Week 7- My Insights

The assignment this week was pretty straight forward.  For this assignment most of my current security threats and vulnerabilities were gathered from Verizon's 2012 Breach report in which can be found at:  http://www.verizonbusiness.com/resources/reports/rp_data-breach-investigations-report-2012_en_xg.pdf  It seems that most of the vulnerabilities and threats discovered in the Harry & Mae's Case Study were current security trends found in the Verizon report.  It amazing how something as simple as failure to change default settings on a device can lead to a huge loss for business if exploited.  A company like Harry & Mae's that handles customers credit card numbers can't afford to be careless with this information.  They can lose there privileges to process credit card payments and be forced to pay huge fines.  This is a risk that as a business owner I would not want to accept.  Listed below are a few of my findings from the Harry and Mae's case study that I think are important yet simple fixes. 
Findings Summary

·        Default settings are currently being used throughout the network on various devices making it easy for hackers to break into network devices and capture information such as customer data, usernames and passwords.  It also makes it easy for hackers to establish user accounts and create privileges for themselves that allow them to have full access to the network or that particular device. 

·        Company wireless network is not password protected making it easy for hackers to compromise network and capture information being shared across network.  This includes the capturing of usernames and passwords.

·        Firewalls are not enabled making it easy for hackers to obtain reported information from malicious software that may be installed on the network without sending an alarm or alert.  Traffic is allowed to flow in both directions.    

·        Signature files are not being updated to filter e-mails.  Virus firewall will only capture e-mail according to old files and any new threats will not be captured.  This opens the network up to malicious software and viruses. 

·        No password restrictions.  This allows users to create easy and simple passwords that can easily be cracked by brute force or that can be easily guessed.  Uses are also writing passwords down making it easy for other employees, janitors, or visitors to login and compromised the system.

·        Virus software not currently being used on virtual servers. 

·        Access card data is being stored on the server that’s not protected.  If server was compromised hackers can create fake access card accounts to gain access to the building.  This in return will create a physical breach which could not only case harm to data but employees as well. 

·        Public IP address being used on servers making them accessible to those outside the network.

·        FTP server being used by employees to transfer files from outside and inside the company.  This makes it easy for employees to steal files from work or bring in malicious software or viruses to be distributed across the network. 

Week 6

In my week 2 blog I posted a list of sources that I felt were credible and reliable sources for obtaining information on potential threats and vulnerabilities.  The sites listed were good sources for security news and issues.  After reviewing my blog posts from previous weeks these are actually the sources that I have been using regularly.  Last week I used one sources that was outside my list and that was www.cio.com.  I think this may be a good sources to add to the list in that it contains information on the best products to include apps and tablets.  It keeps you up on what's going on with companies such as Microsoft and Apple. 

Week 5- Harry & Mae’s Assumptions

There are many assumptions to be made about Harry & Mae’s incorporated when it comes to security.  Security is something that they lack and I think they should consider developing some type of procedures, policies, and standards in order to protect the company’s assets.  There is also nothing in place that deals with privacy in the work place and therefore employees can’t be held liable for their actions.  There should be something in place to make employees for their actions in the workplace.  Harry & Mae’s should also be thinking about protecting their reputation as well.  An open network can compromise the integrity of the data being stored and retrieved.  They should also consider disgruntle employees in that they are known to cause major damage to the company.  The article listed below provides a few myths in the workplace that all employees should consider while on the job.  These should also be considered for Harry & Mae’s.  The article can be found at:  http://www.securityweek.com/three-privacy-myths-workplace

Week 4 - Fake Netflix Android App

Over the past few years’ cell phones have evolved from talk only to talk, text, and Internet.  Cell phones today are like compact computers and can be used to do just about anything that a desktop computer can do.  You can use them to shop, play games, check bank accounts, transfer money, pay bills, e-mail, and chat, watch movies, listen to music, and many other cool things.  However, this rapid increased use has made cell phones a target for scammers.  The android app market is a place where users can download different apps.  Some apps are free and some require a small fee for use.  From my understanding anyone can build an app and publish it.  You don’t have to use Google play, but you can use other app markets to publish your app.  This is scary in that as a user you don’t know if the app being downloaded contains malicious software.  If the downloads does contain malicious software it can be used to gather passwords and account information from your phone.  In other words if you use your phone to pay bills, shop, or do anything that requires the use of a password the bug will capture that information.  I found this article that talks about how a fake Netflix app was created that contained a Trojan that could capture passwords and account information. This was a bogus app that had the potential to affect thousands of devices.  Netflix is a huge company that used by many to download and stream movies.  How can a user know if the apps they are downloading are safe?  The article can be found at:  http://www.cio.com/article/691743/Fake_Netflix_Android_app_is_social_engineering_scam