At Secure Thinking, we are being asked more and more about how busy professionals can protect the business critical and often sensitive information they carry around on laptop and netbook computers.
The simple solution to this problem is to encrypt the laptop disk drive so that only the owner of the computer can access the data.
Most computers have a password which is used to prevent access to the software, applications and data in a casual fashion. Passwords, and particularly strong passwords* are a vital component in preventing unauthorised access to information and applications. However, they only protect systems that remain in the physical possession of the owner.
Once physical possession is compromised, as in the case of a lost or stolen computer, then there are ways of bypassing the logical access controls imposed by usernames and passwords. Such bypass techniques can be as simple as using a brute-force password cracking tool or just simply removing the hard disk drive from the machine and plugging it in to another computer.
This can be a particular problem in the case of mobile computers, where the opportunity for loss or theft is far greater than machines protected by a secure physical environment.
Encryption of the hard drive can protect against the dangers highlighted above. It means that, in effect, if the computer is lost or stolen, the data cannot be accessed by the new owner without the password or pass phrase used to perform the encryption. In addition, where whole disk encryption is utilised, the system cannot even be started unless it is completely reinstalled - overwriting any data on the disk drive.
So if you want to protect your mobile computers, or even your office based ones should you feel the need, then contact Secure Thinking and we will be more than happy to go through your requirements and help you decide on the best solution for your business.
* Strong Passwords should be at least 12 characters long and consist of upper- and lower-case letters, numbers and special characters such as !'#@"£$ etc. They should not be made up of dates, names or dictionary words - even obscure ones!
Articles
Showing posts with label Security. Show all posts
Showing posts with label Security. Show all posts
Friday, 18 February 2011
Thursday, 12 August 2010
Meet Tim - A Social Engineering Story
There's a new guy working in your office. You haven't seen him around before and he keeps switching desks, using those of people who are out of the office, or work different shifts.
He has a nice smile and seems really friendly. You guess he works in IT because he always has a laptop and fiddles with peoples desktop PCs quite a bit, but you haven't spoken to him directly yet.
As time goes by you work out he's a bit of a charmer. He has a way with people, makes them feel comfortable with him around and some of the ladies in the office have taken quite a shine to him. He's witty, amusing and likes to bring in buscuits or doughnuts for everyone.
Eventually you find out his name is Tim and he is something to do with IT – you were right! You pluck up the courage to chat to him, and he tells you about his family, his wife and kids, his favourite sport and the team he supports. You get chatting about common interests, he's a really nice bloke and can talk well about almost any topic – not your typical IT geek then, phew!
The following Monday you see no sign of Tim, but you think nothing of it. He's probably off today or working at your other site.
By Wednesday, you have realised he must be off on holiday – you hope he's not ill or anything, especially that lovely wife of his.
The next Monday morning arrives and still no Tim. You don't worry too much because your PC is playing up and you can't log in to the network.
After logging a call with the Helpdesk, you notice that there seems to be a lot of senior managers and directors in various meetings, all looking very serious. Oh god, not more redundancies. So you knuckle down and look busy – as much as you can without your computer, putting the lack of Tim to the back of your mind.
When you turn up on Tuesday morning you see that everyone is being taken into a room with some gentlement in suits – you were right, it is more redundancies. Your turn to go in the room comes and you enter with some trepidation.
The rather stern looking gentleman in front of you says, “My name is Detective Seargent Jim Gallows. What can you tell me about someone working here recently called Tim....”
And that's when you find out that Tim didn't work in IT, he didn't actually work for your company, or a supplier. In fact it's very doubtful his name was even Tim.
You also find out that your company computer systems are offline beacause they have been infected with a virus which has deleted all your corporate data, but not the police suspect, before “Tim” took copies of all your essential information – personnel records, bank account & credit card details, sensitive customer records, financial data, etc. “Tim” and whoever he worked for now knows more about your company, it's employees, suppliers and customers than your company does!
That's all because you, your colleagues and managers didn't check who “Tim” was, didn't make sure he had the permission and the authority to be where he was, doing what he was doing.
Your company has just been the victim of a social engineering scam. “Tim” had essentially conned his way into your company, planted key-loggeers on peoples PCs to collect their user Ids and passwords. He had then connected his laptop to your corporate network and hacked into various systems, using the credentials he'd collected, to steal all you vital business data. At the end of this he had uploaded his virus to the network, ensuring you didn't have access to your systems for at least a few days.
Now imagine if there was no virus, no tell-tale to let your IT people know something was wrong. Would you even know this had happened?
He has a nice smile and seems really friendly. You guess he works in IT because he always has a laptop and fiddles with peoples desktop PCs quite a bit, but you haven't spoken to him directly yet.
As time goes by you work out he's a bit of a charmer. He has a way with people, makes them feel comfortable with him around and some of the ladies in the office have taken quite a shine to him. He's witty, amusing and likes to bring in buscuits or doughnuts for everyone.
Eventually you find out his name is Tim and he is something to do with IT – you were right! You pluck up the courage to chat to him, and he tells you about his family, his wife and kids, his favourite sport and the team he supports. You get chatting about common interests, he's a really nice bloke and can talk well about almost any topic – not your typical IT geek then, phew!
The following Monday you see no sign of Tim, but you think nothing of it. He's probably off today or working at your other site.
By Wednesday, you have realised he must be off on holiday – you hope he's not ill or anything, especially that lovely wife of his.
The next Monday morning arrives and still no Tim. You don't worry too much because your PC is playing up and you can't log in to the network.
After logging a call with the Helpdesk, you notice that there seems to be a lot of senior managers and directors in various meetings, all looking very serious. Oh god, not more redundancies. So you knuckle down and look busy – as much as you can without your computer, putting the lack of Tim to the back of your mind.
When you turn up on Tuesday morning you see that everyone is being taken into a room with some gentlement in suits – you were right, it is more redundancies. Your turn to go in the room comes and you enter with some trepidation.
The rather stern looking gentleman in front of you says, “My name is Detective Seargent Jim Gallows. What can you tell me about someone working here recently called Tim....”
And that's when you find out that Tim didn't work in IT, he didn't actually work for your company, or a supplier. In fact it's very doubtful his name was even Tim.
You also find out that your company computer systems are offline beacause they have been infected with a virus which has deleted all your corporate data, but not the police suspect, before “Tim” took copies of all your essential information – personnel records, bank account & credit card details, sensitive customer records, financial data, etc. “Tim” and whoever he worked for now knows more about your company, it's employees, suppliers and customers than your company does!
That's all because you, your colleagues and managers didn't check who “Tim” was, didn't make sure he had the permission and the authority to be where he was, doing what he was doing.
Your company has just been the victim of a social engineering scam. “Tim” had essentially conned his way into your company, planted key-loggeers on peoples PCs to collect their user Ids and passwords. He had then connected his laptop to your corporate network and hacked into various systems, using the credentials he'd collected, to steal all you vital business data. At the end of this he had uploaded his virus to the network, ensuring you didn't have access to your systems for at least a few days.
Now imagine if there was no virus, no tell-tale to let your IT people know something was wrong. Would you even know this had happened?
Subscribe to:
Posts (Atom)