Blog 8: One Person's Trash is Another Person's Treasure (Dumpster Diving)

Image courtesy of keerati at FreeDigitalPhotos.net

In my effort to increase security awareness and obtain a cultural acceptance, I wanted to bring a focus on the importance of properly disposing personal items, such as equipment, documents, and data, to prevent individuals from snooping through your trash looking for personal information. As the title of the blog states, one person's trash is another person's treasure.

I remember when I was around 9 years old, my brother and I were walking down the street, on a hot Summer day, towards the playground. It just so happened to be trash day and everyone had their items to be disposed of sitting nicely on the curb in front of their homes. Some of the items were in large bins, some in bags, while others were in their regular form staring right back at us as we walked by. 

As we continued towards the playground, a particular item caught the attention of my brother. He stopped abruptly and strongly nudged me in the side to take a look. After yelling "OUCH!" and attempting to nudge him back (typical sibling love), I focused in the direction of the object of interest. Lo and behold, sitting right in front of us, waiting to be taken by the sanitation engineer, was the first color television my family would own (sure glad it wasn't the last). That's right, I am either that old, or we were that poor!    

Now, this television didn't have any personal identifiable information (PII) relating back to the original owners, nor were we looking for any items of reference whatsoever. In fact, we weren't even looking for a television on that day. However, it is an example of how one person's trash can become another person's treasure. In this case, the treasure was a color television that only required 2 to 3 kicks in the side to make it turn on.

If we were to fast forward a couple of decades, we may be able to change the story from a disposed television to a personal computer. In this situation, the computer could have a hard drive that may hold several pieces of personal data within the magical platters of the metal box. If a malicious user were to obtain this data, they could potentially learn a lot about the previous owner of the computer, even PII. Even more, and moving forward another decade, we may find a thumb drive nestled deep in the bottom of a trash bin, which may hold some interesting information as well, such as financial, tax, and password documentation. Would the "treasure" be the computer/thumb drive, or the data discovered within the devices?  

Once you have decided the device no longer serves your purpose, and to reinforce confidentiality, they need to be properly disposed of, including the wiping of all traces of digital data. Corporations generally have a contract with specific businesses that can provide these types of services. As a consumer, research the correct way to protect your digital data and dispose of your equipment safely, effectively, and securely.

Digital data is not the only item to keep in mind when it comes to garbage day. The items of "ink on paper" are exceptionally easy targets for malicious users to obtain personal information for potentially malicious deeds. Even though some may feel this is the "digital age", many organizations and individuals exchange hard copies of "ink on paper" every day. Some examples of common documents are; tax records, banking financials, health records, bills, invoices, customer receipts, vacation records, and more. Once these documents have been consumed by the viewer, and are no longer required, they tend to be crumbled into a ball and used as a free throw shot off a wall (Yay! 2 points!!). The old saying, "out of sight, out of mind", does not apply here as these document can easily be viewed by an individual diving through your dumpster. In fact, they really do not require any specific tools to obtain this information, other than some gloves and a nose plug.

An easy way to prevent the "ink on paper" from being exposed, to the eyes of another, is to implement a practice of shredding your paper documents. Corporations may also have agreements with businesses that provide secure document shredding services, but as a consumer, pay attention to the type of shredder you utilize for yourself, such as the strip-cut and cross-cut. You want to ensure the document cannot turn into a puzzle that could easily be solved. Instead, make it your goal to reflect the appearance of Ramen Noodles. I have added a picture showing you the difference between the two shredding capabilities below.

Even though that first color television is long gone, I can at least enjoy watching the news about dumpster diving, and other cybersecurity events, in color on my new LED smart TV...which brings a whole new level of security problems of its own!

Thank you for reading! Until next time, remember that you don't have to become a victim of a threat to become aware of a threat!

Blog 7: Cloud Security with Diversity of Defense

Image courtesy of ddpavumba at FreeDigitalPhotos.net

In my effort to increase security awareness and obtain a cultural acceptance, I wanted to bring a focus on the use of cloud based solutions for storing data and security measures to consider that could assist in reducing some associated risks.

As we use different devices to obtain our data, having the ability to utilize cloud-based storage, like One Drive, Google Drive, and Drop Box, seem to have become a useful convenience for some. The convenience resides in the fact that you can have instant access to your data, anytime, and anywhere you have an Internet connection. Even more, some providers allow the opportunity to share your data with team members of your choice to provide an incredible opportunity for collaboration efforts. However, what if your data is being shared with individuals who are not a part of your team. What steps can you take to protect the information and confidentiality of your data?

First of all, a 100% protected and safe cloud based system and environment, more than likely, does not currently exist (none that I have seen thus far). Additionally, consumers must accept that risk does exist with the use of these systems, so the cloud solutions may not be for everyone. In fact, many businesses have policies that strictly prohibit the storage of company data within cloud based storage systems. Even so, measures can be taken to increase the level of security, thus reducing risk, to bring a feeling of comfort when utilizing the cloud as a storage location for your data. However, never go against your company policies, even if you implement security measures to protect the data. Policies put in place by your organization are MANDATORY and must be adhered to at all times. With that being said, let's focus on security measures for the data you own or have explicit permission to store within a system of your choice.

The first security measure to consider when storing data within the cloud is fairly simple to implement and is called password management. Make sure you have a secure and hardened password in place. Even more, ensure to change this password on a frequent basis. A useful tool to assist in this process is called a password manager, such as LastPass, DashLane, and 1Password, just to name a few. These programs can provide you with a means of changing, tracking, and hardening your associated passwords.

Another measure to consider, that corresponds with your password, is multi-factor authentication. By implementing this along side a hardened and frequently changing password, you are creating what is known as diversity of defense. Diversity of defense is a layered approach to security and protection. To illustrate, if a malicious user were to discover your hardened password, prior to your next scheduled change, they would not be allowed to log into your cloud based account without having possession of the device you selected to receive the pass code when you implemented multi-factor authentication. This, in effect, provides an additional layer of protection of your data, as well as a notification to assist you in taking an immediate action if you receive a pass code notification, but were not attempting to log into the system yourself. 

Lastly, and an extremely important measure, is encrypting your data. Even though you have applied diversity of defense with a hardened password and multi-factor-authentication, encrypting your data provides one more layer for that "just in case" situation. For example, If, for some reason, a malicious user were able to obtain your associated password, as well as the multi-factor pass code, your cloud based storage account could be accessed (breached). However, if you have an encryption solution implemented, such as Sookasa, the data residing within would be unreadable and therefore useless to the malicious user. 

Cloud based computing is an exciting and convenient opportunity for data access and sharing that you should not fear. If you put forth the due diligence and layers of security in place, you can enjoy the freedom to access your data from anywhere you have an Internet access, with the comfort of knowing you have several measures in place to protect the confidentiality of your data.

Thank you for reading! Until next time, remember that you don't have to become a victim of a threat to become aware of a threat!



    

Blog 6: A "Combination" of Issues

Image courtesy of Anoop Krishman at FreeDigitalPhotos.net

In my effort to increase security awareness and obtain a cultural acceptance, I wanted to bring a focus on combination locks, for physical security, and how easily they can be "cracked."

I remember being in high school and securing all of my items inside of my locker. As long as I could remember the three digits in the combination, I would be able to retrieve those items, while keeping others out. This locker provided a sense of security and a feeling of protection for the items residing within. In fact, I remember storing personal belongings, such as my really cool Sony Walkman I got for Christmas in the 80's. Lucky for me, I always remembered the correct numbers, which allowed me to have my books readily available for class...not that that helped me any as I couldn't hear the teacher over the Def Leppard music blaring on my Walkman (just kidding).

Anyways, back to the combination locks. Even though they are considered a physical security device that can assist in protecting items behind closed doors, there are ways to discover the code. If the code is discovered, the lock can be opened. If the lock can be opened, my Sony Walkman can be taken. If my Walkman was taken, Def Leppard would not sing to me in class!  Of course, I am still just kidding...I think!

So, how would someone be able to accomplish this? The first thing you need to do to "crack" a combination lock is to discover the third number in the code. To do this, you simply lift up on the clasp and rotate the dial in a specific way to find the "gap." It takes a little time to learn the technique of identifying the gaps within the numbers, as this is actually the hardest part.

Once you have identified the "gap", it becomes your third number of the combination. With this number, you simply fill in the Combination Lock Cracking Form listed below by following the instructions, which will have you write that number in the cell labeled #3. I created this form in 2015 to allow students to practice some lock cracking techniques in a course called Hacker High. Now just continue to follow the written algorithm to reveal all of the possible combinations.

Once you have all of the combinations written down, you attempt each one. You should have the combination revealed within 15 minutes. In fact, my record is just under 2 minutes for a lock I demonstrated for a class I was teaching. You will find that some are easier than others, but they all can eventually be opened utilizing this technique.

Have fun and use this knowledge for good, not for Walkman stealing evilness!

Thank you for reading! Until next time, remember that you don't have to become a victim of a threat to become aware of a threat!