Social Media Engineering

This week at a Big 4 Bank there was a presentation in Cyber Security. The presenter who was an ethical hacker started by saying that he would introduce himself and he rarely does that. In the spirit of that I will leave him unnamed.

Let’s call him Bob. Bob talked about his experiences in collecting 18 flags at DEFCON at Las Vegas a few years ago. This is the largest event for hackers in the world.

Just for background on DEFCON, there was an article just two days ago that talked about how DEFCON hackers were able to crack a new physical Brinks safe in 60 seconds.
These guys are seriously good……


I don’t use any Social Media

Bob started by saying this, which brought some grasps from the audience. He then went on to say that he does have a few hundred social media accounts that use aliases.

So much for the concept of Real Names, which I note is getting challenge from some countries like Germany on Facebook recently.

For the DEFCON event Bob had a challenge to penetrate this large multinational soft drink name and collect a series of information.

But first Bob, spent a few weeks setting up and doing reconnaissance. This included setting up a fake Linkedin account as IT Analyst for this organisation.

Linking In

On assuming this alias on Linkedin, Bob was able to gain access to other persons in that organisation.

He noted that a CFO, that he connected with on Linkedin also suggested that as his PC was not working could he fix this?

 

You can see, how amazingly easy it would be for a hacker to use social media engineering to gain access.


Just observe and listen

Bob was able to learn that there is a favorite pub that was near the headquarters and it was easy to just learn information from being there. One snippert that he learnt was that there was a KPMG audit that was just completed.

These small pieces of information provide Bob with the material that can enable the deception.

 

Bob, then called the Helpdesk.


Hello this is Fred, What’s your Employee Number?

Fred, how’s your day? Fred mentioned that actually it’s not that great as I’ve had an argument with my partner. Bob added after the chatter that he would be happy to be a sounding board as he had really screwed up himself over the years.

Once warmed up, Bob went on…..look I’ve been asked by Tony to followup on the KPMG Audit.

Tony used to be the Manager in this area and Bob had researched him on Facebook and noted that he had a new baby and a really cute puppy.

On mentioning the Baby and the Puppy, Bob could sense that the trust was increasing. So could you help me out with a few questions??


Collecting Flags

Bob’s goal was to collect 18 pieces of information about this organisation. This included:

- What company is used for File archives? - What days are pay day? - Is there wireless on site? -
What about the cafeteria?

The trick was that Bob, was careful to listen to Fred’s voice for any pauses and sense if there was any reluctance on the other end of the line. Bob noticed that Fred may be getting suspicious and added.

“Hey I’m going to be in town next week, can I buy you a beer at the pub?”

That was the clincher as Bob had researched the types of craft beers and in mentioning his favorites, there was a rewarming of the conversation.


A little scary

The question is what’s stopping this happening at your organisation? Does your team realise how Social Media Engineering attacks happen??

I know that most Help Desk staff tend to be younger and usually active on Social Media. Thus this formula would work in most enterprises.

Yes, you should be concerned and perhaps a mock social media engineering attack is in order. There are Bob’s out there that can help you.

http://www.cso.com.au/article/581353/social-media-engineering/

The Perfect Security Setup

David Gee (CSO Online)

For any CSO or CIO, you are charged with protecting the enterprise. That’s a significant responsibility and you know darn well that your reputation indeed your role depends on how well you can manage through the issues that will arise.

How do you with a limited budget, provide the protection that the Board and in particular the Risk Committee is expecting?
First, let me quote Salman Rushie:

"There is no such thing as perfect security, only varying levels of insecurity."
Hmmm that’s an interesting perspective, but there is truth and insight in that statement.


No such thing as Nirvana

 

I believe that indeed you can achieve good but never perfect. For most things in life this is absolutely true and IT Security is no different. How then do you work out what is going to be ‘good’ enough?

Spend alone is not a good indicator of ‘goodness’. In most IT shops we always install too many tools, that overlap in functionality and we don’t often use these products to their full intended value.

Recently in a discussion with a number of Architects I was explained that all three of these IT Security tools were mandatory and ‘must be’ in place. Of course as you start to ask questions around why and how come, you learn that actually one of these was ‘important’ and not ‘mandatory’.

The issue really isn’t about which tools to use. It is more about clarity of purpose and knowing that every action is taking you towards the required level of ‘good’.

Never declare victory

Yes, this is an endless journey and persistence is going to be an incredibly important attribute. You can never say that the work is done, but the balance will be to recognize the progress and keep a strong sense of self awareness of what is critical.

In IT Security, there will be constant shifting sand around what is the latest Malware of Advanced Persistent Threat (APT). This does take a certain mentality that combines a degree of paranoia along with a structured thinking approach to understand where to apply one’s limited bandwidth.

Never declare victory, as Murphy’s Law will always work against you. I once saw the Chief Security Officer of a Big 4 Bank declare at an external SIBOS event that his company had advanced security and ‘was in great shape’.

While I was not working for that organisation, it made me squeamish…..


Patching, Patching, Patching 

 

I’ve seen so many cases of Security 101 being totally ignored, with teams just too busy to do the simple things such as patching. In a similar vein all the usual audit chestnuts such as access control and privileged access.

Show me a company that always does the simple things right over the long term and I will award you a prize. Unfortunately human nature and staff turnover end up with less than optimum results.
Then patching becomes a major finding……..I can see you smile as I’m sure you have had this situation. There is always another priority that trumps your activity to patch that server.


Machine Learning

The answer has to be that we need advanced analytics to detect and respond to patterns of threats. In today’s world the CISO has to deal with a continuous stream of data from various internal and external sources.
 

There will be ‘too many false positives’ and the trick is to be able to filter through the ‘noise’ and get onto correcting any real vulnerabilities.
Big Data is at an infancy stage in many organisations, but this is a domain where machine learning can make a massive difference.

 
Who’s Perfect?

That exactly is part of the problem, and no one wants to admit to be either at a position of strength or weakness. There is only downside to declare this both internally or externally.

This lack of being able to measure best practice and replicate this, means that the bad guys get a free kick.

But let’s remember that actually no one is perfect and that there are only different levels of insecurity.


http://www.cso.com.au/article/582065/perfect-security-setup/

Why you should not trust your Digital Certificates

David Gee (CSO Online) on 26 August, 2015 10:25

As humans have always used a physical signature as a method to provide a verification of identity. Hence we sign contracts and in the past we used our (John Hancock) signature to access our bank accounts. If I have a signed document, then it is attributed a degree of trust.

On the internet we have adopted Digital Certificates to provide a similar level of assurance. This entails a 3rd party organisation that issues a certificate and having this provides a proof point of your identity. By this very act we have entrusted someone else to provide this verification as a service. But let's realise that these Certificate Authorities are not all the same.
Each issuing authority is different organisation, cost structures and the actual price of the certificate can have large variance. Moreover, each organisation own approach to security can also have dramatic variance. It is not surprisingly therefore that you can't really trust a Digital Certificate.


Who do you trust?

You want to use a Certificate Authority that has a good track record of securing their own systems. This means that due diligence is required to ensure that they robust security and processes. Plus that they haven’t issued improper certificates in the past.

 

We trust a Certificate and the implication of this trusted position; is the belief that it does not include any malicious code. This has resulted in the increased attractiveness for Cyber intruders to invest time to have their malicious code signed by a ‘trusted’ certificate

Once the cybercriminals have gained access to the network of software manufacturer’s, they can introduce a malicious file into the build and hence the threat of a valid certificate with risky intent.
This has led to some of the largest organisations such as Google having their share of incidents. Even organisations like China Internet Network Information Center (CNNIC) have been implicated around concerns around some cyber attacks.

Man in the Middle

 

On the internet, we communicate with others through many tools and channels. We inherently trust that the connection is secure and unless we see or hear something suspicious, and we will share our most personal and private information.

Our messages from A to B, clearly are addressed to usually people that we know. If your digital certificate is compromised through a 'Man in the Middle' attack, where we think we are talking to B, but actually these messages are being relayed to C. This alone can be a high risk, and then let's not forget that C can also change the message that you receive.


Trust the Certificate?

This internet that we use everyday has been established using Public Key infrastructure PKI as the foundation of trust. In reality every PC connected has a list of trusted root Certificate Authorities. In turn this has led to a 'chain of trust'.

 

In Banking apps we operate with a secure connection where there is a signed file is “trusted”. A digital certificates is used to secure websites and also to secure email. When a browser is confronted with a HTTPS server with an untrusted server certificate, it will generate an immediate warning.
The problem is that the assumption is that we have entrusted the Certifying Authority to only issue certificated to appropriate users. There are many documented examples of organisations that have by possession of a certificate have been able to mount a man in the middle attack.
In effect ownership of a certificate provides a scenario that the system is seen as valid. Which in normal cases is exactly as designed. The problem is when this falls into the wrong hands.

Gaps in Process and System create risk
Each Certificate Authority has to maintain vigilance and ensure that their systems are secured. Their own internal processes also need to be robust, and therefore only issue certificates to validated parties. This process could include some element of second and third factor authentication so that only registered email addresses or phone numbers can request certificates.

At the end of the day, this can be susceptible to the human factor and we know that this can result in variance to what is supposed to happen. We all trust our fellow humans to a different degree and I think we have to also use that same judgment when it comes to different Digital Certificates and the organisations that we process these.

http://www.cso.com.au/article/583023/why-should-trust-your-digital-certificates/

The race for messaging supremacy

David Gee finds some messaging platforms that you may not know about, including one that may win the race.

Asana, Hall, Jive, HipChat, Slack and Sqwiggle. It sounds like a group of superheroes that are going to save the world but in fact, it’s a band of new messaging startups – most from San Francisco – aiming to be the ‘go to’ product for your team to work more effectively.

These startups are making email look dated, which it is. These days, our inboxes are full of messages that really aren’t that important.

Many of these messaging products are free at least for the first versions but that’s about where the similarity ends. Right now, if you were doing a short list of these newcomers, then it’s likely that HipChat or Slack would be on that list.

Slack vs HipChat

HipChat was created by Australian firm Atlassian and has a simple interface with reportedly good customer service. But the market seems to be backing Slack, which has 750,000 active users and growing. It is clearly a market favourite with a staggering market valuation of $2.8 billion. Note that Atlassian, with a full suite of products, is valued at $3.3 billion.

Slack is essentially a group messaging tool that has memory which is searchable. All the conversations are organised into different channels for public versus private and group discussions.

This is a great example of success coming from failure – in this case an online game, Glitch that was abandoned and messaging became the focus.

What makes Slack different is that is not just a simple chat tool. At first glance it provides for synchronous messaging across all your devices, including the Apple Watch. But it’s much more than that, and allows you to stay within Slack to read all messages, alerts, tweets etc.

Slack integrates your messages and has strong integration capability with other services such as Google Drive, Hangouts, Dropbox and Github. It also allows users to create a searchable virtual archive service.

These integration and archiving capabilities are where it stands out from other platforms. If you receive tweets, emails or a hangout from within Slack, you don’t need to jump in and out of different applications.

The product also has an RTM API, which provides real time event updates on everything that occurs both from servers and team members.

Read more What’s all the fuss about messaging apps?

 

Improve customer experience, social media listening

It’s frustrating when you have had a poor customer experience and then you tweet or share this on social media. Afterwards you receive a slow response or worse, no response at all.

Products like Slack are not built for social media monitoring but they allow for a smart integration when you mention a product or company name.

For large enterprises that receive volumes of tweets, this is where a product such as Slack can help to prioritise and share this alert in the appropriate forum and team.

That’s where the listening and responding comes into play. And it’s important to know the history of any prior dialogue, which is where Slack’s archive feature is useful.

 

The empire strikes back

Although Slack has made some inroads with a great product, it hasn’t quite won the race yet.

Microsoft is not going to give up this battle easily and is the corporate incumbent with their customers already using Lync, Yammer and Skype. Google for Work will also be wanting to play in this space and although the search giant failed with Google Wave, I would expect the company to be in the game.

Facebook for Work is also one to watch.This is being tested, but it is not that easy to get over the name – which I would believe doesn’t belong in the corporate world.

Finally, a dark horse would be have to be LinkedIn, a company with aspirations for taking its current platform to a different level and inside the building so to speak.

 

Personally, I would vote for Microsoft, mainly because it has Office 365, Yammer and SKYPE for Business in its stable.

So where do these products fit in your roadmap? Tools such as Slack can help improve customer experience. Indeed, they can be superheros inside your business.

But products like Slack are currently being used heavily by software coders and developers and not 

by large enterprises so perhaps they don’t yet fit into your corporate IT strategy.

Information overload is a big issue and these products don’t address the root cause of the problem – humans need to interact but the sheer number of channels that are at their disposal means that decisions are possibly being made without the right information.

I suggest that organisations evaluate how their existing tools can operate in the same manner as these new entrants. But I’m not being ‘slack’, I just want that same integration between tools for some parts of my business. I’m just not sure it is needed everywhere.

For me, when the role these tools play is based on knowledge and the need for collaborative intelligence – then they make more sense. Conversely, if these tools play a 'widget processing' role, they will perhaps create more distraction than value.

 

David Gee is the former CIO of CUA where he recently completed a core banking transformation. He has more than 18 years' experience as a CIO, and was also previously director at KPMG Consulting. Connect with David on LinkedIn.

Some of my personal opinions and writings....

INNOVATION & TRANSFORMATION

Why corporates can’t innovate like startups

What they don’t teach you at CIO school

Six things CIOs can learn from bikram yoga

Follow the ‘yellow brick road’ to innovation

Everyone loves a good hack

Transformation for SMARTIES


BIG DATA ANALYTICS

What’s stopping you doing big data analysis?

Step-by-step: preparing your business for big data

Could machine learning replace the CIO function?

CYBER SECURITY

IT security: a top five priority for the CIO

Lessons from a hack


BITCOIN  & PAYMENTS

A banker meets a bitcoiner

Interview: Daniel Alexiuc, The Living Room of Satoshi

STARTUPS

Spotify, the agile posterboy

How big business can innovate like a startup

The CIO as a venture capitalist

Interview: Manutea Dupont, co-founder, ShopWings

CUSTOMER EXPERIENCE

IT's leading role in customer experience

What’s all the fuss about messaging apps?

Why I don’t have to buy an Apple Watch

CIO MENTORING

My first 90 days as a CIO

Time management tips for CIOs

IT and the business still lost in translation

Is 2015 your chance to reinvent yourself?

CIO RELATIONSHIPS

Who’s eating your lunch?

Should the CFO report to the CIO?

What’s all the fuss about messaging apps?

Who's winning the 'battle for our thumbs' and what are the value and risks of messaging for corporates?

Emojis, picture characters that emanated from Japanese messaging systems, have found their way into our everyday lexicon. However, there has been an increasing focus on ‘attracting our thumbs’ with the uptake of messaging systems booming worldwide.

Already, the number of SMS text messages has been outstripped by messages sent using technologies such as WhatsApp. Global and local telecom companies are losing a battle to retain this business and ‘free’ tools are winning over consumers.

Startups are also launched new apps. One such app is ‘Slack’, which is being backed by venture capital firms, Andreessen Horowitz and Accel Partners and only has 8000 users so far. Apps like this are competing against Facebook’s Messenger with its 600 million users.

This battle for our thumbs may eventually cause many of us to have a repetitive strain injury which in time, may be avoided with a wave of wearable technologies being created to help us read and respond to messages.

These apps all have very similar features and you often choose to use an app to connect with a group of friends. It is quite common to have millennial that use two or three of these simultaneously.

So it’s not surprising that there are a few apps with 600 to 700 million users. There is a degree of overlap, but it would be hard to accurately measure.

 

In essence, these apps have evolved from simple text messaging that replaced SMS as a free service and added picture sharing and voice messages. There has also been selective rollout of video conferencing and VoIP functionality, which tends to vary by country.

For telecommunications companies, this is the second nightmare after surviving the rapid uptake of Skype, which is now owned by Microsoft.

	Text Msg	Voice Msg	Video conferencing	Free VoIP	P2 payments	Users (millions)	Owner	Nation
Line	Yes	Yes	Yes	Yes*	Yes	600M	Naver	Japan
Viber	Yes	Yes	Yes	Yes*	Rumours	280M	Rakuten	Japan
WeChat	Yes	Yes	Yes*	Yes*	Yes	440M	Tencent	China
Messenger	Yes	Yes	No	Yes*	Yes	600M	Facebook	USA
WhatsApp	Yes	Yes	No	Yes	Rumours	700M	Facebook	USA

* This feature is country by country limited

P2P payments

It’s a natural extension from ‘friend to friend’ messaging to making small P2P payments using these apps. What started off as the purchase of emoji stickers is now evolving into full-blown electronic commerce and it’s certainly difficult for banks to be part of this discussion.

For instance, Japanese company, Line Corporation – you may have seen its mascots in local Samsung stores – has a thriving business selling games, taxis services, and food delivery using ‘Line Pay.’ This is in addition to its free messaging, voice and video call service.

Enterprises are missing out

Big corporates are directly affected by these disruptions, but are not the targets of the messaging companies. It seems like an eternity since we thought of corporate tech as being ‘innovative’. There is just no R&D that is being spent by the major technology companies on such messaging technology.

When we try to tackle improvements, it has been piecemeal and it is two different realities. We support customers using the phone and online and indeed, we force them down channels that we support rather than supporting the channels that they already use. The winners will be the companies that try to meet the consumer in their own territory.

I’ve heard of users in China using WeChat and voice messaging to track their local deliveries. Even large logistics companies that move shipping containers from China around the world such as Kuhne and Nagel and trialing this technology.

US company, eQuest, recently integrated its corporate messaging system into WeChat. Users sign up to receive job alerts and submit their CVs using the system. It is really is a good example of what enterprises should be doing.

Dutch airline, KLM, is testing WhatsApp so its frequent flyers can ask questions regarding booking requests, upgrades, and seat selections.

I can forsee that this trend around enterprises embracing consumer messaging will continue to grow.

  

Mining your life

There is nothing that is ‘free’, and in return for using these apps we give up significant information about yourself and your network. When this is executed well, it will be welcomed and we will then start to embrace the payments options that are also offered along with location specific offers.

Let’s remember that our friends at Facebook own two of the biggest players in this space. At the moment, the battle for the biggest share of the messaging market will be fought between Facebook, a US company; and China’s WeChat.

Users of these apps are not always aware of the geopolitical aspects of this battle and it is likely that there will be further security breaches.

But this shouldn’t stop an increased awakening in the corporate market about the value and the risks of messaging.

Organisations essentially have two choices. They can continue in their current mode and strive to improve customer experience but force users to use a 'corporate chat tool'; or embrace the fact that users are already using these messaging apps and figure out appropriate ways to use this channel.

For me, it is like having two separate ‘rooms’, one room where the customers are already talking and the second room, which is just for interactions with the corporate. There are times that due to privacy or other regulatory constraints that a messaging tool just can’t be used.

The trick is to engage with the appropriate tool for the right dialogue and engagement. I’d prefer to be engaging in the room where the customers are already talking.

David Gee is the former CIO of CUA where he recently completed a core banking transformation. He has more than 18 years' experience as a CIO, and was also previously director at KPMG Consulting. Connect with David on LinkedIn.

Bikram Yoga as a Metaphor for Business Transformation

The yogi’s guide to business transformation.

I’ve always been a glutton for punishment. I have completed more than my fair share of hard and complex transformations, and I have also sweated my way through a number of those 40 degree bikram yoga classes, despite invariably wanting to leave after the first ten minutes.

The two aren’t really that different.

If you have never tried hot yoga, then this may sound like nonsense, but stay with me.
Bikram, or hot yoga, is a series of 26 poses and breathing exercises. It ups the intensity by requiring the series be done in a studio heated to 40 degrees celsius with 40 percent humidity.

It is a masterclass in staying balanced in the face of discomfort, and has more than a few lessons to offer business executives leading their organisation through a complex transformation.

Start with a solid foundation
In bikram yoga, you start with your feet together and your legs strong. It is all about building your core strength, not about losing weight or looking beautiful.

Similarly, a true transformation has to have a solid foundation, as this will be tested by the will of the organisation to drive towards an objective and not stray from this mission.

Every transformation has to have a convincing objective that everyone believes in and is committed to. Without these foundations in place, a transformation will not succeed.

Keep breathing
Transformations are taxing on the enterprise, as business has to stop many other activities to free up necessary bandwidth to achieve the sustained focus that deep reforms demand.

In the yoga studio, you have to breathe and smile. In the office, not taking that deep breath is always a mistake when you are in the midst of a transformation. Relationships between individuals are often strained as forces work against each other.

Smiling, even when you are straining, makes a massive difference.

The front row must lead by example
The last thing a yoga class needs is for the instructor to waver.
Similarly, transformational leaders are visible out in front, and individuals naturally follow their example.

The last thing you want is for the person in the front row to be seen to be shaking.
Being a visible role model is all part of a successful transformation, and it is impossible to succeed when the front line is not looking both confident and competent.

Don’t over-stretch
In yoga you have to use your judgement to gauge how far you can push your body so nothing breaks.

I’ve seen and led project teams working weekends and overtime for a continuous period of 18 months or more. Stretching is not always bad. The more you stretch the more your flexibility grows.

But push too far, too fast and injuries will follow.

Take time for recovery
A recovery rest in bikram yoga is called a dead body pose, or Savasana.

It is not about sleep - you don't have your eyes closed and you are not unconscious. In a recovery rest, you have to be aware and awake. This is a time for reflection and not just recuperation.

There are natural pauses that exist in yoga and in business and it is all about taking advantage of these when they do occur.

They are not always easy to plan for, but if you don’t let yourself take recovery breaks, there will be burnout.

Build your flexibility
A yogi is a person who practices yoga and has achieved a high level of spiritual insight.

In a similar vein there are people who are truly experienced transformers: they enjoy being uncomfortable and stretching beyond their level of flexibility. These are the transformation experts that adapt to change and take this into their stride.

These yogi types are not that common, but it is a learnt art that anyone can achieve it with persistence and training.

Becoming a transformer starts with changing yourself and in doing so, taking others with you.

Read more: http://www.itnews.com.au/BlogEntry/403718,six-things-cios-can-learn-from-bikram-yoga.aspx#ixzz3a6FpX8E2