USB temptation - can you resist not taking a peak

Trick or Treat?
17% of the flash drives found in public high-traffic areas in Chicago, Washington DC, San Francisco, and Cleveland were plugged into computers – based on CompTIA study.  The USB contained a text file, when opened indicates that they were just part of an experiment and should clink on a link or email the person responsible.  For example, of the 2 that opened the files, both didn’t click on the link but did send an email. Maybe partial cybersecurity awareness (phishing) is starting to make an impact but simply plugging in a USB drive can be all it takes to infect you computing system.  Worst, to click on a file, even if it looks like a text file, can launch a virus, malware, remote connection, etc. without your knowledge.
Study also showed more men than woman opened; San Fran more likely to open/plug-in than D.C. individuals; 42% of Millennials were likely to pick up vs. 22% GenX and 90% of Baby Boomers. And related CompTIA mentions:
45% of employees of 1200 surveyed have not received cyber training from employers;,
94% plug into public Wi-Fi and of which 69% conduct work-related activities;
63% use work mobile devices for personal activities;
42% of Millennials work on infected machines in the past 2 years vs. 32% for all employees;
27% of Millennials have had their information hacked within 2 years vs. 19% of all employees;
37% of employees change password annually or sporadically.
...by the numbers as cybersecurity awareness month comes to a close

By the numbers: Fintech ranked company

not Stripe and no longer eBay...went public for the second time and acquired Braintree, PayPal is growing leaps and dollars
Reporting:
• 29% jump in profit
• $301 million for third quarter
• Up 14% in revenue
• $2.26 Billion in sales
• 12.5 Million payments processed daily
• 173 Million active users (that’s 16 Million from last year)

With these numbers, they can be rivals to Visa/MasterCard or simply continue on the e-commerce path… Certainly putting Square to shame - particularly in the merchant cash advance business with over $1 Billion and busting loan rates to $3 Million per day ($1 Million more than last year).  But slightly missing analysts’ expectation with strong dollar hurt it’s transaction volumes in Europe and China (according to finance.yahoo.com)
Then, a glitch today.  An interruption in global payment processing due to a center power outage -
Click on the heatmap

Passwords never gets old

...at least for security breaches. This time a free webhosting service used by millions around the world stored passwords in clear-text and as a result, 13 Million were exposed in a 5 month old hack.  This week 000Webhost confirmed a hack on one of their main system due to the use of older version of PHP [zdnet.com].  To make this worst, a few other discovery post breach notification including: unencrypted web/HTTP traffic was identified for the login page, SQL injection (ability to inject SQL commands with expressions) and/or XSS (cross-site scripting-ability to inject client-side scripts) vulnerability exist but yet to be patched, and possibility the breach extended to business/vendors it partnered with.  What happened to security 101 for password encryption on servers/storage, encrypted transmission, and input validation / OSWAP standards.  And, some common tools that would have identified/checked security for these items include: DumpSec or shadow file review; Wireshark; and HP Webinspect / SDLC.

But hey, it was a free hosting service...so what about Facebook and other services/sites we don't pay for

Does organizational practices translate to information security posture?

Theranos lab tests promises quicker and more accurate results with smaller blood drop samples which translate to lower cost, nearly 10 times lower.  But, a snag reported by the WSJ,
“confirmed that the company is down to offering just one test using a few drops of blood and is performing the other more than 240 blood tests it offers consumers by using larger blood samples drawn with needles from patients’ arms.”
Moreover, its website modified statements around number of blood drops for test required and actual micro-vials needed.  Perhaps just a coincident but Theranos has responded.
FDA is investigating - though FDA approval not needed since its not externally manufactured equipment such as Siemens or Roche Diagnostics which Quest and Laboratory Corp. uses.  Millions in investments and partnerships including Walgreens (and touted by big names – Mr Biden, John McCain, Henry Kissinger) over the past year have casted some doubts.  Seems at best, a marketing disconnect as one official from the CMS (Centers for Medicare and Medicaid Services) eluted to.
Yet, there’s a matter of no published peer-reviews that compare its test which is traditional that case for this industry.  Additionally, the “company hasn't allowed independent experts to publicly assess its labs, citing the need to protect its intellectual property.”

What if intellectual property protection was also cited for denying IT security audit?
What correlation does industry peer-reviews and independent security due diligence have?

Foreigners may soon sue in US courts for privacy violations

The Judicial Redress Act of 2015 was voted in favor by the House of Reps. and heads for the Senate – which would extend the Privacy Act of 1974 to EU citizens and other specified countries.  The invalidation of the Safe Harbor program pointed to EU residents’ inability to redress data / privacy violations – which is only available to US citizens and permanent residents.  If passed, DOJ (Department of Justice) can designate foreign countries, etc. pursuit of civil remedies.  Hence promoting legislation that allow better data sharing between US and foreign governments.

3rd-time is a charm – but not for security breaches

TalkTalk (phone and broadband provider) has suffered another security breach yet details and notification seem to be lagging behind.  First in February, scammers stole thousands of account numbers and names from company computers and then, in August, the company mobile sales website was hit with a cyber attack that exposed personal data.  Now, a criminal investigation has been launch due to “potentially” all customer personal data exposed (names, DOB, addresses and credit card / bank data) from a company website that did not have encryption.  Some systems were brought down yesterday for precaution / remedy and within hours the stock dropped approx. 10% as a result. Perhaps another topics to content with is the mass exodus of customers…and based on the last several months, TalkTalk is the only big provider, others being BT, Virgin Media and Sky, that show negative sales share growth.
The first scuttlebutt about cause relates to DDoS attack and appeared to be from a cyber-jihadi group…according to the BBC. Let's check back in a couple months

If you like privacy but so-so about iPhones in the past, get one now

It’s not that encryption can’t be broken. But by not having the encryption key makes it nearly impossible when the iPhone or iPad is locked says Apple. 

In response to a warrant, Apple remarked that iOS8 and later made the request to unlock a iPhone/iPad impossible and if it had to make available in future releases (storing keys) or create a backdoor, that would violate the trust of customers and smear the band’s reputation for digital privacy and security.  Further, Tim Cook referenced the Constitution when it came to decide privacy vs security…

Furthermore, law enforcement can't make you unlock unless you're using the Touch ID - since that is not revealing anything we don't know (unless the passcode you self-generated)... Of course, you can keep mis-entry your passcode to lock it longer, passcode is require upon 48 hours of Touch ID inactivity, and a restart forces passcode entry irregardless...just options

October 21, 2015. #BacktotheFuture2

Even politicians are cashing in on Back to the Future buzz…webpages that go to campaign sites.  Maybe best phishing ploy yet ;)
So let’s take a look at some movie items as it relates to cybersecurity:

• Hover board  =  Actually drones… legal policies and privacy topics are for front in our culture
• Video conferencing (flat screen TVs)  =  Facetime, Skype, etc... what’s everyday life (and business interviews) without such 
• Fingerprints  =  Biometrics... convenience yes, but also unlocks personal, confident and top secret information / 2-factor massive uptick
• Connected home devices  =  IoTs… need I say more on all things connected, all the time, that can trend and analytics that can provide your behavior / impulse that may scare you
• Robots  =  Come to life – adaptive technology and expansion use in military etc.
• Flux Capacitor  =   Lockheed Martin is on that but looks to be a break-even energy technology 
• Self lacing shoe  =   Nike has a patent towards it but haven’t seen in a store nearby
• Finally,Cubs plus World Series NOT Equal #FlyingtheW

What will Hill Valley look in October 21, 2045?  Humm...Artificial Intelligence ingrained in machines, embedded in humans so heightened level of senses (and analytics) without the need for downtime so life/business/travel merge and available as if it were by just thinking it -for only those who have the means, otherwise...

Say goodbye to passwords for inbox

Two-factor authentication is certainly the buzz and implementation for organizations but what about removing passwords in that equation.  Yahoo Mail is introducing “account key” to remove passwords altogether by leveraging only your username and mobile device.    Sign up is this week - which detects the PC source and uses your mobile device basically as key, allowing password free login unless “suspicious” activity is detected.  A disable component is also said to be featured – You’ve got Yahoo Mail.  The new mail app requires a later version of iOS and Android; and of course feature rich and look-and-feel as Yahoo promotes Yahoo Mail to compete with Gmail and other markets as schemes for password solution of Twitter.

Annual Cybersecurity Survey by PwC – Turnaround and Transformation

PwC’s annual cybersecurity survey – turnaround and transformation  

Attended the presentation by PwC which revealed a number of themes including: continuous investment/spend on cybersecurity and collaboration with others and big data (analytics) is a big factor in a cybersecurity program

Key findings by PwC’s survey:

• 91% follow a risk-based cybersecurity framework
• 69% use cloud-based cybersecurity services
• 59% leverage Big Data to improve cybersecurity
• 65% collaborate with others to improve cybersecurity
• 54% have a CISO in charge of the information security program

Additional result / themes for all industry – further data analysis is available via their GSISS site

• 31% experienced 50+ incidents while 7% don’t know
• 20% will have an InfoSec budget of 1M-4.9M with next highest at 15% budgeted for 10M
• Security safeguards will be implemented via (in order of majority): overall strategy, CISO in charge, awareness program, third-party, threat assessment and activity monitoring/analysis
• The role of CISO/CSO or security exec will primarily focused on: approach as enterprise risk-mgmt issue, communication directly with CEO, etc., understanding business/competitive issues and environments
• Cloud-based security adoption for security include (primarily) advance authentication and real-time monitoring/analysis

Finally, the financial sector analysis (other sectors forthcoming) revealed major challenges to be third-party, rapid evolution of technology, cross-board data exchange, mobile technology on the rise, and increased threats from outside the country.

Cybersecurity Bill of Rights, Oct 14 adoption

New Bill of Rights to protect your personal information and calls for breach notification with 60 days from insurance company.

• Know all your personal information held and the agent/business they contract with
• Privacy policy requires to be on website and hard copy; as well as consumer options for their data
• Reasonable protection for unauthorized data from company, agencies and any business with your data
• Unauthorized access of data is a security breach which will require: first-class written notification or email sent within 60 days, description of breach and steps to protect from fraud, action company and agents has taken to protect, contact information for the 3 credit bureaus, and contact information of company/agent involved in the breach
• Your rights include: 90-day initial fraud alert/credit report, 7 year extended fraud alert, credit freeze, free copy of credit report, get fraudulent information regarding breach as well as information related to identity theft, dispute fraudulent information on report, and stop creditors/deb collectors from report fraudulent accounts related to breach as well as stop contracting you. 

 http://www.valleynewslive.com/

This came of the heel of Anthem’s data breach that exposed 80MM customer records including names, SSN, birthdays, medical ID, and other employment data.  However, the new bill has raised additional questions regarding the extent of rights and protection that might be beyond existing state/federal protection laws.  So, it should go through further scrutiny or further clarification and its effectiveness will be forth telling.

Making a Good First Impression and Happier Life

It only takes 7 seconds to make a first impression. Inc.com

• Genuine smile – shows welcoming, decreases stress hormones and correlates long lasting
• Right handsake – universally polite but is an art form – careful of pressure
• Verbal introduction – exchange pleasantries, saying their names is always a good thing
• Speak clearly – "…those who talk in a deeper voice, and more calmly, are taken more seriously"
• Make eye contact – shows interest unless you overdue
• Use body language – mirroring each other's body language for mutual connection

Also, "5 Inspiring Lessons From TED Talks on How to Have a Happier Life", Inc.com

1. You're the boss, it's up to you to create a happy work-life balance, so take control, set boundaries and make small/balanced investments
2. Tough choices define who we are and making that hard decision defines who we want to be
3. Not having achieved something YET is different than failing; and should be your mind-set
4. Make the connections: via people, things, ideas, projects, etc.
5. Saying yes (and being engaged) to what lies ahead demonstrates passion  

Snippets of Business and General Management Insights, an Interpretation

It's a seismic disruption in all verticals happening simultaneously…so globalization and explosion of data for rapid decision making is best with diversity in mind and clear decision making based on strategy. Compilation of stats from The Economist:

• 45% of companies are increasing their IT budgets in 2015
• 90% of technology budgets will be outside IT dept by 2020
• Working remotely has grown 80% from 2005 to 2012
• Executives predict that ¾ of their workforce will not work in traditional offices by 2020
• Globally, satellite offices are expected to grove 50% by 2020
• By 2020, the volume of data will grow 10 times to 44 zettabytes
• Female CEOs of Fortune 500 companies = 0% in 1995 to 5% in 2014
• Multiracial CEOs in Fortune 500 companies = 17% in 2014
• Startups are on fire – with approx. less than 1,000 in 1990 to 140,000 in 2014 worldwide
• $86.7 Billion investment in startups worldwide

We know technology is moving the pace of mobile workforce more than ever and at speeds that require fast decision making. Small but impactful insight from big data is a result of right predictive analytics –which empowers people and organizations to transform. With IT in the center of this acceleration and competition, it also bears constant disruption to react faster and more efficient. A way to thrive in this environment and a workforce that will be 50% millenniums in 5 years is through re-skilling oneself and working cross-functional with others. Radical collaboration threw omni-presence of technology will bring significant opportunity for enterprises for making significant breakthroughs. Where data analytics lead, so must individuals (from bottom-up) to establish/root the culture. Executives can then create the larger initiatives based on the foundation and point of view from the employees and their consumers. To be leaders, one must be strong but graceful under pressure and "multi-dimensional with long-term strategy but short-tem accountability", The Economist.
Are you comfortable in times of paradox and ambiguity?

Cyber Insight by ISACA – virtual conference

Full day on-line conference (free) on Oct 28^th with CPE credits on dynamic security posture amidst changing technology and threat vectors – brought to you by ISACA
Topics: cyber security infrastructure, monitoring/analytics, emerging IoT, and threat intelligence

Ever post your boarding pass on social media?

You take a picture of your boarding pass to tell friends on the public Internet you're going on vacation, but what information does it reveal?
Do you tear up before pitching in the garbage?

Your boarding pass (barcode) reveal some of the following personal information about you and others: name, frequent flier number, flight info, planned flights, phone, email, emergency contact, ticket purchaser, options to change seats/flights, maybe that secret question to make changes…any/all of these have been discovered on that barcode

Remember - Cybersecurity Month

Characteristics of Highly Effective Teams

Feel free to comment, provide insight, etc. but below are some of my interpretations for a productive and effective team – inspired by Covey and others

• Clear mission and purpose regarding the end goal, and continuously re-evaluating success and impact
• Taking the initiative, communicates proactively, and taking responsibility / ownership of one owns actions and results
• Priorities that are focused, results oriented and mutually accepted by each member
• Listening and seeking to understand members – point of view and having social sensitivity / self-awareness
• Win-win agreements that are collaborative, cooperative and team centric
• Easily understood roles and authority while empathetic and appreciating unique personalities, skills and style
• Understanding the principle of teamwork through synergy, communication, problem-solving and humor
• Commitment to learning and training to update skills while promoting feedback from others
• Maintaining and supporting a work-life balance 

Cybersecurity live

I took a snapshot of cybersecurity hacks at a point in time (a moment ago) which resulted in the below – ordered by Most to Least:

• Attack Source: US, China, Saudi Arabia, Canada, Bulgaria, Ukraine, South Korea, Iceland, Indonesia, Hong Kong
• Attack Types/Ports: VNC, unknown port, Telnet, Http, Vlsi-lm, csd-mgmt-port, next 5 were unknown ports
• Attack Targets: US, Turkey, Saudi Arabia, Mil/Gov, France, United Arab Emirates,

Rather than reading, check out the live link…just a post for cybersecurity awareness month
https://cybermap.kaspersky.com/

Safe-harbour follow up

With no further delay, the highcourt ruled, http://econ.st/1VAkgSF

Updated October 6th 2015: EUROPE'S highest court today struck down the safe-harbour agreement, arguing that "legislation permitting [American] public authorities to have access on a generalised basis to the content of electronic communications must be regarded as compromising the essence of the fundamental right to respect for private life." The judges also ruled that national data-protection authorities within the EU do have the right independently to examine firms which transfer personal data across the Atlantic. In its initial statement the court did not mention a grace period that would allow companies to adapt to the ruling

Generally, ensuring data received by US to be anonymized would be ideal and a common practice available to industries but might be more challenging for Pharmas based on US FDA requirements – meaning clinical monitoring and subject follow-up / additions would not be feasible = trade-off. "clear guidance" said to follow 

Updating data protection rules between EU and America

European Court of Justice (ECJ) – highest judge decision on data privacy rule could put additional barriers for data flow from EU to America. Since the late 1990s, under safe-harbour, EU data is allowed to flow to the US with proper safeguards provided equivalent EU data protection rules were instituted, no other third parties that are non-compliant, and as long as opting out is available. That's where it ends (or begins) since self-certification has demonstrated that deficiencies exist and false compliant were reported by the European Commission in 2013.
EU sees personal data as a fundamental right whereas US considers it consumer protection – allowing exceptions in the name of national security. These differences were brought to bear when Yves Bot (court advocate general) stated his opinion that "America's data-protection rules are inadequate and the safe-harbour pact should be suspended." The Economist

The EU court's decision on the matter could be rendered on October 6^th and could have far reaching affects with existing data flow of private data and increased cloud services that cross country philosophies. Other related strain in the political mix include: (a) American Congress holding on the Judicial Redress Act - legislation that would allow EU citizens to sue in American courts for privacy violations and (b) Umbrella Agreement which allows personal data to be exchanged between country law enforcement agencies. Data protection rules is trying to catch up with the times but these negotiation and proposals on the tables may further limit data sharing, institute fines based on revenue for violation and may require independent data-protection officers to rule on privacy.
Many sources of the EU data protection so here's one reference – Directive 95/46/EC

General Electric’s Green Berets

AKA Corporate Audit Staff (CAS) at GE in Fairfield Connecticut undergo a 5 year commitment where 2% make it to an executive position upon completion. All it takes is 100-120 hour work weeks in a rigorous and intense environment (said to be collaborative but not competitive), working with high-level senior management around the world. Typically, if you're early into your career, the steps include:

1. Entry level pre-screen selection
2. Application selection by GE's VP of Audit Staff – eliminates about 50%
3. 4 weeks of critical thinking, leadership and ability testing via adaptation to unfamiliar projects, auditing and IT project roles
4. Then, 2 year commitment of 4-month long assignments e.g. balance sheet, general auditing, IT develop and other high-level GE projects

Formal appraisals are delivered 6 times per year and daily feedback is provided on your work/progress. Typically, half of the selected participates move to audit-manager roles in the 3^rd year, 20% move into senior audit management roles and the remaining best-of-the-best 2% is offered executive roles to become the next Presidents, VPs, CFOs or CEOs. All that make it through are in positions of authority…and join the 80% of GE's top CFO's as CAS members, including Jeff Bornstein.

October is National Cyber Security Awareness Month

Days into the month so let's take a quick look at the top 3 security breaches to this point – at least reported…

T-mobile applicants' personal data stolen: names, drivers licenses for 15M US consumers who applied for service – related to database maintained by Experian (credit reporting agency); so more free credit monitoring for 2 years for the affected folks
http://arstechnica.com/security/2015/10/highly-personal-data-for-15-million-t-mobile-applicants-stolen-by-hackers/

Scottsdale, retail brokerage and stock trading company announced 4.6M customers' names, email addresses, and SSN hacked – identified by federal law enforcements….and yes, 1 year free credit monitoring is being offered.
http://krebsonsecurity.com/2015/10/scottrade-breach-hits-4-6-million-customers/

Kmart – Australia – Exposure of customer names, email address, telephone, billing information and products purchased – from customers that used an online ordering system. Australian government is looking for mandatory breach notification legislation – sound familiar (it's a theme being played out in every country)
http://www.computerworld.com.au/article/585784/kmart-australia-calls-police-over-security-breach/

We'll check back regarding the details that unfold; and in the interim, www.itbusinessedge.com provides some tips of prevention

1. Do End User Security Awareness
2. Have an encryption policy and enforcement it
3. Deploy Intrusion Detection/Prevention Systems
4. Implemented Content Filtering to limit access to known malicious websites
5. Perform regular vulnerability assessment
6. Apply comprehensive patching from operating systems to 3^rd-party apps
7. Employ insider system monitoring such as Data Leakage Protection and understand behavior
8. Back up data – for recovery