{"id":26733,"date":"2011-08-13T07:08:01","date_gmt":"2011-08-13T06:08:01","guid":{"rendered":"http:\/\/alienbabeltech.com\/main\/?p=26733"},"modified":"2011-08-13T07:08:57","modified_gmt":"2011-08-13T06:08:57","slug":"smart-security","status":"publish","type":"post","link":"http:\/\/alienbabeltech.com\/main\/smart-security\/","title":{"rendered":"Smart Security"},"content":{"rendered":"
\n
The following is by G. A . “Andy” Marken, President of Marken Communications<\/span><\/a> Inc. He has kindly given us permission to republish his thought-provoking article. As with everything that we publish at AlienBabelTech, the opinions expressed are solely those of the individual writer and do not necessarily reflect the views and the opinions of the rest of the ABT staff.<\/strong><\/span><\/span> \u2013Mark Poppin,<\/span> ABT Senior Editor<\/span><\/span><\/strong><\/h6>\n<\/blockquote>\n

BYOD Is Neat But Tough On Your Company IT Folks<\/strong><\/p>\n

\"\"<\/a>\u201c<\/em>That’s the second biggest… I’ve ever seen.\u201d<\/em>\u2013 Maxwell Smart, \u201cGet Smart,\u201d<\/em> Talent Assoc., (1965 \u2013 1970)<\/strong><\/p><\/blockquote>\n

Anonymous and LulzSec made themselves infamous by hacking highly visible organizations.<\/p>\n

They thought it was cool to disclose information from private\/protected databases. They outed millions of people\u2019s very personal\/private data, making them prime identity theft targets.<\/p>\n

You know, the really bad guys (and gals) who make their living tapping into and \u201cborrowing\u201d your information to supplement their income.<\/p>\n

For most folks, they were simply huge pains in the behind.\u00a0 But for a few\u2026 huge financial problems.<\/p>\n

Little SOBs!<\/em><\/strong><\/p>\n

Of course, they got bolder and bolder and took their attacks to government data sites around the globe.\u00a0 In the U.S., the FBI, NSA, DOD; in the U.K., Scotland Yard, Defence Ministry, Parliament; in Germany the Federal Network Agency, Chancellery, Cabinet; in Russia the ministries of defense, justice, internal affairs.<\/p>\n

You get the picture\u2026all of ’em.<\/p>\n

Cyberattacks on government assets aren\u2019t anything new.\u00a0 Heck, every government has hundreds of folks dedicated to tapping into the other guys\u2019 stuff all the time.<\/p>\n

Government Attention<\/strong><\/p>\n

The rash of recent high-profile break-ins has led governments to take a hard stance and draw a line in the sand.<\/p>\n

They made it official\u2026no more of this crap will be tolerated!<\/p>\n

The Chief made it official when he said, \u201c<\/em>How can we believe a man who would sell out his friends?\u201d<\/em><\/p>\n

Sure, you can mess over Sony, BofA, Citi, MS, Google, you name \u2018em, that\u2019s OK; but mess with the stuff we\u2019ve been gathering on everyone else and that is just aahh\u2026humiliating.<\/p>\n

Now they know what enterprise IT and security folks feel like every time they log in and check their systems.<\/p>\n

Company, government organizations are busy hardening their exterior network security to guard against APTs (advanced persistent threats).\u00a0 The problem is the bad guys simply try harder\u2026gawd, they love a challenge.<\/p>\n

Art Coviello, president of RSA (producers of the SecureID technology that was also hacked) pointed out that the bad guys have the same technologies and tools the good guys do.<\/p>\n

The real bad black hatters are not only smart,\u00a0 they\u2019re dedicated and have no conscience about who or what they damage.<\/p>\n

As if that weren\u2019t depressing enough, he has said publicly, \u201cI think that, over time, the bad guys are going to win.\u201d<\/em><\/p>\n

That doesn\u2019t mean the good guys are going to simply roll over; but with the latest employee trend, organizations have made it easier for them.<\/p>\n

BYOD Leaks<\/strong><\/p>\n

The employee convenience trend is BYOD (bring your own device) \u2013 personal notebook, tablet, smartphone \u2013 so people can be more productive, more mobile, more in touch.<\/p>\n

\"\"<\/a>Mine, All Mine \u2013 <\/strong>Now that people have the freedom to use their own favorite devices for \u201cwork,\u201d they\u2019re also free to handle all of the things that need to be handled like all of their social networking at work.\u00a0 The problem is it also opens the company and the individual to a whole new level of security problems.<\/p>\n

All of this new freedom and power hasn\u2019t made us any smarter.<\/p>\n

Max recognized what was going on and said, \u201cAh, it’s the old… trick.\u201d<\/em><\/p>\n

Spearphishing \u2013 very targeted attacks \u2013 is a super easy way for a cybercriminal to take control of the individual\u2019s device and make his\/her way into the guts of the organization where all the good stuff is kept.<\/p>\n

Sure, there are some cases of seemingly harmless middlepersons; but most of the time, ordinary folks let them in because some message looks too good to be true \u2013 financial, lust, ego, whatever.<\/p>\n

\"\"<\/a>Of Course We\u2019ll Help \u2013 <\/strong>Hackers and cybercriminals just love the fact that people now use their own personal devices at work.\u00a0\u00a0 Few people know enough to provide the ultra- basic security solutions for their many devices, making them extremely vulnerable to access to the entire enterprise.<\/p>\n

Portable devices have some real risk management issues that IT people focus on as they work to balance enterprise, personal information, corporate data, and personal online access.\u00a0 This includes:<\/p>\n

–\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Stolen passwords \u2013 mobile web browsers can expose sensitive information like usernames and passwords as they communicate with sites.<\/p>\n

–\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Weak data protection \u2013 device makers fence off core software and data from third-party apps, but they\u2019re weaker than you might think providing access to browser history, saved\/deleted text messages, device IDs.<\/p>\n

–\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Denial of Service (DoS) attacks \u2013 software design can make the device vulnerable to attacks by overloading the memory<\/p>\n

As Max said, \u201c<\/em>Sorry about that, Chief.\u201d<\/em><\/p>\n

As the digital natives enter the workforce, the industry is offering them a limitless array of affordable products\/services that are simple, easy to use and hard not to do without.<\/p>\n

The \u201cmust have\u201d fashionable products are ideal for our faster network connectivity and impossible to resist apps\/content.<\/p>\n

Rich Opportunities<\/strong><\/p>\n

It\u2019s all there for working folks to use:<\/p>\n

–\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Social Networks \u2013 FourSquare, Face Book, Twitter<\/p>\n

–\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Email — Gmail, HotMail, Yahoo<\/p>\n

–\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Voice over IP — Skype, Fring, TruPhone<\/p>\n

–\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Cloud Apps \u2013 Google\/MS\/iCloud apps, SaleForce.com<\/p>\n

–\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Wi-Fi — Linksys, Netgear, Fon, Boingo, The Cloud<\/p>\n

–\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 File Transfer\/Sharing — YOUSENDit, Dropbox<\/p>\n

–\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Videoconference — FaceTime, NetMeeting<\/p>\n

So many choices, so little time.<\/p>\n

Who were these premiere blackhatters (different sites have different listings):<\/p>\n

–\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Kevin Mitnick is the poster child of hacking and was memorialized in a book by NYTimes<\/em><\/strong> reporter John Markoff.<\/p>\n

–\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Steve Jobs and Steve Wozniak made the list because of their blue box phreaking devices that enabled folks to make long distance calls without being charged.<\/p>\n

–\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Russian Vladimir Levin ripped off Citibank for $10 M (he was caught, sent to prison, they recovered all but $400K).<\/p>\n

–\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Dark Dante or Kevin Poulsen specialized in hacking radio station phone systems to win stuff like a Porsche and $20K.\u00a0 He was doing okay until he hacked federal computers and got thrown in jail for 51 months.<\/p>\n

–\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Jonathan James was the first juvenile (16) to pull jail time for hacking high-profile government systems, stealing software worth around $2M<\/p>\n

These folks \u2013 and the others – would have had a freakin ball in today\u2019s environment; or maybe not, because IT organizations are just too open.<\/p>\n

Siegfried looked around and said, \u201c<\/em>This is Kaos. We don’t *shush* here!\u201d<\/em><\/p>\n

\"\"<\/a>Walls Become Sieves \u2013 <\/strong>Employees increasingly need (and have) ready access to protected and \u201csecure\u201d databases in the office and on the road to handle work in real-time.\u00a0 Now there are so many devices \u2013 storage, work processing, communications \u2013 used that protected data can move almost everywhere without proper mobile security processes\/procedures.\u00a0 Source \u2013 Forrester<\/strong><\/p><\/blockquote>\n

At the same time, IT departments have an increasing spectrum of what they need to protect.<\/p>\n

\"\"<\/a>Securing More \u2013 <\/strong>While companies have relaxed the range of devices that can access data, the legal reporting and protection requirements continue to expand.\u00a0 Because these \u201cdemands\u201d change continuously, the general philosophy is\u2026save it all.\u00a0 Source – IDC<\/strong><\/p><\/blockquote>\n

It may feel big brotherish but if you are too casual, too \u201cthat\u2019s too much work\u201d ish, then IT usually has to step in to help you help yourself.<\/p>\n

Security Guidelines<\/strong><\/p>\n

That\u2019s why they have dumb rules like:<\/p>\n

–\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Prohibiting files stored on the personal device from being redirected to a NAS (network storage device) \u2013 actually a good practice for personal data<\/p>\n

–\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Keeping sensitive data off personal devices in protected data warehouses or allowing access only in\/out<\/p>\n

–\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Encrypting sensitive data on mobile devices<\/p>\n

–\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Monitoring\/alerting IT when sensitive data is moved to\/stored in less secure areas<\/p>\n

–\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Setting\/educating\/enforcing policies governing the use of any mobile device in the company<\/p>\n

No IT person wants to repeat what Max used to say, \u201c<\/em>Missed it by that much.\u201d<\/em><\/p>\n

If you\u2019re not hot for all those rules, regs and red tape for the company\u2019s stuff, you may want to consider using it for your mobile device and the real important stuff\u2026yours.<\/p>\n

Identity theft is on the rise around the globe and adding the best possible security for each and every device you and family members have is just good common sense.\"\"<\/a>Rough, Tough \u2013 <\/strong>Today\u2019s array of mobile devices \u2013 notebooks, netbooks, tablets, smartphones \u2013 are usually wide-open opportunities for hackers and cybercriminals to use as gateways to the enterprise\u2019s data.\u00a0 Maybe all of security steps you have to go through are a pain, but if not for the company, remember your personal\/financial data is probably also on the device, ready for inspection.<\/p>\n

Last year, over 8.1 million identities were stolen in the U.S. according to Javelin Strategy & research.\u00a0 They estimate you can probably triple that number around the globe, so it\u2019s a big business\u2026and profitable.<\/p>\n

Javelin reported that businesses lost almost $1.7 million per billion dollars in sales worldwide because of data and identity theft.<\/p>\n

You may not care too much about someone dipping into the company coffers, but do you have your bank info on your phone?\u00a0\u00a0 PayPal account?\u00a0 Personal\/family records?<\/p>\n

Do the right thing and your partner will repeat Agent 99, \u201c<\/em>Good thinking, Max.\u201d<\/em><\/p>\n

\"\"<\/a>While you\u2019re thinking about your personal security, let me take a call.<\/p>\n

# # #<\/p>\n

by: G.A. “Andy” Marken<\/strong><\/p>\n

President<\/strong><\/p>\n

Marken Communications Inc.<\/strong><\/p>\n

Andy@markencom.com<\/a><\/strong><\/p>\n

Please join us in our Forums<\/a><\/p>\n

Become a Fan on Facebook<\/a><\/p>\n

Follow us on Twitter<\/a><\/p>\n

For the latest updates from ABT, please join our RSS News Feed<\/a><\/p>\n

Join our Distributed Computing teams<\/p>\n