November 29^th, 2022, South Dakota Governor Kristi Noem banned TikTok on state devices for government officials and contractors. Other states have followed suit with over 28 having a complete or partial ban on the application on any state owned, operated, or managed device.  School districts from K-12 around the country are doing the same, as well as some universities and colleges.  The Chief Administrative Officer (CAO) of the House Catherine Szpindor had warned in August that the TikTok app represented a high risk to users and the Committee on House Administration authorized the CAO Office of Cybersecurity to “initiate the removal of TikTok Social Media Services from all House-managed devices”. This ban of TikTok on Federal government devices was proposed by the Trump administration originally, though never enacted.

In November of 2022, Christopher Wray, the director of the FBI testified before Congress and raised concerns about the influence of the Chinese government over the TikTok application and data gathering capabilities and actions of the platform.

To be clear, the concerns of TikTok are not totally unfounded.  There are concerns about the spying capabilities of TikTok. However, these concerns are not limited to TikTok.  What we have seen over the last few years and what we should all be aware of is that the applications on our phones track us.  The applications on our computer browsers track us.  The applications in our cars track us.  These statements should come as no surprise, if you have been paying attention to the news and the terms of service and hell, even if you jus to open an application on your iPhone and are asked by the application to allow it to send data to the manufacturer.  Why does my note taking application, or my calculator need access to my contacts?  Again, if we have been paying attention we should already know that we are the product, the data units being packaged up and sold to advertisers.

In a marketing lecture I attended in December the speaker was talking about the 53,000 data points that Facebook has on each user of its platform.  These data points can be used to segment and micro target customers and hyper-customize advertising.  This discussion was not on how to protect ourselves.  This discussion was on how to use the data to sell products to customers and prospects through micro targeting.

So, if we dispense with the pearl-clutching of how our personal information is being taken up and used and sold and the concern that we all have of this, FOR THE CHILDREN,  as we tap “agree” on our Terms of Service contract wit the iPhone upgrade, without reading it, and instead peel back what is the  concern here.

What we are really talking about is Xenophobia.  The fear of the other.

Apple has created an enhanced security platform to protect end users.  Law enforcement is not happy about this development because it will limit their ability to extract data from devices to catch criminals and terrorists. There are good arguments for Law Enforcement needing access.  But there are also a bevy of privacy concerns.  For another article.

This is not that.

This is othering a product, finding a bogey man and pushing.  The Biden administration has been working with ByteDance, the parent company of TikTok, to house all US citizen’s data in the US and remove access by the Chinese government.  ByteDance a Chinese company that has to answer to the Chinese government does not want to budge.

In the meantime, making an app that a preponderance of young people use and putting it out of reach for law abiding citizens to use to communicate with their representatives creates a digital divide.  It creates a way to limit, or at the very least make it more difficult, information flow between elected officials and constituents. 

Security concerns aside (which there are many), the limiting of access to communications tools is designed to alienate a growing, vocal and engaged portion of the electorate. Look at who called for the original ban, who has been pushing the restrictions.  Who stands to benefit from a less engaged younger voting block? Finally, take note and realize that the millennial generation has already surpassed the Baby Boomers in number and as will soon be a larger voting block as the last midterm election showed.  These bans are designed in part to limit participation in democracy. This fact should concern us all.

We need to fix the data gathering, sharing and selling of personal information – on all tools and platforms.  TikTok is a politically convenient strawman. Companies operating within the US, foreign or domestic, need to abide by established laws with real enforcement mechanisms.  The problem is those rules need to be applied uniformly, for US and foreign companies alike.  Facebook, Twitter, Google, Microsoft, Apple – none want the rules to change to affect them.  If enforcement mechanisms were put in place, TikTok could be made safer or be prosecuted. 

But safety is not what this is really about.

The post TikTok or Not? Should we be concerned? appeared first on Karjaka Magazine.

Drizly has a problem. Technically, two problems. And a CEO with a problem. In 2018 Drizly had a cyber incident where instead of data being extracted from their servers, an employee of Drizly posted login information for Drizly’s servers on Github, a software coding repository that stores all kinds of information about free and open-source software and software snippets. This login to the Drizly servers was used to install crypto mining software, allowing individuals to mine crypto currency without having to pay for server usage or power and cooling. Access to the servers also exposed customer data, though no data appears to have been affected.

The FTC warned Drizly and the CEO, John Cory Rellas regarding the potential exposure of customer information and Drizly and the CEO publicly claimed to have put generally accepted security steps in place to limit exposure.

In 2020 a hacker gained access to the Drizly systems through an improperly secured employee account and took 2.5 million customer records from the customer database.  The information that was stolen included email and postal addresses, phone numbers, and data purchased from third parties (to enhance customer profile and targeting/marketing activities).

Through an investigation it was determined that although Drizly and John Cory Rellas made statements that adequate security protocols were put in place, any steps taken were lacking and should have been known to be lacking based on past incidents on Github.[i]

The enforcement actions the FTC is proposing against Drizly and Rellas are designed to address the problems found in the FTC’s complaint.[ii]  These steps include:

• Destroy an unnecessary data – including data collected or complied not required to service the customers and clearly state that the data collection and retention policy is on the Drizly website.
• Curtail data collection in the future – Drizly should only collect and store data going forward that is required to service the customer.
• Implement an information security program – Drizly needs to implement an security program that is comprehensive, including security training of employees, data segregation, implement controls and reviews, amongst other measures.

What should be explicitly noted is that John Cory Rellas, who was responsible for data security practices as CEO, as additional requirements going forward. The FTC proposed that Rellas will be required to implement a similar information security program at any future company that he moves to if the business collects consumer data from more than 25,000 individuals.

Drizly was acquired by Uber in October 2021, but the proposed actions apply to the company as a subsidiary of Uber. 

What is unusual is that the FTC has specifically named the Drizly CEO and explicitly stated that he failed to implement security best practices, delegate information security responsibilities or hire an executive to implement an information security program.

The question some have asked is, the FTC does not normally specifically call out the CEOs, so why now, why in this case?

The FTC has a rule that is scheduled to go into effect as of December 9, 2022, called the FTC Safeguard Rule which is based off of the Gramm-Leach-Bliley Act. The short explanation is that any financial institution – and financial institution is now broadly defined as any company that offers consumers financial products or services like loans, financial or investment advice or insurance – to provide information on the information sharing of customer data and methods used to safeguard their sensitive data.

The rule requires that all companies must have a detailed information security program that is written and updated and “appropriate to the size and complexity of your business, the nature and scope of your activities, and the sensitivity of the information at issue”[iii].  The top objectives include:

• Security and confidentiality of customer information
• Protect information against anticipated threats to the security and integer of the data
• Protect against unauthorized access to the data that might harm or inconvenience any customer

The FTC is saying that because data breaches and losses are occurring more frequently, C-suite officers of companies should be aware of the potential risks that their companies face.

The FTC can implement consent decrees and recommend enforcement actions but they cannot enforce penalties at this time.  There is a push for changes in Congress to better protect customer data.

As small business owners, we must be aware of what are is being done to secure customer data.

Many people recall the changes that came after the collapse of Enron and Arthur Andersen, resulting the Sarbanes-Oxley Act and the confusion and turmoil in small and large businesses alike to determine who needed to implement what controls. 

Small business will be required to implement some, if not all, of the FTC Safeguard Rule in the coming months as cybersecurity and data loss become larger problems.

Watch this space for more information about how these changes affect small businesses.

_{Security Evangelist Howard Globus has more than twenty years of experience designing, installing and supporting Windows server and workstation products in industries where security and reliability are critical. System engineering and administration experience includes customized Windows Server and Workstation installs, designed to be deployed using the latest automated technology available and managed using products found onsite at most Fortune 500 firms to ensure a wide variety of potential personnel to support the products in the future}.

_{[i] https://www.ftc.gov/system/files/ftc_gov/pdf/202-3185-Drizly-Complaint.pdf}

_{[ii] https://www.ftc.gov/system/files/ftc_gov/pdf/202-3185-Drizly-Decision-and-Order.pdf}

_{[iii] https://www.ftc.gov/business-guidance/resources/ftc-safeguards-rule-what-your-business-needs-know}

The post What do the Boston-based alcohol delivery service Drizly, The FTC Safeguard Rule and C-suite liability have to do with each other? appeared first on Karjaka Magazine.

It’s getting on to that time of year again … Oktoberfest!

 “Why is it called Oktoberfest when the majority of the event occurs in September?”

That, my friends, is because of marketing.

Oktoberfest began in 1810 and, without going into the history of the festival, the short answer is that the festival ends the on the first Sunday in October (unless it runs into Monday or Tuesday… never mind that now) and, to maximize the fun and profit, the start got pushed back into the middle of September.

This year, in 2022, after the pent-up demand post Covid, Oktoberfest in Munich, and around the world, looks to be a really raucous time. Officially, Oktoberfest began on Saturday, September 17^h . While enjoying a stein or two of Oktoberfest Hofbraü, the days troubles start to melt away.

Then it happens, while “Prost”-ing with your fellow revelers, your cell phone lands in the beer.

Not to worry, though, you have the phone backed up, right? RIGHT?

Wurst (sorry, couldn’t help it) case, there’s gotta be a bag of rice around here somewhere!

You’re probably not going to find a bag of rice big enough to save you when your phone gets fully submerged in a stein of beer or slips out of your pocket while boating or you land in the pool with it in your pocket. That piece of technology probably won’t ever be the same.

What about the data that’s on the phone, though?  Can that be recovered? Depends on if it’s being backed up to the cloud manually or automatically and when the last time a full synch was done.

Backups of all systems are critical to keeping business and personal data safe and sometimes to keeping your company up and running. Making sure that you can recover important client information and operational information for your business, keeping it safe from being ransomed or stolen by hackers, protected from malware, former employees and even competitors can mean the difference of staying in business and going under. 

Sometimes, we even must protect the data from ourselves and our own actions.

Any device that has company data on it should be covered with a policy for usage, data ownership and data retention. There should be policies for when company data is on a device (laptop, tablet or cell phone) that is company owned or if a Bring Your Own Device that has company data on it.

The policies should cover topics including:

• Acceptable use (types of websites)
• Company data ownership statement
• Process to return of company property and/or data when leaving company
• Required maintenance tasks and availability to keep the devices secure
• Mandatory backup of data on the devices

Tools exist to manage laptops, tablets, and cell phones, even for small and medium-sized businesses. The tools can mitigate disaster by forcing backups and maintenance tasks to keep company data and devices safe from attacks and human error.

IT On Demand supplies our customers with templates to start building a policy library and the tools to protect and maintain the equipment that is used regularly to do business in an ever-more connected world.

The time to have these policies and processes in place is before a catastrophic event occurs.

Dropping a cell phone into a stein of beer is bad. Bad for the beer, bad for the phone.  It’s unlikely you’re going to find rice in that beer garden or beer tent, by the way. Don’t make it wurst (I know, again) by not having the tools in place to have the data backed up and recoverable.

While drinking and eating through this Oktoberfest season, make sure you keep your company data protected. It can even save the photos you’ve taken of the boss in lederhosen to post up on the company intranet.

                                    PROST!

_{Security Evangelist Howard Globus has more than twenty years of experience designing, installing and supporting Windows server and workstation products in industries where security and reliability are critical. System engineering and administration experience includes customized Windows Server and Workstation installs, designed to be deployed using the latest automated technology available and managed using products found onsite at most Fortune 500 firms to ensure a wide variety of potential personnel to support the products in the future}.

The post Wurst Case Scenario with IT on Demand appeared first on Karjaka Magazine.

In the 2007 movie “There Will Be Blood” Daniel Day-Lewis plays Daniel Plainview and Paul Dano played two roles, Paul and Eli Sunday, twins.  

If you’ve seen the movie, you can skip this next bit.  Daniel is an oil prospector and is brought to the Sunday property by Paul.  Paul’s twin brother Eli suspects that Daniel wants to purchase their land for the oil beneath the ground.  Through the years of the movie, Daniel buys all the land around the area except one hold out.  Eli returns to the area to sell the last hold out plot of land, hoping to make some money after having lost everything.

At this point, Eli comes begging to sell the land to Daniel.  Eli had humiliated Daniel earlier in the film and Daniel takes this as his opportunity to return the favor.  Daniel harangues and bullies Eli, forcing him to renounce his faith, which Eli does thinking he will finally sell this land.  

Here Daniel delights in telling Eli that he doesn’t want to buy the land, that he has no need for it.  Daniel explains that the land it has been drained because of all the drilling and pumping of oil on the surrounding plots.  

Daniel explains that it’s as if he has a long straw and from across the room puts his straw into Eli’s milkshake.  Without Eli knowing about it or having any way of stopping him, Daniel drinks his milkshake.

And this is like cybercrime.

Movies and books have painted a picture that cybercrime is done in the wee hours of the morning, lots of screens scrolling with Matrix-like characters in patterns few can understand. Or Tom Cruise descending from the ceiling into a server room with pressure-sensitive floors that will set off an alarm.

In fact, most cybercrime is a lot more mundane.  

Most small and medium businesses leave their networks open on the Internet.  They rely on their Internet Service Providers to provide “A-Level” security to stop threat actors.  In reality, when an Internet Service Provider puts in a modem or router and a business connects a consumer-grade network switch to it, this is like putting a screen door on a submarine.  There is almost nothing to stop a cyber attack with this kind of setup.

Likewise, when people are hired at a small business and receive an orientation (if they receive and orientation), rarely does it include things like acceptable user policies related to computer systems and sharing of data on the Internet, use and storage of network credentials like email addresses and passwords and proper password rotation on Internet websites.

The computers on an open network and untrained employees are the weakest links in the security chain in most small and medium businesses.  

Information can be sucked up, like through a long straw, without having to run elaborate infiltration operations.

It’s important to have properly secured systems, a network perimeter that allows employees to get their job done while also being safe and secure and regularly training employees on how to spot phishing emails and malware on their machines.

Putting the proper controls in place to keep the bad guys out of our systems are important.  Regularly testing the perimeter defenses and updating them as necessary are all part of a good maintenance plan.

However, if we can only focus on one thing to do to keep ourselves safer in our online world, focus on regular education.  5–15-minute videos and trainings once a month go a long way to educating ourselves, our family members and our staff on how to spot Phishing scams and targeted email attacks.

These proactive measures can stop the drainage of information that we want to keep protected.

Like through a long, cyber straw, cybercriminals love to say …

“I DRINK YOUR MILKSHAKE! I drink it up!” – HG

The post “DRAINAGE!” appeared first on Karjaka Magazine.

There has been a good of talk about Passkeys and how this tool will replace passwords in the Apple environment.

What are Passkeys and how will they be used?

The FIDO Alliance was launched in 2013 by PayPal, Lenovo, Nok Nok Labs, Validity Sensors, Infineon, and Agnitio came together to work on a passwordless authentication protocol.  Today there are hundreds of members of the alliance from large multi-national businesses such as Amazon and Facebook, Wells Fargo and American Express.  Governments from Australia to Germany to the UK to the US are all participating as well. 

Microsoft, Google and Apple have a vested interest in using FIDO considering the online services and devices being used.  Credential compromise is a major concern for online platforms and with mail and documents and businesses running their operations through these three services, there are major points of exposure.

Passwords are the source of over 80% of data breaches.  With hundreds of millions of online accounts active today and over 50% of passwords being resused, a new way to secure business, personal and private data was needed.  The FIDO Alliance came together to address passwordless tools and multi factor authentication.

FIDO has brought tools like security keys, facial recognition, fingerprints, voice and Yubico keys into the marketplace.

Apple announced in early June 2022 that they were going to be moving to use Passkeys, which were announced by Google and Microsoft at their major developer conferences around the same time. 

The idea behind a Passkey is that instead of using a password, users will unlock their smart phones and provide a verification of a code to sign on to a website or online services. With a physical device (the cell phone) and a biometric unlocking mechanism to the device and matching a unique signature key on each application or website, security will be greatly increased. 

This concept what developed several years prior.  However, one of the greatest issues with the protocol was what happens if the cell phone is lost, misplaced, stolen or compromised. If the security was tied to the cell phone and it was gone, then all access to sites and applications would be lost with no way to recover the access.

The FIDO Alliance released an update in March where credentials will be stored using a public and private key pair.  The details on how this works are little bit more technical than we want to go into right now. The important point is that in the event a device needs to be replaced, by enrolling the new device onto Apple, Google or Microsoft’s systems, the Passkey information will be transferred to the new device. This resolves a major issue with the technology.

It is important to note that if not using a biometric lock and instead using a digital code to lock the cell phone, the code needs to be strong as well. If the code is easy to crack it will be easy to access that device and the Passkeys will be available.

Throughout the cybersecurity industry the advance put forth by the FIDO Alliance is seen as a very positive step forward in solving a major problem plaguing businesses large and small and individuals in an ever more connected world.

Research shows that far too many passwords are still reused on multiple websites and over 70% of credentials are believed to be compromised from all the breaches known to date. Every step that brings us closer to a more secure environment is a welcome one. 

There are two challenges that we need to be aware of.  The first is end user adoption, having users enroll their credentials, their devices and then using their credentials and devices on the platforms that support the service.  The second issue is websites will need to update and recode their authentication process to meet the FIDO Alliance standard. Considering the number of websites with a login component, this is not expected to happen overnight.

Stay tuned for more information on how to make use of the Passkeys.

The post Password Protocol appeared first on Karjaka Magazine.

On the 21st of March 2022, the White House released a statement and factsheet entitled “Act Now to Protect Against Potential Cyber Attacks”.  The significance of the statement, the factsheet, specific actions to take and speaking about the threat by the President of the United States needs to be put into historical perspective.

Cyber Crime and Cyber Security have been topics of conversation in discussions and press conferences before.  There has never been a time when a President of the United States took to a podium to specifically speak about this one issue.

Of course, the Russian invasion of Ukraine and the resulting political climate in Europe and domestically within the US are the backdrop and the reason for the actions taken by Cybersecurity and Infrastructure Security Agency (CISA) and the White House.

Earlier in February, CISA, a federal agency tasked with monitoring and alerting on cyber threats to critical infrastructure within the US issued a warning entitled “Shields Up”.  CISA is a relatively recently formed agency, coming online November 16, 2018.  The “Shields Up” warning was the first of its kind issued by the agency, but given the time the agency has been in existence, this might not have been seen as unusual. 

The reason that the warning struck a chord with many in the IT and Infrastructure Security world was that the concern about cyberattacks was as a direct result of Russia’s invasion of Ukraine.  When Russia moved on the Crimea region in 2014 Russia took action against online infrastructure in Ukraine.  Areas like water flow, power and gas were all crippled by the cyberattacks that Russia launched as part of its military action in Crimea.  

In 2022 Russia announced that countries or organizations like NATO that assisted Ukraine or were providing material support to Ukraine would be considered enemies of Russia and would face retribution for their interference.  

Between past performance and current threats, there was a real concern at the start of the war that Russia was going to hit many countries that were helping Ukraine.  

This sets the stage for the general concern when the original “Shields Up” warning was issued.

However, significant attack from Russia never came in the cyberspace.

Professionals and pundits have been speculating that Russia may be a paper tiger rather than a true near-peer when it comes to military might.  But why hasn’t Russia attacked in cyberspace?  

Over the last couple of weeks there have been reports of threats that have been stopped and attacks that have been defeated by Ukraine in the cyberspace.  In part this is a result of Ukraine having built up it’s defenses over the last 8 years.  In part the IT community of hackers and intelligence personnel have been actively working to counter attacks in the cyberspace to show solidarity and support for Ukraine during the Russian attacks.

The White House, however, took the unusual step of making an announcement with steps that businesses should take to keep themselves safe.  What changed?

Russia’s lack of quick success during its invasion, their huge personnel and material losses against what has been billed as a ragtag force, and the subsequent retreats to harden lines far removed from the originally stated goal of taking the capital Kiev have all been humiliating.  This humiliation is to Russia in general and President Putin in particular.

To save face and exert some wins in the varied battle spaces, security professionals believe that Russia will begin with a big push on cyberattacks.

On Wednesday, April 13th CISA released critical warning notices to Industrial Control Systems (systems that control things like water, chemical, natural gas and power systems nationally and locally) that there are nation state actors that have developed tools and have specifically targeted these systems.  CISA recommended immediate actions to take to secure critical systems in the US.

There are further concerns that even when we have cyber insurance policies, we may not be paid out.  Why?  At the beginning of December 2021, Lloyds of London notified insurance companies that they underwrite for that they may not pay for cyber claims when Nation-State actors are shown to be the source of ransomware and cyberattacks.  Lloyds underwriters 20% of the cyber insurance policies globally.  That means 1 in 5 polices that are held may not pay out if an attack is shown to be initiated by a Nation-State.

Given the criticality of the systems we are talking about and the potential affect on how and if business and regular daily life continues with minimal interruptions, it is in the best interest of the United States government to suggest, strongly, that businesses take a proactive approach to securing their businesses.  Insist too strongly and panic may ensue.  Do nothing and vital systems may be compromised.

So, what can we do to protect ourselves as small business
owners?

– Use multi-factor authentication on any and all online systems that are used for personal or business functions.  This will make it more difficult for an unauthorized user to gain access to your accounts and services.

– Put in place risk mitigation tools such as antivirus and extended threat detection systems.  An AV program that is updates regularly to meet the continuously changing and evolving threats is critical and checking on it regularly is a must.

– Work with your staff and family members to train on how to spot suspicious emails and links and be careful where you choose to enter your login data.

– Work with your cybersecurity professionals to patch all your systems (computers, laptops, tablets, phones) with the latest tested updates to mitigate problems.

– Backup your data and ensure it is separated from live data to lessen the likelihood of losing it to encryption.

– Have disaster recovery plans in place for your personal and business life.  If key data is compromised or lost, have a plan on how to restore it or work around to retrieve it from other locations/sources.

– Use complex password and a trusted password management tool to ensure that all your passwords are stored safely, are complex, and unique.

Security Evangelist Howard Globus has more than twenty years of experience designing, installing and supporting Windows server and workstation products in industries where security and reliability are critical. System engineering and administration experience includes customized Windows Server and Workstation installs, designed to be deployed using the latest automated technology available and managed using products found onsite at most Fortune 500 firms to ensure a wide variety of potential personnel to support the products in the future.

The post Act Now or Pay Later appeared first on Karjaka Magazine.

“The Cloud” is a term that is designed to cause person to nod their head, as if to say “Ah, Bach” and glance knowing at the speaker. It’s a catch all term that holds vast meaning for some and simple bewilderment of others.  Like NFTs or Blockchain.  Or tipping at Christmas time.

The simplest way to think of The Cloud is as “Someone Else’s Servers”. As a everyman or everywoman, all servers may be “Someone Else’s Servers” to you. But here is what I mean.  The Cloud are servers that you, or your company, doesn’t own and haven’t invested money upfront to purchase.

In the olden days, like twenty or thirty years ago, when computing power was required to process large amounts of data or run an application or host a website, you or someone in your company had to purchase the iron and silica (the metal and chip) to run the processes.  The server or servers may have been set up under someone’s desk, or in a back closet or room or even offsite in a data center where there were rows and rows of other servers with dedicated power and cooling. The important bit was that you owned the hardware.  That was a capital expenditure, a CapEx cost that would require money be invested in the hardware and then personnel costs for the care and feeding of the hardware, specialists who knew what they were doing ot keep the operating systems up and running and updated and backed up and deal with any nasty business that might have come from a hacker or errant code.

When the internet took off, services started to be offered online by the industries that move our lives. Things like online banking, credit card servicing, online shopping, auctions, entertainment, early social media, dating and pornography were served up to any who could get online.  These services were hosted on those servers in offices and data centers and owned by the companies providing the services.

Then about fifteen years ago there as a shift.  Rather than purchasing the hardware and running the servers and the power and cooling themselves, large companies and small companies and even individuals started to use distributed computing “In The Cloud”.  These were servers or portions of servers that were hosted in Amazon data centers and other independent providers data centers where there was no requirement for a large CapEx, initial investment in the hardware.  There was no need to maintain or manage the servers, the power, the cooling or the storage of these Cloud instances.  Services could be brought online or taken offline without a large investment of money and no need to amortize the costs over years to reap the maximum tax benefits of a large infrastructure investment.

Today, using Cloud based services such as Amazon Web Services (AWS) or Microsoft’s Azure Platform or Google Cloud a developer or designer can bring up a complex set of services to manage end user websites, backend databases, security services and advanced mathematical formulas to run analysis or planning. An idea can go from thought to Minimum Viable Product – a product that can actually do something without a whole lot of bells and whistles but more than a proof of concept – in a matter of days or weeks.  These services are designed to fit pieces together like Legos or building blocks to create great towering structures.

So why should we care? It’s easier to bring ideas and products to market – that’s good, right?  It’s cheaper to bring things online – so that’s good, right?

There are three areas that we as end users should be aware of as more services move to Cloud Services.  The first is security.  Where is the data stored, is it stored properly, is it backed up (if you’re running your business on it) and who is responsible for the day-to-day tasks, the care and feeding that used ot be done by in house, hired professionals.  It is easy to think that because the services are running in The Cloud and ’t’s not my server, I’m not responsible for it.  Every Cloud provider has terms of service that you need to be aware of and recognize what is the provider’s responsibility, what is shared responsibility and what is ultimately your responsibility.  Most Cloud providers do not take responsibility for the data on the servers, so it is up to you to secure it and back it up.

Second, with a widening gap of systems and services moving to the cloud and fewer in house specialty personnel to manage the systems, there is a skills gap that can affect a company’s ability to maintain full functionality.  As noted, the day-to-day tasks can quickly be overlooked and that may lead to data loss or worse.

Finally, there is a real ecological impact to Cloud based services.  These services are offered by companies that build vast data centers that require enormous amounts of cooling and power and can have a negative impact on the surrounding communities. In the age of social responsibility or the desire to have companies show social responsibility, this needs to be taken into account.

Cloud services are here, and the decentralization of the data center means that more services will be moving to the Cloud.  It’s important to keep in mind, all of these will still run on a server, just someone else’s server.  It’s your data and ultimately still your responsibility. 

The post What Is The Cloud And Why Do I Care? appeared first on Karjaka Magazine.

Now that the holidays are over, we don’t have to worry about any more Amazon scams, right?

Oh how I wish that were true.

Now we’re back to regular-old types of scams, no longer going based on the holidays.

One of the more concerning scams making the rounds right now was first seen about 18 months ago.  It’s resurfaced several times during the Covid pandemic and most recently, the FBI put out a bulletin alerting people about the latest iteration of the scam.  (link to bulletin at the end of the article)

Here is the scenario. A package arrives via USPS or delivery service and inside the box is a $500 Amazon gift card, a USB stick and a note that says something to the effect of, “We’re grateful for you being a loyal customer. We want to send you this $500 gift card, this USB stick contains a list of goods that you can choose from.”

Because this is a column about another scam, it should come as no surprise to you that the USB stick contains something other than a list of fabulous prizes.  The USB stick is a Trojan horse. It is known as a “BadUSB” or “Bad Beetle USB” and if it is plugged into a computer, a series of programs will run that injects a set of keystrokes to download and execute several types of malware.

The malware may contain a keystroke logger where the websites you visit and the IDs and password you use to login will be logged and sent back to the Bad Actor. This is commonly used in Financial Services or banking and credit card attacks. There may also be data extraction and data encryption malware to hold your information ransom and move it off of your computer or your network to be sold on the dark web, usually both will happen at the same time.

These USB sticks are for sale on hacker sites and commonly have “LILYGO” printed or embossed on the stick itself.  However, that is not the only type of USB stick used, so avoid plugging in a USB stick from an unknown party.

As a general rule, we limit the ability of USB sticks to be able to run any software (or even be used) in our managed customer’s environments because it is such an easy and common way of delivering malware and compromising computer systems and entire networks.

Additionally, if you receive a gift of a USB stick from a friend or vendor and there is a note that states you need to use this specific gift card only on the items that are listed on this USB stick, be very suspicious.  Companies that provide gifts to their customers where the customer can choose what they would like to receive tend to do this via an online store. A customer would most likely be sent to a website to choose a gift. If you are given an Amazon gift card, you are usually able to purchase anything you’d like from Amazon, that is the point of a gift card.

The coupling of a gift card that can only be used to get things that are listed on a USB stick should be highly suspect.

Finally, if you get a gift, it’s always nice to say thank you. Contact the company that sent it to you and confirm that this is a real gift, from them, that has been sent.

If you do receive this type of package in the mail or via other delivery service, retain all the contents and packaging with any mailing or markings with delivery information or tracking information and return address information. If you have your IT security professional analyze the USB stick, retain any forensic findings or report or additional information that is derived from that investigation.  And if the device is plugged into a computer, it is best to retain the machine, intact and powered down to that a full memory capture of whatever was on that computer can be made. You will need a full forensic image of the victim computer before any remediation is done, especially if an cyber insurance claim is filed and a report is made with the federal authorities.

There are tools that IT security professionals use to analyze what type of information is being sent off network or has been encrypted and log files of actions taken. 

In the link below is the FBI alert which has some recommended remediation steps and information that is requested if they are contacted. Please keep in mind, it is a complex process to remediate these types of attacks.

I recommend if you or someone in your household or office has inserted one of these USB sticks into their machines and remediation is necessary, engage with an IT security professional.

Oh, and in case you were wondering, perhaps the worst part of all, the $500 Amazon gift card is just a printed piece of plastic with no dollar value associated with it.

Again, please do not plug the USB stick into the computer. And if you do contact us right away and we’ll try and assist.

The post New Year/Same Scams: Beware Greeks Bearing USB Sticks appeared first on Karjaka Magazine.

No & Yes.

All scams rely on victims being greedy or being confused.  Addressing the latter, during the holidays we are generally frazzled.  During a normal holiday season there are gifts to buy, exchanges, returns and more things to purchase, travel to plan, relatives to prepare to receive and a rush to use vacation time or flexible health care dollars, and all the preparation for end of year and a closing out of the books, figuratively and literally. We have not had a normal holiday season in almost two years now.

With the pandemic being off and then on and then back off and on again, a rush to get out and see relatives before the next iteration of variant or lockdown or need for another booster, we’re all running around like crazy.

What kinds of things should we expect to see, scam-wise, this season? Here is a short list of the scams that I’ve had reported to me since the Halloween candy was still fresh:

–  Emails requesting sensitive information to verify a purchase (Phishing scams)

–  Emails and texts from “tech support” that your purchase/package is delayed, or a problem occurred (Phishing and SMSishing – SMS-Phishing)

–  Amazon purchase made was sent to the “wrong” address (Phone call and Phishing)

–  Gift card “problem” requiring verification (Phone, Phishing and SMSishing)

– Search Engine redirection based on misspelling to purchase knock-off product

– Request for donations to charities with skim or all funds stolen

The scams that we have been seeing rely on us trying to do many different tasks simultaneously or without focusing our full attention on where we are and what we are seeing.

An email that comes in requesting some kind of sensitive information might be ignored while not around the holidays.  However, if the request is
ambiguous enough and preys on the fear of failing to provide for our
children or loved ones during the holiday, we may be more likely to respond with a piece of information that we would not normally.

Similarly if we are concerned about a gift delay or a problem that can be averted through clicking on a link that was conveniently sent via email or a text message, by all means we may just circumvent having to root through our emails or saved receipts to double check before confirming delivery with a home address and a portion of our credit card.

A charities website that looks right or a web page for a hard to find gift that has a few in stock can make us eager to enter our credit card information and billing address quickly to secure the transaction.

The question, then, is how do we protect ourselves?

The answer during the holidays is not much different than any other time of year. 

If an email, text or website looks too good to be true, it probably is.

If you are expecting a FedEx package and a text comes in asking you to go to this website to enter data that seems unrelated to the delivery, probably best not to enter that information.

If a website redirects you (opens several links in a row to get to the page that you are finally on) when you click on a link in an email or text, it may not be the online retailer or delivery service that you are expecting to login to with your ID and password.

My advice during the holidays remains similar to my advice during the rest of the year.  Be aware of your surroundings.  As you would think twice about wandering down a dark back alley in a foreign town late at night, know where you are before you enter any sensitive information on a website or answer questions from a caller looking to help you out.

–  When shopping online, go to the retailer’s main page from the address bar or a saved, known good link in your bookmarks. You can always key in a coupon code to get the extra percentage off that is promised in the promo email.

–  If you didn’t make a large appliance purchase on an online retailer it is unlikely that they would be calling you to discuss a missed delivery. It is even more unlikely that they would require your credit card information to verify the purchase before they can speak with you about the incident.  If that kind of urgency is real, hang up, go to the retailer’s website (see previous point) and contact customer service from their portal directly.

–  Donations can be made to charities of your choosing online.  Go to the charities’ main website and navigate from there to donate generously.

A good rule of thumb is slow down, take a moment or two and confirm that you are on the site you intended to be on before entering any sensitive information.

Have a happy, healthy and safe holiday. 

The post Holiday Scams appeared first on Karjaka Magazine.

There are many different kinds of hard drives available.  From old-style platter hard drives to Solid State Drives (SSD) to USB/thumb drives.  The different kinds of drives that would be used depend on several factors:

• How will the drives be used (internal, external, portable)?
• What media will the drives be storing?
• Is speed to read/write an issue?
• Is cost a limiting factor?
• Are you looking for dispensability or longevity?

How the hard drive will be used helps to guide the decision on what type of drive to choose. 

What’s the difference between the old-style hard drive and new SSDs?  Old hard drives have round disks mounted on a spindle that is spun using a motor.  The disks are covered with magnetic filaments and a little articulating arm with a needle at the end of it hovers just above the surface of the disk.  As the disk spins, the arm moves the needle over sections (or sectors) of the disk and information is either read or written through this needle and arm.  When the disk becomes slightly unbalanced and spins in a way that the needle makes contact with the surface, ripping up some of the magnetic field, this is what was termed a hard drive crash, the arm crashed into the platter and made the data unusable.

These hard drives are very stable, but they use a lot of power and generate heat and are bulky to house the moving parts. 

A Solid-State Drive (SSD) does not have any moving parts and therefore uses less power. The read and write times are also much better, sometimes 2, 3 or 10 times that of a traditional mechanical hard drive. 

So why don’t all drives move to SSD format?  They are more expensive to manufacture, and the longevity of the devices has not been proven past a few years.  Data stored on old style hard drives has been retrieved 30 and 40 years on, but the longevity of the SSDs is not expected to be more than half that time right now. 

Based on the how the data storage is being used will determine drive the decision about speed to read and write versus data preservation all while considering cost to store a Gigabyte of data. 

How to properly dispose of the hard drive is another consideration. 

When looking at the life of a hard drive, how to dispose it responsibility should be taken into consideration as well.  None of the drives are pieces of equipment that should just be thrown into a landfill.

As with most computer parts all hard contain some heavy and precious metals.  There is a value to reclaiming the materials and care of disposing of them. 

A consideration when recycling or disposing of old hard drives, computer equipment or cell phones is the sensitivity of the information that has been stored on the equipment.  Most operating systems have internal tools to erase or remove data from the systems.  However, there are whole industries dedicated to retrieving data from hard drives and equipment like cell phones where data that was deleted accidentally or specifically to remove sensitive information prior to disposal. 

Therefore, I believe still to this day that the best way to ensure that information is irretrievable from the device is to physically mar or destroy the device using a drill press or crushing device to damage the disk or chip on the drive.  Not everyone has access to a multi-tone pneumatic crushing tool or an industrial drill press.  Most of us do have ready access to a corded or cordless drill with a metal-to-metal drill bit.  Obviously, safety precautions should be taken, such as using protective eye and ear wear, using a clamp to hold the hard drive in place and gloves should be worn when preforming these types of tasks. 

Once the drive is physically damaged beyond use, there are still services that can recycle the materials equipment.  Earth 911 (link) offers a search tool to find local resources on where to recycle/ecycle many different types of computer equipment and materials. 

When considering the type of hard drive to use, take into consideration your budget, the way the device will be used – internally or externally on a machine and for high speed video and audio editing or slower tasks such as email and web browsing – and the longevity of the data storage you need.  Based on these factors and the portability as well as connection

The post Solid State of Mind with Tech Evangelist Howard Globus appeared first on Karjaka Magazine.