Griffin Security Group

LEVEL 4 CERTIFICATE IN RISK MANAGEMENT (SECURITY)

2012-02-21T05:40:00.000-08:00

Griffin Security Group is now able to offer a LEVEL 4 CERTIFICATE IN RISK MANAGEMENT (SECURITY) accredited by Highfield Awarding Body for Compliance (HABC).

This 2 x 5-day course of theoretical and practical leaning is offered to students who wish to obtain a an accredited qualification in security management.

For further information contact us at +44 (0)1636 643915 or nikki.ashe@griffin-group.co.uk

TERRORIST THREATS TO FOOD AND DRINKS INDUSTRY

2011-06-05T01:42:00.000-07:00

Today’s (5^th June 2011) in The Sunday Telegraph is, “SHOPS WARNED OVER TERRORIST THREAT TO FOOD.”

The Critical Centre for the Protection of National Infrastructure (CPNI) recently sent a report to companies in the food industry warning them of possible threats to their manufacturing operations.

The media are now suggesting links between the E.coli outbreak in Germany and the vulnerabilities to the World food chain. The recent E.coli outbreak has demonstrated how quickly bacteria can be spread – currently this highly virulent strain of E.coli has resulted in 18 people dead and 18,000 people seriously ill. According to The Sunday Telegraph report, Klaus-Dieter Zastrow, chief doctor for hygiene at Berlin’s Vivantes hospital, said: “It’s quite possible that there’s a crazy person out there who thinks 'I’ll kill a few people or give 10,000 people diarrhoea’.”

I wonder how many company executive and managers in the food and drinks industry are familiar with PAS 96:2010 - Defending food and drink. This Publically Available Specification (PAS) provides “Guidance for the deterrence, detection and defeat of ideologically motivated and other forms of malicious attack on food and drink and their supply arrangements.” The opening statement in the PAS says:

“The food and drink industry in the UK – the food sector of the national infrastructure – could be under threat from ideologically motivated groups. The threat extends that from criminals who use extortion and from individuals with a grudge. It is different in nature from the (natural) hazards which the industry is well versed in handling. The threat is unlikely to decline in the foreseeable future.”

These security concerns extend far beyond the shore of the UK. In the USA food bioterrorism has become a major concern after documents were found in Afghanistan apparently referring to plans by terrorists to contaminate supplies.

All food production facilities and the supply chains should review their security controls to ensure that not only the physical security protective measures are effective but also the human factors, including screening of staff and the close supervision of staff.

Griffin Security Group

www.griffin-group.co.uk

Security of Cloud Computing

2011-05-30T03:29:00.000-07:00

Once again we return to the subject of Cloud Computing and outsourcing the storage of data.

Before you enter into a contract with a Cloud Computing provider and start to upload your data, you should at least consider these areas of concern:

· Where is the data stored? Because you are uploading data via the internet you are unlikely to know where your data is being hosted. Ask the provider where the data centers are located – in your own country or overseas.

· Who has access to your data? – Privileged users are likely to be able to access your data because they are able to bypass the physical, logical and personnel controls. Ask your provider what security vetting they carry out on the privilege access staff and what monitoring of their access is conducted.

· Data Segregation - Data in the cloud is typically in a shared environment alongside data from other customers. Find out how your provider segregates your data from that of other clients. Is data encrypted on their servers?

· Regulatory compliance – You are ultimately responsible for the security and integrity of your own data, even when it is held by an outsource provider. Cloud providers should be subjected to external audits and security certification, i.e. ISO/IEC 27001:2005. If your provider cannot provide evidence of audits and certification, look for someone who does.

· Business Continuity & Data Recovery – Who do you know that your data will always be available when you want to access it? What provisions has your provider made for business continuity and data recovery? How long will this take? Do you have local backups of the data you have stored remotely?

· How will you access your data if your Internet connections fail? – Access to your data is reliant upon your being able to access the Internet. It is quite common for Internet connections to fail and sometimes this can takes days before the connectivity is restored. Once again, Do you have local backups of the data you have stored remotely?

· Computer forensics support - Investigating inappropriate or illegal activity may be impossible in cloud computing! The analyst firm Gartner warns, “Cloud services are especially difficult to investigate, because logging and data for multiple customers may be co-located and may also be spread across an ever-changing set of hosts and data centers. If you cannot get a contractual commitment to support specific forms of investigation, along with evidence that the vendor has already successfully supported such activities, then your only safe assumption is that investigation and discovery requests will be impossible."

· What is the long-term viability of the provider? – If your provider were to “go bust”, how would you be able to recover your data? What if the outsource provider were to be acquired by another company; would the provisions you have already contracted (especially those relating to location, access and security be retained).

Users of Cloud Computing Services need to understand the potential risks to their data. They should ensure that the fundamental principles of Information Security are maintained:

· Confidentiality - Ensuring that information is accessible only to those authorized to have access

· Integrity - The assurance that data has not been changed inappropriately, whether by accident or deliberately malign activity.

· Availability – Ensuring that data is available to access whenever it is required.

www.griffin-group.co.uk

Access to your data stored in "The Cloud"

2011-05-02T02:23:00.000-07:00

“The online retailer Amazon has apologised for a fault in its web hosting service EC2, which knocked out many well-known websites.

EC2- Elastic Compute Cloud - provides processing power and storage to companies that do not have their own data centres.” [Source: BBC]

Accessibility to your data can be compromised if you rely upon remote data storage, such as “The Cloud”. As a user, you are totally reliant upon the reliability of the Cloud Service Provider. For those who had data stored on the new Amazon Cloud, they would not have had access to their own information for a number of days. It is important, therefore, that you back-up and have access to your data even when the Cloud is not available.

We recently experienced problems with our Internet service which took over a week for British Telecommunications to resolve. Had we been using “The Cloud” we would not have had access to any of our material during that period.

At the IAPSC Conference in San Diego I spoke about security of “The Cloud”. This incident with Amazon only goes to demonstrate how careful we need to be with our own information and data.

APPLE CAN TRACK USERS' MOVEMENTS

2011-04-23T17:19:00.000-07:00

Anyone who attended the International Association of Professional Security Consultants (IAPSC) Conference in San Diego, California this week will not be surprised by the media announcement that Apple iPhone and iPads are recording and storing details of all their owner’s movements.

During the Tuesday afternoon session at the conference I mentioned that the location data was being captured by the applications on the iPhone and iPad and that this could be used to trace the movements of the owners. The files are unencrypted and collect the location data without users' knowledge or consent. Pretty creepy!

Interestingly, Apple have not made any response to the press revelations. However, some have opined that it appears to be covered in the company’s terms of use.

IAPSC Conference

2011-04-21T17:32:00.000-07:00

I have just attended the International Association of Professional Security Consultants (IAPSC) Conference which was held in San Diego, California from the 17^th to 20^th April.

Over 3 days the 61 members attending were entertained, mentored and informed by a variety of speakers covering diverse subjects, including: marketing, writing proposals, use of digital images, lighting, holistic convergence consulting, greater consultant collaboration and much, much more!

On Monday evening we attended a dinner cruise on San Diego Bay. Tuesday evening was the usual reception, dinner and awards ceremony. The evening entertainment was from Reggie Brown a Barack Obama impersonator – and a very good impersonator he is.

The Conference Chairman was my friend John (Jack) Case from Del Mar, California. Jack has spent almost 8 months putting this conference together with some of his colleagues and what a wonderful job they have done.

I look forward to next year's conference being held in Miami.