About Over 50 Articles Library
Content: Services - Computer
Computer Security No 53: Wikileaks Scribbles & Whistleblower protection
Corporate - Private Computer Security
Wikileaks Scribbles & Whistleblower protection
Wikileaks released the manuals and code for yet another CIA tool for spying on whistleblowers. Scribbles allegedly embeds a web beacon-style tag into watermarks located on Microsoft Word documents that can report document analytics back to the CIA.
Scribbles works in the same way as the "tracking pixel" works, where a tiny pixel-sized image is embedded inside an email, allowing marketers and companies to keep track of how many users have seen the advertisement.
Scribbles won't work on encrypted or password protected documents and if such documents are opened in OpenOffice or LibreOffice, it may reveal the watermarks and the URLs for the user.
Note: CIA is legally NOT allowed to spy on American citizens on American soil, but may watch them in other countries.
Which brings us to the Whistleblower protection in Australia:
* It is offered through a "patchwork" of laws at federal (Public Interest Disclosure Act 2013) and state laws (one per state/territory)
* Exceptions are the national security whcih criminalises disclosure (National Security Amendment Act (No 1) 2014) and the Immigration (Australian Border Force Act 2015) which attracts imprisonment.
* There is also an Australian standard - AS 8003-2003 (Corporate governance-whistleblower protection)
Transparency International is a non-government organisation that deals with corruption and prevents criminal activities; unfortunatelly, it was marred by its own corruption scandals and internal politics.
(source: wikileaks, austlii.edu.au, wikipedia ; image source: wrongfulterminationsettlements.com)
Harvard Law - Emerging need for Cybersecurity Diligence in M&A
Steve Bowman, one of the top corporate governance experts in Australia, alerted us to the Harvard Law discussion on the need for due diligence in M&As.
It was posted in the forum by a few partners from Skadden US law firm.
"As a result of a few keystrokes, a company may find its customers' data sold on the dark web, its intellectual property in the hands of a competitor or its operations paralyzed by ransomware."
* data as an asset - was it compromised?
* are there penalties for non-compliance with cybersecurity and data privacy laws?
* does the target company meet the relevant industry standards for cybersecurity frameworks?
* should the acquiring firm engage a third party to assess if the target was already compromised? (average dwell time of malware before discovery is 146 days)
* deal T&C should include: costs to remediate gaps in risk and compliance, "imposing a materiality threshold or drafting exceptions in the disclosure schedule regarding the inability to know with certainty about cyber intrusions", cyber insurance (even for the transaction), etc
To read more: https://corpgov.law.harvard.edu
(image source: poormd.com)
Attacks to be aware of
Google is investigating a massive attack spreading through messages sent to Gmail users inviting them to view a shared Google Docs document. The link leads to a self-propagating Internet Worm.
CEO fraud is now at US $5.3 billion
Cyber criminals tried to steal 5.3 billion dollars through schemes what the FBI calls "business email compromise" -- also known as CEO fraud -- in a new report at its Internet Crime Complaint Center.
Previous FBI reports showed cyber scammers attempted to steal $3.1 billion from October 2013 through May 2016.
"The number of business-email compromise cases, in which cyber criminals request wire transfers in emails that look like they are from senior corporate executives or business suppliers who regularly request payments, almost doubled from May to December of last year, rising to 40,203 from 22,143, the FBI said.
The survey does not track how much money was actually lost to criminals. However, the FBI said that about one in four U.S. victims respond by paying money to fraudsters. Victims have about 24 hours to try to claw back the money, but if it gets past that deadline, the risk of losing everything is high because the bad guys have likely cashed out by that time.
Incidents known to FBI are just 20% of total."
HandBrake for Mac
HandBrake is a tool for converting video from nearly any format to a selection of modern, widely supported codecs. Users who downloaded this recently (May 2017) - may have been infected by a Trojan
(image source: toonpool) (info sources: Check Point, Knowbe4 )
Cyber Security & Privacy suite for Directors and Executives
Are you prepared to discuss cyber at Board level? Are you aware of your obligations and defence as a director or officer of the company? Have you taken the necessary steps to mitigate the consequences of a cyber attack?
ABG offers the Cyber suite of course modules:
- Cyber threats and defences Module - Tactical plans
- Directors and Officers Module - Strategy
- Risk Management Workshop for Cyber
- Cyber Crisis simulation
Send your enquiries to firstname.lastname@example.org
Ransomware discussion (Part 3)
The Ransomware discussion and ways to prevent or deal with it if it happens is in the fortnightly odd-numbers of the Newsletters (Corporate Security).
You are infected - what next?
1. Disconnect the infected computer from the network. Turn off WiFi capabilities (WiFi and Bluetooth). Unplug any USBs, exernal drives. Do NOT erase anything and do not switch the computer off, just disconnect
2. Determine the scope: make an inventory of what was infected:
*shared or unshared files/drives
*USB memory sticks
* Cloud based storage (Dropbox, Google drive, Microsoft OneDrive/Skydrive, etc)
3. Determine the strain
4. Evaluate responses
To be continued in Newsletter #55.
Memories of jokes
Moderated by Monica Schlesinger: www.advisoryboardsgroup.com.au
© About Over 50s 2017 website by aml websites online