-
Fred Zajac commented on the post, Discussion Week 14, on the site 6 years, 8 months ago
I believe the sharing of private information should be based on an emergency policy. The emergency policy should outline why information needs to be shared, how the information should be shared, and who can request such information. HIPPA has an exception to the privacy policy. The exception states that a health entity can exchange patient…[Read more]
-
Fred Zajac commented on the post, Amazon to Let Delivery Drivers Open your Front Door, on the site 6 years, 8 months ago
Elizabeth,
Great find! Here is a quick story…
I used to own a corner property between the local middle school and elementary school. It wouldn’t be uncommon to see groups of kids walking across my property before and after school. On a few occasions, I would have packages missing from my door. I remember a cell phone and cable box…[Read more]
-
Fred Zajac wrote a new post on the site ITACS 5211: Introduction to Ethical Hacking 6 years, 9 months ago
CNBC.com repots uber was hacked because of a third party web provider. They paid $100,000 to keep things quiet. The FTC is looking at uber policies regarding employee and privacy.
small but it shows c […]
-
Fred Zajac commented on the post, Discussion Week 11, on the site 6 years, 9 months ago
The decision to allow certain penetration and vulnerability scan tools should be properly discussed prior to deployment, and each tool should be assigned to the utility owner. The utility owner will be the only authorized administrator, which would assign other users.
I believe the decision to allow these tools is based on the job description…[Read more]
-
Fred Zajac wrote a new post on the site ITACS 5211: Introduction to Ethical Hacking 6 years, 9 months ago
Nick Wells reported a story on CNBC.com with a headline suggesting online fraud is not a bad thing.
He comments on a report from Forter, an e-commerce fraud-prevention company. Forter monitors customer […]
-
Interesting article Fred. I am not really sure how I feel about Nick Wells’ statement. When he said, “It’s the cost of doing business.”, I completely agree with it. There are always risks making purchases online and one need to be proactive in paying close attention to what links you are clicking on and if the websites are legitimate. I don’t necessarily feel comfortable when he says “A little bit of fraud helps.” I personally do not want to be that 2% and I do not think anybody wants to. I am not that familiar, but possibly some fraud cases are easily solved, but what about the ones that are not? The ones where others are going months and months of trying to get everything resolved.
-
I have to agree with Elizabeth. Just because the fraud occurring benefits the consumer instead of them being the victim doesn’t make the fraud ok. In the same vein, just because brick and mortar stores plan and budget for shrinkage doesn’t make stealing from them ok, no matter how large and greedy the retailer may be. Fraud is a cost of doing business that retailers and consumers should plan for, but I don’t think it is ever ok to just accept that that is how things are. They should plan for if it happens but take steps to prevent it from happening in the first place.
-
-
Fred Zajac wrote a new post on the site ITACS 5211: Introduction to Ethical Hacking 6 years, 9 months ago
A plastic surgeon of the celebrities in London decided to fight back against the hacker group, “Dark Overlord” after the group downloaded patient pictures and information. Fighting back by organizations has been […]
-
Fred Zajac wrote a new post on the site ITACS 5211: Introduction to Ethical Hacking 6 years, 9 months ago
Thanksgiving at my family’s house looks like a day on the trading floor at the New York Stock Exchange. The 50+ people, including adults and children requires multiple days of preparation and clean-up. We a […]
-
Fred Zajac wrote a new post on the site ITACS 5211: Introduction to Ethical Hacking 6 years, 9 months ago
In a recent report, an employee at Twitter shut down President Donald Trumps twitter account for 11 minutes on their last day of work. President Trump responded by tweeting his account was taken down by a “rouge […]
-
Fred Zajac commented on the post, Discussion Week 9, on the site 6 years, 9 months ago
Fraser,
Here is some information that may help you for, “Hippa… doesn’t have a standard”.
This link will show you NIST guidelines for the hardware:
http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-124r1.pdfThis link will show you HIPAA regulations for Mobile Applications.…[Read more]
-
Fred Zajac commented on the post, A New IoT Botnet Storm is Coming, on the site 6 years, 10 months ago
Amanda,
I think the IoT is ripe for spreading infection. These devices are not built with security in mind, and are difficult to update / patch (if one is even available). The problem is that people don’t think it will ever happen to them. They think, “Why would anyone want to hack me?” but don’t realize they could be a launch point for…[Read more]
-
Fred Zajac commented on the post, Don't overlook physical controls, on the site 6 years, 10 months ago
Amanda & Elizabeth,
I agree with both of you and thank you for commenting.
It is an extreme case of weak physical controls, and shouldn’t be the case at an organization such as the NSA. I can see how something like this could happen to an organization viewed as a moderate or low level, but NSA (I would assume) would be Top-Secret…[Read more]
-
Fred Zajac commented on the post, WPA2 Cracked, on the site 6 years, 10 months ago
Frazer,
I read about this yesterday as well. It is a bit scary, but the patch was released and “fixed”. This is a man-in-the-middle attack. This is a big issue, but the problem for the “bad guys” is that they would have had to been in your WiFi range to get any of the information.
Add a compensating control to your house and do a quick…[Read more]
-
Fred Zajac wrote a new post on the site ITACS 5211: Introduction to Ethical Hacking 6 years, 10 months ago
USA Today reports the NSA’s Tailored Access Operation unit had a serious data breach. This is one of the largest incidents at NSA over the last five years.
The story reports, the access controls at the TAO’s […]
-
This is both interesting and unsurprising to me. A lot or organizations are so focused on what gets into their building (badges required, metal detectors etc) that they don’t often think of what gets out. I worked in the data center of a major insurance company and a lot of the people I worked with took old pieces and parts home after they were decommissioned even though they were technically supposed to get shredded. It would have been easy to take something with production data on it. The NSA should have way better security for what gets out than a corporation, but I think they’re falling into the same trap the corporations are, trusting their employees too much.
-
Fred,
Really good posting. I feel like I haven’t read a security article in a while regarding physical controls. It is definitely overlooked and tends to be forgot about. Like Amanda said, this is not surprising, but I did feel this article demonstrated a extreme case of weak physical controls. Aside from employees stealing company property or data, whether, a big one I have heard about is tailgating. Not so much directed to the company’s own employees, but still relates to physical control. This would be where a non-employee is able to easily follow someone into a building and now has the ability to navigate through the building. This can lead to the stealing of data and/or physical assets. Sometimes organizations make it to easy for employees/non-employees to steal due to the lack of physical controls.
-
Amanda & Elizabeth,
I agree with both of you and thank you for commenting.
It is an extreme case of weak physical controls, and shouldn’t be the case at an organization such as the NSA. I can see how something like this could happen to an organization viewed as a moderate or low level, but NSA (I would assume) would be Top-Secret level.
It is shocking to me that technical controls are not in place to prevent the removal of data on multimedia devices. Maybe someone needs to invent a device that looks like a metal detector you walk through, that instantly corrupts removable media devices. This can reduce digital information from being illegally removed. Or… they can caulk the USB drives…
-
-
Fred Zajac wrote a new post on the site ITACS 5211: Introduction to Ethical Hacking 6 years, 10 months ago
Sara Guo was interviewed at the Cyber Security Summit in Boston this morning. She works for a venture capitalist firm investing in technology companies. She mentioned the companies involvement with two s […]
-
This is really interesting insight into the reason that IT security is starting to become such an increasingly important field. Threats are becoming more and more sophisticated and many businesses’ personnel and policies are struggling to keep up. The need for both technical expertise and security-conscious administration has become vital to the success of any organization.
-
Fred,
It is very interesting post especially when the source is someone like Sara Guo which is an investor at venture capital firm Greylock Partners, I think she talks from experience from a results of auditing so many companies that she’s trying to invest on. I do agree that so many companies nowdays are not awarded of the risk of losing data, they give access to all their employees to data including sensitive information.
I think all these companies should train their employees to know how to protect data on top of inverts to secure their data by giving the right access to the right employees.
-
-
Fred Zajac wrote a new post on the site ITACS 5211: Introduction to Ethical Hacking 6 years, 11 months ago
My In the News story this week came from the latest episode of Vice on HBO. The episode discusses Russian Hacking, and also exposes how black-hat hackers attack targets. It shows how two white-hat hackers were a […]
-
Fred Zajac commented on the post, Car Tracking Devices Leaked, on the site 6 years, 11 months ago
Rich,
A data hack exposing social engineering type information…
It would be a great thing to know if an “Influencer” (Someone who is admired by several people) was going to be somewhere and when. This could lead to a crazy stalker, potential blackmail information, or disastrous terror attacks on high profile people who use the SVR…[Read more]
-
Fred Zajac wrote a new post on the site ITACS 5211: Introduction to Ethical Hacking 6 years, 11 months ago
Peter J. Henning for the New York Times reported the Government Accountability Office had found IS deficiencies at the SEC that “limited the effectiveness of the S.E.C’s controls for protecting confidentiality, in […]
-
Fred Zajac posted a new activity comment 6 years, 11 months ago
Amanda,
I understand your frustration. As an auditor, I strongly believe changes should go through the proper channels to mitigate the risk of fraud. However… As you mention, the person you are speaking to is frustrated with the time it takes to get their job done.
The best thing is the proper balance. Imagine this… If an…[Read more]
-
Fred Zajac posted a new activity comment 7 years, 3 months ago
62%
-
Fred Zajac posted a new activity comment 7 years, 3 months ago
84%
- Load More
Hi Fred:
Great post. I was very shock that Uber didn’t announced data breach and try to use money to cover up.
Fraser,
I don’t believe that UBER was hacked. UBER had a long history on setting on setting customers and drivers data. They always come with new stories about been victims.
A quick search on Google will give you the statistics about how many times UBER was hacked.