Drones: Are they on your radar?

Drones - friend or foe?

Early in the computer industry programmers used to write computer code to automate many functions and features.  As the years progressed the same code was used for more nefarious purposes. Computer code used for these nefarious purposes is commonly called malware: Viruses, Worms and Trojans. 

Now early in the drone industry we are being teased with visions of Amazon dropping boxes in our rear yard, fast food deliveries arriving with piping hot pizza via a drone and many other examples of how the use of this technology can enhance our lives.  The examples are endless.

However, while drones can in fact do much to enhance our lives the use of drones can also be pointed to more nefarious purposes.  Common perimeter defenses can be easily undermined with relatively little effort for the determined attacker.  With a few thousand dollars your intellectual property can vanish in seconds.  Installation of an onboard camera with pan tilt and zoom could steal your ideas right out of your board room.  The drone can do this and more while still being blocks away.  As drones mature and their payload capability increases security directors and facility personnel concerns will only increase.

Integris Security LLC has for years identified both leading and bleeding edge technologies.  Today, we have identified a strategy, a technology and method to address not all but some of the issues concerning drones.  We would like to set an appointment to speak with you and see if this is on your radar screen.  Drones can be managed and can be one less thing that keeps you up at night.

Press Release:

http://tinyurl.com/hjwpt54

FAA News:

http://thecipherbrief.com/article/exclusive/tech/implications-new-faa-commercial-drone-rules-1092

Integris Security Web Site 6/25/16:

https://www.integrissecurity.com/index.php?solutions=DroneDefense

Recent news 7/1/16:

http://www.vocativ.com/334024/prison-smuggling-drones/

Drones: Are they on your radar?

Drones - friend or foe?

Early in the computer industry programmers used to write computer code to automate many functions and features.  As the years progressed the same code was used for more nefarious purposes. Computer code used for these nefarious purposes is commonly called malware: Viruses, Worms and Trojans. 

Now early in the drone industry we are being teased with visions of Amazon dropping boxes in our rear yard, fast food deliveries arriving with piping hot pizza via a drone and many other examples of how the use of this technology can enhance our lives.  The examples are endless.

However, while drones can in fact do much to enhance our lives the use of drones can also be pointed to more nefarious purposes.  Common perimeter defenses can be easily undermined with relatively little effort for the determined attacker.  With a few thousand dollars your intellectual property can vanish in seconds.  Installation of an onboard camera with pan tilt and zoom could steal your ideas right out of your board room.  The drone can do this and more while still being blocks away.  As drones mature and their payload capability increases security directors and facility personnel concerns will only increase.

Integris Security LLC has for years identified both leading and bleeding edge technologies.  Today, we have identified a strategy, a technology and method to address not all but some of the issues concerning drones.  We would like to set an appointment to speak with you and see if this is on your radar screen.  Drones can be managed and can be one less thing that keeps you up at night.

Press Release:

http://tinyurl.com/hjwpt54

Drones: Are they on your radar?

Drones - friend or foe?

Early in the computer industry programmers used to write computer code to automate many functions and features.  As the years progressed the same code was used for more nefarious purposes. Computer code used for these nefarious purposes is commonly called malware: Viruses, Worms and Trojans.  See our updated posts below.

Now early in the drone industry we are being teased with visions of Amazon dropping boxes in our rear yard, fast food deliveries arriving with piping hot pizza via a drone and many other examples of how the use of this technology can enhance our lives.  The examples are endless.

However, while drones can in fact do much to enhance our lives the use of drones can also be pointed to more nefarious purposes.  Common perimeter defenses can be easily undermined with relatively little effort for the determined attacker.  With a few thousand dollars your intellectual property can vanish in seconds.  Installation of an onboard camera with pan tilt and zoom could steal your ideas right out of your board room.  The drone can do this and more while still being blocks away.  As drones mature and their payload capability increases security directors and facility personnel concerns will only increase.

Integris Security LLC has for years identified both leading and bleeding edge technologies.  Today, we have identified a strategy, a technology and method to address not all but some of the issues concerning drones.  We would like to set an appointment to speak with you and see if this is on your radar screen.  Drones can be managed and can be one less thing that keeps you up at night.

Press Release:

http://tinyurl.com/hjwpt54

FAA News:
http://thecipherbrief.com/article/exclusive/tech/implications-new-faa-commercial-drone-rules-1092

Integris Security Web Site 6/25/16:
https://www.integrissecurity.com/index.php?solutions=DroneDefense

Recent news 7/1/16:
http://www.vocativ.com/334024/prison-smuggling-drones/

Ten Mistakes that Boards Make

Too often we are learning of executive level errors or omissions which cause massive breaches to the data or PI of millions of citizens.  Here's the "Ten Mistakes That Board Make".

         1. Not Asking Questions

2. Failing to Understand the Company and the Risks it Faces

3. Failing to Lead on Ethics and Compliance

4. Not Insisting on a Crisis-Management Plan

5. Speaking out in a Crisis Before the Facts are in

6. Relying on the Wrong Outside Counsel

7. Failing to Understand Attorney-Client Privilege

8. Underestimating Regulators

9. Giving too Much Leeway to Rainmakers

10. Getting Caught Up in the dilemma of False Options

Taken from the magazine Corporate Board Members, an article written by Randy Meyers.

Make Integris Security your Chief Risk Officer (CRO) as the independent keeper of oversight in your corporate enterprise.  It is the job/function of the CRO to keep regulator awareness at a high level and to let the business be in charge of risk management.

Integris Security LLC grew from our passion for protecting our nation’s critical infrastructures and years of providing industry professionals with best of breed solutions, proven best practices and top notch security education. We work tirelessly to nurture our clients’ TRUST. We will work equally diligently to EARN your trust.


Reference: http://operationalrisk.blogspot.com/2014/11/top-ten-mistakes-board-of-directors-risk.html

 

Cyber Security Awareness Month

Now not half way into DHS Cyber Security Awareness Month and the industries leading computer organizations in NYC have hit the ground running with their first joint conference, a success,  ushered in without nearly breaking a sweat.

NY Metro InfraGard, ISSA, ISACA, OWASP, Cloud Security and others joined together with over 300 security professionals in Brooklyn, NY at St Francis College.  The lectures showcased outstanding sessions on Active Directory and a number of security and related discussions.
The all day event produced a Women in Security panel as the
afternoon plenary event.

Most attendee's remarked that this was the opening for the 2015 joint Cyber Security Conference which all believe will now be an annual event.  Congratulations to the organizing committee who persisted and stayed on course to make this important event happen.  A big thank you to St Francis College in Brooklyn for moving heaven and earth to make this happen and for being flexible during the days events.

We look forward to seeing more of this next year.

Uncertainty, risky first half of 2014...the year of the hack?

Pushing the buttons of millions of individual Americans is the fact that their accounts have been hacked according to Larry Ponemon at the Ponemon Institute in a study conducted for CNN Money.  Ponemon's study gaged that 47% of adults had their accounts hacked during 2014, which may soon become known as "the year of the hack".  That's just about half of all adults in the United States.

The facinating numbers come at the heals of the Target breach which we have been discussing on this blog and doesn't include the millions in the latest eBay Breach.  Its raining on the American Public as millions of  (PII) records are exposed.  Here are the facts and figures Ponemon and Jose Pagliery of CNN have dug up for CNN Money:

"Cyber attacks are growing so numerous that we're becoming numb to them. Researchers at IT company Unisys (UIS) say we're now experiencing "data-breach fatigue." Even the most recent numbers make for a dizzying list:

• 70 million Target customers' personal information, plus 40 million credit and debit cards
• 33 million Adobe user credentials, plus 3.2 million stolen credit and debit cards
• 4.6 million Snapchat users' account data
• 3 million payment cards used at Michaels
• 1.1 million cards from Neiman Marcus
• "A significant number" of AOL's 120 million account holders
• Potentially all of eBay's 148 million customers' credentials"

More numbing then the facts and figures presented by Ponemon Institute for CNN MONEY is the fact that the industry has not adopted better and well known security practices as a whole.  Need I go on?  For ten years industry has been digging a hole deep in the sand and sticking their preverbal heads in the hole.  See my blog post on accountability.

Let's not blame it on companies looking at profits after all isn't that why companies are in business to begin with.  However we too pause, when companies select tactical gains to satisfy quarterly earnings statements and maybe making themselves look good as opposed to the overall strategic growth and health of a company or corporation.  Read responsibility to share holders, and company employees. To some extent the risk Vs reward discussion will come up and when presented executives will nervously select profits.  Until boards reflect the knowledge, skills and abilities necessary to make both tactical and strategic management decisions we will continue to see the deep decline and clearly the never ending "year of the breach".  Operational executives will respond in kind when Boards of Directors begin to ask the thorny questions which should focus on the strategic growth of the company.  Employees will then be motivated and hear the clarion call from mount high when the CEO comes back from the board meeting and says they want more security and assurance before we can bring that function on board, who certified that code, who tested it and who is taken ownership of the relationship with the software team?

Here's hoping that the second half of 2014 is the year of Board of Directors active and attuned to what is going on not only in the front office but every office.  That function continues to thrive and work closely if not right next to the security team.  That multi-factor authentication is used not just for outsiders, but insiders as well.  That outside relationships are clearly defined and SLA's (service level agreements) are scoped out to protect both the vendor and the company.  That data which can be held in a planet sized computer terminal or a tiny smart phone is protected and preserved because we should all enjoy a level of privacy.   That when we buy the state of the art upstream gadget that detects attacks and when alarms go off and people start screaming at the top of their lungs someone will listen and will have been properly trained on the use of the gadget and that it is properly configured. All very hopeful that the year end will be better than the start.  The future is now before us.  Let's see how we do!

Good luck everyone!

LINKS:

The Cyber Crime Economy

Study: 432 million accounts hacked

Lessons from the U.S. Veterans Administration

Government run healthcare is suffering from the stiff stench of reality this week as the Veterans Administration emplodes in a wide scale corruption probe in over 46 different facilities - defining systematic corruption which has infected the entire bureaucracy.  What can we learn?

Audits tell part of the story and so does strong management which not only holds those accountable but is in fact in trenches leadership.  Take a hard look at, "Undercover Boss" and ask yourself if the leadership of the VA had been in the trenches could things have been any different.  Clearly the Administrator of the VA was fighting an uphill battle of liars, cheats, and more.  But "Undercover Boss" makes the point: get out of the office and get into the trenches for a reality check.  Now let's see if our USDOJ follows the Veterans Administration IG's report and starts the most necessary criminal investigations to clean the VA once and for all so that our war heros finally get what they deserve - the best health care known to man.

We talk much in this blog about management and boards of directors.  As we should.  Organizations depend on these fine men and women to do the impossible, to be supermen and women.  But the days of hands off management are long gone.  Whether you are in government or the private sector if you haven't gotten that message its high time you did.  Get out of the office and learn the reality of what is going on in the workplace.

We heard much this week about out dated technology and "scheduling".   We worry, is this a sign of times to come in government run healthcare?  Well, those of us in technology know all too well that technology does a backflip and ten steps forward about every 60-90 days.  So if you're thinking of saving money and leveraging your entire corporation and/or government run agency on shoestring that has a one time techology budget - in the immortal words from Brooklyn, NY - forget about it.

Technology is in the worst case an infant, with an appetite that rivals most young U.S. Marines in boot camp.  Belly up to the table because this infant is going to need your undying attention, your understanding and your coddling every single day of the week.  Budgeting and planning for the unexpected are just another great aspect which many who are so quick to adopt technology and outsourcing with an expectation of saving millions may want to slow down and take a deep breath.  Technology implementations are expensive and those seeking to cut to shortcuts are only doing a royal disservice to their companies and agencies and fooling themselves.  While the passing of timely and accurate information is exciting and used correctly can help you turn on a dime....it comes with a fairly large investment and huge reality check on expectations - but not on the information delivered, but on the intense care and ongoing maintainence to systems, controls and people.

Take a hard look at the Veterans Administration of today and ask yourself Mr/Mrs CEO or Agency head...could this be me?  Do I even have a clue?  We hope this as in any number of cases we bring to your attention help you focus not just on security but the fundermentals of leadership and management.

If you need a trusted source and friendly but well grounded reality check give us a call.  We would like your business, but we're not willing to suffer our reputation just to make a buck.

Trust is at the core of Integris Security. We can be counted upon to provide you with the services and intelligence to keep your information, systems and institution secure. Call us and let's get to work on improving your security/risk posture.

Accountablity: Have you heard the call from Target yet?

At some point Industry across America will face a tipping point.  A point at which lying to the U.S. Congress, failure to comprehend risk,  pointing the finger to someone else just isn't going to cut it.  Those in the front office will be held accountable at some point.  Enter TARGET.

Leadership Failure:
Have you heard the call from Target yet?  Perhaps you should.  The CEO - gone.  The CISO - gone.  The Board of Directors - now facing election could be gone as well.  As they should be for failing the stockholders and trustees for the lack of interest, utter malfeasance of office.  For bringing incompetenance into the forefront this board and others need to tossed.

http://www.computerworld.com/s/article/9248631/Advisory_firm_urges_ouster_of_majority_of_Target_board_members_over_breach_

IT Certification - a farce and failure?
(ISC)2 code of ethics cannons state:

1. Protect society, the commonwealth, and the infrastructure
- Promote and preserve public trust and confidence in information systems
- Promote the understanding and acceptance of prudent information security measures
- Preserve and strengthen the integrity of the public infrastructure

2. Act honorably, honestly, justly, responsibly and legally
- Tell the truth; make all stakeholders aware of your actions on a timely basis
- Observe all contracts and agreements, express or implied
- Treat all constituents fairly.  In resolving conflicts, consider public safety and duties to principals, individuals, and the profession in that order
- Give prudent advice; avoid raising unnecessary alarm or giving unwarranted comfort.  Take care to be truthful, objective, cautious, and within your competence
- When resolving differing laws in different jurisdictions, give preference to the laws of the jurisdiction in which you rend your service

3. Provide diligent and competent service to principals
- Preserve the value of their systems, applications and information
- Respect their trust and the privileges that they grant you
- Avoid conflicts of interest or the appearance thereof
- Render only those services for which you are fully competent and qualified

4. Advance and protect the profession
- Sponsor for professional advancement those best qualified.  All other things equal, prefer those who are certified and who adhere to these cannons
- Avoid professional association with those whose practices or reputation might diminish the profession
- Take care not to injure the reputation of other professionals through malice or indifference
- Maintain your competence; keep your skills and knowledge current.  Give generously of your time and knowledge in training others

Can we honestly believe that (ISC)2 is holding its certified membership to account for its own ethics cannons?   Is this industry grist mill collecting money and not policing its own people?  After ten years of continually failing grades in breaches from every corner of the world one has to ask, is the (ISC)2 operation real, is it accountable?

As industry raced to bring down costs and adopted many Information Technology practices, sought greater input about its clients, its prospects, it internal operations a CISSP or other similarly disignated security professional has been behind the wheel.  Are these people being held accountable?

Securing systems is for sure both an art and science and not to be taken lightly.  Nor is their a silver bullet or magic wand to wave to make things right.  However, CEO's will have to lead, Security will have to be rounded touted by, adopted by, insisted upon by all top management executives.  Audits will have to be conducted to constructively explore where the problems are and when found aptly addressed. Function can take place, perhaps a little slower to give the security personnel the opportunity to explain the risk, so that management personnel can bring it into full view for the board of directors.  These board of directors then have the full responsibility to guide Chief Executives as well protect shareholders from weak operations.  IT systems are difficult, solutions are not always forthcoming.  But clearly in breaches for the past ten years industry has failed the public over and over again.  With no accountability until maybe now.