Subject: [sacm] Mis-understanding of the term monitoring

From: [email-masked]
Date: Tue, 11 Dec 2012 07:53:03 -0600 (CST)

Tony and all:

The monitoring which SACM performs is not about people's behavior.

The monitoring which SACM performs is of security mechanisms which are of interest to organizations.

When organizations are expected by law to protect private information, SACM monitors the security controls designed to protect privacy laws.

David Oliva

On 12/10/12, Martin Rex<[email-masked]> wrote:

Tony Rutkowski wrote:
>
> On 8/6/2012 1:21 PM, Martin Rex wrote:
> >
> > You have to realize that the problem here is not a security policy
> > by itself. But trying to enforce compliance by constant electronic
> > surveillance of end user systems will probably be illegal in most cases
> > in Germany.
>
> Maybe this is getting off-topic, but could
> you provide some citations to "German law."
> These assertions seem like rather extreme
> interpretations of something. It certainly does
> not comport with the understanding of the
> law that my German government colleagues
> have.

Maybe your German government colleagues should pay more attention
to decisions of the Federal Administrative Court of Germany.

There was a decision of the Federal Administrative Court of Germany
last year that should provide a clue just how deep into illegal
territory the monitoring of employee computing equipment is
for an employer.

Decision: BVerwG 2 A 11.08 vom 31.03.2011

Main Web Site:
http://www.bundesverwaltungsgericht.de/weitere_Informationen/Information_and_Decisions__EN__g0.html

Online Access to decisions for non-commercial use (in German language only)
search for "BVerwG 2 A 11.08"
http://www.bundesverwaltungsgericht.de/Entscheidungen/Entscheidungssuche_ny.html

The relevant parts of that decision are paragraphs 17-19, basically
re-iterating the Federal Constitutional Courts requirement for a
existence of a formal statute law by the parlamentarian legislator
to access non-public personal information. That the information
was stored on the network storage of the employer, and that the use
of that storage was officially strictly limited to business-related
issues was found to be irrelevant!!

This particular case was about an employee working for the German
federal/governmental agency "Bundesnachrichtendienst (BND)"
(which might be vaguely liked to the CIA among US government agencies).
The employer (BND) had provided non-public network storage to the
employee, and searched, probably among other locations, the contents
of that network storage for indications of non-compliant publication
of confidential information.

Since there was no probably cause and no official criminal investigation
when the search was performed, there was no applicable formal statue law
authorizing this search, so the search was found to be a severe violation
of the employees right of informational self-determination, based
on the requirements established by the Federal Constitutional Court.

After this decison, the employee sued his employer for "punitive damages"
from this illegal search of his personal data. The employee was recently
awarded EUR 3000,- by "Landgericht Berlin"

http://www.berliner-zeitung.de/politik/bundesnachrichtendienst-bnd-muss-zahlen,10808018,21051542.html

That latter decision about the awarded damages is still fresh, and
could potentially be appealed by the employer. That decision also
hasn't been published yet, but given that it is based on the very
clear determination "BVerfG 2 A 11.08", it will be easy to justify
such a payment of damages. It sides quite well with decisions
of the Federal Labour court for severe violations of employee
personality rights.

-Martin
_______________________________________________
sacm mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/sacm

---

From: "Romascanu, Dan (Dan)" <[email-masked]>
Date: Wed, 12 Dec 2012 12:06:06 +0000

Hi,

I was also confused by the usage of the term ‘monitoring’ by the time I was introducing myself in SACM. David Oliva ‘s observation is correct, ‘monitoring’ as used in SACM is about auditing the security controls and mechanisms (although using ‘auditing’ instead could create other confusions)

Regards,

Dan

From: [email-masked] [mailto:[email-masked]] On Behalf Of [email-masked]
Sent: Tuesday, December 11, 2012 3:53 PM
To: [email-masked]; [email-masked]
Subject: [sacm] Mis-understanding of the term monitoring

 Tony and all:

David Oliva

On 12/10/12, Martin Rex<[email-masked]<mailto:[email-masked]>> wrote:

Main Web Site:

-Martin
_______________________________________________
sacm mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/sacm

---

From: Tony Rutkowski <[email-masked]>
Date: Wed, 12 Dec 2012 20:33:09 +0800

How about continuous security awareness,
continuous security assessment, continuous
security measurement, ...   There
seem like many options here.

--tony

On 2012-12-12 8:06 PM, Romascanu, Dan (Dan) wrote:
>
> I was also confused by the usage of the term 'monitoring' by the time 
> I was introducing myself in SACM. David Oliva 's observation is 
> correct, 'monitoring' as used in SACM is about auditing the security 
> controls and mechanisms (although using 'auditing' instead could 
> create other confusions)
>

---

From: "ietfdbh" <[email-masked]>
Date: Wed, 12 Dec 2012 09:28:13 -0500

I think "security assessment" and "security measurement" is what the
security system does, i.e. monitoring traffic/endusers/etc.

How about "security system monitoring" or "security system assessment"?

David Harrington

 <mailto:[email-masked]> [email-masked]

+1-603-828-1401

From: [email-masked] [mailto:[email-masked]] On Behalf Of Tony
Rutkowski
Sent: Wednesday, December 12, 2012 7:33 AM
To: Romascanu, Dan (Dan)
Cc: [email-masked]; [email-masked]; [email-masked]
Subject: Re: [sacm] Mis-understanding of the term monitoring

--tony

I was also confused by the usage of the term 'monitoring' by the time I was
introducing myself in SACM. David Oliva 's observation is correct,
'monitoring' as used in SACM is about auditing the security controls and
mechanisms (although using 'auditing' instead could create other confusions)

---

From: Gene Golovinsky <[email-masked]>
Date: Wed, 12 Dec 2012 07:32:04 -0800

“Continues monitoring” seems to be reasonably well accepted and widely
circulated term.

I think that changing it to something else will cause more confusion, not
less.

--Gene

*From:* [email-masked] [mailto:[email-masked]] *On
Behalf Of *Tony
Rutkowski
*Sent:* Wednesday, December 12, 2012 04:33 AM
*To:* Romascanu, Dan (Dan)
*Cc:* [email-masked]; [email-masked]; [email-masked]
*Subject:* Re: [sacm] Mis-understanding of the term monitoring

--tony

I was also confused by the usage of the term ‘monitoring’ by the time I was
introducing myself in SACM. David Oliva ‘s observation is correct,
‘monitoring’ as used in SACM is about auditing the security controls and
mechanisms (although using ‘auditing’ instead could create other confusions)

---

From: Anton Chuvakin <[email-masked]>
Date: Wed, 12 Dec 2012 08:52:49 -0700

> I think that changing it to something else will cause more confusion, not
if you love in FISMA-land it is accepted. Elsewhere monitoring is
monitoring (continuous by definition), and "continuous monitoring" is
really "periodic control assessment." Guinea pig is NOT a pig, and it is
NOT from Guinea....

-- 
Dr. Anton Chuvakin
Site: http://www.chuvakin.org
Twitter: @anton_chuvakin
Work: http://www.linkedin.com/in/chuvakin

---

From: [email-masked] (Martin Rex)
Date: Wed, 12 Dec 2012 20:30:07 +0100 (CET)

David Oliva wrote:
> When organizations are expected by law to protect private information,
> SACM monitors the security controls designed to protect privacy laws.

Romascanu, Dan (Dan) wrote:
> 
> I was also confused by the usage of the term ?monitoring? by the time
> I was introducing myself in SACM. David Oliva ?s observation is correct,
> ?monitoring? as used in SACM is about auditing the security controls
> and mechanisms (although using ?auditing? instead could create other
> confusions)

Unless infected by malware and being turned into a remoted-controlled bot,
a typical computing system will change its state based on user input,
i.e. user behaviour.  So if you track the state changes of a computer
that is used by a user, you're actually tracking the behaviour of the
user!

Monitoring the which processes are started and stopped, monitoring which
network ports they open and close and when and how much data they transfer,
monitoring which files are written and read, even the DHCP address assigned
to the machine is subject to the protections of the basic right of
informational self-determination.

what are the security mechanisms / security controls that you want to monitor?

-Martin

---

From: [email-masked] (Martin Rex)
Date: Wed, 12 Dec 2012 20:35:35 +0100 (CET)

> what are the security mechanisms / security controls that you want to monitor?

actually, any processes that perform network communication, the ports they
open, the data they transfer (including what they read from disk and write to disk or network shares) and the DHCP address assigned to the machine
is subject to the protection of the constitutional telecommunication
secrecy, and monitoring that information without an applicable statue law
established by the parliamenarian legislator is not just illegal in Germany,
it is a crime punishable with up to 5 years in prison.

-Martin

---

From: David Solin <[email-masked]>
Date: Thu, 13 Dec 2012 10:13:30 -0600

Hi Martin,

You are saying that, if I have infected your computer with malware, it 
is illegal in Germany for you to do anything that would make you aware 
of that fact.  Is that correct?

Regards,
--David Solin

-- 

jOVAL.org: SCAP Simplified.
Learn More <http://www.joval.org> | Features 
<http://www.joval.org/features/> | Download 
<http://www.joval.org/download/>

---

From: Gene Golovinsky <[email-masked]>
Date: Thu, 13 Dec 2012 08:14:22 -0800

Martin.
This feels a bit too broad. We can take it to the extreme and declare all
the system monitoring tool that exist and used for a few decades now
completely illegal.
Not to mention, that well-being of us as law abiding citizens very much
depends on various intrusion detection systems, anti-virus software,
malware detection software ability to see activities that can be deemed as
dangerous and block, disrupt, report.
I think SACM is making a good and noble attempt to make these various
already existing and well accepted software to work better together and
improve when possible.
If what you telling is really the case, then it should mean that German
banks and manufacturers run NO security software or if they do, then they
all breaking the law...

--Gene

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of
Martin Rex
Sent: Wednesday, December 12, 2012 11:36 AM
To: [email-masked]
Cc: [email-masked]; Romascanu, Dan (Dan); [email-masked]
Subject: Re: [sacm] Mis-understanding of the term monitoring

Martin Rex wrote:
> > When organizations are expected by law to protect private
> > information, SACM monitors the security controls designed to protect
privacy laws.
> > I was also confused by the usage of the term ?monitoring? by the
> > time I was introducing myself in SACM. David Oliva ?s observation is
> > correct, ?monitoring? as used in SACM is about auditing the security
> > controls and mechanisms (although using ?auditing? instead could
> > create other
> > confusions)
>
> Unless infected by malware and being turned into a remoted-controlled
> bot, a typical computing system will change its state based on user
> input, i.e. user behaviour.  So if you track the state changes of a
> computer that is used by a user, you're actually tracking the
> behaviour of the user!
>
> Monitoring the which processes are started and stopped, monitoring
> which network ports they open and close and when and how much data
> they transfer, monitoring which files are written and read, even the
> DHCP address assigned to the machine is subject to the protections of
> the basic right of informational self-determination.
>
>

actually, any processes that perform network communication, the ports they
open, the data they transfer (including what they read from disk and write
to disk or network shares) and the DHCP address assigned to the machine is
subject to the protection of the constitutional telecommunication secrecy,
and monitoring that information without an applicable statue law
established by the parliamenarian legislator is not just illegal in
Germany, it is a crime punishable with up to 5 years in prison.

-Martin