Articles – Page 3

With apologies to Shakespeare, this month’s technology article has nothing to do with deception, however, I think that the first part of this famous line is very appropriate as it relates to today’s technology. As technology becomes more sophisticated and complicated, it begins to weave itself in and out of the fabric of every aspect of our society.

So much so, that it can be exceedingly difficult to unweave the technology from our daily lives. In particular, I’ve been following a couple of aspects of technology over the past year and what I am seeing concerns me as they both offer wonderful futures but at the same time, I am convinced that the impact of these technologies hasn’t been fully investigated and thought through and by the time that this has been done, it will be next to impossible to unweave these technologies from the fabric of our society.

I have been following the development of 3D printing, literally, since it was just a concept. I think that in general 3D printing will have phenomenal benefits in a wide variety of applications, but as we’re seeing now, once the lid of possibilities has been lifted and therein lies the concern as not all applications are good applications.

Already, manufacturers of 3D printer “plans” have distributed the schematics for a working pistol made completely from 3D generated parts. The ability for anyone who has access to a 3D printer being able to produce any type of weapon – effectively bypassing – criminal code laws is staggering.

Given that Pirate Bay has recently announced that they will support and administer a 3D Design file-sharing repository, I have significant concerns that there will be not only be issues with there being various designs of weapons, but also the doors will be opened wide for counterfeit parts and the mass production of items and parts that are currently protected by copyright.

This technology will either be a lawyer’s dream or nightmare. The other area where I have concerns is with the rapidly developing prototype of autonomous – or self-driving – cars. Again, this sounds wonderful in concept and in some aspects, our roads will be safer as – in theory – a vehicle can make decisions quicker and more accurately, however there’s a plethora of issues that I’m not convinced have been thought through properly.

First and foremost – to what extent will the driver still be responsible for the operation of the vehicle and any ensuing accidents? Although the current generation of autonomous automobiles is predicated on the premise that the driver has to be actively engaged and ready to take control, I wonder how much an individual’s attention will be on the road if their hands aren’t on the steering wheel and constantly – and actively – observing conditions and reacting accordingly. One of the theories of a society where there are autonomous vehicles is that they will be able to communicate with each other which will make roads safe. If four autonomous vehicles approach an intersection with a 4 way stop then the cars could communicate with each other and the order of precedence could be evaluated and shared. However, what if one of the vehicles is driven by a human, how will this factor in the collective’s decisions as to how to proceed.

My primary concern though is that with the advent of technology, there will always be those that will exploit any level of security to compromise the device. We’re seeing it with any technology currently in the marketplace, so how can we put our lives in the balance with a vehicle that’s infected with malware?

There’s no question that our society benefits from technology, but as in these two cases, technology is being developed without the proper foresight and protocols in place to ensure that the risks are minimized.

It’s next to impossible to unweave this technology from the fabric of the society, it’s in everyone’s best interest that the pros and cons have been weighed and evaluated and contingencies developed.

By: Rick McCallion

Rick is a seasoned software developer with over 25 years of experience in designing and developing systems. In addition to the software development experience, he is also experienced in training users with various skill sets and assisting organizations in determining their information technology needs.

Rick has taught numerous courses at Front Runner for mature audiences with limited computer experience. He teaches with patience and simplicity, in order for everyone to follow and feel comfortable with the software to use on their own.

Rick welcomes any comments, suggestions or questions. This article, along with many others, can be found on his blog at http://techumanity.blogspot.com

Just the other day the Canadian Military began investigating why a 30 GB hard drive was found in a computer hardware recycling depot, still containing its personnel’s personal information.

In the past I have been asked by a top lawyer to “just grant” his summer student the same access to network files as his access rights, since he didn’t have the “time” to figure out what is appropriate.

A manager of IT security I worked with was found not to have changed his network password for 15 months just prior to a PCI/DSS audit, even though the company policy was to change passwords every 45 days.

A secretary left their email password as the default one, “Welcome1”, thinking it would be easier to remember. Not understanding that since the company still used single factor authentication to access email on the internet, it left their email open to anyone who cared try the password.

All of the examples of security errors above deal with people being people… some didn’t have the time to worry about, some didn’t think or know of the possible consequences of their actions, and possibly someone didn’t care.

Any of the above situations can be remedied by a little common sense, providing training, enforcing policies and understanding best practices.

In the first case existing policies were not followed… was it willful? I doubt it. Most likely the hard drive ended up not being destroyed, because mandatory security training is often only given to “full time” employees… not contractors. The contracting company pays lip service to passing on the policies to its employees in an attempt to save money on the contract. Hence the person that sent the drive to be recycled probably thought they were doing the right thing by saving the environment.

The second situation would have been avoided, if a pre-approved role based access system was employed to ensure that students were given access to what they need (as attested by management) from the start. Pre-defined roles make on-boarding quicker and more secure… leaving the guess work out for the administrators, who have much more important things to do.

The third issue is solved by following best practices, making existing password policies mandatory and enforcing domain password policies without overrides. When someone higher up calls for the IT administrator to provide a policy over-ride, they need to be asking themselves, is it in the best interests of the company.

Finally “Welcome1” didn’t get changed because nobody turned on the switch to say “Force user to change password on next login” when it was reset. Even with the switch set IT security training would show the secretary that “Password1” their second choice, which does meets complexity requirements as well would be a bad idea and that a random pass phrase would be much more appropriate.

It all sounds simple, however… again we go back to people, time and desire to use the path of least resistance.

The good thing is that I have found in my 17 year career, most people will “do the right thing”, if they know what to do, and the consequences of not doing it.

IT Security Awareness training classes put on by Front Runner teach best practices and discuss the reasons we need to keep everyone involved. Contact us for details and how we can customize a course for you.

Taking the time to listen and understand what is being conveyed by your instructor can save your company and you personally the heart ache of being on the wrong side of a hack.

In future issues of Bug & Plugs, I will get deeper into the many subject areas of IT security and how they affect your company and possibly you personally.

Until next time…

Ilmar Kutt – Security Consultant
CISSP, MCSE, ITIL v3 and CISA candidate

What a Tangled Web We Weave

By: Rick McCallion

IT Security is everyone’s business…