ZombiePineapple

Cybersecurity Professional, Software Engineer, and Multimedia Producer

[zombiepineapple]

Slingshots for a Spider

I recently finished (didn't take the test, I was just stumbling through the course, open mouthed and scared) the ineffable WEB-300: Advanced Web Attacks and Exploitation, from the magnanimous OffSec, which is the preparation course for the Offensive Security Web Expert certification (OSWE). The image is a very cool digital black widow spider, which makes sense, because the course is teaching you how to be an attacker on 'the web'.

As scared as I am of spiders, I am enamored by this course. Enough to stare at it for two years then finally take it and complete it over one grueling year. It covers things like: Blind SQL Injection - setting things up in a program called Burpsuite, to repeatedly try sending various things, then clicking a button, and seeing how a website answers, whether it gives us info or errors (which is more info!)

Authentication Bypass Exploitation - skirting around the steps that websites use to make sure you are who you say you are, like taking a 'reset password' click of a button, knowing some admin's email, and getting a database to spit out the token so we can get to the website to reset the password before the admin.

and Server-Side Request Forgery - making a server (someone else's computer in charge of doing real work instead of messing around with a human) ask its connections and resources to get something for you.

Now I know what you're probably thinking: Holy cow, where to even start? If you're not thinking that, congratulations. If you are, I've the answer: Tools. No spider is eating flies without sensing, lurking, biting... this metaphor to say: No one's doing it by hand with no help.

So what tools are helpful? How do you know what's good, what's useful, what's a dime a dozen, what's only going to do part of what you want versus all of it...

Luckily the fan favorites are famous for a reason. Just about anything you'd need is already downloaded into Kali Linux, which is jam packed with much, much more than the average hacker even needs!

Tools are dependent on what you need to do. For this class we need to inspect web traffic, recover source code, analyze said code of source, and debug things remotely.

Inspecting web traffic covers SSL / TLS and HTTP. SSL is Secure Sockets Layer and TLS is Transport Layer Security. These are literally just protocols (rules! internet rules that really smart people spent a lot of time figuring out) that encrypts traffic (mixes and chops and surrounds your communication, to keep it safe and secure). HTTP is the hypertext transfer protocol, which is another set of rules that figures out how information is going to travel between devices, like computers, web servers, phones, etc.

But do you always follow the rules? Exactly. Even by accident, a lot can fall through the cracks or go wrong. Being able to see *exactly* what's happening is pivotal in *taking advantage* of what's not dotting the i's and crossing the t's.

Possibly the most famous tool for web hacking, and the obvious choice for inspecting web traffic, is Burp Suite. It gathers info, can pause in the middle of talking to websites and connections that usually happen behind the scenes in milliseconds, like manipulating HTTP requests. You can easily compare changes, decode, the list goes on.

Decompiling source code is the one where you could find a million things that all do very specific things. For example dnSpy can debug and edit .NET assemblies, like .exe or .dll files that usually *run*, and don't get cracked open and checked inside. At least not by a normal user. .NET binaries are easier to convert back to something readable because it uses runtime compiling, rather than compiling during assembly. All you have to do is de-compile. It's the difference between figuring out what's in a salad and what's in a baked loaf of bread. One's pretty easy to de-compile. The other, you'd probably not be able to guess, unless you already knew, that there are eggs in it! dnSpy decompiles assemblies so you can edit code, explore, and you can even add more features via dnSpy plugins.

Another type of code objects useful to analyze are Java ARchive or JAR files. Another decompiler that's good for JAR files is JD-GUI, which lets you inspect source code and Java class files so you can figure out how things work.

Analyzing source code is another act that can come with a lot of options. Data enters an application through a source. It's then used or it acts on its own in a 'sink'. We can either start at the sink (bottom-up approach) or with the sources (top-down approach). We could do a hybrid of these or even automate code analysis to snag low-hanging fruit and really balance between time, effort and quality. But when you have to just *look* at something with your *eyes*, most people choose VSCode. VSCode can download an incredible amount of plug ins, like remote ssh or kubernetes, it can push and pull to gitlab, examine hundreds of files with ease, search, search and replace... I could go on!

Last need is remote debugging, which really shows what an application is doing during runtime (when it's running!). Debugging can go step-by-step through huge amalgamations using breakpoints, which can continue through steps, step over a step, step INTO a step (because that step has a huge amalgamation of steps inside of it too, of course it does!), step out of that step, restart from the beginning or from a breakpoint, stop, or hot code replace. And the best part? VSCode does this too!

Remote debugging lets us debug a running process. All we need is access to the source code and debugger port on whatever remote system we happen to be working in.

Easy, right? Only a few tools and all the time in the world... WEB-300 was mostly whitebox application security, research, and learning chained attack methods. For example, you'd do three or seven steps, which incorporate two or four attacks, rather than just one. It's more realistic, as just one attack usually isn't enough to fell a giant. And here there be giants. Worry not: we've got some slingshots now.

The next step is seeing if we can get them to work!

Useful links:

(PortSwigger Ltd., 2020), https://portswigger.net/burp/documentation

(DNN Corp., 2020), https://www.dnnsoftware.com/

(0xd4d, 2020), https://github.com/0xd4d/dnSpy

(ICSharpCode , 2020), https://github.com/icsharpcode/ILSpy

(MicroSoft, 2021), https://docs.microsoft.com/en-us/dotnet/csharp/language-reference/compiler-options/command-line-building-with-csc-exe

(Wikipedia, 2021), https://en.wikipedia.org/wiki/Cross-reference

(Wikipedia, 2019), https://en.wikipedia.org/wiki/Breakpoint

(Oracle, 2020), https://docs.oracle.com/javase/tutorial/deployment/jar/manifestindex.html

(Wikipedia, 2021), https://en.wikipedia.org/wiki/Integrated_development_environment

(Microsoft, 2022), https://code.visualstudio.com/(Wikipedia, 2021), https://en.wikipedia.org/wiki/False_positives_and_false_negatives

(Oracle, 2021), https://docs.oracle.com/javase/8/docs/technotes/guides/jpda/conninv.html#Invocation

[zombiepineapple]

A House of Brick

You want to know your cars are safe to drive, your plane's jet propulsion isn't hackable, and that when you didn't get those concert tickets, it wasn't because someone else used robots to steal them first. What if I told you building something safe is relatively new to the cyber landscape? That before something called DevSecOps, people would build whole websites, whole apps, then have someone try to attack it, then run repairs?

It's the equivalent of having one of the fairy tale piggies build their house out of straw first, then have the wolf come check it.

DevSecOps is the process of making sure you're building something strong before, during, and after the building process. It's having someone there to make sure you're using bricks, not straw, not wood.

Development, security and operations. It's the marriage between building something, making sure it works, and making sure its safe.

This is all based on the need for software that's of good quality, secure, and stable. DevSecOps makes software faster to create, easier to fix or update more often, and generally safer. Most importantly it brings security to the table during the build process rather than as an afterthought. This makes risk management much easier as well, looking forward to incidents rather than taking action after one.

What does a company need in order to perform DevSecOps?

1 - a decided strategy

2 - software application lifecycle concepts explained through various means which merge all three components of development, security, and operations

3 - reference guides with in-depth and technical information

Let's go over each:

1 - Strategy

This could be just a summary of goals from an executive board, it could be a set of principles the company wants to uphold, or even a set of requirements from a group in charge, like the government or shareholders. There needs to be some point on the compass to guide everything else.

Strategy in DevSecOps is about having several versions of action from higher management. This includes something called cATO, or Continuous Authorization to Operate. This is basically saying we do checks and real-time metrics through the whole software supply chain instead of taking a snapshot every 3 years. (Read the DOD DevSecOps Strategy Guide Here)

2 - Fundamentals, Guidebooks, and Playbooks

Basic lifecycles, topic-specific guidebooks or playbooks, white papers, industry best practices, using jargon and ideas that everyone knows, mapping tools and tasks, and keeping up with SMART metrics (Specific, Measurable, Achievable, Relevant, and Timely); You don't have to reinvent the wheel but you should be looking at the blueprints other people agreed work for wheel making when you're building one. (Read the DOD DevSecOps Fundamentals Here)

Guidebooks have topic-specific in-depth specifications and Playbooks are usually a single-page "plays" (think sports "plays") which have tips, points, checklists, and actionable tasks to take. (Read the DOD DevSecOps Playbook Here) (Read the DOD DevSecOps Fundamentals Guidebook Here)

You might hear the phrase CI/CD Pipeline, standing for Continuous Integration and Continuous Deployment Pipeline. This just means that we're checking things while we build, test, and deploy code. Don't get tripped up on the word "pipeline" - it's literally just referring to the fact that work is going sideways between people like water in a pipe.

3 - Getting Technical

A DevSecOps reference design document takes everything that came before it and gets even more technical, merging similar names for things and getting rid of redundancy or inconsistency. This way we're all on the same page of what exactly is happening or should be done.

Okay, so what does DevSecOps look like?

It looks like a bunch of meetings, collaborating between teams, feedback loops to check everything, and agile workflow (meaning everything goes round and round). DevSecOps changes the mindsets of a lot of teams and environments. A company has to pick a reference design platform with a cATO that works for their needs. When they do risk management, decimal percentages are multiplied in order to prove a company's level.

(for example, all four sections being 90% secure equates to .9 * .9 * .9 * .9 = .6561, so your company is actually only 65% secure, NOT 90%)

DevSecOps looks like a "software factory" sitting on a specific software supply chain. This factory has automation, process flows, control gates, pipeline controls, and flows like a wheel constantly checking for security and stabilization during code development.

This looks neat. Where to start?

Let's break down Strategy, where it all begins. Start with DevSecOps Guiding Principles:

If you haven't heard of the Agile Manifesto, you can read them here. Their principles basically state that people, code that works, and responding to change are more important than tools, documents, contracts, and plans.

The software factories run development, operations, and security simultaneously. You'll hear the term "baked-in security" eliciting the imagery that your software is a three-tier wedding cake, but again this just means we're all working together and communicating mid-development, not tossing the software back and forth like a volley ball.

Remember cATO is continuous testing and risk assessing people, platforms, processes using real-time analytics. This is concentrating on protecting assets, not network segments, a technique called Zero Trust Architecture (see NIST SP 800-27 for more detail).

"X as Code" or "Everything as Code" is good because things can go wrong when a human is following a guide step-by-step to set whole systems up. It also makes sure whoever's running the code knows exactly what's going to happen when they run it. There's a difference between reading and running a function versus just hitting a button and expecting results. It also sets up a "standard deployment model" - basically giving you a safe template to use for other software. This can easily be scanned, updated, scraped, and analyzed. Code is king because "code can be version controlled, tested, peer reviewed, and its execution (logs) tracked" (Unclassified, 2020).

You want everything cloud-smart and data-smart. A cloud is just someone else's computer, but it comes with perks like paying someone else to deal with storage space or your data's security, depending on the cloud service provider, CSP, you're using and what type of package you bought with them. Your architecture needs to be just as up-to-date and savvy with modern designs, though. Architecture is just as complex through cloud as it always has been.

Management structure is both bottom-up and top-down. Direction should be taken based on a company's mission statement (see my prior blog post for more on this). Automate everything you can. Be adaptable, transparent, and accountable. Use DODI 8510.01 for risk management framework and use CJCM 6510.01B for incident handling (but be aware of challenges like fluid system boundaries in microservice architecture, nontraditional system boundaries in distributed services and constant system evolutions).

All in all, here's what it looks like, including continuous monitoring:

For more information go to https://dodcio.defense.gov/Library/ and search for devsecops for an up-to-date declassified modern software practices.

Sources:

Rose, S., Borchert, O., Mitchell, S., & Connelly, S. (2020, August 11). Zero Trust Architecture. Csrc.nist.gov. https://csrc.nist.gov/publications/detail/sp/800-207/final

This document automatically expires 1-year from publication date unless revised. DevSecOps Playbook CLEARED For Open Publication Department of Defense OFFICE OF PREPUBLICATION AND SECURITY REVIEW. (2021). https://dodcio.defense.gov/Portals/0/Documents/Library/DevSecOps%20Playbook_DoD-CIO_20211019.pdf

Unclassified, U. (2021). DoD Enterprise DevSecOps Strategy Guide Department of Defense OFFICE OF PREPUBLICATION AND SECURITY REVIEW. https://dodcio.defense.gov/Portals/0/Documents/Library/DoDEnterpriseDevSecOpsStrategyGuide.pdf

What is a CI/CD pipeline? (n.d.). Www.redhat.com. https://www.redhat.com/en/topics/devops/what-cicd-pipeline

[zombiepineapple]

How to Create a Business "Risk Appetite"

From Mission Statement to Threats

In a paper titled “Enterprise cybersecurity study guide: how to build a successful cyberdefense program against advanced threats”, author Brian Ritchot explains how to develop security for an enterprise company by building its architecture based off the company goals and mission statement (Ritchot, 2013). This is based on the Sherwood Applied Business Security Architecture, or SABSA (Sherwood Applied Business Security Architecture, 2019). Taking the vision of an enterprise company, key words can be selected and decided synonymous with what are called proxy assets. These are given worth simply because they are effectively the company’s mission, which would affect the mission of the company in turn. Risks can be identified in relation to the proxy assets, then risk criticality assigned to each situation. Each risk can be then controlled with either a Key Performance Indicator (PKI) or a Key Risk Indicator (KRI) (Ritchot, 2013). A PKI tracks and measure the value of something over time while a KRI measure something’s risk and determines a threshold, or how much of a loss a company is willing to take before entering a warning state.

From here, a business-risk model can develop a trust model, which is the determination of anywhere two entities must transfer information and thus must register with each other in order to trust their connection (Sherwood Applied Business Security Architecture, 2019). Then a threat model prioritizes threats based on their criticality and chance of occurring. Lastly, safeguards take the inherent risk, before controls, and compare it with residual risk, after controls are implemented, in order to determine where there may be holes left in the cybersecurity framework (Ritchot, 2013).

Here's an example of this technique based on Johnson & Jonson's mission statement, taken from its website.

From Threats to Risk Appetite

From here we can identify risks where the proxy assets are affected in a negative way (Ritchot, 2013). Failed communications can interrupt connectivity, meaning J&J is failing at “togetherness”. If a product is stolen, or something goes wrong with a medical device, J&J is no longer as reliable, so they are not helping people be “healthier”. Ransomware can take the money J&J was using for charitable donations, meaning they are no longer “investing in the future.”

Now that we have our proxy assets, and our threats, we can assign levels of criticality and safeguards. Threats that are more harmful are assigned levels of either “severe” or “significant”. “Acceptable” risks only need to be monitored and kept at their current level, and “negligible” risks require no action (Ritchot, 2013). KRI’s should set thresholds for severe or significant threats so that notifications are sent if a situation enters a “warning state”. Threats that are severe and require KRI’s include the alteration of product code, the theft of medical data from on of their devices, the theft of company intellectual property such as chemical composition recipes, and ransomware attacks.

Continuing with J&J as our example: Threats that are significant and still require KRI’s include failed communications, such as a DDoS attack, stolen or damaged shipments, and product malfunctions. Threats that are acceptable and may continue up until a certain point, requiring only a KPI, include damages that prevent company growth or may even shrink the company for a small time, and international issues such as a natural disaster in a foreign country, falling out of favor politically, war in a country with the United States, and animosity for the Unites States, possibly bringing international hackers into play. An example of a negligible risk, where no action is needed, is if a separate party were to make knock-off versions of J&J’s products, selling them for cheaper and possibly hurting people with unsafe chemicals or dysfunctional medical devices. Whether any data was stolen from J&J is a concern, but inferior, off-brand versions of J&J’s products actually help J&J’s popularity, notoriety, and reliability.

Now that J&J’s assets and production lines have been scrutinized for moments of verifying trust, their mission statement translated into proxy assets, and identified risks assigned levels of severity and given either KPI or KRI controls, J&J’s risk appetite has been formed. Its security controls are working to support business service values, seeing risk as both a threat and opportunity that can bring the best operational and financial outcome (Ritchot, 2013).

Resources:

4 High-Tech Tools Johnson & Johnson Is Using to Get Products to You During the Pandemic. (2020, September 10). Content Lab U.S. https://www.jnj.com/innovation/johnson-johnson-supply-chain-technology-during-coronavirus

‌John. (2019, November 20). Johnson & Johnson Mission Statement 2020 | Johnson & Johnson Mission & Vision Analysis. Mission Statement Academy. https://mission-statement.com/johnson-johnson/

Products. (2018). Content Lab - U.S. https://www.jnj.com/healthcare-products

Ritchot, B. 2013. An enterprise security program and architecture to support business drivers. Technology Innovation Management Review. August 2013: 25–33.

Sherwood Applied Business Security Architecture. (2019, September 19). Wikipedia. https://en.wikipedia.org/wiki/Sherwood_Applied_Business_Security_Architecture

[zombiepineapple]

Some Other Dude Did It!

There is a common legal defense nicknamed "Some Other Dude Did It" or SODDI. Often, people on the stand can say their computer had malware or another person had their computer, and all in all, the case gets acquitted. Investigators even start their search and seizures with the wrong people because of mistakes about who did what, like on public Wi-Fi networks! This defense is particularly attractive in child pornography cases, despite it being extremely unlikely any malware would put images on someone's computer.

Usually the SODDI defense raises reasonable doubt, suggests that even if the accused *did* the act, it wasn't knowingly, and must prove there's actually malware on the device in question.

The prosecution can respond by proving the accused *are* in fact computer literate enough to have committed the offense, or at least knowledgeable enough to not simply allow malware to exist on their computer unbeknownst to them, punch holes in defense "facts" and alibi, and/or prove there was no malware on the suspected device in the first place.

If there really is malware, the prosecution has to explain exactly what that malware does, then prove with computer forensics that the malware didn't do what the defense claims it did.

If there is no malware, forensics can use wiping software and data backups on the device to see if there ever was.

From there it's a matter of explaining to a judge and/or jury all of the proof in a way they can understand.

Sources

Steel, C. (2014). Technical Soddi Defenses: The Trojan Horse Defense Revisited. Journal of Digital Forensics, Security and Law. https://doi.org/10.15394/jdfsl.2014.1192

SWAT Team Throws Flashbangs, Raids Wrong Home Due To Open WiFi Network – Infinite Unknown. (n.d.). Retrieved January 12, 2022, from https://infiniteunknown.net/2012/06/29/swat-team-throws-flashbangs-raids-wrong-home-due-to-open-wifi-network/

Brenner, S., Carrier, B., & Henninger, J. (2004). The Trojan Horse Defense in Cybercrime Cases. Santa Clara High Technology Law Journal, 21(1), 1. https://digitalcommons.law.scu.edu/chtlj/vol21/iss1/1/

[zombiepineapple]

Hiding Secret Messages in DNA Steganography

Cryptography is protecting data. Steganography is hiding it. There are several methods for hiding messages in DNA sequences. One recent study compared "three DNA-based techniques (substitution, insertion, and complementary) in terms of its capacity, cracking property, Bit Per Nucleotide (BPN), and payload.”

This basically takes a string of DNA and applies it as the variable in an algorithm. Which is best is decided by BPN. They found that substitution was most imperceptible and best for smaller messages. The insertion method was the hardest to crack while the other two eventually have a limit to how complex their BPN can get.

In the insertion technique, the secret message is inserted into the DNA sequence data.

The complementary technique is when one side to the DNA is changed to complement the other side, which is the secret message.

Substitution simply means whole parts of the DNA sequence are replaced by the secret message. Here you can see the translation key. The letter “A” in the secret message, for example, could be written as “GCU”, or any of the other three that equate in the key to the letter “A”.

Another case study of a similar method was “hiding undetectable secret messages within the single nucleotide polymorphisms of a genome and detecting mutation-induced errors.” This is basically hiding a message in a scientifically engineered cell. These secret messages show up as benign mutations so the body doesn’t reject the cells. It should be noted that any engineered cells should be watermarked (like one would an image) for various reasons.

Some are using PCR primers as the secret keys to the messages, because there are too many primers to brute force a DNA sequence. From there, a secondary key can be used in the form of an enzyme. So a scientist gets a cell in a petri dish, runs the enzyme on it, runs the PCR primer on it, writes down the DNA code, then goes to their key to decipher the secret message.

What will they think up next?

Sources

Terkawi, N. S., Berriche, L., Alamar, A. A., Albrahim, M. A., & Alsaffar, W. S. (2021). Comparative Study of Three DNA-based Information Hiding Methods. International Journal of Computer Science and Security [IJCSS], 15(2), 45+. https://link.gale.com/apps/doc/A687005442/CDB?u=lirn55593&sid=bookmark-CDB&xid=c64214be (Links to an external site.)

Na, D. (2020). DNA steganography: hiding undetectable secret messages within the single nucleotide polymorphisms of a genome and detecting mutation-induced errors. Microbial Cell Factories, 19(1). https://doi.org/10.1186/s12934-020-01387-0 (Links to an external site.)

‌ Cui, M., & Zhang, Y. (2020). Advancing DNA Steganography with Incorporation of Randomness. ChemBioChem, 21(17), 2503–2511. https://doi.org/10.1002/cbic.202000149

[zombiepineapple]

My First Puzzle (Write-up)

A couple weeks ago, I submitted this to one of my friends for a challenge for our Discord group DPS: Dead Pixel Sec. One person found the answer in 2 hours! I assumed it wasn’t all that hard after all. The whole time making it, I thought to myself “it has no transposition nor stenography, they just need to research old or popular ciphers. This is a good test to see where the others are at for stuff like this.” I snickered a bit, hoping it tripped them up even a little. Hoping they’d get a kick out of the cute answer to the secret word.

And then I found out I’d stumped a few people and I felt really hot! And then I realized people were half-solving it and using their big brains for the rest, or brute-forcing our poor moderator for clues. Some people were using this really cool (Russian) website that can let you websearch parts of an image (https://yandex.com/). So, no better way to learn and teach simultaneously than to release the write-up!

Here are your answers:

What I learned:

You’re going to notice there are a couple letters missing. I lost them! I swear, I had them when I made the puzzle and I didn’t think I was going to do a write up anyways but when I went back to put this all together. Nothing nothing nowhere nothing! If you know what alphabets I got the last two numbers from, send them to me here or on Discord at Zombie_Pineapple#1534. The biggest lesson I learned releasing my first public puzzle is that I should create my write up while I make the puzzle. No extra homework after and no pieces mysteriously missing. So you can see we’re missing two letters (one repeated twice).

Regardless, let’s use our big brains now and see what we’ve got of the message:

GET

REAL

O_

OUR

(U/V/W) ER_AT (I/J) LE

YURT_

What’s the secret word, dude?

The (U/V/W) could be any of those three. We could search the internet for any English words starting with Yurt and know that there’s only one other option: Yurts, meaning our mystery long word is “(U/V/W) ERSAT (I/J) LE”, which, needing a vowel instead of a J, would only make sense as VERSATILE. In the English language, the smaller word still missing a letter could probably only be ON or OF. (It was ON.) Regardless if you chose an F for that last letter, we still have our secret word to figure out. The hint is “dude” in the question. If you take the first letter from all the words, you get the secret word, and final answer, “GROOVY”.

Thank you to everyone who played my puzzle and I hope you learned some ancient or fun ciphers from it. Feel free to reach out to me for further information.

[zombiepineapple]

So You're Under Attack. What's Next? (The 10 Steps of Incident Response)

There are 10 Incident Response Process steps!

Identify that there’s an issue. Whether you get an alert, someone tells you they think something’s wrong, a third party notifies you, or it’s already reached the news networks, you don’t know something’s wrong until you realize: something’s wrong!

Investigate! Check your computers and check your accounts. Did the attacker use any specific tools, techniques, procedures or internet locations? Is the malware tunneling out to a malicious IP address? Have any blacklisted DLL’s been imported?

Collect Evidence! If the police are going to be involved, you’re going to need all sorts of evidence, not of just the attack, but what you did to mitigate during and after. Key things to look out for include:

· Financial information – personal and business related

· Personal information you can identify someone with

· Medical information

· International transactions – especially exports that are supposed to be regulated

Report Findings: You need to know the timeline of the attack, how this is going to affect normal business operations, how long will it take to bounce back, how much money might the company be losing, what exactly was your “Incident Response Plan” step by step and what all technical data can you include?

Containment! Clean or disconnect computers, find and block malicious software, disable user and service accounts or change their passwords, and block malicious IP addresses so the websites can’t connect.

Repairs: Analyze the attack, find “controls” that can prevent and notify you of this attack (remember you want to detect it before chaos ensues next time!) and think about if you need different trainings for your people.

Remediation: Change passwords and credentials if you haven’t already. Then wipe & rebuild, or manually clean computers and restore data from your backups.

Check it! Check it all! Your computers, accounts, network setup, security controls, any requirements your company needs to have. Know your future game plan. Write an “After Action Review” for closure and posterity. Ask yourself: what went wrong on your end? What could have been done better?

Conclusion: take your initial report and add facts that were missing at that point. You’ve got the full picture now, so you can safely state the timeline of events, what exactly happened, the impact it made, all and any technical data, what went well and what went poorly.

(Keep Calm and) Carry On: Remove temporary patches or incorporate them in your full-time security so they don’t stick out or trip your network up during future incidents.

And you're good! You may now return to threat hunting and making your castle so big brained and convoluted to attack that hopefully it will take some time before someone succeeds again. Remember: This happens to everyone and nothing is 100% defendable. Do your best and that'll be the best you can do. :)

Sources

Donaldson, S. E., Siegel, S. G., Williams, C. K., & Aslam, A. (2018). Enterprise cybersecurity study guide : how to build a successful cyberdefense program against advanced threats. Apress.

[zombiepineapple]

How Do You Hold a Cloud in Your Hand? (Securing Clouds and BYOD's)

Security in a Non-private Cloud

A “cloud” in technological terms, refers to a computer that a company is letting a customer use, out of sight and physical reach. The name often conjures up images of data sitting in the air, cyberspace wafting through our ozone, but tends to look more like hundreds of servers in humongous, chilled basements. When a company offers cloud services, several new challenges arise. This is especially true when using a non-private cloud.

The first challenge in securing a cloud is the actual development of the security controls, which are among the rest of the code (Donaldson et al., 2018). Developers must build, configure, install, and account for actual software in their scripts. Then they need to keep score of issues in order to continuously improve, in true Agile methodology form, and spur conversations with higher ups about future actions. The second challenge is to prevent a single breach of a cloud from taking the whole network down. This is overcome by separating, segmenting and isolating nodes, sites, user groups, and other scopes. This way, if one section goes down, the others aren’t affected (Donaldson et al., 2018).

The third challenge is making sure people who log in are who they claim to be. This can be a major weakness barely overcome by multi-factor authentication and a policy of Least Privilege. In addition, there should be careful attention to an account’s life cycle (Donaldson et al., 2018). Consider permissions granted when an account is created, it’s password controls, and what happens to the account when an employee is on vacation or terminated. The fourth challenge is how exactly to protect data. This comes down to encryption choices and key management techniques, like using better algorithms and rotating or backing up keys. As if your cloud were a physical lock box, you want a strong lock and you want to keep the key to it safe. The fifth challenge is to keep an eye on your cloud. You must be vigilant: Logging, monitoring, investigating, and improving. A baseline should be noted, alarms and countermeasures arranged, and frequent human oversight given in conjunction with automated monitors (Donaldson et al., 2018).

Next, a cloud must be reliable, both in the face of disaster and in the event that change is required. Customers tend to use clouds for their networks because they believe and depend on the cloud service to run 24/7 uninterrupted (Donaldson et al., 2018). This unfortunately means that a cloud provider is held to this standard and has to do their best to uphold it. Similarly, required changes are expected to be made immediately and seamlessly, which can be especially difficult if a cloud is extremely large or complex. Lastly, everything mentioned so far needs to be in writing, in some form, and usually needs to be agreed upon between a company and the cloud provider. Legalities and contracts need to be smoothed out, like if a company doesn’t want any of their information in servers outside the United States, or incident contingencies and assigned responsibilities. If disaster strikes, there needs to be clear evidence of fault and responsive procedures (Donaldson et al., 2018).

BYOD Policy Challenges

Your company is on “the cloud”, but now you need to account for all of the end-devices owned by each employee, which are connecting into the cloud to get work done. One person may have a Macintosh, another has a Surface Pro Tablet. Keeping your network safe in the increasingly popular “Bring Your Own Device”, or BYOD, world comes with its own set of issues which the company will need to account for in writing. BYOD policies take into consideration normal solutions, like requiring multifactor authentication and location awareness, among other type of device “sensors”, but have unique challenges mentioned as well (Donaldson et al., 2018). This might be its own legal agreement or merged inside of a data protection policy. The point is that if an employee oversees the device holding company data, they are responsible for keeping that data safe, and must agree to their company’s terms. This is a two-way street, however, because employees will have personal data on these devices. Expectations need to be managed before accidents occur, like an administrator wiping everything on an employee’s device or an employee’s family member getting into a work interface left open (Donaldson et al., 2018).

Phones are one of the biggest issues to account for. Phones, tablets, and even some types of computers don’t run the same operating systems as Macintosh or Windows desktops. This means they can’t use the same anti-virus, anti-malware, or intrusion detection systems. Mobile devices don’t have “root” access, are often at the mercy of their service providers, have their own version of applications and required coding adjustments when connecting online, and connect with cellular radios keeping them constantly connected and continuously in use (Donaldson et al., 2018).

Some companies require the use of MDM software, or Mobile Device Management, which can assure “Device inventory and accounting, malware scanning and detection, encrypted storage of enterprise data residing on the device, protected ‘sandbox’ for enterprise applications to run, secure application stores for enterprise-approved software, monitoring of device sensor use, including camera, microphone, and GPS, remote ‘wipe’ capability if the device is lost or stolen (Donaldson et al., 2018)”. Using MDM software may be the best option for a company, but it may dissuade employees from using their devices because they don’t want to risk losing their personal data. Agreeing to let the MDM software delete all data on your device is a scary decision. For example, most people have so many personal photos on their phones they cannot sync with their service provider’s cloud, and if their device were wiped, there’d be no way to get those photos back (Donaldson et al., 2018).

Conclusion

When a company uses a cloud service, they lose some control over the security of their data. This happens again in a different way when they let their employees work from their own devices. An enterprise business needs to pay close attention to all parties involved, what they’ve agreed to, and assigned responsibilities to keep their organization safe. The people, processes and tools involved in large infrastructures need to somehow still be arranged in a way that keeps the business working, efficient, and clearly designed (Donaldson et al., 2018).

References

Donaldson, S. E., Siegel, S. G., Williams, C. K., & Aslam, A. (2018). Enterprise cybersecurity study guide : how to build a successful cyberdefense program against advanced threats. Apress.

[zombiepineapple]

Security Architecture: The Paperwork Explained

When you do security for a large-scale company, something as big as a Fortune 500 enterprise, the architecture of your set up is going to come with some challenges, but it will all be worth it. You’ve got to keep organized and separate your network into different areas, or “scopes”, depending on how critical each area is to your business.

So when you do this, think of your network “logically” and “physically”. A logical network is a map of how the data flows. A physical network is the path the wires and devices make spatially in reality. You need to consider where packets are headed, and how the devices talk to each other, but also where things are located, like how close the server room is to the end-devices using that network.

LOGICAL EXAMPLE:

PHYSICAL EXAMPLE:

Here you can even see purple clouds around buildings, indicating the reach of their Wi-Fi. That would be handy to know, for example, to prepare for wardrivers, who might drive on your company’s street in the hopes your signal reaches the road.

I would argue that physical security is more important because many people overlook it, and all the cybersecurity in the world can’t help if an attacker can simply walk into your server room. People who are hired to protect computers tend to know more about using a computer for protection rather than, for example, whether the door hatches fit correctly, or if a clothes hanger can be slipped through to pull a handle from outside.

You need to consider when devices are outdated and guestimate when they might break on you. You need to make sure you have all the proper policies worked out on paper, and that following those policies actually works. You need to know how much your company can actually protect itself. It’s unwise to think your company can be completely 100% secure. You want to cover as much of your “attack domain” as possible, using preventative controls, detective controls, audit controls, and forensic logs.

Then you need to write your policies down! Your policies come in 4 parts: Definition, Standards, Guidelines, and Procedures.

A document defining your policies is first: you need to define your assets, which you need to protect, then explicitly state who is in charge of keeping those assets safe. Lastly, this needs to come with consequences – what happens if these assets aren’t safe. What’s the worst case scenario? Remember there are four kinds of assets: Equipment, People, Facilites, and Data.

Security standards documentation is second! Clearly state protection levels for all your assets, so we know how critical they all are. For example, an administrator’s password, gaining access to 400 servers, is a whole different level of importance than a cashier’s log in for a single money box at a store.

Guidelines are write-ups from a parent company to a subordinate company who is allowed to write their own policies. The parent enterprise is saying “Hey you can do whatever you want for your security policy, but stay between these general borders with it.”

Procedures are the nitty-gritty details for even the lowest-level employee. This is to keep us all on the same page, so we all know exactly how and what we are supposed to be doing.

In conclusion, knowing what you need to do is half the battle. After implementation, the upside is you know what your strengths and weaknesses are, and though you may not be able to protect against every attack, you are at least ready for any attack.

References

Donaldson, S. E., Siegel, S. G., Williams, C. K., & Aslam, A. (2018). Enterprise cybersecurity study guide : how to build a successful cyberdefense program against advanced threats. Apress.

[zombiepineapple]

We've got you Surrounded: The Future of Tech

Computers Everywhere

When the topic of surveillance comes up, people tend to realize just how many devices they have, but they may not know how many of these devices are able to connect to each other. It can be difficult to visualize the interweaving of nodes on even a home network, especially for people who are not technologically inclined. These “smart devices” were associated with the term “Ambient Intelligence” because they can automatically collect information on a person without direct user interaction, then make choices for the user based on habits.

Three things make up Ambient Intelligence: Pervasive Computing, Ubiquitous Communication, and Intelligent User Interfaces. It should be noted that this post will not focus on Intelligent User Interfaces at all. Pervasive Computing is defined as a “computing environment where information and communication technology are everywhere, for everyone, at all times.” (Tavani, 2012) This is the concept of technology being integrated into absolutely every object and part of life. Ubiquitous Computing is a synonym for Pervasive Computing but in practice has the unique communication method of “ensuring flexible and omnipresent [connectivity] between interlinked computer devices that can be stationed at various locations” (Tavani, 2012).

Ambient Intelligence

Ambient Intelligence can make many simple tasks automated. For example, a smart fridge could make a shopping list for a busy parent and even send a request to have the groceries delivered (Tavani, 2012). These remedial tasks can seem daunting when they pile up, but technology can handle simple tasks and integrate them into making human life easier. Research and development can also be spurred by Ambient Intelligence. There’s more data, faster communications, better algorithms, and real-time results. This is the next step in cyber evolution: from keeping expansive databases of personal information to personalized and enveloping connected technology. This is a special interest of advertisers as well. An AI could predict what a customer needs without prompting and show them the place to buy from automatically. People would see advertisements that are incredibly specific and relevant to their lives.

A company’s code of conduct should come into play, especially, concerning privacy.  It’s the responsibility of the employees to know and communicate intricacies of their devices and their device’s role, intended and extraneous, in a customer’s life. Claiming no accountability because a customer agreed to terms and conditions through product purchase isn’t enough. Failure to communicate can break several ACM ethical principles. Failure to follow principles 2.5 and 2.7, meaning a company has not evaluated possible risks nor raised public awareness about them, can lead to breaking principles 1.2, 1.3, and 1.6: dishonesty causing privacy breaches and possible harm (Code of Ethics, 2016). Ambient Intelligence comes with freedom and autonomy concerns. What if a customer would have made a different choice without Ambient Intelligence’s sway? Taking away a boring task may also remove the opportunity for spontaneity or creativity, which would lead to personal growth or exploration. This relates to ACM principle 1.5 because it lessens the opportunity for work required to make new ideas. This leads into possible technological dependency (Code of Ethics, 2016). If there’s a technological failure or problem, are the people using these life-encompassing networks able to find their own solutions? This could affect human-wellbeing, principle 1.1.  Privacy concerns are probably one of the biggest issues on the table. How can a person keep their privacy if they are surrounded by technology that is watching them, logging, and analyzing their personal lives?  Furthermore, if a person doesn’t care to watch their own network traffic, they can’t know who their data is being sent to, leading to possible breaches of principles 1.6 and 1.7: respect of privacy and confidentiality (Code of Ethics, 2016).

Pervasive Computing

Imagine every small and large thing in life is wired and connected to each other. From utensils to entire walls, pervasive computing completely permeates every object in a person’s life. This leads to real-time actions, meaning a piece of technology can immediately react to a human. There’s no wait-time for constant and consistent back-and-forth (Xue, 2011). Furthermore, this technology can be invisible to people, like inside a table, or in clothing. It’s transmitting without any human interaction. A very interesting concept developed from Pervasive Computing is “calm-technology” (Seth, 2010). This flips the use of technology, from a device that a third-party uses to contact a customer, into a world built for asymmetrical human interaction. In a “calm-tech” world, a person is only given their text messages or calls when they ask to see them. They are not notified, nor interrupted. Going further with this idea, technologies can change from room to room to create specific environments built for different uses. Augmented functionality would have a user set their environment like they might a separate network, or a bundle of devices (Seth, 2010). Of course, this could backfire by encouraging people to live in their bubbles, preventing real-world issues and empathy-evoking troubles from reaching the people privileged enough to help.

Businesses’ codes of conduct should take careful consideration in making sure this type of technology is easy to check, correct, and fix in the case of faulty choices made by the AI. These technologies are so weaved into life that users will be much more likely to use them without knowing how they work. This type of product usage works well with, for example, a television, which one can replace instead of fixing, but entire networked rooms promise a great deal of troubleshooting. If it’s too easy to use, but too hard to correct, customers may find themselves at the mercy of the rooms they’re in. This means Pervasive Computing can become a disservice to society, especially for non-technical people. Lastly, ACM’s first principle also mentions that all people are stakeholders in computing (Code of Ethics, 2016). This implies that a customer’s interests and safety should come before a third-party advertiser’s. However, many companies already sacrifice customer data and use customer time and attention as an economic asset for advertisement revenue. It would be naive to think this would not be integrated into Pervasive Computing as much as possible. So, this concept runs the risk of influencing customers contrary to their best interest, in favor of another company’s best interest.

Ubiquitous Computing

Ubiquitous Computing helps connect devices, even over long-distances. One of the main technologies using this concept is RFID (Tavani, 2012). RFID can be easily printed, very small, and stickered onto any object. This has prompted RFID-based social creativity, like lanyards for conventions, scan areas for tourists, art, and games (RFID Party Wristbands For Party And Meeting Planners, 2016). Ubiquitous Computing is also great for researchers. For example, microchipping wild animals to watch their migratory patterns (How to scan for a microchip, n.d.).

Company’s should be very wary of Ubiquitous Computing, and be sure to include references to them in their codes of conduct. RFID, for example, can be scanned and reproduced, possibly giving physical access to a building (Tavani, 2012). One main ACM concern is 1.6: respecting privacy (Code of Ethics, 2016). For example, should there be analysis of logs created automatically of employee movements, due to their work lanyards giving away their positions? People may feel like they are being unduly surveyed by Ubiquitous Computing, especially if they are surrounded by it, which may lead to feelings of technological pollution. It may be a breach of societal well-being to create an environment of panopticon (Tavani, 2012). These connected, non-segmented networks may be a security risk and may be socially and mentally oppressive.

Conclusion

These emerging technologies have the challenging duty to walk an ethical tightrope. Between always helping and always watching, connecting out and trapping within, or autonomous choices and targeted advertising. Inevitably, these new technological concepts will be at the direction of big businesses and at the mercy of consumers, with ethics adjusting in the center, to hopefully guide both sides.

References

Code of Ethics. (2016, June 7). ACM Ethics. https://ethics.acm.org/code-of-ethics/

How to scan for a microchip. (n.d.). Www.pet-Detect.com. Retrieved June 13, 2021, from https://www.pet-detect.com/pages/How-to-scan-for-a-microchip.aspx?pageid=536

RFID Party Wristbands For Party And Meeting Planners. (2016, May 20). RFID Card, Proximity Card of Huayuan RFID, the RFID Manufacturer. https://www.rfidhy.com/rfid-party-wristbands-party-meeting-planners/

Seth, R., Kapoor, R., Al-Qaheri, H., & Sanyal, S. (2010). Piecemeal journey to 'HALCYON' world of pervasive computing: from past progress to future challenges. Informatica, 34(2), 189+. https://link.gale.com/apps/doc/A232715917/CDB?u=lirn55593&sid=bookmark-CDB&xid=7e09340e

Tavani, H. T. (2012). Ethics and technology : controversies, questions, and strategies for ethical computing. John Wiley & Sons, Inc.

Xue, W., Luo, Q., & Ni, L. M. (2011). Real-time action scheduling in pervasive computing. Informatica, 35(2), 269+. https://link.gale.com/apps/doc/A262037007/CDB?u=lirn55593&sid=bookmark-CDB&xid=45974b3b

[zombiepineapple]

Ethics for (New) Tech

Consider these three ideas:

1. Freedom and Autonomy

2. Technological Dependency

3. Privacy, Surveillance, and the “Panopticon.”

Now let’s apply these ideas to a new technology: Google Glass, which has been revamped since its original disparate unpopularity. We hated how it looked because it reminded us that the wearers of the glasses could scan our faces and learn about us in real time, and we couldn’t see what they saw. This leads into the “Panopticon”, which is a prison system set up so that a person knows they’re being watched, possibly all the time, which in turn changes their behavior. They could effectively socially engineer while walking down a busy street. Even if the users of Google Glass weren’t using it on a person, the fact that the glasses constantly record and offer information makes the people around feel as if they are being watched, which spurs paranoia and distrust.

There is also a lot of disdain for the possibility of people becoming dependent on the glasses. Running into walls by accident because they couldn’t stop looking an inch in front of their eyes. This is similar to how some feel about phones, but this time the phone has an active AI and it’s attached in front of your eyes, so you don’t have to “put it down”.

This leads into the technology possibly infringing on a person’s autonomy. With Google making every decision you could ever want, there’s no need to use one’s own abilities, or make one’s own choices. This could easily be taken advantage of. For example, a restaurant that pays for ads with Google being recommended over another restaurant that may be closer or more accurate for the type of food requested.

A technological convergence could jeopardize a company’s code of conduct if it results, even unintentionally, in any breach of ACM principles. We absolutely need to account for those possibilities when we create or update code of conducts.

So before using or creating a new technology, especially one that incorporates tech already developed (in other words, standing on the shoulders of giants) make sure you ask yourself if any situation involving this new tech could breach an ACM principle: https://www.acm.org/code-of-ethics

Resources

Tavani, H. T. (2012). Ethics and technology : controversies, questions, and strategies for ethical computing. John Wiley & Sons, Inc.

Ethical Considerations of Google Glass. (2016, March 22). PREMag; PREMag. https://prestudentconversation.wordpress.com/2016/03/23/ethical-considerations-of-google-glass/

‌ https://www.acm.org/code-of-ethics

[zombiepineapple]

CIA Model for Enterprise Security

There are three main parts of cyber defense, or the CIA Model: Confidentiality, Integrity, and Availability (Donaldson et al., 2018). These three concepts make up the CIA triad, which an attacker looks for cracks in and defenders must constantly attend. If a company has poor confidentiality, their data or their customer data may get stolen. If there’s too much access in a company, people may be unnecessarily privileged to security systems or other network segments. If an attacker is able to modify data, such as in a (wo)man-in-the-middle attack, or by changing inputs in a database, the integrity of the security system is compromised (Donaldson et al., 2018).

Implementation Challenges

Three challenges associated with implementing the CIA triad in a cybersecurity program include people, financial backing, and public collaboration. Firstly, people are not perfect. There will always be instances of a policy well intended but thwarted by an individual making a mistake or being unaware of the consequences to their actions. The seven layers of the OSI Model are often covered profusely, but the eighth layer, the human layer, is rarely mentioned or accounted for. Many professionals assume that if they can set their networks up properly, it will compensate for any employee or customer ignorance, either innocent or negligent.

Secondly, many companies only have so much time, resources, employees, and money to pour into their cybersecurity programs. There’s only so much that can be done, and only so many hours in a day to do it. This leaves many companies in the middle of transitioning, or building their defenses. While all cybersecurity set ups should be constantly improving, leaving holes in the hopes that they simply won’t be attacked is not effective nor safe.

Thirdly, many companies have their cybersecurity personnel sign agreements which prevent them from discussing the issues their company has in their defenses. This keeps professionals from having proper discourse and sharing ideas that could lead to creative solutions and stronger defenses.

Vulnerabilities

Confidentiality

Some vulnerabilities in association with confidentiality include security architecture, network segmentation, and system administrators. Knowing exactly where sensitive data resides is one of the most important mitigations for a poor security architecture (Donaldson et al., 2018). Databases, servers, and backups need to be closely watched and protected. For example, if a system administrator knows they use Amazon Web Services for their servers, but doesn’t know where their servers are physically located, those devices are at risk (Tomsho, 2020). Network segmentation is useful for all parts of the CIA triad. Keeping one group of employees separated from another keeps a network organized and encourages a policy of least privilege. Most importantly for confidentiality, network segmentation can make it harder for an attacker who has accessed one part of the network, to get to another part (Tomsho, 2020).

Lastly, system administrators are refered to as the “achilles’ heel of most enterprises [because] if attackers can get access to [their] credentials, they can bypass all other data protections and frequently do so with little or no audit trail to reveal their actions (Donaldson et al., 2018).” There are simple solutions to this, such as giving each administrator a different privileged user account that is logged and audited with more care than an average user. Time restrictions can be put on when the account may be in use, multifactor authentication should be implemented, and passwords should be changed frequently (Donaldson et al., 2018).

Integrity

Some vulnerabilities in association with integrity include political and reputational issues, publicly financial data, and under preparedness for ransomware attacks (Tomsho, 2020). Political instigators and sensationalized reputations can catch fire in the public discourse. If a company is targeted for political or activist reasons, the attackers can be inspired to risk everything in order to cause as much damage as possible. This can lead to vandalism, hijacking, fake news, and social disparity (Donaldson et al., 2018). Publicly financial data, while not as much an attraction for gossip, can lead to more sophisticated hackers looking for big payouts for richer victims. This works both ways with banks as well, because many money transactions happen online. The Sarbanes-Oxley regulations were put in place to protect financial data integrity for this very reason (Donaldson et al., 2018). Lastly, if a company isn’t prepared with proper backups for a ransomware attack, they could lose all their data.

Availability

Some vulnerabilities in association with availability include distributed denial of service attacks, targeted denial of service attacks, and physical destruction. “Distributed Denial of Service (DDoS) attacks are used to effectively disable services in the victim enterprise or country. These techniques have been used in the past several years, and they can take significant portions of the victim’s Internet capabilities offline for some time until they are mitigated. (Donaldson et al., 2018)”. A targeted DDoS attack usually pinpoint one company, resulting in a network having to be rebuilt if it can’t be recovered. Physical destruction goes along the same lines as sabotage or vandalism. If a company’s devices and data aren’t protected properly, and people have access who shouldn’t, a company can be completely deleted, unable to service their customers.

Conclusion

Attackers have the advantage of dark-web sales and high levels of public discourse for attack methods and scripts (Donaldson et al., 2018). There are libraries dedicated to brute forcing, videos that teach social engineering, and hacking classes available online. In order to keep networks and data from being accessed, changed, or stolen, the CIA triad should be a top priority for any cybersecurity professionals.

References

Donaldson, S. E., Siegel, S. G., Williams, C. K., & Aslam, A. (2018). Enterprise cybersecurity study guide : how to build a successful cyberdefense program against advanced threats. Apress.

Tomsho, G. (2020). Guide to networking essentials. Cengage Learning.

[zombiepineapple]

Case Study: Hades Ransomware

With the emerging idea of making it illegal for companies to pay ransoms, I thought it prudent to do a little write up on a recent malware, named "Hades".

First, it's important to mention that most malware is derivative, meaning an attacker takes what someone has already made, makes a few tweaks, and it gets a new name.

The Hades Ransomware, made by a hacker group called Gold Winter, recently had its special characteristics released and explained. It's a copy of a malware called Wasted Locker, but has had some obfuscation (cryptography that jumbles plain words into nonsense, so humans can't read it) and also got a bit of a makeover, graphically. So it looks like new software.

Hades is usually aimed at high profile victims who have more money to pay the ransom with. Here's a screenshot of what people see on their computers once Hades has locked it:

A few interesting things about Hades: It doesn't seem to be for sale on the black market, so it may be some group's private pet project. It's also very neighborly with other insidious programs. It recognizes and uses other malware in its attack vector (fancy word for how it attacks - think of drawings on a soccer field for the players to follow) and will even copy other malware's messages, as if paying homage!

This could be the group trying to earn clout with other groups, in order to gain popularity and trust on the dark web. It's also a little respectful tip-of-the-hat as if to say "you got here first."

Gold Winter gives each victim a personalized onion website, with their very own support chat box to talk with the attackers. This helps companies pay the ransom smoothly and quickly. A common joke you may have heard is that ransomware can have better customer service than most legitimate software!

With the recent pipeline incident, and malware attacks always on the rise, I feel like it's too easy for people to look at a Security Administrator or team and simply claim they weren't being proactive or didn't have proper security in place. It's important to know every company has a vulnerability, it's just a matter of locating it. No security plan is perfect and many times, security managers are treated with the Locksmith and Goalie issues.

The Locksmith problem is that it takes years and years to learn how to locksmith quickly and when you're first starting out and you struggle for an hour or two on a lock, people see you working harder so they're happy to pay you for opening their door. But after a few years, or a whole career, customers are very angry to pay for a task that took you five seconds to complete, even if it took 30 years to perfect! Suddenly because it looks easy, no one thinks it's difficult.

The Goalie issue pertains to the lack of appreciation goalies get in soccer. Their job is to keep the ball from getting past them, and no one seems to notice the work they do as long as the ball doesn't score. Then, if the other team gets through, the goalie gets a lot of negative attention. This is why there's a lot of depressive disorders among goalies. When they're at their best, they're invisible.

An amazing security architecture works the same way. It takes practice, sweat, and tears to make it look effortless, and regular employees or customers tend to be unaware of it until there's a breach. It's a thankless job.

References:

Experts Shed Light On Distinctive Tactics Used by Hades Ransomware. (n.d.). The Hacker News. Retrieved June 17, 2021, from https://thehackernews.com/2021/06/experts-shed-light-on-distinctive.html

https://www.secureworks.com/blog/hades-ransomware-operators-use-distinctive-tactics-and-infrastructure

https://www.virustotal.com/gui/file/1526fc970cdb0e5a69f0ca2284d12312c6f7c9d0e77aa264aa4260411a4f03e7/detection

https://www.secureworks.com/research/threat-profiles/gold-winter

[zombiepineapple]

Answering a few questions about Free Speech online

Free Speech and Exceptions

Originally a Greek ideology, freedom of speech is extremely important to our culture and legislation (History.com Editors, 2018). The United States first amendment promising the freedom of speech without government censorship helps people share information, communicate, protest, make symbolic statements and more. The supreme court has had considerable cases to draw lines in the sand, showing us what we can and can’t say. Generally, speech that promotes hatred, violence, or slander are denied the freedom to circulate (History.com Editors, 2018). This can be very interpretive, however, as one person’s truth can be another’s lie, and opinions can be perceived as strength by one person, and violent by another.

Internet Censorship: What keeps Platforms from Censoring Properly? Does Internet censorship deny the right to free speech?

The internet tends to follow the same rules as the US legal system, but grey areas make things difficult. For example, during the COVID-19 pandemic, YouTube content creators would have their videos demonetized if they said the word “covid” in their videos (Stokel-Walker, 2020). This was a choice the platform made in order to give priority to authoritative sources and deter the spread of misinformation. YouTube had good intentions, but ended up censoring too strictly, inspiring people to find loopholes in order to subvert the rule completely. One example was that people began saying “CV” phonetically instead of the word “covid”, which was enough to get around the censorship checks (Stokel-Walker, 2020). A famous phrase “first coined by internet pioneer John Gilmore [states] ‘The Net interprets censorship as damage and routes around it.’ (Chander, 2015)"

Another issue of internet censorship is that some types of illegal speech are made egregiously simple with the internet, like plagiarism or child pornography. Large platforms can have difficulty sifting through their users to stop these types of situations, especially when there’s so much blatant violence to regulate (Marantz, 2020). Violations flying under-the-radar or actively trying to remain hidden can elude law enforcement by hiding behind overwhelmed internet platforms with little or non-specific monitoring and censorship.

Online platforms must worry about political and public sway as well, not just legality. Whether it’s “flag burning, cross burning, public display of profanities, violent video games, lies about having military honors, depictions of animal cruelty, non-obscene sexual expression, [or an] offensive protests outside a private funeral trigger[ing] the concerns that animate the Free Speech Clause... free speech controversies repeatedly find themselves intertwined with contemporary political and public policy battles. (Chen, 2020)” This can mean that the most popular or controversial examples are given the most attention, resulting in more extreme censorship, rather than any agreed consensus or enforcement. This also leads to platforms that knowingly exchange less censorship for more users and financial gain.

Corporate Free Speech: How can a company incorporate free speech issues into their best practices and code of conduct? Does the ACM Code of Ethics cover this issue?

The best way for a company to incorporate free speech in their codes of conduct is to consider scenario-specific intent and consequences. If an intent or result of speech breaks a principle of the ACM Code of Ethics, that speech cannot be considered included in the person’s first amendment's right. For example, discriminatory speech in the workplace, harassment, or bullying, all which can lead to harm (Code of Ethics, 2016). A person cannot speak in an unethical and dishonorable manner and expect to be protected. A metaphor for this is that a person cannot fire shots from behind a shield. So, though the ACM Code of Ethics doesn’t explicitly touch on first amendment rights, ethical standards including freedom of speech can still be formed.

Does Fake News Equate to Free Speech?

Incorrect information can cause real damage. “One day in 2013, a false rumor, circulated on Twitter, caused the stock market to lose $200 billion in value. Someone hijacking the Associated Press Twitter account had falsely reported injury to the President, sending the market into a swoon. Lawsuits for damages would have spelled the death of Twitter” but no lawsuits were filed because the first amendment protected the media platform (Chander, 2015). While some types of Fake News can be considered libel, some types are simply too hard to pinpoint blame, and may result in questionable harm. For example, there are too many hands at fault for the internet rumor claiming the coronavirus vaccine had miniscule microchips in them because of a mass surveillance conspiracy theory led by Bill Gates (Carmichael, 2020).

Censorship can keep false facts from spreading, but rumors snowball into online groups and communities spreading the information as if it’s sensible public opinion requiring discourse. fake news connects like-minded people and “promote(s) expressive experiential autonomy” (Chen, 2020). This means that Fake News has “Free Speech Value”. The fact that this type of speech is useful to some people, aligning with an original intent for the first amendment’s encouragement of democracy, means that all fake news must count as protected free speech. Fake News can only be removed if there is proven harm resulting from the story, causing the right to be revoked (Chen, 2020).

Conclusion

As the concept of Free Speech has formed the internet, the quandaries of the evolving technology have brought more and more questions in how to further define Free Speech. Most decisions tend to be based on evidence of injury after-the-fact. As legislation catches up to today’s cyber world, new boundaries will be set. Until then, Free Speech online remains a type of wild west, where the rules depend on where you happen to be.

References

Carmichael, J. G. and F. (2020, May 30). The Bill Gates “microchip” claim fact-checked. BBC News. https://www.bbc.com/news/52847648

Chander, A., & Le, U. P. (2015). Free speech. Iowa Law Review, 100(2), 501+. https://link.gale.com/apps/doc/A398524041/PPCJ?u=lirn55593&sid=bookmark-PPCJ&xid=f302009e

Chen, A. K. (2020). FREE SPEECH, RATIONAL DELIBERATION, AND SOME TRUTHS ABOUT LIES. William and Mary Law Review, 62(2), 357+. https://link.gale.com/apps/doc/A650781945/PPCJ?u=lirn55593&sid=bookmark-PPCJ&xid=d1397461

Code of Ethics. (2016, June 7). ACM Ethics. https://ethics.acm.org/code-of-ethics/

History.com Editors. (2018, August 21). Freedom of Speech. HISTORY; A&E Television Networks. https://www.history.com/topics/united-states-constitution/freedom-of-speech

‌ Stokel-Walker, C. (2020, March 30). YouTube’s Independent Creators Are Mad That They Can’t Say “Coronavirus.” Medium. https://onezero.medium.com/youtubes-independent-creators-are-mad-that-they-can-t-say-coronavirus-e7b16ae844fa

Tavani, H. T. (2012). Ethics and technology : controversies, questions, and strategies for ethical computing. John Wiley & Sons, Inc.

Marantz, A. (2020, October 12). Why Facebook Can’t Fix Itself. The New Yorker. https://www.newyorker.com/magazine/2020/10/19/why-facebook-cant-fix-itself

[zombiepineapple]

What Threat does Social Media Pose to Businesses?

Company Concerns Regarding Social Media

Social media can be used many ways with differing results. These advanced communications like Facebook or Twitter can have amazing and destructive effects all at once, sometimes building the hype, or excitement and popularity, of a company to new heights and sometimes leaving a business in ruin from a boycott in “cancel culture” (Cancel Culture, n.d.). Two concerns companies should have pertaining to social media are, firstly, their employee's usage of personal accounts at work, and, secondly, how their company uses social media as its own entity. Both contain unique threats for businesses.

Employees Using Social Media at Work

Employees cannot help but log on to their personal social media accounts during work hours, whether it’s from a personal phone or even a company device. Often, they do this without hiding their identity and end up sharing information about their company or work (Lee, 2020). This doesn’t tend to be neutral and will usually have a positive or negative slant, leading to a kind of unwanted brand representation. Employees will use social media for a variety of reasons: Enjoyment, self-enhancement, venting, addiction. This can be bad for companies and employees for several reasons (Lee, 2020).

Employees that use social media often during work hours can become overloaded with information and excess communication, exhausting them and hurting productivity (Yu, 2018). Social media addiction can hurt a person mentally and physically as well, leading to lack of sleep, backache, eye strain, envious feelings, shallow management of relationships, and tendencies to seek approval from others (Priyadarshini, 2020). Employees can use social media to bond with each other outside of work, but even this can lead to controversies and strife at work when online conflict arises (Beatrix, 2014). This can be aggravated by power dynamics at work having to translate somehow in private online communications. Employees online can put companies at risk of more than a bad reputation. They could accidentally release sensitive work information, trade secrets, or reveal network vulnerabilities (Tavani, 2012). Lastly, they could connect to unsafe websites that may try to infiltrate the company.

To mitigate these risks, many companies either ban social media usage outright or have strict policies. When on the company’s network, an employee should expect little to no privacy, even when visiting a private account (New York City schools issue guidelines for employees' using social media, 2012). This practice has become commonplace for companies around the world, some even making policies that restrict and direct social media usage during off-work hours (Beatrix, 2014).

Company Social Media Outreach

Social media controlled by a company, in order to interact with the public and consumers could not be farther from how personal employee social media is viewed. A businesses social media strives to put the company in the best light possible based off a concept called Corporate Social Responsibility, or CSR (Stohl, 2017). CSR’s goal is to make a company as internationally, ecologically, economically, and socially responsible as possible (Fernando, 2021). Companies want to respect diversity and the right to free speech while communicating with transparency. Social media helps them share information with large collections of stakeholders en masse and control their own image by responding to unflattering reviews and complaints (Stohl, 2017).

If a company isn’t careful, however, they can fall prey to the rest of society on a platform. “Cancel culture” is the act of boycotting or banning a company, person, or product for various reasons. Something “cancelled” may undergo public humiliation, loss of shares or profit, brand injury, loss of customers and business opportunities (Cancel Culture: How to Protect Your Business from Being “Cancelled,” n.d.). A very recent example of this was Spain’s postal service’s public campaign, which released a video and several stamps colored various shades of skin types (#EqualityStamps, n.d.). They were trying to make a statement about racism in order to raise awareness and work towards societal equality. Their ad claimed the “Equality Stamps … reflect an unjust and painful reality which should never exist.” This backfired because they made the skin-colored stamps different prices (Goodman et al., 2021). The “white” skinned was the most expensive, meaning a person would need more of the other stamps to equate to how far a white one would ship a package. There was public outrage and a few days later, the stamps were removed.

Conclusion

While personal employee usage of social media can hurt a company’s work force and possibly put them at risk of leaking vulnerabilities, a company’s own social media platform can be just as dangerous if not properly handled. Social media holds many threats for businesses because of its effect on its employees, brand image, and the undeniable reliance on a fickle and outspoken public. Employees are best managed with work policies, and companies should be sure to hire professional and knowledgeable individuals for their social sites. Overall, social media usage should be carefully planned and monitored, with generic public apologies at the ready to mitigate possible “cancellations.” These scripts can be rounded out in real time with genuine behavioral policy changes that meet stakeholder and public needs. This will keep a company up-to-date in their CSR.

References

Beatrix M P van, D. (2014). Social media and the employee's right to privacy in Australia. International Data Privacy Law, 4(3), 222-234. http://libproxy.ecpi.edu:2055/10.1093/idpl/ipu015

Cancel Culture: How to Protect Your Business from Being “Cancelled.” (n.d.). Ecowarriorprincess.net. https://ecowarriorprincess.net/2020/02/cancel-culture-how-to-protect-your-business-from-being-cancelled-2/

#EqualityStamps: The stamp collection that reflects the unjust reality of racism | Correos. (n.d.). Www.youtube.com. Retrieved May 30, 2021, from https://www.youtube.com/watch?v=Yq3dftc2q0k

Fernando, J. (2021, February 2). Corporate Social Responsibility (CSR). Investopedia; Investopedia. https://www.investopedia.com/terms/c/corp-social-responsibility.asp

Goodman, A., Andrew, S., & Chavez, N. (2021, May 28). Spain’s postal service ends its skin color-inspired stamp campaign that made the lightest stamps the most expensive[Review of Spain’s postal service ends its skin color-inspired stamp campaign that made the lightest stamps the most expensive]. CNN; CNN. https://www.cnn.com/2021/05/28/world/spain-stamps-skin-color-trnd/index.html

Lee, Y. (2020). Motivations of employees' communicative behaviors on social media: Individual, interpersonal, and organizational factors. Internet Research, 30(3), 971-994. http://libproxy.ecpi.edu:2055/10.1108/INTR-06-2019-0264

New York City schools issue guidelines for employees' using social media. (2012). American School & University, http://libproxy.ecpi.edu:2048/login?url=https://libproxy.ecpi.edu:2281/trade-journals/new-york-city-schools-issue-guidelines-employees/docview/1010620810/se-2?accountid=142826

Priyadarshini, C., Dubey, R. K., Kumar, Y. L. N., & Jha, R. R. (2020). Impact of a Social Media Addiction on Employees' Wellbeing and Work Productivity. The Qualitative Report, 25(1), 181-196. http://libproxy.ecpi.edu:2048/login?url=https://libproxy.ecpi.edu:2281/scholarly-journals/impact-social-media-addiction-on-employees/docview/2350114073/se-2?accountid=142826

Stohl, C., Etter, M., Banghart, S., & Woo, D. (2017). Social Media Policies: Implications for Contemporary Notions of Corporate Social Responsibility: JBE. Journal of Business Ethics, 142(3), 413-436. http://libproxy.ecpi.edu:2055/10.1007/s10551-015-2743-9

Tavani, H. T. (2012). Ethics and technology : controversies, questions, and strategies for ethical computing. John Wiley & Sons, Inc.

Yu, L., Cao, X., Liu, Z., & Wang, J. (2018). Excessive social media use at work: Exploring the effects of social media overload on job performance. Information Technology & People, 31(6), 1091-1112. http://libproxy.ecpi.edu:2055/10.1108/ITP-10-2016-0237

[zombiepineapple]

The Copyright Conundrum

The theft of intellectual property is given different parameters when applied to the cyber world. This is for a few reasons. For one, programming code (which, personally, I love the pseudonym "codified thought") is very easy to copy or pull from programs downloaded or purchased. For two, that code balances a fine tight rope between something unique/useful/nonobvious (the requirements to patent something) and something that, if released into the world, could revolutionize the way we treat and use technology.

So on one hand, we've got a creator that deserves the money from their effort and sweat, and on the other hand, we've got an increasingly depleting common cyber landscape filled with people starving for information they can't afford, which would benefit everyone to be released.

This is where Richard Stallman's idea comes in, that “information wants to be free”, because much of cyber information and code was created to be shared. Money restricts that, defeating the purpose. Working against Stallman's argument, we could note that some people create for the purpose of financial gain. These types of works are the easiest to understand as someone's property, so it's easiest to see when it's stolen. Whether things other than software can be considered "wanting to be free" would rely on the concept of if it was designed to be shared or promote communication and education, versus if it's meant to act on an economic choke, with a supplier and a buyer who's agreed to terms and conditions restricting further distribution.

Lessig's Creative Commons is absolutely the easiest and best choice to go with to date. In this case, when you post your work, you tell the world the type of creative commons you want to apply to it. So, creative commons clearly states a creator's intent, gives a diverse choice between the various types of distribution versus ownership, and is simple and popular enough for the non-legalese to understand.

But what about groups of people? The plot thickens when you get into businesses. See, in most corporations, there tend to be agreements signed by employees that anything they create belongs in copyright to the corporation as its own entity. This isn't always the case, but should be kept in mind. There's still some debate today about whether corporations should have the same rights as a person, and copyright is a huge issue reliant on those choices.

All in all, if you make something, ask yourself if it's a product, or a possible technological revolution. Would people benefit educationally if you picked a type of creative common over another? And did you make this to share it, or to make money? It's okay if it's both, but one over the other should be a priority. This will prevent a student from becoming a thief, and draw clear lines between a product and a contribution.

What do you think? Comment below to chat.

Resources

Copyright Ownership of Content in a Business | Digital Media Law Project. (n.d.). Www.dmlp.org. Retrieved May 25, 2021, from https://www.dmlp.org/legal-guide/copyright-ownership-content-business

‌Tavani, H. T. (2012). Ethics and technology : controversies, questions, and strategies for ethical computing. John Wiley & Sons, Inc.

[zombiepineapple]

What Can Social Media Sites Do To Fix Privacy Concerns

Much of the data in the cyber landscape is given by users or customers and gathered and benefitting companies. The exchange is often a customer giving up the rights to their data in order to use the company’s service or platform, like in Facebook’s case (Terms of Service, 2019). This seems unfair because it is. I’d like to draw everyone’s attention to the five rules of the Code of Fair Information Practices:

There must be no personal data record-keeping systems whose very existence is secret.

There must be a way for a person to find out what information about the person is in a record and how it is used.

There must be a way for a person to prevent information about the person that was obtained for one purpose from being used or made available for other purposes without the person's consent.

There must be a way for a person to correct or amend a record of identifiable information about the person.

Any organization creating, maintaining, using, or disseminating records of identifiable personal data must assure the reliability of the data for their intended use and must take precautions to prevent misuses of the data. (Center, n.d.)

These could easily be followed by companies. Just think of all the other various forms of settings you can go through to decide different choices in your experience of an online service. How simple would it be to have a section called “You Data” with checkboxes of what you’d like to share and what you’d like not given to third party advertisers.

This would cost these companies a lot of money, and public outrage dies down after time when an ethical breach is discovered. These big online names aren’t held accountable, so why would they care to act accordingly? Another solution could be, the more third-party cleared data a person approves, the more mini-games or rewards they are given. They could be emailed links to what happened with their data, and what the statistics look like resulting from everyone who participated. This may change user activity because they can see the results from their actions in an analytical format, but that's a very good thing! We want people to be conscientious about how they act online, what they click on, whether they have a stopping cue in an infinitely scrolling page, how long they spent exactly playing that click bait game.

This reminds me of the "black mirror" analogy from the TV show of the same namesake. When you put information out there, you're only seeing yourself, like when the screen goes dark and you see a flash of yourself sitting at the TV. Giving people the ability to see themselves in large data pools may give a better impression of being a part of something, not being a worthless statistic in a sea of corporate greed. Looking at user data you know includes you helps you change and grow to be and act as a better version of that. Large companies use personal and advertising data to influence society, and they're sorely missing out on an opportunity to turn it into a conversation between customers that can change much much more.

I think businesses, especially social media sites, should be held to these high standards, and we should expect this from any company. Personal data being shared in any manner should be a personal choice, and the hard stop limit should be biometrics. Biometrics should never be shared under any circumstances by a company because if they’re misused, they can’t be replaced. You (probably) can’t go change your face or your fingerprints like you could change your password if it’s stolen (Tavani, 2012).

~Jullian

References

Center, E. P. I. (n.d.). EPIC - The Code of Fair Information Practices. Www.epic.org. Retrieved April 18, 2021, from https://www.epic.org/privacy/consumer/code_fair_info.html

Tavani, H. T. (2012). Ethics and technology : controversies, questions, and strategies for ethical computing. John Wiley & Sons, Inc.

Terms of Service. (2019). Facebook. https://www.facebook.com/legal/terms