The ThreatStats section of the April 2012 issue of SC Magazine lists the top data breaches of the month. At the top of the list is Piedmont Behavioral Healthcare in Concord, NC with 50,000 records breached. The reason? An Alamance County employee mistakenly changed a lock on the facility that housed data servers with personal health information. Amazing how one simple mistake put the records of all those people at risk.

Next is the St. Joseph Health System in California with 31,800 records breached. It seems that protected patient information from several hospitals may have been available on the Internet for one year. Again, unbelievable!

The last one is Central Connecticut State University with 18,763 records breached. The reason listed is a malware infestation exposed the information of current and former faculty, staff, and student workers.

Another staggering statistic is the total number of records containing sensitive personal information involved in security beaches in the U.S. since January 2005: 544,669,041!

SC Magazine lists the source of this information as the Privacy Rights Clearinghouse (data from a service provided by DataLossDB.org hosted by the Open Security Foundation).

Don’t add yourself to this list. To learn how you can prevent network breaches from unauthorized network connections and out-of-compliance devices, take at look at Black Box's Veri-Nac®.

For easy WAN encryption with no VPN tunnels, take a look at EncrypTight®.

A common vulnerability in wireless networks is in their ability to create unexpected connections that can result in security gaps. Here are five common wireless security bandits to watch out for:

1.   The rogue access point (AP). A rogue access point is an unauthorized access point connected to your wired network, generally connected by someone in your organization trying to set up do-it-yourself wireless service. Although rogue access points are usually installed innocently enough, they can provide an unsecured gateway right into the heart of your network.

2.   The ad-hoc client. Ad-hoc mode is the ability of wireless devices to connect directly with other wireless devices without accessing an access point. If a computer on your wired network sets up an ad-hoc wireless connection to another computer, that other computer can gain access to your network through the ad-hoc computer.

3.   The out-of-compliance access point. Older access points that have not been updated to the latest firmware release may open your network to hackers. Keeping all the equipment on your network up to date with firmware releases will protect your network from attack to known vulnerabilities. Not doing this can weaken security and reduce network performance. Out-of-compliance access points tend to be a problem in organizations that do not have a security policy that addresses keeping all equipment up to date on their firmware releases.

4. The mis-associated client. This is a problem, not with your wireless network, but with nearby wireless networks. When a wireless client has more than one wireless network to choose from, it may accidentally connect to the wrong network. This kind of mis-association, especially if it’s by a laptop also connected to your wired network, creates a security breach. Although mis-association is usually accidental, a hacker may deliberately create a decoy wireless network that looks like yours in order to fool users into logging on. This connection then allows the hacker to steal passwords and attack your wired network.

5. The non-traditional wireless device. It’s easy to focus on laptop computers and forget about other wireless clients such as personal Bluetooth® devices, cell phones, bar-code readers, and printers that may also use your wireless network. All these devices are vulnerable to cracking and may present an entry to your network to an enterprising hacker.

Your best defense against these common security bandits is a cohesive security strategy that includes network access control, regular site surveys, and a consistent, up-to-date security policy. A centrally managed wireless system makes planning and enforcing network security far more efficient than in “traditional” wireless networks with autonomous access points. Managed systems can often be set to independently handle tasks such as network access control and rogue mitigation, making life far easier for time-stressed IT managers.

Because wireless networks are particularly vulnerable to attacks, security is a primary concern. Wireless networks can be hacked by “war drivers“—who cruise around looking for a wireless signal to exploit. Usually war drivers are just looking for free Internet access, but sometimes they’re looking for confidential information such as credit card numbers.

Although a wireless network can never be totally secure, there are important steps you can take to minimize the risk:

1. Know how far your signal extends.
When you install a wireless network near public areas, it’s very important to know where your signal is going. If it’s easily picked up outside your business—perhaps from a parked car across the street or from the building next door—then you’ve got a security problem. If you send a strong wireless signal into the coffee house next door to your business, chances are someone is going to try to take advantage of it.

A wireless analyzer can help you map exactly where your access points are sending their signals. This can help you arrange the access points in your network in order to minimize signals in public areas and maximize signals to your users. A wireless analyzer can also spot unauthorized wireless access points attached to your network as well as other wireless networks broadcasting in your area. A wireless analyzer may be a freestanding application or may be part of a wireless management suite. Newer wireless mesh products often feature cloud-based management that includes wireless analysis.

2. Separate your wired network from your wireless network.
To add a layer of security to your wireless network, separate it from your wired network by gathering all your wireless access points into a separate LAN connected to the DMZ port of your firewall. This makes the wireless network accessible, yet safely outside of your main wired LAN. Once you separate the wireless from the wired network, insist that anything that needs to be kept secure stay on the wired network. This includes confidential data such as credit card numbers, sensitive financial data, or corporate secrets of any kind. You can, however, freely use the wireless network for less-sensitive applications such as notebook computers for taking notes at meetings, PCs for temporary workers, computer hookups for trade show booths, and bar-code readers for inventory.

3. Use encryption to lock out unauthorized users.
Any wireless signal, no matter how heavily encrypted, can be broken into eventually. Encryption isn’t perfect, but it can go a long way towards discouraging the casual hacker—the trick is to make breaking into your network so difficult that the hackers don’t bother. Be sure to use encryption and, rather than easily hacked WEP, use higher-level encryption schemes such as Extensible Authentication Protocol-Transport Layer Security (EAP-TLS).

4. Have a security plan and implement it. Seriously.
With a wireless network, as in any other network, it’s important to have a security plan and then implement it. The biggest security problem with wireless security is that network administrators often fail to take even the simplest of steps to ensure security, do not activate encryption at all, or fail to change the default passwords. When you fail to take these basic precautions, you leave your wireless network extremely vulnerable to casual hacking.

Yes, a wireless network is less secure than a wired network, but if you pay attention to your wireless network and implement a sensible security plan, you won’t find yourself blindsided by its vulnerabilities.

Is your hospital using a PACS system? Although this way of digitally sending images eliminates the need to manually retrieve and transports files, your PACS system may not be performing as quickly as your organization needs. If these images are being transmitted to another facility in another town, state, or even country, the latency of your connection can cause the transfer to take FOREVER. And in emergency situations where there are life-or-death implications, this delay is unacceptable.

Many healthcare institutions with multiple locations have experienced slow DICOM transmission across their WAN links, and have looked for solutions to improve transmission speeds (usually due to the critical nature and timeliness of the transmissions). WAN acceleration or WAN optimization devices help speed up these transmissions. But are your devices packing the 1-2-3 punch that Black Box provides?

While some traditional WAN acceleration or optimization technologies have been used by healthcare organizations and have provided some relief in certain situations, there are two basic technological or architectural problems that are limiting the benefits of these technologies in other applications.

Punch #1 and #2 – Cashing and Compression

Most WAN acceleration or optimization technologies involve caching or compressions. This approach can help in some cases, but in others it can be very limiting. Caching benefits transmission speeds by taking frequently requested data and storing it locally (instead of sending it across the internet each time you need it); this can help with web pages or other frequently used info, but doesn’t help much if the information being requested is unique medical images. Compressions can help by shrinking the file size of the data being sent, but many PACS systems have modes where they pre-compress the data before sending it. In this case, the compression attempts by other WAN accelerator appliances can actually slow down the transmissions.

Punch #3 – Protocol Optimization

Black Box can help PACS systems communicate across multiple locations with one or both of the following products:

Opti-WAN: A family of WAN Acceleration appliances, the Opti-WAN does not use compression or caching to achieve its speed gains. The Opti-WAN is specifically designed for long-distance or high-latency WAN connections. It accelerates links from a 1-Mb to a 1-Gb connection by accelerating and making more efficient all TCP/IP transmissions. Speed improvements can be as small as 20% or as high as 10x or more (depending on latency and other factors). DICOM traffic is one of the many formats that are helped by Opti-WAN.

Optinet:  A family of secure web gateways, the Optinet provides packet-level visibility into the traffic going through your Internet gateway.  By gaining this visibility, it allows the organization to identify critical traffic and accelerate it through the gateway.  The ability to take DICOM transmissions from a PACS system and elevate it past all e-mail and general web browsing traffic can substantially increase the throughput.  Traditional gateways don't have the Layer-7 inspection capabilities of Optinet, and would have trouble identifying and selectively prioritizing unique traffic such as DICOM.

Think of all of the archived charts, pictures, x-rays, and other important files in your organization. Plus, many times a patient's records involve several pictures in a series, from different angles, or with different filters. With the proper WAN appliances, PACS can efficiently deliver critical information; saving time, money, and lives.

It should come as no surprise that the federal government is concerned about signal leakage. In fact, its interest goes back to the days of World War II when the Army was trying to exploit weaknesses of enemy combat phones and radio transmitters. Since then, the scope of the government’s interest has broadened beyond the battlefield. In the last 40 years, the National Security Agency (NSA) has taken several industry measurement standards for signal protection and greatly enhanced them.

These enhanced criteria are commonly referred to as the TEMPEST standards (although the NSA also calls them EMSEC standards, short for “emissions security”). TEMPEST pertains to technical security countermeasures, standards, and instrumentation that prevent or minimize the exploitation of vulnerable data communications equipment by technical surveillance (AKA eavesdropping!). It involves designing circuits to minimize emanations. Another set of testing standards is called Common Criteria (EAL4+). Both standards are important, but they test for different things.

TEMPEST

Many things put your data communications at risk. Any device with a microchip generates an electromagnetic field, often called a “compromising emanation” by security experts. With the proper surveillance equipment, these emanations can be intercepted and the signal reconstructed and analyzed. Unprotected equipment can, in fact, emit a signal into the air like a radio station—and nobody wants to risk his or her job and a whole lot more by broadcasting national security or trade secrets to the wrong people.

Some of the most vulnerable equipment includes speakerphones, printers, fax machines, scanners, external disc drives, and other high-speed, high-bandwidth peripherals. And if the snoop is using a high-quality interception devices, your equipment’s signals can be acquired up to several hundred feet away.

TEMPEST testing, while classified, is regarded as a process that assesses the threat of data linking by various covert electromagnetic eavesdropping mechanisms. TEMPEST testing and certification is often required by military organizations, and ensures that equipment is designed to minimize emanation.

The TEMPEST standards require red/black separation. In military and government IT setups, that is the most common segregation between secure and non-secure networks. “Red” circuits are normal, unsecured circuits and equipment. Separation is ensured by maintaining physical distance or installing shielding between “red” and “black” circuits and equipment.

TEMPEST is vital for areas where physical security is either not possible or limited. When equipment is on a vehicle or deployed in an active zone, use of TEMPEST-rated equipment is a must when sensitive data is involved. It can be a user’s only line of protection.

Common Criteria (EAL4+)

Common Criteria is an international standardized process for information technology security evaluation, validation, and certification. The Common Criteria scheme is supported by the National Security Agency through the National Information Assurance Program (NIAP).

Common Criteria defines a common set of tests regarding the process of design, testing, verification, and shipping of new security products. Common Criteria enables customers to assess a level of trust in how a product has been designed, tested, built, and shipped.

When shopping, be sure to get secure KVM switching for networks with multiple security classifications. For more information, visit the Secure KVM section of blackbox.com.

It's estimated that up to 20% of the cable for sale is now unsafe, unapproved, or counterfeit. Chances are that you've bought illegitimate cable and haven't even realized it! Cheap cable can really hurt you (literally) in the long run. Let's take a trip back in time to 1980. Remember the MGM Grand fire in Las Vegas? The fire spread so rapidly that eighty-four people perished. An electrical ground fault was to blame. What if counterfeit cable causes an accident where you work?

Below we've listed a few pro-tips of what are the sure signs of counterfeit or cheap cable:

1. Look for the UL number. If there is no UL umber, that's an instant tip-off. Even if there is a UL number, look it up to see if it's legit.
2. Look for the ETL logo. Ask the seller for the ETL test results and check the ETL website.
3. How is the printing? Is it poorly done on the box and cable?
4. Check for product manuals. Legitimate products will always include brochures or manuals.
5. Does the color match previous bought cable?
6. Compare the weight to cable you know performs up to standard.

Use these tips when you shop around for your next batch of cable. The last thing we want is for you to get burned on counterfeit cable. For more information and tips on how to avoid unsafe cable, listen to our "Complete Cabling Solutions" podcast, coming soon.

Do you have any cable horror stories? Share it with us so we can pass your wisdom on to others!

Is your organization protecting itself in the new digital age? Unauthorized devices joining the network through an open port or a wireless network is a real threat. With an ever-increasing number of mobile devices—laptop computers, notebooks, smartphones, PDAs, even video game systems—network managers are finding that portable devices are creating a real security threat. Controlling access is what Network Access Control (NAC) is all about.

NAC has a special place in a network security plan because, unlike a firewall, which offers perimeter protection, it monitors the inside of your network. A firewall stops the hacker in Poland from getting to your network through the Internet. NAC stops the hacker inside your building or in the parking lot from getting to your network through an Ethernet port or a wireless access point.

Learn how your organization can protect itself. Attend our next webinar and learn to:

• Prevent network breaches from unauthorized network connections and out-of-compliance devices.

• Stop rogue laptop connections and unauthorized wireless access devices from accessing your network.

Go to http://www.blackbox.com/Store/LP/veri-nacwebinar.aspx to view the webinar schedule and choose the time that’s best for you.  In addition, be sure to visit our Veri-NAC resources page.