Catalyst EU and the Global Perspective on Information Security
Blogger: Dan Blum
Bringing together a diverse, multinational group of IT experts Burton Group’s European Catalyst conference illuminated a number of global IT security issues. As my plane lifts off into the sky above the coast of Barcelona, many still reverberate, concerning compliance, security and authentication.
The Unlikely Complexity of Log Management
One of our most intense speakers – Jay Leeks of Nokia – spoke on log management. At first blush this does not seem to be a topic of great architectural and legal complexity, but as Jay leads you through his global log management project learnings, an intricate landscape is revealed. For in the global company logs are much more than the drainage pipes of IT; they are repositories of much significance to multi-jurisdictional privacy, evidentiary and management functionality.
In Finland where Nokia has its headquarters, sender IP addresses in the headers of emails are considered private information. Inside the envelope of a company email envelope, the employee still has some privacy rights in many jurisdictions, though generally not in the United States. Likewise there is variance in retention requirements, with some countries demanding certain information items be retained, but others demanding they be destroyed after a period of time. Scope of regulatory jurisdiction is often unclear; it may cover information that is stored in the country, information about citizens of that country wherever it may be stored, or both. Nokia’s global log architecture is decentralized to allow for flexibility in what is stored, and where and how it is managed; but information can still be aggregated or searched centrally for enterprise-wide reporting purposes.
Nokia’s lawyers have said the full brunt of regulatory duress falls only on the raw log data, not on the ephemeral and normalized representations constructed later by security event and information management (SEIM) systems. Yet raw log data cannot be arbitrarily disposed of like so much sewage, for we know that only well-preserved original logs collected during the normal course of business are admissible in court proceedings.
No Fees? No Worries.
Though the U.S. may still be one of the more benign environments for managing your logs, it has become a harsh and unforgiving environment for credit card processors – especially those who experience a breach (or just run afoul of their Payment Card Industry (PCI) auditor). Yet Europe remains relatively indifferent to the apparently urgent topic of PCI Data Security Standard (DSS) compliance.
To see why this is, one need only follow the money. After the TJX breach, the credit card companies began raising the fees of credit card processors who cannot satisfy their PCI auditors. A 1% increase in an organization’s credit card fees can cost millions or billions of dollars or euros – enough to justify many, many security countermeasures to avoid the fee. But the higher fees fall only on processors in the U.S. and generally not in Europe.
What is the difference? A Ponemon, White and Case survey found that 94% of European companies reported (confidentially) that they had experienced a breach in the past three years, compared with only 86% of U.S. companies. But whereas the U.S. has a free-wheeling market for instant consumer credit and makes heavy use of card-not-present transactions over the phone and over the Internet, use of credit is much more restrained in Europe. Also, European companies have tight use restrictions on personal data and perform much less data collection due to stronger privacy regulations in the EU.
Just as Windows used to be an environment (unintentionally) designed for computer viruses, the U.S. consumer market still seems to be an environment that could have been designed expressly for identity theft. How far will the country go? During the baseball playoffs, Visa was running commercial showing how easy and convenient credit cards are becoming and making cash transactions look like discordant anachronisms at the checkout line. It would be interesting to know if similar ads are running in Europe, and whether Europe will ever follow the lure of easy credit as far as the U.S. has. According to Ponemon, if they do so without adding more of the U.S.-style controls, they'll suffer an even worse outbreak of ID theft…
Even before that point, European complacency over PCI may not last, as the EU is mulling its own breach notification requirements. If these become law, we shall soon learn whether or not the Ponemon survey is accurate. For our part, Burton Group suspects security weaknesses are universal.
