Cyber Security Awareness Month #CyberAwareTips

October has been deemed "Cyber Security Awareness Month" by many major security companies and it's something, that if used correctly, could be of great assistance to those that might not be as cyber-savvy. I've been posting a few tips to Twitter with the hashtag #CyberAwareTips, along with many others. Let's see how much traffic we can generate with this hashtag and get the word out this month. 

An interview with Andy Yen (Creator of ProtonMail)

I was recently given the opportunity to correspond with Andy Yen, creator of ProtonMail, regarding his encrypted email service and the current state of internet privacy. ProtonMail, which has been posted about multiple times on this blog, is growing at a rapid pace and is one of the most popular encrypted email services available. Through our correspondence I was able to ask Andy his opinion on internet privacy and what’s in store for the future of ProtonMail. Also, make sure to add a donation towards ProtonMail and spread the word about his company. Here’s a few questions Andy graciously answered for us:

What prompted you to start your own email service based on privacy? Was there a defining moment you can remember?

“The defining moment was two years ago when I tried to find a good way to keep my email communications secure and private. All of the existing solutions (mostly involving PGP) were simply too difficult to use, and since a good service didn't exist, the only solution was to create it ourselves.”

In your opinion, besides email, what is the largest threat to privacy on the internet today?

“The biggest threat is actually cultural. Nowadays, we have the Facebook, Snapchat, Instagram generation, which are young people being trained from a young age to share everything online without giving it a second thought. This trend can permanently alter the definition of privacy within a generation or two.”

What are your suggestions to a new generation coming up that see's privacy as more of an afterthought?

“I always joke that it will be very interesting to watch a US presidential election in 20 years where the old Facebook posts and instagram photos of the candidates resurface. I think it's important for the new generation to remember that what goes out onto the internet is permanent. Once you share a photo, you can NEVER take it back, and it could mark you for the rest of your life.”

Honestly, protecting privacy can be bad for business. Have you had push back from large organizations or governments regarding your service?

“Actually no, businesses large and small now understand that privacy is important. This is because, what businesses need more than ever is actually security, and encryption technologies like ProtonMail bring the security which ensures that cyberattacks like the Sony hack are a lot harder to pull off. Security is the goal, but privacy is the end state that comes with security.”

Over the past year I've personally noticed the increase of the ProtonMail service. Will ProtonMail always be free?

“We know that many of our users who need privacy the most (activists in Russia, China, etc) are also those that most cannot afford to pay. Thus, we are committed to keeping the basic version of ProtonMail free for as long as possible.”

Do you foresee any additional privacy services spawning off of ProtonMail in the future? I've heard rumors of a mobile app. Would you ever branch off into secure storage?

“Actually, our mobile apps have already been released in beta and we have several thousand beta testers using the apps today. In the future, we also intend to expand into storage since that is a commonly requested feature from our users.”

In what ways can our readers help assist continue making ProtonMail the best private email service out there?

“There are several ways in fact. The first is to get the message out about how bad the current surveillance state is. Many people simply don't realise they are being constantly tracked, monitored, and recorded online. Secondly, it is important to encourage others to also use ProtonMail because the most secure email system in the world cannot turn the tide if we don't get the world on board. And lastly, for uses who are interested in assisting us directly, it is possible to donate to the project here: protonmail.ch/donate”

Protect Healthcare Data Now!

Healthcare data has become “en vogue” for hackers and it’s no secret that they’re looking for it. The risk to the patient and the cost a hacker can get for the data is much higher than any other record that can be stolen now.  I wrote the following blog describing this issue, why it’s important to protect the data and how the industry is taking this problem head on. Hope you like it.

http://www.tripwire.com/state-of-security/security-awareness/why-is-healthcare-data-so-valuable/

When Encryption Can Hurt You

I wrote this article after seeing too many companies NOT performing SSL interception on their internal networks. Attackers are using encryption to protect stolen data within your network. If you don't have a way of detecting this traffic, you're leaving the door wide open for an attacker to walk out undetected.

Here's the full article:

http://blog.algosec.com/2015/09/is-encryption-one-of-your-biggest-network-security-holes.html

FireEye 0-Days for Sale

Two security researchers, Kristian Hermansen and Ron Perris, found four zero-day vulnerabilities within FireEye's solution. They've blown one of the vulnerabilities on the internet to prove that what they have is a big deal and that there's more to come. Shortly after they leaked the first 0-day the researchers announced that the remaining vulnerabilities are now for sale. This comes after 18 months of frustration from the researchers attempting to have the vulnerabilities fixed, without no avail. This is either an exaggeration or they weren't submitting the vulns to the FireEye bug bounty (which I seem highly unlikely).

This becomes a major concern for FireEye, and it's customers using their products, since they pride themselves on finding 0-Day vulnerabilities as part of their offering and now have multiple ones available for sale against their product. You can read FireEye's White Paper and view on why finding 0-Day threats are so important on their website.

Vulnerabilities are found every day against major software vendors, but when it comes to 0-day vulnerabilities  being found against the largest security company detecting these attacks, it starts getting some attention.

We'll see how this plays out.

American Users are Causalities of International Data War

In a recent article by the LATimes it references foreign countries creating large databases of American military and government workers for use to blackmail, recruit and craft dedicated spear phishing campaigns towards U.S officers and officials.   

This is a concern, because with every hack (Anthem, OPM and even Ashley Madison) nation state attackers are able to garner and piece together the growing puzzle that is the American government user base. These are also only the hacks we now about and I’m sure there’s a ton that have gone without notice, so with every new hack nation states are dropping down another piece of the puzzle. Many times they don’t even have to perform the hack, they just need to take the data from others that have posted their work on the dark webs (E.G Ashley Madison database on the dark web with .mil or .gov email addresses) as a gift towards their big data initiatives. With each new breach we’re giving away personal information that these nation states are using as evil marketers to learn more about their targets, which in this case is our government. This is interesting, because the government can attempt to perform as much security awareness on their employees, invest millions of dollars on technical security infrastructure all to be shot to hell by private sector hacks giving away information about government workers. This is by far the weakest link and the attackers have noticed it. There’s blood in the water and the sharks are circling.

The other problems with these attacks is that they doesn’t exclude others from being caught in their net and the intended targets, along with innocent user bystanders, are caught in the crossfire. With the Anthem breach (where the data hasn’t been seen for sale on the black market, so it’s most likely being used by a nation state) EVERY users data was scoped up for the entire company, whereas the intended targets were supposedly only government officials/officers. This is putting American citizens privacy in the middle of an international data war. We’re all becoming collateral damage, or throw away data, that’s most likely sold or reused later if needed, but still not the intended targets of the breach. It’s as if the American public was hit by a drive-by shooting and is just another victim of pointless violence. We’re all sufferers of nation state attacks, not just the intended targets.

"Clowns to left of me, jokers to the right, Here I am, stuck in the middle with you" ~ Stealers Wheel

Become a Recomended Vendor on www.frontlinesentinel.com

Within the next couple weeks this site is going to take form into a larger ecosystem of services, blogging, vendor reviews, etc. With that I'd like to see if there are any additional vendors looking to start the process with writing about their organization, services, market, etc. We have a template created already with questions we think buyers would want to know and hopefully use to make a purchasing decision. If you're interested, we'll have the template sent to you. 

There will be a section within the site to have vendors, as well as potential buyers, come to get a review of products currently in the market. I think it’s important to have another view of the product that will help organizations promote their brand and where buyers want to read. This can be very useful for both startups to gain press and industry veterans to gain more steam. 

I’ve personal spent so much time over the past couple years reviewing technology and want to come up with a complete listing of questions to have vendors answer that will assist with the selection process (this will eventually be refined by product, but for now we have to start somewhere with your help).

Over the next couple weeks, I’ll be collecting all the responses and adding them to the new site. Other vendors have asked me if there was a cost involved with this, and the answer is "No". We're looking to create a place where vendors can display their services and buyers can come and review them (all in one place). We kindly ask that you use your social media outlets to promote your link, but that's all. 

Please fell free to email me at frontlinesentinel@gmail.com for more information.