NJCCIC Publishes: Tips for Teleworkers, Remote Access Security

For many organizations, telework programs have been in practice for years – whether as part of the organization’s everyday work program or as a component of their business continuity plans.

For those organizations, policies, educational programs, technologies, and support services for the remote workforce are well established. For organizations engaging in telework for the first time, defining expectations is a good starting point.

First, create a telework policy that addresses the following:

• The scope of the telework program, roles and responsibilities, eligibility to telework (not all jobs can be performed remotely), 
• work hours and paid time-off, 
• the suitability of the alternate workplace and its related safety requirements, 
• responsibility for equipment and supplies, 
• operating costs and expenses, 
• and requirements for physical and information security. more

Some Landlords Illegally Spying On Tenants’ Stimulus Check Status

While millions are awaiting their payments to help with necessities, landlords are also eager for their tenants to receive stimulus checks, so they can pay rent. Unfortunately, some landlords have not just been waiting patiently...

In order to help Americans to track the status of their stimulus payments, the IRS and Treasury Department launched a new tool, Get My Payment. The tool provides individuals “with the status of your payment, including the date your payment is scheduled to be deposited into your bank account or mailed.”...

In order to check the status of a stimulus payment, one only needs to provide basic information, including name, date of birth, street address, and Social Security Number (SSN) ... This basic information is readily available on the dark web ... it is also readily available to many landlords through the applications that tenants complete when applying to rent a property.

You may want to speak with a lawyer to evaluate options if your landlord checks your payment status on the IRS portal. You may also want to consider filing a police report. more

Corporate Privacy & Information Security Challenges from Covid-19

This is an excellent information security article written by a respected colleague. ~Kevin
via Charles Patterson - Exec Security
The CoVid-19 response has had serious and often devastating effects on individuals and businesses throughout the world... But there are a number of side-effects from this, many of which affect privacy and information security...

Company offices may be left mostly empty with a skeleton crew, and access being granted to maintenance staff or a few lone employees who may still be carrying out basic operations or some who may have just needed to return to pick up something from their desk to help them work better from home.  This means the employees, cleaners, and other staff will be largely unsupervised and may have easy access to areas not normally permitted...

When reviewing your security during this period, here are some very important points to consider:

• How secure was your facility during the down time?
  • Note what areas were weakened, where was less manpower deployed?
• Who continued to have access?
  • What types of staff were still given access? Were employees still allowed back in?
• Were any private or classified areas left open and unattended?
  • Pay particular attention to board rooms, conference areas, and C-suites. Look for any signs of unauthorized activity.
• What incidents may have occurred during the period? 
  • Review logs of any security incidents, look for any correlations that could indicate suspicious activity.
• Were there any areas accessed by unauthorized personnel? 
  • Investigate thoroughly any reports of employees found in unauthorized areas.
• Did any break-ins or vandalism occur?
  • Security breaches or other incidents could be used as a cover for actual espionage activity. If a break-in or theft was reported, pay attention to any nearby areas that may have been accessed as well.

After returning to your offices, pay close attention to anything that has been disturbed, anything that may have been tampered with. Any indication of unauthorized access to offices or secure areas should be investigated thoroughly. Electronic sweeps of critical offices and confidential areas should be scheduled. more

Will Working from Home Increase Business Espionage Opportunities

I received a question today about inductive coupling; gleaning computer data leaked on to power lines (aka, mains) from keyboards, screens, etc. The person mentioned this was possible if the residences shared the same power transformer.

"So, does the increase in work-from-home offices these days increase the business espionage threat?"

Interesting question. Got me thinking.

I replied...
You're correct about sharing a transformer. Information can be induced onto the mains and intercepted on that side of the circuit. Several floors in an apartment building and usually 3-4 homes in a residential neighborhood can share one transformer.

But, let's think this through...
Back before we all became computerized the mains lines were relatively noise-free. Carrier-current bugs and wireless intercoms worked quite well for transmitting audio. These days, the noise level is a digital cacophony, created by everyone who shares the circuit.

The very low signal level a keyboard might contribute would be difficult to hear. Segregating the signal from other digital noise would also be a challenge. With diligence and the right instrumentation deciphering this digital data is doable. It would not be a nosy neighbor doing this. If you got that far, you're probably a government and the home worker has a bigger than average problem.

Realistically speaking...
A fairly static group of mains users also reduces risk. Your neighbors aren't deep cover spies who have waited years for the chance you might be forced to work from home. Moving into a neighborhood or apartment building with spying intentions is possible, but not easy to do on a moments notice. There are easier ways to obtain even more information, with a lot less work, and greater chance of success.

Worry about these things...
The weak links in a home office are: the computer, wireless keyboards, Wi-Fi, and internet modems. Current versions of wireless keyboards use Bluetooth (30 foot range) with some pretty good security features. As for date leaking onto the mains... Most smart people use a UPS battery backup with filtering for their computers, so no problem there. For anyone without a UPS getting one is a very worthwhile recommendation for multiple reasons.

Threats the average home office faces...

• shared cable internet, 
• Wi-Fi signal hacking, 
• spyware viruses (data, audio and video compromise), 
• Wi-Fi connected printer intercepts, 
• information phishing scams, 
• and none of the usual enterprise type protections. 

Attacks can be instituted by anybody, some staged from anywhere. Being on one side of a transformer isn't necessary. No need to tap the mains.

Imagine this...

• Step #1: The spy purchases a USB Rubber Ducky (to crack into the computer) and an o.mg cable (to crack into the smartphone). Total cost: <$200.00.
• Step #2: Spy plops these into an old Amazon box and mails it to "the mark."
• Step #3: Mark goes, "Wow, cool. I didn't order this. Amazon must have screwed up. Not worth sending back. I'll keep it."
• Step #4: Mark plugs this windfall into his computer and phone.
• Step #5: Gotcha! 

Think this isn't already happening? Think again. The USB Rubber Ducky is now on backorder.

Your company needs to have a technical security consultant on retainer—because there is more to know.

More People Searching for Technical Surveillance Countermeasures (TSCM)

Analysis: More organizations are hardening their defenses against electronic surveillance and information theft.  With TSCM information security surveys becoming mainstream attacks will shift toward the defenseless...

Defenseless equals lunch in the Infowar Jungle.

Hacker Physically Plants Keylogger Devices on Company Systems

A hacker admitted to planting hardware keyloggers on computers belonging to two companies to get unauthorized to their networks and steal proprietary data. He now faces 12 years of prison time.

It appears that the individual was after data relating to an "emerging technology" that both targeted companies were developing.

In February 2017, 45-year old Ankur Agarwal of Montville, New Jersey, trespassed the premises of one of the two tech companies and installed keylogging devices on its computers to capture employee usernames and passwords. He also added his laptop and a hard drive to the company's computer network. more

A Technical Information Security Survey could have prevented this in the first place. ~Kevin

Toga! Toga! Toga! ...SCIF Fight!

SCIF fight shows lawmakers can be their own biggest cybersecurity vulnerability.

About two dozen House Republicans enter a sensitive compartmented information facility (SCIF) where a closed session before the House Intelligence, Foreign Affairs and Oversight committees took place.

A group of House Republicans could have created a field day for Russian and Chinese intelligence agencies when they stormed into a secure Capitol Hill room where their colleagues were taking impeachment testimony yesterday with their cellphones in tow. more

"You're all worthless and weak!" ~Doug Neidermeyer

IT / Security Director Alert: Cisco Aironet Wi-Fi High-Severity Vulnerability Patch Available

Cisco has issued patches for critical and high-severity vulnerabilities in its Aironet access point devices.

It also issued a slew of additional patches addressing other flaws in its products.

“An exploit could allow the attacker to gain access to the device with elevated privileges,” said Cisco in a Wednesday advisory.

“An exploit could allow the attacker to gain access to the device with elevated privileges,” said Cisco in a Wednesday advisory. "...it could allow the attacker to view sensitive information and replace some options with values of their choosing, including wireless network configuration. It would also allow the attacker to disable the [access point], creating a denial of service (DoS) condition for clients associated with the [access point].” more

5 Cheap Things to Beef Up Your Security
by Rob Kleeger, Digital4nx Group

Here are a few simple things to prevent and keep most of your private information as safe as possible from hacks or negligence.

1. Invest in a Password Manager:  If you are like me, most people can’t remember the login details for the dozens of online services they use, so many people end up using the same password — or some variation of one — everywhere. If you are one of those people, this means that if just one site on which you use your password gets hacked, someone could gain access to all your accounts.
2.  Use a virtual private network (VPN) service: When connected to any internet-connected device, it helps to keep most of your browsing private from your internet service provider; it reduces some online tracking; and it secures your connections when you use public Wi-Fi.
3. Turn on MFA (2FA) on everything: Two-factor authentication adds an additional layer of security to the authentication process by making it harder for attackers to gain access to a person's devices or online accounts because knowing the victim's password alone is not enough to pass the authentication check. Two-factor authentication doesn’t guarantee security, and it is vulnerable to hacking attacks like phishing attempts that spoof a login page.
4. Backup: Have a backup plan. All too often, SMB leadership says they backup, but the backup is saved on the server, which if gets encrypted, serves no purpose...neither does attaching a NAS to the same network. Have a cloud-based or offline based backup plan. Confirm backups run regularly and periodically test those backups to do a full restore. 
5. Don't forget about the paper:  In many ways, people are so focused on cybersecurity, they forget about the basics. Use a cross-cutting paper shredder.  Wirecutter recommends the AmazonBasics 15-Sheet Cross-Cut Shredder for most people, though serious privacy mavens should step up to the AmazonBasics 12-Sheet High-Security Micro-Cut Shredder, which runs a little slower but produces confetti half the size of a cross-cut shredder’s pieces.

Dissinformation as a Service (DaaS)

While disinformation campaigns are often associated with governments, new research indicates there is a robust, easy-to-navigate market for anyone looking to buy their own propaganda arms.

It is “alarmingly simple and inexpensive” to launch a sophisticated disinformation campaign, analysts from threat-intelligence company Recorded Future concluded after studying the issue. “Disinformation services are highly customizable in scope, costing anywhere from several hundreds of dollars to hundreds of thousands of dollars, or more depending on the client’s needs.”...

“If the ease of this experience is any indication, we predict that disinformation-as-a-service will soon spread from a nation-state tool to one increasingly used by individuals and organizations,” the Recorded Future analysts said. more

As Technical Information Security Consultants, this caught our attention. 

The best disinformation always adds in some correct information. The sum is verisimilitude, the ring of truth. 

So, where will the best correct information come from? Inside, of course.

Another very good reason to conduct regularly scheduled Technical Information Security surveys at your organization.

Protecting Your Engineering Business from Industrial Espionage

Industrial espionage is a much more common occurrence than many people realize. 

As a business grows and begins to compete at a higher level, the stakes grow and their corporate secrets become more valuable. It isn’t just other businesses that might want this information, hackers who think they can sell the information will also be sniffing about.

Even if you can’t eliminate the risk entirely, there are certain things you can do to reduce the risk of a security breach in your business. more

A Very Short List...

• Shred Documents

• Don’t Print Sensitive Information if You Don’t Have to

• Keep Your Schematics (designs, strategies, etc.) Under Wraps

• Keep it Need to Know

and my favorite... 

• Be Proactive - Look for Leaks

Because...
If you don't look,
you may never know.

Just Another Week in the World of Spies

China - Yang Hengjun, a well-known Australian writer and democracy activist detained by the Chinese authorities in January, has been formally charged with spying... more

Russia - A Moscow court has ruled to keep an American man and Marine veteran suspected of spying in prison for two more months. The court ruled on Friday to keep Paul Whelan behind bars at least until late October. more 

WWW - Freelance site Fiverr offers illegal private spying services... more

UAE - Why the CIA doesn't spy on the UAE... more

Israel shouldn’t let a little spying undo its economic ties with China, ex-chief analyst argues... more

Iran has sentenced a British-Iranian national to 10 years in jail for spying for Israel... more

China’s spies are waging an intensifying espionage offensive against the United States. more

USA - Patrick Byrne resigned suddenly as CEO of Overstock.com last Thursday, after mounting controversy surrounding his past romantic relationship with alleged Russian agent Maria Butina. Butina is now serving an 18 month prison sentence for conspiring to promote Russian interests through conservative U.S. political groups. more

Australia - Intelligence agencies warn of 'unprecedented scale' of foreign spying within Australia. more

Iran - Environmentalists filming Iran’s endangered cheetahs could be executed for spying. more

India sending spying devices to Pakistan via balloons... more

USA - The spy in your wallet: Credit cards have a privacy problem... In a privacy experiment, we bought one banana with the new Apple Card — and another with the Amazon Prime Rewards Visa from Chase. Here’s who tracked, mined and shared our data. more

Business Security Trend: Proactive Information Security... Legislated by law!

via Brian G. Cesaratto, Epstein Becker Green
New York is the latest state to adopt a law that requires businesses that collect private information on its residents to implement reasonable cybersecurity safeguards to protect that information.

New York now joins California, Massachusetts and Colorado in setting these standards. New York’s law mandates the implementation of a data security program, including measures such as risk assessments, workforce training and incident response planning and testing. 

Businesses should immediately begin the process to comply with the Act’s requirements effective March 21, 2020.

Notably, New York’s law covers all employers, individuals or organizations, regardless of size or location, which collect private information on New York State residents.

In order to achieve compliance, an organization must implement a data security program that includes:

• reasonable administrative safeguards that may include designation of one or more employees to coordinate the security program, identification of reasonably foreseeable external and insider risks, assessment of existing safeguards, workforce cybersecurity training, and selection of service providers capable of maintaining appropriate safeguards and requiring those safeguards by contract;
  
• reasonable technical safeguards that may include risk assessments of network, software design and information processing, transmission and storage, implementation of measures to detect, prevent and respond to system failures, and regular testing and monitoring of the effectiveness of key controls; and

• reasonable physical safeguards that may include detection, prevention and response to intrusions, and protections against unauthorized access to or use of private information during or after collection, transportation and destruction or disposal of the information.

 

Information Security: Privacy Tips for Business Travelers

The Basics...

• Beware of shoulder surfers. Get one of these.
• Know when to shut your mouth. Don't give strangers any confidential information.
• Use a Virtual Private Network (VPN).
• Change any passwords you used while on your tip.
• Keep your device with you to reduce info-suck opportunities.
• Avoid using public charging stations (unless you have one of these).
•  Read Murray Associates' Guide to Off-Site Meeting Information Security.

Historical - A Covert Transmitter & A Mistake = Early Fake News

February 13, 1935 was probably the first case of a major news organization incorrectly reporting a courtroom verdict because of a radio communications fail - the birth of Fake News! 

Flemongton, NJ - The Associated Press (AP) thought it was being uniquely creative - and sneaky - during "The Trial of the Century" involving the kidnapping and murder of Charles Lindberg's young son. A reporter secreted in a miniature shortwave transmitter, concealed within a leather brief case. A receiver station above the courtroom stood ready to copy the agreed upon code, based on the verdict, and send the results to its newspaper feeds.

Little did they know that a competing news agency had the same idea, but used a different code. The AP operator received the New York Daily News code assuming it was from the AP mole. It immediately sent the story to hundreds of editors across the world.

One of the short-wave transmitters carried by a reporter into the courtroom at Flemington was concealed in a small leather brief-case...

Short Wave Craft described how to build a short-wave set in a brief-case in the June 1932 issue - three years earlier! With a slight change in the connections, this receiver is easily converted into a transmitter for code signals, such as those used at the Hauptmann trial.

Short waves played a most important role in the famous million-dollar Hauptmann trial. Two tiny short-wave transmitters were secretly carried by reporters into the courtroom and were used to signal the jury's verdict to other reporters outside the locked courtroom. more

FREE - Security Message Screen Savers

Security Message Screen Savers

• Reminders work.
• Put your idle computer screens to work.
• Three backgrounds to choose from, or commission custom screens.
  

Supreme Court Relaxes the Confidentiality Standard... but you have to do your part!

via Blank Rome LLP - Robyn N. Burrows

The Supreme Court in Food Marketing Institute v. Argus Leader Media, No. 18-481 (U.S. June 24, 2019) recently relaxed the standard for withholding confidential information under Exemption 4 of the Freedom of Information Act (“FOIA”)—a major win for contractors that regularly submit sensitive business information to the government...

To take full advantage of the Court’s holding, companies doing business with the government should keep in mind the following practical tips:

• Carefully document all efforts to keep information private.* This includes updating internal policies on maintaining the confidentiality of company records, increasing security features limiting access to certain sensitive data, and providing additional training to employees on how to properly handle confidential business information.

• In submissions to the government, clearly indicate which information is to be kept confidential. This includes marking the data with a protective legend identifying it as subject to Exemption 4 protection. Be aware that certain statutes and regulations may require specific language to be used.

• To the extent possible, obtain written assurances from the agency that the information will be kept confidential and will not be released to third parties absent the contractor’s consent. Contractors may also be able to negotiate contractual provisions protecting the data to be submitted to the government. more

* An independent consultant specializing in quarterly holistic information security audits can do this for you. 

Killed for Spying: The Story of the First Factory

Piedmont, in north-west Italy, is celebrated for its fine wine. But when a young Englishman, John Lombe, traveled there in the early 18th Century, he was not going to savoir a glass of Barolo. His purpose was industrial espionage. 

Lombe wished to figure out how the Piedmontese spun strong yarn from silkworm silk. Divulging such secrets was illegal, so Lombe snuck into a workshop after dark, sketching the spinning machines by candlelight. In 1717, he took those sketches to Derby in the heart of England.

Local legend has it that the Italians took a terrible revenge on Lombe, sending a woman to assassinate him. 

Whatever the truth of that, he died suddenly at the age of 29, just a few years after his Piedmont adventure. more

Kieffer Ramirez Shares His Favorite Niche Investigations Resources (most are free)

SpyDialer

Cost: Free
Search people via their phone number, name, address, and/or e-mail address by using SpyDialer which contains billions of phone numbers obtained using social media and user-contributed address books.

Concerned about your information showing up on SpyDialer?!?! Check and see. If you appear there, you have the option of deleting your information... anonymously.

The 17 other resources appear here.

Porcelain — An Industrial Espionage Story

1712 A.D. ...a French Jesuit priest named François Xavier d’Entrecolles pioneered industrial espionage by recording the secrets of porcelain making while on a trip to China and sending them back to Europe...

Another remarkable use for porcelain is the lithophane, a sheet of porcelain so thin as to be translucent, with artwork etched into it. The lithophane is thin enough that the art can only be seen when backlit, but just thick enough that the image can have depth. Lithophanes began to appear in several parts of Europe in the 1820s, but they’re believed to have originated in China a millennia earlier during the Tang Dynasty. Later Ming Dynasty scholars wrote of Tang bowls “as thin as paper” that included secret images.