Cyber Attacks Typology

Saw this acronym to describe the types of cyber threats and thought it was useful.

STRIDE

Spoofing - Falsifying identity to gain systems access

Tampering - Making unauthorized changes to data or systems

Repudiation - Forging identify of actions to data or system to deny responsibility or even blame a 3rd party

Information Disclosure - Stealing (exfiltrating) information and disclosing it to unauthorized individuals

Denial of Service - Depriving legitimate users access to data or systems

Elevation of Privilege - Transforming user account to allow it to exceed legitimate user privileges (e.g. admin account or superuser)

Funny-sad enough, these six types of cyber attacks can cause any information security officer to lose their stride. ;-)

(Source Photo: Andy Blumenthal 

Cyber Attacks Typology

Modesty And Privacy Of Body and Information

So modesty and privacy is very important in terms of propriety and security.

Both are intimately connected. 

Already as children, we learn not to show or talk about our "privates" to others. 

And as adults, we understand that there are certain things about ourselves that we don't just talk about or divulge to others indiscriminately. 

Not being discrete with these and showing either your private parts or your personal information can get you in a load of trouble by giving others the opportunity to take undue advantage of you. 

Both open you up to be ridiculed or even raped of your person or information identity. 

That which is yours to use with others in propriety is instead disclosed for taking out from your control and for use against you. 

Security demands modesty of body and of information, and if not taken seriously, then no amount of lame covering will keep that which is private from public consumption. ;-)

Modesty And Privacy Of Body and Information

Lock Or Peephole

So is that keyhole in privacy for a lock and key or as an exhibitionistic peephole?

The New York Times had an excellent article on this yesteday, called "We Want Privacy, but Can't Stop Sharing."

We are compelled to share online to demonstrate that we are:

- Important
- Interesting
- Credible
- Competent
- Thoughtful
- Trustworthy

The problem is when you inappropriately overshare online, you may leave youself little to properly disclose in building real-world intimate relationships in a normal give and take of "opening and closing boundaries."

Moreover, being like a lab rat or in a house of glass walls for all to watch indiscriminantly can leave us with feelings of "low self-esteem, depression, and anxiety."

Being under observation--even when it is voluntary--implies being open to judgement and this can drain us of our ability to be ourselves, creative, and take calculated risks.

We don't want to become too busy brushing our hair back and smiling for the camera and making everything (artificially) look like made for reality TV (e.g. Kardashian) perfection. 

The key to privacy is to disclose what needs to be shared, put a lock on what's personal, and not arbitrarily leave the peephole eyes wide open. ;-)

(Source Photo: here with attribution to g4ll4is)

Lock Or Peephole

What If They Can Read Our Redactions?

The New Yorker has a fascinating article about technology advances being made to un-redact classified text from government documents. 

Typically, classified material is redacted from disclosed documents with black bars that are technologically "burnt" into the document.

With the black bars, you are not supposed to be able to see/read what is behind it because of the sensitivity of it. 

But what if our adversaries have the technology to un-redact or un-burn and autocomplete the words behind those black lines and see what it actually says underneath?

Our secrets would be exposed!  Our sensitive assets put at jeopardy!

Already a Columbia University professor is working on a Declassification Engine that uses machine learning and natural language processing to determine semantic patterns that could give the ability "to predict content of redacted text" based on the words and context around them. 

In the case, declassified information in the document is used in aggregate to "piece together" or uncover the material that is blacked out. 

In another case prior, a doctoral candidate at Dublin City University in 2004, used "document-analysis technologies" to decrypt critical information related to 9/11. 

This was done by also using syntax or structure and estimating the size of the word blacked out and then using automation to run through dictionary words to see if it would fit along with another "dictionary-reading program" to filter the result set to the likely missing word(s). 

The point here is that with the right technology redacted text can be un-redacted. 

Will our adversaries (or even allies) soon be able to do this, or perhaps, someone out there has already cracked this nut and our secrets are revealed?

(Source Photo: here with attribution to Newspaper Club)

What If They Can Read Our Redactions?

Lets Play Chicken

So probably everyone knows the game of chicken.

They play this game in the movie Footloose--driving these big tractors towards each other waiting to see who flinches, chickens-out first, and veers out of the way before the vehicles collide. The person who moves out of the way first is the "chicken" (although that person is probably pretty darn smart not to risk getting him/herself killed!)

An article in the Wall Street Journal (18 February 2013) on making friends by sharing, but not oversharing, reminded me of this. 

Like two vehicles driving towards each other--making friends is about coming together by disclosing who you are and what you are about--finding and enjoying commonalties, respecting each others differences, and being able to interact in a mutually satisfying way. 

Driving gradually and carefully, you can get to know someone by mutually sharing and connecting--first a little, and then building on that with some more. 

Beware of disclosing too much, too fast--it can make another person uncomfortable--like you're dumping, desperate, or maybe a little crazy!

At the same time, not being able to open up can make the other person feel that you don't like or trust them or maybe that you are a little boring, shallow or that you are hiding something.

Of course, the chemistry has to be there and it's got be reciprocal--both the feeling and the sharing--users and stalkers need not apply. 

However, if things aren't working out between the two people and they are on course for a head-on collision, someone has got to get out of the way--maybe that person is a chicken or perhaps they just know when it's time to say goodbye. 

Anyway, chickens can either end up doing the chicken dance or they can end up as roadkill--it all depends on how they approach the other chicken. ;-) 

(Source Photo: Andy Blumenthal)

Lets Play Chicken

One Hand Washes The Other

This week the House overwhelming approved an notable ethics reform package to ban insider trading on the hill and in the executive branch. (Washington Post) 

However, ethics and conflict of interest in government decision-making is something that affects politicians and civil servants alike.

Two specific areas come to mind, including employment decisions and acquisitions awards, where there is probably no greater area of public trust. 

Because personnel and contracting decisions affect livelihoods and pocketbooks, they are ripe for corruption and undue influence, favors, and other mitigating factors such as preference or tit for tat arrangements. 

To safeguard these actions by public officials, the Federal government has set out rules that govern personnel practices and acquisitions.  

On the personnel side, there is an exemplary set of rules commonly referred to as the " Prohibited Personnel Practices" (Title 5 U.S.C. 2302(b)).

For example, they set out rules against such things as: 

- Discrimination against employees or applicants and even for off duty conduct

- Preference in personnel decisions

- Soliciting or considering recommendations not based on personal knowledge

- Retaliation against whistleblowers or those filing appeals

- Coercion of political activity

Similarly, there are laws in government that govern federal acquisitions such as the Federal Acquisitions Regulations.

Included in this are are specific rules that mandate ethics and integrity in procurements, and these for example bar activities such as:

- Conflicts of interest in making acquisition decisions

- Soliciting and accepting gifts

- Seeking employment with a bidder

- Disclosure of protected information

Of course, these guidelines are only as good as those following them. When these rules are bypassed with winks, excuses, or even outright deceit, the system and the ethical principles embodied in them are doomed by backroom politics. 

As the same time, the specifics of the rules and regulations, and the interpretations of these to each situation is critical, and officials should regularly consult with their ethics officers and legal counsel to ensure that they are not only doing the right thing, but doing things right. 

The Office of Inspector General (OIG) for each department and agency plays a vital role in ensuring that officials are managing in such as way as to avoid fraud, waste, and abuse, and the OIG can usually be contacted both by phone or email and is available to assist the public in investigations, inspections, and evaluations. 

To ensure the integrity of government at the highest level, the rule-makers (Legislative Branch), the implementers (Executive Branch ), and the interpreters (Judicial Branch) are all involved in ensuring the ethical foundations of our government.  

On the ground, day-to-day, senior executives, human resource and procurement officials, ethics and legal officers, internal affairs and the OIG play important roles in guiding the process and hopefully weeding out the "bad apples."

However, when people involved are lax, derelict, or intentionally overlook corruption and endemic bad behavior as part of a one hand washes the other culture, everyone loses in terms of not only the smooth and efficient running government, but in the underlying principles of integrity for which it stands. 

(Source Photo: here with attribution to "Brain Malfunction")

One Hand Washes The Other

Modesty In A Social Media World

New "love" app out of the U.K. called I Just Made Love (IJML).
This one is not for the modest or privacy-conscious.
The app is available for download for both the iPhone and Android.
Essentially, people are going out and using location-based services (i.e. GPS) and self-identifying their love-making--act by act. We're up to 194,000+ already!
Not to be gross, but the app lets people not only report on doing the act and where, but also using check boxes with icons, you can identify the details such as the context: couch, indoor and outdoor, as well as how: 5 top positions--which is way more information than I care to hear about.
In our often hedonistic society, there are of course, other services such as Four-Square that lets you broadcast where you fulfill other bodily pleasures like eating, drinking, and shopping.
Personally, I don't care to know what people are doing or where--too intrusive for my liking. But I can see why others may want to use FourSquare type apps (not IJML or who knows) with friends and family who may want to connect in this way--like to meet for Happy Hour at Old Town.
And certainly, marketers are interested in capturing valuable personal information on what you are doing, where and with whom, and using it to drive their sales and profits. Maybe you get a coupon out of it. :-)
With the love app, it seems like some people want to brag, appear the Don Juan, raise their "macho" social status, or just perhaps enjoy being exhibitionists.
From my perspective, the main pro of this app is to promote the concept (not the act itself) of love over things like war, hate, discrimination, etc.
Even with that being said, it seems like some things are just better off left as intimate moments between you and your special other.
Interesting to me, this topic of disclosure came up big time in the Orthodox Jewish world with the publication in the Yeshiva University Beacon (5 December 2011) of a much written-about article entitled "How Do I Even Begin To Explain This," where a frum Jewish girl from Stern College discloses her story of illicit rendezvous in a hotel room with a gentlemen and at the same time the "walk of shame the day after."
The dichotomy between her "Orthodox" beliefs and her "secular" actions and her publication of this article in a Yeshiva newspaper and her explicit description of sexual deeds is a perfect example of the tear in our society between privacy and social probity on one hand, and the desire or need to share and be "free" of all constraints on the other.
As a social commentary, we are at a point where it seems that nothing is real unless we share it with others, and that can be good or bad--it can lead to greater wisdom and societal advancement or it can lead us to do things we shouldn't do, are sorry we did, and where we feel shame afterwards.

Modesty In A Social Media World