Ride The Lightning

Pentagon Approves Android Phone for DOD - Still Wary of iPhones

It looks like the Pentagon is moving away from BlackBerrys (duh) and embracing the Android. It was reported that the only phone which currently meets security requirements is the Dell Venue. In a recent Security Technical Implementation Guide, the DoD stated that acceptable devices must be running Android 2.2 and have the Android Market stripped from its core.

Web browsing must be done through a DoD proxy server and classified information cannot be sent, received or accessed by the phones.

The Defense Information Systems Agency is testing iPhones and iPads but due to Apple's insistence on controlling its ecosystem, they have not been approved. Installing DoD third-party security was reportedly difficult. Also, government officials indicated that they were uncomfortable with Apple's ability to track users' locations.

Perhaps military intelligence is not an oxymoron after all.

E-mail: snelson@senseient.com Phone: 703-359-0700

www.senseient.com

http://twitter.com/sharonnelsonesq

Jurinnov Debuts Security Spotlight Blog

First, thanks to those who wrote to express their appreciation for last week's list of information security resources.

And now, it gives me great pleasure to introduce readers to a new infosec resource, the Security Spotlight blog from our friends at JurInnov. The author is Eric Vanderburg, CISSP, and although the blog is a fairly recent addition to JurInnov's offerings, it promises to be a worthy contributor to knowledge in this fast-paced arena.

E-mail: snelson@senseient.com Phone: 703-359-0700

www.senseient.com

http://twitter.com/sharonnelsonesq

Selling or Giving Away Your Old Cell Phone? Think About Security!

Lee Reiber, Director of Mobile Forensics at AccessData, read an RTL post on mobile phone security and was kind enough to send this guest post on the proper disposal of old cell phones.

When consumers trade in their old mobile devices (phones/tablets) for new this holiday season – much of it will end up on eBay, Craigslist and other sites to be resold.

Although the data has seemingly been wiped clean – sensitive information still resides that can easily be extracted for identity theft and other criminal activity.

I recently bought five used cellphones (two HTC Androids, an LG Android, an iPhone 3G and a Sanyo 2300 flip phone) and tested them using mobile forensic technology.

What was found is surprising. Most contained personal information including date of birth and personal email records. One device in particular contained Yahoo accounts with passwords, work location along with social security number, geolocations of images, and Facebook logins.

Consumers as well as corporations that resell old devices need to follow a few simple steps to help ensure sensitive information is kept out of the public eye:

• Sellers should restore the device back to factory settings
• Make sure to remove the SIM card and erase any SD card
• Run updates on the phone’s operating system to eliminate  most of the data stored in the file system

Thanks for passing along these helpful tips for the secure disposal of cell phones Lee!

E-mail: snelson@senseient.com Phone: 703-359-0700

www.senseient.com

http://twitter.com/sharonnelsonesq

Nuix Gifts the E-Discovery World With Proof Finder

Our friend Craig Ball has posted about this before, but I was late to the party (as usual) and didn’t realize that we too were using Proof Finder. Proof Finder costs only $100 per year (all of which is donated to supporting child literacy) and yet it has the capabilities of some tools costing much, much more. The product is only available for 10 weeks or until the goal of $100,000 is reached, whichever occurs first.

As Craig said, this tool will pay for itself in minutes (and yes, you were gushing like a schoolgirl at a Justin Bieber concert) but John gushed in exactly the same way when I asked him about Proof Finder.

We have long been fans of Nuix and while Proof Finder is limited to 10 GB of expanded data and doesn’t have all of the export functions and review tools of the full-fledged Nuix product, it is an absolutely marvelous tool at an unbeatable price point.

We had only one problem, probably unforeseen and that was with the licensing. The Proof Finder license is hardware-based. Like many folks, we swap hard drives in bays of our analysis machines and this invalidated the licenses. But Nuix quickly listened and is in the process of fixing the licensing.

So we doff our caps to Nuix for this extraordinary tool which even attorneys can master in moments. So prepare to gush like that schoolgirl at a Justin Bieber concert and run, don’t walk to the Proof Finder site.

E-mail: snelson@senseient.com Phone: 703-359-0700

www.senseient.com

http://twitter.com/sharonnelsonesq

Making E-Discovery Costs More Transparent and Predictable

Sensei Enterprises is certainly not alone in the world of e-discovery trying to make its pricing more transparent and predictable. Here is our recent press release talking about how we approached it:

FAIRFAX, Va., Dec. 8, 2011 /PRNewswire/ -- Sensei Enterprises, Inc. has announced implementation of a new pricing structure for computer forensic and e-discovery services. The new tiered and flat-fee pricing model provides clients with a total-cost estimate at the beginning stages of a project and throughout its life-cycle. It also allows clients to have complete control over the costs – choosing the services which best suit their needs.

Sharon Nelson, President of Sensei Enterprises, observed, "Pricing in this industry is very problematic. Clients may not know whether they are being quoted low prices by someone who really isn't going to provide a high caliber of service. They may also not know if the initial low quote is going to escalate dramatically, as it so often does. Our new pricing model and estimator allows the client to see precisely what the cost would be for the known scope at the outset of a case – and if the scope changes, the client will know precisely what the additional costs will be. Transparency is the key feature of our new pricing structure and I commend our staff of technologists for coming up with a pricing structure that reflects Sensei's reputation for integrity."

Free quotes may be obtained from Director of Computer Forensics Jesse Lindmar, who may be reached at 703-359-0700 or jlindmar@senseient.com.

I actually gave considerable thought to the quote. I remain frustrated by those in the industry who charge prices which bear no relation to the work involved and equally frustrated by those who underbid knowing one of two things - they will either ratchet up the prices as they go along or they will not provide all of the services truly required by the case. Saving money by hiring an unqualified, sloppy or profit-driven "expert" certainly doesn't save money in the end.

We have commiserated with other colleagues about clients who willingly pay 500% of value and those who just plain get snookered. I don't know that there is a solution, but more and more I am seeing colleagues I respect doing what we have done to educate clients and give them some sense that they can truly control their budget for e-discovery without ever being suprised by costs which suddenly spiral out of control without their knowledge.

I was very pleased when noted author and e-discovery expert Michael Arkfeld happened to see the press release and took the time to write me saying, "Great idea - the marketplace needs this." We agree and hope those who have not yet followed suit will soon do so.

E-mail: snelson@senseient.com Phone: 703-359-0700

www.senseient.com

http://twitter.com/sharonnelsonesq 

Information Security Resources From Sensei and RTL Readers

I know, I know, I'm late in getting to this. I blame the American Bar Association for having two book manuscripts due so close to one another. That's my story and I'm sticking to it. :-)

First, here are our favorite resources (with a hat tip Dave Ries, our co-author on Locked Down: Information Security for Lawyers, to be published in March 2012). The three of us compiled this short list for those who don't want to delve too deeply in too many sources.

• American Bar Association, Law Practice Management Section, www.americanbar.org/groups/law_practice_management.html, provides information on security geared to attorneys through CLE programs, ABA TECHSHOW, Law Practice Magazine, and Law Practice Today webzine
• CERT Coordination Center, http://www.cert.org/  (Carnegie Mellon University), a leading information security research and training center, provides security information for both technical and nontechnical users
• Computerworld Security Topic Center, www.computerworld.com/s/topic/17/Security, on online news service that regularly addresses privacy issues
• Dark Reading, http://www.darkreading.com/, a comprehensive security information and news site
• Microsoft, Safety & Security, for nontechnical users: www.microsoft.com/security/default.aspx, for technical users: http://technet.microsoft.com/en-us/security/bb291012 
• SANS Institute, http://www.sans.org/, a leading information security research, training, and certification organization, provides security information for both technical and nontechnical users, including its extensive Reading Room and Security Awareness Tips of the Day
• US-CERT: United States Computer Readiness Team, http://www.us-cert.gov/  (part of the Department of Homeland Security), provides security information for both technical and nontechnical users

Thanks to Derek Milroy, a security specialist who was kind enough to share with our readers his personal list of security resources. He can be reached at derekmilroy@yahoo.com. There was very little point in reinventing the wheel so with his gracious permission, we have simply added additions at the end of the list. We’d also like to thank Seth Wilson, Brian Honan, Aaron Turner, Anthony Freed, Sean Gajewski and Andrew Simmons, all of whom replied to a Ride the Lightning blog post asking for readers’ favorite infosec resources. Their recommendations are included in Derek's list.

Thanks to one and all. To those interested in following information security, an area where it is well-nigh impossible to keep up, this is a holiday gift indeed!

E-mail: snelson@senseient.com Phone: 703-359-0700

www.senseient.com

http://twitter.com/sharonnelsonesq

Jason Baron Leads eDiscovery Daily Blog's Holiday Thought Leader Series

We've been interviewed by Jason Krause many times and were delighted to see that he is doing a Holiday Thought Leader series related to e-discovery. We are even more delighted to be separately featured in upcoming posts. I was amused by Jason asking how John and I manage to work together and live together. As many times as I've been asked that question, I gather not many husbands and wives could do that. :-)

We were tickled to see our friend Jason Baron appear as the first thought leader interviewed in the eDiscovery Daily blog post yesterday. Jason was once kind enough to give us a personal tour of the National Archives and join us for lunch - a fond memory indeed.

His interview soundly states what those who have followed him know to be true - that he is one of Malcolm Gladwell's "outliers." In a world where so much evidence is "born digital" as Jason puts it, he is certainly correct that litigators need to understand both information management and e-discovery. As the acknowledged King of Search, I was pleased to see his optimism about how we may exert some control over our data through new search tools and methodologies.

Jason also offers his thoughts about e-discovery certifications and whether e-discovery would benefit from having its own ISO standards for quality. A good read from one of e-discovery's most noted visionaries.

E-mail: snelson@senseient.com Phone: 703-359-0700

www.senseient.com

http://twitter.com/sharonnelsonesq

Protecting the Crown Jewels: Your Data

John and I are teaching an information security seminar for ALI-ABA on December 15th from 1-2:30 p.m. Eastern time. Though the seminar is directed at lawyers, almost all of it (except the legal ethics rules) is generally applicable and we are already seeing a number of corporate registrants.

There has been a lot of news recently about smartphone security, data breaches and the wisdom of storing sensitive data in the cloud. We're happy to meander wherever your questions may take us. Hope some of you can join us.

You can register at http://bit.ly/lpmsecure

E-mail: snelson@senseient.com Phone: 703-359-0700

www.senseient.com

http://twitter.com/sharonnelsonesq

Does a PIN Prevent Someone From Accessing Your Phone's Data?

We read with interest a post answering that question by the folks at viaForensics. This is certainly a question we are frequently asked - and as the post points out, these PINs (or passwords/passcodes as they are also called) are critical to keep data secure from casual phone thieves and the Joe Six Pack crowd. The exception is the SD card in Android or BlackBerry phones which can contain unencrypted data which is easily read.

If your phone gets to someone with some skills (including the skill of Googling "how-to" infromation), you could be in trouble. As the experts at viaForensics note, they can always get the data on the iPhone, they can only rarely get data from the BlackBerry and sometimes from the Android (it is device dependent).

This is why we caution those who carry sensitive client, patient or other regulated data on their phones that the iPhone (which is a terrific device in terms of functionality) presents a serious security risk. The newer Android phones with onboard encryption are a far more secure choice in view of the rapid decline of RIM and the BlackBerry. Even the Executive Branch of the government and the NSA appear to be preparing to make the move to the Android platform.

We here at Sensei intend to do the same in 2012.

E-mail: snelson@senseient.com Phone: 703-359-0700

www.senseient.com

http://twitter.com/sharonnelsonesq

Reed Technology Launches Web Preserver

A couple of days ago, our friends at Reed Technology (part of LexisNexis), announced the launch of Web Preserver, Now I can't claim any credit for the name, but I think I did have some impact when I told these very nice folks that Reed Tech's Web and Social Media Archiving Services just didn't roll easily off the tongue. Web Preserver is a much better brand, and one that I can remember. John and I did like this product especially for research. I've quoted a bit from their press release below - note the free trial, which is well worth doing.

"A SaaS-based Web page capture and archiving service for corporations and government. The Web Preserver service provides Web researchers the ability to quickly capture and preserve a fully functioning Web page, including all of the links and associated metadata, with one simple keystroke.

The forensically-preserved Web records are easily retrieved in their fully functional original layout and format for review, for use in court cases, audits, to support records management retention guidance, and more.

Recent studies show that almost 30 percent of today’s URLs disappear within three years of creation, with the average Web page lasting just 44 days*. “Reed Tech’s latest technology innovation is specifically designed to help our clients preserve their Web research as it existed on the day it was captured, giving them a significant strategic retrieval advantage as Web pages age over time,” said Dave Ballai, CIO and vice president Commercial Solutions for Reed Tech."

For a demonstration and/or a 60-day free trial of Web Preserver, please contact Rod Wittenberg at RWittenberg@reedtech.com.

E-mail: snelson@senseient.com Phone: 703-359-0700

www.senseient.com

http://twitter.com/sharonnelsonesq