{"id":26674,"date":"2011-08-04T17:28:56","date_gmt":"2011-08-04T16:28:56","guid":{"rendered":"http:\/\/alienbabeltech.com\/main\/?p=26674"},"modified":"2011-08-04T17:31:34","modified_gmt":"2011-08-04T16:31:34","slug":"people-make-security-exploitation-too-easy","status":"publish","type":"post","link":"http:\/\/alienbabeltech.com\/main\/people-make-security-exploitation-too-easy\/","title":{"rendered":"People Make Security Exploitation Too Easy"},"content":{"rendered":"
\n
The following is by G. A . “Andy” Marken, President of Marken Communications<\/span><\/a> Inc. He has kindly given us permission to republish his thought-provoking article. As with everything that we publish at AlienBabelTech, the opinions expressed are solely those of the individual writer and do not necessarily reflect the views and the opinions of the rest of the ABT staff.<\/strong><\/span><\/span> \u2013Mark Poppin,<\/span> ABT Senior Editor<\/span><\/span><\/strong><\/h6>\n<\/blockquote>\n

Insecurity<\/strong><\/h2>\n

\"\"<\/a>\u201c<\/em>When two hunters go after the same prey, they usually end up shooting each other in the back. And we don’t want to shoot each other in the back.\u201d<\/em> \u2013 Col. Douglas Mortimer, \u201c<\/strong>For a Few Dollars More (Per Qualche Dollaro I Piu<\/em>)\u201d, Constantin Film (1965)
\n<\/strong><\/p><\/blockquote>\n

NY Times<\/em><\/strong> writer, John Markoff, had just finished his book on the exploits\/capture of hacker Kevin Mitnick about the same time we received a call from our boss at CERFnet (one of the first three ISPs in the U.S.) telling us we had to change our password because the fledgling West Coast arm of the Internet had been hacked.<\/p>\n

We had 10 minutes to give him our new password that would be part of our online identity to access, contact the world.<\/p>\n

That sucked!<\/em><\/strong><\/p>\n

We had just gotten rid of the mind-boggling CompuServe numbers and\u2026well, we really liked that password.<\/p>\n

Monco\u2019s comment came to mind, \u201c<\/em>Think you people need a new sheriff,\u201d <\/em>but kept our mouth shut and changed the password.<\/p>\n

Flash forward 20 plus years and it seems so inconsequential.<\/p>\n

Sure, Internet security is an oxymoron like homeland security.<\/p>\n

Security at work or on your own device is important as long as it doesn\u2019t get in your way of doing things like talking with others, getting work done, playing games, watching videos, listening to music.<\/p>\n

People don\u2019t want to jump over a bunch of hurdles.\u00a0 They want speed, reliability.<\/p>\n

Anything else and they\u2019re outta\u2019 there!<\/p>\n

Big Business<\/strong><\/p>\n

Last year, hacking was big business — more than 3.8 million records compromised.\u00a0\u00a0 And more than a third of them were held by banks, financial institutions.<\/p>\n

\"\"<\/a>Prime Targets \u2013<\/strong> Last year was not one that security experts want to relive, but they know the record number of attacks is only the beginning of even bigger breaches.\u00a0 Criminals are reaping big profits and kids are having fun flaunting their exploits to the point that even hackers are after hackers.\u00a0 Source \u2013 Verizon<\/strong><\/p><\/blockquote>\n

The hack attacks may highlight user names\/passwords, but those that don\u2019t crave the publicity\/notoriety are after the important stuff\u2026credit card, financial records.<\/p>\n

As Fernando pointed out, \u201c<\/em>That’s the bank! As soon as I get some money, I’ll put it in.\u201d<\/em><\/p>\n

So IT people have a pretty hard job\u2026protecting us from ourselves.<\/p>\n

\"\"<\/a>Online Cash \u2013 <\/strong>While ecommerce sites revel in the fact that online sales are steadily growing, companies are investing heavily in closing holes and beefing up security to give customers greater confidence that they provide a safe place to do business.\u00a0 Some call it the cyberwar space they don\u2019t want to talk about.\u00a0 Source – eMarketer<\/strong><\/p><\/blockquote>\n

People who feel the most pressure are those involved in online sales sites.<\/p>\n

They have to make it easy so you don\u2019t abandon your shopping cart, but they also have to make you feel they\u2019re protecting your junk.<\/p>\n

Those selling locations \u2013 and most others \u2013 try but they\u2019re outnumbered, outgunned.<\/p>\n

The skilled IT people who weren\u2019t cut (because finance said we don\u2019t need those folks since we haven\u2019t been penetrated) don\u2019t have the weapons the Red Bull-drinking kids and growing criminal organizations have.<\/p>\n

Plus hackers have more motivation to \u201cshow the system\u201d or just plain greed.<\/p>\n

Monco was motivated when he said, \u201c<\/em>Seems like a pretty good place for an ambush to me.\u201d<\/em><\/p>\n

The danger doesn\u2019t matter to company management who want everyone working on, using the social net.\u00a0 That\u2019s where the business of business is focused today.<\/p>\n

Social Outreach<\/strong><\/p>\n

Today, we\u2019re reaching out, staying in touch with friends, partners, customers all the time at home, on the road, at the office.<\/p>\n

\"\"<\/a>Open to Talk \u2013 <\/strong>Social media sites are attracting huge crowds of people who want to connect with people who share common ideas and interests.\u00a0\u00a0 They are also attracting large numbers of hackers and cybercriminals who want to use that information to their advantage.<\/p><\/blockquote>\n

Hactivists and cybercriminals love social media because you share so much that they don\u2019t even have to be half-way good at stealing\/exploiting.\u00a0 We give them almost everything they want\/need\u2026and more.<\/p>\n

\"\"<\/a>Sharing \u2013 <\/strong>Social site members seem to be willing to share as much information as necessary \u2013 and then some \u2013 to become part of the group.\u00a0 They might not share as much information in face-to-face meetings as they do on the Web; but since many have grown up online, open sharing is of minor concern.\u00a0 Source \u2013 Ponemon Institute<\/strong><\/p><\/blockquote>\n

But there\u2019s no need to beat yourself up for sharing so much.<\/p>\n

Social media sites make really great targets for the cybercriminals because it may be a little more work (getting the information one user at a time) but the information has good resale value.<\/p>\n

The sites have more holes than Swiss cheese.<\/p>\n

LulzSec, Anonymous and just about anyone with decent skills and a few hacking tools can have a freakin\u2019 ball creating havoc.<\/p>\n

\"\"<\/a>Leaky Web \u2013 <\/strong>Almost every location on the Web looks like a web to hackers.\u00a0 There are holes everywhere that people with just a few tools and half-way decent expertise can penetrate just to be mischievous, nasty or for personal gain.\u00a0 Source – comScore<\/strong><\/p><\/blockquote>\n

The hackers seem to be of the mindset that we can do it the hard way or the easy way\u2026your choice.\u00a0 Unfortunately, most folks make it way to easy for the kids\/criminals to hook the over trusting, gullible or people who have visions of wealth doing nothing.<\/p>\n

Nino warned them when he said, \u201c<\/em>Here are your guns without bullets.\u201d<\/em><\/p>\n

\"\"<\/a> Waiting for Dinner \u2013 <\/strong>While hacktivists carry out their work to exploit and embarrass organizations, cybercriminals like to follow behind them to pick up morsels of valuable information and occasionally attack on their own for full-blown financial meals.<\/p><\/blockquote>\n

The personal attacks start out so warm and friendly.\u00a0 \u00a0Before folks know it their identity has been picked clean.<\/p>\n

Gotta\u2019 Use Devices<\/strong><\/p>\n

Personal computers and notebooks were bad enough (or good enough, depending on which side of the Web you sat); but the growing popularity of mobile devices \u2013 smartphones and tablets \u2013 have made hacking and cybercrime even more fun, more productive.<\/p>\n

The array of devices, the growing usage and security \u201copportunities\u201d have made security an even bigger challenge for IT folks (responsible for blending the devices into the company infrastructure) and a richer opportunity for the hackers.<\/p>\n

Your mobile device risks include:<\/p>\n

–\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Stolen password \u2013 mobile browsers tend to expose sensitive information (user name, password, account data) when they communicate with websites<\/p>\n

–\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Weak data protection \u2013 device manufacturers, service providers try to silo their core software, data from third-party apps but the silos are built with pretty weak mud<\/p>\n

–\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 DoS Attack \u2013 Denial of Service is increasing because the mobile device software leaves the device vulnerable to attack to crash it by overloading memory<\/p>\n

Of course, those \u201cminor\u201d problems are nothing compared to all the stuff you and thousands of other trusting folks store in the Cloud.<\/p>\n

It\u2019s no wonder that the security technology and services business is getting huge \u2013 fighting overwhelming odds but growing just the same.<\/p>\n

\"\"<\/a>Problems, Opportunities \u2013 <\/strong>The sale of security hardware, software and service has always been a \u201cdecent\u201d business, but it has historically been a difficult sale because people just don\u2019t like buying \u201clife insurance.\u201d\u00a0 But the coverage being given to the latest series of \u201cvictimless\u201d activities has made security and content protection a higher priority with almost every organization\/individual with connectivity.\u00a0 Source – IDC<\/strong><\/p><\/blockquote>\n

While some people (i.e., the boss) want to lay all the responsibility of protection on IT people, there are things the rest of us can do to make it a little more difficult for the hacktivists and cybercriminals.<\/p>\n

Focus People Focus<\/strong><\/p>\n

First, realize you are on the Net, the Web and visible to the world.<\/p>\n

Sites\/services track, monetize what you do.<\/p>\n

Sure, the service is free; but get real.<\/p>\n

Act\/communicate accordingly\u2026the next Tweet, the next text message could easily end up on someone\u2019s front page.\u00a0 When in doubt, they have a button for that\u2026Delete.<\/p>\n

As Col. Mortimer observed, \u201c<\/em>It’s a small world.\u201d<\/em><\/p>\n

There are also a growing number of free, paid privacy, security products that allow you to manage the way companies (and others) track your online activities.<\/p>\n

They include:<\/p>\n

–\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Secure data vaults (Dropbox, ain\u2019t exactly secure) will collect, store your data for a fair price<\/p>\n

–\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Tracking protection services alert users when they are being monitored online<\/p>\n

–\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Reputation management services are becoming increasingly popular as individuals and parents get assistance in monitoring and controlling their online profiles<\/p>\n

When you join a new site, service \u2013 free or paid \u2013 read the fine print.<\/p>\n

The sub-mouse size type will tell you what they do with all your info and how you can jump through hoops to keep your info private.<\/p>\n

Their lawyers include (bury) that to CYA (look it up in Wikipedia).<\/p>\n

Trained Assistance<\/strong><\/p>\n

If you\u2019re using your devices at the office, work with your IT\/security people rather than around them.<\/p>\n

Got a pet project you\u2019ve just gotta\u2019 get up there\/out there that IT will only slow down if they get involved?\u00a0 Hacksters\/cybercriminals love the \u201cwork-around\u201d folks.<\/p>\n

Those are probably the holes LulzSec used to get in so they could post their exploits.<\/p>\n

Sure, security \u2013 personal, company, consumer \u2013 is lax because it just hasn\u2019t been important\u2026until now.<\/p>\n

But the weakest part of it is the one hucksters\/cybercriminals take advantage of most\u2026the user.<\/p>\n

\"\"<\/a>All About You \u2013 <\/strong>Hardware, software and service organizations continue to beef-up their protection of content.\u00a0 The problem is, they haven\u2019t figured out how to close the biggest source of vulnerability–the individual on the keyboard or device.\u00a0 Source \u2013 Dreamtime.com<\/strong><\/p><\/blockquote>\n

As Monco said, \u201c<\/em>There seems to be a family resemblance.\u201d<\/em><\/p>\n

The attack one-upsmanship is the next phase of iNet, Web, mobile connectivity we\u2019ve experiencing and it won\u2019t end well.<\/p>\n

You just don\u2019t have to make it too easy for them!<\/em><\/strong><\/p>\n

\"\"<\/a>As Fernando said, \u201c<\/em>You probably wouldn’t like that other place as much, signor. At that place you’d stay up half the night shooting cockroaches.\u201d<\/em><\/p>\n

\u00a0<\/strong><\/p>\n

# # #<\/p>\n

by: G.A. “Andy” Marken<\/strong><\/p>\n

President<\/strong><\/p>\n

Marken Communications Inc.<\/strong><\/p>\n

Andy@markencom.com<\/a><\/strong><\/p>\n

Please join us in our Forums<\/a><\/p>\n

Become a Fan on Facebook<\/a><\/p>\n

Follow us on Twitter<\/a><\/p>\n

For the latest updates from ABT, please join our RSS News Feed<\/a><\/p>\n

Join our Distributed Computing teams<\/p>\n