Introverted Leadership Mentor
I had the pleasure of presenting the following presentation to the Rochester Regional Library Council on Oct. 25th. It contains general Internet and computer safety tips and is slightly modified from a session we provide to faculty and staff at RIT.
In my Cyber Self Defense course at the Rochester Institute of Technology, I teach a module on Developing a Security Mindset. Based on a class exercise by Tadayoshi Kohno at the University of Washington (mentioned in a blog posting by Bruce Schneier), the goal of the module is to reorient students’ thinking from the features of a product and how those features are supposed to be used to thinking about how someone might “hack” the product. In other words, develop a security mindset.
I ask the students to determine product assets and vulnerabilities and identify how someone might attack the product. The students are told that they do not have resources to counter every possible threat.
I also have the students create a risk map that depicts the likelihood of a particular attack and the potential impact of that attack. Placing specific threats on a risk map helps students understand that since not all threats bear the same weight they need to choose what is most important to defend against.
The twist to the exercise is that students may not conduct an analysis of a computer-related product. For example, subjects presented by my students this quarter included Water Purification, Bicycle Safety, Running a Pizza Business, etc. As the students presented, we discussed their risk maps and the choices they made.
Group one risk map for a water purification plant
Although we may not agree with the students’ risk map, the exercise stretches IT students to think “outside the box.”
When television and movies use information security as their storyline, they typically pass up accuracy for the sake of drama. I was pleasantly surprised when a recent episode of Covert Affairs actually got the information security content mostly right.
In the episode in question, the character Natasha plays a freelance hacker who was employed by Russian organized crime to develop malware. Natasha demonstrates a successful hack that immobilizes a communications satellite and most computer-controlled infrastructure such as phones, television, traffic lights, etc. Although the ability to create a hack that could accomplish all of these goals is a bit of a stretch, Covert Affairs got some things right.
Organized crime and freelance hackers
When I first began working in information security several years ago I was told by a co-worker that organized crime was responsible for much of the malware developed today. I was very surprised as I had not thought about how malware attacks might be funded. Organized crime does hire freelance hackers to develop malware, although the most common purpose is to aid in identity theft. Although the hack demonstrated in the episode is something you might expect to see in a cyber attack and is not as common as that developed for identity theft, there have been computer attacks on infrastructure in Estonia and Georgia, and the United States certainly attempted to paralyze the infrastructure of Iraq before Desert Storm. In 2010, the United States Cyber Command was announced.
Using computer code in a way that it’s possible to identify the author
Security experts do examine some hacks to try to determine its author, especially if its a severe attack. Check out this article in Wired Magazine “Pentagon Searches for ‘Digital DNA’ to Identify Hackers” (https://www.wired.com)
Kudos to Covert Affairs for making an effort to get the technical details correct.
Having trouble with security awareness at your university or college? Need some new ideas? Trying to figure out what to do for National Cyber Security Awareness Month?
The members of the EDUCAUSE Higher Education Information Security Council (HEISC) Awareness and Training Working Group have created some wiki-based resources to help you with your security awareness initiatives.
We’ve created two main resources.
Check out these resources. The A&T Working Group is delighted to share their ideas with you and they’re there to help you be successful. They have a wide range of expertise and they believe you’ll find these materials valuable.
Today, I had the privilege of being interviewed by our local YNN cable news about the challenges presented by placing private information on portable devices. A surgeon at the University of Rochester Medical Center had lost a flash drive containing the medical details of around 800 of his patients. The reporter, Anne Lithiluxa, asked me how loss of data could be prevented.
Generally, if you’re going to place private information on a portable device, either the device or the information needs to be encrypted The likelihood of exposure of private information through the loss of portable devices has increased tremendously lately due to the proliferation of smartphones and their use in accessing corporate email accounts. Good information security practice is always a combination of safe handling practices and technical protections.
However, the bottom line is that people are always the weakest link. Technical protections can always be defeated by poor practices.
