Tag Archives: Best practice

  • 0

Bridge Building: Establishing Communications Processes

Category:Communications Processes,Infosec Communicator,Leadchange,Lessons Learned,techcomm,Uncategorized Tags : 

image

This past fall we had the privilege of visiting Pont du Gard, a Roman bridge and aqueduct in Languedoc in the south of France. Although built primarily without mortar (except for the top course of blocks), Pont du Gard has endured for more than 2000 years, despite frequent spring floods.

The Pont du Gard aqueduct/bridge was built to provide clean water for the town of Nimes. Its builders understood the importance of building a structure that took into account the factors that would affect the bridge. They understood at least some of the pressures that would bear on that structure. They built the bridge accordingly. Its builders designed it to endure.

Geographical map of the aqueduct of the Pont d...

Geographical map of the aqueduct of the Pont du Gard. Map created using data from OpenStreetMap. (Photo credit: Wikipedia)

So, this blog is about communications. What does the Pont du Gard have to do with communications?

Much of my role as a technical communicator has been to build processes that enable the flow of good communication. I’ve had to factor in the context (pressures that will bear on the structure) in which I was building those processes. Those communications processes are the bridges (aqueducts) that I build. In distributed organizations, well built communications bridges are critical to the health of the organizations.

Over the next few weeks, I’m going to talk about bridge building.  First, I’ll discuss my initial attempts at architecting communications processes for a Fortune 500 organization that had outsourced key support processes in the midst of a major software/hardware infrastructure transformation. Next, I’ll discuss communications processes I’ve built in my role as an information security practitioner in higher education. Finally, I’ll talk about my current work to build a sustainable communications bridge that enables clear communications between a central organization and its distributed communities, ensures the concerns of those distributed communities are heard, and facilitates best practice sharing among those communities.

Enhanced by Zemanta

  • 1

  • 0

Avoiding the Botnet Snare

Category:Information Security,Infosec Communicator,Uncategorized Tags : 

“Why would anyone attack my computer? I don’t have anything of value on it.”

Is this your mindset? Although the goal of many attacks may be identity theft or financial gain, there are other reasons for someone to attack your computer.

Of the many types of malware (malicious software) attacks, one of the most serious is someone installing remote control software that allows them to install and run automated programs, making your computer into a bot or zombie computer. Your computer then becomes part of a bot network controlled by a bot herder. The bot herder will use your computer to conduct distributed-denial-of-service (DDoS) attacks, send spam and phishing email, and attack other computers.

Trends

Several years ago, 2006 was described unofficially as the “Year of the Bot.” Millions of computers were members of botnets—4.7 million according to the 2006 Symantec Internet Threat Report. Other estimates ranged as high as 7% of all computers (approx. 47 million.) Typically, bot networks may contain as many as 80,000 computers. (There were even reports of a Dutch botnet of 1.5 million computers!) The problem is not any better today.

How does it work?

Although bot methodology is evolving, the classic bot scenario is shown below:

How a botnet works: 1. A botnet operator sends...

Image via Wikipedia

IRC (Internet Relay Chat) has been the classic means of communications in bot networks. In this type of network, it is easier to shutdown the bot controller because communications would be easier to track back to their source. Most recently, there are examples of bots using P2P (peer-to-peer) communications—“bots talking to bots.” This creates a decentralized structure which is much harder to shutdown.

How do I know if my computer is part of a bot network?

Unfortunately, there is no easy way to tell. You may notice unusual activity if you leave your computer on, you may be contacted by your Internet service provider (ISP), or you may find that your computer is quarantined/blocked from the campus network. If you are following the requirements of the Desktop Standard and you have run a virus scan and a spyware scan with no reported infections, it is likely that your computer is not part of a botnet. Follow the steps below to make sure you don’t become part of a botnet.

Protection

The key to preventing your computer from becoming a bot is to use a combination of technical and process protections. You’ll need to make sure you’ve got the right software enabled and you may need to change the account you use to check email or browse the Internet.

Protecting Yourself from Bots

If you’re running Windows XP or older, don’t use your administrative account for daily activities, use a “limited” account instead. A limited user account doesn’t allow the user to install software or make system configuration changes. If you browse the web using a limited user account and accidentally visit a malicious web site, normally, no software can be installed without your permission because your user account is not capable of installing software.

Create defense in depth to protect your computer against a variety of attacks. Install antivirus software, keep it up to date, and set up regular system scans. Make sure the Operating System (Windows, Macintosh, Linux, etc.) is up to date with its patches and has auto-update turned on. Way back in 2006, the average time between the discovery of a vulnerability and the availability of instructions to exploit was less than seven days.

Use a personal firewall. Firewalls protect you from outside intruders and also can prevent programs on your computer from inappropriately connecting to the Internet For Windows computers, check the list at https://personal-firewall-software-review.toptenreviews.com/. Macintosh users can use the built-in firewall in the OS, but make sure it’s enabled. Linux users should choose an appropriate firewall. A hardware firewall can also be used to protect desktop computers.

Use anti-spyware (where available). Spyware sends personal information to other people without your knowledge. For Windows, Spybot Search & Destroy (www.safer-networking.org) and Ad‑Aware (www.lavasoft.de) (free for personal use only) have been traditional choices. You may find that it is best to use more than one product, but be sure to read any information about compatibility with other software. Check out the reviews at https://anti-spyware-review.toptenreviews.com/ for some suggestions. (Be careful of downloading other anti‑spyware products. Some of them actually install spyware on your computer.) Researchers have estimated that as many as 89 percent of home computers are infected with multiple instances of spyware, averaging about 30 spyware components each.

Enhanced by Zemanta

  • 1

Updated: 2012 Speaking Schedule, January through June

Category:EDUCAUSE,Higher Education,Information Security,Infosec Communicator,Internet Safety,Presentations,Social Networking,STC,STC Rochester,Summit Tags : 

I’ll be speaking at the following events this winter and spring. Watch for my presentation materials on SlideShare.

January 9: HEISC (Higher Education Information Security Council), Town Hall. Recording available.

January 30:  Bullet Proofing Your Career Online (with Hannah Morgan, @careersherpa), ABCPNG (Always Be Connecting Power Networking Group), First Unitarian Church, Rochester, New York

Description: What are the 10 key steps to building and securing your online reputation? A security professional and a career sherpa provide their perspectives on how to create an online presence that enhances and promotes your career safely and effectively.

April 23rd: Bullet Proofing Your Career Online (with Hannah Morgan, @careersherpa), STC Rochester Spectrum Conference, Rochester Institute of Technology, Rochester, New York

April 24th: Leadership Day, STC Rochester Spectrum Conference, Rochester Institute of Technology, Rochester, New York

Facilitating the event and the panel discussion

May 17: Engage! Creating a Meaningful Security Awareness Program (with Cherry Delaney, Purdue University), EDUCAUSE Security Professionals Conference 2012, Indianapolis, IN

 Abstract: This session will help attendees identify available resources and tools and determine the steps needed to create an engaging security awareness program. We’ll share how to integrate social media, video and other resources in an effort to reach a variety of audiences. We’ll also discuss how to leverage security incidents to create opportunities for engagement with your community. We’ll conclude the session by helping you plan a series of targeted activities for a high profile event such as the National Cyber Security Awareness Month.

May 20: Communications Liftoff! Rocketing your Community to the Stars, Leadership Day progression, STC Summit, Rosemont, IL

May 21: Bullet Proofing Your Career Online (with Hannah Morgan), STC Summit, Rosemont, IL

May 23: Shockproofing Your Use of Social Media 2012, STC Summit, Rosemont, IL

Description: Lightning Talk. What are the top ten ways to shockproof your use of social media? What’s new for 2012?
Enhanced by Zemanta

  • 0

Making Information Security Fun

Category:Facebook,Higher Education,Information Security,Infosec Communicator,Internet Safety,Presentations,Social Networking,STC,STC Rochester,techcomm Tags : 

I shared this presentation at the October program meeting of the Rochester Chapter of the Society for Technical Communication. The presentation demonstrates how the Information Security Office at the Rochester Institute of Technology used marketing techniques to reinforce key messages to raise awareness around information security concerns such as phishing.

To see more about how we’re using blogging to raise awareness in a specific academic course, visit the RIT Cyber Self Defense blog.

Enhanced by Zemanta

Subscribe to Blog via Email

Enter your email address to subscribe to this blog and receive notifications of new posts by email.

Join 2,235 other subscribers

Categories

Support Introverted Leadership on Patreon

Blubrry affiliate banner