Blog

Drafting Policies for Fun

Not many people think writing policy is fun. Or procedures. Or standards. Or any documentation, really. But policy and documentation can be fun, and more importantly, if done well, contributes directly to the security and safety of the organization, so it’s worth spending time on.

OK, but how can it possibly be fun? Because when you understand what you’re building, how it is like a set of block like toys that click together to create a structure capable of supporting an entire company, then it’s more like a puzzle. And if you don’t like puzzles, anything around the legal industry is probably not for you, and you should get someone else to do it for you. Like Liticode *cough*.

Policy, and all documentation, really, is a support structure. And just like any support structure, requires engineering. Wordsmithing, not metalsmithing, but still, craft that requires study. If you throw something together without adequate understanding and skill, you end up with more problems than before you made the policy. Like a bad bridge, it will collapse at the worst possible time, probably taking careers with it.

A more visually correct representation is a house of cards, because we’re dealing with documents, and most of them are flimsy things that collapse under the faintest pressure.  But we’re going to fix that problem by building using better cards.  Cards made of reinforced concrete and steel, architected not cobbled together.

Policy is the roof. Why not the foundation? Because policy is the first line of defense. It’s what takes the first hits when you’re under attack by hostile lawyers or other nefarious entities, including your own personnel who just want to do things differently. Policy is the shield from stuff falling on the business.

The walls are the procedures and standards that support the policy. Can’t have a policy without process and standards, or it’s a useless policy. For example, if you have a policy that says no personal use of company assets, but you don’t have a process to detect it, or a standard of configuration for the business computers being used, your policy is going to be impossible to support.

So what’s the foundation? That is your charters, bylaws, explanatory documentation, authorities, and anything else that doesn’t count as part of the super structure.  A simplistic example is the criminal laws against theft.  They aren’t part of your policy or your procedures, but they provide the cause that your HR termination policy uses to support a dismissal.  You rely on them, just like you rely on manufacturer’s documentation, government standards, industry standards, and job descriptions, to direct the business.

So, just like building a complex house of cards, your policy in one area might be the foundation in another layer. The procedures of one layer are the foundation of another. The point to internalize being that all these documents are a) tangible, meaning they exist and you can put your hands on them to produce in court, and b) fit together like a puzzle, reinforcing and supporting each other, so that removing one piece in the bottom layer doesn’t cause the entire thing to collapse.  That last part is important.  They interlock and reinforce each other.

Which brings up the other fun part of the policy game. Who has ever performed a red team analysis of policy? Nobody, other than Liticode. We’re the only company that will look at your documentation and game it with our legal teams and provide you a risk analysis of your policy structure and documentation. And that’s just as important as your penetration testing of your network. The evil hackers might get your database, but the lawsuits that come after are what’s going to destroy the company and careers. We help you prepare with our policy analysis, but we want you first and foremost to have people that grasp the concept of the policy structure and how it is critical to your corporate defense.  Defense in depth includes the legal activities side.  Most (all?) risk assessments simplistically check off boxes indicating policy is present, but don’t evaluate the content.  That will get you blindsided, and we can help avoid that.

So enjoy building policy. Call us if you’re short handed or want an additional set of eyes. Call us later if you want to test it and see if you have any unexplored risks in your structure. Our staff has the skill and experience to turn your house of cards into a fortress.

Security, Cycles, and Management

Organizations frequently have some sort of cyclical systems improvement program in place, yet when we assist with incident response,  we routinely see gaps where different departments have isolated some or all of their systems from the overall picture.

Big picture thinking and management is difficult, so it is easy for these lapses in judgement to creep in. But without a unified systems view of the organization, it is impossible to properly manage risk, and at some point that will create a problem. For example, the IT department may have air-tight policy and practices, but if HR is letting the business hire criminals, those policies won’t matter.

Every department and all business aspects are tied together. The business is a unit, it is not silo’s of independent compliance. That’s why we have the “unified scorecard” approach.  So when we see compliance programs that assign responsibility downward, we know where to start looking for gaps. All the process improvement in the world won’t help if you don’t have a unified model and consistent performance across the business. We like to engage with clients and help them knit together a unified program so that they are better protected and fully risk aware. Nobody wants to find a blind spot hiding in plain site. Our development of management models to provide this unified front is what helps our clients avoid surprises, so they can go about their business without needing our incident response services.

Cycles, frameworks, metrics, scorecards, visibility.  These are things that keep an organization healthy and incident free.  No matter which approach you take, make sure its unified.

If you want to stop having unmitigated incidents, call us for a free evaluation.  We want to help your business be incident free.

Enterprise Architecture

The concept of architecture, building systems in a rational manner for long term consideration with a complete picture of the landscape, is essential for enterprise clients with large investments in resources. Here at Liticode, we’ve been engaged in architecture in many business areas. We’ve engaged clients with software, security, and business architecture projects. If you could use a hand in planning for the future while competing in the present, give us a call. We provide TOGAF methodology as well as custom.

Passwords

Passwords are not going anyplace, but they are getting bolt-on improvements. Things like two factor tokens and text message codes. But passwords still need to be strong enough to match the application they are used for.

You don’t need to change them every 30 or 90 days. Let’s get that out of the way. If you need to change a password that often, either you’re a spy, and there’s better options, or your system is broken and needs a good consultant makeover (call us).

Passwords do need to be long and complicated. The password complexity needs to match the security requirements of your system, which is found through risk analysis. That’s a topic for another day. For now, just think in terms of how much you value what it is tied to. Money, privacy, family photos, your job. If it’s valuable to you, make a good password.

A good password is long, complex, and memorable. It contains numbers, letters, and symbols. People think symbols make it too difficult, but call it punctuation instead, and it’s much easier to work with. That last sentence contains 4 symbols. It’s also how we generally want to make passwords, out of words strung together that we can remember, with numbers and symbols.

This is 1 SUPER-STRONG Password!

That’s an example, but please don’t use it, it is now in every attack dictionary the bad guys have. And don’t use phrases from movies or songs! All the lines and all the lyrics are in all the bad guys dictionaries. You can’t even change it and use it, for example, saying “2 be or NOT 2 be? That is the ?” It’s in the dictionary. Seriously. Use random words.

But how long should it be?

Depends on how long it will take you to find out if someone is trying to break in. Some companies alert you to failed attempts, others don’t. If you don’t get alerts and it doesn’t have a two factor security setting, you should think twice about using it for valuable things.

If it does alert you, or there is a two factor piece, you can use a relatively short password. 20 characters or so, three words or more.

If it doesn’t alert you and you value the service, pick a long password. Six words.

Use a different password on every site, app, and account. Wait! It’s not hard! Because you’re also going to use Lastpass.

You can do it. You kind of have to.

Now you don’t have to change your password from Sportsteam3 to Sportsteam4 next month, and the bad guys won’t steal your money.

How Liticode Helps Clients with the Yates Memo

The Yates memo, if you haven’t heard by now, is instruction from the DoJ about holding business executives feet to the fire in legal matters where the business may be at fault. Liticode provides several service offerings, from Litigation Preparedness Evaluations to process auditing and litigation evidence assistance to help clients address these issues.

The biggest takeaway for executives is that they need to know how things stand in their area of two possibility so they aren’t blind sided by litigation.

Have your in-house counsel call us for an evaluation. Before they need to call us for litigation assistance. It’s well worth the cost to ensure your house is in order, so a business problem doesn’t become a personal problem.

Utilities for Secure Internet Use

A recent case forced us to put together a coherent list of utilities everyone should be using to avoid internet problems.

The first and most important utility is LastPass. LastPass is a container for passwords. You use it on your phone, tablet, and PC. You make up one really good passphrase you can remember easily, and let it take care of the horrible complicated passwords that keep your bank account safe. Nobody likes to type in a complicated password, so they don’t use them, and their accounts are at risk because of weak password choices. LastPass does the hard work for you.

Next, we pair LastPass with Google Authenticator. Authenticator is a free utility for two factor authentication, probably installed on your phone already, or available from either the Android appstore or iTunes. Two factor authentication means you have something in addition to your password. You can use it with all your social media accounts and probably your email. Without your password AND your Authenticator token, nobody can access your stuff, which is great! You’re safe!

Next, set up LastPass to use Google Authenticator, and viola! You are a hard target for internet criminals!

The last piece of the puzzle is integrity, or proving you are you, not some imposter. For that you need to set up an account at Keybase.io. In keybase, you set up a key pair for encryption and digital signing. Sounds way more complicated than it is. Plus, once you have a keybase account, you can prove you are you on all your social media and websites like 9gag.

A fringe benefit of keybase is the ability to send encrypted messages.

As with all security utilities, ensure you have your data backed up before you turn on security features, especially encryption! And be sure to read the fine instruction manuals.

Now, what’s a good passphrase for LastPass? Not your favorite movie quote, at least not without some extra work. Here’s some examples of high quality pass phrases, none of which you should use, because they will all now be publicly known!

  • Ferry my horse sun* 2 the far shore for $5.
  • Left. No, right. No, left! YOUR OTHER LEFT!!
  • I had a gr8 password, but i forgot it. :,-(
  • Tension, apprehension, and dissention have begun! Not!

And that is the only thing you’ll need to remember, from now on.

Idle Time Mining

Most forensic shops have several very powerful machines for the business. Much of the time, these machines sit idle, doing nothing in between cases. Consider putting those thoroughbred boxes to more profitable use by mining virtual currencies. The additional income can smooth can flow curves, be used in purchases, and help heat the office in Winter.

Seriously. 

Mining operations can be run from different boot disks while the machines aren’t doing anything. It’s pretty easy to set up, and the heating benefits are no joke.

You could cut your office heating bill and get some coins out of the deal.

Besides, virtual currency forensics is going to be huge business. Get involved now.

Musings on The Near Future

When we first started helping litigants with electronic evidence, there was a lack of paying clients. This was because few lawyers then had any grasp of tech who weren’t actively in tech, and courts had even less. Strange, isn’t it, that cases that could have benefitted from electronic evidence failed to capitalize on it, because the people responsible for litigation didn’t grasp is importance. Like only eating the same fast food because you don’t know there’s a restaurant one block over. But gradually it crept in. It took literally decades, but here we are. Now only the very rural or new do not grasp the import of electronic evidence materials.

For the past decade we’ve had a labor shortage, which has worked out well for us, providing a stable enough demand to operate as an independent consulting group, but that is changing.   As the lawyers have become more knowledgeable, demand for technical expertise and billable hours have shrunk, while more professional consultants crowd the field. Fortunately, it is not exactly a commodity service, so we have not suffered a drawdown, but it has limited growth. We see two areas of interest in the near future.

One, is the typical business Oroborus cycle of acquisition and merger. We will likely meet this fate within several years, being small and specialized. Not a problem except as it leads to stagnating methods and standardized responses with higher costs. Sorry, consumers.

The second area is far more dire, and that is the advent of expert systems, or what the ignorant refer to as AI. Experts systems are codified judgement engines that modify their rules based on results. They “learn” from outcomes. Where an expert now collects, processes, and constructs affidavits or testimony, eventually 95% of that work, and the lawyer activity surrounding it, will be done by a supervised expert system.

At which point our job, the technical consultant, turns to criticizing and improving those systems. But it will drastically alter the legal playing field. Especially where one side can afford it and one can’t. We will likely need to extend the right to counsel to include the right to expert system advice. 

One day there will be a public defender computer made of old code and rusty hardware trying to keep up with too many cases and the shiny new Wall Street supercomputer expert system.

I, for one, welcome our new robot overlords as they can be mathematically proven to be fair and unbiased and mistake free. But that’s still at least a decade away, more likely two. 

Congratulations

to the big man himself for passing the HCISSP exam on the first try! Liticode considers the HCISSP a necessary standard for working on HIPAA and hospital security and litigation consulting. No cert is too much of a reach for our valued clients.

On the Structured Interdependence of Policy

Corporate documentation is a multifaceted pyramid structure.  It begins with the business plan and statement of purpose.  The departments are chartered to spell out purpose, responsibilities, and control.  The charters are supported in policy.  Policy is frequently interdepartmental in reach.  Nothing is done in a vacuum.  The policies are detailed in procedures, standards, and other documents.

Everything fits into the structure, which makes it strong.  Errors in the documentation expose a company to risk from a variety of sources.  Every action taken by the company should be traceable back to one of the documents.  The documentation exists to protect and guide the actions of the employees.

It shouldn’t just be a bunch of paper in a binder that gets reprinted once a year for auditors.  It shouldn’t be a stick used only to discipline.

If policies aren’t the inspiration for action, they’re in need of overhaul.  You can tell the vitality of a company by its policy manual.  Is yours a lighthouse in the storm, or a pair of handcuffs?