Testing, in the black box (ATV), Security & Privacy

How Automate Testing Vehicles (ATV) should include Pentesting.

Why should privacy officers get involved in development, regression testing process?

Why does IT need to improve their testing strategies?

Pitfalls in Testing, Security/Privacy concerns is what drives people to have nightmares. Privacy officers need to have a better understanding of the environment they work in. The IT people need to embrace the notion that Privacy/Security starts from the beginning. So in that way the chances of being on a front page of a newspaper because of a breach and/or a failure will be minimized. NO ONE wants to phone the CIO about a problem like this. It is a team effort.

I do have to warn you, the reader, that some of the material may be a  little IT oriented. But in an organization where one needs to satisfy a number of different objectives, I would suggest at least a basic knowledge of the IT process is needed. And that the IT personnel need to understand the present compliance/regulator landscape.

Some definitions are warranted before I begin.

ATV or Automated Testing Vehicle. What is it? Why do I care? And is it a 'best practice'? (one of the most over used phrase at present).

The idea is fairly simple. Having a set of scripts (automated) that can be run to test the system in question. The objective is to test the system before any changes are implemented. The process should set up  the files that will be used for testing(see one of my previous blog posts concerning using data for testing),  then run the test scripts, and afterwards run the comparison reports and highlight items of concern from the test just executed. All this is done in an automated fashion. Rather simple concept, but one that can be 'processes' changing in a good way.

Well there is more to this. But let me define another term or two first.

IT systems that are down cost money in lost revenue, and good will to the enterprise.  As an example, in 2012 Google had an outage.
Google June 2012 down for 10 min.

The ball park figure cost that Google suffered was calculated at about $750,000. And that was for 10 minutes.  Now I am not suggesting all downtime costs are that much. It depends on the circumstances, but I am sure no one would like to find out for their own companies.

Another good example of the costs is sited at costs of web down time per industry

This site allows you to calculate the cost of a web site being down per industry/application. Its an eye opener to say the least.

In another 'word', downtime is BAD/EXPENSIVE *Yea  I know that is two words*. But joking aside we need to reduce unavailability as much as possible.

PenTesting. Wikipedia link  The Information Systems Audit and Control Association(ISACA) defines Penetration Testing as  "A test of the effectiveness of security defences through mimicking the actions of real-life attackers."

(For the reader who is more concerned with Privacy/Security, please read on)

So now let's proceed. When an application change happens IT personnel (or a designated organization) tests the changes (IE regression testing). They test the change to see if it works. Now depending on the process that is followed, a user may also test/approve the same series of changes to the application for user approval. Fine, right? Do you notice something missing in the above? In fact, there is more then one item here that needs to be defined/explored.

For many organizations testing to maintain the basic functions within an application does happen in a haphazardly way.  Sure the change is tested and to get to the enhancements, some basic functions are tested as well, But, based on my anecdotal experiences, on many occasions, the entire core functions of the changed application are not testing on a consistent bases.  A test of the all the basic core functions should also be completely tested whenever there is a change.

As an example, if the application in question is some public facing web application (a web store as an example), basic function testing should also be done. Test for example, the ability to add/change a Credit card information and make sure that the update still works. Test adding an item to the shopping cart etc.

So if the new function within the application fails, you have verified that the basic core functions, the one you need to keep the doors open, will still operate.

Imagine if an error occurs at your bank, yet the basic functions were tested successfully with the 'improved mobile bank portal' (the change that will be implemented).  Then logic would dictate that the basic functions should still work (you can still pay bills) even if the enhancement of the bank's mobile app does not. Corrections can be retested and implemented with minimal cost/embarrassment to the organization.

I am therefore advocating that there should be standard testing scripts that confirm, even with the changes that are going to be implemented,  that ALL the core functions still are accessible.

So to implement a process like this, you first need to map out the basic functions that you can not live without. Once that is done and scripts are created, an automated process should be created. When ready, a series of script can be executed with little human intervention. (less change for human error). The 'Best Practice' (there is that phase again) would be something along the lines of submitting the scripts and going home. When you get into the office the following day the results are ready for analysis/correction etc.

This should ensure that at even if the new change fails. You, the customer, can still do business with the organization in question. This is what some people call a ATV (see above). This process can be called your insurance policy.

However, lets' takes this further. Why just test  the basic functionality of the application? Should we also test for Security/Privacy issues?  Should the company's Privacy/Security office ensure that this type of testing, verification is also included within an ATV and executed whenever anything changes?

Absolutely!

A process that includes PenTesting (see above) is something one should consider adding to the above mentioned ATV. With any change there is always a chance that a vulnerability is created that may not have been there before.

Any failure can by it's very nature, cause the potential to expose sensitive information. It can be business secrets, and/or Personnel Identifiable Information (PII) to name but two potential headaches.

There is software in the marketplace that has the capability to engage/test/analyze applications for vulnerabilities. Some of the software I have previously mentioned as well as others which are available with the capabilities needed.

So I suggest that one creates an ATV process that includes the basic functionality of the application/system in question as well as additional testing for security/privacy. All  this should be automated so that more extensive testing can be executed as well as reducing the chance for human error.

Privacy officers need to ensure that any changes that are implemented will not cause exposure that may be costly. IT people need to make sure that the basic systems functions still run, no matter what is changed.

Finally, while no one can claim in absolute terms that there will be no issues, following these basic concepts can help reduce the chance that the CIO needs to be called because of an issue.

Data Privacy Project road map part Deux

-->

 

 Before we get started, let’s review some critical items that we covered last time.

The analysis phase of any Test Data Privacy Project (as all other IT projects) is the lynch pin, where you make or break the project. So to summarize this step you need the following:

1)    Identify the meta data of the application(s) in question

2)    ‘Marry” the meta data to the data stores (the field in the meta data that corresponds to underlying  table/file)

3)    Inspect the potential PII Fields/data to see if they are actual fields that need masking. A sample would be nice to show the SME, if there are any questions about the field contents.

Then we have the design step. The following is the continuation of the discussion from my pervious blog entry.

It is the SME who is the critical member of the project team in this phase. He/she will be asked questions like, how do these fields that were identified in the previous step as PII, interact with each other?  A simple example: is there an edit to make sure the city zip/postal code combination is valid?. The rules should be consistent throughout the environment. IE, if you age the birthday in one file in a certain way, you will need to age the birthday the same way in any other data store you have.

Now before we move on, I should address a question that should be brought up at this time. Are you going to need to sub-set the data while masking it? (see my blog Testing and Data Privacy, is there an issue (final post or is it)?  After you answer that question, the next one is HOW? (And as I mentioned before, my expectation is that you will answer YES to this question). Are you going to want to take a random set of customers (as an example) and mask all the related records of those customers? Or has the SME given you a list of branches that will be used for testing? So you need to also mask the customers of those branches, including the addresses of the customers of those chosen branches,  the SSN/SIN/Tax ID for those customers, and extract only those products that the target branches have to sell etc.  What this all means is that you will need to design the extract process at the same time as the masking process. This can be a large hurtle to be overcome, BUT the end results will more then make up for the effort. (this will be a subject of another blog entry in the future)

WARNING WARNING WARNING

I’ve got your attention, I hope. What I need to highlight here is that the sub-setting of data and the obfuscation of the data needs to be done at the same time. Failure to do this, may mean an increase chance of a data breach.  Now back to your regular scheduled program.

The actual masking rules do not only depend on the requirements, as defined by the SME and/or legal/privacy personnel (see above), but also is driven by the chosen tool set that you have. For example, if the toolset you are using, does not use >128 bit Strong encryption, should you still use that technique for masking? If you need to be able to reverse the obfuscation (if there is a legitimate reason) then that may restrict what kind of rules/code that can be used to mask the data in the first place.

Another aspect that needs to be considered, but many times forgotten, is how will the audit requirements be satisfied for this project? And make no mistake about it, there will be a need for audit reporting for this process. Why do I say that? It is because the masking process is most likely being driven by either regulatory requirements, or best practices. And in either case some sort of ‘proof of the pudding’ will be required. This also needs to be taken into account within the project.

Once the design phase is finished, we will then move on to the coding.  There is not much I can say here :

1)    Depending on the chosen toolset you will be using, it will indicate how one will code the rules, and the limitation of those same rules

2)    Try to reuse as much of the masking rules as you can. There is no need to reinvent the wheel, if one can help oneself. Some tolls allow for one rule to be applied to many different data sources. And for obvious reasons that is something I encourage you to do as much as possible

Next is the implementation phase. This should be the easiest step. I mean, isn’t this just another IT project? And don’t you implement IT projects ‘all the time’?  It should follow the same process, right?

Maybe. But to see if it is easy, one needs to ask a series of questions first. Some examples of questions are as follows;

1)             How often will the obfuscation needs to be run?

2)             Who is responsible for the running of the process? Will it be production support, or will the users themselves run the series of jobs in question?

3)             Will there be a need to have user input before each run. (IE. Will the data sub-setting requirements change)

4)             How will change management be taken care of? In other words, if a file/field is changed or added, how will the masking process be updated? Who will do it? And how do you ensure nothing falls between the cracks.

5)             Make sure that the Audit reporting is implemented. Is it on request, or will some sort of reporting need to be done every time? Will the reports need to be secured?

And in all these steps, you should make sure you document EVERYTHING, in a concise and accurate manner. Only with this being done can one try to assure a successful ongoing, maintainable process. I would suggest setting up a Lotus/Excel worksheet to help with this.

The intention of this blog is not to replace due diligence. Each IT environment is different, with its unique challenges. My sole intention is to try to help the community to tackle this concern head on. Experience tells me that this is a big task, but does not have to be daunting.

As the many clients I have known can attest to, if one does this methodically, with foresight, one can achieve a successful conclusion.

If you have any questions about this or any other topic that I post, or you want me to explore some issue, drop me a line at rgalambos@gmail.com.

Till next time

Data Privacy Project road map

 


 --> As I am sure most people agree, and have experienced as well, the majority of projects either come in over budget, late, or even worse, they never finish at all. A critical project like Data Privacy is no exception. But then again failure is not an option because of the consequences.

Before I begin, lets talk about privacy and the foundation of the project.

Politics. Yes I said it. And I am not talking about the govt type of politics, but the ones that all organizations have.

The first step that needs to be addressed is to get upper management sponsorship for a Data Privacy project. This is critical for the success of the project. Someone has to make the decision to bite the bullet to start funding and make sure that all department heads understands that  is mandated from the top.

This proposed project is  cost centered. It will not generate any revenue. It wouldn't make the widget run faster, nor get more customers. So getting funding for these type of projects is harder to get. One needs to make sure that upper management understand the business need, the ROI etc..

The data in question can span many applications which means many different departments are involved. A number of application owners are the stake holders in a project of this sort. So unless there is  someone high up giving directions, most likely roadblocks may appear that could be insurmountable.

This can be very daunting. I suggest that you start with a pilot project, unless you are in a small IT shop. Ideally choose a relatively isolated application, if possible. Start small to be able to learn where the road blocks/pit falls are. It is easier to learn from a mistake now then  to tackle more then you can chew.

Who owns the data? Who will decide how  the data be scrubbed? How much data will be scrubbed? Who will maintain the process once it is developed? These  will be questions that need asking.

Who will lead the project? What resources will be brought to bear on the project? Will the SME of the applications be used as reference, or will they be actually part of the project team?

Who will maintain the process after it is complete?

Ok, we can start, Right? Well not exactly. The next step is to determine  what 'methodology'/process/expertise will be used. Are you going to develop something in house? Or are you going to purchase something? The company may already have the tools  in place  that are capable to obfuscate data. Then all you have to do you is to deploy them.

The next item is determining what exactly needs masking/scrubbing. There are a lot of factors that need consideration. Some examples are, but not limited to, the PCI DSS standard (ie. if you retain/use Credit card information). If you have EU customers/locations/presence then one must be sure to adhere to the EU Privacy Directive. Or if you operate in Canada then one must make sure the company abides by PIPEDA, and so on. Most likely the answer to these questions will come from your legal, privacy or audit departments. So consultation is in order.

So we now have all our ducks in a row.  Like most IT projects there are basically four steps for a successful project. They are: analysis, design, coding and implementation, each building on the previous success.

The most critical step, is as you can imagine,  is the analysis. In fact I would expect that at least 50% of the time that you spend on  the project will be in this first critical phase.

Analysis.  In this first step your objectives are:

1 ) Identify all the data stores that have Personnel Identifiable Information (PII).

2) Take all the meta data and scan them for tell tale signs that they contain PII, for example a field that is labeled 'ADDRESS'. That in itself is not enough just to find those fields so named. You will also need to marry the meta data to the actual data store (where the data resides. ie. DB, flat files etc). This should be enough, but trust me it isn't.

The after these two exercises are finished, one needs to actually look at the data and see, if that ADDRESS field is actually PII. It could be the address of your branch office in which case it would probably not be PII, and outside the scope of the project.

Then there are the data field labels that do not reflect what is stored. An example could be a field that is labeled 'NUMBER'. This could be a phone number, a reference number, or the number of times the customer has ordered from your company. You will need to inspect the files, that you have identified (see above)  and make sure you  have a list of all the data fields, and the data stores that need obfuscating.

This is time consuming to be sure. But if the analysis is not done completely and thoroughly then the project is doomed for problems further down the road.

The results of this phase are a list of files that contain PII, and the fields within those files that need to be worked on..

Design. In this step your objective is to design the various techniques needed to obfuscate the data.

Taking the information developed in the previous step, a systematic approach will prevail.

You need to categorize the various data items that were discovered. For example, all the names should be grouped together and then masked the same way.. They all need to be masked the same way to maintain consistency and interoperability between the different applications. IE you need to make sure that Robert that is scrubbed to Oliver in application A. Then, if Robert appears in application B, it will also be scrubbed to Oliver in that application. This is crucial to the long-term success of this process.

The SME needs to determine the business rules that are applicable to the various groups of data. Are there edits on addresses to make sure that the masked address is located in the specified city? The birthdays of customers are important to be maintained because of insurance rates etc?

The masking rules that are being created against the various data fields need to take all business logic into account. And then to add to the complexity of the situation. the project team may be also be mandated to sub-set the data while copying from the production system. (see one of my previous blogs with a short explanation of various forms of testing that are normally inherent within an IT department).

In the next post I will continue to explore the design stage and then delve into the next two stages of Privacy project.

and as always if you have any questions drop me a line at

rgalambos@gmail.com

Robert Galambos CIPP/C CIPP/IT