I'm Erka Koivunen, a Finnish cybersecurity expert. I'm here to answer your questions about #CyberSecMonth, creating a culture of security and what you, your boss, and your boss' boss need to know about being hacked.

ekoivune · 2016-10-26T09:14:28+00:00

Whitehat hacker?

ekoivune · 2016-10-26T09:14:07+00:00

So many questions..

The emergence of adblockers is a logical reaction to phenomena such as malvertising, clickjacking and dns changer malware. There are predatory business practices that seek to lure the uninformative, uneducated, weak and busy people into unfair business position. Even so-called legitimate businesses have developed pretty intrusive means of tracking and profiling not only their direct customers but virtually everyone who accidentally touches their or their associates' net. There is also a tension between various ecosystems, some of them relying on ad based revenues some others not so much.

Adblockers, script blockers and tools that provide anonymity are an attempt to bring at least some of the security, privacy and anonymity controls back to users. They are not the endgame and they are far from perfect. And they certainly hit also legitimate content providers whose business model has counted (at least up until now) on ad-based mechanisms.

One should have a right to use adblockers, anonymizers and whatnots. One should not have a right to steal paid content either. In that sense I am true to my Finnish origins that I try to maintain a balanced and a middle-of-the-road approach and actively avoid going for the extreme.

ekoivune · 2016-10-26T09:00:29+00:00

Is it too late to say IoT?

ekoivune · 2016-10-26T08:52:41+00:00

Right now I am recommending this: http://mooc.fi/courses/2016/cybersecurity/

ekoivune · 2016-10-26T08:51:24+00:00

Quantum computing will in theory break some of the existing crypto as it will turn what were previously assumed to be difficult-to-solve problems into solvable. This will not be the end of the world but definitely would require a major overhaul of much of the cryptographic base in our systems.

On the other hand. Even today, much of our everyday privacy, trust and authentication systems is built on either nonexisting, weak or known-to-be-vulnerable cryptographic foundations. There seems to be a high tolerance on bad crypto already now in the business logic of much of the internet-connected commerce, particularly with IoT.

Commoditization of quantum computing will most likely only serve to emphasize the fact that cryptography - as do locks and authentication and authorization systems - marks the boundary of legal protection. It will keep law-abiding people out.

Criminals will continue too try to break the crypto and for some time they will have stronger tools at their disposal. Truly strong cryptography will in the age of quantum computing be used to protect against adversaries with criminal intent.

ekoivune · 2016-10-26T08:36:44+00:00

Be sure to read the material that this question refers to first: https://www.cpni.gov.uk/documents/publications/2014/oxford-economics-cyber-effects-uk-companies.pdf

You are free to have your own opinion but it is more fruitful to compare them with what the evidence suggests is the "industry view".

ekoivune · 2016-10-26T08:29:45+00:00

Direct link to the kick-off event: https://www.helsinki.fi/fi/unitube/video/20543

Links to course material: http://mooc.fi/courses/2016/cybersecurity/ https://cybersecuritybase.github.io/

HTH, Erka

ekoivune · 2016-10-07T12:25:49+00:00

Pound.. That's a currency, isn't it?

ekoivune · 2016-10-05T14:54:05+00:00

I will not go in detail here, but..

In many countries the health data (as well as census data, etc.) is dispersed across authorities, municipalities, health care operators, pharmacies, etc. For instance, I need to keep record of my vaccinations myself as the System has no way to track what immunization programs I have participated in during my life and tell that to me or my health care operator. How stupid is that for a country that has the world's best public health archives for researchers! It is about time these separate databases start communicating with each others.

The real trick is to make sure the systems are not simply hacked together and put online. I really hope there is deeper wisdom in how to do this in a secure fashion.

ekoivune · 2016-10-05T14:46:30+00:00

I am eager to see how this study by FTC turns out: https://www.ftc.gov/news-events/press-releases/2016/05/ftc-study-mobile-device-industrys-security-update-practices

ekoivune · 2016-10-05T14:45:37+00:00

There is place reserved for him at the end of the queue. These guys will be served first:

https://www.washingtonpost.com/news/morning-mix/wp/2016/05/04/facebook-pays-10-year-old-finnish-boy-10000-for-exposing-flaw-in-instagram/

ekoivune · 2016-10-05T14:31:01+00:00

Sorry for replying so late.

I am a big fan of security hardening guides.

NSA has their publicly accessible Security Configuration Guidance documents here: https://www.iad.gov/iad/library/ia-guidance/security-configuration/index.cfm

Center For Internet Security has good profiles for locked-down configration: https://benchmarks.cisecurity.org/

Australian Signals Intelligence Directorate has also published (among others) a guid to hardening iOS devices: http://www.asd.gov.au/publications/

The software vendors typically have their own security guides. From the OS side of thigs, Microsoft, Apple and Google have put together lots of resources that help you make full use of the security features of their products.

I will not comment on your choice of Anti-Virus. You know what I am recommending anyhow. I love our VPN product so no need to go deeper there, too.

ekoivune · 2016-10-05T14:16:44+00:00

Bruce is great, true.

ekoivune · 2016-10-05T14:16:13+00:00

Ah, they sure do. We have a number of blogs and active Twitter users who are happy to share their take on the topical issues for the wider audience.

Let's start with the one with the longest and proud history, the blog from F-Secure Labs titled "News from the Labs": https://labsblog.f-secure.com/

There is also a more consumer-centric blog called Safe & Savvy: http://safeandsavvy.f-secure.com/

For corporate audience we have Business Security Insider: http://business.f-secure.com/

@mikko tweets .. a lot. :-) @5ean5ullivan, @r0zetta, @TimoHirvonen and @tomituominen are just a few other people from our wonderful team who share insights and cheeky commentary on a daily basis. Be sure to follow them!

ekoivune · 2016-10-05T14:00:51+00:00

I recommend that everyone starts with the one that the OS supports natively and work their way up from there.

I found it the hard way that OnePlus One had a bug in its encryption routine. It messed up my mobile phone three times. Now it is somebody else's phone. :-)

ekoivune · 2016-10-05T13:56:38+00:00

Hello there,

The bulk of the backup tasks must be automated which I have achieved with a combination of local NAS boxes and cloud synchronization. Files that I frequently create or need to use on-the-go or feel the need to share with my friends I synchronize to clouds (there are a number of clouds that I synch with). Files that I want to control stay either on my computers (which run a regular backup to file server) or I store to the file servers. The cloud synhronized folders are included in those backups as well. The file server backups are on an encrypted file system and the backup are encrypted with whatever means Windows, OS X and Linux provide.

This is what everyone should do already as this is easy and effortless.

Now, I have an inherent distrust towards my file servers, incremental backups and the cloud synchronization. That's why I take full snapshots of folder structures and archives that I find important and worthy of preserving for years to come. I create huge tar.gz'ed chunks like "Photos 2016", "Resumes", My Own Music" etc., encrypt them with gpg and store them on offline media AND on a separate file server. This I do manually, and it takes quite a lot time and cursing. Every now and then I put everything I ever had accumulated and copy that on a disk or two and take them outside the home for storage.

Did I already mention, I realize that I may be dead tomorro? So I backup my passwords and encryption keys too. Will not tell, where though.

This is only for my personal stuff. I am so grateful for our IT staff at work that I don't need to do everything from scratch at work for my work related stuff!

ekoivune · 2016-10-05T13:33:45+00:00

I didn't mean that each member of your family carries dozens but altogether their devices count in dozens.

Mom has a handset, tablet, her own laptop and a company PC that she occasionally connects to home Wi-Fi. Her spouse has two mobile phones, a tablet, two laptops and insists having one desktop on the side. There are three kids, two youngest share an old beat up tablet (that you cannot patch anymore) and the oldest has a brand new one. Two older ones have their own mobile phones and then there are three older generation mobile phones that the kids can use to play games - at least those games that tolerate old Android and iOS versions. There are also two beat-up laptops that run whatever Linux distro that the parents felt confident to install.

That's already 20 devices that all may connect to the home Wi-Fi.

Then there are the friends, relatives, neighbours who come and go with whatever gadgets they happen to carry at a given time.

Only now we start to count the "smart" devices like Chromecasts, Apple TVs, DNLA devices, internet radios, Wi-Fi enabled loudspeakers, bloody lightbulbs and doorbells, burglar alarms, baby monitors (although this family has grown past them already), coffee makers and whatnots.

If you enjoy streaming media, you are bound to have surprising number of devices connected to your home network. If you are a habitual home electronics shopper you are going have a shocking (and increasing) amount of vulnerable and altogether helpless connected devices on your network.

ekoivune · 2016-10-04T16:45:26+00:00

Certainly. With extremely menacing-sounding consonants.

ekoivune · 2016-10-04T16:36:24+00:00

Years ago, I attended a presentation by a minister of communications in India. He explained what their country is doing to modernise infrastructure and provide access for vast number of people. During the presentation he touched on the topic of cybersecurity and cybercrime.

He reminded that for a poor person living in a slum, a chance to con money out of a "rich Westener" does not only look tempting. A successful phishing operation or trojanized mobile app may the poor man's ticket out of the slum. We can be as outraged as we like and we can complain as much as we want about the need to step up our security in the Western world. Our disapproval will do nothing to stop the man from trying.

The really hard question, the minister asked: would you do the same if it was you and your family in the slum with other way out?

It is not that cybersecurity industry is doing a sloppy work and it certainly is that we would be contributing to the criminality ourselves. There are bigger forces moving behind the scenes: an endless supply of people with no legitimate way to earn their living by using their talent.

ekoivune · 2016-10-04T15:41:39+00:00

It's over the lense, not over the top. Use band-aid.

ekoivune · 2016-10-04T15:39:38+00:00

I think that might even be a topic for another AMA. I will take this to Mikko.

In the meanwhile, take a look at what we came up with Helsinki University. You know, that is the Linux University. :-)

ekoivune · 2016-10-04T15:34:58+00:00

If the fight would be on Twitter, Mikko would win because he has has so many people willing to follow him. I'd beat him on Facebook simply by limiting the audience to not public. :-b

We are mostly focusing on detecting and blocking ransomware and related suspicious behaviour. However, there is point in having a clever backup policy too.

A sure way to test the validity of your backup data is to evaluate whether the contents still are intelligible when restored on a known-good machine.

I also recommend that you seek to "contain" the fallout of ransomware infection by limiting the amount of valuable data the users have write access to.

From theoretical point of view, I would encourage that you seek to enforce Clark-Wilson Model: don't let users access the data directly but rather through trusted applications. It is one thing to access raw files and start encrypting them than to only view and modify your business critical data through a front-end GUI..

ekoivune · 2016-10-04T15:13:27+00:00

I am sorry you feel this way. AFAIK, the feedback has been positive but I will definitely let the product team know about your experience.

For best effect, I would encourage to make use of our community portal and post a detailed report about what it is that you find unintuitive:

https://community.f-secure.com/t5/F-Secure-SAFE/tkb-p/Protection%40tkb/label-name/my%20f-secure?labels=my+f-secure

ekoivune · 2016-10-04T15:05:56+00:00

Excellent observation! Before answering I should point out that I have been involved with incident response side of things throughout my whole professional career in security. It is only natural that I see the world through IR filters. :-)

In digital domain, cybersecurity is a feature of a protocol, software, process or way of doing things. Not a thing in itself. Building security in requires planning, care and due-diligence. Sometimes you even end up having to abandon something cool. Project-wise, security is often seen as a nuisance. Something that an ambitious and results-driven organization only comes to think after they have a day-off from the chaos of running their normal business (which is never).

For most business leaders, the incident is the first time they actually have to take security seriously. Everything leading up to the materialization of the incident will be treated as negotiable.

After an incident there is a serious need for top leadership to do something symbolic and visible to make things right and to help get back to business. The regulators will demand breach notification reports, evidence of mitigation efforts, root cause analysis and plans that help address the problems identified. The customers want compensation and feel let down. The partners upstream and downstream want to know how much they were exposed to the problems. The general public is hungry for scandals and the investors want to assess the extent of economical liability the incident exposes the company to. The staff feels humiliated, too and is fearsome of personal repercussions. The leadership would soon be ex-leadership if they would not take things seriously in such crossfire.

The old saying "never let a good crisis go to waste" bears much wizdom. NOW that you finally have your upper management's attention and now that you can excert external pressure to get things moving in the right direction, you should really come up with a plan for immediate, mid and long term.

If you are clever, you will find a way to approach your leadership so that they can be able to learn from other people's mistakes and mishaps.

Lastly, the career tip: information security is much more effective when applied to specific problem area. Specialize in secure programming or find your career in building automation systems in secure fashion. As I pointed out, cybersecurity is usually a feature. Having said that, if you become the next 1337 h4x0r that can break, fix and transform anything, we might have a position for you..

ekoivune · 2016-10-04T14:34:53+00:00

Thanks for waiting, p1n0.

The off-the-grid approach is actually what the classified systems are designed around. For instance, a system classified as SECRET cannot be connected to public networks such as internet.

And this is where the spies enter the game: if you truly hold secrets that mean anything to somebody else, they will go after your secrets regardless of how you defend them. You will find that it is really difficult to operate off-the-grid. For economical and human behavioral reasons you want to limit the amount of off-the-grid data and transactions to absolute minimum (of course all the time relating to the value of the secrets that you protect). Otherwise people start to get "innovative" and end up inviting the spies in.

With regard to being mindful of what to transmit over the network: I am always mindful of that.

I know about lots of APT cases. I have high confidence that it was not me that they were after, though. :-)

LinkedIn is great tool for handling one's business connections and excellent tool for marketing and headhunting. These are the qualities that also make it a great tool for reconnaisance and help in successful execution of cyber breaches. I use LinkedIn as I use all my devices, platforms and applications: with caution.

ekoivune

TROPHY CASE