Network Security: Social engineering

As part of the Network Security class I am taking I was required to respond to a case study in the Security+ Guide to Network Security Fundamentals textbook.  I thought the case study presented a realistic example how social engineering can be used to gain access to a companies network and included a summary of the case study and my response below.

 Case Project 2-6: Community Site Activity

Case project 2-6 involves reading a security case study involving an auditor who was hired to determine if he could gain access to the network of a corporation. The CEO of the corporation proudly proclaims the auditor will not gain access to the corporate network because the network is secure and the company operates in a confidential and secret manner. The auditor uses social engineering to discover information about the CEO, then uses the information to have the CEO willingly open an email attachment, opening a back door into the corporate network (Ciampa, 2012, p. 77). The full case study can be found on page 77 of Security+ Guide to Network Security Fundamentals.

After reading the case study, the following questions are asked: What would you say to the CEO? Why? What recommendations would you make for training?

According to the case study, the auditor was able to determine some information about the CEO via Facebook.com. I would recommend the CEO not have an account on Facebook.com, but if the CEO insists on having a Facebook account he limits the amount of public information to only his name. Unfortunately, Facebook does not make it easy for users to change security settings and verify their account is not sharing more information than the user wishes to share. According to a June 2011 post by Graham Cluley from at Sophos, “Most Facebook users still don't know how to set their privacy options safely, finding the whole system confusing. It's even harder though to keep control when Facebook changes the settings without your knowledge” (http://nakedsecurity.sophos.com/2011/06/07/facebook-privacy-settings-facial-recognition-enabled/). I would also recommend the CEO limits the amount of public information available on other websites (e.g. Twitter, Flicker, blogs, etc) as easy access to information about the CEO is what allowed the auditor in this case study to penetrate the corporate network.

I think it would be advantageous for all companies to hold quarterly security training. Since the world of network/IT security is changing at such a fast pace, 15,000 – 20,000 new phishing attacks are launched each month (Ciampa, 2012, p. 60), IT professionals must continually educate end-users as to what the new attacks are and how they operate. Another recommendation is for companies to create a corporate intranet where new security attacks are updated on a weekly basis, thereby, allowing end-users to stay on top of the latest security threats.

Finally, security training must educate end-users on both the software vulnerabilities (e.g. inserting a USB drive from home into a company computer), and the social engineering vulnerabilities such as providing a caller with information about the company computer (e.g. type of operating system, vendor of anti-virus, etc). Unfortunately, companies regularly place tools with company secrets and access to company networks (computers, smart phones, tablets) in the hands of their employees without continually educating the employee how to securely use the tools they are given. While no company will ever be 100% safe from malicious attacks on their network and devices, we can minimize the number of successful exploits by continuing to educate end-users.

Verizon and the CR-48

As many of you know by now, I am one of the fortunate ones who received a Google CR-48 notebook computer.  I recently activated the 100 free megabytes per month promotion that comes with the notebook; activation was easy and only required me to create a Verizon account.

I decided today to inquire how I might add more data to my monthly allowance, and I contacted Verizon via phone.  After spending nearly 30 minutes with 3 different Verizon representatives explaining what the CR-48 is and how I receive 100MB of data each month for free with Verizon, I was finally told that Verizon has never head of this arrangement, but would treat the data usage as pre-paid mobile broad band.  The last gentleman to help me also informed me that mobile broad band is relatively new and therefore, very expensive.  See below for the rates and data usage amounts I was quoted.  The Verizon representative continued to explain that if I planned on watching any Youtube videos 5GB was not going to be enough, adding that none of the data plans would really allow me to do much on the Internet.

Rates and usage as quoted by Verizon representative

• 5GB for $80
• 1GB for $50
• 300MB for $30
• 100MB for $15

After ending my call with Verizon, I did what I should have done in the first place, I Googled CR-48 and Verizon.  Upon reading some posts in a CR-48 forum, I came across the following post from Google, http://www.google.com/chromeos/features-connectivity.html .  According to this post, the rates are much different than what the Verizon representative quoted me (see below).  Although I'm still not sure how increase my monthly data allowance, the post by Google give me hope that I can afford to purchase some more bits!

Rates and usage as quoted by Google

Data plans

Plan	Price
100MB of data per month1	Free
Limitless day pass2	$9.99 per day
Additional 1GB of data3	$20 per month
Additional 3GB of data3	$35 per month
Additional 5GB of data3	$50 per month

Flow

I received my beta invite to Flow, a new task manager that claims it will change the way I work; I'm not sure if the developers realize just how big of a task they have in organizing my life. Setting up my flow account was super easy, and 2 of the 3 fields required for account set up were pre-filled.

I am impressed by the sleek looking user interface, and the handwritten description of what a tab or button does makes the interface appear really friendly.

I rely heavily on my Android phone as my go to device, the one device I always have on me. Unfortunately, Flow does not mention anything about developing an Android app at this time, although, they state an IPhone app is in progress. Until I am able to access my grocery list on my phone while I am at the grocery store, I'm not sure how practical flow will be for my everyday use. However, I am looking forward to giving flow a try for my non-mobile tasks.

Anyone looking for a new task management application should head over to http://getflow.com/ and register for a beta invite so you can give Flow a try for yourself.

Verizon to sentence top users to reduced bandwidth

After reading an Engadget post about Verizon's plan to throttle its top 5 percent of wireless data users, I'm left pondering the if the 5 percent stated by Verizon is truly 5 percent? According to the terms of service posted on Engadget, "if you use an extraordinary amount of data and fall within the top 5 percent of Verizon Wireless data users we may reduce your data throughput speeds periodically for the remainder of your then current and immediately following billing cycle to ensure high quality network performance for other users at locations and times of peak demand." To summarize, the top 5 percent of wireless data users will have their bandwidth speeds reduced for the remainder of the current billing cycle, and the following billing cycle. Theoretically, if the top 5 percent of data users are placed into a pool of reduced bandwidth users, a new top 5 percent of data users could, and should, emerge. For example, if I am a heavy wireless data user and my bandwidth speed is now filtered, it will now take me longer to download the same amount of content as it did before the filtered bandwidth sentence. Therefore, my wireless data usage should naturally drop as a result of the sentence, thereby allowing someone who was previously in the top 6 percent of bandwidth users to take my place in the top 5 percent pool. The question is what is the true bottom of the 5 percent pool?

The other question is will Verizon disclose to its customers sentenced to reduced bandwidth that indeed their bandwidth is reduced, or will the customer be required to call Verizon customer service to complain about slow download speeds, only to find out they've been sentenced for using too much of the service they are paying to have?

Setting static IP address on network printer

The printer I was working with was a HP CP1518ni. The first step was to select an IP addresses that is not part of the dynamic IP pool. Then I used the printer menu on the printer itself to set the static IP address I selected in step one. I was also prompted to set the subnet mask and gateway too so be sure to have this information available. Because this printer previously had a dynamic IP address, I went to the ports tab on the printer configuration menu (in XP - Start/Printer & Faxes/right click on printer and select properties) and placed a check in the box next to the new static IP address I selected in the previous step. Finally, I printed a test page to verify the printer was properly configured.

Happy printing!

Hello 2010

I saw the following post by Peter Aursnes on twitter the other day and I think his statement can help inspire us to achieve our goals in the new year. Happy New Year!

Beware of always learning and never doing. Trust yourself- that you already have the seeds of greatness inside of you.

- Peter Aursnes

Toothpaste

As I was brushing my teeth this morning, I decided to read the information on the tube of toothpaste to pass the time. The tube I am using is a sample size of Crest Sensitivity, given to my wife at her last dentist visit. I discovered a couple points of interest under the Drug Facts heading.



1: Warnings: when using his product do not use longer than four weeks unless recommended by a dentist.

I have only used this toothpaste for two consecutive days so I am safe from the dangerous reprocussions of using this product past the four week mark, but this raises a question: what happens after using this product longer than four weeks without a dentist's recommendation?

2. Keep out of the reach of children. If more than used for brushing is accidentally swallowed, get medical help or contact a Poison Control Center right away.

Now that I am done brushing my teeth, and enjoying a fresh cup of coffee, what did I put in my mouth? As I sip my coffee, I can't help but wonder if I'm swallowing any poison that maybe left in my mouth. I fell alright, so I guess my body is able to handle small amounts of poison, just not more than what is used for brushing?

3. Directions:

• do not swallow
• 12 yrs. & older: Apply at least a 1-inch strip of the product onto a soft bristled toothbrush. Brush teeth thoroughly for at least 1 minute twice a day (morning and evening) or as recommended by a dentist. Make sure to brush all sensitive areas of the teeth.
• do not use in children under 12 yrs.

A couple of questions come to mind:

1. Applying at least a 1-inch strip of product is recommended, but what amount is considered more than used for brushing?
2. What happens if a child at 11 years of age uses this product? What occurs within our bodies between the age of 11 and twelve helps us fight off the dangers those under 12 years of age face when using this product?

I am not singling out Crest, this just happens to be the tube of toothpaste I grabbed this morning, and I believe I would find similar warnings on other brands of toothpaste. I guess the bottom line is while I meet the general requirements: over 12 years of age and will not use longer than four weeks, I do not meet the main criteria for this product; my teeth are not sensitive.

The Dash

I was sent this poem in an e-mail, and was would like to share this poem with all of you. I found this poem to be inspirational, motivational, and perfect for self-reflection. Enjoy!

The Dash
copyright 1996 Linda Ellis



I read of a man who stood to speak
at the funeral of a friend.
He referred to the dates on her tombstone
from the beginning...to the end.

He noted that first came the date of her birth
and spoke of the following date with tears,
but he said what mattered most of all
was the dash between those years.

For that dash represents all the time
that she spent alive on earth...
and now only those who loved her
know what that little line is worth.

For it matters not, how much we own;
the cars....the house...the cash.
What matters is how we live and love
and how we spend our dash.

So think about this long and hard...
are there things you'd like to change?
For you never know how much time is left
that can still be rearranged.

If we could just slow down enough
to consider what's true and real,
and always try to understand
the way other people feel.

And be less quick to anger,
and show appreciation more
and love the people in our lives
like we've never loved before.

If we treat each other with respect,
and more often wear a smile...
remembering that this special dash
might only last a little while.

So, when your eulogy is being read
with your life's actions to rehash...
would you be proud of the things they
say about how you spend your dash?

Time Management

I just finished watching the Randy Pausch Time Management Lecture, and what a great lecture it is. For those who may not know, Randy passed away July 25, 2008 after a battle with Pancreatic cancer. Randy gave this lecture earlier this year, knowing his time was limited, and therefore has instant credibility of knowing how to manage time.

If you enjoy the Time Management video, you may also enjoy Randy's Last Lecture video.

Enjoy!

Pheasant hunting in Minnesota

According to an article published in the St. Cloud Times, last year was the best year for pheasant hunting in Minnesota since 1964! I wish I would have taken more time to go pheasant hunting last year. According to the article, 655,000 rooster were shot in 2007. Does this mean 2008 will not be as productive?

You can read the full article here - it's a quick read.

Gas Saving Tips

Concerned about high gas prices? No, don't join the "put Exxon out of business" campaign, I think Exxon appreciates all the free publicity from chain-mail. Instead, read this money saving article by lifehacker. You may be surprised to know that according to the article, using your air conditioner makes little if any difference on your fuel efficiency! I also found the online gas trackers like GasBuddy.com, and GasPriceWatch.com interesting.

Just encase you feel you're beings squeezed at the pump, I included a reader's comment from the lifehacker article belo. See, we don't have it so bad.

• digitalgravy at 04:24 AM on 06/10/08 *

  hah! $4 a gallon?! it cost me 116.9p (£1.17) a litre! that's £5.31 / gallon which works out at $10.39 a gallon!! You guys over the pond have it easy!!
  grrr!

Where would you go?

I saw this question asked asked on another blog by Paul Kedrosky, and I thought, "I wonder how my friends would answer"? So here's the question asked on Paul's site.

A question for people to ponder: Say you were 22-years-old, unattached, and recently graduated and looking for your first job. You want to be part of something big and dynamic, a truly dynamic economy where you're going to be able to rise up with it.

The U.S. has long been that place, and maybe you think it no longer is -- or maybe you do. Whatever. Where in the world -- visas aside -- would you go?

How about you? Where would you go, from San Francisco to Sao Paulo, from Singapore to Shanghai, from Sydney to Slovenia to Saskatoon. The world is changing rapidly, and the "right" answer from 1998 isn't likely the right answer in 2008.

DNA Testing

Here is an interesting article from the New York Times about government oversight for DNA testing. What do you think? Should the government regulate DNA testing?

Bumper stickers and your car

Interesting short read on personalizing things in our life. http://replicatorinc.com/blog/?p=35

Naps

You will enjoy reading this interesting study on napping, published by the Boston Globe. According to the study, napping is good for our mind and body, and feeling sleepy mid-afternoon is normal. You can read the complete article at http://www.boston.com/bostonglobe/ideas/naps/ Now, I just need to sell my boss on the benefits of an afternoon nap. Oh wait, I am the boss; I hereby mandate all employees take a 45 minute nap every afternoon from this day forward!

Twitter

After resisting for as long as I could, I finally broke down and registered for a twitter account, and I'm hooked! For those who may not know, Twitter is a mini-blog/social networking site that allows you to post your status with 140 characters or less. Twitter asks a simple question, "What are you doing?", and your responses are logged. The neat feature Twitter offers is the ability to follow others. While the thought of "following" others is somewhat stalker like, the advantage is you see what others are doing as soon as they submit their post. Although many people on twitter post exactly what they are doing right now (i.e eating ice cream), I find the most interesting posts are those that are informational (i.e. Barack Obama just clinched the Democratic Nomination).

If the concept of Twitter does not sound interesting to you, I encourage you to try it before making your decision final. Just head over to www.twitter.com and register for a free account. You can then follow me, troythetechguy to get a feel for how Twitter works. By the way, here is a little jargon you'll want to know. When you post an update on twitter, it's called a tweet!

XP copy Tip

I know I discuss Linux a lot, and that's because Linux rocks! However, from time to time we may have to use Windows. Here is a quick tip when copying in Windows XP.

http://www.online-tech-tips.com/cool-websites/windows-no-to-all/

How The Internet Works

While searching for a video on youtube.com to help me understand a networking concept for one of my classes, I came across this neat video by the History Channel explaining how the internet works. You can watch the video at http://www.youtube.com/watch?v=u0WGGa2gIws

How to use Photoshop

I found this neat video on how to touch up photos using Photoshop. CAUTION: This video is not for those with low self-esteem.

Enjoy!

Click here to watch the video

The worlds cheapest car

With close to $3.00 per gallon gas, this car could give American car manufactures a run for their money! According to the short article on Crunch Gear, this car cost s $2,500, and gets a energy efficient 50MPG! Click here for the full story.