Over the past twenty-plus years that I’ve been working in the industry, the “personal computer” has gone from from obscurity to commonplace. Some of you may have been in the workforce long enough to remember when your organization first started using email, desktop publishing, and spreadsheets. At the time, everyone needed training, and often it was requirement before anyone was allowed to use or even requisition a computer. On top of this, they were very expensive, and justifying the ROI often meant they were only used for very specialized parts of the business. Today, having PCs in the workplace is taken for granted. Likewise, I’ve seen an increasing expectation that all employees know how to use a computer, and in some cases, a high level of proficiency is just assumed, regardless of training, background, experience or industry.
While it’s largely true that computers have become much easier to use than in decades previous, they have also become much more complex – both in functionality and in how intertwined they have become with modern life. Remember the “golden days” of automobiles where any red-blooded American could roll up their sleeves and work on their own cars? Nowadays even professional mechanics rely heavily on computers to figure out what’s wrong with your car. Most people were never even presented with the opportunity to “pop the hood” of their computers, and despite the prevalence of modern technology everywhere we look, only a miniscule percentage of us ever go beyond cracking the case of our computer to blow out the dust bunnies with canned air.
Why this is important to business owners and leaders:
Do you remember when being proficient in computers was considered “geeky” or “nerdy”? Now the opposite is true – we joke about folks that struggle with their smartphones and computers. The assumption that “everyone” knows how to use a computer can lead to other more dangerous assumptions about your organization’s security. In today’s technology security environment, humans remain the weakest link, and the bad guys know this.
Do you assume your employees know to not use work email for personal use?
When email was new to the workplace, this rule was strictly enforced, but times and workplace culture has changed. Now that everyone has email, computers and smartphones, enforcing this practice has often been de-emphasized in the pursuit of “work-life balance” or outright dismissed by companies attempting to shed “uptight” business culture roots. Unfortunately, co-mingling personal and business technology can result in significant security risks for both the business and the individual.
Do you assume your employees know what do when they get a virus infection?
Depending on your company’s culture, the employee might be too scared or ashamed to admit they’ve been compromised, even if you have an IT person or department ready and waiting to help them. An unreported security breach can lead to Sony-sized hacks on your organization.
Do you have a technology usage and/or security policy for your company? If yes, do your employees understand and adhere to this policy? How do you know?
The most dangerous assumption here is that making your employees sign an agreement acknowledging this policy equates to enforcement. Proficient technology use requires training, and using this same technology securely requires regular training and checks. Just like technology itself, the practices and office culture surrounding its use are constantly changing, and both the company policy and the employee’s knowledge should be updated regularly.
Image courtesy of pakorn at FreeDigitalPhotos.net
Chinese computer manufacturer Lenovo (IBM’s former hardware division) is making headlines this month, but not the kind that most companies covet. Until as recently as January 2015, Lenovo has shipped a large number of computers with pre-installed software from adware company Superfish. In and of itself, this isn’t an uncommon practice – hardware manufacturers commonly reduce manufacturing costs for their consumer products by striking deals with various companies who pay to have their software installed on brand-new computers. As initially reported by security researcher Marc Rogers, the Superfish partnership was a bad one for Lenovo, not only because the software itself was already notorious for being adware, but also because it compromises the built-in security of your computer’s SSL protocols to do its dirty work. Lenovo initially tried to downplay the problem, but pressure from the security community and the resulting media attention has since caused Lenovo to reverse its position 180 degrees. The CTO apologized in an open letter, and the company has issued a fix that completely removes the vulnerable software.
What this means for you:
Unless you are really into the technical details, the “what” and “how” of the Superfish vulnerability is much less important than the “why” and the “who”. In this case, we know why Lenovo installed Superfish – presumably they benefitted financially in some fashion. The real problem behind this fiasco is that Lenovo (a “trusted” brand – I use a Yoga 3 while I’m out seeing clients) missed the security flaws in this arguably useless piece of software and endangered thousands of its customers for no other reason than to make a buck. Can any hardware manufacturer be trusted to have our security in mind when making and selling their products? If the most recent NSA hard drive firmware scandal is to be believed, I’d say the answer is a resounding “no”. As we’ve seen with numerous other industries, when a company is held more accountable to shareholder profit (or “patriotic” duty?) than to consumer wellbeing, the only person we can trust is ourselves.
Unfortunately, manufacturers like Lenovo, Dell and HP have made a bed that is now very uncomfortable in which to lie. Their practice of installing “bloatware” on their equipment have driven prices down to a level that may be very difficult to maintain if they can’t lean on the dollars gained by these pre-installed software deals. At minimum, they’ll have to be much more discerning on what they pre-install, which, in turn, will drive up costs and narrow their margins even further.
Russian security firm Kaspersky has just released details of an elaborate, multi-year, multi-country heist that netted hundreds of millions for the group orchestrating the crime. Rather than a series of spectacularly violent bank robberies, this campaign played out quietly and slowly on the technology infrastructure of over 100 financial institutions in 30 different countries. Unfortunately for us, Kaspersky and the banking industry are keeping specific names out of the public spotlight, as expected. It can be assumed that the organizations involved don’t want to damage their reputations, and authorities typically refuse to comment on onging investigations. How did the criminals gain such unprecedented access? Simple malware campaigns targeting employees and officials, which eventually led to a fully compromised infrastructure that allowed the criminals to quietly funnel away millions and leave very few traces behind.
What this means for you:
It may sound a bit cliched to trot out the saying, “There are 2 types of companies, ones that have been hacked, and ones that have been hacked and don’t know it,” but in this case, the criminals were able to steal vast amounts of money by staying well under the radar, an approach that is at direct odds with the normally disruptive and in-your-face style of malware and hacking many people have encountered previously. By lurking quietly in the background, the criminals gained complete familiarity with organizational procedures and employee habits, allowing them to digitally impersonate privileged officials and processes to move money around and out of the organization with impunity. Without a smoking gun, shell casings, fingerprints or DNA evidence, the only trail authorities could follow was the money one – a trail that was obfuscated by digital sleight-of-hand and spoofed internet addresses. Even though your organization may not be targeted for this kind of heist, there are many other types of data cybercriminals value, and it’s in their best interest to not get caught. Don’t look for the obvious malware symptoms – those types of attacks are analogous to vandalism and random, impersonal pollution. The real cyberattack you need to worry about is the one you can’t see.
Image courtesy of 1shots at FreeDigitalPhotos.net
If you didn’t hear it on the news, you probably got an email from Anthem letting you know that your personal information has been exposed in a massive data breach that impacts over 80 million people served by the medical insurer. According to Anthem’s own website established to address this breach, no medical records or credit card information was stolen (that they know of) which is a faint blessing in the face of what was stolen: names, addresses, birthdates, social security numbers, phone numbers, email addresses and employment history. In other words, everything a thief needs to steal your identity.
What this means for you:
As before with other large data breaches, there’s not a darn thing you could have done to protect yourself from the attack. If you just happened to not be a current or former Anthem-covered individual, it’s likely your information was stolen previously in any of the numerous other breaches from last year. Anthem will be offering free credit monitoring to all affected individuals, something that is going to sting their deep pockets signicantly, but will do little good in the long term. Why? Well, unlike credit card numbers, addresses or phone numbers, 80 million people aren’t going to change their names, dates of birth or social security numbers. Identity thefts can outwait the one year of monitoring (still unconfirmed, one year is my guess) that Anthem will provide. You can bet a large number of people won’t continue that service on their own dime, but you might want to consider factoring this type of fee permanently into your annual budgets. Or at least until someone can figure out how to secure our identities and credit better.
From a business standpoint, Anthem’s plight illustrates an important lesson. Though current legislation recommends this sort of data be encrypted, it is not a requirement. Shouldn’t Anthem have taken the extra step to protect your data? Does the government need to mandate common sense and best practice? Will Anthem’s current nightmare convince you to enforce more strict security practices in your own work and personal life? I don’t think you need me to tell you that if you want a prosperous and sustainable business protecting your sensitive data is no longer a recommendation, it’s a requirement.
Like the predictable “tick-tock” of a clock, reports are coming in of an infection spreading rapidly through Facebook via a fake Flash Update. The “tick” in this case was the report last week of a zero-day Flash vulnerability, and the subsequent legitimate update of the Adobe Flash plug-in. Not wanting to miss an opportunity, cybercriminals have released the “tock” – a video on Facebook is tricking clickers into installing a set of malware that can take complete control of the victim’s computer. Over 100k have fallen for this scam which is only 2 days old as of this writing.
What this means for you:
If you see a warning pop up on your computer that software on your computer may be out of date, it may be legitimate, and it may not be. With Adobe Flash, it’s very easy to check by going to Adobe’s own Flash website http://helpx.adobe.com/flash-player.html. Also be wary of the source of the update warning, such as that which comes from clicking on a dodgy link on Facebook or in an email. Doublecheck it against a legitimate source. Not sure what that source might be? Your trusted IT professional is only a quick call away. Spending five more minutes to vette that update warning is certainly worth avoiding a malware infection, right?
Microsoft has announced that Windows 10 will be free for users upgrading from Windows 7 and 8. There is an asterisk behind that statement however, and depending on your world-view, it’s a big one. First off, it won’t be free forever – only for a year after its release. It’s not clear what that means if, for example, after upgrading your Windows 7 machine to 10, you need to wipe the hard drive and reinstall. Do you have to reinstall 7 first and then upgrade to 10? Is there a cost if that happens after that initial year has lapsed? Microsoft has also been deliberately vague on what this means for enterprises and organizations with large installations of 7 or 8. Do they get it for free?
What this means for you:
Some experienced industry analysts predict that there will probably be a different “flavor” for the corporate world, especially as Windows 10 will come hard-coded with Microsoft’s new update/upgrade “Windows as a Service” model where improvements and fixes will come at a more rapid pace than most IT organizations have traditionally been willing to follow, and that “versions will no longer matter.” While this might sound like music to the average consumer’s ears, trends like this are rarely viewed favorably in tightly controlled IT environments, especially when it means maintaining compatibility with legacy apps and systems. Microsoft is still fuzzy on when Windows 10 will arrive – “later this year” is the current expectation, but you can bet that most large enterprises and organizations will probably forgo an immediate upgrade, as they have traditionally done for previous iterations of Windows. If you want to see Windows 10 right away there is a preview build which is still in very early development, but unless you are a stalwart early adopter and understand the pitfalls that lie ahead, I’d recommend waiting until it’s officially released. You can also watch Microsoft’s 2+ hour long presentation on the latest build of Windows 10 online.
Adobe has confirmed that a recently discovered vulnerability in the current version of Flash for Windows, Macintosh and Linux is actively being exploited on the internet. Adobe is planning to release a patch the week of January 26th, but did not confirm a specific date. Though security vulnerabilities are nothing new to Flash, this particular loophole is being exploited by a well-known and widely distributed exploit “kit” called Angler which could indicate a rapid spread of compromised websites and a large spike in malware infections. Once used to gain access to a victim’s computer, the device could fall prey to any number of malicious programs, including key loggers, ratting, ransomware, and good ole-fashion zombification.
What this means for you:
According to Adobe’s own advisory, pretty much everyone is affected by this exploit, though some reports suggest that Windows 8.1 and Chrome users may be safe for the moment, but that was based upon the current version of the Angler kit in distribution. The actual security hole Angler exploits exists in every version of Flash on all OS platforms. The easiest way to protect yourself from this exploit is to disable Flash altogether. For all browsers except Chrome is usually a matter of disabling the plug-in. For Chrome, you have to type “chrome://plugins/” into your address bar to access the hidden internal plug-ins page, at which point you can disable it from there. Aside from keeping your browser’s “head” down until the storm passes, make sure your antimalware software is functioning properly and updated, and avoid any strange links you may receive over the coming week.
Laptops and cellphones were once the sole domain of high-powered business executives, but thanks to the proliferation of high-speed internet and falling hardware prices, they are pervasive not only in professional environments, but in just about any walk of life. As you can probably guess, this also means an exponentially expanded attack surface for cyber criminals who are no longer focusing on traditional targets. Anyone who has a bank account or credit history is a potential victim, and younger targets can be exposed to potentially dangerous privacy invasions. Rather than enumerate the various ways in which your security and safety could be violated (we all have enough nightmares as it is), I’d like to focus on some positive actions you can take to make your mobile, digital life safer and more secure.
- Password protect your devices.
Even the most careful professional will misplace their mobile device on occassion. While passwords won’t stop determined hackers, it will keep most everyone else out until it can be recovered or remotely wiped. Laptops normally do not have remote wiping capabilities, so don’t stop at just a password for protecting these types of devices. - Use built-in apps, or purchase location-tracking software.
Late-model Android and iOS devices have location tracking and recovery capabilities built-in, but they must be enabled. You can add location tracking or a “phone-home” program to your laptop, but it requires the device to be connected to the internet in order for it to report its location. - Don’t store sensitive information on mobile devices.
With any portable device, the chance of it falling into the wrong hands is high. If you don’t have an IT department managing your device and controlling what can be stored on it, you should inventory what is stored on the device (sensitive client info, photos, personal financial data, passwords) and consider whether you need that information to be stored on that device. If you do, make sure you observe #4. - Encrypt any storage media.
All late-model Android and iOS devices have the capability to encrypt all data stored on the phone. It’s on be default on iPhones, but must be enabled manually on most Android devices. If you have to store sensitive data on your mobile device, make sure encryption is enabled and working. While it’s not completely necessary to encrypt your entire laptop hard drive, it is possible, and many financial service firms require it on their laptops. At minimum, store your sensitive data in an encrypted partition or folder, or on an encrypted thumb-drive. - Back up your data.
Do I even need to qualify this particular practice? Backups should be stored separately from the hardware being backed up. It should be transmitted and stored encrypted if it’s internet/cloud based. It should be as frequent as the minimum period of data loss you are willing to lose, e.g. if you can’t stand to lose an hours worth of work, your backups should run on an hourly basis. Be aware of the performance hits this may have on your hardware and network bandwidth. - Hide devices in parked cars or take them with you.
Mobile device thefts from parked cars is consistently at the top of all loss categories. Thieves know to target cars coming and going from office parks, universities, airports, and the retail/service businesses near these locations. Before you drive away from your work location to a Happy Hour or a quick bite or some grocery shopping, stow your laptop bag in the trunk or hide it in a hard to access part of the car. Don’t do this when you reach your destination, as the thief may already be there, watching for someone to do just that. If you can’t secure it or hide it properly, take it with you. - Add a leash.
If you are highly mobile and work from many locations, it’s easy to misplace your smaller electronics, and sometimes even laptops. Add a colorful leash to your thumb drives so you don’t forget them, and maybe even consider the same for your phone if you are prone to misplacing it. If you have to take your laptop bag with you to a place where you don’t plan to use it (because of #6), attach the strap to something you will be using at that location, whether it be to your jacket or purse, or even to your leg if you are sitting in a location with lots of noise or distraction. It’s easy to forget work-related tools when you are focused on non-work activities. - Be less conspicuous.
In open public places with crowds, conspicuous use of expensive mobile devices will flag you as a target for bold thieves. I’ve talked with victims whose laptops were pulled right out from under typing hands in a sidewalk cafe or picnic table, and have read numerous reports of smartphones and tablets being grabbed in broad daylight. If you want to work on your device in a busy environment, keep one eye on your surroundings, and place yourself and your device in a position where it will be less easy to snatch by a fleet-footed thief. - Educate your friends and family.
Even though you may be cautious and secure, the people around you can undo your careful preparations with carelessness or even well-meaning intent. Be mindful of everyone around you who might not be as savvy as you in technology, and choose carefully how you interact with them via email, social media, and even device sharing. Work laptops are notorious for being infected by family members who don’t have the same security concerns as you do. Quieting a young child with your smartphone may seem like a good idea at the time, but maybe there is some other way you can entertain them that doesn’t involve your work phone. - Report thefts/losses immediately.
Eventually, it will happen. Whether the device is stolen, damaged or infected and compromised, you should work immediately with the appropriate authorities and professionals to make sure you limit the damage, both to you and your organization, as well as any customers or clients who might be affected. Don’t wait.