October 2016 marks the arrival of the National Cyber Security Awareness Month (NCSAM), a nationwide effort directed at individuals, companies and enterprises. The NCSAM 2016 theme, announced by the White House on 28 September is, “Lock Down Your Log-in” with special emphasis on the need to ensure your login protocols go beyond the use of userid/password combinations.
Every engagement should have in place a means to authenticate the user, beyond their having presented the appropriate userid/password combination. The authentication may take the form of a one-time-password transmitted to a device; a positive command action by the user within a third party application on a separate device; or the use of biometric data and/or devices. With authentication, the first step in adopting the iconic trilogy of the NCSAM is in place.
“STOP. THINK. CONNECT.”
- Stop: Make sure your security software, processes and procedures are in place
- Think: What are the consequences of my actions or behavior online?
- Connect: Use the internet; enjoy the internet
STOP
Your devices which you are using to conduct business should all be protected at the same high level of security. What that means is, if you are using a desktop, laptop, tablet or smartphone, your device needs to have a modicum or security in place. Devices get lost, devices get stolen, and device become compromised via user behavior (clicking on a link which begins the process of a cybercriminal taking control of your device).
THINK
How may my actions put myself, employer or company at risk?
To accomplish such may be as easy as ensuring all applications (apps) are downloaded to your devices from a reputable site, one which does application scans of anything they are pushing your way. For example, for apps which are designed to run on a device using the iOS (Apple) operating system, the Apple Store is where you should be obtaining the executable codes for your device and those apps which are designed to run on an Android device would be found within the Google Play or the manufacturer’s sites.
Similarly, are your social network publications putting you or your employer at risk? Are you posting to Twitter, Facebook or any of the hundreds of other social networks where you are, where you are going and what you will be doing when you get there? From a personal safety standpoint, advertising where you are, is also advertising where you are not; useful information for any criminal. Likewise, sharing information on with whom you are meeting, and where, is plain and simple poor OPSEC (operational security), and which will permit an adversary the opportunity to use your information as additional pieces to the targeting mosaic.
CONNECT
Using the internet is not without risk. That said, do not allow the risk to paralyze you, recognize the need to be careful, judicious and aware. The Federal Bureau of Investigation (FBI) has highlighted those areas of cybercrime which are proliferating throughout the United States.
- Ransomware: The FBI advises ransomware has infected individual users, police departments, hospitals, schools and many companies. The criminals take control of your device, encrypt it and offer to sell you the key to unlike the device (the ransom).
- Business email compromise: The criminal entity compromises or mimics the business accounts of company executives with “spend authority” and using social engineering techniques, dupe the company’s personnel into making a financial transaction which puts dollars into the hands of the criminals. The FBI reports, this type of crime has been reported in all 50 states, and more than 100 countries. The level of financial damage is estimated to be greater than $3 billion worldwide.
- Intellectual property theft: The common misconception is that intellectual property is restricted to that which would be protected by patents or trademarks. This is not true, oftentimes the trade secret is a process (WD-40) or magic ingredient (Coke’s formula) which are closely held, but never registered. While, intellectual property theft occurs on a global basis, those protecting intellectual property should be thinking locally, then globally and protecting their infrastructure from unnecessary or unfettered third-party access. Intellectual property theft is an FBI criminal priority.
While we emphasize cyber security during NCSAM, let’s collectively put in place, reminders on the need to maintain awareness in a dynamic manner. Cybersecurity is not once and done, it is ongoing and ever-present.
