Monthly Archives: October 2015

  • -

The Hollow Sounds of Sabre Rattling in the Cyber World

President-Barack-Obama-President-Xi-Jinping

The big news in the security segment this week is the newly-formed agreement that President Barack Obama has struck with Chinese President Xi Jinping. With a backdrop of U.S. threats to launch counter-attacks, the two leaders agreed to refrain from state-sponsored cyberattacks against each other that attempt to steal trade secrets or competitive business information. Sounds pretty good on the surface, but as it is with any complex agreement, you have to evaluate the implications of the deal before rendering judgement. In the following I’ll share my thoughts.

Closing the Barn Door too Late

In the U.S., we have a popular idiom that goes something like this, why close the barn door after the horse has bolted. I’m not sure how that would translate into Chinese, but here’s how it translates into lost dollars. A 2013 report published by The Commission for the Theft of American Intellectual Property estimated that annual losses from IP theft over the internet totaled in excess of $300 Billion annually, which is roughly the total amount we exported to Asia in 2012. The report also estimates that China is responsible for roughly 70% of these losses. We are talking about trillions of dollars already lost. It makes one wonder how much is left to steal and, more importantly, where is the discussion about making us whole for these losses?

Who is Attacking?

James Clapper, Director of National Intelligence, stated that he is not optimistic that the agreement with China will effectively deter state-sponsored cyberattacks on businesses. One can envision where it will be quite easy for China to continue to target U.S. businesses at arm’s length by having future attacks appear not to be state-sponsored. On top of this, you have the grim reality that for most cyberattacks, we simply do not know where they originated or who is responsible.

Economic Sanctions as a Weapon

The stated deterrent is economic sanctions, which the U.S. has used effectively in the past, but success with this approach has relied on forming a coalition among a larger group of countries. When a single country imposes economic sanctions unilaterally, it becomes a more difficult task as the trading partner intended for punishment can many times find alternative outlets and sources for the impacted goods. Current weaknesses in the Chinese economy will also contribute to significant reluctance for the U.S. to impose damaging sanctions that could trigger a broader global economic decline.

Increasing Protection

U.S. businesses may understandably not feel any safer after the agreement than they did before. The basic tenet in the field of security is to invest in protection in relation to the value of the assets being protected. The U.S. is under-investing in security as evidenced by the continuing breaches and losses suffered. Stopping foreign hackers starts with basic security measures such as two-factor authentication and data encryption. At the same time, U.S.-based enterprises should expect more protection from their government, but it will need to be a partnership where businesses increase their investment in security and the government initiates more effective means of deterring attacks on American targets such as implementing more menacing counter-attacks and preemptive strikes on would-be foreign hackers.


  • -

Managing Shadow IT

By Rachel Holdgrafer, Business Content Editor, Code42

Code42_Shadow_IT“Shadow IT,” or solutions not specified or deployed by the IT department, now account for 35 percent of enterprise applications. Research shows an increase in IT shadow spend with numbers projected to grow another 20 percent by the end of 2015.

Experts agree that shadow IT is here to stay, particularly the growing tendency to use cloud services for collaboration, storage and customer relationship management.

Enterprise organizations can’t afford to bypass the productivity and profitability that comes with a happy and enabled mobile workforce. However, the utilization of SaaS that IT has not vetted and approved may expose regulated or protected personal data, which a business is responsible for remediating.

California leads the way in the privacy arena with the Security Breach Notification Law and Online Privacy Protection Act. The Federal Trade Commission is the primary U.S. enforcer of national privacy laws, with other national and state agencies authorized to enforce additional privacy laws in vertical industries such as banking and health care.

Sanctions and remedies for non-compliance with FTC data protection laws include penalties of up to US $16,000 for each offense. The FTC can also obtain an injunction, restitution to consumers, and repayment of investigation and prosecution costs. Criminal penalties include imprisonment for up to ten years. In 2006, a data broker agreed to pay US $15 million to settle charges filed by the FTC for failing to adequately protect the data of millions of consumers. Settlements with government agencies can also include onerous reporting requirements, audits and monitoring by third-parties. A major retailer that settled charges of failing to adequately protect customer’s credit card numbers agreed to allow comprehensive audits of its data security system for 20 years.

So, what is the answer? How do you start to get a handle on shadow IT?

Ask.
Ask employees which cloud services they are using. You might also need to utilize a combination of automated and manual discovery tools to get a complete picture of what programs employees are using and what data is hosted and shared in provider clouds. These “cloud consumption” dashboards can monitor and assess cloud usage and detect encryption tools at each host.

Protect your data.
Implement automatic backup of all endpoint data in the enterprise to capture a real-time view of where employee data lives, when and where it moves and who has touched it—even as it moves to and from non-approved clouds.

Act fast when the inevitable happens.
The reality is a breach may be inevitable, but you can recover. With continuous and automatic endpoint backup, IT can quickly evaluate the content of files believed to have been breached and act in good faith to lessen the impact. Additionally, understanding what was stolen allows a company to make an accurate disclosure and manage consumer confidence issues.

For CIOs and IT staff accustomed to maintaining complete control over their digital ecosystems, relinquishing even a bit of this control can be terrifying—even in the name of productivity. And yet, with a security strategy that focuses on complete data visibility, they can empower mobile workers while minimizing the risks associated with the dark side of shadow IT.

 


  • -

Three ways to improve your personal cyber safety

By Gavin Reid, Vice President/Threat Intelligence, Lancope

For National Cyber Security Awareness month there a couple of relatively easy-to-do things that I highly recommend if you want to improve your personal cyber safety. These important protections are easily available but not well documented.

One of the biggest cyber security problems impacting users today is the reuse of easy to guess passwords across multiple sites. All it takes is for one site to be compromised and the hackers can then use your password to log into others. This process is often automated and run against all sites. To help combat that ensure that you have a *unique*! password for each site. No one can remember multiple unique complex passwords so invest in using a tool like roboform or 1password to manage these passwords and keep them safe. Once you have installed a good password manager go back to each site you use and replace your common password of “petname123″ and let the password manager create a long and complex password for you like “yott2&uv0ugs7.” Save that password and go on to change the next one. Set a complex password that you DO remember for your password manager. It’s only one and it can be recalled from memory.

Don’t be afraid of the cloud! Losing all of your newly-created complex passwords to a hard drive crash would be a terrible loss. Make sure you sync your password file in the cloud to be able to access them across multiple devices (phones, tablets, laptops) and always have a backup. Roboform has its own cloud storage built in and 1password uses Dropbox or iCloud. Your passwords are encrypted withAES encryption so even if someone somehow broke into the cloud provider and stole your password list, they cannot decrypt your passwords without the one complex password you committed to memory.

The next step to ensure you won’t be an easy victim is to set up two-factor authentication for some sites that are more important to your personal cyber security like Gmail, eBay and PayPal.

Gmail
You may not have thought about it, but your personal Gmail account ties many things together. For example if you use Gmail as your email address for your Amazon account, if someone hacks your Gmail they can force a password change to access your Amazon account. Similarly, your bank and many other systems may use your email as a way to allow for password resets.

Criminals can also use your Gmail account to send out legitimate looking email requests for emergency help to all the people in your address book like the email below:

Hi,

How you doing? I made a trip to London (United Kingdom) unannounced some days back, Unfortunately i got mugged at gun point last night! All cash, Credit card and phone were stolen, i got messed up in another country, stranded in London, fortunately passport was back in our hotel room. It was a bitter experience and i was hurt on my right hand, but would be fine. I am sending you this message cos i don’t want anyone to panic, i want you to keep it that way for now!

My return flight leaves in a few hours but Im having troubles sorting out the hotel bills, wondering if you could loan me some money to sort out the hotel bills and also take a cab to the airport about ($1,550). I have been to the police and embassy here, but they aren’t helping issues, I have limited means of getting out of here, i have canceled my credit cards already and made a police report, I wont get a new credit card number till I get back home! So I could really use your help.

You can contact the hotel management through this telephone number (+449444045232), you could wire whatever you can spare to my name and hotel address via Western union:

Name: John Hastings
Location: 201 Bunaby Street, Chelsea,
Greater London
SW10 0PL.
United Kingdom

Your Gmail account plays an important part in your overall internet safety. It is very important you set a strong password and enable two-factor authentication. Here is how to do it:

  • Login to your Gmail account then go-to the following URL
    https://www.google.com/landing/2step/
  • Click on “Get Started” then “Start Setup.” Enter the number for your phone and verify the number by entering the numeric code that Google sends to the phone by either text message or voice call.

GmailTwoFactor

  • You can also choose to use the smart phone app Google Authenticator, which you would register through the same wizard shown above. To install Google Authenticator click here for iOS or here for Android. Either way works and will stop people from easily taking over your personal email (and of course your online identity!).

PayPal and eBay
If you use either of these services, they are high-value target accounts for crime. PayPal is especially problematic as it links directly (in most cases) to your bank account. EBay accounts, on the other hand, are often hijacked then used fraudulently to sell nonexistent items, leaving the account owner to work out the mess. I highly recommend you protect yourself by setting up two-factor authentication for both accounts.

Setup instructions for PayPal:

Go to https://www.paypal.com/us/cgi-bin/webscr?cmd=_register-security-key-mobile

PayPalSecurity

This will give you the option to set up a secondary authentication method. You have three choices, pay a small amount and they will ship you a small fob that will provide one-time passwords to use as a secondary authentication for your account (i.e. a hacker can’t get into your account by just guessing your password or resetting it). The second choice is a more convenient one if you have a smartphone. You can download the Symantec VIP Access program for smartphones. Or you can just have PayPal send messages to your mobile like we did with Gmail.

When you get the token software installed on your smartphone, authenticate it to your PayPal account and register its unique ID. Now when anyone wants to use your PayPal account, they will have to have both your username and password and the one-time token password your phone or fob would generate. Note: you can also tie this token to your eBay account.

There was a lot of work to do to get to this stage. It is unfortunate that this process is obscure and not built-in or easier to enable. I am sorry to say that there is one more step if you use Gmail with any applications that auto-check email. I have several, such as the Microsoft Outlook client for Mac. These applications do the authentication automatically. For convenience with only a small security risk I can use Gmail to set up application- or device-specific passwords. These fixed passwords can ONLY be used by the same app on the same device. You can do this by editing the “authorizing applications & sites” button in the Gmail account settings.

When you click edit, it will force another authentication then allow you to set up, manage and track application-specific passwords.

So that’s it. I wish it was easier, but these are a couple of steps that can make your internet identity much harder to abuse.


  • -

Take Advantage Of Network Security – An Ounce Of Prevention Is Worth A Pound Of Cure

In the minutes, hours and days that follow a widespread, widely publicized data breach, most companies scramble, amping up their security measures in an effort to overcompensate for their lack of proactive preparation. A Forrester Research study revealed that more than 45 percent of businesses opt to increase security and audit requirements after an attack occurs. But as our grandmothers always say, an ounce of prevention is worth a pound of cure. Basically, Grandma was trying to say that a proactive approach to security—versus a reactive one—helps to ensure that your business is protected without having to learn the hard way.

While a lax data security plan may be the most detrimental of business strategies, a close second is taking a “one and done” approach. In reality, true data and network protection requires constant effort —it’s not a checklist to be completed, filed away and forgotten. System security, as a whole, is a moving target with new threats and vulnerabilities popping every day and from all angles. Which means one security solution may become outdated just as quickly as it was implemented. Without dedicated resources and the training required to implement and monitor advanced security solutions, organizations are basically sitting ducks, putting their corporate assets at greater risk.

Network Security

So where do you start? System protection begins with a thorough risk vulnerability assessment—and trust me, there are plenty of vulnerabilities to look for. For example, consider the impact of Bring-Your-Own Device (BYOD), with its myriad of points at which employees may unknowingly compromise corporate network security. Or take into account the rising threat and increased variety of Distributed Denial of Service (DDoS) attacks. From organized crime rings to hacktivists to foreign government hacking attempts, the complexities and motives are changing by the day.

By identifying the most vulnerable points within your current system and workflow, you can then start to draft a strategy and analyze potential solutions. Creating a customized security plan, one that’s tailored to addressing those vulnerabilities head-on, is foundational to a solid strategy. Your plan may include simple items, such as creating and implementing a formal BYOD policy. Or you may need more comprehensive protection, enhancing your network and cloud security through a Managed Service Provider (MSP) or bringing in a variety of tactical solutions, such as firewalls, antivirus, OS hardening, intrusion detection and web filtering as applicable. A complete security solution should protect your data and applications from all angles — network, cloud and employee communication—to mitigate any threat to your data.

Part of a successful security plan, however, is allocating enough staff and resources to support that plan. The best-protected systems are those that are constantly managed by a dedicated IT team. If, in your risk assessment efforts, you find that you’re lacking resources to provide ongoing support and monitoring, a Managed Network Security Solution may be the answer.

Our Managed Network Security Solutions provide not only security, but also the team that can support your security mission. We offer 24 x 7 x 365 management and monitoring, going beyond protecting PC desktops with custom, comprehensive real-time protection against attacks, defending and protecting your entire office-computing environment against the latest generation of Internet threats.

Take the first step toward achieving system security and contact a Prime representative today. Remember that ounce of protection? When we’re talking about data security, it’s worth WAY more than a pound of cure.


Contact us