Thursday, 16 June 2011
PDCA is Dead

I have to admit that I have never really understood the PDCA concept as it applies to information security.  I do know that PDCA stands for Plan-Do-Check-Act, but I have never understood the difference between Do and Act, other than there is a Check step in between.  Also, I can never remember which way the wheel goes, clockwise or counter-clockwise!

It seems like PDCA is from another era, when security improvements could be regularly scheduled on an annual basis; time moved more slowly then.  Now we have new types of threats on a monthly basis, or even weekly basis.  We need to respond to these quickly, no matter what phase of PDCA we happen to be in at that time.


I am a big believer in continuous improvement, which I call pdca.  Continuous improvement in this case refers to progress made on a daily basis and documented monthly or quarterly.  This pdca is part of lean management, kaizen, etc.  Unless security is managed on this basis, it will slowly degrade, until the next annual audit.


A recent article in the May, 2011 Harvard Business Review discusses these concepts in the context of motivating people.  The connection to security is that fundamentally security is about people and motivating them to do the right thing.  The article is “The Power of Small Wins”, by Teresa Amabile and Steven Kramer.  The article presents their research, illustrating that employees are best motivated when they are able to make continuous progress in their work.  This might seem obvious, but contrast with what managers think is the number one motivator:  “recognition for good work”. 


In short, pcda is critical to information security for two reasons:  keeping up with changing threats and helping to motivate security staff, IT staff and end users to do the right thing.

Posted on 06/16/2011 10:37 AM by Frederick Scholl
Tuesday, 14 June 2011

I tend to read any legal cases about information security, because they are one source where accurate root cause information on breaches can be found.  Two very interesting decisions on security at banks were recently published.  One is the May 27 US District Court decision on Patco v. People’s United Bank.  An even more recent decision is Experi-Metal v. Comerica Bank, June 13, US District Court.  Both cases involve online transactions with large sums being fraudulently transferred out of business accounts and to Eastern Europe.  Unfortunately, these cases are not uncommon.  The first one I became aware of was Joe Lopez v. Bank of America; Lopez lost $90,000 back in 2004 in a wire transfer to Eastern Europe.  Last year my neighbor’s business lost over $300,000!  In this case, the funds were recovered through timely efforts of the FBI and their counterparts in Latvia.

These and many of the recently reported security breaches are caused by basic operational security problems, not super high tech exploits.  The vast majority of breaches are also perpetrated on firms that have had multiple breaches.  In other words those businesses are not learning from past simple mistakes.  In this post, I look at these two recent legal decisions and what we can now learn from the mistakes of the banks.  In another post, I will look at what we can learn from the mistakes of the banks’ clients.

In reviewing the courts’ decisions, the common factor is that neither bank had suitable fraud detection monitoring controls in place.  Both violated one of the basic principles of security:  monitoring.  Today, all security controls can be hacked…..the only way to control breaches is constant vigilance and the ability to react quickly.

In Patco v. People’s case, $588,851 was transferred out of Patco’s business account to unknown entities.  Someone had captured Patco’s bank log in information, either through a keystroke logger, man in the middle attack or other means, not identified in the proceedings.  Patco sued the bank to recover the funds. 

In the Patco case, the Bank prevailed in Summary Judgment.  This decision turned on what it had promised to Patco and the legal interpretation of that contract under the Uniform Commercial Code. 

But even more interesting is how the bank might have protected itself, its customer and its reputation.  The bank did have fraud detection software in place.  The criminals had used a computer not owned by Patco to log in and transfer funds.  The risk score recorded by the bank was 790 for these transactions.  The transaction was noted in real time by the risk scoring system to be from a “very high risk non-authenticated device”.  Log files of transaction risk scores subsequently showed that the highest previously recorded score was 214.  In other words the bank was able to detect that the fraudulent transactions had a risk score 300% higher than its previous maximum, but no one was watching!

This is one of the most common contributing factors to security breaches:  no monitoring.  Putting in place complex technical or administrative security controls does not work, unless those controls are monitored!  At this point, we have to assume that all controls can be breached given high enough incentives.  Therefore monitoring and incident response processes become essential to minimize potential losses.

PostScript on this case:  After the breach, United Bank is now reporting that it is monitoring the risk scores for ACH transactions!


The facts in the Comerica case were similar.  In this case $1.9M was transferred out of Experi-Metal accounts after the criminal used a phishing attack to gain the log on credentials.  The 93 transfers were done in a matter of hours out of Experi-Metals Employee Savings Account, which regularly had a zero balance!  The judge also noted in his decision that Experi-Metal had limited prior wire activity and that Comerica was aware of phishing attacks just prior to the fraudulent activity.  His conclusion was that Comerica had not acted in “good faith” as required under the UCC and therefore is responsible for the outstanding $560,000 that was not recovered.

Unfortunately, security monitoring is often left to the last in implementing controls.  The best approach is to establish first what information executive management needs to see, and then work backward to establish how that information will be collected.

Posted on 06/14/2011 1:48 PM by Frederick Scholl