Comments on: This Message Will Self-Destruct in Five Seconds…. http://webiscope.com/2007/12/this-message-will-self-destruct-in-five-seconds/ Internet Healthcare Collaboration Thu, 01 Jul 2010 01:56:19 +0000 http://wordpress.org/?v=2.9.1 hourly 1 By: Stephen Halsey http://webiscope.com/2007/12/this-message-will-self-destruct-in-five-seconds/comment-page-1/#comment-252 Stephen Halsey Fri, 14 Dec 2007 22:58:36 +0000 http://webiscope.com/2007/12/this-message-will-self-destruct-in-five-seconds/#comment-252 At some point you have to make the leap of faith that security assurances are accurate. I feel much better knowing that there are new standards and procedures in place that should reduce the percentage of these incidents occurring. We now have a third party that does do unannounced security audits for the hospital as a whole. That opens up a lot of new issues as well though (they are testing out production systems which can cause issues when they find holes). For remote hosts though, I highly recommend getting 3rd party verification of what they claim. After all, they are marketing their services as well, and the truth of those claims can't be verified easily. But we shouldn't have to settle for a buyer-beware mentality. At some point you have to make the leap of faith that security assurances are accurate. I feel much better knowing that there are new standards and procedures in place that should reduce the percentage of these incidents occurring.

We now have a third party that does do unannounced security audits for the hospital as a whole. That opens up a lot of new issues as well though (they are testing out production systems which can cause issues when they find holes).

For remote hosts though, I highly recommend getting 3rd party verification of what they claim. After all, they are marketing their services as well, and the truth of those claims can’t be verified easily. But we shouldn’t have to settle for a buyer-beware mentality.

]]> By: Thomas Ames http://webiscope.com/2007/12/this-message-will-self-destruct-in-five-seconds/comment-page-1/#comment-251 Thomas Ames Fri, 14 Dec 2007 22:30:49 +0000 http://webiscope.com/2007/12/this-message-will-self-destruct-in-five-seconds/#comment-251 Not all of us are as technically proficient as you, Jake, haha. I'm long removed from my hacking and programming days, so I'm left with assuming (hopefully correctly) that their recovery plan is adequate. I think I'm in the same boat as many of us, where since we're such a small team and maintain mostly communications and marketing efforts on the Web, we simply assume everything is fine since they're the experts. So the question, then, is how can we who aren't that technically proficient ensure that the system is adequate? In our process of selecting a vendor we brought in a representative from IS who posed many questions that I didn't have a clue what they were about. Certifications, tests, redundancy, etc.; all I care about is if the Web site is up and if I can add a streaming video to the front page. Might be a good idea for the future to have someone such as yourself recommend a checklist of questions and adequate/satisfactory answers (that's incredibly difficult, I know). Not all of us are as technically proficient as you, Jake, haha. I’m long removed from my hacking and programming days, so I’m left with assuming (hopefully correctly) that their recovery plan is adequate. I think I’m in the same boat as many of us, where since we’re such a small team and maintain mostly communications and marketing efforts on the Web, we simply assume everything is fine since they’re the experts. So the question, then, is how can we who aren’t that technically proficient ensure that the system is adequate?

In our process of selecting a vendor we brought in a representative from IS who posed many questions that I didn’t have a clue what they were about. Certifications, tests, redundancy, etc.; all I care about is if the Web site is up and if I can add a streaming video to the front page.

Might be a good idea for the future to have someone such as yourself recommend a checklist of questions and adequate/satisfactory answers (that’s incredibly difficult, I know).

]]> By: Cap'n http://webiscope.com/2007/12/this-message-will-self-destruct-in-five-seconds/comment-page-1/#comment-250 Cap'n Fri, 14 Dec 2007 20:44:09 +0000 http://webiscope.com/2007/12/this-message-will-self-destruct-in-five-seconds/#comment-250 Chris: sounds like it's time for a field trip! I would think any place that advertises the seven-course meal ought to be able to show some proof - not necessarily with just service records, but hopefully documented fail-over test results, disaster recovery reports and security audit records. At a previous employer, they used to have disaster recovery practice once a year ... and sometimes unannounced practice. Talk about keeping the provider on their toes. But if you're curious about your provider's security ... what better way to find out than try & hack it yourself? Chris: sounds like it’s time for a field trip! I would think any place that advertises the seven-course meal ought to be able to show some proof – not necessarily with just service records, but hopefully documented fail-over test results, disaster recovery reports and security audit records. At a previous employer, they used to have disaster recovery practice once a year … and sometimes unannounced practice. Talk about keeping the provider on their toes. But if you’re curious about your provider’s security … what better way to find out than try & hack it yourself?

]]> By: Chris Sadler http://webiscope.com/2007/12/this-message-will-self-destruct-in-five-seconds/comment-page-1/#comment-249 Chris Sadler Fri, 14 Dec 2007 19:14:14 +0000 http://webiscope.com/2007/12/this-message-will-self-destruct-in-five-seconds/#comment-249 For those of us who understand (or not) what Cap'n is saying but couldn't possibly do it ourselves ... at what point do we trust the security assurances that we've been given by either our internal IT or, as in our case, by our development partners and hosting company? I mean, we pay a premium to be hosted at a data center that is independently audited and certified, has biometric entry, n+1 redundancies, dust-free air, etc. I always thought that seeking out this type of partner was enough; I can worry about other things. But now Stephen has me wondering ... For those of us who understand (or not) what Cap’n is saying but couldn’t possibly do it ourselves … at what point do we trust the security assurances that we’ve been given by either our internal IT or, as in our case, by our development partners and hosting company? I mean, we pay a premium to be hosted at a data center that is independently audited and certified, has biometric entry, n+1 redundancies, dust-free air, etc. I always thought that seeking out this type of partner was enough; I can worry about other things. But now Stephen has me wondering …

]]> By: Aaron Holbrook http://webiscope.com/2007/12/this-message-will-self-destruct-in-five-seconds/comment-page-1/#comment-248 Aaron Holbrook Wed, 12 Dec 2007 22:15:21 +0000 http://webiscope.com/2007/12/this-message-will-self-destruct-in-five-seconds/#comment-248 Nice work Cap'n. Not being an IT guy first and foremost, I wouldn't know really where to begin solidifying my site. It's a good thing to think about though, and I'll definitely be doing more research on it in the near future. I agree with Thomas, and just to reiterate, it was a nice refresher from some of the more regular topics that we see every day. Also: Regular Expressions rule! :) Nice work Cap’n. Not being an IT guy first and foremost, I wouldn’t know really where to begin solidifying my site. It’s a good thing to think about though, and I’ll definitely be doing more research on it in the near future.
I agree with Thomas, and just to reiterate, it was a nice refresher from some of the more regular topics that we see every day.

Also: Regular Expressions rule! :)

]]> By: Stephen Halsey http://webiscope.com/2007/12/this-message-will-self-destruct-in-five-seconds/comment-page-1/#comment-247 Stephen Halsey Wed, 12 Dec 2007 21:58:18 +0000 http://webiscope.com/2007/12/this-message-will-self-destruct-in-five-seconds/#comment-247 Agreed. That it was a remote vendor the second time around made it that much more disturbing. Form validation, etc are all good things to look at (especially anything involving post calls). Hiring developers that have an understanding about things like form validation is helpful and have at least a familiarity of what constitutes the majority of issues (you summed it up nicely Cap’n) is also really good to have. Getting web security bumped high enough on security agendas so that backend processes are looked at it as well is really key. To be fair, we have had a changing of the guard here over the past year, and the new guard are much more demanding, which is great. Not just for me and my team of course but for our site’s users who correctly expect our websites to be up and running 24/7. Agreed. That it was a remote vendor the second time around made it that much more disturbing.

Form validation, etc are all good things to look at (especially anything involving post calls). Hiring developers that have an understanding about things like form validation is helpful and have at least a familiarity of what constitutes the majority of issues (you summed it up nicely Cap’n) is also really good to have. Getting web security bumped high enough on security agendas so that backend processes are looked at it as well is really key. To be fair, we have had a changing of the guard here over the past year, and the new guard are much more demanding, which is great. Not just for me and my team of course but for our site’s users who correctly expect our websites to be up and running 24/7.

]]> By: Cap'n http://webiscope.com/2007/12/this-message-will-self-destruct-in-five-seconds/comment-page-1/#comment-246 Cap'n Wed, 12 Dec 2007 21:17:34 +0000 http://webiscope.com/2007/12/this-message-will-self-destruct-in-five-seconds/#comment-246 It's pretty disturbing that a remote vendor would find themselves in that situation; I can understand a "DIY" shop not having the tallest fences around its wares - but part of selling a service is considering security, uptime and reliability as important as the service/product itself. That includes redundant servers, backbones, backups, and stringent security measures as the first line of defense. The most common thing I run into here are script-kiddies trying to take advantage of any form they can find. Usually it's just a spambot trying to push levitra/cialis/viagra (or some mis-spelling thereof), but some of those are looking to exploit the mailserver as a relayer too. They're just ankle-biters though; the worrisome bunch are the ones trying to DoS and injection attacks on the databases. I built some common functions through which every form must get validated, which look for all the usual stuff (yay, regular expressions) - any form submission that fails skips right past the "real" processing. I want to expand upon this to record all the details of the offenders - IP addy, what they attempted and how - etc. It just helps me build my library of what to keep an eye out for. And that's only part of the front end ... It’s pretty disturbing that a remote vendor would find themselves in that situation; I can understand a “DIY” shop not having the tallest fences around its wares – but part of selling a service is considering security, uptime and reliability as important as the service/product itself. That includes redundant servers, backbones, backups, and stringent security measures as the first line of defense.

The most common thing I run into here are script-kiddies trying to take advantage of any form they can find. Usually it’s just a spambot trying to push levitra/cialis/viagra (or some mis-spelling thereof), but some of those are looking to exploit the mailserver as a relayer too. They’re just ankle-biters though; the worrisome bunch are the ones trying to DoS and injection attacks on the databases. I built some common functions through which every form must get validated, which look for all the usual stuff (yay, regular expressions) – any form submission that fails skips right past the “real” processing. I want to expand upon this to record all the details of the offenders – IP addy, what they attempted and how – etc. It just helps me build my library of what to keep an eye out for. And that’s only part of the front end …

]]> By: Thomas Ames http://webiscope.com/2007/12/this-message-will-self-destruct-in-five-seconds/comment-page-1/#comment-245 Thomas Ames Wed, 12 Dec 2007 19:42:37 +0000 http://webiscope.com/2007/12/this-message-will-self-destruct-in-five-seconds/#comment-245 I think many of us (particularly if we're small) rely on the assumption that if it's hosted internally, it's safe; if it's hosted externally, again, we're safe. But your situations have proven that might not be correct, and we have to do our due diligence to establish that the necessary resources and plans are in place in the case of hacker, disaster, or whatever else. Great post that hasn't been brought up before! I think many of us (particularly if we’re small) rely on the assumption that if it’s hosted internally, it’s safe; if it’s hosted externally, again, we’re safe. But your situations have proven that might not be correct, and we have to do our due diligence to establish that the necessary resources and plans are in place in the case of hacker, disaster, or whatever else.

Great post that hasn’t been brought up before!

]]> By: Aaron Holbrook http://webiscope.com/2007/12/this-message-will-self-destruct-in-five-seconds/comment-page-1/#comment-244 Aaron Holbrook Wed, 12 Dec 2007 12:41:12 +0000 http://webiscope.com/2007/12/this-message-will-self-destruct-in-five-seconds/#comment-244 Wow, that's an absolutely fantastic point. It's funny to think that not one person mentioned anything about this at the conference either. I think regardless of where your site is hosted, or what your position is asking the question of "What would we do if..." is really necessary. Not just if it's hacked, but also the disaster recovery plan? Do we have one? If not, what can we do to change that? Great post Stephen, I'm glad that your site wasn't too badly affected - looks like you got off with the right amount of a wake up call. I know what I'm going to be doing today... Wow, that’s an absolutely fantastic point. It’s funny to think that not one person mentioned anything about this at the conference either.

I think regardless of where your site is hosted, or what your position is asking the question of “What would we do if…” is really necessary. Not just if it’s hacked, but also the disaster recovery plan? Do we have one? If not, what can we do to change that?

Great post Stephen, I’m glad that your site wasn’t too badly affected – looks like you got off with the right amount of a wake up call.

I know what I’m going to be doing today…

]]>