Archive for Vulnerability Analysis

Another Oops for Cloud Services – InfluxDB Halts Service in Belgium/Sydney with Insufficient Customer Notice

In the latest example of “If you don’t own the server you don’t own the data” cloud events, InfluxData recently closed operations in their Belgium and Sydney locations, with apparently woefully inadequate customer notification and follow up. In both instances, users were apparently notified only via email and via the InfluxDB documentation or status website.  The hows and whys are a little fuzzy, but suffice to say that InfluxData management made some very unusual decisions to turn off services and delete customer data… with what is overwhelmingly being called “insufficient notice”.   It appears that this event may have cost InfluxData some customers, or new customers at least, as they try to dig out from under this fiasco.

In fairness, they did provide notification via their cloud status page, but who looks at that unless there’s an outage or service degradation?   You can follow the thread here if you want to see the drama unfold: https://community.influxdata.com/t/getting-weird-results-from-gcp-europe-west1/30615/19

 

While we are not aware of any security product that uses InfluxDB for it’s cloud database, there are plenty of examples of video and access control products that use cloud based database instances or other cloud dependent services.  InfluxData uses Google, Azure, and AWS for it’s hosting services, so this wasn’t a case of a company that suffered a catastrophic site failure or financial bankruptcy issue.  This was more likely a financial issue to discontinue services for poor performing areas and focus on better areas.  It certainly was well within InfluxData’s rights to do so too, but apparently could’ve been communicated much better.  Further, there was no attempt to migrate the user’s data to another region, or even provide backups of the data for user’s to migrate themselves.

Responses from user’s on the support page was scathing, if not somewhat in disbelief too:

Users from the Sydney region weren’t so lucky, as apparently there were no measures taken to be able to restore their data:

All of this is just to say that thousands of business run on cloud services every day, and many of them probably have no idea about what their hosting provider’s service level guarantee or disruption notification policies are.   Further, just because your cloud service guarantee they are backing up your data doesn’t mean you shouldn’t be backing it up also… to your own storage.. that you own.    If you must use security software in the cloud and store your data there, have a business continuity plan that includes your cloud provider services and the recovery of the data that is stored there.

Now repeat after me, “If you don’t own the server, you don’t own the data”…

 

 

Posted in: Cloud Services, Security Technology, Vulnerability Analysis

Leave a Comment (0) →

The Importance of Security Consultants in Designing Effective Security Systems

In an ever-evolving world with increasing security concerns, it has become imperative for businesses and organizations to prioritize the implementation of robust security systems. However, choosing the right approach and ensuring an effective security setup is not always straightforward.  A renewed trend that was prevalent a couple of decades ago was for integrators to offer “consulting and design services’.   Often, businesses rely on security integrators to design and install their security systems, and for certain size projects that makes sense.  Why hire an outside consultant to design a small retrofit project?    While security integrators play a crucial role, there are significant benefits to involving a security consultant in the design process. In this article, we will explore the virtues of using a security consultant and highlight examples of where security installers have fallen short or encountered conflicts of interest.

  1. Unbiased Expertise: A security consultant brings a unique perspective and unbiased expertise to the table. Unlike security integrators who are often affiliated with specific brands or manufacturers, security consultants have a broader understanding of the security landscape and can offer impartial advice. Their experience in assessing risks and designing comprehensive security strategies ensures that the resulting system is tailored to the specific needs of the organization.   We don’t sell or install anything, and thus have no particular preference for what products the client may choose to consider for their project.  That doesn’t mean we won’t make recommendations about their requested choices (see our past articles about our strong feelings on putting corporate security data in the cloud or using NDAA banned products).  The short version:  if your consultant receives remuneration from a manufacturer or vendor for the products they specify, find another consultant.
  2. Conflict of Interest: One of the key concerns when relying solely on security integrators is the potential for conflicts of interest.  Integrators may be motivated to prioritize their own profit margins or partner relationships over the best interests of the client. This can lead to compromised system designs, subpar equipment selection, or inadequate coverage.   You may be sold a particular brand or product line because there is a sales goal incentive being pushed by management or the manufacturer.   Worse, it is not uncommon for integrators to unload poor selling product or superseded parts in order to clean up their inventory.   This is fine if the client is aware and accepts the product (presumably for a discount), but sometimes it is done without their knowledge.  By involving a security consultant, businesses can mitigate these conflicts and ensure that their security system is designed with their unique requirements in mind.
  3. Prevent Poor Project Management:  Integrators will often bake in “project management” and “system check out” line item fees in their proposals, claiming to offer project management and punch list services for their own installation phase.   This is very much like having the fox watch the hen-house.  In one recent case, we saw a project where a vendor substituted the installed camera
    Poor project management and no punch list results in poor installations.

    Poor project management and no punch list results in poor installations.

    models with inferior (cheaper) models AFTER they received the bid award and purchase order.   The client didn’t catch it, but we did during project field inspections.   Never let the integrator perform their own punch list and acceptance testing.

  4. Post Installation Documentation:   Trying to get as-built documentation is often another problem.   While almost nobody likes doing as-built drawings, their value should never be underestimated.  Ask anyone who has done a retrofit project without them.  If the client does not hold back a percentage of payment until all punch list items are complete and all as-built documentation is submitted, then the likelihood of that work ever being done without further consideration can be very low.  Too, often the integrator will simply take the original design drawings and update them slightly (or not at all) and turn them in as the as-built documentation.  That is insufficient.  Good as-built documents include the original equipment list (mfr/model, qty, serial #s, IP addresses, power, etc) and locations, riser diagrams, installation details, as well as the point-to-point wiring and configuration details for every piece of installed equipment.   If the vendor uses a tool like System Surveyor or Fieldwire, ask for the full report to be printed to PDF and included in the as-built documentation.  (You may also want to request they delete the data being stored on the cloud if your organization has data retention policies that concern this situation).
  5. Comprehensive Risk Assessment: Security consultants conduct thorough risk assessments to identify potential vulnerabilities and areas of concern. This includes evaluating physical vulnerabilities, assessing technological risks, and analyzing procedural weaknesses. By considering these factors during the design phase, consultants can develop an integrated security system that addresses identified risks, ultimately providing greater protection against potential threats.  This may include out-of-scope items that may not be viable under the current project funding, but can be provided to the client so the cost can be projected under future budgets or other projects which can resolve the issue.
  6. Future-Proofing: Security systems should be adaptable and scalable to meet evolving security requirements. Integrators might focus solely on immediate needs, potentially overlooking future expansion or technological advancements that may be outside the scope of their work or capabilities.  Security consultants, however, take a holistic approach by considering the long-term goals and growth plans of the organization. This ensures that the security system is flexible and can accommodate future upgrades or changes without significant disruptions or additional costs.

While security definitely integrators play a critical role in the installation of security systems, involving a security consultant during the design and project management phases offers numerous advantages. Their unbiased expertise, ability to identify vulnerabilities, and focus on long-term planning can significantly enhance the effectiveness of a security system. By avoiding conflicts of interest and addressing potential pitfalls, businesses can ensure a comprehensive and robust security solution tailored to their specific needs.

Remember, investing in the services of a security consultant is an investment in the long-term safety and security of your organization. Don’t leave the design of your security system to chance—seek the guidance of an expert to achieve the peace of mind you deserve.

Posted in: Access Control, CPTED, Premises Liability, Security Consulting, Security Technology, Vulnerability Analysis

Leave a Comment (0) →

Vatican’s Security Dilemma: Dahua Cameras and the Potential Risks

The Vatican City, the spiritual and administrative headquarters of the Roman Catholic Church, is an iconic destination visited by millions of tourists and worshipers each year. With its priceless artworks, historic buildings, and religious significance, protecting the Vatican’s security is of paramount importance. During a recent tour, we noted that the Vatican has implemented a security system featuring Dahua cameras, a leading Chinese manufacturer, for their VMS platform. However, the adoption of Dahua cameras has raised concerns regarding potential security risks. In this article, we explore the utilization of Dahua cameras in the Vatican and the associated challenges.

A Dahua PTZ camera installed on the exterior wall of the Vatican City.

A Dahua PTZ camera installed on the exterior wall of the Vatican City.

Dahua Cameras: Advanced Surveillance Technology

Dahua Technology is a well-known Chinese company specializing in the production of surveillance equipment, including security cameras, recorders, and software. Their products are widely used around the world, known for their affordability. Dahua cameras incorporate cutting-edge technologies like facial recognition, high-resolution imaging, and intelligent analytics, enabling comprehensive monitoring and analysis of security footage.

The Vatican’s Decision to Deploy Dahua Cameras

Given the Vatican’s stature as a symbolic and historical landmark, ensuring security is a complex undertaking. In an effort to enhance their surveillance capabilities, the Vatican opted to implement Dahua cameras in various locations, including public areas, museums, and the St. Peter’s Square. The decision to deploy Dahua cameras was likely driven by their advanced features, wide product range, and competitive pricing (The only other dominant international CCTV brand evident around Rome was Avigilon).

Security Risks Associated with Dahua Cameras

The following are at least some of the obvious identified risks associated with the Vatican’s choice to deploy Dahua hardware:

  1. Data Security Concerns: One of the major concerns with the use of Dahua cameras is the potential for data breaches and unauthorized access. There have been reports suggesting that Dahua cameras may have security vulnerabilities (perhaps government sponsored or otherwise) that could be exploited by malicious actors.  Any vulnerabilities in the software or firmware of the camera system could potentially expose sensitive footage and compromise the safety of the Vatican and its visitors.  There are many examples of previous breaches easily found on the internet to demonstrate the potential damage for this kind of exposure.
  2. Surveillance Backdoors: There have been allegations that certain Chinese-made surveillance equipment, including Dahua cameras, may have built-in “backdoors.” These backdoors could potentially allow unauthorized access or remote control of the cameras, leading to a breach of privacy and security. Although Dahua has addressed some of these concerns by releasing firmware updates, the risk remains a significant consideration and there is some uncertainty in the industry if ALL of the backdoors have actually been removed.
  3. Geopolitical Implications: The utilization of Chinese-made surveillance technology raises geopolitical concerns. The Vatican’s decision to rely on Dahua cameras might inadvertently involve the Vatican in geopolitical controversies, considering the Chinese government’s influence over its technology companies. This situation could have diplomatic implications and potentially impact the Vatican’s relationship with other countries.  While the Vatican is a sovereign country and is not subject to the US NDAA as some  entities may be in this country, there well may be implications and consequences in foreign relations with NATO or EU countries that do have these types of protective legislative measures in place.
  4. Installation methods:  During our tour of the Vatican interior we noted that the cameras were installed using surface mount brackets and then plugged into a CAT5 jack located near the
    Interior Dahua camera plugged into data jack noted during tour of Vatican

    Interior Dahua camera plugged into data jack noted during tour of Vatican

    camera location.  In at least two cases, it would have been trivial for a (tall) person to simply unplug the camera from the jack or even cut the category cable to disable the camera.

Mitigating the Risks

So what should the Vatican do, if anything, to mitigate the risks of having Chinese government backed security equipment with history of known flaws in the firmware and architecture?  Given the resources available to the Vatican, our recommendation would be to hire a professional consulting firm to do a risk assessment on the installed VMS platform and recommend a replacement with a brand manufactured by a reputable company with a good performance record and advanced features needed by a prestigious venue such as the Vatican.   Short of that, other additional measures that should be considered are as follows:

  1. Rigorous Cybersecurity Measures: The Vatican should implement robust cybersecurity protocols, including regular firmware updates, network segregation, and encryption. Conducting regular security audits and penetration testing can help identify and address vulnerabilities promptly.  All security cameras should be on a separate physical network or VLAN that is not routable to the internet, with network intrusion detection systems IDS features implemented on the network switches and routers.
  2. Diversification of Suppliers: The Vatican could explore diversifying its camera suppliers to reduce the risks associated with dependence on a single manufacturer. Adopting a multi-vendor approach would provide more options and potentially enhance security by selecting cameras from different sources.  This can have implications itself in terms of spare parts inventory, and camera configuration and firmware management headaches by having multiple vendors with multiple models.  Using a major brand manufacturer such as Axis, Hanwha, Avigilon, or Bosch would ensure there are enterprise class tools available to manage these aspects.
  3. Enhanced Collaboration: Collaborating with cybersecurity experts, both internally and externally, would help the Vatican stay informed about potential threats and implement appropriate countermeasures. Engaging with experts in the field can ensure the continuous monitoring and evaluation of the security system.
  4. Installation Standards:  The Vatican should develop and apply security equipment and installation standards that should be implemented for all existing and new security devices.  All devices should be vandal resistant where possible, and all cabling should be protected in conduit or other protected raceway to prevent vandalism or sabotage.  Camera devices should have a minimum mounting height and standard for field of view and focal length based upon the objective and purpose.   Advanced analytic methods should be implemented for object detection and classification, facial recognition, license plate recognition, and other intelligent video analytic technologies such as people counting, loitering, object removal, object identification, line crossing, etc.

Conclusion

The Vatican’s decision to adopt Dahua cameras reflects its commitment to improving security and safeguarding its treasures. However, it is important to acknowledge the potential security risks associated with using this technology. The Vatican should diligently address these risks by implementing robust cybersecurity measures, considering alternative suppliers, and maintaining an ongoing dialogue with cybersecurity experts. By doing so, the Vatican can strive to strike a balance between utilizing advanced surveillance technology and mitigating potential security vulnerabilities, ensuring the protection of its spiritual and historical significance for generations to come.

Posted in: CPTED, IP Video, New Equipment and Gadgets, Premises Liability, Security Technology, Vulnerability Analysis

Leave a Comment (0) →

Playing Around with the PinPoint Survey Application using Amazon Data

We put together a quick demo of the PinPoint Survey Application using some public data scraped from the web for all the US Amazon sites.  The equipment names and photos are all generated, so don’t get too excited about thinking there are real Amazon security equipment details being posted on the web.

Some of the reporting features are turned off, but the overall objective was to show off the speed and utility of the site data and geospatial mapping capabilities for relating sites and equipment within those sites.

Using the application from a tablet, you can use the built-in GPS to map the device lat/lon data to the database, along with any photos, notes, and punch list information that might be relevant.  This is particularly useful for large external sites like ports, refineries, mines/quarries, or power generation/transmission facilities.

GIF Movie of PinPoint Survey Application using demonstration data for Amazon sites

PinPoint Survey Application Short Demo

Posted in: Access Control, Application Development, CPTED, Premises Liability, PSIM, Security Consulting, Security Technology, Vulnerability Analysis

Leave a Comment (0) →

Hacking Sony – Corporate culture broken from the top down

One of the questions I keep asking myself as I keep reading the dozens of recent articles about how Sony got hacked by “North Korea” is, why does Image left on screens for 2014 Sony HackSony KEEP getting hacked?

The short answer is “because they can”.  But the longer answer points to a corporate culture that doesn’t understand the need for protection of information assets, or the people who are constantly after those assets.

On November 24, Sony discovered that its corporate network had been hacked. The attackers took terabytes of data, deleted the original copies from Sony computers, and left messages threatening to release the information if Sony didn’t comply with the attackers’ demands.  But it was really much worse, not only was work disrupted as Sony’s IT professionals scrambled to recover lost data and restore data services, much of the proprietary information of Sony Corp. was released into the public domain for everyone to see.  Unreleased movies, private email conversations, celebrity contact information, social security numbers, passwords, and salary information were released into the wild.  The damage will be felt for years to come.

I’m uncertain of the actual number of cyber attacks on Sony (and only Sony knows the real number), but this latest attack has to put it somewhere in the high teens.  This attack was the latest of a string of attacks that has been happening since 2003, mostly related to Sony’s DRM policies and certain lawsuits over “hacking” the Sony PS3 platform.  At least, that’s where I think it all began.  Since then, it’s become the “hip” thing to do for black  hats, Hack Sony.  The notion that North Korea is behind this latest attack as claimed seems pretty thin to us, and also to the FBI in their official statements so far.

But what really is the cause of this?  From what I have read, it looks like it stems from a top down culture of a lack of respect for information security.   Their IT security department is woefully thin, understaffed for a company of Sony’s stature, security equipment and software was not properly installed, policies not enforced, and even simple things like compartmentalization of data, like keeping performer contracts or salary information separate from other data sources, were apparently not properly implemented.   This seems odd, since much of the technology Sony has developed (or bought) for DRM and copyright protection is fairly sophisticated, and expensive to develop.

Skipping the technical aspects of what Sony should have done or should now do to protect itself from cyber security, I will just propose in simple layman’s terms what a company in Sony’s position should consider across their corporate footprint.

  1. A top down philosophy of information security starting with corporate officers.
  2. Increased IT security staff and technology solutions to better identify, insulate and protect from cyber threats.
  3. Corporate wide training in information security, compartmentalization, best practices for data security and user authentication.
  4. Mandatory periodic password audits for all personnel (no Prima donnas who can’t remember a password).
  5. Two step authentication for most or all access, especially to sensitive information repositories.
  6. Regular security audits for physical and IT security.
  7. Personnel background checks, exit interviews with binding nondisclosure agreements.
  8. Active content filtering for incoming and outgoing internet traffic, strict VPN use for remote sites, and GEO IP security filtering at the desktop level.
  9. Active enforcement of corporate policies and legal prosecution for data breach events by employees or contractors.

Meanwhile, the media will be poring over mountains of sensitive information they shouldn’t have, hoping to find the next juicy bit of “Sony Dirt” to release in it’s next news cycle.

 

 

Posted in: Security Technology, Vulnerability Analysis

Leave a Comment (0) →