SC Magazine Discussion by Dr MJ Frederick

SC Magazine Discussion by Dr MJ Frederick https://padlet.com/mj_frederick/cgk1ljaqt4k0 Operations Security en-us 2017-09-30 21:09:13 UTC 2018-11-03 01:42:08 UTC hello@padlet.com Zero Trust (group 1) https://padlet.com/mj_frederick/cgk1ljaqt4k0/wish/292770162 This article gives an example of how an attaker can have control of your computer data and use it any way he/she wants. It gives an example about how costumer of booking.com received email with their actual hotel reservation from an attaker who had stolen data from booking.com. The attaker was phishing for personal information.

https://www.scmagazine.com/home/security-news/how-consumers-can-adopt-a-zero-trust-mindset-for-cybersecurity/

Group 1
Marleni Chiappini
Jessie Spires
Tyler Orr

]]> 2018-10-15 12:37:18 UTC https://padlet.com/mj_frederick/cgk1ljaqt4k0/wish/292770162 Data from soldiers’ fitness trackers reveal sensitive locations, routines (Group 8) https://padlet.com/mj_frederick/cgk1ljaqt4k0/wish/292840849 A heatmap of two years’ worth of fitness tracker Strava’s global data, released last November but discovered more recently by an Australian student, inadvertently revealed the location of U.S. military facilities in war zones.
https://www.scmagazine.com/home/security-news/privacy-compliance/data-from-soldiers-fitness-trackers-reveal-sensitive-locations-routines/]]> 2018-10-15 14:27:35 UTC https://padlet.com/mj_frederick/cgk1ljaqt4k0/wish/292840849 Group 7 (Nate Orolfo https://padlet.com/mj_frederick/cgk1ljaqt4k0/wish/293106182 A sibling duo embedded malware into prominent figures in the Italian government and other public figures. These people became victim to a spear-phishing tactic that has been going on for years. The emails with the malware contained .zip files that contained EyePyramid, allowing the access of the victim's data. But the attackers were caught due to lack of OPSEC. They communicated and talked about their victims on their phones, used IP addresses associated with their company, and then tried to delete the evidence when they were caught.]]> 2018-10-16 00:00:15 UTC https://padlet.com/mj_frederick/cgk1ljaqt4k0/wish/293106182 Group 5 mark_deel https://padlet.com/mj_frederick/cgk1ljaqt4k0/wish/293319321 This article discusses overall policy changes to our national cyber security strategy. This is a product of a risk management process on currently existing assets and policies and updating them to a less passive/more aggressive strategy.]]> 2018-10-16 13:31:21 UTC https://padlet.com/mj_frederick/cgk1ljaqt4k0/wish/293319321 Android spyware BusyGasper has many features, but few known victims ( Group 3) pytou1995 https://padlet.com/mj_frederick/cgk1ljaqt4k0/wish/293578921 This article is about mobile malware implant that is called BusyGasper. This mobile malware targets the Android users. Blog post, Kaspersky Lab researcher Alexey Firsh reports that BusyGasper has existed since May 2016. Malware could reportedly issue around 100 commands, and its capabilities include spying on device sensor, exfiltration data from messaging app such as WhatsApp and Facebook, keylogging, and bypassing the Doze battery saver.
https://www.scmagazine.com/home/security-news/android-spyware-busygasper-has-many-features-but-few-known-victims/]]> 2018-10-16 19:45:53 UTC https://padlet.com/mj_frederick/cgk1ljaqt4k0/wish/293578921 Group 1 cameronbartlett1998 https://padlet.com/mj_frederick/cgk1ljaqt4k0/wish/293627604 This article discuses the "Securing Our Critical Infrastructure" conference. Where four NCSA panelist discuss the worries and future of cyber security. All 4 panelist agreed there is no huge threat to cyber security right now. The four panelist answered question from an audience at their CyberSecurity Summit.

https://www.scmagazine.com/home/security-news/expanding-attack-surfaces-and-difficulties-obtaining-the-right-people-worry-ncsa-panelists/]]> 2018-10-16 22:49:20 UTC https://padlet.com/mj_frederick/cgk1ljaqt4k0/wish/293627604 Group 9 https://padlet.com/mj_frederick/cgk1ljaqt4k0/wish/293636997 A data breach at the Pentagon occurred not involving the Pentagon directly but by a third-party vendor. This breach exposed the PII of at least 30,000 military and civilian personnel. One industry member pointed out the "weak link" in contractors while another commented on the increase PII information on the Dark Web.

]]> 2018-10-16 23:39:23 UTC https://padlet.com/mj_frederick/cgk1ljaqt4k0/wish/293636997 Group 2 Embracing the social network. https://padlet.com/mj_frederick/cgk1ljaqt4k0/wish/293652842

Here is an article about Embracing the social network world keeping important data safe online. Expressing even though social media is here to stay like Email we need to walk before we run with the idea of integrating everything through online social platforms.

]]> 2018-10-17 01:11:18 UTC https://padlet.com/mj_frederick/cgk1ljaqt4k0/wish/293652842 Group 4 https://padlet.com/mj_frederick/cgk1ljaqt4k0/wish/293653116 This article simply talks about advancements that need to be taken by our government to improve our infrastructure's security level.]]> 2018-10-17 01:12:47 UTC https://padlet.com/mj_frederick/cgk1ljaqt4k0/wish/293653116 Group 6 https://padlet.com/mj_frederick/cgk1ljaqt4k0/wish/293663542 https://www.scmagazine.com/home/industrial-tech-security-association-set-up-ncsc-calls-for-cooperation/

Internal informational tech security is very important to keep information within the company. Procedures such as auditing and biometric authentication are used in hand with relevant access to employees. We can use a more constant structure to keep employees informed and honest. However, security should not just focus on internal systems and protecting from breaches to our technology. In this day and age, threats come in many forms, so we need to expand our reach. Operations security is an often overlooked concept that can be used to protect sensitive information within companies and even in our personal lives. By evaluating the information that needs to be kept secret and analyzing the potential external threats, we can begin to create an idea of the need for operations security. Many competitors will evaluate a company to piece together information that is exposed in order to make a profile they can use to get an advantage on business tactics. In order to overcome this, a company must evaluate its threats, risks, and vulnerabilities and figure out which ones must be prioritized. When this list is made, countermeasures can be made to negate these risks. A countermeasure that stops a threat or vulnerability to precious information has completed the final step of operations security.

Considering how critical operations security is, it comes as no surprise that an association such as Iotsa has been established. As the article notes, adversarial entities are constantly analyzing the latest trends, practices and holes to be found in operational security. Whether it be criminal activity or state-sponsored espionage, gaps in the understanding and implementation of operational security can and will be exploited by those intending to do others harm. Cyberwarfare is a very real issue, and has become enough of an issue that the UK has seen fit to call for sanctions on participating countreies over it (https://www.thenational.ae/world/europe/uk-calls-for-sanctions-on-russia-over-cyber-warfare-1.780817Links to an external site.). Identifying and addressing what data could be targeted,and by whom, followed by analyzing vulnerabilities and countering them, si the only way to protect critical assets.

Operational security is the process of determining if friendly actions can be observed by enemy intelligence and then reduce or eliminate exploitations with countermeasures, for example having employees follow strict policies when a network change has been done while monitoring and logging all changes, always having a group or someone to identify and respond to risks on a timely fashion, restricting admission to network devices and utilizing a dual control system so the same set of employees aren’t in charge of security and network at the same time.

]]> 2018-10-17 02:03:03 UTC https://padlet.com/mj_frederick/cgk1ljaqt4k0/wish/293663542 Group 5 mark_deel https://padlet.com/mj_frederick/cgk1ljaqt4k0/wish/300021605 This article discusses overall policy changes to our national cyber security strategy. This is a product of a risk management process on currently existing assets and policies and updating them to a less passive/more aggressive strategy.

]]> 2018-11-03 01:40:14 UTC https://padlet.com/mj_frederick/cgk1ljaqt4k0/wish/300021605