Contingency Planning - Week 4

What do you do when the unthinkable happens? A tornado has just wiped out your business. Whether you are a small business, or a large corporation, contingency planning is a must. In NIST SP 800-34 the U.S. Department of Commerce provides guidelines for creating a contingency plan for information systems. If you are a large business, most, if not all, of the guidelines would apply. If you are a small business, there are certain guidelines you don't need to worry about, such as alternate sites.

When creating a contingency plan, a business should do a business impact analysis. This analysis will provide valuable information for creating your contingency plan. It will tell you what your Recovery Time Objective is, in what amount of time are you shooting for to be back up and running. What is your Maximum Tolerable Downtime? It will also tell you what your Recovery Point Objective is, the most critical functions you want back up after a disaster.

When creating a contingency plan, make sure you have looked at all the procedures and written them down. Assign specific duties and responsibilities in the event of a disaster. Identify who makes the call that your contingency plan goes into effect.

One of the key things to remember in contingency planning is to practice. Set up tests and exercises to ensure all personnel know their roles and responsibilities, and also to ensure equipment and systems are adequate for disaster recovery. Make sure to also relook at your contingency plan from time to time to ensure it is still sufficient to get your business back up and running after a disaster.

Data Breach Incidents - Week 3

                Looking through the past few years of Verizon’s Data Breach Investigations Reports, it makes me wonder how the same issues keep happening year after year. Yes, hackers and attackers get more sophisticated and creative as technology safeguards advance, but some of the same things keep happening each year. The 2016 report says 40% of the incidents could be prevented with what they consider “quick fixes.” If this is the case, why aren’t these quick fixes being utilized?

                Phishing still seems to be the biggest culprit for data breaches.  As long as phishing has been around, do people still not pay attention when they open emails and attachments? How much effort does it take to look at an email and make sure it’s from someone you would expect an email? If it’s not, check it first. Don’t open any attachments.

                Another one is using default or weak passwords, or doing something that allows someone to steal your password. Everyone knows what the default passwords are. When you first log into a system, change the password. Don’t change it to a weak password. Make sure it is strong and not easily figured out. Then, when you create a strong password, don’t write it down. That’s how they get stolen.

                One more on data breaches…card skimmers. They’ve been around for a bit and most times people pay closer attention when they use a card reader. If you’re in a hurry, still pay attention to your surroundings. Especially for those “quick” stops to fill up a gas tank. There are now tamper-resistant and tamper-evident card readers. Take a closer look and see if there is any evidence to lead you to believe it has been tampered with. Take a look at other gas pumps at the same place. Do they all look the same? Odds are if someone is using a skimmer, they’re not going to put one on every pump. If something looks out of place, don’t use it and alert the person inside behind the register. If in doubt, go inside and pay.

Information Security and Project Management

                Project management will be an ongoing thing in business, with technology and other aspects. One of the main things that will need to be considered is information security. This week for class we were all asked to write a paper based on failed IT project management. While it doesn’t happen that often, it does happen. There were several different scenarios where failed IT had happened.

            I one, the U.S. Air Force had spent $1 billion over seven years to develop a single system to merge 240 separate systems. This Expeditionary Combat Support System was eventually stopped. The prime contractor was terminated from the project, after they had been given a stop work order the year prior, due to poor performance. Could this poor performance have led to a breach of information security? What information was contained in the 240 other systems they were trying to merge into this one system? Could that information have been breached?

            Another incident involved the Canadian government developing a new payroll system. When the payroll system was brought online it was a mess. People’s information was hacked, employees didn’t receive a paycheck for months, many of them having to sell their homes in order to get by. Was this project pushed too quickly with not much, if any, testing before it went fully online? Could the headaches have been prevented if there was thorough testing done ahead of time to make sure the system was ready to go? Were there higher ups sticking to a certain deadline for the system to go active? Was there a lack of communication about the potential problems if the system went active at that time?

            These are just a couple examples of IT failure in project management. Information security is critical to systems that are online and running, but it is also critical in project management to make sure these problems don’t occur while developing a new project.

Secure vs. Unsecure Wi-Fi Networks

Information Security should be one of the first things you think about when setting up or joining any kind of network. If you pay no attention to InfoSec, you greatly run the risk of information not being available to you when you need it. Or, you run the risk of people who don't have a need for the information getting hold of it.

Many people don't think about Wi-Fi networks being open or secured when they join them while traveling or outside of their home or place of work. It seems these days people, mainly younger people, are more worried about being able to post their selfies or status updates on Facebook or Instagram, or any of the other social networking applications out there. They are in such a rush to post these they don't even stop to think if they're doing it on a secure network or an open network.

If you are on an open network, you are potentially allowing others access to your device. Once they have access to your device there are many types of threats they could pose. They could collect data from your computer. They could insert malicious code in your device which could eventually render it useless. They could leave loopholes to gain later access to your device.  Some of these threats have far reaching consequences.

With many transactions taking place online these days, once someone has access to your device there are many things they could do. Many devices and operating systems ask if you want the device to save a password when you fill it in to go to a specific account’s website. If you are one who does save passwords on your device it won’t take long for someone to get into the password vault on your device. How many different accounts do you deal with online? What could happen if someone now has access to every one of those accounts? Many people also do online banking these days. What would happen if someone got into your bank accounts? There is potentially enough information on your device that someone could clean out your bank accounts, use your other accounts, or even steal your identity.

But there are steps you can take to lessen this risk. First, stay off open networks. Use only secure networks. If you must get on an open network, at least make sure it is one you have to sign into, like a Wi-Fi network provided by your internet company across a city. Make sure you have anti-virus software installed on your device and make sure it is up to date. You can set your device to automatically install updates. Or, if you are not comfortable with that, make sure you are manually checking for and installing updates weekly. When you are somewhere you think you need to log into a Wi-Fi network to do something, ask yourself what is saved or stored on your device, and what damage could be caused if someone got hold of that information.