Simplifying the Web Site Security Issue

Web site security vulnerabilities are a common problem but few web site owners, business operators or even web designers truly understand the nature of the problem. 

I wrote some time ago about why web site security is important for everyone but it is a hard concept to communicate to people who have little or no understanding of the technology involved in hosting a web site, Internet service or e-commerce business. 

So this article is an attempt to make a non-technical comparison which can be understood by anyone. 

Imagine you own a Conference Centre (your website). This facility has lots of rooms (pages) and attracts hundreds of attendees (visitors or customers computers) every day. Some attendees will come regularly for different courses or will cover the same course over and over again. 

Other attendees may have a quick look around and decide they aren't ready to do a course just yet. But may come back later. 

Unbeknown to you, one of the training rooms has a broken lock on the fire exit (vulnerability) through which every day a hypnotist enters. 

This hypnotist is a nasty person (malware) and he quickly hypnotises (infects) everyone in the room. He tells them to gather as much information on the financial transactions of those around them as they can. Then, when they hear the keyword "download", they will divulge all the information they have gathered and forget what they have done. 

So the attendees go off about their day-to-day activities and, without realising what they're doing, quietly gather the information. 

They collect the bank statements and account details of their family and loved ones, they watch as people enter PIN numbers at the checkout and they copy down and skim credit card details. 

They also collect security codes, PIN numbers and password used for non-financial purposes because they know people reuse them frequently and they may be useful. 

Then, a few days later a phone call arrives and the keyword is mentioned. The attendee passes everything they have gathered to the hypnotist. 

Days, weeks or months pass before anyone starts noticing. First it's a card transaction declined. Then it's bailiffs calling round and before long the reason is understood - the family and friends of the attendee have been the victims of identity theft and fraud, and have lost thousands. 

Tens, hundreds or even thousands of people have been robbed of thousands or even millions of pounds. 

Eventually, the auhorities trace the cause of the problem back to the Conference Centre but there's no sign of the hypnotist. 

All that happens now is the attendees lose confidence in the Conference Centre and stop coming. Very quickly the centre goes out of business. 

And all because the owner of the conference centre didn't make sure the facility was secure. 

10 Social Networking Security Tips

Social Networking is the biggest thing to hit the internet since it began.  The sheer numbers involved are staggering.  If Facebook was a country it would be the 3rd largest in the world behind India.  It can be a massive force for good, yet it comes with inherent dangers, not least of which is to your security.

As such Secure Thinking have produced our 10 Social Networking Security Tips, to keep you safe and secure whilst chatting with your mates!

1. Don't publish too much
Don't publish too much information about yourself, your personal life, and your family online.  Things to avoid if possible are full dates of birth, mother's maiden name, 1st pet's name, 1st school, or make sure you lie to these types of things.  After all, they are all used by major institutions as "security" questions, so don't make it easy for someone to target you.

2. Assume everything is public
Always assume that everything that you post on the internet will at some point become public domain.  The rules and settings employed by the service provider now might change in the future.  Never post or say anything online that you wouldn't want your mum, your boss, future employers or future partners to find out about!  This includes "chats" with other people and "status updates", all of which have the potential to be public or become visible to others.

3. The internet never forgets
Unlike you an I, who have a habit of forgetting things on a regular basis, the internet won't forget.  That means the embarrassing photo's from your stag/hen party will still be hanging around the next time you get married!  And even if you delete images or remove content, there's a good chance it's been copied, backed-up or cached by another internet service.  This is an important fact that people tend to forget.

4. Don't "connect" with people you don't know
Don't accept "friend" or "connection" requests from just anybody unless you're aware of the risks.  Accounts of users are regularly monitored and targeted for malicious purposes with the intention of gaining something - either identity information or more often money in some way.

5. Don't trust even your "friends"
Remember, unless you can verify the identity of a user account without simply trusting they are who they claim to be don't trust them!  A genuine friend could have had their account compromised or someone may have set-up an account in their name with the intention of gathering information on you and others you know.

6. Don't announce your plans to the world
If you're going on holiday to Thailand for a fortnight, that's great, but don't tell the world and his wife when you're going, when you're returning, which hotel you're staying in and who's traveling with you!  This information is brilliant for burglars, muggers, identity thieves and anyone else who fancies free board and lodgings in you home while you're away.  Remember points 4 and 5!

7. Be wary of "apps"
"Apps" are great fun, what harm could they do, they're all provided by the site?  This isn't true.  Many "apps" are developed by individuals and companies external to the social network you're using and they often re-use code segments from other apps.  As such there's no guarantee the apps you're using are simply there for your enjoyment and aren't harvesting your data.  Now some harvesting is done for legitimate marketing and research purposes, but some of it is also done with not so innocent intentions.  As such be wary and don't download/install/add the "app" unless you really need to.

8. Avoid location based services
I know they're the new up and coming "thing", but I personally don't like the idea of having my movements tracked, even if it means I save a few quid at Starbucks.  Again, like point 6, you don't know who else has access to the information and who knows if the terms of service might change at some point in the future?

9.  Check your settings
All of the current social networking sites come with some form of privacy or security settings.  Now these might seem confusing and a bit pointless, but it's worth taking some time to go through and understand them to ensure you're protecting yourself to the best of your abilities.  If you need help then see if there's an FAQ, speak to someone who understands how they work or simply stay off the site.  Either way, make sure you have the settings at the level you feel comfortable with and that protects your data.

10.  Never post anything sensitive
The last point is almost the same as point 2, but here we're emphasising the need to avoid posting potentially sensitive personal or business information which could cause you or your company/employer harm.  This could be something as innocuous as a tweet saying "Off to meet XYZ corp now, back in an hour".  There is the potential that this could be privileged information and might allow your competitors to see who you're dealing with or who your clients are.  It could provide them with a competitive advantage or it could land you in trouble with your bosses, regulators or courts, depending on the issue at hand.


Now all of this might seem a little to paranoid for some of you, but as "they" are out to "get you" surely it's not paranoia!?

10 Client Site InfoSec Rules

If you're working on a client site, in addition to obeying their rules and policies on information security here are Secure Thinking's 10 Client Site InfoSec rules you should employ  to keep yourself and your information safe and protect the client.

1. Never leave equipment unattended
Laptops, phones, disks, memory sticks etc., should be taken with you, locked away securely or, in the case of laptops, locked to something solid with a Kensington style lock if they have to be left unattended.

2. Use encryption
Encrypt laptops, external disk drives, USB sticks to protect the data on them whilst on the move.  This will help to protect your data should you lose an item of equipment or it is deliberately targeted.

3. Operate a clear desk policy
Even if the client doesn't operate a clear desk policy, you should.  Never leave papers or other media on unattended desks.  Lock it away or carry it with you.

4. Leave sensitive information where it belongs
Don't carry sensitive information in bags, briefcases or laptop cases unless it's directly relevant to the work you're engaged in. If you do carry sensitive information, keep it in a secure bag and don't leave the bag unattended.

5. Never send unencrypted data or emails over public or client wi-fi networks
Just because your client trusts their wi-fi network doesn't mean you should.  Only send non-sensitive information over non-secure networks.

6. Never directly connect to client networks
Unless it is essential for your role never directly connect your systems to their network.  This is to protect them and you!  You don't know their network is secure and virus free and they don't know your system is.

7. Always lock your screen
When not working on your computer or laptop make sure it is locked and set a low timeout value for the automated screen lock.  This helps to prevent your system being accessed should you become distracted.

8.  Only work on that client's data
Never work on another client's data while on-site at a different client.  There are a whole host of potential legal and regulatory issues you could be opening yourself up to and you've no idea who might be interested in snooping over your shoulder.

9. Keep your equipment up-to-date and secure
I know it's a common one but you should ensure your Anti-Virus, Anti-Spyware, Operating System and other software packages that you use are patched up-to-date, you should also disable all unnecessary applications and services, and have your firewall enabled.

10. Don't use removable media
Unless it's essential to your work, don't use removable media to transfer data between your system and client systems.  If you do have to use a USB stick or other device, ensure you have auto-run functionality disabled (preferably on both systems) and ensure the device is virus scanned at both ends.  Use a brand-new device where possible and encrypt it if it's practical.

Mobile & Social Networking Apps

The subject of 3rd party "Apps" has raised its head again - this time on Google Android smart phones.

Apps on smart phones and on social networking sites are becoming ever more popular, but are the intentions of the App developers always in the best interests of the users?

A recent study of the apps on Android mobile phones has shown that the data they access and how they use it does not always tally with what the user authorises when they install the app.

This becomes even more of an issue where apps are downloaded or installed from other, shall we say less reputable sources.

There has also been occurrences of apps being developed reusing code segments created by other developers. This could lead to all kinds of unauthorised or malicious use of personal data which even the app creator doesn't know about.

So here are some simple rules to follow to enhance your security and protect your data:

• Don't use apps unless you really need to
• Only install apps from reputable sources
• Only install apps that are essential for you
• Remove apps you no-longer use
• Always read what data will be collected by an app
• If in doubt don't install it
• Don't provide an app with access to sensitive information or don't place sensitive information in a location an app has access to

Location Based Services & Security

It seems that more and more location based services are surfacing, jumping on the Social Media bandwagon.

Now, I'm not an old fuddy-duddy, and I can see how some of these services might be of use to businesses and potentially to individuals. I do however, have massive concerns over the privacy and security of these services.

Firstly, there is the physical security aspects. The information about where you are could be used to target you personally for malicious intent. This could range from mugging you as you leave a venue to burgling your home while you're out.

Then there are the issues of who has access to this information. There are various rules and laws which apply to data protection but under what jurisdiction are you accounts being managed? Who both from a staffing point of view and a company point of view has access to the information? Are your locations, movements and habits being observed, monitored and assessed for other reasons - some of these may be purely for targeted marketing but others could be for more insidious purposes?

I have been critical in the past of individuals who post on Twitter, Facebook and other social networking sites with too much detail about where they are and what they are doing. Now we have services specifically designed to post and collect this information.

The simple fact of the matter is that people will leave themselves open because there are multiple, complicated options on the security settings page - will every user truly understand them all? And how do you know all of your "friends" are the only ones viewing your information? It could be that their accounts have been compromised or that you have mistakenly added a "friend" who isn't who you think it is.

My philosophy is this - whatever you share on the internet, even just to "friends" you should consider it public domain. Don't tell anyone anything, say you are or have been anywhere, or opine about something you wouldn't want your mother, your boss or the rest of the world to know! That way, you can protect yourself, your identity and your information.

Meet Tim - A Social Engineering Story

There's a new guy working in your office. You haven't seen him around before and he keeps switching desks, using those of people who are out of the office, or work different shifts.

He has a nice smile and seems really friendly. You guess he works in IT because he always has a laptop and fiddles with peoples desktop PCs quite a bit, but you haven't spoken to him directly yet.

As time goes by you work out he's a bit of a charmer. He has a way with people, makes them feel comfortable with him around and some of the ladies in the office have taken quite a shine to him. He's witty, amusing and likes to bring in buscuits or doughnuts for everyone.

Eventually you find out his name is Tim and he is something to do with IT – you were right! You pluck up the courage to chat to him, and he tells you about his family, his wife and kids, his favourite sport and the team he supports. You get chatting about common interests, he's a really nice bloke and can talk well about almost any topic – not your typical IT geek then, phew!

The following Monday you see no sign of Tim, but you think nothing of it. He's probably off today or working at your other site.

By Wednesday, you have realised he must be off on holiday – you hope he's not ill or anything, especially that lovely wife of his.

The next Monday morning arrives and still no Tim. You don't worry too much because your PC is playing up and you can't log in to the network.

After logging a call with the Helpdesk, you notice that there seems to be a lot of senior managers and directors in various meetings, all looking very serious. Oh god, not more redundancies. So you knuckle down and look busy – as much as you can without your computer, putting the lack of Tim to the back of your mind.

When you turn up on Tuesday morning you see that everyone is being taken into a room with some gentlement in suits – you were right, it is more redundancies. Your turn to go in the room comes and you enter with some trepidation.

The rather stern looking gentleman in front of you says, “My name is Detective Seargent Jim Gallows. What can you tell me about someone working here recently called Tim....”

And that's when you find out that Tim didn't work in IT, he didn't actually work for your company, or a supplier. In fact it's very doubtful his name was even Tim.

You also find out that your company computer systems are offline beacause they have been infected with a virus which has deleted all your corporate data, but not the police suspect, before “Tim” took copies of all your essential information – personnel records, bank account & credit card details, sensitive customer records, financial data, etc. “Tim” and whoever he worked for now knows more about your company, it's employees, suppliers and customers than your company does!

That's all because you, your colleagues and managers didn't check who “Tim” was, didn't make sure he had the permission and the authority to be where he was, doing what he was doing.

Your company has just been the victim of a social engineering scam. “Tim” had essentially conned his way into your company, planted key-loggeers on peoples PCs to collect their user Ids and passwords. He had then connected his laptop to your corporate network and hacked into various systems, using the credentials he'd collected, to steal all you vital business data. At the end of this he had uploaded his virus to the network, ensuring you didn't have access to your systems for at least a few days.

Now imagine if there was no virus, no tell-tale to let your IT people know something was wrong. Would you even know this had happened?