Blog 11: SQL Injection

In my effort to increase security awareness and obtain a cultural acceptance, I wanted to bring a focus on a topic called SQL Injection.  

Structured Query Language, or SQL, has been around since the 70's and is heavily utilized in today's connected web of data access. The purpose of SQL is to provide the instructions to interact with the data residing within database systems. These back-end database systems can hold important information that may be personal and confidential to the organization, as well as the organization's customers, and should only be viewed by authorized individuals. 

However, many attacks have been reported over the years that have jeopardized the data held within these systems, called SQL Injection. SQL injection is a technique used to "inject" malicious SQL code/queries, generally within a web form input box, to gain unauthorized access or harvest information from a database server. For example, VTech, a company that sells a plethora of kid's toys and more, was one of the largest attacks in 2015 that utilized SQL injection (ThompsonM, 2015). VTech's database servers were compromised during this attack allowing the hacker full authorization and control of the data.     

Even though organizations have built a level of awareness around this issue, SQL injection vulnerabilities are among the most exploited flaws (Baker, A. 2013). In fact, a survey conducted from Ponemon Institute is claiming SQL injection as the number one attack vector for 2015 and OWASP has it listed as a top ten threat category (Paganini, P. 2014). The impact of this type of vulnerability could lead to the internal compromise of a database that could tarnish an organizations trust and brand with its customers, as it did with VTech. 

Some of the primary defenses to consider for SQL injections attempts are; parameterized queries, stored procedures, least privilege, and input validation. Parametrized queries allows the database to distinguish between code and data by having the developers define all of the SQL code before passing the parameters to the query, regardless of the input that is supplied. Additionally, stored procedures can be utilized to prevent user input, as they are called directly from within the application. Another simple, yet effective defense that could be applied is the principal of least privilege. This method minimizes the privileges assigned to every database account to provide users with the permissions required to perform their job function, but nothing more. Lastly, providing input validation to detect unauthorized input prior to the application processing it could assist in preventing an injection attack.        

With the many internal and customer-facing applications spanning the Internet to support business initiatives, it is exceptionally important to provide methods to protect the confidentiality and integrity of this data. To assist in this effort, OWASP has provided tips in the form of a Prevention Cheat Sheet that can be viewed, modified, and implemented. The link to the Cheat Sheet can be found here (SQL Injection Prevention Cheat Sheet. n/d). 

Thank you for reading! Until next time, remember that you don't have to become a victim of a threat to become aware of a threat!

References:

Baker, A. (2013, August 22). 14 Years of SQL Injection and still the most dangerous vulnerability. Retrieved February 25, 2016, from https://www.netsparker.com/blog/web-security/sql-injection-vulnerability-history/

Paganini, P. (2014, April 18). Ponemon study – SQL Injection attacks too dangerous for organizations. Retrieved February 27, 2016, from http://securityaffairs.co/wordpress/24094/cyber-crime/ponemon-sql-injection-attacks.html

SQL Injection Prevention Cheat Sheet. (n.d.). Retrieved February 27, 2016, from https://www.owasp.org/index.php/SQL_Injection_Prevention_Cheat_Sheet

ThompsonM. (2015, December 03). VTech Hack Reminds Us that SQL Injection Can Have Serious Consequences. Retrieved February 25, 2016, from http://coar.risc.anl.gov/consequences-of-sql-injection-attacks/

Blog 10: Security's Weakest Link (Social Engineering)

In my effort to increase security awareness and obtain a cultural acceptance, I wanted to bring a focus on a topic called Social Engineering. Social Engineering is a technique that can be used to manipulate individuals for a desired outcome. It is a form of human trickery and has been called one of the weakest links in security.

Unlike technical controls, that are built on rules and algorithms, humans revolve around feelings, and emotions. These human responses make up our natural instincts to trust and feel the need to help others. For most of us, we have been raised to "love thy neighbor", or to "do unto others as you would have them do unto you." These types of actions and response are exactly what a skilled social engineer is counting on to breach the human firewall and bring unsuspecting individuals to a potential cybercrime event.

To illustrate, in 2015, Ubiquiti Networks, a San Jose based technology company, fell victim of an email based social engineering attack that resulted in the loss of $39.1 million dollars (Honan, B. 2015). As stated by Honan (2015), "it appears a member of staff in one of its subsidiary companies based in Hong Kong fell victim to what is known as a "CEO scam", which is where a social engineer impersonates a senior staff member within the organization. By successfully impersonating a senior staff member, individuals tend to fall back to their natural human response of trust. In this case, the natural response created a devastating monetary and brand repercussion for the organization. One of the most powerful ways for these social engineers to penetrate the human firewall is through phishing attempts, as it takes less time and efforts to achieve their desired results (Mijares, A. 2015).

These types of attacks are on the rise, however, with the right amount of training, awareness, and guidance, the people within the organization can become an exceptional defense against social engineers who seek to exploit the human firewall for malicious purposes. Instead of accepting an email or unknown individual at "face value", learn to overcome the natural instincts we have and verify the information before opening the "ports" of your human firewall. 

For more information on protecting against social engineering attacks, spend some time on Google and possibly the book The Art of Deception, by Kevin D. Mitnick, William L. Simon, and Steve Wozniak (Review of the Art of Deception, n/d). You will find a plethora of information designed to give you the information you need to put a training program together for your organization.

Thank you for reading! Until next time, remember that you don't have to become a victim of a threat to become aware of a threat!

References:
Honan, B. (2015, August 6). Ubiquiti Networks victim of $39 million social engineering attack. Retrieved February 18, 2016, from http://www.csoonline.com/article/2961066/supply-chain-security/ubiquiti-networks-victim-of-39-million-social-engineering-attack.html

Mijares, A. (2015, October 22). Social engineering: Employees could be your weakest link. Retrieved February 18, 2016, from http://www.computerworld.com/article/2996606/cybercrime-hacking/social-engineering-employees-could-be-your-weakest-link.html

Review of The Art of Deception. (n.d.). Retrieved February 18, 2016, from http://www.techsoc.com/deception.htm

Blog 9: Tales from the Crypt(ography)

Image courtesy of Stuart Miles at FreeDigitalPhotos.net

In my effort to increase security awareness and obtain a cultural acceptance, I wanted to bring a focus on the importance of utilizing the science of cryptography to secure your data and communication channels with the implementation of encryption techniques. 

The main focus for this post is to provide the reader with an understanding of the basic science behind cryptography. To do this, we will look at a fairly simple encryption algorithm called the Substitution Cipher, to see how it can be applied against a basic clear text messages to produce a ciphertext for secrecy. To decrypt the message, the recipient will need to have the algorithm, as well as the associated key.

In the days before microcomputers, messages were passed in written form, such as ink on a scroll, and carried by a soldier on a horse for delivery to the intended recipient. In these days, specific methods were put in place to protect the confidentiality of the message by manipulating the placement of the words to make it appear as nonsense to an individual who may intercept the message maliciously or unintentionally. However, for the intended recipient, the method could be reversed to allow the message to be interpreted, as long as the algorithm and key were shared. 

These methods are knows as the science of cryptography, which is the art of secret writing with the implementation of an algorithm and key to a message to make it difficult, if not impossible, to view the original information. In addition, it is called encrypting and decrypting the message.

To illustrate, let's begin with the Substitution Cipher. This algorithm applies a key to shift the original letters of the message a number of spaces to the right. The number associated with how many shifts to the right is the "key" within the algorithm. For example, a "Rot 3" (Rotate 3) would have you shift the first letter of our cleartext message below, which is M, three spaces to the right, which would be P.

By utilizing the image below, we will begin with what is known as the plaintext, or original message, and apply the algorithm against it to produce a ciphertext. The algorithm we will use is the Substitution Cipher with the Rot 5 key and the plaintext I have chosen is:

MEET ME AT FOUR PM ON ELM STREET TODAY

Image Produced by Troy Bevans

To encrypt the plaintext, thus making it a ciphertext, simply start with the first letter of the message, which is M. Since we are using the Rot 5 algorithm, find M in the top portion of the grid where the alphabet is written in the shaded gray area. Once you have found M, select the number directly below it, which is R, to make your first letter of your encrypted ciphertext. Once you have completed the entire message, your encrypted ciphertext will look as follows:

RJJYRJFYKTZWURTSJQRXYWJJYYTIFD

As you can see, if this message was received with out understanding what encryption algorithm was applied, it would be difficult to decipher. For example, let's say you were aware that the Substitution Cipher was used, but did not know which key, such as Rot 3, 4, or 5. In this case, it would take a little time to decrypt the ciphertext back to cleartext. This value of knowing which Rot # was used is called the key. The use of the Substitution Cipher is the algorithm and knowing how many letters to shift (Rot 5) is the key. By applying all of this together, you can encrypt and decrypt your message, thus applying a layer of protection, for the confidentiality of the message the soldier is carrying on the horse, along it's path to the intended recipient.

Encryption algorithms have come a long way since the days of the scroll and delivery by horse. With that in mind, I am sure glad my computer does all of this encrypting/decrypting for me!!! Aren't you?!   

Thank you for reading! Until next time, remember that you don't have to become a victim of a threat to become aware of a threat!

Blog 8: One Person's Trash is Another Person's Treasure (Dumpster Diving)

Image courtesy of keerati at FreeDigitalPhotos.net

In my effort to increase security awareness and obtain a cultural acceptance, I wanted to bring a focus on the importance of properly disposing personal items, such as equipment, documents, and data, to prevent individuals from snooping through your trash looking for personal information. As the title of the blog states, one person's trash is another person's treasure.

I remember when I was around 9 years old, my brother and I were walking down the street, on a hot Summer day, towards the playground. It just so happened to be trash day and everyone had their items to be disposed of sitting nicely on the curb in front of their homes. Some of the items were in large bins, some in bags, while others were in their regular form staring right back at us as we walked by. 

As we continued towards the playground, a particular item caught the attention of my brother. He stopped abruptly and strongly nudged me in the side to take a look. After yelling "OUCH!" and attempting to nudge him back (typical sibling love), I focused in the direction of the object of interest. Lo and behold, sitting right in front of us, waiting to be taken by the sanitation engineer, was the first color television my family would own (sure glad it wasn't the last). That's right, I am either that old, or we were that poor!    

Now, this television didn't have any personal identifiable information (PII) relating back to the original owners, nor were we looking for any items of reference whatsoever. In fact, we weren't even looking for a television on that day. However, it is an example of how one person's trash can become another person's treasure. In this case, the treasure was a color television that only required 2 to 3 kicks in the side to make it turn on.

If we were to fast forward a couple of decades, we may be able to change the story from a disposed television to a personal computer. In this situation, the computer could have a hard drive that may hold several pieces of personal data within the magical platters of the metal box. If a malicious user were to obtain this data, they could potentially learn a lot about the previous owner of the computer, even PII. Even more, and moving forward another decade, we may find a thumb drive nestled deep in the bottom of a trash bin, which may hold some interesting information as well, such as financial, tax, and password documentation. Would the "treasure" be the computer/thumb drive, or the data discovered within the devices?  

Once you have decided the device no longer serves your purpose, and to reinforce confidentiality, they need to be properly disposed of, including the wiping of all traces of digital data. Corporations generally have a contract with specific businesses that can provide these types of services. As a consumer, research the correct way to protect your digital data and dispose of your equipment safely, effectively, and securely.

Digital data is not the only item to keep in mind when it comes to garbage day. The items of "ink on paper" are exceptionally easy targets for malicious users to obtain personal information for potentially malicious deeds. Even though some may feel this is the "digital age", many organizations and individuals exchange hard copies of "ink on paper" every day. Some examples of common documents are; tax records, banking financials, health records, bills, invoices, customer receipts, vacation records, and more. Once these documents have been consumed by the viewer, and are no longer required, they tend to be crumbled into a ball and used as a free throw shot off a wall (Yay! 2 points!!). The old saying, "out of sight, out of mind", does not apply here as these document can easily be viewed by an individual diving through your dumpster. In fact, they really do not require any specific tools to obtain this information, other than some gloves and a nose plug.

An easy way to prevent the "ink on paper" from being exposed, to the eyes of another, is to implement a practice of shredding your paper documents. Corporations may also have agreements with businesses that provide secure document shredding services, but as a consumer, pay attention to the type of shredder you utilize for yourself, such as the strip-cut and cross-cut. You want to ensure the document cannot turn into a puzzle that could easily be solved. Instead, make it your goal to reflect the appearance of Ramen Noodles. I have added a picture showing you the difference between the two shredding capabilities below.

Even though that first color television is long gone, I can at least enjoy watching the news about dumpster diving, and other cybersecurity events, in color on my new LED smart TV...which brings a whole new level of security problems of its own!

Thank you for reading! Until next time, remember that you don't have to become a victim of a threat to become aware of a threat!

Blog 7: Cloud Security with Diversity of Defense

Image courtesy of ddpavumba at FreeDigitalPhotos.net

In my effort to increase security awareness and obtain a cultural acceptance, I wanted to bring a focus on the use of cloud based solutions for storing data and security measures to consider that could assist in reducing some associated risks.

As we use different devices to obtain our data, having the ability to utilize cloud-based storage, like One Drive, Google Drive, and Drop Box, seem to have become a useful convenience for some. The convenience resides in the fact that you can have instant access to your data, anytime, and anywhere you have an Internet connection. Even more, some providers allow the opportunity to share your data with team members of your choice to provide an incredible opportunity for collaboration efforts. However, what if your data is being shared with individuals who are not a part of your team. What steps can you take to protect the information and confidentiality of your data?

First of all, a 100% protected and safe cloud based system and environment, more than likely, does not currently exist (none that I have seen thus far). Additionally, consumers must accept that risk does exist with the use of these systems, so the cloud solutions may not be for everyone. In fact, many businesses have policies that strictly prohibit the storage of company data within cloud based storage systems. Even so, measures can be taken to increase the level of security, thus reducing risk, to bring a feeling of comfort when utilizing the cloud as a storage location for your data. However, never go against your company policies, even if you implement security measures to protect the data. Policies put in place by your organization are MANDATORY and must be adhered to at all times. With that being said, let's focus on security measures for the data you own or have explicit permission to store within a system of your choice.

The first security measure to consider when storing data within the cloud is fairly simple to implement and is called password management. Make sure you have a secure and hardened password in place. Even more, ensure to change this password on a frequent basis. A useful tool to assist in this process is called a password manager, such as LastPass, DashLane, and 1Password, just to name a few. These programs can provide you with a means of changing, tracking, and hardening your associated passwords.

Another measure to consider, that corresponds with your password, is multi-factor authentication. By implementing this along side a hardened and frequently changing password, you are creating what is known as diversity of defense. Diversity of defense is a layered approach to security and protection. To illustrate, if a malicious user were to discover your hardened password, prior to your next scheduled change, they would not be allowed to log into your cloud based account without having possession of the device you selected to receive the pass code when you implemented multi-factor authentication. This, in effect, provides an additional layer of protection of your data, as well as a notification to assist you in taking an immediate action if you receive a pass code notification, but were not attempting to log into the system yourself. 

Lastly, and an extremely important measure, is encrypting your data. Even though you have applied diversity of defense with a hardened password and multi-factor-authentication, encrypting your data provides one more layer for that "just in case" situation. For example, If, for some reason, a malicious user were able to obtain your associated password, as well as the multi-factor pass code, your cloud based storage account could be accessed (breached). However, if you have an encryption solution implemented, such as Sookasa, the data residing within would be unreadable and therefore useless to the malicious user. 

Cloud based computing is an exciting and convenient opportunity for data access and sharing that you should not fear. If you put forth the due diligence and layers of security in place, you can enjoy the freedom to access your data from anywhere you have an Internet access, with the comfort of knowing you have several measures in place to protect the confidentiality of your data.

Thank you for reading! Until next time, remember that you don't have to become a victim of a threat to become aware of a threat!



    

Blog 6: A "Combination" of Issues

Image courtesy of Anoop Krishman at FreeDigitalPhotos.net

In my effort to increase security awareness and obtain a cultural acceptance, I wanted to bring a focus on combination locks, for physical security, and how easily they can be "cracked."

I remember being in high school and securing all of my items inside of my locker. As long as I could remember the three digits in the combination, I would be able to retrieve those items, while keeping others out. This locker provided a sense of security and a feeling of protection for the items residing within. In fact, I remember storing personal belongings, such as my really cool Sony Walkman I got for Christmas in the 80's. Lucky for me, I always remembered the correct numbers, which allowed me to have my books readily available for class...not that that helped me any as I couldn't hear the teacher over the Def Leppard music blaring on my Walkman (just kidding).

Anyways, back to the combination locks. Even though they are considered a physical security device that can assist in protecting items behind closed doors, there are ways to discover the code. If the code is discovered, the lock can be opened. If the lock can be opened, my Sony Walkman can be taken. If my Walkman was taken, Def Leppard would not sing to me in class!  Of course, I am still just kidding...I think!

So, how would someone be able to accomplish this? The first thing you need to do to "crack" a combination lock is to discover the third number in the code. To do this, you simply lift up on the clasp and rotate the dial in a specific way to find the "gap." It takes a little time to learn the technique of identifying the gaps within the numbers, as this is actually the hardest part.

Once you have identified the "gap", it becomes your third number of the combination. With this number, you simply fill in the Combination Lock Cracking Form listed below by following the instructions, which will have you write that number in the cell labeled #3. I created this form in 2015 to allow students to practice some lock cracking techniques in a course called Hacker High. Now just continue to follow the written algorithm to reveal all of the possible combinations.

Once you have all of the combinations written down, you attempt each one. You should have the combination revealed within 15 minutes. In fact, my record is just under 2 minutes for a lock I demonstrated for a class I was teaching. You will find that some are easier than others, but they all can eventually be opened utilizing this technique.

Have fun and use this knowledge for good, not for Walkman stealing evilness!

Thank you for reading! Until next time, remember that you don't have to become a victim of a threat to become aware of a threat!

Blog 5: The Sticky Key Vulnerability

Image courtesy of Stuart Miles at FreeDigitalPhotos.net

In my effort to increase security awareness and obtain a cultural acceptance, I wanted to bring a focus on a specific vulnerability within the Microsoft Windows Operating Systems. 

In the world of Information Technology security, a vulnerability is synonymous to the word weakness. The vulnerability I am referring to is called the Sticky Keys. If you press your shift key five (5) times, the Sticky Keys menu will pop up.  Go ahead and try it! 

This weakness can be exploited by a user, potentially malicious, in such a way that it could allow the user to reduce the overall security of the system and bypass your hardened password, no matter how strong it is!  

Based on information provided by (Wikipedia Vulnerability Computing, n/d.), a potential vulnerability generally has these three elements:

1.) An existing flaw within the system.
2.) Access to the system by the malicious user.
3.) Knowledge and capability to exploit the flaw.

With that being said, let's further define the vulnerability elements and compare to see if it applies to Microsoft's Windows operating systems being used on a laptop. Here is the scenario; you left your Windows 8 laptop on the restaurant table while you utilized the facilities (Bio Break!). When you returned to your table, and to your surprise (Really???), the laptop was gone. The individual who took your laptop arrived at their home and uses a Windows 8 DVD to change your local administrator password to access all of your files. How did this user do that? Continue reading to learn the answer.

If the malicious user were to take an existing Windows 8 DVD and place it into the DVD-ROM drive, then turn the laptop on and boot directly off of this DVD, they would be provided with the opportunity to install Windows 8. However, with your particular laptop, Windows 8 is already installed. Therefore, instead of pressing the "Next" button, the malicious user simply holds the shift key down and presses F10. By doing this, he/she receives a Command Prompt. Once they have the Command Prompt visible, they utilize the "CD" command (change directory) to get to the local Windows\System32 directory.

Now that they are at the local Windows\System32 directory, the malicious user would type the following command; "copy cmd.exe sethc.exe." This command will copy the Command Prompt executable file over top of the Sticky Keys executable file. The malicious user has now replaced the Sticky Keys menu program with the Command Prompt program. Once the user reboots the laptop normally, the logon screen will appear. From here, he or she will press the shift key five (5) times, but instead of the Sticky Key menu, they will see the Command Prompt. Even more, the Command Prompt has administrative priviledges, which aligns with the first vulnerability element, "a flaw within the system."

Since administrative privildeges exist, the next commands entered would allow the malicious user to view the name of your local accounts, as well as change the password for access. To view the local user accounts, they would type: "net user" and discover the user ID was, for example, PilotTroy. From here, they would type: "net user pilottroy P@ssw0rd1" to change the password for that local account.  Once this has been completed, they could simply type "exit" and log directly onto your computer to view all of your data, using your own personal account. Thankfully, there are ways to disable the Sticky Keys function, but that is for a different blog.

If you are interested in watching the video I created to see this in motion, **click here**

Thank you for reading! Until next time, remember that you don't have to become a victim of a threat to become aware of a threat!


References:
Wikipedia Vulnerability Computing(n.d.). Retrieved January 13, 2016, from https://en.wikipedia.org/wiki/Vulnerability_(computing)

Blog 4: If It Looks "Fishy", It Just Might Be "Phishy!"

Image courtesy of David Castillo Dominici at FreeDigitalPhotos.net

A fish, that is just floating effortlessly by a rock, all of a sudden sees a flash of white and yellow heading it's way. It thinks to itself, "that looks like something I could eat! Yes, it is something I could eat because it looks just like a minnow. If it looks like a minnow, it must be a minnow. I love minnows! Therefore, I must swim to it fast, open my mouth, and gobble that flashy and tasty little treat up." At this point, the fish is feeling very lucky. So, it moves in a quick direction towards the meal and completes the mission. Unfortunately, that was not a delicious minnow and the fish was tricked! 

Like the fish, I must be the luckiest person on the planet! According to some of the emails I receive, I have people from all over the world wanting to send me money. Out of everyone in the world...they picked ME! How amazingly lucky is that, right?! Even more, they make it so easy to get the money. All I have to do is provide them with some personal information, like my full name, social security number, and a bank account to get the money deposited. I am so incredibly LUCKY! Well, about as lucky as that fish on the end of the hook fighting to stay in the water while being pulled from the other end of the line. You see, after providing the information, I did not see any of the promised money deposited. Instead, I saw money withdrawn, as I too have been tricked! 

Lucky for me, this is just a story and didn't actually happen. As the title of this blog states, if it looks "fishy", it just might be "phishy." Phishing emails come in many forms and can even appear to be legitimate. Therefore, do not become a victim like the fish or my story. Before you click on any attachment or link in an email be sure to R.E.A.D. the email first. Ask yourself if the email is:

• Relevant: Is the email relevant and appropriate for you or your work? If the answer is no, it could be spam or a phishing attempt.

• Expected: Is the email from an expected or trusted source under the sender’s typical email address? Does this source normally send you similar emails or attachments? If the answer is no, it could be a phishing attempt.

• Action Requested: Does the email call for you to perform an urgent/immediate action (click a link or open an attachment)? If the answer is yes, it could be a phishing attempt.

• Defies Logic: Does the email sound too good to be true or seem suspicious? If the answer is yes, it could be a phishing attempt.

Thank you for reading! Until next time, remember that you don't have to become a victim of a threat to become aware of a threat!

Blog 3: Password Management

Image courtesy of Stuart Miles at FreeDigitalPhotos.net

In my effort to increase security awareness and obtain a cultural acceptance, I wanted to bring a focus on the importance of password management. Passwords are the keys to the doors to accessing the majority of our data that resides within. This data can be exceptionally important and should always be protected. Therefore, it is essential to learn effective password management techniques to keep you and your data a bit safer.

Since most of us have several accounts spread out over the Internet that hold various amounts of information, such as financial, healthcare, and educational data, we should have more than one associated password. If you utilize the exact password for several accounts, you are at more risk if an account were breached. Therefore, ensure you utilize a different password for each account you log into to offset the opportunity for password guessing attempts.

Speaking of password guessing, you should NEVER use something related to yourself, such as a pet or child's name, favorite sports team, hobby, etc. in your passwords. By doing so provides a means for a malicious individual to profile you to allow a better opportunity at a password guessing attempt. Further, your password should be a minimum of 8 characters, including upper/lower case with at least one number and character. This will make it more difficult for a brute force attempt if a malicious user is utilizing software as a tool.

So, I bet you cannot wait to change all of your 100 plus passwords you have to begin your quest for effective password management, right?  Ouch! I believe I just heard the most sarcastic sigh EVER from my readers (is that even possible?)!  Well, lucky for us, this is where I bring up a couple of options that could potentially make your quest much easier.  Allow me to introduce you to the world of password management tools.

The two services that come to mind are Dashlane and LastPass, although many more exist. Both of these services can provide you with access to all of the "doors" that hold your data. They provide extensive security features, including two-factor authentication and high level encryption.  Instead of remember hundreds of passwords, you need to only remember your "master" password, which you DO NOT want to forget or share. Even more, these services have the capability to create secure passwords for you. Both of these can assist you on your quest to secure and effective password management efforts. Best of all, you can give them a try for free!!

Thank you for reading!  Until next time, remember that you don't have to become a victim of a threat to become aware of a threat!  

Blog 2: Shoulder Surfing the Mobile Device

Image courtesy of jesadaphorn at FreeDigitalPhotos.net

In my effort to increase security awareness and obtain a cultural acceptance, I started a little game for myself.  This game was to see how many phone security pin numbers I could harvest, within 2 months, by simply shoulder surfing.  Everywhere I went, I would watch for those about to look at their phones and make an effort to harvest.  It was like my eyes were a farming combine and the people were my corn crops!

Of course, I would never attempt anything malicious with this information, as I do not actually have the phone in my possession anyways, but it proves how easy it is to obtain.  In fact, at my son's parent teacher conference in November, I was able to secure 3 more to my list, two teachers and one parent, hitting number 23 (Go Michael Jordan!!) over that two month period.

The point of this is, be aware of who is around you when utilizing your pass code.  Here are a few suggestions to consider prior to entering your "secret" code:

• Re-position your body prior to entering your code.
• Create a shield with your spare hand when entering your code.
• Use both thumbs and hit the left and right side, by crossing your thumbs across the phone prior to entering the number, for pattern confusion.
• Enter one of the numbers and turn your body prior to entering the next.
• Change your code at times.

To completely hide the pattern of your code, and you have the option available, utilize the fingerprint reader.  It is exceptionally difficult to discover a pattern over the shoulder when a pattern isn't even presented.  

A word of caution though with the fingerprint reader.  If you fall asleep with your phone nearby, be careful of your kiddo picking it up and pressing it, ever so lightly, against your finger to unlock it for some fun game playing!  Unfortunately, I am speaking from experience on this one!

Thank you for reading!  Until next time, remember that you don't have to become a victim of a threat to become aware of a threat!

Blog 1: Cultural Adaptation for Security Awareness

Image courtesy of Stuart Miles at FreeDigitalPhotos.net

There is no doubt in my mind that cybersecurity holds many topics to be aware of for organizations operating within this connected world. Throughout the duration of my blog, I will be focusing on specific areas of cybersecurity that should be considered when attempting to build a successful Security Awareness Program for cultural adaptation. By implementing this program, organizations may have a better opportunity to mitigate against varying risks, protect customer loyalty, and continue with the daily function of producing profitable revenue.

To accomplish this revenue generation, they perform their typical operating duties with the support of people, process, and technology to produce a product/service for customers to ultimately purchase. With this support comes a specific level of risk that must be considered to prevent any potential loss that could negatively affect the bottom line, tarnish the brand, or negatively affect customer loyalty. 

For example, the Department of Veteran's Affairs had a laptop stolen from a consultant in 2006. The laptop itself may have been worth $1,000.00, but the data (PII) held on the laptop was worth much more.  How much more?  After litigation, the amount was a staggering $20 million dollars(1). I believe this incident affected the overall bottom line in some manner and tarnished the VA branding. 

My main focus for this blog is to provide the reader with some additional knowledge on the topics of security awareness to assist with a cultural change. Examples of potential security awareness topics include but are not limited to:

• Social Engineering
• Shoulder Surfing and Dumpster Diving
• Passwords
• Encryption and Cryptography
• Mobile Devices
• Phishing/Vishing
• Training and Awareness
• Policies, Checklists, and Procedures
• BYOD in the Enterprise
• Cloud Computing
• Access Controls
• Physical Security
• Measuring Effectiveness
• Compliance Issues

Thank you for reading!  Until next time, remember that you don't have to become a victim of a threat to become aware of a threat!

References: 

(1) http://www.cnn.com/2009/POLITICS/01/27/va.data.theft/