The view from a small college CIO: Infosec is getting harder to do.

Posted on by
Reply

Ravi Ravishanker is the CIO and Associate Provost at Wellesley College in Massachusetts. He has been in IT for many years, and supports an organization with more than 1400 faculty and staff. I spoke to him in September 2016. “Information security has continued to be one of the highest priority for every one of the IT organizations I have worked for. The only difference is that it has become harder and its relative importance compared to the other things we have to do has gotten higher, which results in much higher resource allocation to security across the entire institution.”

He recalls back in 1986, when he began his IT career. He was writing code in assembler for a VAX VMS. This was done to make it faster to execute. “However, we made a programming error to have one user send a file to another using TCP/IP. Because of an internal security lapse, the students found out they could send someone else’s files using our program. It didn’t take long to fix the problem, fortunately.” Coming into the modern day, he finds that vulnerability scanners are one of his most important security tools. “This is because they expose vulnerabilities about network ports that shouldn’t be open. Similarly, scanners that test our web apps for a range of vulnerabilities are also essential.”

“We realize that given our limited resources, we have to be very diligent. First and foremost, data and network security needs to be a priority for everyone in the IT organization, not just a select group of security administrators. Also, security is a joint partnership between IT and our users; it is a shared responsibility of the entire the enterprise. If our users aren’t following best practices, they can expose our enterprise to data security issues. Security is a critical part of everything that we do.”

To date, he hasn’t seen much in the way of insider threats at the college. “People in higher education have a sense of loyalty to the institution, and we place a lot of trust in our employees. While insider threats are always a potential issue, we are in a space where it is minimal.”

The college has moved into the cloud and continues to increase its cloud footprint. “We try to do as much due diligence when we sign up with a new provider and make sure that they are giving us the security that we need. We thoroughly review the contracts and agreements from security and compliance perspectives before signing up with a provider.”

“We are a fairly small IT organization and currently our user services, which manages desktop support, and the systems and network groups are all under one director. This works really well in terms of information exchange between the groups and easy access to the systems and network engineers. However, we recently decided to reorganize this group and we hope that this relationship will be preserved because this relationship is critical from information security perspective.”

Like what you are reading?

Subscribe to Inside Security!



iBoss blog: How to Communicate to Your Customers After a Breach

Posted on by
Reply


There have been numerous breaches at major consumer retail companies over the past year. Most of these are followed with some kind of  “apology letter,” laying out what customers can do to protect their credit and what information was stolen from the retailer’s databases. Sadly, there aren’t any shining examples from this collection of correspondence. And the cases that I’ll cite here are what to avoid rather than to mimic. But there are some important lessons to be learned, both from designing the best apology letters to improving IT practices post-breach.

You can read the article on the iBoss blog here.

FIR B2B Podcast #54, 55: good and bad PR pitches

Posted on by
Reply

Paul Gillin (my podcasting partner in crime) and I both get lots of pitches from PR people: most of them are sadly missing something. In this and subsequent podcasts, we take the time to review what makes a great PR pitch and provide examples of both good and bad ones. We talk about the elements that compromise a great PR pitch, give kudos to two of our favorite PR folks that always deliver them, and highlight some of the more irksome things that we have experienced over the years.

 

You can listen to part 1 of our 15 minute podcast here:

And here is part 2 of the 19 minute podcast here:

The current state of online ad blockers (plus podcast)

Posted on by
3

The online advertising world is undergoing a massive transition right now, trying to cope with an increasing technology war between the advertisers and us, the people that view their advertising. It is messy, it is contentious, and no one really knows what is going to happen in the coming months and years.

Recently, Facebook made changes to the way it works with displaying online ads. They say in that linked post, “We’ve all experienced a lot of bad ads: ads that obscure the content we’re trying to read, ads that slow down load times or ads that try to sell us things we have no interest in buying. Bad ads are disruptive and a waste of our time.”

Here is the problem: one person’s “bad” ad is another person’s opportunity to sell you something that maybe you might want. So they have attempted to clarify the issue, and give users more control over their ad experience. So far, it hasn’t been good.

How many of you Facebook users know about this page to control your ad preferences? I don’t see many hands being electronically raised. Take a moment, click on the above link, and spend a few minutes browsing around to see what they have done. You will be surprised.

facebookads

The page is full of confusing controls and has a really poor user experience. For example, as you can see from the screen shot, I have given my personal information to three different advertisers, two of whom that I didn’t recognize. When I deleted these two – because I don’t want to hear from them ever again – they first fade, before disappearing from view if I would return back to this page.

Andrew Bosworth, a VP at Facebook, says, “Some ad blocking companies accept money in exchange for showing ads that they previously blocked — a practice that is at best confusing to people and that reduces the funding needed to support the journalism and other free services that we enjoy on the web.” (my emphasis added)  That is a lofty thought.

But let’s not just blame Facebook. At least they are trying to take control over the situation and make improvements, so that users will click on more relevant ads and they will be able to charge more for them. How about the traditional news generators, like newspapers and other media companies? What are they doing about online ads?

The short answer is that they are selling every square pixel they can and finding new ways to pop-up, pre-roll, roll over, mix sponsored and editorial content, and in general pollute the overall browsing experience of their online properties. Just about every publication that I want to read places some obstacle (and that is what I think about them) in my way when I try to click on an article that I want to read. Their home pages automatically start playing noisy videos that have me using the mute button on my PC as a default setting, just so I can have some peace and quiet when I am reading in the mornings.

I know, they have to make money. Print advertisers are leaving in droves, subscribers are few and far between, and newsrooms are ghost towns.

So a few years ago, technology comes to the rescue and creates browser plug-ins called ad blockers. These sense pop-ups and other devious methods, and prevent them from displaying ads. It is a great idea, and most modern browsers have incorporated some of their features too.

However, the problem is the blockers worked too well. So Facebook and other major sites who benefit from advertising revenue have decided to block the blockers. Now we have a cat-and-mouse game, where as one side adds new features, the other side figures out a way around them. Malware authors have been doing this for decades.

“More publishers will have to look to more innovative ways to incorporate their commerce with their content.” So says TechCrunch, who ran this story not too long ago. They proposed a sensible argument for how ad blockers can improve the overall experience and at least eliminate the cheesy online ads. But what is happening is that innovation has turned into just using as many ways as possible to put up online ads.

The pre-eminent ad blocking company is called Ad Block Plus. On their blog, they announced a new version of their software that is used by hundreds of millions of users. It is called “Acceptable Ads Platform.” Basically, they get to choose which ads are “good” and which aren’t. They will continue to block the bad ads, but allow good ads by default. You can change this setting and not allow any ads whatsoever.

The New York Times has said, “instead of blocking bad ads, AdBlock allowed ads it deemed acceptable to be seen, often for a price.” This strikes me as something we used to call “bait and switch.” The Ad Block Plus company now wants to be known as a “web customizing” company. This seems a bit naïve, or misleading, or both. It also puts this company in the hot seat to decide what is acceptable and what is not. They claim to be putting together a panel of judges. We’ll see how well that will work.

As I said, this is all early days for what will come. While the web has been with us for decades, and online advertising too, it seems we need to work together to figure out how to best serve up ads that won’t block the editorial content that we were trying to view and still allow the publishers and media companies to make money from our interests. So far, it is sub-optimal for nearly everyone involved.

To hear more about this matter, listen to our latest podcast from Paul Gillin and I where we discuss this issue. Or leave your comments here.

Inside the Jihadist’s Tech Toolkit

Posted on by
Reply

A July report entitled Tech For Jihad: Dissecting Jihadists’ Digital Toolbox details and analyzes how 36 specific tools are used by various jihadist groups. While the news media has focused on how these groups leverage particular social media accounts and these are well documented (that last link has some solid suggestions on improving your social media posture too), there is actually a wide array of other tools that are used to spread propaganda, recruit new members, and launch cyberattacks. Indeed, the jihadists rely a great deal on the Internet and as they increase their digital footprint require the same kinds of security protection that any careful enterprise would employ these days.

Two security researchers from Flashpoint wrote the report: their company is a security vendor that analyzes the dark web and provides other intelligence reports about malicious actors.

At the heart of their toolkit is the Tor browser, which enables anonymous surfing and connecting to the Dark Web for various illegal activities. According to the report, Tor has been in use since May 2007 by the jihadi groups. A year later saw the creation of a custom encryption tool called Asrar Al-Mujahideen. After the Snowden revelations, a new tool was released called Amn Al-Mujahid. A full timeline, from the RecordedFuture blog, can be seen here:

 

The preferred access method seems to be the Opera browser, because it can connect to a free VPN service, and mostly from Android devices. Speaking of VPNs, they were first used in 2012, and the authors found early posts on dark web forums comparing the various VPN technologies and their advantages and disadvantages, just like any solid IT researcher would go about doing. This included an analysis of what kinds of logs the VPN software keeps and how these logs can be erased. The VPN chosen was the CyberGhost VPN (there are free and paid versions, and of course payments in bitcoin is accepted).

Another tool mentioned in the report is the HardDiskSerialNumberChanger, which can further obfuscate the originating device identifying information coming from the local hard drive. Another tool is called FakeGPS, which provides a false physical location to various social media clients such as Facebook and Twitter. This enables users to pick some fake location when they post social updates.

Then there is various encrypted email services, including HushMail, ProtonMail, GhostMail and Tutanota, among others. The authors document the use of these products by jihadists beginning in February 2013. This was followed with encrypted text messaging chat services, such as What’sApp and Telegram. Telegram in particular is used to disseminate official statements from Jihadi leadership to the general public. Because it offers end-to-end encryption, this makes messages difficult to read while in motion and is why the app is becoming more popular among jihadists. Taken together, what is clear is that jihadists are doing a great deal to carefully hide their locations and digital tracks.

This is just a few of the tools that are employed by these organizations. There are others, including home-grown mobile apps that are used to spread propaganda (including their own podcasts and other media streams) in both English and Arabic to supporters. These media streams have proven so popular that “culture jammers” have released their own apps that purport to be the “real” ISIS podcasts to confuse their audience. This is what Google’s Project Jigsaw has been working over the past year to target aspiring ISIS recruits and dissuade them from signing up. By using search algorithms, the program places ads alongside common search terms and keywords that link to anti-ISIS English and Arabic YouTube channels. Jigsaw hopes these links of testimonials can debunk the Jihadi narratives, and so far it seems to be working. Click through rates on Jigsaw’s curated videos were three times more than the pro-ISIS links, according to Wired magazine.

Clearly, this increasingly comprehensive outlook shows how seriously jihadists handle their operational cyber security and other online activities. But it could also be a useful example for ordinary enterprise IT workers, who travel abroad or who wish to maintain a higher level of security themselves.

There is much that can be learned from the jihadist infosec toolkit and how they make use of the Internet for recruitment.

As the authors conclude, “While jihadists incessantly adapt their behaviors to evade surveillance, we must adapt our surveillance tactics to keep up. The more we understand about how jihadists leverage digital technologies to engage in nefarious activities, the better equipped we will be to defend ourselves and mitigate risk as effectively as possible.”

SecurityIntelligence: No Business Is Too Small for SMB Cybersecurity

Posted on by
Reply

Smaller businesses, like the HVAC company that caused the Target penetration in 2013, often think they are too small to be security targets, but SMB cybersecurity can have big implications. Size doesn’t matter as long as your firm has something of value that someone thinks is worth stealing, or a connection that someone thinks is worth exploiting.

However, the more vertical the SMB market, the more likely it is to sustain attacks. I explain why in this post for IBM’s SecurityIntelligence.com blog.

What, me worry (about my emails)?

Posted on by
4

I never thought I would see the day where executives and major public figures would be proud of their techno-luddite status. Scratch that. Not proud, but grateful. In a story in today’s New York Times, several senators and other public figures are quoted about how they have given up their personal email accounts, or have begun scrubbing their sent folders, thanks to the recent series of leaks from the mailboxes of the DNC and Colin Powell.

chuck2Senator Lindsey Graham said, “I haven’t worried about an email being hacked since I’ve never sent one. I’m, like, ahead of my time.” Senator Chuck Schumer is noted for still using a flip phone. And of course there are the email-related stories that doggedly follow one of our presidential candidates around. All of a sudden, it is cool to be more disconnected. Especially ironic, given today is also the day millions will flock to the nearest Apple Store and buy a phone that doesn’t have a headphone jack. (Shelly Palmer’s rant on this is pure pleasure.)

The hacked emails seem to be genuine, at least according to press reports and the impact they have had with the shake up of the DNC leadership. But they have also had the effect that others in the public eye are reconsidering the contents of their own message store.

I have even learned a new acronym: LDL, for let’s discuss live. Meaning, “too hot to talk about in email.”

So let’s all just take a deep breath and look calmly at a few simple rules for your own email usage going forward. First off, yes, emails can be compromised. Don’t say anything there that you wouldn’t want anyone else to read. While you may not think you are a target or of any interest, you have no control over where that message might end up. You might want to walk down the hall for a quick FTF meeting, or even pick up the phone. Think about the 80’s.

Second, if you are very worried, start using encryption, and make sure it covers the complete path end-to-end. There are several instant messaging platforms that are easy to use (Network World did a recent review comparing them, and I have written reviews of encrypted email products for them as well). Yeah, I know, encryption is a pain, but the current crop of products is actually pretty easy to deploy and use. Having said that, hardly anyone sends me encrypted emails, ever.

Third, take a moment to review your password collection for your communications products, including your IMs, email accounts, voice mails and VoIP products. If you use the same password for more than one of these tools, take a day and install LastPass or some other password manager and start treating these passwords more seriously. Do it this weekend.

Finally, don’t hide behind your personal accounts such as Facebook or a non-corporate email address. Those are just as much at risk, as one network anchor realized who hurriedly deleted his Gmail account that was cited in the Times story. Everything is discoverable and vulnerable these days.

The death of the SMS OTP

Posted on by
1

As mentioned in Andrew Showstead’s blog post last month, the National Institute of Standards (NIST) has come out with a ruling on its digital authentication guidelines. They state that many types of SMS messaging as a second authentication factor (2FA) should now be considered insecure. This is actually not news. There have been numerous insecurities and hacks and other SMS 2FA compromises, starting with this 2012 hack of Wired author Mat Honan. Since then, Wired has put everyone on notice about insecure SMS 2FA and there is this FireEye blog post about combining SMS and phishing attacks. And one well-known digerati got his phone hacked by having the attacker just call his cell provider to change his SIM number.

In any case, the NIST document and the implied underlying decisions both require further explanation.

First off, the NIST ruling isn’t set in stone. It is a ‘preview,’ which means they are still collecting comments, and their document and their recommendations may undergo revision. Interestingly, you can submit your comments on GitHub here. That represents a big change for NIST, and they should be applauded for trying to use the open source community natively. As they posted, “It only seemed appropriate for us to engage where so much of our community already congregates and collaborates.”

Second, if you are going to comment, you should probably start with reading this blog post from Paul Grassi, a senior standards and technology advisor at NIST. The original document linked above is a difficult read, even for the most technical among us. For example, one of the NIST terms used is that SMS as an authentication factor is “deprecated.” What is that? Grassi says “you can use this puppy for now, but it’s on its way out.” Meaning that federal agencies should start exploring other 2FA options, or puppies in his parlance.

Speaking of federal agencies, while this NIST stuff is going on, the Social Security Administration didn’t quite get the right memo. They announced in late July that beginning immediately, anyone using their website to track their retirement benefits or communicate with the agency will be required to enter a cellphone and use a SMS message as an additional authentication factor when logging into their account.

Ironically, the agency claims it is doing this to adhere to federal standards just at the same time that NIST is trying to raise the bar on those same standards. As you might imagine, security analysts have already weighed in. Brian Krebs says the move by SSA “does not appear to provide any additional proof that the person creating an account at ssa.gov is who they say they are. The new measure does little to prevent fraud.” Krebs does give the agency props for using other authentication methods at the time a retiree sets up an account, but still there are weaknesses.

Third, Grassi makes some other good points, one of which being that not all SMS services are created or operate equally and not all of them are tied to actual physical cell phones. There are some virtual VOIP numbers (think Google Voice) that can forward texts to anywhere and anyone. Or that text messages can show up on the locked cellphone screen, so that the user doesn’t even have to have possession of his or her phone to enter the appropriate code sequence. That is part of the issue around sending an SMS one-time password (OTP) as an additional authentication factor. It no longer becomes “something you know” but is just “something else that you know.”

Finally, with all the hue and cry about the NIST document, we tend to lose sight that sending an SMS for OTP is still better than having no additional authentication factors. “For normal people, 2FA is still going to limit the ability of an attacker to intercept or alter both your password and your SMS code,” says Violet Blue writing in Engadget recently.

Does this mean that SMS OTP is dead? Not quite. Certainly, as several security experts quoted in a recent SearchSecurity article say, the move by NIST is long overdue. SMS authentication shouldn’t be the sole second factor. There are better authentication methods, such as the Vasco Digipass Go and Crontosign products mentioned in Showstead’s blog post, and numerous other efforts with using selfies and photos too.  The key takeaway? You need multiple authentication factors now more than ever, and SMS should be one of them, but not the only one.

Security Intelligence: Use a Malware Simulator to Better Defend Against Ransomware

Posted on by
Reply

If you are looking for ways to run a malware simulator to test ransomware and other forms of malware in your environment, but don’t want to deal with the actual materials to infect your systems, look no further than the Shinosec ShinoLocker suite. This is a malware simulator and target attacking suite for penetration testers and other researchers. I talk more about this innovative product in my post today for SecurityIntelligence blog.

WindowsITpro: Going beyond the password

Posted on by
1

We have a love/hate affair when it comes to using passwords. The average person has to remember dozens of them for various logins, and many of us try to cope by reusing our favorites. That just opens up all sorts of security issues: if a popular service (take your pick: Yahoo, LinkedIn, Dropbox, and many more sites all have been breached over the years) is compromised and millions of user names and passwords revealed, there is trouble ahead.

In this piece for WindowsITpro, I talk about the past, present and future of the lowly password.