Saturday, October 18, 2014
Cash Payments
For some reason I had a hard time coming up with a topic for this week’s post. I figured if I just started typing, something would come to me eventually – and it finally did (I’ll spare you the rambling that got me to the final topic). Our assignments have focused on the restaurant chain of Harry and Mae’s and the breach they experienced in their payment processing system. Even though this is a fictional company, the situation could very well be real. I got to thinking about the protection of my information whenever I pay after eating in a restaurant. I generally tend to fall on the side of paranoid, which means I never pay with my debit card when the waitstaff takes the card from the table to go pay at a terminal. I just use my credit card or pay in cash in the situations because I refuse to let someone walk away with access to my checking account. However, I willingly handover my debit card whenever I’m paying at the register. Because of our Harry and Mae’s case study, I’m starting to rethink this habit. Granted, the person behind the counter that I’m handing my card to isn’t going to have time to steal my information while I’m watching them, but I really don’t know what their payment processing system is like or how well protected my information is. Going forward I think I’m going to start using my credit card or cash in these instances as well. It’s not that I really want my credit card information taken, but with the ever increasing number of breaches lately, I expect it is likely at some point. No loss of information is pleasant to deal with, but I really don’t want my checking account compromised along with everything else. This happened to a friend of mine, and it was months before she got everything straightened out. I just don’t have the patience to deal with that kind of a mess.
Saturday, October 11, 2014
Simon Says...
In one of the chapters assigned for this week’s reading assignment, our book talks about social engineering. I find this aspect of cyber security especially interesting -probably not surprising given the fact that I have a bachelor's in psychology. Naturally, this is a topic towards which I would gravitate. It’s also something I deal with every day at work. My company has very strict privacy rules regarding client information where we have to verify very specific pieces of information before we can provide any client account data. Sometimes just the fact that we ask the information upsets people, even after we point out that this is to protect their information. They just like to complain that this is their account they should be able to have their account information.
But what really surprises me is when other companies call for client account information, and argue with me that I should be able to talk to them about the account. For example, a client’s account is transferring to another company, and they call us to check the status of the transfer. We can provide limited information about the transfer: if it’s been received, if it’s in process it’s been completed etc. If there is something wrong with the request that we can’t process it, we ask the receiving company to instruct the client to call us. At least once a day one of these companies will start yelling that I should be able to provide this information to them. When this happens, I usually ask them if their company has rules regarding client privacy, and they always reply yes but in this situation I should be able to give them what they’re asking for. They try various social engineering techniques, such as creating a sense of urgency, attempting to put themselves in a position of authority, anything to make me feel like I should give them this information. It’s frustrating, but it’s a factor in protecting client information.
Thursday, October 2, 2014
I think I might have learned something
I’ve decided to comment on my assignments for this week’s blog post. Last week was the initial design of the current system arrangement for Harry and Mae’s restaurants. Much of the assignment was similar to the analysis we had done for a previous class, but I feel like I understood the assignment so much better this time around. The purpose behind college and homework is to learn (obviously), but I’m starting to realize just how much I have learned. I’ve understood all along that there is a learning curve with every class as I’m introduced to new topics and processes; however, for the first time in the program the assignments are requiring the prior knowledge learned in the previous classes. Each of my classes prior to this term, while enjoyable and informative, were pretty independent of one another. Now they have begun to build on each other, which is interesting to me. I don’t mean just the assignments, just the way the past has informed my current classwork. I’m sure I would have been able to complete the assignments this week and last week if I hadn’t had the prior coursework, but it would have been much more difficult, if not overwhelming. Fortunately I had the previous work that I could reference to complete these assignments. I’m finally seeing the light at the end of the graduate work tunnel, and am happy to know that I have leaned not only the subject matter, but how to incorporate what I’ve that learning into my new projects.
Friday, September 26, 2014
New York agrees with me
During a discussion of cyber security, the superintendent for the New York Department of Financial Services (DFS), Benjamin Lawsky, said, “It is impossible to take it seriously enough” (Lopez & Friefeld ). The importance of cyber security cannot be understated. Last week I posted specifically about the Home Depot breach, but there are so many more. Just yesterday, the Channel 7 news in Omaha had a story that Jimmy John’s experienced a breach. J.P. Morgan has also recently reported that they are investigating a potential breach. In fact, the DFS issued a report earlier in the year that the majority of financial institutions have experienced at least one attack in the last three years. Exact numbers were not provided in the article, but this still seems like a significant number of attacks. This doesn’t even include the number experienced by retailers.
In my post last week, I stated that it seems retailers are taking the required extra steps only AFTER an attack has occurred, instead of learning from others and taking steps now. Lawsky points out that lawmakers are in a position to enforce requirements, but I think any policies they put into place to address this specific topic would be to general or too outdated by the time the bills were approved. Technology tends to move faster than Congress (especially of late).
The article ends with Lawsky saying, “Once there is a major event, everyone suffers. We are going to pay for it either now or then” (Lopez & Friefeld ). This is my belief to an extent, but I would suggest that it actually costs more to wait for something to happen. Aside from the expense of review and upgrading the system to prevent a breach, the company would have to cover the cost of identity protection and any required reparations after a breach. In the long run it is cheaper to make changes now instead of waiting for shit hit the fan and have people scrambling to resolve what should happen fix initially. By focusing attention on the importance of cyber security now, Lawsky is positioning New York in a better position to protect the financial institutions.
Lopez, L. & Friefeld, K. (2014). N.Y. Financial Regulator Says to Focus on Cyber Security.
Saturday, September 20, 2014
Thoughts on Home Depot
CNN posted a short little article about the hack into Home Depot that has been recently reported in the news. This latest breach, involving over 56 million credit/debit cards, only serves to highlight the need for strong security measures. In addition to that, it also raises some questions. How did it happen? Why was it able to happen for such a long time? What’s going to happen in the future?
According to Home Depot, the breach resulted from “a custom strain its security team had never seen before.” Unfortunately, this is likely to be the future of these kinds of attacks. With changes in technology, and improved methods from the attacker community, this will also be a more common occurrence. Home Depot has said that they are seeking to increase their encryption and security methods, but why did it take a major hack to make those changes? Granted, I don’t know all the facts in the case yet, and it’s easy to judge, but does it really take a 56 million card lost to instigate changes? Target reported a breach of 40 million cards last year, and this should have been a wake up call to any retailer. Instead, the attack was found on September 2, but is believed to have been around since April. This is a long time to be losing information.
There are some lessons that can be taken away from this. We shouldn’t rely on what is in place. Instead, it should be regularly reviewed, tested, and updated. Improvements are constantly made in regards to technology and this should also apply to our defenses. Anytime a client’s information is at risk, companies need to ensure it is protected. Having an effective security plan in place has got to be cheaper then supplying identity protection services for millions of cardholders.
Backman, M. (2014). Home Depot: 56 Million Cards Exposed in Breach. Retrieved from http://
Saturday, September 13, 2014
Patience and Planning
I’m going to write about something that happened at work recently. I apologize for some of the generalities in this post, but I am not going to discuss any company specific technologies in a public forum. In our cyber-security courses we learn about Confidentiality Integrity and Availability being the cornerstones for protecting information. This also applies to new systems in development. My company prides itself on our technology and often uses it as an incentive when we are inviting new agents to join us. While our agents do think about the Confidentiality and Integrity legs of the triangle, their primary concern is Availability.
A new program was recently implemented that completely replaced one of the primary services we provide to our agents. Testing had been done to ensure it worked as designed; however, it couldn’t talk to the agent facing system that is used to view the service. The new program was security tested, and passed. Information remained remained secure, but the Availability failed once the program went live. Because of this the entire Information Security team had to give up their weekend so they could find the problem, fix it, and test it by Monday morning.
In my opinion, this comes down to planning and patience. I saw this happen at my previous employer, but never to the scale as what happened at my current company. Management was excited about the new program, and rushed to put it in place. Once it passed initial testing, it should have gone through a secondary phase of a limited rollout to test it in the live environment. This wasn’t done, and resulted in a pretty big failure. Planning and patience could have avoided this.
Sunday, September 7, 2014
Websites for managing threats and vulnerabilities
Establishing a list of reliable sources for breast and bone abilities is important for managing them. Below is a list of the sites I like best with a little bit of a description and why I like them. I’ve also included a link to each one so that you can also visit the site and give me your thoughts.
The National Vulnerability Database (NVD), which is a government sponsored database for vulnerability management. They provide links to additional websites dedicated to threat and vulnerability management. Having these additional links all in one place is easy.
I especially like the link the NVD provide to The National Checklist Program. These lists provide guidance for setting up security configurations to defeat known threats.
Common Vulnerabilities and Exposures provides information about know vulnerabilities and exposures. This is helpful for the use of vulnerability management, patch management, alerting, and intrusion detection.
Symantec has two pages that I like for current threats and vulnerabilities. First is their Threats page, which lists the name, severity, height, and discovery date. Each threat name has a link that provides additional information about it.
Symantec’s vulnerabilities page, lists the name of the threat, it’s severity, and the date discovered. Each name is hyperlinked to a description page that details the problem, and provides recommendations.
Subscribe to:
Posts (Atom)