The Social Media Security Podcast

For a while now, I have been keeping an eye out for technologies that might help organizations leverage social media securely, within an Intranet environment for business purposes. Recently, I came across a success story about the Canadian Medical Association’s recent implementation of a social Intranet using an out-of-the-box product by ThoughtFarmer. That article (posted on the ThoughtFarmer blog) tapped the CMA project leader, Tanis Roadhouse, for tips on some of the key points in her blue-print for the CMA site’s implementation. So, I decided to check into the story.

The article showed that Tanis, while not being a life-long IT project leader, was pretty well organized, and showed some thought leadership. Here’s a summary of her 7-point blue-print for building a social intranet:

1. Start with an inspiring vision: the value of a collaborative culture
2. Secure executive support
3. Pick a name that matters
4. Gather requirements to learn the business
5. Partner with IT early
6. Treat content owners like royalty
7. Embrace continuous improvement

Click HERE for the entire article.

For each point, the article provides some detailed explanations. I followed up with Tanis via Twitter to see where Risk Management and IT Security fit in, since they weren’t explicitly listed in the explanations. For the most part, she said they addressed these issues in the IT liaison step.

Tanis did mention (over Twitter) that, because the organization is heavily oriented toward finance, a Risk Assessment was performed in order to protect client data. The assessment concluded that there was, “Limited risk, as it is an Intranet site”, and that “Risk to clients was reduced through governance policies.”

I should point out here that you can not infer that an intranet site will be secure simply because you have good governance policies. Any organization that takes on any IT project that will be deployed on their network (internal or external) should do a thorough risk assessment, and use its recommendations to strengthen any identified vulnerabilities. This may result in strengthening policies, technical safeguards, procedures, personnel screening, roles and responsibilities or training. (Disclaimer: I harp on this stuff because it’s a big part of what I do for my clients.)

I think the lesson here is that organizations are starting to see value in using social media tools that they keep under their own control. In the early years of Facebook and Twitter, I saw some organizations embracing the publicly available tools to initiate internal collaboration, which was (and still is), generally a bad idea. This kind of thing led to hackers employing social engineering tactics to join “employee groups” and learn way too much about the vulnerabilities inside the company’s walls and networks, which of course, leads to data breaches.

Now, with some real implementations we can talk about, I’m hoping to get a closer look at how these tools can be deployed securely in an environment where you’re not sharing sensitive corporate data with 700 million of your closest friends (e.g. as would happen on Facebook).

I should also mention that the ThoughtFarmer blog also seems to be a good source of thought leadership. Not only are they kindly publishing meaningful success stories, but they also demonstrate an understanding of how to use social media to help others think through their problems. One of their subsequent posts has a list of “81 Intranet Governance Questions to Ask Yourself.” (Click HERE)

I’m encouraged by this kind of leadership, both in the vendor community (as demonstrated by ThoughtFarmer) and among the project initiators like Tanis. I hope to follow their progress in the future and share any tips I learn with you.

If you have been struggling with the problem of how to keep passwords strong, yet memorable, we may have a simple answer for you. In the Security Now Podcast (episode 303) this week, Steve Gibson presents a very interesting analysis on what makes a good password these days. He calls it Password Haystacks, and there is a pretty simple solution to having to remember strong passwords.

Steve’s conclusions are very compatible with my usual prefered strategy for choosing passwords – like using the first characters from a song or movie quote, and adding some special characters and numbers. But his advice is interesting about how simple the basic password root can be, and how to easily make it much stronger. It’s pretty cool and simple.

The bottom line is that by adding length to a good, short password (regardless of whether or not they are repeated characters or patterns) you will massively improve resistance to a brute force attack. This is because today’s attacker doesn’t know how long the password is, for sure, and will always start with the easy dictionary words and patterns, and then they will move to the shortest possible character combinations in a brute force attack, followed by the next shortest combinations, and so on… 

As an example, using this logic, a 23 character random password is not “usefully” stronger than a 3 character random password with 21 repeated characters. 

There are some minor caveats in using this approach, to keep the passwords strong, such as having at least one lower, one upper case, one number and one special character in the root of the password. The rest of the characters don’t really matter, as long as you don’t reveal what pattern you use in the repeated characters or patterns.

For example “..B.o.B……….” is a pretty good password, since it would take at least 2 billion centuries with massive cracking array scenario to go through all combinations. So, you don’t need a very long song title or movie phrase. You simply need to keep your simple pattern or strategy a secret.

The Security Now podcast episode (in text or audio format) where the rationale for this approach is described is at the following link:

http://www.grc.com/securitynow.htm (look for Episode 303)

Steve also has a web page that analyzes passwords in terms of how long a given password can be expected to stand up to various brute force attacks. You don’t have to enter your real password, but try entering something that has the same length, and number of upper, lower case, numbers and special characters as your real password, and see how long it would take an attacker to try all combinations using a brute force approach.

http://www.grc.com/haystack.htm

If you aren’t convinced, or if you want to learn more, post a question or comment below.

Something to ponder…

– Scott

I am now offering monthly briefings, tailored to organizations that want to build and sustain security awareness for staff. Just because your security team is too busy to do its own training and awareness doesn’t mean you can’t have an economical way to address human security risks. Please call or email me at the coordinates below…

Scott Wright

The Streetwise Security Coach

Join the Streetwise Security Zone at:
http://www.streetwise-security-zone.com/join.html

Phone: 1-613-693-0997
Email: scott@streetwise-security-zone.com
Twitter ID: http://www.twitter.com/streetsec

To receive weekly security tips and other notices about helpful content available on this site, please make sure you are on my list by clicking HERE, and entering your name and email address.

We know that many organizations are using open source Wiki software and platforms (e.g. Mediawiki) to do collaboration internally without exposing their systems to 600 million other users. But are there any other tools that enterprises can use to mimic the real-time connectivity of social networking sites like Facebook internally?

Why would a business want private social networking tools? Isn’t that an oxymoron?

I believe that enterprises can and will eventually begin to use “internal” or “private” social networks to allow for easier real-time collaboration, while avoiding some of the risks of the “public” social networks – such as social engineering attacks, Koobface attacks, etc. I’d really like to learn more about what the options are for businesses to deploy their own social media tools internally, or in a private cloud. Internal deployments would probably tend to be more secure, with potentially more control over access and authentication of users. But a cloud-based implementation by a trusted service provider might also be quite secure. Either way, the facility would be less of an easy target for attackers.

Have you seen or heard of such a thing? If so, where can I learn more about them? Doing a Google search turns up many hits, but I’d like to hear about some success stories and reviews of these kinds of solutions that could benefit the members of the Streetwise Security Zone as we try to figure out how to leverage the power of social media, in a secure and efficient way.

Also, what are your thoughts? What would it take for enterprises to be able to use social networks and social media tools securely? 

I am now offering monthly briefings, tailored to organizations that want to build and sustain security awareness for staff. Just because your security team is too busy to do its own training and awareness doesn’t mean you can’t have an economical way to address human security risks. Please call or email me at the coordinates below…

Scott Wright

The Streetwise Security Coach

Join the Streetwise Security Zone at:
http://www.streetwise-security-zone.com/join.html

Phone: 1-613-693-0997
Email: scott@streetwise-security-zone.com
Twitter ID: http://www.twitter.com/streetsec

To receive weekly security tips and other notices about helpful content available on this site, please make sure you are on my list by clicking HERE, and entering your name and email address.

As each major player in today’s technology and Web-connected world makes a move to get a bigger piece of the social networking pie, they take on new risks they haven’t seen before. But if they only looked around, they’d be able to see and learn from the mistakes of others.

This week Apple launched “Ping”, a new social network that serves the iTunes community. But they don’t seem to have learned much from those that have ventured into this space before them. The Ping forums are being bombarded with spam posts containing phishing links. As blogger Chester Wisniewski, from antivirus maker Sophos points out, “Did they not see this coming?” (click HERE).

While Apple should have anticipated the problems, and tried a bit harder to protect legitimate users from this unwanted content, my advice to users is the same as for any social network: Use good link hygiene.

What is Good Link Hygiene?

Link hygiene is something we all need to practice on a daily basis, whether it’s while we’re reading Email or browsing social networks. It’s about avoiding the risks associated with malicious sites and content, as well as malicious file attachments.

There are many different ways in which hackers and scammers can trick you into giving them access to valuable information and computer resources.

Here are four of the nine items I teach people to check for when it comes to link hygiene which can reduce the risks of becoming a victim from malicious content in Email and websites:

1) Are your Email configuration options set to disable previewing of content or loading of images?

2) Is your computer’s operating system and application software (e.g. browser, Adobe Reader) up to date?

3) Do you have a reputable anti-malware product with up to date patches and virus signatures on your computer?

4) Do you know what your anti-malware product’s alerts look like, so you can recognize most fake virus alerts?

 So, Apple – as well as other social networks – should take some blame for allowing their social network to become polluted with malicious content. However, it’s almost impossible for sites to eliminate these risks entirely. It’s up to us, the users, to stay vigilant, and know how to avoid becoming a victim.

If you’re a Business Premium member of the Streetwise Security Zone, you can download the PDF version of this month’s coaching content on Link Hygiene by clicking HERE. This lesson includes a discussion of the various ways in which hackers and spammers try to trick you into going to malicious sites or entering sensitive information into fake forms.

I am now offering monthly briefings, tailored to organizations that want to build and sustain security awareness for staff. Just because your security team is too busy to do its own training and awareness doesn’t mean you can’t have an economical way to address human security risks. Please call or email me at the coordinates below…

Scott Wright

The Streetwise Security Coach

Join the Streetwise Security Zone at:
http://www.streetwise-security-zone.com/join.html

Phone: 1-613-693-0997
Email: scott@streetwise-security-zone.com
Twitter ID: http://www.twitter.com/streetsec

To receive weekly security tips and other notices about helpful content available on this site, please make sure you are on my list by clicking HERE, and entering your name and email address.

It seems like maybe I talk too much about Facebook security. But it’s a growing issue in the news these days. As you can see from the image next to this blog post on my website, one of the most searched terms in Google is now “How do I delete my Facebook account?” (In fact, as of today, if you type “Delete” into a Google search, the top suggestion is “Facebook account”) So, I’m debating quitting Facebook on May 31 with the others who are disgusted with the site’s disregard for privacy and security. (See http://www.quitfacebookday.com)

My reasons include:

(1) You can’t seem to depend on anything you put there to be kept private – more due to constant policy changes than hackers;

(2) Facebook is now one of the biggest sources of phishing scams on the Internet, which are causing real losses;

(3) On any given day, the privacy of your data may depend on your FRIENDS’ settings, not just yours;

(4) Very few people are able to decipher the privacy settings to choose meaningful rules, which leaves them exposed – even me;

(5) Facebook shares your data with other sites (through the Open Graph API, the Like Button or Instant Personalization) in ways that can cause embarrassment and lead to identity theft;

(6) Facebook does not appear to be abiding by its agreement with the Privacy Commissioner or Canada to improve its handling of private information.(http://www.priv.gc.ca/media/nr-c/2009/let_090827_e.cfm)

Arguments against quitting Facebook include:

(1) All the “hip” young people say “Privacy is dead. Build a bridge and get over it…”

– Chanting this may make them feel good, but doesn’t change the fact that the easiest place to be scammed or have your password stolen is through social media sites that have very weak security and authentication. People must still care about their privacy, if only to ensure that persecution and other politically motivated abuses don’t victimize innocent people – it’s a slippery slope.  Privacy commissioners have a very difficult job these days. But it is an increasingly important one.

(2) How will I connect to friends and family without Facebook?

– How did you do it in 2003? It also depends on whether you use Facebook for “reading” or “writing” or “both”. If you just like to “see” what’s going on, you can use Twitter, with the caveat that you need to be careful of those short URLs that can take you to dangerous places. But tools like Brizzly.com can expand the links for you, so you’ll know where they are leading you. However, if you like to write lots of personal details of your life, and only want to share it with friends, that’s the biggest challenge right now – because even Facebook doesn’t provide assurance that your private posts won’t be shared with people you might not want to see them. There aren’t many tools that are widely used and can do this. But they are coming. So, maybe it’s better to wait.

(3) One person quitting from a group of 400 Million isn’t going to make a difference.

– It’s true that the numbers make this initiative look futile. So, for most people, quitting won’t make a difference to anyone. But if you are a person of authority, especially a security or privacy authority, your actions can show the people around you that this is a serious issue. Parents telling their kids that they are quitting – and why – may or may not have an impact (depending on whether the ear-plugs are in or not).

Public figures like Leo Laporte  can have a significant effect on their followers. (Click  HERE for the story which includes a link to the WikiHow page on how to quit Facebook)

As a security consultant who has been following this trend, I am asking people to take it seriously. If you are a security manager in a company, you can also have an influence on your co-workers, as long as they don’t see you as being heavy-handed, or crying “wolf” – which may be unavoidable in some cases.

(4) If all the security and privacy advocates quit Facebook, who will counsel those who still use it to let them know about the risks in their own “element”?  Good question. I don’t have an answer to that one. I may leave a Facebook page up (which is different from a personal profile). That way, people can still reach me and see what I have to say, publicly, and maybe understand why I no longer have a personal profile… and maybe they shouldn’t either.

What will the future of social networking look like?

I believe something will come along that is more secure than Facebook, and will provide the connections we need – without as much risk. But it may take a while. There is an initiative called Diaspora (http://www.joindiaspora.com/), which has this very intent. While its initial incarnation seems to have a few serious weaknesses of its own, this is the kind of thing that needs to happen to combine a great vision for social networking with a level of trust that can be sustained.

So, what do you think?

(1) Should I quit Facebook on May 31? or sooner?

(2) Will you quit Facebook?

Feel free to comment below. (NOTE: If all you plan to say is “Privacy is Dead”, get ready for a flaming arrow!)

Here’s how to delete your facebook account – http://www.wikihow.com/Permanently-Delete-a-Facebook-Account

I am now offering monthly briefings, tailored to organizations that want to build and sustain security awareness for staff. Just because your security team is too busy to do its own training and awareness doesn’t mean you can’t have an economical way to address human security risks. Please call or email me at the coordinates below…

Scott Wright

The Streetwise Security Coach

Join the Streetwise Security Zone at:
http://www.streetwise-security-zone.com/join.html

Phone: 1-613-693-0997
Email: scott@streetwise-security-zone.com
Twitter ID: http://www.twitter.com/streetsec

To receive weekly security tips and other notices about helpful content available on this site, please make sure you are on my list by clicking HERE, and entering your name and email address.

With children and young adults going back to school shortly, many parents are going to be concerned about their  child’s vulnerability to risks of using the Internet to keep in touch with school friends and people back home.

If you have a student at home who’s about to be using the Internet a lot more when they go back to school, please tell them to be careful, and, if possible, show them this list:

1. Make sure you understand the Acceptable Computer and Network Usage Policies of the institution. If you violate them, you may lose Internet access, which for some students can mean failing the term.
2. Make sure you have a software firewall and up to date, reputable anti-virus software on all computers that are connecting to the Internet. Anti-virus suites with anti-phishing and anti-spyware can also reduce the risks.
3. Don’t accept social networking invitations (Twitter, Facebook, etc.) from people you don’t know. The number of imposters and scammers is growing – almost faster than these sites can shut them down.
   
4. Don’t click on links or accept new Facebook applications if you don’t need to. There’s a growing list of dangerous applications and sites that may be more dangerous than they appear.
5. Don’t post “Too Much Information” about yourself. You don’t know who might be watching or waiting for you to announce something that gives them a cue that they can act on against you. Don’t tell the world where you’re going and when, just because you can.
6. Use different, strong passwords for Internet accounts, and consider using a free password manager program that uses a single password to protect passwords for all your accounts.
7. Report illegal or suspicious computer activity to the institution or Internet Service provider immediately to protect yourself and your friends from becoming victims of hackers.
8. Back up your assignments and work in multiple places as often as you can, and keep them safe from being stolen.
9. Consider using a full-disk encryption program on your laptop if it has confidential information on it that you wouldn’t want to be printed in the newspapers.
10. Don’t plug other peoples’ USB Flash drives into your computer. They can be infected with viruses that your computer’s anti-virus software may not catch. Always try to use your own USB drive, don’t plug it into a computer that doesn’t have any anti-virus software on it, and keep as little important data on it as you need to.
    

Ken Knapton has also published a book on Cyber Safety for families with kids. While I haven’t read it yet, I have been following Ken’s updates on Twitter with tips from the book, and I try to “retweet” them all. Although many of the tips are for parents trying to keep their families safe, I suspect there are some good tips for college students, too. The book is getting good reviews on his Facebook page.

There will always be risks on the Internet that our children will have to learn about sooner or later. But let’s hope they don’t have to learn the worst lessons from experience.

The sooner they learn how to use the Internet responsibly, the more comfortable they will be in a work environment where they can contribute to a culture of information security.

I am now offering monthly briefings, tailored to organizations that want to build and sustain security awareness for staff. Just because your security team is too busy to do its own training and awareness doesn’t mean you can’t have an economical way to address human security risks. Please call or email me at the coordinates below…

Scott Wright

The Streetwise Security Coach

Join the Streetwise Security Zone at:
http://www.streetwise-security-zone.com/join.html

Phone: 1-613-693-0997
Email: scott@streetwise-security-zone.com
Twitter ID: http://www.twitter.com/streetsec

To receive weekly security tips and other notices about helpful content available on this site, please make sure you are on my list by clicking HERE, and entering your name and email address.

This article (click HERE)  has some great insights that are very consistent with what I am hearing from managers and professionals in the Legal and HR fields. Social media is here to stay, and you can’t block it completely out of your organization for very long. Sooner or later, you’ll have to look at it from every possible angle, and come up with a rational strategy for managing the risks.

You really need to stop and think about the implications and risks of Social Media, as they pertain to:

• In-house Research, Collaboration and Development
  
• Marketing, Sales and Business Development
  
• HR screening
• Product support forums
• Employees’ home use of social media
  

There are many subtle risks that require cross-functional attention before letting people loose.

Are you just trying to close your eyes and hope it all goes away?

Or are you working with your team to lay out some ground rules for success with Social Media?

I am now offering monthly briefings, tailored to organizations that want to build and sustain security awareness for staff. Just because your security team is too busy to do its own training and awareness doesn’t mean you can’t have an economical way to address human security risks. Please call or email me at the coordinates below…

Scott Wright

The Streetwise Security Coach

Join the Streetwise Security Zone at:
http://www.streetwise-security-zone.com/join.html

Phone: 1-613-693-0997
Email: scott@streetwise-security-zone.com
Twitter ID: http://www.twitter.com/streetsec

To receive weekly security tips and other notices about helpful content available on this site, please make sure you are on my list by clicking HERE, and entering your name and email address.

Thanks to Ryan Levesque from Twooting.com for having me on the “Twooting” podcast.

“Twooting” is the term Ryan and his partner, Bo Bennett, have coined to describe the act of “talking about Twitter.”

In this 30 minute podcast episode, Ryan asks me about some of the major risks inherent in using Twitter, and we discuss some of the approaches and tips that can help mitigate them.

Click HERE to listen to the episode of Twooting.

If you are interested in learning about how to get the most out of Twitter, I recommend listening to Ryan and Bo in the Twooting podcast. You can also find them on Twitter at http://www.twitter.com/thepodcast.

I am now offering monthly briefings, tailored to organizations that want to build and sustain security awareness for staff. Just because your security team is too busy to do its own training and awareness doesn’t mean you can’t have an economical way to address human security risks. Please call or email me at the coordinates below…

Scott Wright

The Streetwise Security Coach

Join the Streetwise Security Zone at:
http://www.streetwise-security-zone.com/join.html

Phone: 1-613-693-0997
Email: scott@streetwise-security-zone.com
Twitter ID: http://www.twitter.com/streetsec

To receive weekly security tips and other notices about helpful content available on this site, please make sure you are on my list by clicking HERE, and entering your name and email address.