For those fol­low­ing this mat­ter, the fil­ing of the peti­tion for the amend­ment of the Cal­i­for­nia Util­ity Code to reflect the dig­i­tal evi­dence require­ments is in. The docket num­ber is P1007015 and we invite any and all responses.
The vision behind this effort is to bring evidence-​​competence to the Cal­i­for­nia Util­ity Grid as a part of Crit­i­cal Infra­struc­ture Pro­tec­tion efforts in the State of California.

Orange County
While this rul­ing is ini­tially spe­cific to the County of Orange and its Appel­late Court Dis­trict, it also impacts any elec­tronic mes­sag­ing or energy con­trols which flow through this area as elec­tronic media of any form.

Khaled — as a stan­dard or the col­lec­tion o sur­veil­lance data of any form now cre­ates a level-​​of-​​competence for any and all data used in sur­veil­lance or con­trol­ling sys­tems which would come to be used as part of a Court process, whether Civil or Crim­i­nal in nature. Khaled then has wide sweep­ing impact in that all sys­tems and processes, includ­ing con­tract dis­putes and other civil mat­ters which the Supe­rior Court would come to resolve or which would be tried in Supe­rior Courts as part of a State lead pros­e­cu­tion in any mat­ter, or a locally lead pros­e­cu­tion in any mat­ter must also meet this new “trustworthiness”.

The “I Said So” Evi­dence Model
The days when it was just blindly accepted that the sys­tems worked as the man in the White Coat said they do are over. Proof and reli­able proof are now needed for all dig­i­tal cap­ture sys­tems or data con­trol mod­els which the courts will accept as fac­tual or at least review­able and authen­ti­cated to one level or another. With­out this data is just that unsup­ported and unprov­able data.

It is Certichron’s inten­tion to fos­ter a bet­ter under­stand­ing of the needs or foren­sic con­trols in all sys­tems which are intended to cre­ate what we call “Inten­tional Evi­dence”, that which is pre-​​approved court-​​admissible con­tent. The Cal­i­for­nia Power Grid is the most gran­u­lar place to enforce that and is the basis of a model which touches us all and as such is a very impor­tant part of upgrad­ing the US and Cal­i­for­nia Util­ity Grid infra­struc­ture.
The Cer­tichron CPUC fil­ing can be seen at

• Khaled Rul­ing
• Our Peti­tion for Rule­mak­ing in regard to Evi­dence Stan­dards before the CPUC
• Our sup­port­ing com­men­tary before the CPUC

Cer­tichron and Relify Secu­rity annouc­nce the avail­abil­ity of Certichron’s SecureNTP ser­vices to Relify Secu­rity customers.

Cer­tichron announces its part­ner­ship with Relify Secu­rity. Relify is a well estab­lished provider of com­mer­cial con­sult­ing and secu­rity review ser­vices for bank­ing, credit union and other PCI-​​DSS type clients as well as other Finan­cial Providers.

To quote Relify Security’s man­ag­ing part­ner:
“Relify Secu­rity has recently launched a part­ner­ship to deliver what Relify believes is a pretty unique and needed ser­vice. It address a prob­lem that we often don’t think about… Where do you get your time?”…

“SecureNTP pro­vides one time source for all uses: What this means is that there is one time source for every­thing finally — from Build­ing, Power, Secu­rity, IT Oper­a­tions and at last uni­form evi­dence across the entire entity. In most cases SecureNTP requires no instal­la­tion of hard­ware or soft­ware, since your busi­ness is likely already run­ning the NTP pro­to­col. Once you have reg­is­tered with Cer­tichron, it only takes a few minor con­fig­u­ra­tion changes and instal­la­tion of the dig­i­tal key, along with set­ting up audit log­ging and key man­age­ment practices.”
Mike Pear­son, CISSP
Man­ag­ing Partner

For more infor­ma­tion con­tact Relify Secu­rity, LLC
O/​F: 866.897.6900
M: 813.523.0151
www​.reli​fy​se​cu​rity​.com
Reli­able and Ver­i­fi­able Advanced Secu­rity Solutions

PCI DSS 1.2 is revised to 1.2.1

Last Sum­mer the PCI DSS 1.2.1 was release and it spec­i­fied that each key ser­vice in an infra­struc­ture must have its own server which for Microsoft Oper­at­ing Envi­ron­ments means they need to ded­i­cate a AD PDCe (A “Pri­mary Domain Con­troller Emu­la­tor” which used to be called Sec­ondary Domain Controllers).

Notice also that the 1.2.1 ver­sion actu­ally requires each key server pro­vid­ing Trust Ser­vices to the CDE (Card Data Envi­ron­ment) to be run from its own sys­tem mean­ing that each sys­tem has a prov­able set of con­trols and oper­at­ing con­straints within the larger mer­chant or processing/​banking ser­vice operations.

Time Ser­vices are  a part of trust services

Time Ser­vices are part of this and we think this is a great step for­ward for the PCI SSC in its recog­ni­tion that time as a com­po­nent of the trans­ac­tion chain is made as impor­tant as pri­vacy con­trolled infor­ma­tion but from the aspect of being able to prove the event properly.

Our busi­ness is evidence

Certichron’s focus is this evi­dence and the abil­ity to build reli­able evi­dence of ephemeral acts in a cost effec­tive man­ner that is the basis of our time-​​evidence ser­vice. Con­tact Sales@​Certichron.​COM or call us at 800−511−2301 for more infor­ma­tion on build­ing your own evidence-​​centric time man­age­ment prac­tice to off­set or mit­i­gate risks in your IT oper­a­tions today!

Q: The staged or delayed deploy­ment prac­tice model enu­mer­ated in the PCI DSS Pri­or­i­tized Approach implies I can put 10.4 com­pli­ance off until later in the com­pli­ance prac­tice — is that true?

A: This is a really good ques­tion and from my per­spec­tive I under­stand the intent in the pri­or­i­tized approaches lan­guage in mak­ing it eas­ier for smaller Mer­chants and lower-​​volume enti­ties to com­ply, but I think there are other under­ly­ing issues which make it imper­a­tive to address time man­age­ment in the secu­rity model and control/​default service/​password changes in the con­fig­u­ra­tion report process of Require­ments 1 and 2. Let me explain this logic… the Pay­ment Indus­try Coun­cil (www​.pcissc​.org) only con­trols the use of the PCI DSS stan­dard within the Pay­ment Indus­try. That use of the PCI DSS is con­trac­tu­ally con­trolled by the CARD Brands them­selves as part­ners and found­ing mem­bers of the PCI SSC. Any use of the PCI DSS stan­dard then out­side of that nar­row con­trac­tual use would be con­strained by what­ever other con­straints con­trol that other model.

PCI DSS is a stan­dard — The Pri­or­i­tized Deploy­ment Approach is an Con­sor­tia Opin­ion, and the two are separate

The same tech­ni­cal stan­dard is now ref­er­enced under Law in sev­eral States in the US most promi­nently Nevada which func­tion­ally took the Pay­ment Counsel’s abil­ity to allow par­ties to only meet parts of the Data Secu­rity Stan­dard (now a part of Law and Prac­tice therein) is moot, since those same par­ties must meet all of the DSS and that is based in Pri­vacy Law and not the con­trac­tual con­trols of the Pay­ment Counsel’s mem­ber credit/​payment card brands.

It’s not true!

Before argu­ing this isn’t true, lets walk the walk. Take the per­spec­tive that the PCI SSC is an indus­try con­sor­tia and not a Leg­isla­tive Body so the first thing to do is to per­fect the ques­tion so we can come to a real answer.

Per­fect­ing the right question

The real ques­tion here to answer is “are there any leg­isla­tive or reg­u­la­tory require­ments which are cod­i­fied in Law or prac­tice which would make me imple­ment the Time Man­age­ment Solu­tion por­tion of the PCI DSS (sec­tion 10.4) imme­di­ately rather than sec­ond or third year as the Pri­or­i­tized Approach guide implies???” and in my opin­ion there is an answer and its YES.

Oper­at­ing in a man­ner which ensures (and insures) Court Admis­si­bil­ity of Dig­i­tal Data.

My asser­tion is that the com­pli­ance with the PCI DSS is not the core com­pli­ance issue here because you have to oper­ate legally. Because of this you can­not wait until the third year to imple­ment a prac­tice which insures court admis­si­bil­ity of your data records because you have a legal oblig­a­tion which extends beyond the PCI DSS require­ments to insure your records are court admissible,

Fol­low the logic — Because this is above and beyond what the PCI DSS require­ments may put in place, while the PCI com­pli­ance process may defer proper time man­age­ment you can­not because you must always oper­ate your busi­ness or dig­i­tal trans­ac­tion sys­tems in a man­ner which makes them prov­ably con­trolled under the local or spe­cific Jurisdiction’s require­ments. No con­tract with any other party (includ­ing the CARD Brand Provider you do busi­ness with can elim­i­nate that need, nor can the PCI DSS require­ments either.

Nevada Com­pli­ance tops it all

Like­wise if those records have Nevada State Res­i­dent Per­son­ally Iden­ti­fi­able Infor­ma­tion in them then they like­wise would also need to com­ply to the con­trols of the PCI DSS and that also can­not be delayed. Nevada State Pri­vacy require­ments man­date the use of the PCI DSS process con­trol tech­nol­ogy and more impor­tantly not its rec­om­mended low-​​effort roll out time­line for easy mer­chant accep­tance and this is impor­tant to under­stand the imme­di­ate impli­ca­tion of. I am not a lawyer and you should get real good legal advice on this but I am bet­ting that the Pay­ment Coun­sel can­not absolve you of any legal respon­si­bil­i­ties to imple­ment con­trols to address keep­ing pri­vacy impacted infor­ma­tion as well as your finan­cial con­trols. The PCI SSC lost con­trol of how the DSS con­trols are rolled out when they allowed the State of Nevada to write them into law mean­ing that State of Nevada pushed the roll out as a national stan­dard therein.

Now every­one with online ser­vices or national oper­a­tions which may include Nevada State pro­tected infor­ma­tion must imme­di­ately meet those Nevada State Legal require­ments to insure their data is both secure and is Court Admis­si­ble. Those issues are now are defined in before higher tri­bunals than an Indus­try Con­sor­tia like the PCI SSC. The real ques­tion is how you com­ply. I sug­gest you send us email to EvidenceNow@​certichron.​com and Cer­tichron will send you back a pack­age on mak­ing your infra­struc­ture evi­dence ready in today’s newly emerged dig­i­tal integrity world.

Overview

ntp_request.c in ntpd in NTP before 4.2.4p8, and 4.2.5, allows remote attack­ers to cause a denial of ser­vice (CPU and band­width con­sump­tion) by using MODE_​PRIVATE to send a spoofed (1) request or (2) response packet that trig­gers a con­tin­u­ous exchange of MODE_​PRIVATE error responses between two NTP daemons.

Impact

CVSS Sever­ity (ver­sion 2.0):

CVSS Ver­sion 2 Metrics:

http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009–3563

CERT Alert for NTP Ver­sions before 4.2.4p7 and 4.2.5 before 4.2.5p74, when OpenSSL and autokey are enabled. This directly impacts PCI DSS com­pli­ance prac­tices using NTP with OpenSSL and autokey to iden­tify end-​​nodes in NTP ser­vice topologies.

CERT 2009–1252