Category Archives: Information Security

Information security topics

Bills of the 85th session

Now that the 85th Texas legislative session is over, here is a list of the cybersecurity and privacy bill that made it through.  For the complete list of the bills I tracked this session, click here.

House Bills

Bill Author Caption Stage Notes
HB8 Capriglione Relating to cybersecurity for state agency information resources. Effective 9/1/2017 A significant bill affecting multiple agencies. Requires all security incidents to be report to the Department of Information Resources (DIR) within 48 hours of detection. Also includes a provision for the Sunset Commission to include cybersecurity in their review of state agencies. Additionally directs DIR to conduct exercises and to address duplication of efforts within state agencies. Well worth reading the full bill.
HB9 Capriglione Relating to cybercrime ; creating criminal offenses. Effective 9/1/2017 Amends the Penal Code to include criminal offenses for malware and ransomware, among other cybercrimes.
HB1278 Dutton Relating to availability of Previous personal information of certain current and former prosecutors. Effective immediately Excepts the personal information of district attorneys, criminal district attorneys and municipal attorneys from public disclosure.
HB1861 Elkins Relating to the confidentiality of certain information related to a computer security incident. Effective immediately Adds a provision to §552 (public information act) that excepts information related to security incident information.
HB2087 VanDeaver Relating to restricting the use of covered information, including student personally identifiable information, by an operator of a website, online service, online application, or mobile application for a school purpose. Effective 9/1/2017 An interesting bill targeted at restricting the use of student’s profiles gathered by online services. As many of these services are nationwide, it would be interesting to see this bill in action

Senate Bills

Bill Author Caption Stage Notes
SB42 Zaffirni Relating to the security of courts and judges in the state. Effective on 9/1/17 Excepts disclosure of personal information of judges and their spouses from disclosure.
SB179 Menéndez Relating to student harassment, bullying, cyberbullying, injury to or death of a minor; creating a criminal offense. Effective on 9/1/17 David’s Law
SB532 Nelson Relating to reports on and purchase of information technology by state agencies. Effective on 9/1/17 One to keep an eye on. The bill directs agencies to provide information to the Department of Information Resources about their security programs and risks. DIR must provide a public analysis of the risks and plans.  Also has some language about cloud computing and state agencies.
SB564 Campbell Relating to the applicability of open meetings requirements to certain meetings of a governing body relating to information technology security practices. Effective on 9/1/17 Expands (currently only applies to the Department of Information Resources) an exception to open meetings requirements to allow for closed meetings of governmental bodies to discuss security assessments, network security information, or other security issues.
SB705 Birdwell Relating to an exception from disclosure under the public information law for certain personal information of an applicant for an appointment by the governor. Effective immediately Excepts the personal contact information of persons applying for appointment by the governor or the senate from public disclosure under the PIA.
SB843 Perry Relating to disclosure and use of certain information regarding the Crime Victims’ Compensation Act. Effective on 9/1/17 Prohibits the release of applications for compensation
SB1910 Zaffirini Relating to state agency information security plans, information technology employees, and online and mobile applications. Effective on 9/1/17  Requires each state agency to submit a security plan to the DIR.  Also calls out that if an agency has a CISO, that CISO should report outside of the IT department!!! 🙂

We have to do better: Pacemaker security

Last week Billy Rios and Jonathan Butts published a research on the security of pacemakers.  In all they identified over 8000 vulnerabilities in third-party components within the subsystems of 4 major vendors’ physician programming and home monitoring devices.

These vulnerabilities exist primarily because vendors are able to cut development time by using commonly available libraries.  While the libraries may be considered secure when initially deployed, over time new vulnerabilities are discovered.  Unfortunately the patches for these vulnerabilities are not uniformly applied.

This is a common problem with embedded devices, internet-of-things things, and industrial control systems.  The use of public libraries makes sense to get a product to market, but many vendors don’t account for the update and patch process.

Additionally, as I’ve written about before, many vendors still use hardcoded or backdoor passwords.  The researches have been able to verify hardcoded credentials in three of the four devices tested.

We have to demand better from the vendors selling critical information technology, whether it is an industrial control system or medical equipment.  Simple vulnerabilities like insecure libraries, the inability to patch, and hardcoded credentials must be addressed by vendors.

Grasping blockchain, it’s more than just bitcoin

OK, OK, I said I wouldn’t mention the “ransomware that shall not be named” again, but…

With all the focus on how people are supposed to pay to have their files decrypted, a lot of people have been asking about bitcoin.  There are many types of cryptocurrency, bitcoin is simply one of them.  Each cryptocurrency, though, relies on a technology called “blockchain.”

Blockchain, in turn, is much larger than cryptocurrency.  It is really a technology that can help track real estate ownership, transfer of tangible property, contracts,  and other agreements.

Now, I’m not going to get into the nitty-gritty.  There are a bunch of articles, books, websites, and YouTube videos that can explain the cryptography and protocols underlying blockchain.  What I would like to do is give a very high explanation of blockchain.  So, from 40,000 feet:

  1. Someone wants to transfer something to someone else (bitcoin, property, contract)
  2. That person creates a transaction with the other party.
  3. The transaction is grouped with other transactions to create a “block”
  4. The block is transferred to nodes responsible for validating the block (miners)
  5. Once the block is validated, it is added to the blockchain

The blockchain is  then autonomously distributed to a peer-to-peer network.  In effect blockchain is a widely distributed write-only ledger, so blocks cannot be altered without the entire network becoming aware of the modification.  This transparency adds to the technology’s security.

For an idea of where blockchain could be headed, check out an article I co-wrote for the e-commerce times.

DocuSign breach leads to more effective phishing

While the world was focused on WannaCry (I promise that’s the only time I’ll mention it), a significant security issue seems to have slipped through the cracks.

DocuSign, is an application to digitally sign business documents like real estate loans, business contracts, statements of work, etc.  OK, I think we’ve already established that I tend to be more paranoid than most folks.  I don’t trust many online applications, especially for important things like loans and contracts.  But I’ve used DocuSign many times in the past and found it to be a very convenient tool for reviewing and signing documents while mobile.

Unfortunately DocuSign had a breach last week that exposed the email addresses of users.  That combined with the attackers access to a DocuSign server enabled the attackers to send very, very realistic phishing emails to real DocuSign users.

Let me make this clear:  at this point there is no indication from DocuSign that any information beyond users’ email addresses was exposed.

The phishing scam asked users to open a Word document with malicious code.  Now DocuSign does not ask users to open files within an email (they are notified to sign into the site to sign), but many didn’t suspect any nefarious business.

If you are a DocuSign user, be on the lookout.  More phishing messages are likely.  If you get an email to sign a document, don’t click the link.  Sign into the DocuSign site to sign any documents.