O on the Spot

What Is The Global Data Protection Regulation?

2017-08-02T12:00:00.000-07:00

The Global Data Protection Regulation (GDPR) addresses data privacy's "right to be forgotten" and impacts all companies that either do business with EU citizens, or operate in the EU. This new regulation that will go into effect May 2018 and will have a global impact on companies storing personal data of EU citizens and residents.

Personal user data is defined by the GDPR as web forms, cookies, user preferences, etc. The fundamental change is that companies that provide third party services, such has cloud hosting, will be held jointly liable for data breaches by the GDPR “which will affect technology service providers in particular.”

Key changes to EU data protection introduced by the GDPR
 More rigorous requirements for obtaining consent for collecting personal data.
 Raising the age of consent for collecting an individual’s data from 13 to 16 years old.
 Requiring a company to delete data if it is no longer used for the purpose it was collected.
 Requiring a company to delete data if the individual revokes consent for the company to hold the data.
 Requiring companies to notify the EU government of data breaches within 72 hours of learning about the breach.
 Establishing a single national office for monitoring and handling complaints brought under the GDPR.
 Firms handling significant amounts of sensitive data or monitoring the behavior of many consumers will be required to appoint a data protection officer.
 Fines up to €20m or 4% of a company’s global revenue for its non-compliance.

The GDPR can be broken down into three categories reflected in the regulation
 Compliance journey

Requires entities to map and classify all their personal data
Performs risk assessments
Designs privacy protections into all new business operations and practices
Employs dedicated data protection officers
Monitors and audits compliance
Documents everything they do with data and everything they do to achieve legal compliance.

 Transparency framework

How entities deal with contracts (language in contracts of third parties)
How entities provision users and their permissions and privileges to see user data
How they communicate full user information concerning personal data
Breach notification to users and regulators.

 Enforcement (Sanctions and Remedies)

Regulator will have authority to levy extensive fines
“Right to be forgotten”
“Right to data portability”
Right to access their data
Right to end use of their data

EU Citizen or EU resident’s personal data that flows out of the EU to non-EU jurisdictions will be highly discouraged.

What is the Impact on US Businesses?
Does your organization have an office in the EU?

Do you have servers or “cloud” in a non-EU jurisdiction that contains EU Citizen or EU resident personal data?

 This law does indeed apply to organizations based outside the EU, too, like the
United States, Canada or China. 3
 EU-GDPR applies to data ‘controllers’ and ‘processors’

Does your organization employ more than 250 employees? What personal data of European residents do you collect and how do you process it? I recommend an information audit of any system that might collate or process personal data of European subjects.

Sources:
http://eur-lex.europa.eu/legal-content/EN/TXT/?qid=1497261922341&uri=CELEX:32016R0679

http://www.computerweekly.com/news/4500270456/EU-data-protection-rules-affect-everyone-say-legal-experts

https://tbgsecurity.com/eu-gdpr-demystified-a-straight-forward-guide-for-us-firms-part-1/

Top 10 Common Firewall Config Errors

2017-08-01T12:00:00.000-07:00

You know there's nothing I like better than sitting down with fresh firewall report and explaining why ANY rules are not your friend as far as PCI compliance is concerned. Below are the top 10 compliance busting rules and why your should tweak them before a QSA comes along:

1. No HTTPS Server Session Timeout

HTTPS server session should expire to prevent the possibility of hijack my a man in the middle attack. Set them to 10 minutes to avoid a finding.

2. Filter Rules Allow Packets From Any Source
3. Filter Rules Allow Packets To Any Destination

These 2 rules do have to take the role of the internal host on the network as a rule on side of this transaction should specific a specific IP address to avoid a lengthy explanation to the assessor.

4. Filter Rule Allows Packets To A Port Range
5. Filter Rule Allows Packets To A Port
6. Rules Allow Access To Clear-Text Protocol Services
7. Filter Rules That Allow Any Protocol Were Configured

These 4 rules show that you as a firewall administrator know what and where your data is going.

8. Rules Allow Access To Potentially Unnecessary Services

Good operational hygiene will prevent this problem cropping up. If it doesn't need to be in the rule take it out. If the rule is useless delete it.

9. Clear-Text SNMP In Use

Practically every network I've work on as never used SNMP. Disable it.

10. Syslog Logging Configured With No Encryption

Your Syslog messages between the client and the Syslog server host could ne intercepted. You don't want bad actors intercepting your firewall logs.

Needles In A Stack of Needles

2017-07-31T12:00:00.000-07:00

When I was an IT Manager and had to deliver daily, weekly and monthly reports that "showed" how secure the business was, I used different products that would just pump out a lot of noise. None of them would explain what to filter for and why. So here are a few metrics to filter for and measure over time to spot a compromised workstation:

1. Your firewall monitor connections from your internal servers to external hosts (The Internet). This log record should return the following:

packet time

packet interval

packet size

The number of packets

Tracking these to give a basic metric for for your network. Then use a tool like Splunk to filter for any activity over the thresholds. The indicator here is if any workstation is sending large packets out of your network for a sustained amount of data then this is a potential breach unless the behavior can be explained.

2. LDAP Query Traffic

Active Directory is an easily exploitable source of information regarding your network. It's designed to be helpful and as such can be used by bad actors to get information. So too many queries to AD can be an indicator of compromise that you want to look out for. These queries will show up in your DC's event logs which will allow you to capture and filter for any workstation making too many of these query. Your looking for a spike that stands out the norm. Using LDAP traffic as a metric from your endpoints to map or use as a metric possible compromised workstations.

If you want to look more into this, visit Paul's Security Weekly on audiboom

Lots of Amendments in the Florida Ballot 2012

2012-10-25T08:07:00.001-07:00

FYI. Read them early. There are a lot of amendments on this years ballot

http://ballotpedia.org/wiki/index.php/Florida_2012_ballot_measures

Orencio Cárdenas

(786) 379-5011

orencioc@gmail.com

Twitter: orenciocardenas

www.orenciocardenas.com

If it’s not right, don’t do it. If it’s not true, don’t say it

Marcus Aurelius

Posted via email from Orencio's posterous

Win 8 for $40 Great Deal

2012-07-06T12:18:00.001-07:00

Great Deal from Microsoft! $40 to Upgrade from Win XP & 7! Get it while it lasts!

http://goo.gl/Qa41E

Orencio Cárdenas

2012-02-17T11:57:00.001-08:00

Eric"s question (mp3)

Posted via email from Orencio's posterous

Article: Man Arrested After Trying To Split Atoms at Home

2011-08-04T18:28:00.001-07:00

Orencio Cárdenas

(786) 379-5011

orencioc@gmail.com

---------- Forwarded message ----------
From: Orencioc <orencioc@gmail.com>
Date: Thu, Aug 4, 2011 at 4:03 PM
Subject: Article: Man Arrested After Trying To Split Atoms at Home
To: orencioc <orencioc@gmail.com>

Man Arrested After Trying To Split Atoms at Home
http://mashable.com/2011/08/04/man-arrested-split-atoms/

(Sent from Flipboard)

Orencio Cardenas

(786) 379-5011

Posted via email from Orencio's posterous

Leaving for Spain

2010-06-20T05:19:00.001-07:00

Listen!

via AudioBoo

Posted via web from Orencio's posterous

Public vs Private Cloud Computing and Companies

2010-06-10T09:59:00.001-07:00

I found these articles insightful regarding the decisions that companies face regarding cloud computing. It seems that “Private” cloud computing is an option that companies are considering when security, privacy and control cannot be ceded to a “public” cloud. Yet the cost savings and flexibility of outsourcing your infrastructure is very appealing to those that make decisions.

“An organization with a large internal IT estate may wish to repurpose some of this to create a private infrastructure cloud--a sound way to increase utilization of existing assets and consider the internal economics of providing IT as a service.”Owen Garrett, “Keeping Cloud Costs Grounded”, 2010, <http://www.forbes.com/2010/06/02/internet-software-zeus-technology-cloud-computing-10-garrett.html?partner=email>(accessed June 04, 2010).

“As cloud computing shows its strengths in flexibility and economical operations, corporate computing operations are taking notice--even at companies that are too conservative to place much trust in the cloud services on the Internet. So now we hear a lot of talk about "private clouds," which usually mean server clusters behind the corporate firewall that mimic the operation of the public clouds.”David F. Carr, “What Cloud Computing Means”, <http://www.forbes.com/2010/06/02/microsoft-google-amazon-technology-cloud-computing-10-leaders.html?partner=email>(accessed June 04, 2010).

Can medical organizations go with IaaS (Infrastructure as a Service) and still meet HIPPA compliance? Will relying on the vendor’s best practices on securing patient data be sufficient to avoid government fines in the event of a breach? These are questions that have not been answered and unfortunately may not have an answer until the first breach occurs. I would expand on David F. Carr statement that not only “companies that are too conservative”, but industries that are too conservative like banking, medical will need to be slow to move towards public cloud computing. Any company that deals intimately with user privacy will need to experiment with the private cloud computing option before they ever considering the public aspect of cloud computing.

Posted via email from Orencio's posterous

Check you settings

2010-06-04T05:08:00.001-07:00

This site made fixing my setting for my privacy reeeeally easy. I think FB has been really useful for connecting with friends but let’s face it they are pimping out our info to make money which isn’t cool. So check your setting and close the door to protect your info and your.

http://www.reclaimprivacy.org/

Posted via email from Orencio's posterous

Progress AI Roll forward Issue

2010-06-01T06:31:00.001-07:00

C:\Intergy\DB>rfutil medman -C roll forward -a D:\int_bkp\CopyAI\medman.a4

OpenEdge Release 10.1B0347 as of Tue Feb 3 10:20:44 EST 2009

** The database was last changed Thu May 27 21:13:10 2010. (831)

** The after-image file expected Tue May 25 21:00:04 2010. (832)

** Those dates don't match, so you have the wrong copy of one of them. (833)

roll forward open D:\int_bkp\CopyAI\medman.a4 error: -1. (11014)

I got a response from Donald Church that explained what’s going on:

“Glad to hear that the training is proving useful – and I think I know what is happening with your AI roll. According to your screenshots, you restored a backup that was made at 12:30 AM on 27 May. This would mean that at that time an AI switch would have occurred, the previous AIs copied to the backup folder and all copied AIs would have been remarked as empty. (This is assuming you had used the backup script and not a manual backup)

What the message in the Roll Forward of .a4 is telling you is that at some point after the restore, around 9:13 PM, the database was started and records began to be written. So if you imagine for a moment that the database was on record 10,000 at the time of backup, the AI file immediately started would have recorded record 10,001. But by starting the database at 9:13, a new record 10,001 was written along with whatever data followed thereafter. Now fast forward to 10:20 PM when you attempt the Roll Forward – you are asking the database to accept the original record 10,000 from the AI file when it is now on record 10,012 or something due to the database running since the restore. In a nutshell, by using the database after the restore, you invalidated all those AI records since they are sequential for only the original data.

This is similar to the issue in the movie ‘Back to the Future, Part II’ – Doc and Marty couldn’t fix what Biff did with the sports almanac in the future because if they traveled to the future, it would be the alternate future where Biff was powerful. The solution to your problem is the same as what they did in the movie – go to the past and fix it there. Restore the database from the backup again and Roll Forward the AIs without starting the database this time. That will make the numbers be in sequence and work.

The only caveat to all this is whether or not AI was turned on after you did the original restore – if so, you might have AI data based off all the records that the database added after the restore at 9:13 PM. Luckily, RFUTIL is pretty smart and will notice those records don’t match on time stamps and have wrong sequence numbers.”

Orencio Cárdenas

IT Manager

Femwell

Tel.# 305-273-4641 X141

Tel.# 305-631-7670 Help Desk

Cell# 786-566-8457

Posted via email from Orencio's posterous

Progress AI Roll forward Issue

2010-06-01T06:26:00.001-07:00

I had an issue with restoring my Progress database and the AI roll forward process that has me a little stumped. I restored the backup from 5/27 12:30AM without incident. During the evening I went and copied over the AI files for that day as seen at the very bottom. Below I copied the command prompt for the session I was using during the roll forward operation.
C:\Intergy\DB>rfutil medman -C roll forward -a D:\int_bkp\CopyAI\medman.a4
OpenEdge Release 10.1B0347 as of Tue Feb 3 10:20:44 EST 2009
** The database was last changed Thu May 27 21:13:10 2010. (831)
** The after-image file expected Tue May 25 21:00:04 2010. (832)
** Those dates don't match, so you have the wrong copy of one of them. (833)
roll forward open D:\int_bkp\CopyAI\medman.a4 error: -1. (11014)
I got a response from Donald Church that explained what’s going on:
“Glad to hear that the training is proving useful – and I think I know what is happening with your AI roll. According to your screenshots, you restored a backup that was made at 12:30 AM on 27 May. This would mean that at that time an AI switch would have occurred, the previous AIs copied to the backup folder and all copied AIs would have been remarked as empty. (This is assuming you had used the backup script and not a manual backup)

What the message in the Roll Forward of .a4 is telling you is that at some point after the restore, around 9:13 PM, the database was started and records began to be written. So if you imagine for a moment that the database was on record 10,000 at the time of backup, the AI file immediately started would have recorded record 10,001. But by starting the database at 9:13, a new record 10,001 was written along with whatever data followed thereafter. Now fast forward to 10:20 PM when you attempt the Roll Forward – you are asking the database to accept the original record 10,000 from the AI file when it is now on record 10,012 or something due to the database running since the restore. In a nutshell, by using the database after the restore, you invalidated all those AI records since they are sequential for only the original data.

This is similar to the issue in the movie ‘Back to the Future, Part II’ – Doc and Marty couldn’t fix what Biff did with the sports almanac in the future because if they traveled to the future, it would be the alternate future where Biff was powerful. The solution to your problem is the same as what they did in the movie – go to the past and fix it there. Restore the database from the backup again and Roll Forward the AIs without starting the database this time. That will make the numbers be in sequence and work.

The only caveat to all this is whether or not AI was turned on after you did the original restore – if so, you might have AI data based off all the records that the database added after the restore at 9:13 PM. Luckily, RFUTIL is pretty smart and will notice those records don’t match on time stamps and have wrong sequence numbers.”

Intergy Backup Restore Checklist

2010-06-01T06:19:00.001-07:00

I’ve been restoring our Intergy database on Progress and I developed this checklist below to help define the process. I read the Checklist Manifesto and found the overall message really applicable to IT tasks.

Intergy Backup Restore Checklist

r 1. Is the medman.odbk file from the previous date on the Intergy Backup Server (INTBKPSRV)

o If NO find it on \\192.168.3.200\share\int_bkp and move to INTBKPSRV.

r 2. Copy AI files from Production server to AI drive on INTBKPSRV

r 3. Confirm that drive structure matches production environment

o D = AI

o E = BI

o F = DB

r 4. Before Installing run (install.exe user \) prior to running the setup.exe for Intergy.

r 5. Install Intergy Server (Point DB to drive F)

o EHR

o Storage Server

o Patient Portal

o > 50 Users

r 6. AI & BI file locations: During installation you must point Intergy toward the appropriate drives for where this data will reside. (See step 2)

r 7. After Server Restart Launch Database Administration

r 8. Choose Enterprise 80 GB

r 9. Redirect the AI, BI and DB to the correct drive paths

r 10. Navigate in Command Prompt to c:\intergy\db to run all commands

r 11. Intergy large File Support: To add support for larger than 2GB storage area files, run the following command:

o PROUTIL medman –C enablelargefiles

r 12. Consult the medman.lg file for detailed information concerning the database.

r 13. Shutdown Database: promon medman Option 8 then Option 2

r 14. VERIFY DATABASE: prorest medman D:\IntergyBackup\medman.odbk –vp

r 15. DELETE DATABASE FILES: prodel medman

r 16. RESTORE DATABASE: prorest medman D:\IntergyBackup\medman.odbk

r 17. Launch “Database Administration” and Start the database.

r 18. Run Intergy, Intergy EHR and Test

ROLL FORWARD

r 19. RESTORE FILES FROM LAST BACKUP: rfutil medman –C roll forward –a <afile#>

r 20. ENABLE AI: rfutil medman –C aimage begin

POST RESTORE STEPS

r 21. Verify Cluster size: proutil medman –C truncate bi 16384

r 22. Verify AI is enabled: rfutil medman –C aimage extent list

r 23. RESTART SERVER (After restart review the medman.lg file to ensure proper database start up.

Restore database without loading Intergy

r Repeat Steps 12 through 18

Intergy Testing

r Login to 10 random Data Sets

r Check patient demographic data in Intergy PM and Intergy EHR.

r Check patient billing data in Intergy PM

r View EOB image from DOM

r Print Encounter form

r Print Schedule Summary for the day

r Change patient demographic and billing data

r Make a backup of new changed database. (45 min)

r Restore original database and have Operations validate that data is gone. (45 min)

r Restore changed database and have Operations validate that data is restored. (45 min)

Orencio Cárdenas

IT Manager

Femwell

Tel.# 305-273-4641 X141

Tel.# 305-631-7670 Help Desk

Cell# 786-566-8457

Posted via email from Orencio's posterous

Traveling

2010-05-21T19:00:00.001-07:00

Listen!

via AudioBoo

Posted via web from Orencio's posterous

Karate Kid - Mr Han is no Miaghi

2010-05-20T18:59:00.001-07:00

Good movie that is worth seeing. Story mirrors the original. Mr. Han is the new Mr. Miaghi but not as good. Tournament fight scenes were awesome.

Posted via email from Orencio's posterous

Setting up Dell Equlogic

2010-05-04T08:26:00.001-07:00

Got all the gear in for setting up a productio and staging environment. Working on Dell storage now.

Posted via email from Orencio's posterous

Pivot Software - Must Watch

2010-03-17T03:30:00.001-07:00

This is a very cool software that presents data in a fresh and visual way. I downloaded it after and it was every bit as cool as the presentation.

Posted via email from Orencio's posterous

What customer information is at your fingertips?

2010-03-06T09:06:00.001-08:00

What are the products you are offering that your customers are buying? From
the content of your data, can you tell what your customers are interested
in? What part of your data would be most relevant for determining potential
future products and services? What are you doing with that data? Can your
data tell you what is changing about your customers purchasing history?
What assumptions can you make about your customers? How do certain customer
segments use your services or products?

Take a long hard look at the information you have collected to date.
Understanding this data and what it tells you about your customers and their
purchasing practices is critical to business sustainability. If you have
gaps of information, think about what other types of information you can
collect that would be useful to your business. This information will be
critical to planning your future business strategies and tactics. You need
to keep learning about your customers, the market and what is selling.
Understanding what is selling and how it is selling is important to you and
your business.

But customer information isn't the only critical information you own. Data
related to product production and purchasing becomes key for your business
operations. How you use resources to bring products and services to market
matters to the bottomline. Understanding when you are paying too much for
something or wasting resources becomes critical to minimizing expenses and
maximizing profits. Therefore analyzing this data is just as important as
analyzing customer information.

So in the end, you need to ask yourself what customer and operational
information do you have at your fingertips? If you aren't able to get
valuable information about your customers or business operations from your
data, then you need to get someone to do it for you or outsource it but
don't just let that information sit there untapped and unused because it
could mean the difference between a successful business or no business.=

Posted via email from crunchthisinfo's posterous

Social Networks and Medical Organizations

2010-02-05T06:54:00.001-08:00

Great website that highlights how Hospitals are using Social Networks. It’s interesting to see that from the 31 state, in patient hospitals listed with You Tube, Facebook and Twitter only 4 are in Miami.

http://ebennett.org/hsnl/

Outsourcing Social Media Efforts may not work because people are interested in having authentic communications through social media not just a “please hold” script.

Posted via email from Orencio's posterous

Explaining Healthcare Issues

2009-10-27T14:00:00.001-07:00

I think that these podcasts really do a great job of explaining, in an entertaining way, the healthcare issues currently in the news.

TDT#81: Seeking Truth in Health Care Reform--Dr. Bill Mayer & Dr. Scott Gibson

This American Life – Episode 392: Someone Else's Money 10/16/2009 & 391: More Is Less 10/9/2009

Posted via email from Orencio's posterous