Train your users. Save a Breach

I have been talking about perimeter security. Please keep in mind that all of these are on a really high level because frankly I don’t want to bore you to death with details. It is more about awareness and what you can do to keep safe.

I have talked about the router, wireless threats, threats from other sources not commonly thought of and now we get down to the nitty gritty. The desktop itself. I am not even going to go into laptops, pads and the like at this point because that is a discussion point by itself.

I would say one of the most common calls I get is for a malware infection or virus infection. I know what you are thinking. “Mitch, I thought you were teaching us about perimeter defenses here. Don’t you practice that yourself?” I sure do but the fact of the matter is no matter what system I put in place, no matter how much I monitor it, no matter how tight I have that security there is still one factor out of my control. The user.

I get that question a lot. “How did this happen?”  Usually I get that before I look at it. It is like saying my car isn’t running right so what is wrong with it. Until the mechanic can do some looking, discovery and digging he can give you a wild guess but not an answer. Almost always the cause of the infection is the user themselves. They clicked on something, plugged in that USB stick or opened an attachment that they shouldn’t have.

Before I get into the whole clicking on something you shouldn’t I want to stress some precautions that can help at least spread a virus or due a ton of damage but isn’t fool proof.  First PATCH that computer. So many of the problems come from companies not putting on those latest updates from Microsoft every 2^nd Tuesday of every month. I am a little cautious with this when it comes to doing a patch for an entire organization. There has been occasion (one fairly recent) when a patch can mess up a machine. I wait a day or two to make sure I don’t have to go backwards fast. Another strategy is to have just a couple of machines in an organization as your testers to make sure nothing will blow it up. Then schedule the rollout. There are many ways  you can do this which I will not go into here but just set your machine for automatic updates if you are a small company.

Second. Keep your firewall turned on. Many times I run into where someone installed a piece of software  and it didn’t work. They turn off the firewall and forget to turn it back on. (The firewall is another layer of protection. Remember the analogy of the bank and the doors. More doors only they are on the PC itself)

Third.  Make sure you run some kind of virus scanning. It at least catches the most obvious stuff. The virus scanning programs are becoming less and less effective every day because they have been using that same format and technology for years. The bad guys have figured out ways around that a long time ago (again.. another subject I could write about for a long time)

Frankly the best prevention technique today and probably always will be is TRAINING! I am amazed how companies do not train users on the basics of what to click and what not to click. It is kind of like giving your Son or Daughter a cell phone without teaching the basics of how to stay safe online. Oh wait!  That happens too. (Sorry, couldn’t help myself) Maybe a better analogy is showing someone how to drive without teaching them where the brakes are so they can stop before they hit something. I think you get my drift.

In summary,  that desktop is usually the culprit (more like the person using it). It may not be because someone is going to a bad site on purpose but with lack of training and recognition of what they are clicking on it could wind up costing a lot of money and a lot of productivity.  I try so hard to get clients to see the benefit. By stopping one bad action through recognition it could save a company literally thousands of dollars and a thousand more headaches. Awareness is the key.

Wireless is like leaving the window open

Have you ever left your house, locked it up and drove way not really thinking about it. You return home later and notice air moving. Where is it coming from? You left a window open!! (Gasp). If you think about how a bad guy would enter your home when you are away he probably isn't coming through the front door. My guess is he would see the open window and not take long to get in.

My last blog I talked about perimeter security using a router. If you leave a window open (wireless that is not separated by from you network) it is a pretty easy entry into the network. Again, the hardest part is getting inside the first layer usually. Many small businesses do not even give it a second thought. A few customers ask for if they have wireless, they think why not and throw up an access point (that's that thing with the funny looking antennas on it but sometimes they don't have them)  so people can cruise the internet.

LAST BLOG:PERIMETER SECURITY

So whats wrong with that you as? Say I am a bad guy. I drive to the back of your building at about 2 am. Earlier that day I was just driving around to see if I could find anyplace that has an unsecured access point I can jump on to. BINGO!!  Your it! Most of the better routers (see how I came back to that router again?) will have the ability to plug multiple pieces of equipment in and then program it so you can separate things like access points from your regular network. People can still cruise the net but it makes it difficult for them to get into your network (not impossible). There are other ways to do this but with the right programming and hardware it can help allot. One other thing that I do with my clients is the Access Points they buy have a schedule in them so I shut them down about an hour after everyone leaves. That prevents Johnny or Jane hacker from jumping on at 2AM.

I still have not explained why you should do this, have I?  Johny or Jane hacker can leverage that access point in a number of ways. They can plant some viruses, mess with your systems and here is one that most don't think of (I actually had this happen to a client) commit a crime while using your lines so they trace it back to you. How fun would that be to have the FBI at your door questioning you about some fraud that came from your network? Exactly!!

Now I have one more that hardly any business thinks of. Most printers and copiers these days come with a wonderful wireless feature on them. One that is typically turned on by default and left on. So that isn't so bad. Right?  Couple it with most vendors NOT CHANGING DEFAULT PASSWORDS and you have another wide open window.



To stay consistent lets just say there is a bank. It has a copier and wireless was left on. Blasting out to the world "Here I am..Come see me!"  Jane Hacker knew this because she was using a wireless analyzer to drive around and again, find open systems or at least ones broadcasting. This time she mixes in with the rest of the cars in the parking lot. She is able to EASILY access that printer through wireless. She now can see the internal hardrive (yep, they have internal hardrives) with stored documents complete with account numbers, names, addresses and social security numbers. (And yes, this happened but it was years back). Jackpot and now she can go sell that info on the black market at a premium of $15 a pop. Just for fun before she leaves she reprograms the LCD display and locks everyone out of it.

I could go on an on about real life things that have happened like this. I could also go into BYOD (Bring Your Own Disaster ... I mean Device) that leverages wireless and other ways it can open a door to your network but I want you to actually continue to read my blogs. I can also get much deeper into the mechanics of how this works but for now lets just say its making you aware.

My lesson for today is, just like looking at a building think of the most unusual way you can get in and not just the obvious. If someone gets inside then the whole router thing I talked about is irrelevant, though I will be talking about those inside layers. AH HA!  Its like locking all the doors but letting someone in the back door to look around. Still will catch up with you. Remember. The bad guys really don't want to be seen just like a thief so they may not come at you in broad daylight. Think like a thief!

In the next blog I will touch on some of the more unusual "windows" (Not Microsoft. Figure of speach here folks)  that are open out there but have actually been the cause of some of the most publicized and large breaches in the last year. Till then!

Starting at the perimeter for Cyber Security

I believe the old saying goes " A chain is only as strong as a the weakest link". Same goes for perimeter security and it is a place to start talking about a structured and layered approach.

In my previous blog I described your data being like money in a bank. It should take many layers to get even close to it just like in a bank. If you are a bad guy trying to steal money in the middle of the night the first order of business is trying to get in the door or inside of the building. The same goes with data on a network.

I am going to pause for a second and put a disclaimer out there for you. In this blog I am only going to describe the technology side of security. Not the actual physical security. Physical security is as important but for the sake of simply staying focused we will talk on the technology side. Many businesses do not think about the physical security aspect of protecting data but in later blogs I will go through some of the things I have seen and experienced that will bring to light how important that aspect of security is. Still with me??

Think of the Internet as the world outside of the door of your business. So you have a door on your business. Right?  Same goes for your network. You have to put a door there so it is not wide open that any body can come on in. Take a look around at your data and financials. We are trying to avoid that. The harder it is for the bad guy to break down that door and get in the more of a fighting chance you will have.

So this door. The door will be a piece of equipment that you probably have heard of at some point called a router. What that router will do is let traffic in and out of your door or doors (I will talk about those doors in a minute) and direct traffic (emails, data etc) to where it needs to go. I will not go into the gory details of how that works but it is kind of cool what it can do.

Now a router is not just a router in most cases. A router has on it something called a firewall (the better ones at least). Picture our bank again. Now think of that bank of having thousands of doors on it that can either be made to just let people in, just let people out or to let them go in and out. On the router these are called ports. Here is a very important part. There are a few doors every bank has to have open just to make sure people can come in and go out (when you surf the Internet you have to go in and out of one of those ports). The rest of them should pretty much be locked, sealed and welded shut so someone doesn't get into your bank without you knowing. This is typically done when it is first set up. 

Even more important is every door has a master key (this would be the admin password for the router itself which can be used to change settings). That key is known to the world and anyone with the key can get in the door and do what they please. So what do we do if we know we have a common lock with a common key?  Change the lock and key!! I can not tell you how many times I go to visit a new client and simply test the original password (typically either admin, password or 123456.. I am not kidding!!) and bang!!  I am in their router and able to do any type of voodoo I do including opening doors they don't know about so I can get in later. I just described how a majority of hacks on routers happen. CHANGE THE DEFAULT PASSWORD!  

Sorry for yelling but this is one of the simplest and most effective ways to keep a common hacker out of your system and so many times it just is not done. Anyway.. That is kind of routers 101 so to speak. I do have one item to add. Spend a few hundred dollars on a router. Please!! I have replaced countless inexpensive routers because frankly they just are pretty easy to breach. I wont mention brands hear.  

I will mention several brands that I like to work with that really are solid. My favorite is probably Watchguard (http://watchguard.com/) . Excellent product! Very powerful if you need it but also does a fantastic job of updates on their systems and I just do not have problems with failures. Averageish cost is $500. You can add services such as a web filter, virus protection and Intrusion detection but that where you would have to have someone who knows his stuff to be running it. Other brands I have used are Cisco, Dell Sonicwall and Fortinet. There are many more out there but any of these work for a small business without killing you in price. All make routers that are $100K + so lets just say you have a wide range.

There is one more thing to be addressed. I have run into businesses that would not put a router on thinking they were safe. Their provider of their Internet plopped this black box in (cable modem), hooked up to their stuff and sure as shootin they had Internet. They never asked if there was a firewall on there. Some do have that firewall, some don't and some just are not very good though it has been getting better. Don't just trust that black box. Many providers will not even give you access to see what is going on in case one day you have trouble. Put your own equipment on.

So in closing the router is your first line of defense for your network. If you want to tighten up your security this would be the best place to start. Not the only place though! Many more layers to go through. Aren't you excited? Next I will touch on wireless which is an area many businesses are not understanding is a wide open door into their system.. Till then...