Slashdot Mirror
New EU Rules Require ISPs, Telcos To Come Clean Within 24 Hours of Data Breaches
hypnosec writes "Under new EU regulations ISPs and Telcos serving European customers will have to come clean within 24 hours in case of a security or data breach that leads to theft, loss, or compromise of data. Companies will have to disclose the nature and size of the breach within the first 24 hours. Whenever it's not possible to submit such data, they must provide 'initial information' within the stipulated time and full details within three days. Under the new terms the affected organizations will be required to reveal information such as information that has been compromised and the steps that have been taken or will be taken to resolve the situation. If the breach 'is likely to adversely affect' personal information or privacy, affected businesses and consumers will be notified of the breach."
Does this mean the alleged NSA taps on major internet links that monitor all traffic would have to be reported as breaches too if an EU ISP discovers (or knowingly installs) one?
It's just too easy for US companies to "pretend nothing happened".
Hmm.
Europe is more about freedom than the US.
All the right wing congressmen prancing about, but they claim to disavow surveillance.
I'm just a trouble maker finding holes in the wall...
rats seem to like peanutbutter more than cheese, but there's lots of that...
Does dropping trou for an intelligence agency (foreign or domestic) count as a "breach"? Or is that just "business as usual"?
This should be for all internet service providers of some scale.. I mean telcos have a lot of communications metadata, but breaching that is not actually something I need to know QUICKLY. What I need to know stores and places with my credit cards and shared accounts are stored. "Do I need to reset passwords" is basically the main question.
Do they really expect every massive, multi-part intrusion to be investigated to completion so that a full report can be made after only 72 hours? What am I missing?
... and then, there are "SECRET PRESIDENTIAL DIRECTIVES"
In any case, this law is a start, and I wish similar laws would reach across the pond too
"You can have all the LAWS you want, but as long as the SECRET PRESIDENTIAL DIRECTIVES get to by-pass any existing law ( and in the PRISM case, even bypassing the UNITED STATES CONSTITUTIONS ), do not keep your expectation too high
I bet the kid of an EU official was tasked with implementing with a heartbeat server, couldn't hack it and the parental unit thought: let's make every ISP implement a "Still hakced by the NSA"-website, that refreshes every 24h.
Suppose ISPs (and that includes telcos) were required to only provide connections, an no other products: they simply provided a wire and a router for a monthly bill. They could have no data at all about you aside from how to bill you. Now suppose they perform competitive bidding to provide service to a separably maintained database of customers (or multiple such databases if you dislike centralization) which handled billing. Then the ISPs don't even have your billing information, and in the case of wireless providers might no even know where you live. If logging is necessary for some reason (perhaps bill per amount of bandwidth), this can be very short term (seconds) aggregated in volatile memory and streamed off to another company (perhaps the billing one in the case of bandwidth based billing). So at most they have on site is an in memory note of how much band width an unknown user consumed in the last few seconds. This is easy to audit.
The key to applying capitalism effectively here is to ban vertical integration, and setup specific and simple to regulate levels at which competition takes place. Then you can have good competition and regulate the state that companies at each level are allowed to maintain. A stateless router ISP is little threat to privacy or freedom (and its cheaper!).
In the wireless case, you would split up providing cells from providing customs, meaning every customer can use every cell (For the existing Cell installations that means more coverage for the average user, and smaller cells for less noise, lower power and higher bandwidth). Companies bid to construct cell towers (and/or are paid based on the amount of traffic they serve), and different companies make contracts with customers.
The privacy is better, the freedom is harder to infringe on, the market competition is better (and thus better prices) and the efficiency of the service is higher (no more needlessly overlapping cells).
EU Privacy directive is still law, EU Right to Privacy is still written directly into UK law. RIPA does not trump the fundamental rights and it didn't give them permission :
http://www.legislation.gov.uk/ukpga/2000/23/section/1
"(4)Where the United Kingdom is a party to an international agreement which—
(a)relates to the provision of mutual assistance in connection with, or in the form of, the interception of communications,
(b)requires the issue of a warrant, order or equivalent instrument in cases in which assistance is given, and
(c)is designated for the purposes of this subsection by an order made by the Secretary of State,
it shall be the duty of the Secretary of State to secure that no request for assistance in accordance with the agreement is made on behalf of a person in the United Kingdom to the competent authorities of a country or territory outside the United Kingdom except with lawful authority."
You didn't have a UK court order, so you didn't have lawful authority to intercept UK comms. It was done illegally. You cannot transcribe a mass surveillance directive FISA warrant into UK law and pretend it gives you UK lawful authority. FISA law does not apply to UK, a FISA warrant does not count as lawful authority. If it did, then American law would count as lawful authority over any UK law.
Without even getting into whether a US law that violates the 4th Amendment is lawful authority or not. It is not lawful in the UK. It is not lawful under RIPA.
So the companies who assisted in this, need to come forward and report what they did as a data breach. Because that is what it is. Parliament rules UK, not GCHQ, not NSA.
In particular Vodafone is buying Deuschland Kabel and Vodafone network in Greece was spied on in 2004, so the Germans need to ensure their network is secure from extra-legal surveillance before allowing that to go ahead. Answers are needed.
It does seem a bit absurd. I understand the 'let customers know' about a security breach ASAP (24 hours even) although the full info should be released as it is known and then a maximum time specified for the investigation. Maybe up to 6 months. There are obviously certain circumstances where it wouldn't be possible to fix the problems because of third parties, insane financial costs (like shutting down a factory), etc. It may only be feasible to do at certain times. If shutting down the factory to fix a security breach means six months until resumption that could mean the company goes bankrupt.
There's no full report required, just the immediate discovery and notification thereof. "Breach detected, your password may be stolen, please change it now". It's about giving people the ability to take measures ASAP.
...I sometimes encounter data breaches from companies I do business with, simply because I use a unique e-mail address for each business. (name_businessname@domain). As soon as I start receiving spam on the e-mail, I have pretty much irrefutable proof that a leak exists at that company; the only condition being that I must make sure that that e-mail address is never communicated to anyone else.
Of course, "proof" for a court of law could require a bit more, but I think that needs to be established as jurisprudence, and this could be an example of how it could be established.
Slashdot: stuff for news, nerds that matter, matter for news, stuff that nerd
If shutting down the factory to fix a security breach means six months until resumption that could mean the company goes bankrupt.
If shutting down the factory to fix a problem where people lost their lives means six months until resumption that could mean the company goes bankrupt.
When you are dealing with someones personal information any kind of mismanagement can have very large consequences.
Just treat it as equally important and you will be fine. If you can't afford a security breach, don't risk it.
For good measure, again No.
From the last paragraph of TFA :-
This provision is likely useless against the NSA.
Hopefully you are aware of what the compromised server is used for, as well as which other servers it normally interacts with. You also should know whether that server handles sensitive data, and how that data is protected (are the passwords hashed and salted on the http server, the db server or some other server?). This information should be available within an hour, and it should be enough for a preliminary report.
Using proper log handling and log analysis (which you have, right?), you can identify the timespan of the intrusion, figure out which connections were made from the server in question during that time period, figure out what data was accessed or modified during this time period by one of the (potentially) compromised accounts, and so on. This should take a couple of minutes if you know how to handle logs.
Finally, you need to combine all the data you have gathered into a technical report, which is then sent via bosses to the PR department for publication. This step most likely takes many hours, but it should still be possible to do everything within 24 hours (unless you want to sleep).
In short: If you can't do it in 24 hours, you are unprepared for handling intrusions, and then you should fix your system and educate your employees. The goal of the EU rules is to create an incentive to actually do so.
Full credit to this article at the London School of Economics and Politic Science .
It is clear that FISA allows the US to target ‘persons reasonably believed to be located outside the United States to acquire foreign intelligence information’. Arguably, when intelligence already in the hands of an agency such as the NSA is handed over to the GCHQ, there is little, if any, legal regulation or oversight in that situation as the RIPA applies only when the GCHQ gathers the data itself. If the data is simply provided to the GCHQ by the NSA pursuant to The Security Service Act 1989 and the Intelligence Services Act 1994 there is no legal requirement for a UK court warrant.
Also RIPA does not apply where the information on UK residents is harvested outside of the UK (e.g. harvested from Google servers based in the US).
I forgot to add that while I'm sympathetic to your point of view, it appears that from a purely legal point of view, the authorities appear to have ensured that their actions are clothed with a fig-leaf of legality. Whether their actions have any moral justifications is an entirely different matter.
What is particularly repugnant is that these overly broad surveillance powers may have already been used to target civil liberty groups in the UK. I would think that it is a clear abuse of power to spy on parties perceived to be 'anti-government' instead of the terrorists they ostensibly were meant to root out when the laws were enacted.
Did you know about:
Available Prism Packages in Ubuntu 8.04
http://buck-nasty.blogspot.pt/2009/01/how-to-install-mozilla-prism-in-ubuntu.html
prism-facebook
prism-google-analytics
prism-google-calendar
prism-google-docs
prism-google-groups
prism-google-mail
prism-google-reader
prism-google-talk
prism-twitter
Install Prism packages for google using the following command
sudo aptitude install prism-google-talk prism-google-mail prism-google-docs prism-facebook prism-google-analytics
Am I missing something here..? Why ISPs and telcos?
If its important enough to set up new legislation/regulation then shouldn't this apply to _any_ corporations?
Shouldn't Amazon, eBay and your banks be similarly accountable? I know if be a lot more angry if my bank exposed my personal and financial details than my ISP.
Does this mean that companies have to report the breach after it actually occurs or when they "notice/detect" that it occurred.
Keep in mind there can be a significant gap between when something happens, it is noticed, and when it is "officially" reported by the company.
Your post suggests you've never done this before. Consider:
1. Spear phishing attack nets the credentials of employee A.
2. A's credentials are used to access sensitive data B. A normally has access to B so this doesn't set off any alarms.
3. A's credentials are used to plant malicious code on an internal web site.
4. Malicious code nets credentials of employee C and D and E (and a dozen others).
5. A separate attacker probes C's access, digs through source code repository.
6. Source code review yields an exploitable vulnerability in an internal system.
7. Staging from D's workstation, internal system F is cracked using discovered vulnerability. This gives them access to credentials that are trusted by system G.
8. Staging from E's workstation, sensitive system G is accessed using credentials stolen from F.
9. An administrator on G notices that something is amiss.
So now that you've discovered the breach, the clock starts.
10. G contacts E to ask what's going on, but E's at home asleep.
11. E's workstation is taken offline and forensics begins.
12. The credentials stolen from F are used on several systems because the developer re-used them, so it takes a while to figure out that F was where they were stolen from. The attackers covered their tracks, but a sharp-eyed engineer found access attempts in an unrelated daemon's logs from D.
13. D is contacted, and has no explanation. It's possible he would have accessed that system, but he can't remember. But your guys are smart, so you check his system for malware just in case.
14. Malware found on D. How did it get there? He exchanges software with a 3rd party all the time, so you spend some time scanning what he's downloaded, turning up nothing, so then you go through his e-mail, and find a short e-mail with a link from a colleague that seems out of place. The URL doesn't look suspicious (the vulnerability was removed by the attackers after it was used), so you set it aside.
15. You get stuck, so you go back to that e-mail again, one item of many presumed false leads, and realize that A didn't remember sending it.
16. Malware found on A, spear phishing e-mail found.
17. Logs of systems scoured for activity from A, sensitive access to B found.
18. A's outbound e-mail checked, e-mail to C (and dozens of others) found that looks similarly suspicious.
19. Logs of systems scoured for activity from C, accesses to source code repository found.
20. The dozens of others also affected are investigated to see what systems they accessed, just in case there's more.
21. What did you miss? Was there anything else? Keep looking. Are you sure that's it? Keep looking.
This is all "best-case" and you haven't even started trying to identify the attackers yet, much less assembling a report.
It's easy to play the armchair security consultant and talk about "proper log handling and log analysis" as though that's the magic bullet. Do you think that every company subject to this law has "proper log handling and log analysis" covering every component of every internal system on their network? Do you think even a majority of companies have this?
Do you think it's typical that every system in this chain of investigation will have all of the logs needed to proceed to the next step? Do you think those doing the investigations will always have easy access to these logs? That they will spot patterns that look like normal accesses but really came from an unauthorized attacker? Do you think they will even have access to the systems in question without having to track down an administrator?
There are companies that have the forethought (or experience) to make such a forensic exercise relatively fast and accurate, but these companies are the exception, not the rule, and even for those that have their shit together, investigations like this could take WEEKS to reach a meaningful conclusion about what data was compromised. You might know *something* after 72 hours, but in many cases this will be far from a "full report".
That's not how I read it, but that would make more sense, I suppose. I'm thinking of situations where you have a multi-pronged attack, and one prong accesses one set of sensitive data, and the other prong accesses another. One access may be discovered, the clock starts, and 72 hours later they may not even be far enough into their forensics to find out about the other prong of the attack. But if you're defining each as its own "breach", even though it's part of the same larger complex attack, I suppose it's a little more reasonable than I interpret it.
But what if you're investigating something like this:
1. Breach of data A occurs
2. First breach of data B occurs (small set of data accessed)
3. Second breach of data B, by the same attacker from a different attack vector, occurs (accessing more data)
1 is discovered, clock starts, but you're able to get a full report out after 72h.
2 is discovered, separate clock starts, and you're able to get that report out after 72h.
3 is discovered. Should that have been part of (2)? What happens if you don't notice this during your investigation of (2)?