain their current position. Because of this, students experience stressful isolation even before the class begins! The feeling of isolation of which I speak exists between the student and the class material; it's not between the student and the instructor or other class members. Many of my former students willingly admit that they initially felt that their knowledge and experience were worlds apart from the material being taught. I believe that one way to break this isolation is to make use of an acronym - "WITFM" 0r "What's In It For Me"? If students discover a direct connection between what is being taught and how they will use it, they will be more receptive and motivated to learn the material. This discovery can be nurtured by the instructor using phrases such as "When you notice this problem at your work site, you can ..." or "When you are out in the field, you may see ..." Giving the student a practical reason to learn the material can greatly aid them in comprehending and retaining the information.

Using these methodologies, an instructor may significantly help in subduing the considerable and impeding stress that all students feel at some point during the learning process.

Click here for more information.

Employee Data Protection: Securing Your Most Valuable Asset

Brinda Beasley — Wed, 14 Aug 2013 11:35:00 GMT

Protecting employees’ personal data is a big responsibility that falls on the shoulders of anyone who has access to create, store, handle or view personal information that is contained within Personnel and/or Accounting records. Federal regulations in the Privacy Act of 1974 hold government agencies accountable for the proper management of personal information, which raises the concern for how private employers protect their employees’ personal information.

Personnel files should always be maintained with utmost care and confidentiality and only shared with others on a need-to-know basis, and with the express written consent of the employee, as required by law.

While there is an endless host of actionable possibilities to protect our employees’ personal data, it is important for employers to adapt some commonsense practices, which may include:

Never respond to outside inquiries, other than job title, dates of employment, and employee status, for employment verification without prior written consent from the employee.
Develop policies and procedures with your IT department and use up-to-date technologies to protect personal information that is maintained in electronic format. Develop internal controls, such as limiting the number of people who can access personal information, as well as limiting which data each individual can view.
Safeguard all paper copies of personal information under lock and key with restricted access
Only collect information from each employee that is required to pursue the company’s business operations and to comply with government reporting and disclosure requirements.
Always keep the medical history of an employee in a separate file with restricted access
After employees are terminated, keep their files in your records in accordance with applicable state and federal laws. You can learn more about federal requirements by visiting the US Department of Labor’s website or by searching individual state Department of Labor sites.
Have a written code of ethics and a confidentiality policy, and require every employee to sign an acknowledgment of having read the policy. Place the signed acknowledgment in each employee’s personnel file.
Develop a procedure for the confidential reporting of breaches such as an ethical hotline.
Communicate to your employees the types of data that are not considered confidential such as partial employee birth dates, (i.e., day and month only, but not year), an employee’s company anniversary or service recognition information, etc.

The bottom line is that employers should take every reasonable precaution to protect the personal data of their employees, whether that information is held in a government database or not. Not only is it the right thing to do, it’s just good business. After all, our employees are our most valuable asset, and taking extra precaution to protect our most valuable asset is an investment that contributes directly to the company’s bottom line.

Click here for more information.

Creating Organizational Agility

Christopher Steinbach — Thu, 18 Jul 2013 10:04:00 GMT

Every upwardly mobile professional has a copy of the Organization Chart within arms-reach - - straight lines and boxes mapping accountabilities and authorities depicting the easy and “sanctioned” routes to get things done. But is this really accurate? Organizations are staffed with people. These people all have their own preferences, insecurities, personal desires and goals hidden behind the boxes on that chart. So there is a big difference between how an enterprise is organized and how it functions. There are friends, foes, good Samaritans, gatekeepers, resisters, expediters, naysayers, influencers, etc., etc. The organizational “Chart” is a maze of personalities and ambitions at best. The key to success is to accept this reality, not resist it, and work diligently to become a “maze bright” person in the organization. As discussed last time, this starts by working hard to develop effective peer relationships but as described by Lombardo & Eichinger and others, there are additional approaches you should use to become truly agile within your organization:

Practice #1: Become more self-aware. Try and do the most honest self-assessment of your skills “getting it done” in your organization. Identify at least one person within each group you work with and ask them for feedback what you could do better working with that group.

Practice #2: Pay attention to how the “Movers and Shakers” behave. If things you are doing appear to not be working, try things you generally don’t do that have proven successful for others. You have to look beyond the surface and see what is going on in the background. Who do others rely on to expedite things? Who are the major gatekeepers who control resources and information? Who appear to be the guiders and helpers? These are people you need to know better.

Practice #3: Think equity. Understand the personal “balance of trade” within the organization. Don’t just ask for things; find some common ground where you can provide help, not just ask for it. What do people need in the way of problem solving or information? How does what you’re working on impact them? What can you “trade” in return?

Practice #4: Patience. Some people know the channels to work and the steps to follow to get things done but are too impatient to follow the functional “people-driven” informal process. Developing the ability to maneuver through the organizational maze includes giving things time to run their course; taking deep breaths; and practicing serious self-control. Don’t get frustrated, lose your cool and force the agenda. Focus instead on diagnosing new paths and developing counter-moves if things really are not moving. Be mindful that personal the bridge you burn today, you may desperately need in the future.

Make no mistake, becoming “Maze Bright” and organizationally agile is not easy. That said, once mastered, the dividends are tremendous. You will be seen as a person who get things done where other fail, as someone who is committed to the organization and the good of others as well as yourself. Most importantly, you will find that no skill is more respected by your team. When you can go off into the wilderness of the organizational maze and consistently come back with results that benefit your team and make their professional lives easier, their loyalty is assured. Further, the knowledge gained by developing this skill within yourself will allow you to truly build and prepare your team to perform most effectively in the future. I look forward to discussing this critical skill next time.

Click here for more information.

Social Media in the Cyber Security Space

Ryan Steinbach — Tue, 11 Jun 2013 10:26:00 GMT

Last fall, I started as an intern at the Newberry Group with objectives of assessing the impact of growing a social media presence, developing a strategy for social media use and executing on that strategy. After nine months, my team and I accomplished these objectives and learned a great deal about the cyber security digital community in the process.

In my relatively short, but deep dive into social media strategy and development over the last two and a half years, I’ve witnessed how different the digital communities can be. The cyber security digital community is particularly fascinating. My team found that cyber security professionals tend to fall into two buckets when it comes to social media. There are those who embrace social media due to their above average understanding of its utility, and there are those who avoid it at all costs due to their above average understanding of the risks associated with it.

This creates an interesting obstacle when engaging with the cyber security digital community. The space expects a sophisticated level of engagement, yet can also feel fragmented and reserved. It seems most companies have accepted that they need to be present on social media but there are huge disparities in utilization. Some online presences are merely place holders while others are hosting weekly webinars.

My team at Newberry decided the greatest value was between these two extremes. We saw opportunities for talent sourcing, service promotion, and partnership development, but we also needed to be realistic about the amount of capacity we could commit to these efforts. The value is there to be had, but only with the people and buy-in to capture it effectively.

We knew we didn’t have the capacity to be active in every space or create a large amount of unique content so we focused our efforts on building out the spaces we felt had the most value and created a content strategy that balanced quality and thought leadership with consistency and practicality.

Creating a social media policy also became a critical element of our strategy. The greatest enemy of engagement is uncertainty and, in a space as sensitive as the cyber security community, assessing the appropriateness of a 140 character tweet will likely lead to abandonment. We want to be as explicit as possible about our internal expectations for social media because we believe it will remove that uncertainty and foster greater internal engagement.

The development of a social media strategy and policy that balanced value with capacity is the product of what has become my biggest take away from my time at Newberry. I’ve learned that the benefits of social media do not appear over night. Early wins can be few and far between. But, sustainable and consistent execution of social media builds equity in a digital community that eventually translates into real company value.

This kind of sustainability requires a hard look at where a company can be most effective and then tailoring that to the company’s internal capacity. Instead of leaving social media to the intern as many companies do, my team decided early on that there was no point in me doing any of the day-to-day social media work. Instead, I focused on strategy and setting up Newberry’s internal structure – things that once set in place can be utilized with minimal maintenance.

I’m confident that as I leave Newberry my work will be appreciated, not missed. I’ve helped give Newberry the tools to continue to build value in the cyber security digital community on their own. While this was not part of the three original objectives I had going into the internship, I believe it is by far the most valuable and can serve as an example to others in the space.

Click here for more information.

Developing Effective Peer Relationships

Christopher Steinbach — Tue, 14 May 2013 11:20:00 GMT

Being “Action Oriented”, having “Career Ambition”, being excellent at fostering a “Boss Relationship”, maintaining “Customer Focus”, and excelling at “Directing Others” are critical to growing into a management role and being effective in that role. However, these vital competencies can often get in the way as one moves from being an effective manager to becoming an effective leader. Career growth early in one’s profession often is dependent on being effective “up and down”. Building trust and credibility with clients and bosses (up), and effectively directing those junior to you (down) to achieve superior results is of paramount importance. However, as one’s responsibility begin to expand to support scale within an organization it is imperative that individuals begin to work “across” and foster effective peer relationships. Learning to work “across” is in fact the essence of organizational leadership. Leaders are able to achieve positive results for the organization even when they do not have direct power and control over all resources involved in the activity. Leaders are able to work through influence; trading on mutual respect and goals, share credit and rewards, and build and grow trust. This highly valued ability leads to a more efficient use of time and resources by easing the exchange of ideas and talent across the organization. Managers direct their people. Leaders make the whole organization better. Certainly this requires putting one’s ego on the back-burner but the rewards for those that do are huge. You become recognized for being someone that can work and be effective well beyond your direct span of control for the good of the organization. How do you make this transition? Fortunately, Lombardo & Eichinger and others offer some suggestions:

Practice #1: Curb your Competitive Nature. If peers see you as excessively competitive, they will work to cut you out of the loop and sabotage your efforts to work across organizational boundaries. Always offer an explanation for your thinking and invite others to explain their point of view. Resist “staking out a position” and focus on generating a variety of possibilities. Invite, and accept, criticism of your ideas.

Practice #2: Separate working smoothly with peers from personal relationships. Remember, you are not forming friendships, you are avoiding “one-upsmanship” and the “not invented here” phenomenon in all your organizational interactions. You are keeping your ego and pride in check for the good of the organization. That is the reputation you seek to build. You don’t have to “Like” everyone.

Practice #3: Avoid the water cooler banter. If a peer does not play fair, avoid talking about it with others. Talking about conflicts with others will often backfires on you by undermining the trust you are attempting to build with other peers. Confront the peer directly, privately, and politely and give them a chance to save face. Explain the unfair situation and its impact on you. Even if you don’t totally accept what is said, you have set the stage for an improved relationship going forward. More importantly, you will reinforce your reputation as a person who can be trusted even when there is a conflict.

Practice #4: Keep a balanced Scorecard. Watch out for “winning” too much. Look for appropriate opportunities to grant concessions you can live with even if they are not what you wanted ideally. You want to foster a desire in others to work with you again and again. If you are seen as leader who has a strong point of view but is willing to cooperate and compromise with others that favor will be returned when it matters most. You will create an army of influential peers who are all to ready to support your position because you supported theirs in the past even when you did not totally agree.

Make no mistake; learning to achieve results through influence alone is a tough skill to master for ambitious people. However, the fact remains that those who leave positive impressions get more things done more efficiently than those who leave cold impersonal impressions. Learning how to build and sustain peer relationships is the cornerstone for developing organizational agility. I look forward to discussing this this vital skill next time.

Click here for more information.

Social Engineering through Social Networking: Defending Your Organization

Steven Carney — Tue, 16 Apr 2013 12:15:00 GMT

Human beings are the weakest link in data protection. Social networking has made this weakest link, even weaker. Social engineering continues to be one of the most leveraged attack vectors for targeting an organization’s electronic data or IT systems. Historically, a social engineering attempt would consist of an unsolicited phone call or e-mail. Attackers would attempt to obtain reconnaissance-related information from an unsuspecting employee or get them to click a link, or download an e-mail attachment, that would introduce malware to the system, potentially allowing backdoor access to the network. As users have become more educated on information security, they have learned not to open attachments or click links from individuals they do not know or trust. However, with the continued growing popularity of social networking, potential attackers can perform a more targeted social engineering attack that exponentially increases their level of possible success.

One piece of information typically found in social networking profiles is employment information. A quick search on LinkedIn or Facebook can reveal a list of potential social engineering targets for just about any organization. By using the information found in the target’s profile, the attacker can craft an e-mail that looks legitimate and includes an attachment or link containing malicious software. If an attacker determines the target worthy, they may even establish a false profile reflecting similar interests and befriend the employee, allowing them to eventually introduce the malware through an e-mail or link.

Since it is not feasible to control and monitor what employees put on their personal social networking profiles, how can an organization appropriately defend against this type of attack?

1. User Education: This has been, and always will be, the most effective tool for combating social engineering. In addition to the typical IT security training provided by most organizations today, users should be educated on what company information is appropriate for disclosure on social networking sites and how this information could be used to exploit them. Employees should understand that individuals they make contact with online should not be considered a trusted contact. E-mail attachments or hyperlinks from these online contacts should not be accessed from company-owned computers.

2. Policy and Procedures: Organizations should prohibit employees from using, or listing, their company e-mail addresses on social networking sites. If the social networking sites are a means for networking or marketing and part of official job duties, then look at establishing a generic e-mail account with increased security restrictions that the employee can utilize. This will allow the employee to identify any contact that is made through the site and treat it as untrusted.

3. Security Infrastructure: A reputable web proxy with malware scanning capabilities should be utilized to scan web traffic for potential malware. URL filtering should be enabled and sites that contain known malicious code or malware blocked. Social networking sites should also be restricted for users that do not have a business purpose for visiting them. URL filters typically have groups of sites that are categorized and updated to make this process easy. Finally, a spam filter device or service should be used to scan inbound e-mail for malware and filter unwanted e-mail. Some spam filtering devices also have the capability to scan outbound e-mail for sensitive information such as social security or credit card numbers; this is commonly referred to as Data Loss Prevention (DLP).

With employees advertising more personal information on social networking sites, we can expect to see a continued increase in targeted social engineering attacks. As with any security threat; a layered defense strategy is the best defense against social engineering attacks.

Click here for more information.

Making Quality Decisions

Christopher Steinbach — Tue, 12 Mar 2013 09:22:00 GMT

You have worked hard to become a confident decision maker, even in the face of ambiguity. How do you ensure that you hit the target more often than not and, more importantly, get closer and closer to the bull’s-eye over time? You must practice. Making good decisions requires the right amount of patience, humility, and ice cold nerve to step up and make the call. As I discussed last month; no one is right all the time, it’s being more right than wrong over time that matters. You must develop a highly refined sense for the right amount of data, analysis, intuition, wisdom, experience, and judgment required for each decision opportunity. Michael Lombardo and Robert Eichinger and others have proposed some ways to refine that “6th Sense” that is so recognizable in people renowned for their decision quality. A few of my favorites include:

Practice One: Know your biases. We all have them; attitudes, beliefs, opinions, prejudices, favorite solutions or ways of doing things. The key is to not let them influence your cold objective point of view. Before you make any significant decision, step away. Examine your motives; look at your past decisions; talk through the consequences of various decisions with a trusted third party. Look for patterns. Do I see every problem as a nail demanding a hammer as a solution? A great decision maker is constantly, humbly, examining the source of his intuition and challenging himself to recognize each problem as new while eliminating his own prejudices and biases. Much of what we learn is relevant to the next problem, but a lot is not. Work to know yourself first, then the problem, and then decide.

Practice Two: Holster your gun and sleep on it. Life is a balance between waiting, and doing. Clearly in business a premium is placed on doing over waiting. However, decision quality can often be greatly improved with just a small amount of additional data and/or reflection. Challenge yourself to gather one more piece of data relevant to a meaningful “Why?” question. Let the subconscious brain aid your efforts. Get a good night’s sleep and get back to it in the morning.

Practice Three: Understand the difference between “Thinking”, “Understanding”, and “Knowing” when defining a problem. Do you ever represent (or more accurately, misrepresent) as fact your personal assumptions or the opinions of others using the expression “I know that…”? I personally believe this common tendency of people, to mischaracterize personal thoughts and the conjecture of others as “known” facts, is the leading cause of poor decision making. There is a very simple formula to get out of this trap: When you “think” something (created between your own two ears), seek validation from a credible third party or obtain first-hand knowledge of the critical facts. When you “understand” something from a credible third party, seek first-hand knowledge of the critical facts. Only when you “know” the critical facts through direct first-hand exposure - - act.

So quality decision making is born first of self-knowledge. Being humble enough to examine our motives and tendencies as a starting point and building a framework of the problem through careful consideration and seeking to understand cause and effect; asking “Why?” a lot, as we discussed last month. The final step is to have the patience to seek relevant data and most importantly having the guts to seek first-hand knowledge of the most critical facts. In doing so, you elevate your perspective and attain that “6th Sense” for the right call. You will become recognized as someone who is willing to own their decisions and the basis upon which they are made. And that is the first building block for effective peer relationships and effective team building, which are the essence of leadership. I look forward to discussing those skills next time.

Click here for more information.

Dealing with Ambiguity

Chris Steinbach — Tue, 12 Feb 2013 09:04:00 GMT

How does one survive - - and thrive - - in this modern world? In my experience, it starts with learning how to effectively deal with ambiguity. This critical skill, which I introduced at the end of my last post, is important because; congressional leaders are unable to make tough budget decisions; good people can sometimes do bad things while bad people can also do amazingly good things (consider Lance Armstrong); Getting great at anything runs straight through being awful at it; The solution for today’s problem may not be the solution for tomorrow’s problem. In fact, for 90% of business it’s not clear what the problem even is, let alone what the solution could be; the only constant is change. We live in a “grey” ambiguous modern world.

Let’s be honest. Most of us would prefer to be 100% sure - - about everything! We prefer to know everything that is going on around us because it makes us feel like we are in control. Most of us get really uncomfortable if we can’t wrap up everything we start into nice neat packages with a bow on top. Unfortunately, the cold truth is that success and rewards go to those who develop the ability to make more good decisions than bad in less time than the other guy, using impartial information and few if any precedents or examples of how similar problems were solved before.

Please note that I did not say “make only good decisions...” I said “make more good decisions than bad...” All successful people today have learned to live comfortably in the “Grey Space” by cultivating a well-developed tolerance for errors and mistakes - - both for ourselves and others - - and absorbing the heat and criticism that might follow.

Make no mistake, this is a tough but extremely valuable skill to learn and develop. In the words of English Statesman George Savile - - “He that leaveth nothing to chance will do few ill things, but will do very few things.” And we all know that “doing very few things” just won’t cut it in today’s world of work - - and especially not in a dynamic, energetic, and empowered culture like we have here at Newberry Group. We must learn to thrive and act effectively in the “Grey Space”. So how do we learn and develop this tough skill and effectively deal with ambiguity? Michael Lombardo and Robert Eichinger propose some of the following in their book “For Your Improvement”:

Practice One: “Incrementalism”. Research indicates that we do not grasp the essence of a new problem until the second or third attempt at solving it. Plan on making a series of small decisions, get feedback, correct course, and get a little more data moving forward until you have solved the problem. Start small so you can recover quickly and build confidence that you can “handle the heat” and course correct. You will not build this confidence if you start with “the” problem.

Practice Two: Recognize your Perfectionism for what it is - a roadblock to success. Perfectionism is born of an obsessive need to collect more information than the other guy, thus limiting your personal risk. Try to decrease your need for data and your need to be right a little every week. Pick small decisions and try to act on them with little or no data at all, trusting your gut. As discussed before, the real test in the world of business is who can make a good decision on limited or no data in a reasonable time frame. That takes practice so start with the small stuff - - you will likely be surprised how often you are right. (And if you find that you’re not more right than wrong, you need to read next month’s blog :).)

Practice Three: Ask “Why?” a lot. Evidence from decision-making research makes it clear that the better your problem definition, the better chance you have at finding the solution quickly. Focus on causes, not fixes. http://www.isixsigma.com/dictionary/5-whys/

Practice Four: Develop a philosophical stance toward failure/criticism. Learn to crave feedback. The faster and more frequent the feedback on small problems the faster and greater our learning. Teach yourself by letting others “off the hook” when a mistake is made by focusing on what we can learn from the mistake, not the consequence. In doing so, you will bolster your own ability to handle failure and criticism.

Practice Five: Become Process focused, not results focused. To work well in uncertain times means that you must recognize first and foremost that your work is never done. If the only constant is “change” then that constant will demand that you jump from incomplete project to incomplete project. You must alter your internal reward structure so that you feel good about moving things forward incrementally instead of finishing it. In taking this approach, you will not only cease to be easily frustrated, you will also find that the critical few things that need to be finished – in the sea of insignificant many things - will be. Trust that “through the process” the results desired will be derived from completing the critical few, not everything you start.

Working to develop your ability to deal with ambiguity will give you the will to confidently act when information is limited. But like every well-developed competency, its over-use can become a weakness if relied upon too often or worse, exclusively. A complete person or a complete organization fosters complementary competencies that provide balance and assure that strengths don’t become weaknesses. One of the strongest complementary competencies for those that are comfortable with ambiguity is a strong sense for what is, and is not, a quality decision. Developing this critical competency in our culture will be the topic next month!

Click here for more information.

Building Culture through a Common Language

Christopher J. Steinbach — Mon, 17 Dec 2012 08:16:00 GMT

In today's intensely competitive environment it is critical that organizations establish and sustain a corporate culture that reinforces the behaviors most important to maintaining a distinct competitive advantage. The cornerstone of corporate culture is effective communication but how do you ensure that all are receiving the same message when you are talking about something as "soft" as organizational or individual behaviors? When we say "patience", or "perseverance", or "compassion" what do these words mean in the context of the workplace and how do we ensure that all hear the same meaning? Well, you have to establish a common language for the discussion of these "soft" skills, these competencies. By establishing that common language, all are clear on which "behaviors" individuals are expected to be competent and in turn are valued by the organization for their contribution to organizational effectiveness and competitive advantage.
Fortunately, considerable research has been done over the years with respect to those behaviors most likely to lead organizations and people down the path toward success. This research has produced a number of useful behavioral frameworks, taxonomies, of desired and undesirable behaviors in individuals and organizations. I was fortunate enough to be exposed to one of the more popular and widely used behavioral taxonomies early in my professional career, the Leadership Architect, developed by Mike Lombardo and Bob Eichinger. The Leadership Architect defines 67 competencies found in the most successful people and organizations. In fact, I was certified in the use of this tool for facilitating organizational development and culture building, and as a tool to promote individual professional growth and development. However, the art in successfully using such tools is in clearly determining and communicating which of the many "desirable" behaviors are most important to a particular organization at a particular place in time.
In this series I will introduce those competencies most vital to Newberry's success over the next 36 to 60 months. I will endeavor to explain the competency, it's relevance to our business today and offer suggestions on developing or becoming more skilled in the desired competency. It is my desire to contribute to the development of our own cultural framework for success by starting the dialogue about how our behaviors will shape our future success. It is important to remember that as the market evolves so should the competencies of the organization. What is important today may not be important tomorrow. Which leads us to our first competency - - Dealing with Ambiguity; and our first developmental lesson.....chat soon. :-)
Click here for more information.

5 Tips for Building a Cyber Security Career

Phillip Justice, Jr. — Mon, 19 Nov 2012 09:57:00 GMT

The cyber security field is rapidly expanding to deal with the accelerated risks of changing technology and now is a great time to make the move into a security career. However, not only do you need the qualifications, but also an analytical mindset and good communication skills to effectively convey your expertise to the wide range of customers. Cyber security experts are always chasing an elusive problem and you have to think outside the box quite a bit to find that advanced persistent threat. Here are five tips on how to build your successful career:

1. Develop a Solid IT Foundation

In the case of cyber security, it's really beneficial to have a strong background in information technology. A lot of universities have modified curriculum to provide security focused-degrees. Previously you might have been restricted to computer science or information technology, but now there are actual degrees tailored around computer security. These programs are often sponsored by entities that are focused on cyber security and want to help build the workforce. For example, currently the U.S. government has a shortfall of cyber security professionals. So they have started working with universities to establish these programs to help grow the cyber security field and fill the jobs that they know will be out there.

2. Get Certifications and Training

Certifications are necessary because they establish a foundation. They identify the individuals that have put in the time and effort to understand the fundamentals of cyber security. The CISSP certification is a well-known and internationally recognized security certification and is a great starting point. But with all the different domains of expertise within the security field, you should hone your craft and acquire certifications for your specific area.

3. Use Your Past Military Experience

Today, information technology in the military is no different than it is in the corporate world. There are disciplines within the military that focus on IT and cyber security, so veterans have an opportunity to directly transfer their experience from military service into commercial cyber security work.

4. Use Your Existing IT Career

If you've been in IT for a long time and you have a strong background, you have most likely been exposed to security issues. In all reality, you probably have a level of experience that would qualify you to easily transition and adjust to cyber security work without having to start from the ground up. Talk to your peers or managers about what security opportunities are available to you. Also take some personal initiative to start working on a certification in your area of interest.

5. Build Up Practical Experience

At the end of the day, just like in any field, you need the qualifications and the practical experience. And you have to work your way up. Unless you have a lot of applicable experience, expect to start at the bottom and prove yourself so that you have the evidence to put in your resume. Certifications are great because they establish a foundation through the training, but practical experience is just as important. If you don't have the experience, be forthcoming about it, but also have the wherewithal to press forward with developing your career.

Are there jobs out there?

There is a wide range of cyber-related jobs and almost every industry will have availability whether it's on the commercial side or federal side. In some cases, a cyber opportunity might be there, it just might be coupled with 2 or 3 other roles at the same time; You might be the cyber expert and the IT guru. Newer fields within information technology or security, such as cloud security, mobile security, digital forensics, and malware analysis, are all hot domains so you'll see a lot of opportunities advertised. However, no area in cyber security has lost momentum. Cyber security as a whole is a hot industry to be in, and I predict it to be so for the next couple of decades. It's not slowing down.

Click here for more information.

October is National Cyber Security Awareness Month (#NCSAM)

Newberry Marketing Team — Mon, 15 Oct 2012 17:55:00 GMT

We’re one of the official champions of National Cyber Security Awareness Month (NCSAM) and there’s still time to get involved! National Cyber Security Awareness Month is a campaign focusing on the need for improved online safety and security for all Americans. The National Cyber Security Alliance has sponsored National Cyber Security Awareness Month every October since its founding in 2003.

This year’s theme is “Our Shared Responsibility.” So how can you help?

1. Share Tips and Resources with Your Friends and Family

The National Cyber Security Alliance (NCSA) website is full of tips on how to protect your personal information, teach online safety, and keep your business safe online. Would you know what to do if your accounts were hacked? Do you need resources to help teach cyber security in your classroom? Does your small business have a Cyber Security Plan?
Find resources and tips on www.staysafeonline.org.

2. Attend An Event and Share It!

Organizations all across the United States are hosting cyber-related events to help raise awareness.

Find an event in your area on the Events page: www.staysafeonline.org/ncsam/events
Stay at your computer and check out these FREE Webcasts from SANS:
Securing The Human
Oct 16th and Oct 30th
Register on their website: http://www.securingthehuman.org/blog/2012/09/06/three-security-awareness-webcasts-for-oct/

Newberry Group is proud to be a part of National Cyber Security Awareness Month. Anyone can help raise awareness in their community, let’s continue to help others stay safe online!

To learn more about the National Cyber Security Alliance, visit www.staysafeonline.org.

Click here for more information.

Understanding the ‘Why?’ in B2B Social Media

Ryan Steinbach — Thu, 20 Sep 2012 12:40:00 GMT

Last January I came across this post by Brad Friedman, Build Your Social Media Schedule For 2012. He explains that while more and more business are getting into social media marketing, many get into it for the wrong reasons. I came across this post while skimming through an abyss of opinions on ‘Social media resolutions for 2012.’ What caught my attention was this:

Start with the – "Why?"

Intrigued, I went back and took the time to reflect on what Brad had to say. Early in the post, he gets right to the source of most ineffective social media marketing.

Are you involved with social media to boost your ego?

…do you just want to promote yourself or your product all the time?

Did you join…because ‘Everyone I know is on …?’

Brad encourages us to evaluate ‘why’ – our motivations for using social media. Unfortunately, not much has changed in the last 9 months. As more research supports the benefits of social media in business, more companies are joining social networks, creating blogs, and hiring social media staff. Although no manager will admit it, their motivations are often as unjustified and misaligned as the questions listed above, and with no consideration of the information security implications. In order to reap the benefits of social media and use it in a way that is safe for the company and its employees, a more comprehensive approach is required.

This begins with an evaluation of the business model, value chain, and internal as well as external communication channels. Understanding the information security risks of social media use and, more importantly, how to mitigate these risks is also a critical yet often overlooked step. Once the institutional framework is in place, a company can begin identifying opportunities for social media, developing metrics for evaluating performance, and, finally, implementing social media into business operations. Even if a social media strategy is working for competitors, it doesn’t mean that strategy, or even social media in general, is going to be effective.

The staff at Newberry Group understands this and has given me the opportunity to research and prove an opportunity for social media in their business model. As a social media intern, I’ll be developing a business case for social media use at the Newberry Group. I’m excited by this opportunity, not only because I have a deep interest in B2B social media development but also, because I believe my role is a fundamental step that every business should take, even if it is already engaging social media.

I hope to share some of my work and findings in subsequent blog posts over the next few months. If you have any thoughts on, contributions to, or questions about my work, please do not hesitate to email me: [email protected]" shape="rect">[email protected] or shoot me a tweet: @R_Steinbach (note: tweets are my own and in no way reflect the views or opinions of Newberry Group)

Click here for more information.

5 Tips to Get Your Data and Computer Storm-Ready

Breanna Cooke & Nicholas Trifiletti, contributor — Fri, 31 Aug 2012 12:19:00 GMT

Hurricane season is upon the southern United States and now is a good time to make sure your data and computer is prepared for an emergency too. Here are some tips to get you started:

Backup your data with an online backup service - There are many online backup services to choose from. This article by PC magazine does a great job of outlining the different options available.
Copy your User folder (the folder named "Username") to an external hard drive – This will ensure that all of your documents, photos, videos, music, desktop, and application data such as email archives and application preferences are saved. For the ultimate backup, consider making a "snapshot" of your entire computer with a program such as Acronis True Image (PC) or Carbon Copy Cloner (Mac). The "snapshot" will allow you to boot from that hard drive if you had to completely restore your files.
Use a battery backup + surge protector – If you use a desktop computer, a battery backup will provide some buffer time for you to save your files when there is a power outage. Most battery backups also give you the benefit of a surge protector.
Plug your cable modem’s coaxial cable into a surge protector – If you use a cable modem and your computer is directly connected to it via an ethernet cord, be sure to plug the coaxial cable into the battery backup. This will help prevent power surges being transferred from the cable, through the ethernet cord, and on into your computer.
Unplug your computer when not in use during a storm – The most certain way to avoid power surge damage is to simply unplug your computer from its power cord.

Click here for more information.

Why do Nigerian scammers say they are from Nigeria?

Diane McClain — Wed, 11 Jul 2012 09:49:00 GMT

Far-fetched tales of West African riches strike most as comical. So why do Nigerian scammers say that they are from Nigeria? Why so little imagination? Why don’t Nigerian scammers claim to be from Turkey, or Portugal, or Switzerland? Stupidity is an unsatisfactory answer: The scam requires skill in manipulation, considerable inventiveness and mastery of a language that is non-native for a majority of Nigerians.

We’ve all seen some form of this "too good to be true" chopped up English type of technique designed to part us from a significant amount of money. However, the initial reaction of a scam-savvy person is just what the attackers are looking for. This scam method relies on a vast numbers game and is examined in Cormac Herley’s whitepaper, Why Do Nigerian Scammers Say They Are From Nigeria?. A researcher at Microsoft, Herley’s analysis delves into the numbers that make these scams work and the gullibility of the victims. Make no mistake, these scammers are smart and they know what they’re doing.

Attacks are seldom free.

Malicious software can accomplish many things but few programs output cash. At the interface between the digital and physical worlds, effort must be spent. Turning digital contraband into goods and cash is not always easily automated. For example, credentials may be stolen by the millions, but emptying bank accounts requires recruiting and managing mules. The end game of many attacks require per-target effort. Thus when cost is non-zero each potential target represents an investment decision to the attacker. He invests effort in the hopes of a payoff. Therefore, he must "qualify" his victims prior to expending significant amounts of resources (time and money) to attain the prize.

Who is a target and how are they chosen?

There are several models of human behavior that illustrate the theory that when large numbers of communications are cast to random recipients, there is a direct relationship to the number of viable targets harvested. The attacker is looking for people gullible enough to respond to the communication. These people make the "short list" and the attacker continues to nurture these targets until all false positives have been eliminated and there are only true positives left. True positives represent a tiny subset of the initial list of random recipients. In addition to a high gullibility trait, true positives must also have money and an absence of any factors that would prevent them from following through all the way to sending the money.

Since gullibility is unobservable, the best strategy is to get those who possess this quality to self-identify. These are the communication recipients who respond. An email with tales of fabulous amounts of money and West African corruption will strike all but the most gullible as bizarre. It will be recognized and ignored by anyone who has been using the Internet long enough to have seen it several times. Therefore, shrewd recipients are in a sense, helping the scammers by inadvertently classifying themselves as non-viable targets merely by the absence of their response.

So how does this approach answer the question in Herley’s title? His answer: By sending an email that repels all but the most gullible, the scammer gets the most promising marks to self-select and tilt the odds in his favor.

So what…?

You say, "I don’t fall for these Nigerian scams so this won’t affect me." That’s great… AND keep in mind all that was discussed in this article was only one type of scam. There are millions more scams relying on the same gullibility factors of human behavior with the same end game. We are the weakest link.

Read the full whitepaper by Cormac Herley here:
http://research.microsoft.com/pubs/167719/WhyFromNigeria.pdf

Click here for more information.

June is National Internet Safety Month

Breanna Cooke — Fri, 22 Jun 2012 10:38:00 GMT

Like wearing a bike helmet, staying safe on the Internet is all about taking the right precautions. In celebration of National Internet Safety month, we’re directing you to some resources from the National Cyber Security Alliance’s (NCSA) website. The National Cyber Security Alliance is a non-profit organization that collaborates with the government, corporate, non-profit and academic sectors to empower citizens to use the Internet securely and safely. Visit their site, www.staysafeonline.org, for more information and resources.

Tip Sheets from the NCSA

The NCSA has put together some tip sheets that are great reminders and can help facilitate Internet safety discussions with your family. Some of the sheets include:

Online Gaming Safety – Tips for Parents: Most video games are connected to the Internet whether they are played through an Internet browser or a computer or gaming console. NCSA gives steps on how you can help keep your child’s information safe and be an informed parent.
Mobile Device Safety Tip Sheet: With apps that access your location, public wi-fi hotspots, and text messages with suspicious links, mobile safety is just as important as on the home computer. These tips serve as a good reminder about how to safely manage your mobile devices.
Safe Social Networking Tip Sheet: Taking time to set your privacy settings and being conscious of the personal information you share is what helps keeps social media enjoyable. Go over these tips with your family so that everyone is on the same page about what information should be shared and how to keep accounts secure.
For more tip sheets, visit www.staysafeonline.org/tools-resources/tip-sheets

Free Security Checkups

NCSA has provided a list of security vendors who offer free online security checkups. Most of these will search for viruses and spyware and will help you keep a clean machine. Check out the list of vendors here: www.staysafeonline.org/tools-resources/free-security-check-ups

Also, check out the Microsoft Computer Safety Index survey. The survey will ask you some questions about your online habits, then will walk you through some steps to check the settings on your computer. (For PC only)

Click here for more information.

Your Digital Footprint: What can you control?

Valerie Root — Wed, 09 May 2012 09:59:00 GMT

Do you know how much of your private information is available to strangers?

We may be in a digital world but that doesn’t mean that we shouldn’t take precautions with our information. Many of us do not realize how much of our personal information is available to outsiders and how it contributes to our digital footprint.

What is a Digital Footprint?

Your Digital Footprint is the information about you or from you (activities, comments, public records) that can be accessed via a digital environment.*

The 3 Main Sources of Information

Our personal information is available from a variety of sources and much is out of our control: we don’t have any say in who can access our information.

1. Public Records

The Freedom of Information Act was first enacted in 1966 by President Lyndon B. Johnson and supplemented by President Bill Clinton with the Electronic Freedom of Information Act Amendments in 1996.** Some of the information available to anyone as a public record includes:

Census records
Consumer protection information
Court dockets
Criminal records
Government spending reports
Legislation minutes
Professional and business licenses
Real estate appraisal records
Sex offender registration files
Voter registration

2. Web Searches

Have you ever Googled yourself? Almost anyone can be found online. Someone can find information about you through:

Simple search by name, e-mail or phone number (it gives thousands of results!)
Companies that help you look up anyone if you can provide some basic information. Many of the results will come back as free searches and then they offer more in-depth information for a fee.
Companies who maintain massive databases that troll public and government websites for information and sell it to anyone willing to pay.

3. Social Websites

Do you have a Facebook, Google+ or LinkedIn account? Even with extensive privacy settings, there is no guarantee that the information you share won’t get into the wrong hands. A simple status update about being away from home can be an open invitation for a thief. Some of the information you may have shared includes:

Home address and phone number
Dates for vacation and travel
Photos or “check-ins” of where you are
Names of your family members

What do you want your Digital Footprint to be?

Take steps to protect yourself and the information that you can actually control. Privacy controls are an important component when interacting with online resources. Regularly reviewing and setting your privacy controls helps limit what is available to the general public. Not everyone will look at the pictures, posts, blogs, likes/dislikes or comments without evil intent. Being aware of what you are putting online and who might see it is the best step in protecting yourself.

* http://en.wikipedia.org/wiki/Digital_footprint
** http://en.wikipedia.org/wiki/Public_records

Click here for more information.

Identifying and Reporting Suspicious E-mail

Jerry Kennedy — Wed, 18 Apr 2012 15:45:00 GMT

If you are like me, you receive the occasional e-mail that just doesn’t look quite right. It may be from an anxious individual looking for your help to move their recent monetary windfall out of their impoverished country. Or it’s from someone who has a “can’t miss” investment opportunity that just needs some additional capital. Or it’s from someone who is simply looking for a sales quote for a business that just doesn’t look right. While I am sure that none of us have taken that bait, we shouldn’t ignore these suspicious e-mails. We should be reporting them to the Defense Security Service (DSS) and the Federal Bureau of Investigation (FBI).

How do I know if it’s suspicious?

Most of us understand that phishing is the act of someone trying to elicit personal information from you so they can exploit you or IT systems/accounts that you have access to. However, what if these e-mails do not ask for anything other than your simple response? Many of the examples above only ask you to respond and, if you do, they will “send you further information.” Once you respond and essentially confirm your e-mail address is active, these devious folks commonly do a number of things. They do as they promise and send a response back that is typically malware or spyware that infects your computer or network. They also typically sell your e-mail address to hackers or spammers who inflict their own damage to your systems.

What does DSS and the FBI do?

The DSS and FBI depend heavily on leads and information from the general public. It is rare for Federal investigation cases to be initiated by the DSS or the FBI. The sources of many of their investigations stem from reports from the general public. To aid in their data collections, we can forward suspected e-mails to them. DSS and the FBI then track these to the source, compile it with other data on file, and determine if an investigation is required.

Should I report everything?

It is important to keep in mind that not all unsolicited e-mail is malicious. Legitimate companies often send mass e-mails hoping to gather customers. And those lengthy “Terms and Conditions” that we all ignore when signing up for an online service or purchasing software often gives the recipient authority to use your e-mail address as they see fit. Always remember that you should never open any attachments that come from unknown or unexpected recipients.

How do I report suspicious e-mails?

Seek the advice of your company’s Security Officer or IT Department on how to handle and report malicious e-mails.
OR
Visit the FBI website for instructions: http://www.fbi.gov/scams-safety/e-scams

Click here for more information.

SANS Presentation Webcast Posted

cmdLabs Staff — Sat, 17 Dec 2011 23:01:00 GMT

Eoghan Casey delivered the presentation “Expert Briefing: Mobile Device Forensics Essentials” on behalf of cmdLabs at the SANS WhatWorks in Forensics and Incident Response Summit on July 8. SANS has made this presentation available via webcast at the following URL:

https://www.sans.org/webcasts/show.php?webcastid=92648

If you have any comments or suggestions regarding the presentation or anything else, please shoot us an e-mail at [email protected]">[email protected].
Click here for more information.

Salvaging Digital Video Fragments

Eoghan Casey — Sat, 17 Dec 2011 15:11:00 GMT

Digital video is becoming a more common form of digital evidence with the increasing prevalence of video in computers, mobile devices and cameras. Digital cameras can create high quality videos, most smart phones can create videos, and the iPad2 has two cameras that can create videos. The videos created by such digital devices can be stored on removable storage media and on the devices themselves. Frequent creation and deletion of videos on these kinds of devices can result in fragments of deleted video clips that most file carving tools cannot salvage. In addition, when dealing with Flash memory dumps acquired from mobile devices, data at the physical level is often fragmented. Specialized methods and tools are needed to salvage deleted video fragments as demonstrated in this article using the contents of Flash memory acquired from a Motorola V3 (RAZR) mobile device.

File Carving Limitations

Most file carving tools require a known file header in order to salvage deleted data. For instance, to recover a deleted 3gp file, most carving tools look for the file headers such as the following.

Hex view of 3gp header in the Motorola V3 Flash memory dump

If the file is fragmented or the header is missing, the file carving approach will not salvage the deleted video successfully. In this example, a file carving tool that searched the Motorola V3 memory dump for several 3gp header signatures found two files in as shown in the audit log:

05/24/2011, 11:26:35
QuickTime 3GP (3gp), header: ftypisom
QuickTime 3GP (3gp), header: ftyp3gp
QuickTime 3GP (3gp), header: ftypmmp4
Default file size: 1024 KB
Maximum file size: 100 times (individual file type definition defaults sizes respected)
E:\Physical GSM Motorola V3 RAZR\Flex Partition 1140000-1fe0000.bin
Scope: 000000 - E9FFFF
Extensive byte-level search
9D0E80 - AD0E7F: 00001.3gp
B888F0 - C888EF: 00002.3gp
05/24/2011, 11:26:35
2 file headers were found. 2 files were retrieved.

However, the salvaged files were invalid because the original files were fragmented. Furthermore, the names and directory paths of these files were not obtained using this method, demonstrating a further limitation of file carving.

Salvaging Video Fragments

When video files are fragmented, it is necessary to consider the video file format in more detail. Fortunately, many digital video formats have a structure that can be used to find and salvage individual frames. A frame is a discrete section of the video that can have a timecode or sequence number and other characteristics that can be useful for salvaging digital video clips.

The defraser tool can be used to identify frames for several video formats in a forensic duplicate of any piece of storage media, including a removable storage card, computer hard drive and Flash dump from a mobile device. The following screenshot shows defraser used to detect video related data in the Motorola V3 memory dump.

Defraser showing video related data in the Motorola V3 memory dump

Although the defraser tool does not automatically piece together the frames into a video that can be played, it does make the frames available for manual reconstruction. With some effort, defraser may be used to combine fragmented frames into a valid video file that can be played.

As with file carving methods that rely on header signatures, the carving methods employed by defraser do not provide the filenames and directory path of salvaged video data in the context of the original file system.

File System Reconstruction

Ultimately, the most effective approach to extracting digital video files from acquired digital evidence such as a Flash memory dump from mobile device is to reconstruct the logical arrangement of data. On mobile devices, this logical structure involves the flash abstraction layer and file system. Using mobile device forensic tools such as Cellebrite Physical and XRY, it is possible to reconstruct and review logical file structure of a Flash memory dump as shown below with a 3gp video stored in an MMS related file in the Motorola V3 memory dump. Note that different tools may interpret the logical structure differently and show more files and folders, clearly demonstrating the importance of validating the results of forensic examination tools.

XRY/XACT showing the logical file system in the Motorola V3 memory dump

Cellebrite Physical showing the logical file system in the Motorola V3 memory dump

Extracting the MMS file using such a mobile device forensic tool and extracting the video content as discussed in the “Delving into Mobile Device File Systems” blog post results in a 3gp file that can be played using VLC media player.

Playing salvaged digital video using VLC Player

Examination of Salvaged Video

After salvaging digital video files it is important to review the resulting data closely for potential anomalies. For instance, using MediaInfo [http://mediainfo.sourceforge.net/en] to extract metadata from video files shows details related to its creation and format. The following screenshot shows metadata from a 3gp video extracted from the Motorola V3 memory dump, revealing that the embedded date-time stamp was set to an incorrect date.

Metadata within a 3gp video displayed using MediaInfo

In addition, reviewing individual frames within a salvaged video file can reveal anomalies such as portions of two unrelated videos being combined into one salvage file. The following screenshot shows frames extracted from a 3gp file using DCCI Video Validator [http://video-validator.sourceforge.net/] revealing footage from two unrelated video files.

Frames extracted from digital video using DCCI Video Validator

Conclusions

When a video file is fragmented or the header of a video file is overwritten, carving methods that rely on header signatures and contiguous files will not salvage video files successfully and may even incorrectly combine unrelated video fragments into a single file or fail to detect the presence of video content altogether. However, using specialized tools such as defraser, a digital investigator may be able to salvage fragments of video files and piece them together into a valid video file. This process of reconstructing video fragments is time consuming and error prone, particularly when dealing with numerous video files on a single piece of storage media or mobile device. Therefore, whenever feasible, it is preferable to reconstruct the logical arrangement of data to extract the complete content of video files. Whichever method is most effective for salvaging digital video, it is important to examine the results closely to ensure the accuracy and completeness of the resulting videos. Such a review includes inspecting embedded metadata for anomalies and reviewing keyframes for possible fragments of unrelated video footage.

Click here for more information.

Newberry Group Website Launch

Chris Steinbach — Fri, 25 Nov 2011 16:41:00 GMT

It is with great pleasure and pride that I announce the redesigned Newberry Group website, a project more than a year in the making. Our new website will showcase our portfolio as it continues to grow and diversify, and highlight the exceptional contribution our fellow employee-owners make to our Nation, our clients, our communities, and our company. As you know, being a Newberry Employee Owner (NEO) isn’t like being an average employee at an average company. At Newberry we have the unique opportunity to create long term wealth for ourselves and our colleagues, as owners, through the Newberry Group ESOP.

We tried to encompass the spirit of Newberry, the Signature Experience, in this website, our public face to the world. People often ask me, “What is the Signature Experience?” The answer is that it’s different for everyone. For our clients it means an excellent and consistent delivery they can trust. In the marketplace, it means finding an excellent and trusted partner, as well as an extremely focused and tough competitor. For our employee-owners, it means an inspiring workplace where personal and professional development are valued and encouraged. The Signature Experience seeks to enhance and enrich the lives of our employee-owners, our clients, and our communities.

Newberry is an agile and evolutionary company that is far different today than it was a year ago, and will continue to mature into a far different company a year from now than it is today. Our employee-owners strive for more, refusing to remain static, embracing the kind of change that creates a unique and rewarding Signature Experience for all who come to know us and our company. I believe our new website embodies that spirit and tells that story.

Click here for more information.

Winner of DFRWS2011 Forensics Challenge Announced

Eoghan Casey — Wed, 09 Nov 2011 13:13:00 GMT

This year Eoghan Casey worked with Tim Vidas at Carnegie Mellon University and Matthew Geiger at CERT to create the DFRWS Forensics Challenge in an effort to advance forensic analysis of Android mobile devices. The winners of the challenge were Ivo Pooters, Steffen Moorrees and Pascal Arends from Fox-IT. Their submission provides a suite of utilities written in Python for extracting information from data acquired from Flash memory on Android devices. Complete results are posted on the DFRWS Web site.

The scenarios for the DFRWS 2011 Forensics Challenge were two seemingly unrelated crimes that turned out to be tightly linked with each other. The first scenario was a suspicious death and the goal of the investigation was to determine whether the victim killed himself or was murdered. The second scenario was an intellectual property theft case and the goal of the investigation was to document any evidence that intellectual property was stolen and to support termination of the suspected insider.

An interesting outcome of the challenge was that using dd to acquire data from the Android device in Scenario 1 did not copy the important information in out-of-band (OOB) areas of the YAFFS2 file system. As a result, it was not possible to reconstruct the file system. However, contestants were still able to carve out usable content from this data.

The winning submission provides a technical analysis of data structures found in memory dump from Android mobile devices and provides an Android analysis toolkit that extracts specific items and formats them in a report. Using this toolkit to perform a forensic examination of a full NAND dump of a YAFFS2 file system (such as in Scenario 2 of the DFRWS 2011 Forensics Challenge) first requires the file system to be mounted under Linux as an emulated Flash device (using nandsim).

A sample of the information extracted by the winners from the SQLite database located on the Android device in Scenario 2 (mtd8\data\com.android.providers.telephony\databases\mmssms.db) is provided here:

Address	date/time (UTC)	read	type	body
[email protected]	05/06/2011 01:34:55 AM	True	in	(Nearby! Coming for my beer) Hey Yob, I am closing in on Fat Heads. See ya soon.
[email protected]	05/06/2011 05:53:30 PM	True	in	Reminder, planned IT outage this weekend. This maintenance window will start at 3 PM today and continue for approx 48 hours.
[email protected]	05/06/2011 05:55:16 PM	True	in	This effects external services such as website, email, webmail, and the ftp server. Use the secondary email access and helpdesk # for emergencies
[email protected]	05/07/2011 11:39:16 PM	True	in	(Save me!) If Luke asks, I’m going out with you to dinner, OK? I just can’t face Mr. Smooth tonight. Shandra
6245	05/07/2011 11:44:27 PM	True	out	Sure thing. Do you know where the wine loft is?
6245	05/07/2011 11:54:37 PM	True	out	I ran into some friends at the double wide, meetup at 8:30 or so?
6245	05/07/2011 11:56:53 PM	True	out	Or you can walk down Carson and join us

Much more information was extracted from both Android devices as detailed in the reports, which include an impressive graphical reconstruction of events.

Click here for more information.

SQLite for Digital Forensic Practitioners

cmdLabs Staff — Tue, 08 Nov 2011 16:37:00 GMT

An increasing number of programs are employing SQLite to store data that can be of relevance in an investigation. Forensic practitioners who become familiar with SQLite and learn how to interpret these files will be in a better position to obtain the most usable information from available digital evidence. We cover this and other useful forensic techniques in our Mobile Device Forensics course (SANS SEC563).

Backup files from an iPhone or iPod Touch provide an excellent example of SQLite databases that digital forensic examiners can exploit with relative ease, provided they are not encrypted. Data backed up from an iPhone using iTunes such as call logs, contacts, multimedia, and other files are, by default, stored in SQLite database files under “~/Library/Application/Support/MobileSync/Backup” Mac. On Windows XP these backup files are stored in the user’s profile under “C:\Documents and Settings\[userprofile]\Application Data\Apple Computer\MobileSync\Backup” and Windows Vista has a “Roaming” subfolder in this path.

SQLite databases can be examined using a command line tool like sqlite3.exe or with a GUI tool like SQLite Database Browser shown here with the call log backed up from an iPhone.

The dates are in Unix string format and can be converted using Perl as shown here:

$ perl -e "print scalar(gmtime(1247848584))"
Fri Jul 17 16:36:24 2009

The use of SQLite databases gives forensic practitioners the ability to query the available data directly using the SQL database language. Although a full treatment of SQL is beyond the scope of this discussion, simple examples are provided here to get you started.

C:\>sqlite3.exe E:\iPhoneBackup\call_history.db
SQLite version 3.6.16
Enter ".help" for instructions
Enter SQL statements terminated with a ";"
sqlite> .tables
_SqliteDatabaseProperties call
sqlite> select * from call WHERE address like '%868%';
2|+186835xxxxx|1247848584|60|4|-1
3|+186835xxxxx|1247853361|0|5|-1
4|+186835xxxxx|1247854453|0|5|-1
9|+186831xxxxx|1247895923|60|4|-1
10|+186835xxxxx|1247936960|60|5|-1
11|+186835xxxxx|1247941792|0|4|-1
12|+186835xxxxx|1247941827|0|4|-1
13|+186835xxxxx|1247941920|0|4|-1
14|+186835xxxxx|1247942844|0|4|-1
16|+186835xxxxx|1248015352|60|4|-1
17|+186835xxxxx|1248015674|0|4|-1
18|+186835xxxxx|1248016092|0|5|-1
26|+186835xxxxx|1248177103|0|5|3

The Symbian operating system for mobile devices also makes use of SQLite databases, and other computer applications store investigatively useful information in SQLite databases, including Firefox 3 and Skype. For instance, the moz_places table in the places.sqlite file from Firefox 3 is shown below.

This file can also be queried using SQL, as shown here being queried for all URLs containing the cmdLabs web site.

C:\tools>sqlite3 E:\firefox\places.sqlite
SQLite version 3.6.16
Enter ".help" for instructions
Enter SQL statements terminated with a ";"
sqlite> .tables
moz_anno_attributes  moz_favicons         moz_keywords
moz_annos            moz_historyvisits    moz_places
moz_bookmarks        moz_inputhistory
moz_bookmarks_roots  moz_items_annos
sqlite> select * from moz_places WHERE url like '%cmdlabs%';
621|http://www.cmdlabs.com/|Home|moc.sbaldmc.www.|1|0|1||2000
622|http://www.cmdlabs.com/page11/page11.html|Blog|moc.sbaldmc.www.|1|0|0||100
623|http://www.cmdlabs.com/services/services.html|Services|moc.sbaldmc.www.|1|0|0||100
624|http://www.cmdlabs.com/services/services/services-4.html|Training and Education|moc.sbaldmc.www.|1|0|0||100

Programs like Firefox that maintain usage records in these databases may leave remnants of deleted items that may be recoverable from unallocated disk space as detailed in Murilo Tito Pereira’s article “Forensic analysis of the Firefox 3 internet history and recovery of deleted SQLite records” (www.digitalinvestigation.net).

Click here for more information.

Delving into Mobile Device File Systems

Christopher Daywalt — Tue, 08 Nov 2011 16:02:00 GMT

Mobile device forensics tools have come a long way in the past year, giving us access to more data on a wider range of devices. Even when a full copy of physical memory is not possible, for many devices the complete logical file system can be acquired. Although this generally does not include deleted items, it can still provide access to substantial digital evidence including MMS messages, IM fragments, and Web browsing history.

However, even when a tool can acquire the entire file system from a mobile device, it may not be able to display items of interest like MMS messages. In such situations, the forensic examiner must locate the desired information within the file system and interpret it themselves.

This is one of the main reasons why it is important for practitioners to have an understanding of the underlying technology, and not be overly reliant on automated tools.

Locating MMS Data

A good example of when a tool can acquire but not display evidence of interest came up in a recent case involving MMS messages on a Verizon LG phone. Although the commonly used tool called Cellebrite could acquire data from the mobile device, including a copy of the file system, it did not present MMS messages in the output report. As a result, the investigating agency was only able to view the incriminating evidence through the device itself by performing a manual “scroll” examination.

Until cmdLabs came along to help…

By examining the file system acquire using Cellebrite, we found MMS messages in the “mms” folder on the LG device. For the sake of illustration, this file system location is shown using BitPim.

The MMSMsg.db file contains metadata associated with the messages, and the PDU files contain the original file name as well as the actual data of the pictures and videos in the message. The header of one PDU file is shown here, revealing some Synchronized Multimedia Integration Language (SMIL) tags and the original file name on the device (0920091201a.3g2).

Even after the original video file is deleted from the device, a copy remains in the MMS message.

Extracting MMS Data

The media portion of the PDU message file can be extracted using simple file carving techniques. Although you could remove the file header manually using a hex editor, it is more effective to use a file carving tool like Foremost. By automating the file carving process, your process is repeatable. In addition, Foremost generates an audit log that can be useful for forensic documentation purposes.

The file header (a.k.a. signature) of the 3gp videos from an LG VX series device is “ftyp3g2a” preceded by 4 bytes. The configuration entry for the Foremost file carving tool is shown here:

3gp	y	4000000	????\x66\x74\x79\x70\x33\x67\x32\x61

Using a configuration file that contains the above signature, the command ‘foremost -c foremost.conf MMS*‘ will extract the 3gp video content from PDU files acquired from an LG device. The resulting videos will be saved in the default Foremost output directory and can be played using Quicktime as shown here.

For those forensic practitioners who are interested in learning more about mobile device forensics and related data recovery techniques, cmdLabs is teaching the SANS Mobile Device Forensic course (SEC 563) in New Orleans from January 11–15, 2010 and again in San Antonio from January 25–29, 2010.

Click here for more information.

Handbook of Digital Forensics and Investigation Released

Eoghan Casey — Tue, 08 Nov 2011 15:56:00 GMT

At long last and with the help of many talented experts, I have put together a new Handbook. This book provides an advanced reference for conducting digital investigations and performing forensic examinations. The first part of the book provides comprehensive methodologies and practical tips from experienced practitioners in the areas of forensic analysis, electronic discovery and intrusion investigation. The second part of the book delves into technical aspects of digital evidence on computers, networks, and embedded systems. The technologies covered include Windows, UNIX, and Macintosh computers, cellular telephones and other mobile devices, networks and mobile telecommunications technology.

The Network Investigations chapter written by cmdLabs personnel is available in PDF form upon request.

F-Response is giving a copy of the Handbook with purchase of their tool:

Buy F-Response, Get a copy of The Handbook of Digital Forensics and Investigation

My deepest thanks to the contributors: Cory Altheide (Mandiant) – Christopher Daywalt (cmdLabs) – Andrea de Donno (Lepta) – Dario Forte (DFLabs) – James Holley (Ernst & Young) – Andy Johnson (University of Maryland, Baltimore County) – Ronald van der Knijff (Netherlands Forensic Institute) – Anthony Kokocinski (CSC) – Paul Luehr (Stroz Friedberg) – Terrance Maguire (cmdLabs) – Ryan Pittman (US Army) – Curtis Rose (Curtis W. Rose & Associates) – Joseph Schwerha (TraceEvidence) – Dave Shaver (US Army) – Jessica Reust Smith (Stroz Friedberg).

Click here for more information.

The Pitfalls of File Initialization for Forensic Analysts

Eoghan Casey — Tue, 08 Nov 2011 15:48:00 GMT

File initialization is a normal Windows file system behavior that can create problems for forensic analysts. We have encountered file initialization behaviors in a number of cases and find that it creates significant confusion if the underlying cause is not understood. In several cases, incomplete file initialization was misinterpret as backdating, and in another matter it hampered data salvaging efforts.

File Initialization

File initialization is a process that Microsoft Windows uses when creating a new file system entry. Basically, when a new file is being created, an appropriate amount of unallocated space is reserved for the data that will be stored in the new file. Under certain circumstances, the storage space reserved for the new file may not be used in its entirety, or at all.

When only a portion of the disk space that was reserved for a new file is used to store data associated with that file, this leaves a discrepancy between the logical file size and the actual amount of data stored in the file. As a result, you can have a file that appears to have a logical size larger than the actual amount of data stored for that file. The space between the end of valid data and the end of file is called uninitialized space.

“In NTFS, there are two important concepts of file length: the End of File (EOF) marker and the Valid Data Length (VDL). The EOF indicates the actual length of the file. The VDL identifies the length of valid data on disk. Any reads between VDL and EOF automatically return 0 in order to preserve the C2 object reuse requirement.” (Microsoft fsutil documentation)

Uninitialized space is similar in concept to file slack except that it is contained within the logical file size. Unlike file slack which is no longer associated with a file, data in uninitialized space is in a kind of limbo, trapped at the end of an allocated file but not actually part of that file.

Figure: Diagram of file with a logical size that is larger than its valid data length, leaving uninitialized space

The effect of file initialization behaviors are most easily demonstrated on Windows XP with fsutil as shown here. First, we create a new file that can contain 1024 bytes:?

C:\Test>fsutil file createnew cmdLabs-setvaliddata 1024

    File C:\Test\cmdLabs-setvaliddata is created

Then we set the valid data length of the new file to 1000 bytes, which leaves 24 bytes unused at the end of the file.

C:\Test>fsutil file setvaliddata cmdLabs-setvaliddata 1000?

    Valid data length is changed

NTFS captures the difference between logical file size and valid data length in two MFT fields as shown here:

Figure:MFT entry with logical size and valid data length viewed using X-Ways Forensics

Salvaging Data from File System Limbo

The significance of this from a forensic analysis standpoint is that a file with a valid data length smaller than the logical file size can contain data associated with two files: data associated with the new file (VDL bytes), and data from the old file in uninitialized space (logical file size – VDL bytes).

From a forensic analysis perspective, this uninitialized space can be beneficial. While various disk cleaning utilities can be configured to wipe file slack, they generally do not touch data in uninitialized space. As a result, deleted data can remain in uninitialized space indefinitely, even despite data destruction efforts, and can be salvaged by forensic analysts.

However, this arrangement of data can create complications for forensic analysts, particularly when dealing with larger files that have substantial amounts of uninitialized space. For instance, when carving for certain file types, it is common to export unallocated space. However, any data in uninitialized space will not be included in unallocated space. Similarly, when performing keyword searches, a forensic analyst could incorrectly attribute a hit in the uninitialized space with the new file.

In one case, several approaches were employed in an effort to salvage video fragments:

examined deleted video files still referenced by file system
performed file carving on unallocated space only
processed file slack only for fragments of video files

None of these approaches recovered videos from a time period of interest. It was not until we conducted a forensic analysis of uninitialized space that additional video fragment were found.

Misinterpreting Normal File System Behavior as Backdating?

Another complication from a forensic analysis standpoint arises when the file creation process is interrupted before the contents of the file is written to disk, because the new file system entry will point to a cluster that still contains data associated with an older file. When this occurs and a date can be associated with the older file, forensic analysts might think that a newer file was overwritten by an older one. This phenomenon can be misinterpreted as evidence of backdating.

As an example, consider a newly created file that has not been initialized and has not had any associated data saved to disk as shown here using fsutil:

C:\Test>fsutil file createnew cmdLabs-creatnew 1024

            File C:\Test\cmdLabs-creatnew is created

When a file is initialized but the associated contents was not written to disk, the initialized file system entry may point to a cluster that contains old data as shown below using EnCase. By default, EnCase shows uninitialized space in blue text. The cluster that was allocated to the new file “cmdLabs-createnew” contains older data (folder entries of files from earlier in January).

Figure: EnCase showing folder entries from early January in the cluster allocated to the new initialized file system entry

This situation can be misinterpreted as backdating if the forensic analyst assumes that the clock had to be set back to the old date when the file contents was saved to disk.

Click here for more information.

Advances in Windows Mobile Forensics

Eoghan Casey — Tue, 08 Nov 2011 15:30:00 GMT

Recent research into important file formats on Windows Mobile devices has led to a breakthrough in mobile device forensics. Our improved understanding of the proprietary Microsoft embedded database format enables us to recover all available data from files such as cemail.vol, including deleted items.

The papers and associated tools detailing these advances in Windows Mobile forensic analysis are published in the Journal of Digital Investigation [http://www.journals.elsevier.com/digital-investigation/#description]. The most recent special issue on forensic analysis of embedded systems contains two papers: Introduction to Windows Mobile Forensics and Windows Mobile Advanced Forensics.

Introduction to Windows Mobile Forensics by Eoghan Casey, Michael Bann and John Doyle covers the fundamentals of Windows Mobile systems, embedded database formats and tools for acquiring and examining these systems in a forensic context. A table from this paper is provided here, listing potentially useful sources of evidence on Windows Mobile devices.

Windows Mobile Advanced Forensics by Coert Klaver from the Netherlands Forensic Institute provides in-depth technical details about embedded database formats and tools for acquiring and examining this information. The author developed tools for interpreting data in embedded databases acquired from Windows Mobile devices, including deleted items.

An upcoming issues of the Journal of Digital Investigation contains the paper Windows Mobile Advanced Forensics: An Alternative to Existing Tools by Cpt. Frédérick Rehault from the French National Gendarmerie. The author developed custom boot loaders and file parsing tools to extract the maximum amount of information available from Windows Mobile devices. A small sample of the very detailed output from one customized tool is provided below, showing interpreted fields extracted from a text message in cemail.vol along with the location of associated content in the file system.

[ MESSAGE ] <<<< VISIBLE >>>>

    Message Class : : IPM.SMStext

    Message Flag (1:Read; 0:Unread) : 0x00000028

    Subject : Love you too. Cant wait to see you tomorrow!

    Msg Status : 0x00040000 : SMS

    Delivery Time 2009-05-15 04:53:54

    Sender Email Address : 14435551212

    Sender Name : 14435551212

    Last Modification Date 2009-05-15 04:53:55

    Recipient Info: address & name : t£ lT SMS14105551212Steven…
     
    -- Message Content Location --

    NORMALLY Stored in "\Windows\Messaging\ 453a000a xxxxxxxx.mpb "

The tool also extracts the raw database record as shown here with all of the internal database fields:

*************************************************************

        [ DEBUG ]: Found RECORD HEADER at Offset 0x000b7e9c

[ DEBUG ]: hRecord = 0x00000a47 [ DEBUG ]: hDBHandle = 0x00000060 [ DEBUG ]: DataRecordSize = 0x00b8 [ DEBUG ]: CompDataRecordSize = 0x009e [ DEBUG ]: Nb Props found = 12 [ DEBUG ]: Flag = 0x4000 : Data might be compressed

00000000 45 0a 00 3a a0 00 00 00 0f 00 00 31 28 00 00 00 |E..:.......1(...| 00000010 00 00 b0 25 58 00 4c 00 6f 00 76 00 65 00 20 00 |...%X.L.o.v.e. .| 00000020 79 00 6f 00 75 00 20 00 74 00 6f 00 6f 00 2e 00 |y.o.u. .t.o.o...| 00000030 20 00 43 00 61 00 6e 00 74 00 20 00 77 00 61 00 | .C.a.n.t. .w.a.| 00000040 69 00 74 00 20 00 74 00 6f 00 20 00 73 00 65 00 |i.t. .t.o. .s.e.| 00000050 65 00 20 00 79 00 6f 00 75 00 20 00 74 00 6f 00 |e. .y.o.u. .t.o.| 00000060 6d 00 6f 00 72 00 72 00 6f 00 77 00 21 00 34 00 |m.o.r.r.o.w.!.4.| 00000070 00 00 04 00 00 9d b0 25 19 d5 c9 01 16 00 31 00 |.......%......1.| 00000080 34 00 34 00 33 00 35 00 35 00 35 00 31 00 32 00 |4.4.3.5.5.5.1.2.| 00000090 31 00 32 00 16 00 31 00 34 00 34 00 33 00 35 00 |1.2…1.4.4.3.5.| 000000a0 35 00 35 00 31 00 32 00 31 00 32 00 80 33 49 26 |5.5.1.2.1.2..3I&| 000000b0 19 d5 c9 01 47 0a 00 3b |....G..;|


        + List of properties in record:

        -- PropID[ 0 ] = 0x80050013 UI4 : 0x3a000a45

        -- PropID[ 1 ] = 0x80110013 UI4 : 0x000000a0

        -- PropID[ 2 ] = 0x001a0013 UI4 : 0x3100000f

        -- PropID[ 3 ] = 0x0e070013 UI4 : 0x00000028

        -- PropID[ 4 ] = 0x003d001f LPWSTR :

        -- PropID[ 5 ] = 0x0037001f LPWSTR : Love you too. Cant wait to see you tomorrow!

        -- PropID[ 6 ] = 0x0e170013 UI4 : 0x00040000

        -- PropID[ 7 ] = 0x0e060040 FILETIME 0x1c9d51925b09d00

        -- PropID[ 8 ] = 0x0c1f001f LPWSTR : 14435551212

        -- PropID[ 9 ] = 0x0c1a001f LPWSTR : 14435551212

        -- PropID[ 10 ] = 0x30080040 FILETIME 0x1c9d51926493380

        -- PropID[ 11 ] = 0x80010013 UI4 : 0x3b000a47

cmdLabs covers forensic analysis of Windows Mobile and other mobile devices in the course we develop and teach for SANS (FOR563 – Mobile Device Forensics [http://www.sans.org/security-training/mobile-device-forensics-4896-tid]).

Click here for more information.

Winner of the DFRWS2010 Forensic Challenge Announced

Eoghan Casey — Tue, 08 Nov 2011 15:11:00 GMT

This year Eoghan Casey collaborated with the Netherlands Forensic Institute to create the DFRWS Forensic Challenge in an effort to advance forensic analysis of Flash memory in mobile devices. The winner of the challenge was Solal Jacob who used the open source Digital Forensic Framework, and provides some new modules specifically for parsing memory dumps of Sony Ericsson K800i devices. Complete results are posted on the DFRWS Web site.

The scenario for the DFRWS2010 Forensic Challenge involves an arms dealer named Monsieur Victor (a.k.a. “The General”) who was apprehended in the Netherlands and threw Sony Ericsson K800i in a nearby canal. The Netherlands Forensic Institute acquired data from NAND and NOR chips in the water damaged mobile device using Memory toolkit. The goal of the challenge is to recover leads relating to front companies, bank accounts and cohorts.

The winning submission provides a technical analysis of data structures found in memory dump from a Sony Ericsson K800i mobile device and provides DFF plug-ins that recover wear-leveling tables, enabling a forensic analyst to reconstruct the flash abstraction layer as shown here.

Once the desired state of memory has been reconstructed, the DFF tool can be used to interpret the partition table and file systems on the mobile device as shown here.

The resulting logical view show metadata associated with files and folders, including deleted items.

In addition, digital photographs recovered from mobile device memory can be previewed using the DFF as shown here.

An interesting outcome of the challenge was that several contestants were able to extract substantial amounts of information from the physical memory dumps without understanding the logical arrangement of blocks or the file system. The implication is that, once full physical dumps of NAND and/or NOR memory are obtained from a mobile device, simple text extraction and file carving techniques can provide significant amounts of useful information, including deleted data.

A logical acquisition created using Microsystemation’s XRY mobile device forensic tool is now available to facilitate further development such as interpretation of foreign characters. As an example, the logical view of SMS messages on the device used in the DFRWS2010 Forensic Challenge is shown here.

Click here for more information.

Digital Evidence & Computer Crime, 3rd Edition Released

Eoghan Casey — Tue, 08 Nov 2011 14:47:00 GMT

After six years of work, the expanded and updated third edition of Digital Evidence and Computer Crime: Forensic Science, Computers and the Internet is now complete. The 800 printed pages and one online chapter cover the methods and tools relevant to incident responders, forensic analysts, police and lawyers.

This book is divided into five parts, beginning with the fundamental concepts and legal issues relating to digital evidence and computer crime in Part 1 (Digital Forensics: Chapters 1 – 5). Part 2 of this text (Digital Investigations: Chapters 6 – 9) covers investigative aspects of digital evidence and computer crime. Part 3 of this text (Apprehending Offenders: Chapters 10 – 14) deals with specific types of investigations with a focus on apprehending offenders, including Violent Crime in Chapter 10, Sex Offenders on the Internet in Chapter 12 and Investigating Computer Intrusions in Chapter 13. Part 4 of this book (Computer Forensics: Chapters 15 – 20) begins by introducing basic Forensic Science concepts in the context of a single computer, and goes on to apply these concepts in updated chapters dedicated to networked Windows, Unix, and Macintosh computers and mobile devices. Part 5 (Network Forensics: Chapters 21 – 25) covers computer networks from an investigative perspective, focusing specifically on the Internet and performing forensic analysis on network logs and traffic.

This material provides the foundation for the more advanced companion text, the Handbook of Digital Forensics and Investigation.

Many thanks to Susan Brenner, Christopher Daywalt, Monique Mattei Ferraro, Bert-Jaap Koops, Terrance Maguire, Mike McGrath, Tessa Robinson, Bradley Schatz, Ben Turnbull and Brent Turvey for their excellent contributions to this textbook.
Click here for more information.

Geolocational Log Analysis: Think Globally, Act Locally (with code)

Brian Baskin — Tue, 08 Nov 2011 14:45:00 GMT

In many network environments the administrators and security engineers have an understanding of the full geographical scope and reach of their network. While some corporations have a global audience and expect traffic from the far reaches of the world, others are more localized and target a specific small region.

A health care provider for Alaska would monitor its network connections to ensure that network connections are limited to its main source of users, i.e. those in Alaska. An insurance company in St. Louis will see mostly traffic from IP addresses in Missouri, but Illinois as well, due to the city being on the state line. Occasionally, administrators may notice connections being made from Hawaii, Bermuda, or Italy, signifying users who are on vacation but are still wired in to their work. However, a long-term series of connections from a Eircom subscriber, Ireland’s largest ISP, should spark interest to the network administrator of a Seattle tax firm.

While anonymous web connections from global addresses are common, specific attention should be paid to such addresses being used to access password-protected areas of a corporation. This could include remote file access, VPN and web-based corporate email.

In such cases the logs from these applications, usually supplied in plain text or W3C format, contain details about transactions to include the remote IP address and the account name being authorized. In reviewing logs from various incident responses cmdLabs has found details to show that a short log review made on a daily basis could help smaller corporations determine quickly if a user account was compromised and accessed from a remote location.

For example, the log sample below from a Cisco ASA tracks VPN connections. The user “cmdLabs\bbaskin” was accessed via the IP address of 159.134.100.100 on 2 April, 2011, an IP that was traced back to Ireland. A few hours later the same account was accessed from an IP address in Austria.

Apr 2 21:53:37 192.168.1.1 Apr 02 2011 21: 53:08: %ASA-6-302013: Built outbound TCP connection 7823 for inside:10.10.10.50/389 (10.10.10.50/389) to NP Identity Ifc:192.168.1.1/1047 (192.168.1.1/1047)

    Apr 2 21:53:37 192.168.1.1 Apr 02 2011 21: 53:08: %ASA-6-1

    04: AAA user authentication Successful : server = 10.10.10.50 : user = cmdLabs\bbaskin

    Apr 2 21:53:37 192.168.1.1 Apr 02 2011 21: 53:08: %ASA-6-113009: AAA retrieved default group policy (DfltGrpPolicy) for user = cmdLabs\bbaskin

    Apr 2 21:53:37 192.168.1.1 Apr 02 2011 21: 53:08: %ASA-6-113008: AAA transaction status ACCEPT : user = cmdLabs\bbaskin

    Apr 2 21:53:37 192.168.1.1 Apr 02 2011 21: 53:08: %ASA-6-734001: DAP: User cmdLabs\bbaskin, Addr 159.134.100.100, Connection Clientless: The following DAP records were selected for this connection: DfltAccessPolicy

For this small set of data it is trivial to query each IP address to determine its country of origin, netblock owner, and other details that would highlight unauthorized access. The problem arises when you have hundreds of thousands of such transactions in your daily log files. One service that cmdLabs uses regularly is the IP to ASN WHOIS server run by Team Cymru. This server provides quick and easy access to country codes for a given IP address. However, it has two limitations: it requires Internet-access which is not readily available from a forensic workstation and to process a large bulk of IPs you have to use their Netcat process which only returns ASNs and not country codes. To overcome these limitations I’ve developed a simple solution that could process hundreds of thousands of IP addresses to determine country codes. This solution is a small Python script called IP2CC that takes an IP address as input and outputs the originating country code for that IP. This solution requires three components:

The free country code database located at http://www.maxmind.com/app/geolitecountry (updated monthly)
Python API module to access this database located at http://code.google.com/p/pygeoip/
The IP2CC.py script. Downloadable at the end of this blog post.

The script allows for input to be given via the command line, stdin, or an input file. In normal use it will simply output the country code. With the –c or -t option the output will contain both the IP and country code in either a comma-separated version (CSV) or tab-separated (TSV) output, respectively.

Python ip2cc.py –i  -f  [-c] [-t]
        > python ip2cc.py -i 11.11.11.11

        US
        > python ip2cc.py -i 22.22.22.22 -c

        22.22.22.22,US
        > echo 33.33.33.33 | python ip2cc.py

        US

> python ip2cc.py -f IP.txt -c 14.48.7.101,AU 12.51.21.19,US 10.61.14.9,Internal

In one use, we’ll eliminate known intranet/extranet IP addresses and run the resulting list through IP2CC to produce a master list of foreign accesses. This script will run in Linux and OSX in conjunction with the native OS command line tools. For a Windows environment you will find additional capabilities by installing the necessary GnuWin32 components. For example, when reviewing a NCSA-formatted log with the IP address in the first field:

D:\> type in051611.log | egrep –v “^192” | gawk “{print $1}” | python ip2cc.py -t | egrep –v “US|Internal” | gawk -F\t "{print $1}" | sort | uniq > DailyForeignIPs.txt

        D:\> for /F %i in (DailyForeignIPs.txt) do grep “%i” in051611.log >> DailyForeignConnections.txt

The first command above will save a simple text listing of all unique foreign IP addresses into a file for processing. The second line takes each IP address from that resulting file and compares it back against the logs to extract all lines that include its presence. The resulting DailyForeignConnections.txt can then be quickly reviewed to determine if any accounts were accessed from a foreign IP address.

Dealing with the VPN logs shown earlier, we’ll change our command line a bit. Using the standard Cisco log file index as a source we can see that the log id of 734001 will show us the remote IP address of a user login. We’ll search the log for that id and then parse out the IP address in the 15th field. An additional hindrance is that the IP address is appended with a comma, which we’ll remove with the ‘tr’ command.

D:\> type asavpn-051611.log | findstr "734001" | gawk “$15 !~ /^192/ {print $15}” | tr -d "," | python ip2cc.py –t | egrep –v “US|Internal” | sort | uniq > DailyVPNForeignIPs.txt

This is ultimately just a very simple Python script. In-house, we use it as a mere function within larger processes, but its simplicity allows for it to be used in a variety of result-tuning processes. Customization is easy. At times I’ll make an offshoot of the script to process input from `uniq` command with the `-c` count option occasionally. The `uniq –c` adds a new column that specifies the total number of instances of that IP address which is useful when evaluating the persistence of a single IP amongst thousands. A few small changes to the Python will allow you to read this count and add it to the CSV output for easy integration into a spreadsheet.

Usage of a tool like IP2CC is a first step to opening an administrators eyes to traffic beyond their network. A good administrator or security engineer should monitor not only the traffic that flows across their network but also the perceived traffic that flows from a network’s outer nodes to the Internet. Monitoring for your company’s existence in spam black-lists, a malware rating on services like Web of Trust, and other indicators can give clues that an infection or intrusion may be underway within your network. We’ll discuss these points, and others, in a future blog post.

Downloads:

IP2CC Python Source Code v1.0 [ip2cc.zip]

Click here for more information.

Deeply Embedded Metadata

Mon, 01 Jan 0001 00:00:00 GMT

Click here for more information.