Jump to content
  • entries
    42
  • comments
    58
  • views
    86,709

Aligning FileMaker Security Requirements To Business Interests

Steven H. Blackwell

1,074 views

Aligning FileMaker Security Requirements To Business Interests

 

March 29th 2016

 

There has been a considerable amount of discussion recently in various FileMaker Platform venues about database security.  Much of the discussion has focused on the use of one technique or another, and most of those techniques actually detract from the security of FileMaker systems rather than enhance security.

Absent from these discussions, however, has been any description of first instance reasons for having security features in place in the FileMaker Platform. This BLOG entry will discuss the relationship between business interests and security requirements. Developers and administrators must assure that they have properly aligned security requirements with business interests. Generally speaking, we are seeking to assure the Confidentiality, Integrity, Availability, and Resilience (CIAR) of digital assets and supporting physical assets in the organization.

First and foremost, businesses and organizations of most every type have an interest in business continuity.  That is, they have an interest in remaining in business, and in being able to continue to function to perform their missions, all in the face of some natural or man-made interruption.  That includes cyber-attacks of varying types; but, such attacks are not the only potential interruption that can cause an organization to cease operations, either temporarily or permanently.

Physical damage to IT technology hardware whether by cyber-attack, flood, fire, tornado, building collapse, or similar disaster is one likely cause of business interruption and continuity failure. So is a new phenomenon:  the ransom-ware attack.  These attacks encrypt the entire data infrastructure of an organization with the attackers demanding a ransom to decrypt the data and release the underlying information back to the organization.

Business continuity can also fail as the result of the loss of customer or client confidence in the organization resulting from a data breach or data exfiltration. Additionally, if attackers were to damage or to delete significant portions of the organization’s data, the organization may not be able to continue in operation.

All these business continuity imperatives argue strongly for robust steps to preserve CIAR and to allow the organization to continue to function post-attack or post-disaster.

Regulatory compliance requirements related to data privacy and avoidance of the associated penalties for non-compliance are another key business interest for most organizations.  At international, national, and state levels, there are a variety of statutory and regulatory requirements for safeguarding data against breaches, for notifying affected individuals of breaches, and for post-breach monitoring and management. An organization’s compliance failure can subject it to civil and criminal penalties, including substantial fines. Clearly, any organization, irrespective of structure or mission, wants to avoid these potential penalties.

Organization brand reputation is another key business requirement needing safeguarding. The negative publicity that follows in the wake of a breach as well as the impact and burden of remediation for those whose data are compromised can seriously, if not permanently, tarnish the reputation that an organization has often worked years to achieve. Lost of customer or client confidence, loss of members’ confidence for professional and trade associations, and degradation of analyst and media opinion can all rapidly sink any organization.

Many FileMaker Platform customers and clients are small to medium-size businesses.  They frequently have fewer resources to combat the after-effects of CIAR loss. They are the ones most likely to suffer failure of business continuity and to be driven out of business by severe attacks. Larger businesses can also experience negative effects as well; however, they may have more resources to be able to continue to function.

These are some of the business interest reasons for safeguarding FileMaker Platform systems.  They are the underlying primary reasons for designing and implementing robust CIAR security in FileMaker systems.  These are not the only reasons of course.  There can be others, notably protection of developer intellectual property. But the concepts of business continuity, regulatory compliance, and avoidance of civil liability are core reasons that drive security requirements.

Steven H. Blackwell



5 Comments


Recommended Comments

As a FileMaker developer, I work with a lot of small to medium sized companies that say security is important, but really don't want to spend more FM development time on it.  Most think things are good enough and few have ever had any security problems, which is good.  However, complacency isn't good enough in the security world.  And what I have to remind most of these smaller companies is that when they claim they have never had a security breach, usually that means they are unaware of a security breach.  Most of them do not even have the tools or wherewithall to realize they have been penetrated until there is some external consequence such as credit cards numbers are stolen and getting used.  While I offer, not many of my clients want to pay for a security plan to document controls, disaster recovery, etc.  I'm making more of a sales pitch and some are, but it is surprising that it is harder for me to sell a security and disaster recovery plan than it is further module development.  

In the FM discussions, several of us have been talking about using FM scripting for Two Factor authentication.  It is at best a light version of it because it is not at the security layer, but it functions and verifies Persistent IDs.  Others have talked about biometrics such as the iPhones finger print for authentication or maybe facial recognition.  There has been talk about the NEM ID used by the Danish government for all citizens and how to integrate it into FM.  There are quite a few frontiers of security that it would be nice too see FileMaker advance into.  I'm hoping FM 15 has some advancements in security.  

Share this comment


Link to comment

From a developer standpoint, and a business perspective, you need to protect your self in those cases. The client needs to sign a waiver, acknowledging that you have advised them of the risk of waiving the standard security protocol, and absolving you of any responsibility should a breach occur due to using a suspect approach.

It may even be in some cases, like with HIPPA compliance, that you require it...as a condition of the contract. No negotiation. It really comes down to building out the spec, and making sure that security is built into the process. No selling involved. Mapping out layers, and security. At that point, security is no longer a side conversation or an add-on...it becomes woven into the normal development process. There is no opportunity to say no...

There may be occasions where that doesn't work. And you have to make adjustments based on real business needs...but it should be the exception, not the rule.

Share this comment


Link to comment

I have had a couple of small to medium clients become aware of their lack of security only when a staff member leaves and takes a copy of the clients (or even the whole database) with them.

Share this comment


Link to comment
Quote

There are quite a few frontiers of security that it would be nice too see FileMaker advance into.  I'm hoping FM 15 has some advancements in security.

 

 

 

I cannot comment on unreleased versions of the Platform.  That said, FileMaker, Inc. has paid a lot more attention to security in the past couple of releases.  I expect and hope that trend will continue.

 

If it is to be introduced to the Platform, Multi-factor Authentication (MFA) will need to be tightly integrated with various instances of FileMaker Server. It must be based on some combination of three elements:

 

·      Knowledge (something you know)

 

·      Possession (something you have)

 

·      Inherence (something you are)

 

MFA is designed and intended to validate a user’s assertion of identity wherever that user happens to be at the time of the assertion.  It is not tied to a specific workstation.  In the FileMaker Platform environment it would not be managed by any internal business process aspect such as scripting.  As we saw rather conclusively in the incidents described by Josh Ormond (http://fmforums.com/blogs/entry/1512-a-conversation-about-2-factor-authentication/), these processes are susceptible to any number of types of manipulation by any one or a combination of eight nine distinct External API’s.

 

I believe I can confidently state that FileMaker, Inc. is aware of the need for MFA. 

 

Steven

 

 

 

 

Edited by Steven H. Blackwell

Share this comment


Link to comment
×

Important Information

By using this site, you agree to our Terms of Use.