Sunday, June 26, 2016

Boek review: Komt een vrouw bij de h@cker, van Maria Genova (Dutch)


Een poosje geleden zag ik wat tweets over het boek "Komt een vrouw bij de h@cker" van een ene @genova2 voorbijkomen. Hoewel ik dacht dat het boek in de categorie fictie viel besloot ik Maria Genova (de schrijfster van het boek en de persoon achter de hiervoor genoemde Twitter-handle) te gaan volgen. Toen ik enkele maanden later op de conferentie van (ISC)² SecureNetherlands 2016 aanwezig was zag ik in de agenda dat Maria kwam spreken over haar boek. Na een boeiende talk kwam ik met haar via Twitter in contact en kocht ik via haar een persoonlijk signeerde boek! Oh trouwens, het boek is helaas allesbehalve fictie...

Komt een vrouw bij de h@cker gaat over identiteitsfraude. Ze beschrijft waargebeurde cases ten aanzien van het misbruiken van gegevens door anderen om zich voor te doen als jou. Meestal met nadelige financiële gevolgen voor de originele identiteit (lees: jij). Situaties zoals fraude met betrekking tot het inschrijvingen op je woonadres, mobiele telefoonabonnementen, bestellingen bij online winkels, misbruik van bankgegevens en ga zo maar door, komen allemaal aan bod. Ook gaat ze in op overheidsinstanties en hoe slordig daar (soms?) wordt omgegaan met gevoelige persoonsgegevens. Vaak overigens op de meest eenvoudige manier, zonder complexe hacks door hackers.

Dit is allemaal bijna niet voor te stellen en dus besloot Maria om contact te leggen met een echte hacker om zodoende uit eerste hand te zien hoe eenvoudig digitaal inbreken is. En de informatie op onze computers laten weinig tot de verbeelding over, want nagenoeg alles is te vinden op onze computers. Denk hierbij aan volledige kopieën van identiteitsbewijzen zoals paspoorten en rijbewijzen, maar ook accounts en wachtwoorden die we opslaan in eenvoudig te lezen bestanden, en intieme en soms ook pikante foto's. En niet te vergeten de slechte discipline die gehanteerd wordt ten aanzien van het installeren van alle updates en het hebben van een malware (virus) scanner. Het is een snoepwinkel voor de digitale inbreker.

Dat identiteitsfraude bestaat en plaatsvindt kan ik me nog wel mee verzoenen. Criminaliteit bestaat nu eenmaal en hoewel we het zeker moeten bestrijden, moeten we niet de illusie hebben dat we het kunnen uitbannen. Niet op korte termijn in ieder geval. Wat ik zelf gewoon bijzonder vind en eigenlijk gewoon weg niet begrijp is de mate waarin een slachtoffer wordt ondersteund in dit proces (althans, de mate waarin hij of zij niet wordt ondersteund).

Op het moment dat we iemand op straat zien overlijden krijgen we slachtofferhulp aangeboden (sterker nog, ik kreeg het zelfs aangeboden toen ik aangifte kwam doen van diefstal van mijn fiets). Maar slachtofferhulp bij identiteitsfraude gebeurd gewoon niet. Vaak krijg je al niet eens een aangifte goed verwerkt, is de politie niet deskundig (genoeg) om je te ondersteunen en heb je vaak de schijn al tegen want het is toch 'jouw' handtekening!

De financiële schade is vaak al niet te overzien. Van enkele duizenden tot vele tienduizenden euro's die je gewoon kan ophoesten omdat je in de rechtbank niet geloofd wordt. Onschuldig gevangen zitten is helaas hierbij ook geen uitzondering! Maar ook de impact op je persoonlijke leven is voorbij het denkbare. Geliefden die je niet meer geloven en van je gaan scheiden, vrienden en familie die je in de steek laten want "waar rook is, is vuur" en eveneens het verliezen van je baan en huis.

Identiteitsfraude is realiteit, het krijgt te weinig aandacht van de overheid en justitie, de pakkans is klein en de hoeveelheid aan onschuldige slachtoffers groot! Het boek samengevat in één woord: doodeng...

Maria gaat gelukkig ook in op wat eenvoudige en toepasbare oplossingen die al een groot verschil kunnen maken. Denk hierbij aan het hebben van een uniek wachtwoord voor elk online account, geen kopieën van je legitimatie meer verstrekken tenzij dit van de wet moet (meer info hier), terughoudend zijn met welke informatie je deelt en het installeren van alle updates voor je computer, tablet en telefoon. De tips beslaan meerdere pagina’s en ze zijn erg nuttig en helpen allemaal een beetje bij het (hopelijk) voorkomen van identiteitsfraude.

Wat mij betreft een must-read voor iedereen, ongeacht leeftijd, opleidingsniveau, werkniveau en geslacht. Want iedereen kan slachtoffer worden!

Eerste publicatie: 2014
Pagina’s: 224
ISBN: 978-9-089-75292-5
Link: mariagenova.nl
Lezing: mariagenova.nl/lezingen

Friday, June 17, 2016

My talk at US Consulate about Cyber Security and Agile Development

I had a talk at the United States (US) Consulate in Amsterdam last Tuesday (June 14, 2016) on a Cyber Security v. Agile eCommerce event. Companies like SBS Broadcasting, KLM, ION-IP, WhiteHat Security, Bureau Brandeis, Isatis Group and many more attended this event. I was asked by ION-IP to speak at this event and, of course, I immediately said yes!

Before I say something about my talk, let me first start with the US Consulate itself. This was a very nice and new experience for me, especially from a Security perspective because it has airport-tight Security levels. First of all, I needed to get a personal invite the Commercial Specialist of the US Commercial Service of the consulate itself (besides the invite by ION-IP and WhiteHat Security). No invite from the consulate itself means no access. For obvious reasons I had to show my passport (driver’s license was also possible) and had to turn over all my electronic devices.
US Consulate in Amsterdam - Source: Wikipedia
Thinking to be efficient, I had already switched of my phone, but I had to turn it on again. The reason for this was so they could see it was actually a phone. Then it was tested for drugs and explosive substances, and then I had to switch it off again and turn it over. I decided to not bring my smartwatch, because that would have been submitted also. The next step was to walk through a detector and, thankfully, I had to only take of my belt and no other clothing. We were then escorted by an employee towards to meeting room (through a couple of locked doors). We also could not leave the building without an employee present.

My talk was about Security Awareness and why we should stop it, or at least have the ambition to make it obsolete. This is obviously a statement to make the audience think about the value of Security Awareness and when and when not to invest in it. When looking to the organization I work for I see that the most value comes from Security Awareness on the level where change is done. Whether it is IT, HR or the Legal department, everywhere there can be made a change there can be made a difference. Obviously the Security Awareness in every department is for the most part completely different.

I ended with my talk with an advice that Security Awareness for IT departments should focus on automation. The more you automate, the more predictable and agile you will become. And when you are agile, you can even become anti-fragile. Every time an IT-department consider training users on Security, we should first ask ourselves if we can make our technology better. If not, then we need to question if we can make our policies, procedures and baselines better. And then, and only then, we can start training users. Because leaning on awareness for security, is leaning on the weakest link in the chain of security, the humans.

And again, for Security Awareness in general, focus it at the places where changes are done in order to really make a difference!

If you want to read more about my point-of-view concerning awareness, read these posts of mine.
I really want to share my gratitude towards ION-IP, WhiteHat Security and the United States Consulate in Amsterdam for giving me the opportunity to talk at the event and help creating awareness within the field of Cyber Security and Agile Development.

If you have questions or want to debate or challenge my point-of-view! Please do so! Sharing opinions is creating knowledge and knowledge leads to wisdom! So feel free to comment below.

Sunday, June 12, 2016

Awareness and Cyber Security versus Agile Development

Let me start with a message (yet again): "If you want an agile environment, you need Security Awareness". What did I just say? I recently said in another blogpost of mine that if you need Security Awareness to be secure, then you are doomed in the first place. I still think that is true, but it is only a part of the case I want to make. In this post you will read the rest of my point of view on this topic.

On June the 14th of 2016 I will talk about this specific topic on the “Cyber Security v Agile eCommerce”, hosted by ION-IP, WhiteHat Security & The Embassy of the United States of America in Amsterdam. In this post I will dig a bit deeper on this topic, why I have this opinion and why I want to share it with you and the rest of the world (the world, because if I may believe Google Analytics, my readers are from everywhere, thank you all!).

Security awareness by itself is by no means the holy grail to a secure environment to work, play, and live in. Though many companies and security professionals alike often focus heavily on security awareness, and to be more precise, security awareness focused at user level. I believe that when you cannot make security ubiquitous by nature, you will fail for sure at creating awareness at that level.

A couple of months ago I was looking for a replacement car (my former broke down) and as I really do not know anything about cars, other than how to drive one at least, I noticed a certain behavior of mine. And that behavior is commonly known as “a typical user who does not know anything technical about the topic at hand and therefore lacks any sensible judgement about its mechanics”. And it gave me a valuable insight concerning security awareness at user level.

This insight was the very fact that I literally did not ask one question about the security of the car. I did not ask anything about the airbags, brakes, seat-belts, electronic brake-force distribution, lane detection, and the security features accompanied with cruise control. I asked myself why as me being a security officer, and the only answer that pops up is this: “If I do not know anything technical about a car, I for sure cannot influence its security, I can only use it as it is build”. I think that the security of the car should ubiquitous. And this changed my perspective on creating security awareness at user level.

The point that I am making in this talk is that your focus or drive should be to eliminate security awareness at user level. This focus helps you to become more creative by building solutions so non-technical users are working secure by design, instead of working insecure and hopefully with some awareness stuff will not hit the fan. But this needs security awareness at another level in the organization.

My statement in the talk is this: “Move security awareness to the level where change is done…”. If the people with the power to change are aware of security, chances are more likely that a securely designed system is being created. So instead of focusing all that energy, time, and money on security awareness for everyone in the organization, try focusing it all on your IT staff. I firmly believe that when you do that, nice things start happening. Part of this firm believe is the experiences I had with this principle in the company where I am fortunate enough to work at.

Security and privacy are not the same thing, so I also advocate to start working on privacy awareness. And, in contrast to security awareness, that topic should be addressed to everyone in the organization. It is by far more effective than security awareness, because the topics are more relevant by nature, and people can really influence them by their behavior. It is easier to teach a user to not share a social security numbers or medical details by phone and e-mail, than learn such user to recognize specially targeted and crafted phishing mail and to not click on the link.
Source: VISTA infosec
Let me end my post with an advice and a question.

When you focus security awareness on the place where change is done, you get more (and this will grow over time) systems designed securely. Awareness should also focus on automation. Because I firmly believe automation is imperative for an increased security. And the more you automate, the more agile you will become. And the more agile you are, the more anti-fragile you can become. And anti-fragility helps making your business become weatherproof for (sudden) changes in its environment.

So, Security awareness at IT-level leads to secure design, which leads to automation, which leads to increased agility which can lead to anti-fragility. Cyber Security can go hand in hand with Agile Development. And let me turn that around, a strong Agile Development culture can greatly increase your security!

What can you design and automate in order to make security awareness obsolete, while increasing the agility of your business?