Cybersecurity is all about Infosec!

Posted on June 28, 2017June 25, 2017 by admin_roger_189

“Using smart technology is not smart unless infosec procedures are set in place.” Laith Alkhouri

We are inundated with shiny and new.

The newest mobile device, the newest computer, the newest operating system, the newest application or apps, all that newness.

All of that smart technology!

Individuals and organisations often forget, in the rush to get things to market, the first reiteration of shiny and new can have some serious flaws and issues.

We forget it too!

Going back a couple of years when everyone was jumping on the band wagon of “you need an app for that“, some of the NFL teams released apps for you to track you favorite team, keep up with the stats and buy their merchandise.

They forgot that a financial transaction needed access to either credit card information or bank account details. These transactions were in plain text in transmission as well as when stored on the device.

No encryption.

If you purchased that jumper then you had a really good chance of having your financial details stolen.

To stop themselves from being sued they put all of the onus on everyone using the system through a comprehensive waiver. You agreed to the terms and conditions probably without realising it, you agreed when you installed the app.

The way all of the software companies manage their apps are the same. You want to use the app then it is your problem because you agreed to the terms and conditions.

The legal beagles have not caught up with this yet. As a user, are we not entitled to have some semblance of security and safety when using a product.

Are we not entitled to sue someone when using their product and something happens?

When did that change?

I suggest that when you install your next app that you have a look at the terms and conditions before you say yes. In most cases you have no rights what so ever if something is stolen, according to them.

Oh look something shiny and new, I just have to have it!

Roger Smith is a highly respected expert in the fields of cybercrime and business security and is a Lecturer at ADFA (UNSW – Australian Centre of Cybersecurity) on Cybercime, Cybersecurity and the hacking techniques used by the digital criminal. He is an Amazon #1 selling author on Cybercrime with his best selling book, Cybercrime a clear and present danger, going to number one in 3 sections of Amazon. He is the primary presenter for the Business Security Intensive (BSI) and author of the Digital Security Toolbox which is given away for free at the BSI. He is a speaker, author, teacher and educator on Cybercrime and an expert on how to protect yourself, your staff, your clients and your intellectual property from the digital world.

Ransomware for Medical devices – what happens then?

Posted on June 25, 2017June 25, 2017 by admin_roger_189

One of the biggest problems with our bright new shiny digital world is everything we do or use today has some level of digital components.

We know that everyday computers, smart devices, mobile devices and gaming platforms, are digital in nature.

We forget that Fitbits, Internet of Things devices and medical devices also have some level of digital incorporated into them.

So what happens to these devices if they become infected with malware, even worse if that malware is a ransomware.

If I had a pacemaker installed in my body and the medical staff lost control of it (that is what malware and Ransomware does, removes their control and gives it to someone else) I think that I would get a little panicky.

Definitely a WTF moment.

Most medical devices are either WiFi or blue tooth enabled. That makes them relatively easy to break into.

Researchers have been looking at compromising medical devices and in 2015 there were 25 known vulnerabilities in some of the most popular devices. What about the unknown ones, how many of them were there?

We all saw what happened with IOT devices when Mirai was released on the internet late 2016. It compromised a certain level of device that had a hard coded username and password in the system.

We also saw what happens when the wannacry ransomware hit and the fall out from that in May 2017.

Now imagine a wannacry variant that targets your pacemaker. “Give us $1000 or we stuff around with your heart!” That would certainly make your life pretty interesting.

What’s to stop it happening? Whats to stop it happening right now?

I keep coming back to people taking responsibility for the code they write. I think we need to have a serious look at our new and shiny world and do something about it. Before it is too late and people start dying!

We need to think things through.

Think like the bad guys.

Oh, and before you say “why would they target my pacemaker?” In most cases it is because they can.

He is an Amazon #1 selling author on Cybercrime with his best selling book, Cybercrime a clear and present danger, going to number one in 3 sections of Amazon.

He is the primary presenter for the Business Security Intensive (BSI) and author of the Digital Security Toolbox which is given away for free at the BSI

He is a speaker, author, teacher and educator on Cybercrime and an expert on how to protect yourself, your staff, your clients and your intellectual property from the digital world.

Why do we still believe these 6 idioms about the Internet?

Posted on June 14, 2017June 11, 2017 by admin_roger_189

For 25 years the internet has been around.

Since its inception, thanks Tim, we have seen how it can be used for ‘good’, but we have also seen, in the last 10 years, how it can be used for bad, evil and nasty stuff.

The bad utilization is starting to have significant impact on the business world but we still have a number of areas where we do not see the dangers.

These are some of the internet attitudes that we come across constantly:

It will not happen to me

In one word, OK two – automated systems.

The free automated systems that are now available to any bored 14 year old cause major problems for anyone connected to the internet or digital world.

I have anti virus, that’s all I need.

We are constantly shown that most business organisations think in one dimension when talking about the Internet.

The fact that the bad guys and even the automated systems think in a multi faceted approach when it comes to targeting us. Anti virus will find 95% of attacks and stop about 85%.

That leaves a significant number of areas where AV will not protect you at all

My password is strong enough for me

I was recently watching an interviewer on one of the late night shows that was sent out to the streets to ask people for their passwords. The ridiculous easy way, in which she got that information, was astounding.

One of the other features to come out of it was people still use dictionary words, personal information, easy to remember sequences.

Passwords have to be complex, unique and more than 9 characters. Its not easy for you it is easy for them.

I only trust my friends on social media

On my Facebook recently there has been a spate of people who are already my friends asking to hook up on Facebook again.

It can be very difficult making sure that you do not fall for this type of scam

3d people – man person with umbrella and arrows. Protection against problems

I am not rich and famous why would they pick on me

On the Internet everyone has something of value.

Even though you may not have money or access to money, trade secrets or you think your personal information is not important you still have one thing that the cyber criminal considers important.

You have some sort of technology that they can then use to target other people from and hide their attack behind.

Digital security is very expensive

The fundamentals are not.

Use a firewall, use an anti-virus, back everything you consider important up, patch it all and use a decent password.

None of these are expensive, but they all lift anyone out of the realms of easy targets.

In addition here are a couple more – Trust no one and be paranoid.

I don’t need a back up because it will never happen to me

If you think that your information on your digital device is not worth backing it up then ask yourself this question – if I lost my laptop, dropped my phone in the toilet or my tablet was stolen what information could I not live without.

That’s the information that needs to be backed up.

Backups are for any digital device that has your information on that is irreplaceable.

The bad guys have changed, we have not.

They’re are smarter, more persistent and definitely more brazen. We have to adapt to their changes and make sure we are protecting ourselves, if we don’t no one else is

Roger Smith is the CEO of R & I ICT Consulting Services, Lecturer at ADFA (UNSW – Australian Centre of Cybersecurity), Amazon #1 selling author on Cybercrime, Presenter for the Business Security Intensive, author of the Digital Security Toolbox and D igital Security Framework. Rapid Restart Appliance Creator. He is a Speaker, Author, Teacher and Educator on cybercrime and how to protect yourself from the digital world.

Why Business Security is a specialised field

Posted on May 25, 2017May 21, 2017 by admin_roger_189

I am sorry, but if I hear another IT person or manager express that they do not know how they were target by malware when they have Anti Virus I am going to scream.

The issues and problems associated with Business Security needs to have a different and more refined and robust focus than normal IT.

They need to focus on what the bad guys are actually capable of.

Normal IT, in most organisations, have a primary focus of keeping the lights on, making things work and keeping it functional.

We have to stop thinking that Business Security is the realm of IT, because it is not.

Business Security is a whole of business process and HAS to be treated that way.

This is why you need a professional who is focused on the security component of an organisation.

Someone who can cross all of the areas of the business and get all levels involved in the process. For small and medium business, this is an expense that few can afford.

The ways that a system and organisation can be compromised are numerous, and in most ways are practically invisible to small and medium sized organisations.

There are also numerous reasons that they are targeted, but automated systems are the primary contender.

The only reason they are targeted is that they are connected to the internet.

The bad guys need no other excuse than you have a digital device and it is connected to the internet.

In addition small and medium organisations do not have the three things that are vital to protecting the organisation:

Skills
Time
Money

Investing in these things are normally outside the purview of ordinary business.

Its not from want or trying.

Most want to be secure.

They just do not know how to get to that next level, and if they knew would not have the above resources to make it happen.

Cybersecurity / Business Security is a typical catch 22 situation.

You need to invest in the skills, time and money but do not have the skills, time and money within the organistion to be able to apply what you need.

This is why you need a framework.

A framework that is going to apply a progressive protection strategy around the business.

That framework can be any of the available frameworks but for small and medium business i think that mine would be a great place to start.

My framework puts technology, management, adaptability and compliance into a system where each additional components makes the organisation just that little bit more secure.

Try it here

In addition a managed Security Service Package is a great way to make your money, expertise and time go a lot further.

Most MSSP’s will look after all of those critical components of an organisation.

They have the skills to do it, they have the expertise to make it more secure than an untrained person and will definitely make your money go a lot further.

What are the riskiest network TCP / UDP ports and how do you secure them?

Posted on May 23, 2017May 21, 2017 by admin_roger_189

Vulnerabilities do not rest on TCP ports, they rest on services.

Any TCP port can be open but if there is no corresponding service using that port an attack on the port will most probably fail.

There are exceptions to this – TCP Port knocking and encryption allow a port to be open but will register as closed.

All hacking / malware attacks are targeted at those services and each of those services can have different applications behind them.

A little background – A Quick introduction to hacking.

Vulnerabilities are discovered and used in attacks based on a number of things:

application, – what is the application that is using the TCP port, Apache and IIS have different vulnerabilities and they both can be as unsafe or as safe as each other. It depends on the attacker, defender, version and the installation process
version, – one version will be more secure that the previous one – In the labs we demonstrate a problem with VS-FTP version 2.3.4 it has a back door hard coded into the software. Anyone who knows that can use it to compromise the server it is installed on. By upgrading to 2.3.5. you remove the vulnerability and the back door. With the introduction of IOT the main vector of attack are port 80 attacks and hard coded default usernames and passwords
installation process – the installation process for a number of applications have a default username and password. If these are not changed then the system is vulnerable. Tomcat and vnc are examples of known default usernames and passwords.
interaction within the application and the operating system. – there are a number of applications that are vulnerable when installed on a specific type of operating system. Code red – targeted port 80 (HTTP) to attack the SQL components of a web server on port 1433 (MSSQL)

Fingerprinting and scanning

This is the process of finding out what application and services are behind the port.

It also tells us what version is running.

A simple NMap scan will deliver this information to anyone who knows how to use it.

A simple Nessus scan will reveal even more!

User rights and shell

A hacker needs 2 things to be dangerous.

He needs to have the authority – administrator (god) access and he needs to create a shell, something to run commands, scripts or applications in.

You can still do damage to a system if you have less than admin access but it is only to the application that is running – compromising tomcat will give me access to the web server component of a system. There are ways to escalate the user from a service to the administrator.

If you do not have the ability to gain a shell then most attacks will not work.

In the world of penetration testing we can discover hundreds of vulnerabilities but only one or two or ten will enable me to compromise the system with both administrator access and a shell.

They are the only ones we report, resolve and remediation.

Hackers use Google and YouTube

Most hackers will find information on what they are targeting, how to do it and what they need to do through a basic search.

So with that all being said – here are the top 20 ports with their corresponding application. Insecure network services

Port numbers

21. TCP – Ftp – file transfer protocol – one of the oldest ports on the internet and is used to transfer information from one system to another over a TCP connection. Can be used in Command and Control of malware.
23 – TCP – telnet – the most basic of shells, can be used to transfer commands and scripts from computer to computer. Unencrypted and easily captured.
25 TCP – SMTP – email servers – exchange, sendmail, and any system that has been designed to send email as part of its system requirement.
69 – UDP – TFTP trivial file transfer protocol – used to update and transfer information from computers to routers. Information can be intercepted because it is a UDP connection.
80. TCP – HTTP – hyper text transfer protocol – Apache, iis
143 – TCP – imap – mail protocol
110 – TCP – pop3 – mail protocol
443 – TCP – HTTPS secure hypertext transfer protocol
53 – TCP/UDP -DNS domain name service – bind, windows
8080 – TCP – tomcat management –
161 – TCP – SNMP –
3389 – TCP – RDP – remote desktop protocol
4444 – TCP/UDP – metasploit
1433 – TCP – SQL
137,138,139 – UDP – netbios
1723 – TCP – VPN PPTP
9100 – TCP Internet Printing
Gaming ports – inbound and outbound – some games install and connect to a web based server on a specific port based on the game. The game allows an attacker to use the game as a platform to store and activate malware.

There is no way to secure individual ports and their applications except to make sure the application and operating system are up to date.

There are a number of ways to protect an organisation:

a second generation firewall / next generation firewall will inspect packets at the network, data and physical level as they enter and leave and compare that information to its database.

If an attack is indicated it will either stop it or move it to a sandbox.

The other ways are through logging, auditing and reporting.

Depending on the size of the organisation a SIEM maybe necessary, but a process of alerts is vital to catching the initial components of a breach.

Why are we the weakest link in cybersecurity – we just don’t care!

Posted on May 21, 2017May 21, 2017 by admin_roger_189

The threats are NOT imaginary.

The threats are real!

The visibility of the wannacry attack actually highlights how vulnerable the world is with its reliance on all things digital

Zero day exploits and known vulnerabilities are available for every operating system, including IOT devices.

Anything with a digital signature can be hacked.

Where it all breaks down is that in most cases there is a human who is attached to the device.

A human who has the ability to veto all security measures in their hurry to do something, anything with the device.

How often have we seen the “updates available” on our server, laptop, smart device or application and have been in too much of a hurry to apply them.

In most cases it would take 10 minutes out of our busy daily schedule, 10 minutes where we have to find something else to do – not screen related.

We are so busy that we cannot find that 10 minutes?

Most systems are now being designed to make it obvious, and will persistently tell us that we need to update.

What do we do?

We complain that we do not have enough time. We are too busy. We cannot stop for that brief space of time to increase our security.

The SMB patch for wannacry has been available since march, that is almost 8 weeks before the cryptovirus attack, but the impact was significant because we were too busy.

I thought that we had learned from the “code red” attack in the early 2000’s, that patching is a very important part of digital security, obviously not!

“Code Red” crippled the internet because of un patched SQL servers, the patch had been available for 3 months prior to the release of the virus.

Most of the problems with security in the digital world is US.

We are too focused on our tools to see the underlying features that have actually been put in place to protect us.

There is a quote I often use in my training “THERE IS NO PATCH FOR HUMAN STUPIDITY”

We are the weakest link in cybersecurity, in the digital chain where we should be the strongest.

In most cases we are very stupid!

Google Alerts – The week I died 7 times, and how I knew about it!

Posted on May 17, 2017May 21, 2017 by admin_roger_189

What a weird thing!

I have a Google alert for my name, just to check that people are not talking about me.

Recently, over the space of about 10 days i died and was buried 7 times.

A disconcerting occurrence. I was happy to see that none of them were me.

It has bought to my notice the importance of google alerts.

For those people not using google alerts i would suggest that you do.

Google alerts scans the internet for any reference of the criteria you have configured for your alert within a set period of time – mine are last 24 hours.

I have a number of alerts configured.

I have an alert that triggers on “cyber, cybercrime, cybersecurity, digital security, MSP, managed services and business security”. This is to keep me up to date in industry news

What is the difference between a Penetration Test and a vulnerability scan?

I have an alert that triggers on our clients names, products and services. This keeps me up to date with what our clients are doing and if there is any chatter that could potentially turn into a problem.

I have an alert that triggers on any of our business names, products and services. This tells me of there is any chatter about our organisation and so that we are aware of problems before they become issues.

Google alerts are a cheap and inexpensive way (free) of keeping track of what is happening on the internet around you and your niche. I would suggest that you utalise it.

Roger Smith is the CEO of R & I ICT Consulting Services, Lecturer at ADFA (UNSW – Australian Centre of Cybersecurity), Amazon #1 selling author on Cybercrime, author of the Digital Security Toolbox and the SME D igital Security Framework. Rapid Restart Appliance Creator. He is a Speaker, Author, Teacher and Educator on cybercrime and how to protect yourself from the digital world.

A business security framework for the cyber insured

Posted on April 18, 2017May 17, 2017 by admin_roger_189

The introduction and subsequent uptake of insurance focusing on “cyber” have shown that the insurance industry is serious about protecting the assets of businesses all over the world.

The level of protection is dependent on the policy, your business requirements and also how much protection you need for your business.

Insurance without looking at increased protection however, will not work. A breach would / could put you in the situation where you are not covered.

If you do not get your business security and protection correct then you will be in a situation where a cyber crime against your business will not be covered under your insurance policy

Here is a basic framework that aligns with most cyber insurance policies.

Technology. There are a number of areas where technology investment is paramount. Here are a few
- Router, modem, firewall – get the best you can afford. Definitely get rid of the system supplied by the ISP or the shop bought one from a home retail shop. As a level of protection they will not protect your organisation. Minimal spend should be around $600 for a small business up to more than $20k for a large organisation
- End point protection – 2 things about end point protection, they will catch malware and suspect applications because, like us the hackers are inherently lazy and use old known code. The second is doing a regular scan, this will allow systems to catch up with malware that has been recently discovered.
- Wifi – access to your wifi allows access to your systems, whether it is set up to have access or not. Once again spend a little and invest in the best you can afford.
- Encryption – if you are collecting staff, user, client and financial information then it need to be protected from ease dropping with encryption. Encryption needs to focus on data at rest, where and when it is stored as well as in transit.
- Patching and updates – operating systems – do it, applications – do it, websites – do it, tablets and phones – do it. Absolutely critical to protecting anything digital in today’s world.
- Up to date operating systems and applications – if you are using old versions of MAcOS, windows XP, android – replace them ASAP
Management.
- Policies procedures and processes – policies are very important as they tell your staff where you stand on passwords, internet usage, email usage, education and training. Make sure everyone reads and understands them. Procedures allow you to specify how things are done so that anyone can walk in and do a task without supervision. Processes will also allow systems inside the organisation to be implemented as a standard
- Audit and reporting – it is no use collecting information from the system if no one is going to look at it. You need to implement a standard process that audits the information and reports it to management.
- Logging and alerts – all systems have some level of logging. In a small organisation daily checks of individual logs can be done, in larger organisations there is a need for a central location and a system that alerts staff to issues coming from firewalls, intrusion detection or AV.
- Password management – in today’s world passwords are your passport to the digital world so they have to have 3 components – must be more than 10 characters, must be unique for each location and must be complex, having letters, numbers, capitals and symbols.
- Education and training – there is a 300% ROI on education in an organisation. Your staff are the first and last line of defence, when the technology fails an educated user will be the last line of defense
Sustainability
- Disaster recovery – when it alls goes to custard (and it will) you better have a way back. This is what disaster recovery is all about. It doesn’t matter if it is physical (flood, fire), digital (cyryptovirus, failed hard drive) everything that is stored digitally is vulnerable.
- Risk management – you need to way up the risks of a issue impacting your organisation. The higher the risk the more you need to mitigate it. If you use the NIST framework to manage your risk and exposure it will benefit the process of risk management
- Backups – everything that is important need to have a backup made of it. If it is business critical then the risk of something happening needs to be weighed up against mitigation and cost. Virtual imaging backup software is a huge solution to this priblem
- Business continuity – what happens if the district where you office is locked down and noone can access the office. What contigencies have yo got in place.
Compliance – if you are collecting PII (personal identification information) then you will have a compliance requirement. If you are collecting financial information then PCI DSS compliance requirements come into the situation as well

So insurance is all very well but unless your organisation invests in the additional components of your cyber protection you may find that the cryptovirus that has encrypted all of your data is not covered.

If you want to know more get my book or ebook

Roger Smith is the CEO of R & I ICT Consulting Services,(http://rniconsulting.com.au), Lecturer at ADFA (UNSW – Australian Centre of Cybersecurity), Amazon #1 selling author on Cybercrime (http://www.amazon.com.au/CyberCrime-Clear-Present-Danger-Security-ebook/dp/B00LEJTN5Y), author of the Digital Security Toolbox (http://www.rogersmith.com.au/roger/toolbox/) and the SME digital security framework (http://smesecurityframework.com.au/csb/). He is a Speaker (http://www.rogersmith.com.au/roger/roger-smith/), Author, Teacher and educator (http://securitypolicytraining.com.au/cybersecurity-awareness-introduction/) on cybercrime and how to protect yourself from the digital world.

Cybersecurity and business security training when it is working, you WILL know!

Posted on April 9, 2017April 18, 2017 by admin_roger_189

Joining the Cybersecurity IN Crowd

When it comes to proving that your Cybersecurity and business security training is working there is usually not much to show! In most cases there is a general rumbling within an organisation, like every other training: wasting time, effort and sometimes money.

BUT, there is a little known fact that when cybersecurity training is embraced there is an overwhelming camaraderie created.

Complete the course and you are one of the crowd.

A part of the IN crowd.

Look at that you, know a little more about computers, security and that is important for moral within any organisation.

Like any other training and education program we need to know how to use the tools that we are given in the organisation. Cybersecurity and business security focuses on protecting the information that those tools generate.

How do you know that your training is being embraced

If they are discussing the training – you win

Getting people involved in any training is hard – most people just want to do their jobs. More importantly, in todays world they either think they know it all or management doesn’t think it is important.

If you have delivered any type of business security or cybersecurity training or presentations and they are talking about it in the break room then that is a vast improvement.

This increase in awareness allows the organisation to concentrate on other areas of core business namely products and services. In addition this level of discussion also makes for increased awareness, better protection for the organisations infrastructure.

A win for the staff as well as a win for management.

There is a distinct lack of visible passwords

If your training is working you will find that everyone is more aware of the organisations password strategies. This awareness should be visible with a distinct lack of post it notes all over peoples work stations, monitors and under keyboards.

When everyone has been taught how to create complex passwords that are unique to every website or location, that are easy to remember and are longer then 10 characters, security within the organisation just has to improve.

Errors and mistakes with digital information start to disappear.

Once a training package has been completed there is a distinct decrease in the number of silly mistakes made by the people who have received the training.

Why don’t People make as many silly mistakes. They do not open email attachments, follow links, email critical information outside the organisation, make silly regretful comments on social media and are less susceptible to social engineering attacks. They think about the consequences and the have a higher awareness threshold

They have been taught to follow the “trust no one” philosophy, are paranoid of the digital world, show an increased awareness in what and how the bad guys are targeting them, your organisation and their access to money.

Bragging about recognizing a specifically sneaky phishing / spear phishing email

The biggest off shoot is when staff members start to brag about cyber attack failures that they have been involved in. A targeted email that was aimed at the accounts department. A phone call they thought was fishy.

When that happens everyone feels good.

There is an increase in business interaction

With an increased awareness of what is a true business proposal and what is krap, business can start to make an impact in their areas of core business.

If you combine a true cybersecurity, business security training package with an above average NIST score you can start to influence your market niche, control who you do business with and improve their business capabilities.

As we all know training and education of staff, management, C-Level execs and board members is very important. The significant changes in internal attitudes to cybercrime and fraud increase significantly if a decent training.

If you are interested in a decent inexpensive training package for small and medium enterprise then contact us on one of the following links.

Training

Business Security - an R & I ICT Consulting Website

Category Archives: Uncategorized