Tag Archives: user security

Holiday Season Security

The state of Washington Office of Cybersecurity has recently posted a good article related to information security and online shopping at http://cybersecurity.wa.gov/resources/security-tips/.  This is a good time of year for this kind of reminder as we all are taking advantage of the convenience and ease of shopping online.

It cannot be emphasized enough that we each must constantly take care with our private information, particularly financial information like bank accounts and credit cards, and particularly when using or accessing such information using mobile devices.

Don’t trust public computers or wireless networks (even the college’s public Wi-Fi network) to be secure enough for these kinds of transactions.  It is not difficult for a malicious actor to be able to intercept wireless signals as they pass between your phone and the most secure wireless access point, thus having access to obtain whatever information you type into your device.  This could include account numbers, user names, passwords and personal identification numbers (PIN).

Do your online shopping with a trusted wired connection as often as you can (not with public computers like in a library or college computer labs–you never know if the person using it before you compromised the machine).  If you must use a mobile device, like a phone or tablet, be certain to follow the OCS guidelines to make your shopping “trip” as uneventful as possible.

Safe Computing!

 

Cybersecurity Awareness… or not?

An interesting exchange of opinions recently occurred between two of my favorite news sources related to information technology security.

Since we are still in the midst of a month declared by the federal government as “Cybersecurity Awareness Month” (see both https://www.dhs.gov/national-cyber-security-awareness-month and https://staysafeonline.org/ncsam/), which is an effort to increase security awareness among regular technology users, the disagreement is interesting.

The premise of “cybersecurity awareness” is that all computer users need to be trained to be more knowledgeable and to apply their experience, knowledge and expertise in making the use of modern technology more secure.  This is a worthy goal, I believe.

However, Bruce Schneier,  a highly respected security expert and author, persuasively argued recently that maybe the computing industry should be less focused on educating the user and more on fixing the current state of technology:

Stop Trying to Fix the User

I am sure that many technology users will agree that there are basic technology fixes that should happen!  However, Lance Spitzer, the training director for the Securing the Human of the SANS Institute and security blogger for Educause disagreed with Bruce’s emphasis on the technology:

Why Bruce is Wrong

The college’s Information Technology Services division does as much as can be done technically to ensure that all users have as safe a computing experience as they can on campus.  However, given the state of computing technology, solving IT security issues with technical solutions is never going to be enough to make them non-existent.

Every one of you, as users of college systems, are still an important part of a robust security solution, and your ability to recognize something is wrong often proves better than the best technology solution.

So in a way, both of these authors are correct:  There absolutely should be better, more secure technological ways of doing some of the everyday things we do with computers, like click a link or login, but until that exists, users need to be better trained and more aware of how to evaluate the risks inherent in technology use on a daily basis and to respond when they experience attacks by malicious users.

This  will continue to be an interesting discussion, I think…

Safe Computing!

Lock Down Your Login

As October’s Cybersecurity Awareness Month continues, I thought I would refer once again to the federal Stop.Think.Connect information campaign and focus briefly on one particular topic currently being emphasized there.

Be careful and turn your speakers down before clicking on this link, as the page automatically plays a cutesy animated YouTube video, but the Lock Down Your Login page is a good introduction to what is known as Multi-Factor Authentication (MFA).   This site calls it “strong authentication.”

Once you as a user have been authorized to use a particular technology system, such as a banking website or your work computing network, authentication is the process of verifying your identity to that system so it can provide you the access needed.

Commonly, this is done by prompting a user to provide a login name and password, which in computing terms is considered “single-factor” authentication.

Multi-Factor Authentication is a mechanism through which a user is granted access only after more than one form of authentication is presented.  MFA may sometimes be referred to in the media or on websites as two-step authentication or two-factor authentication (2FA) , but technically 2FA is a subset of MFA.

One very common example of two-factor authentication is the use of a debit card (factor one-something you HAVE) and a PIN (factor two-something you KNOW) to withdraw money from an ATM.

Another example of MFA you may already experienced is the use of your thumb or finger print to unlock your cell phone.  In this case, the first factor (something you HAVE) is the phone, the second factor (something you KNOW) is the password you have previously saved on the phone, and a third factor (something you ARE) is the ability of the phone to read your thumbprint (also called biometrics).  If any of these factors are not available, you cannot access the information on the phone.

Most information security experts now recommend the use of MFA in all cases of authentication, particularly as more and more of our login information is being stored on servers all over the world and more and more of those servers are compromised.

For instance, commerce websites such as Amazon.com asks that you create a username and password (single-factor) to be able to use their service.  A compromise of that information on their servers by hackers or even company insiders could allow malicious users to pretend to be you and make purchases on your account without your knowledge.

The problem multiplies if you happen to employ the same password for different accounts on different systems.  Once one is compromised, all your accounts secured with a single-factor using the same password are potentially compromised.

If, however, if you have set up MFA with your Amazon account,  which allows you to receive a one-time random code via text message, automated phone call or third-party app (such as Google Authenticator or Microsoft Authenticator),  the malicious user cannot get into your account without using that code which only you have on your phone.  Even if they have somehow obtained both your username and password, they cannot login to the MFA protected account.

Other websites or networks now also use phone-based MFA, but there are also methods that are not phone-based, such as the use of security token generators or smart cards.

A few people think the extra step of obtaining and using a random code is too onerous to do every time you log into a particular account.  But this simple extra step increases the security of that account so significantly that most major online companies are preparing or already offering some sort of MFA for use with their accounts.  If that extra step prevents the use of your personal credentials even after a security breach, it is obviously worth it.

As someone who pays close attention to information security and the scary trending online threats and growing malicious practices, I choose to use MFA for my personal accounts whenever it is available, and use both phone text-based codes and app-based code generators.

The use of MFA is also growing quickly in the work place as institutions and business work to protect their internal technology resources, and is currently being tested here at Bellevue College for possible use with Office 365.

If you are worried about this, remember that a couple of decades ago our typewriters didn’t require a login at all, but after computers became ubiquitous, we learned how to function with usernames and passwords. Now it seems natural.

MFA will be the same kind of cultural revolution.   I think it is safe to predict that one day we will be using MFA for all of our accounts as another line of defense against malicious users, and won’t think twice about it.

Safe Computing!

State Office of CyberSecurity

The Washington State Office of Cyber Security (WA-OCS) was created in 2015 to help coordinate state-wide efforts to protect the electronic data and information held by state institutions and agencies (such as BC).

In addition to up-to-date advisory information for security professionals in state agencies, the website for WA-OCS also includes news articles, videos, security tips, lists of recent scams, and information about other resources that the general public may be interested in as they work to be safe online at home and protect their own and their family’s personal data.

As society continues to conduct more and more commerce and social interaction online and “in the cloud”–both professionally and personally–it can never hurt to be informed of the latest cybersecurity information.  So you may consider adding the WA-OCS website to your personal list of important information resources.

Safe Computing!

Stop. Think. Connect

October is Cybersecurity Awareness Month, and in celebration, below are some links to the federal STOP.THINK.CONNECT organization’s tips & advice website and their general advice regarding online safety habits.

STOP.THINK.CONNECT is a good, lay-level website with lots of information and resources addressing some of the basic things that any of us can do, either at home or in the workplace, to help ourselves more securely use computers online.

These basic tips are available in multiple languages :

English, Spanish, Portuguese (Brazilian), Russian, French (Canadian),  and Japanese.

There are also safety tips for mobile devices.

Please take the time to review these basic tips and apply them both with your personal accounts to help prevent cyber-trouble for your cyber-self, and with your professional practices at work.

Other good sites related to your personal online accounts and internet use include:

https://www.lockdownyourlogin.com/

https://www.stopthinkconnect.org/campaigns/own-your-online-presence

https://www.stopthinkconnect.org/campaigns/keep-a-clean-machine-campaign

Safe Computing!

Good article on ransomware

Ransomware is a type of malicious software that encrypts files on a computer until the user pays money to a bad actor to get them unencrypted.  This is the fastest growing sector of malicious software and is enormously inconvenient if you become a victim.

I have posted a good article about ransomware on the OUCH page of this site, but wanted to bring everyone’s attention to it here on the blog. Take a few minutes and get up to speed on this pernicious threat.

The OUCH archives page on this site is found under “AWARENESS” > “SANS OUCH! ARCHIVE” through the menu at the top right of this page.  It can also be reached directly at:  http://commons.bellevuecollege.edu/itsecurity/sans-ouch/ .

The original article can also be found at the Securing the Human website at http://securingthehuman.sans.org/newsletters/ouch/issues/OUCH-201608_en.pdf.

Safe Computing!

Credential Stealing

One of the consistently best voices addressing cyber security issues worldwide is Bruce Schneier.  He is a cryptography expert and privacy advocate out of Harvard who has published many books, some of which are very technical in nature and intended for professional information security audiences .  But one of his great skills is that he also writes about important and timely privacy, trust and security topics in a manner that is accessible to most lay people.

Today I am bringing your attention to a recent article he wrote for the Xconomy web site which addresses the evolving nature of  computer attacks and the assumptions most people make that such attacks are merely technical or malware issues.

Turns out, the challenges in modern IT security are not so much about technology, but about people using the technology.  In fact, Schneier states that “…software vulnerabilities aren’t the most common attack vector: credential stealing is.”

The article quotes the head of the NSA’s Tailored Access Operations (TAO) group as saying “…stealing a valid credential and using it to access a network is easier, less risky, and ultimately more productive than using an existing vulnerability, even a zero-day…” ( essentially a software-based cyber attack using previously unknown tools or methods).

Schneier urges computing professionals to adapt to this changing environment, but the key piece of information within the article for most regular technology users is that they are more and more likely to be the initial target for malicious actors, who are using everything they can–including social engineering, phishing, physical and psychological manipulation, and outright threats–to gain legitimate credentials to target systems or networks, including home networks.

Using the kinds of techniques perfected by stereotypical con men and the hacker culture,  modern criminals are now hacking people more than they are hacking machines.  And once they have YOUR work or personal login credentials, they have the same access to everything you have access to within those environments.

So this article is a good reminder for each of us to think twice any time a person or a machine asks for personal or college information, or for home or work technology credentials.

Safe Computing!


The full Bruce Schneier essay can be accessed at: http://www.xconomy.com/boston/2016/04/20/credential-stealing-as-attack-vector/

If you are interested and wish to see more of Bruce’s writings, his personal blog web site is: https://www.schneier.com/.

(Sometimes his writings are too technical for me, but he has a very practical, realistic and common sense approach to many security and privacy issues, so it is worth checking his site out for the more generalized stuff that can help you can understand all of the issues about which he writes.)

Beware Humans with Computers!

At a recent presentation to state risk managers in Olympia, representatives of the law firm BakerHostetler, which includes a number of attorney’s who specialize in resolving information security data breach issues, identified that cyber attacks using Phishing and Malware  was the cause of 31% of the more than 300 data security incidents the firm handled nationwide in 2015.  This is not much of a surprise given the recent increases in the number of these types of attacks.

The second highest category identified at 24% was Employee Action/Mistake, which includes failures of employees to follow organizational policies resulting in a data breach.

Interestingly, the next highest causes of data losses include other categories which also have significant ties to how authorized users interact with information technology and the data stored and manipulated with that technology.  These include: Loss or Theft of a Device (17%); Vendor/ Contractor Actions (14%); Internal Employee Theft (8%); and Lost or Improperly Disposed Data (6%).

These statistics show that the human component of data protection is significantly more important with regard to modern IT security issues than is the technology component.

The underlying source of ALL of these top kinds (92%) of data breaches can easily be attributed to the authorized users of the compromised data and either a deliberate disregard for organizational policies or a lack of information security awareness on their part.

Clearly, it is important for each of us to understand that we each need to constantly protect the college data we access during the course of our daily work, and to ask questions of our supervisors when we are not certain how best to do that.

The college has published a number of policies and procedures related to technology use by college employees and the protection of college data.  Here are links to a few of those current documents:

Take some time this week to update yourself on the information in these important documents and, as always:  Safe Computing!

Password Security

I haven’t had much time recently to write here a lot, but there is an interesting story related to a data breach in the public sector that I thought would merit a few moments today (here is a link to a Wall Street Journal article about it ).

The basis for the story is that a number of DropBox (a popular cloud file storage site) account passwords have been published by some hackers.  However, the security for the DropBox site itself has NOT been compromised in any way…

So what happened?

It seems that the hackers were able to get into another unidentified website’s user database, which stored account names and password credentials for that site, then went down that list of credentials at the DropBox site.  They were subsequently able to access a number of DropBox accounts.   This ability to use a password stolen from one site to access another site occurred because the users used the same login name and password for their DropBox account that they used on the website that was compromised!

Knowing it would be difficult to get through the high levels of security that DropBox has in place, the hackers simply went to the less secure site and reused against DropBox the information they acquired there.  It wouldn’t surprise me if they actually did this a number of places.  They could have tried accessing Google or Microsoft or Yahoo or any other site they wanted.  The security issue is actually the REUSE by users of the same user names and passwords on different websites.

This illustrates one of the primary purposes behind most malicious attacks: the acquiring of credentials.  If a person with bad intent has actual login access to any given website, it doesn’t matter how much security that site has against direct attacks or hacking.  The bad guys are already in.

Bottom line:  never give away your login name and password, and don’t reuse passwords across multiple websites.  That is the ideal.

However, because it is difficult for all of us to keep track of lots and lots of passwords and to always use a different one for every purpose, at least be aware of what you are trying to protect and think about how to use more secure passwords at sites you wish to better protect.

For instance, you absolutely shouldn’t use the same password for very public places like Facebook or Twitter that you use for very private places like your bank or credit union site.

This applies to campus, as well.  The password you use when handling sensitive or protected college information shouldn’t be the same password you are using to sign up for a Groupon newsletter or to access personalized content on CNN.

 

Security Intelligence Report

Warning:  for serious information security buffs only!

Microsoft has recently published it most recent security intelligence report (152 pages!) on the current state of information security and exploitation trends in the world.  While it is not really intended for the casual computer user, it is fascinating reading if you are interested in diving a little deeper into the bigger information security picture.

There is a 21 page summary version and a 94 page worldwide threat assessment also posted on their Security Intelligence Report website, along with lots of links to other related information if you are bored and have an afternoon to kill…

Just think!  Some of us get to read this stuff every day!

ENJOY the beginning of summer this weekend.