Mental illness, Homelessness, and our Security

You might ask: Why are so may people with Mental Illness out on the streets or homeless? President Reagan has most of the responsibility why so many people with mental illness are homeless. At least one third of those living on the streets and half of our jailed population suffer from mental illness, and should be in institutions specifically designed to help these individuals. During his presidency in 1980 (a sad time), Regan stopped funding federal community mental health centers, thus removing services for those people who suffered with mental illness. While he was the governor of California, he had done something just as cruel and he released over half of the mental hospital patients in the state. He even passed legislation wiping out a requirement for involuntary hospitalization for those with mental illness. As so often is the case, as the president goes, so goes the country. As a result, states followed suite, and started to open the gates of mental institutions throughout the country. Ironically, in 1981, President Reagan was shot by John Hinckley Jr., who had mental illness. Is there a connection with so many of the shooters out and about hurting and killing so many innocent people and President Reagan? I think so!

Watch out for Email Scams About the Olympics

There are reports that hackers are using a 2018 Winter Olympics Phishing Campaign that hides malicious attacks inside of an image! Why is this particularly dangerous? Not only does hiding the attack inside an image help it evade detection, but once it actually runs, it uses a technique that generally won't get picked up by traditional antivirus solutions. How is the Attack being Done? The attack is being delivered via phishing emails disguised as alerts from the country's National Counter-Terrorism Center, with malicious Word documents attached. Once opened, the Word doc encourages readers to enable content. DO NOT ENABLE CONTENT. The tricky aspect of this attack is that no download of the actual image is necessary: malicious code can be run from either downloaded images or images hosted on the web. That means an attacker doesn't necessarily need to download an image onto a machine in order to get the malicious code to run on that machine. What to do to protect yourself and your company • Do not to open email attachments from senders you don't know: You should be especially wary of Word documents that ask you to enable content/macros. • Do not click on any links in an email

Third Party Risk

A phone call or personal meeting are often crucial for success when dealing with third parties that have access to your critical or confidential data. East coast partners like morning meetings; I think they take great pleasure in doing this to us Californians to get back at us for the amazing weather we have. When we have business partners, we have to get assurance that they are practicing appropriate security and have a mature security program with good security controls. Make sure you have security standards to share with your partners, and ensure that they can follow them. These standards should cover contract language, their development environment, coding standards, ongoing assessments of their systems and processes, and much more. The last thing you want is for a breach of your data to occur and you had not done adequate assessments of your business partner.

How to secure budget for some key initiatives; a sales pitch to the C-Suite - Build a presentation on the increase in cyber risk to the company - Goal is to convince the C-Suite that ownership of risk needs to be at their level. You need to build a culture of security awareness throughout the organization The CISO must hone their skills as a salesperson or public relations master. Security must be sold as a crucial part of the business culture of the organization. Concise points with little to no technical information is crucial if you want to keep the level of attention of the key decision makers. Rehearse your sales pitch and keep it short. Graphs and charts with red/orange/green representing current status seem to be examples of good approaches. The absolute last thing you want to present is the number of attacks, or, for that matter, the number of anything! Talk risk, likelihood, and potential impact to the business. Speak in “businessese”.

What do you do if you suspect you have a phishing attack? What is your response plan? Does it include: Request forwarding, as an attachment, of the suspicious email? Analyzing the url links, headers, sender address, business need or applicability? Were there any attachments? If yes, filter through Virus Total or some other reliable online tool looking for reported vulnerabilities. If the attachment or url are malicious, check the logs for user activity and be sure to interview the user or users. Interviewing the user is important to ascertain if they either intentionally or inadvertently clicked on a link to a possible malicious site. But review the logs, as often users either don’t recall, or will not admit their behavior. Clearly some technical knowledge and skills are necessary to address this possible security incident. But there also is a project planning aspect to managing this. Having a good Incident response process has always been important, but with the proliferation of phishing attacks on all businesses and organizations, never more so than today. This must be one of your highest priorities. Mock drills are an essential part of this process. Just like testing backups, testing your IR plan is crucial. You have to know if you have been breached.

Synergy Between the CISO and Application Development

CISOs must work collaboratively with the heads of Application Development to ensure a Secure Development Life Cycle process is being implemented and followed. Developers must be following our secure coding standards. Are secure ESAPI libraries being used? ESAPI (The OWASP Enterprise Security API) is a free, open source, web application security control library that makes it easier for programmers to write lower-risk applications. An effective CISO must have some knowledge of Application Security best practices. OWASP, the Open Web Application Security project is a great resource for this. It is a not-for-profit international organization of volunteers who are passionate about secure coding and development. Most CISOs I have known, other then the few who came up as developers, are admittedly weak in this area, and will often rely heavily on the myriad of tools and projects from OWASP. The most recognized is the OWASP Top 10, a broad consensus about what the most critical web application security flaws are. Part of a good Application Development Security Strategy is having both static and dynamic application vulnerability scanning in place. These scanning tools cannot be run out of the box; they need configuration.

Great Conference in Los Angeles The Eighth Annual ISSA-LA Security Summit is coming to the the Universal City Hilton on Friday May 20th. On May 19th there will be four in-depth training classes at unbelievably reduced pricing. Jack Daniel, one of our industry’s most well respected experts, will deliver the Opening Keynote. Cory Doctorow, co-editor of the popular weblog Boing Boing and a contributor to The Guardian, Publishers Weekly, Wired, and many other newspapers will deliver the Closing Keynote. Of course you are getting many emails to attend lots of conferences, but the line-up of speakers at this Summit is of the highest caliber. Are you a CISO or want to rub elbows with CISOs, and learn about the key issues? Come to the CISO Forum and hear from Malcolm Harkins, ex-CISO of Intel and Mark Weatherford, former DHS First Deputy Under Secretary for Cybersecurity, and the former first CISO of California. Are you in Healthcare? Join in the Healthcare Privacy and Security Forum. Want to learn how to properly protect your applications? Come listen to Jeremiah Grossman, founder of Whitehat Security, Jim Manico, OWASP Board member and Java expert, and Chenxi Wang, former VP at Forrester. And our world class speakers don’t stop there. We have Bob Bigman, Former CISO of the CIA, Dr. Robert Pittman, CISO, LA County, a Law Enforcement Panel, and a CTF for those who are technical experts. And don't forget our exciting panel: Privacy vs Security, Apple and the FBI. Visit: summit.issala.org and sign up now to join 1,000 of your peers, before prices go up April 20.

Looking Back at 2015

As we look back at 2015, we find ourselves thinking about a tumultuous year. IoT has finally hit center stage, with the potential to revolutionize our society, while at the same time setting the clock back in advancements in Information Security. Security companies continue to be absorbed into IT companies, a trend that started 5 years ago and just keeps on rolling. Mass shootings on the domestic front have increased the cry for more gun control, while ISIS has gained even more prominence, and is utilizing social media more than any terrorist organization before. Many of us find ourselves troubled and in deep thought as we still have two recent horrific events fresh in our minds, one in Paris, and one in our own backyard in San Bernardino. These physical attacks come in the midst of years of ongoing successful cyber-attacks, creating a world where both our personal and online safety are being assaulted. We must stand strong and united, and networking organizations such as ISSA-LA have a large role to play. ISSA-LA has hundreds of fellow professionals as a part of our community, and the more we share, the more we meet and talk together, the better we will all be prepared for the next attack. Sadly, for cyber-attacks, it is now not a matter of if, but a matter of when. For the more dramatic and scarier physical attacks, we must not think of compromising what and who we are, by allowing any reductions in our freedoms. We cannot lose our identity as a great country founded on the principles of FREEDOM. After 9-11, the Patriot Act was such a compromise. It led to the NSA surveillance activities, where all of us were spied upon by our own government. Obviously we find ourselves in a very difficult situation. If our loved ones were lost in one of these physical attacks, we would most likely be filled with rage and unbelievable sadness, and probably be willing to sacrifice individual freedoms to stay safer. In some areas of life, many Americans appear willing to accept additional hassles, with airline travel coming to mind. We must be careful not to become who we are protecting ourselves from.

ISSA-LA and HIMSS Southern California present the Third Annual Healthcare Privacy and Security Forum, June 4th at the Los Angeles Convention Center.

This event will bring together leaders in Privacy, Security, and Risk Management within government and private industry for a day of collaboration, networking and presentations by leading Privacy and Security professionals.

We are pleased to have two world class Keynote Speakers

Bruce Schneier, Chief Technology Officer of Co3 Systems

- Fellow at Harvard’s Berkman Center

- Board Member of EFF

and

David Kennedy, Founder and CEO of TrustedSec

- Co-Founder and CTO Binary Defense Systems (BDS)

REGISTER NOW

BECOME A SPONSOR

AppSec California 2014 an off-the-charts success

Surf, Sand, Security! Over 250 people got together at the Annenberg Community Beach House and discussed security on the shores of Santa Monica, California. An All-Star cast of speakers spent two days sharing their knowledge with conference attendees and each other in between breaks looking at the blue waters of the Pacific Ocean and volleyball players on the sands adjacent to the conference. A more perfect setting would have been hard to imagine.

https://appseccalifornia.org/

Video recordings of the 2-day event will be posted next week.

Plans are already under way for AppSec California 2015 at the same location.

OWASP Back in San Francisco during RSA

Jim Manico and Eoin Keary will be offering a free boot camp training on Monday, February 24, 2pm - 5pm, at Jillian's, across the street from the Mascone Center. "This intensive boot camp focuses on the most common web application security problems, including aspects of both the OWASP Top Ten and the MITRE Top 25. The course will introduce and demonstrate application assessment techniques, illustrating how application vulnerabilities can be exploited so students really understand how to avoid introducing such vulnerabilities in their code and understand fixes.

http://owasp.blogspot.com/2014/01/free-owasp-training-and-meet-up-in-san.html

This is great news, as OWASP had earlier pulled out of RSA and cancelled their co-marketing agreement with the RSA Conference.

Surf, Sand, Security!

Get together with your peers and discuss security on the shores of Santa Monica, California.

January 27 — 28, 2014

Come join OWASP Chapters from Los Angeles, Orange County, San Diego, Santa Barbara, and the Bay Area as we gather at the Annenberg Community Beach House to network and share information with the country's leaders in information security. 

https://appseccalifornia.org/

Quick Tips for Handling and Securing your Laptop

Treat your laptop like cash!     

 

If you had a wad of money sitting out in a public place, would you turn your back on it – even just for a minute?  Would you put it in checked luggage?  Leave it on the backseat of your car?  Keep a careful eye on your laptop just as you would a pile of cash. When outside the office, never leave it unattended.

Do not leave your laptop in your car.

Don’t allow your laptop or anything of value to be visible from outside of your car. If you have to leave a laptop in a vehicle, put it in the trunk before you depart, not when you arrive at your destination, thus avoiding anyone seeing a laptop in an unattended vehicle. Never store a laptop in the trunk over night or over the weekend.

Do not allow anyone else to use your laptop

Don’t allow your laptop or anything of value to be visible from outside of your car. If you have to leave a laptop in a vehicle, put it in the trunk before you depart, not when you arrive at your destination, thus avoiding anyone seeing a laptop in an unattended vehicle. Never store a laptop in the trunk over night or over the weekend.

Ensure that your laptop has been encrypted

All laptops should be encrypted, as they are too easy to loose or be stolen, and it is too easy to forget what you may have stored on them. Something could be confidential.

 Record identifying information and mark your equipment

Record the make, model and serial number of your laptop and keep it in a separate location. Have a luggage tag on your laptop case, labeled with your contact information.

Secure your laptop when in the office

Secure your laptop by locking it in a docking station, if available. You can also use a security cable, a locked office or locked cabinet.  Do not set the laptop on the desk and then walk away with it unsecured.

Keep it off the floor                                

No matter where you are in public – at a conference, a coffee shop, or a registration desk – avoid putting your laptop on the floor. If you must put it down, place it between your feet or at least up against your leg, so that you’re aware of it. Laptops on the floor can easily get stepped on, kicked, and stolen

Do not store your password with your laptop

 You should secure your laptop with a strong password, but don’t keep the password in the laptop case or on a piece of paper stuck to the laptop.

Be very careful while travelling with a laptop

You should secure your laptop with a strong password, but don’t keep the password in the laptop case or on a piece of paper stuck to the laptop.

Studies have shown approximately 12,000 laptops per week are lost or misplaced in US Airports!

Consider non-traditional bags for carrying your laptop

When you take your laptop on the road, carrying it in a computer case may advertise what’s inside. Consider using a suitcase, a padded briefcase or a backpack instead.

Do not store your laptop in checked luggage.

 Never store your laptop in checked luggage. Always carry it with you.

Be vigilant in hotels

If you stay in hotels, a security cable may not be enough. Try not to leave your laptop out in your room. Rather, use the safe in your room if there is one. If you’re using a security cable to lock down your laptop, consider hanging the “do not disturb” sign on your door.

Keep track of your laptop when you go through airport screening

Hold onto your laptop until the person in front of you has gone through the metal detector. Watch for your laptop to emerge from the TSA scanners.

Backup your files

 Don't forget to always ensure that the files on your laptop are copies of the originals that you  have on a server somewhere.

Very mixed day: Obama Notifies of Intent to Veto CISPA, but Gun Control Dies

The suspense is over as Obama actually stands tall again, in defense of Americans' privacy. No get out of jail free card for the corporations who want to share private data. Back to the drawing board for Congress. Can they ever get it right? We all know what is needed, but Congress is just too busy trying to manage all that lobbyist money. It's a lot to keep track of! I applaud the efforts of the ACLU in keeping the pressure on Obama; he actually used some of their language in his statements.

However, what is the deal with this lack of responsible gun control? We're not talking about taking guns away from anyone, except possibly those who are so screwed up as to fail a reasonable background check. Now, wouldn't we want this to occur? This one has the major support of the majority of Americans, but the NRA is way out of bounds here. It's almost too absurd and blatant to believe. I don't need to hear another person screaming "guns don't kill people, people do"! Some people should not have the guns that kill people.

Healthcare HITECH Privacy and Security Summit, May 21 at the Universal City Hilton

HIMSS (Healthcare Information and Management Systems Society) Southern California has partnered with ISSA-LA (Information Systems Security Association Los Angeles) to present the Healthcare HITECH Privacy and Security Summit, May 21 at the Universal City Hilton.

This event will bring together leaders in Privacy and Security within government and private industry for a day of collaboration, networking and presentations by leading Privacy and Security professionals. You will learn from experts what you need to know to comply with new HITECH rules and OCR investigations.

Keynote Speaker

Howard Schmidt

White House Cybersecurity Coordinator, Retired

Special Advisor to President Obama

“The Summit is packed with an All-Star cast of speakers, who will share their knowledge and experience to help prepare covered entities and business associates to meet the September 23, 2013 Compliance Deadline of the final omnibus rule”, according to Richard Greenberg, ISSA Fellow, Los Angeles Board member, and Information Security Officer for Los Angeles County Public Health. The U.S. Department of Health and Human Services (HHS) published  the rule, which modifies the privacy and security, breach notification, and enforcement regulations now a part of the Health Insurance Portability and Accountability Act of 1996 (HIPAA).

“You’ll hear directly from a wide variety of professionals, including  Yun-kyung (Peggy) Lee of the U.S. Department of Health and Human Services, Office of Civil Rights, who will prepare attendees in case of an OCR investigation”, continued Mr. Greenberg. “We have attorneys, CISOs, a Privacy Officer, and other experts who will engage with attendees as part of panels on BYOD and Business Associates, and during the Roundtable Luncheon.”

According to the Open Security Foundation's DataLossDB, which tracks the loss, theft, or exposure of personally identifiable information, out of the 1,520 total incidents reported last year, 327 occurred in the medical industry, making it the most widely breached industry in the United States. Healthcare has been one of China’s priorities in its 15-year science and technology development strategy for 2006 to 2020, and has resulted in a surge in campaigns against Healthcare firms.

The Summit provides an excellent opportunity to learn how your peers are handling important privacy and security issues arising from HITECH, such as data breaches, compliance, and mobile device security. The Summit provides a collaborative environment where attendees and speakers can network, share experiences, and learn from one another.

The Summit will be held on Tuesday, May 21, 2013 from 7:30 am to 6:30 pm at the Universal City Hilton.

ISSA-LA is the premier catalyst and information source in Los Angeles for improving the practice of information security. The Chapter provides educational programs for information security and IT professionals. The Chapter conducts outreach programs to businesses, financial institutions, nonprofits, governmental agencies, and consumers.  ISSA-LA is the founding Chapter of the Information Systems Security Association, an international not-for-profit association of information security professionals and practitioners.

For more information or to register for the Healthcare HITECH Privacy and Security Summit, please visit: http://www.issala.org/summit/healthcare-hitech-privacy-and-security-summit/

The agenda can be viewed here:

http://www.issala.org/wp-content/uploads/2013/04/Healthcare-Summit-Schedule-7.2.pdf

Who Should Attend

•       Privacy Professionals

•       Security Professionals

•       Risk Management Professionals

•       Clinicians

•       Hospitals and other Healthcare Providers

•       Health Plan Professionals

•       Employers and Healthcare Purchasers

•       State, Regional and Community-Based Health Information Organizations

•       Public Health Officials

•       Pharmaceutical, Biotechnology and Medical Device Manufacturers

•       Healthcare IT Consultants, Suppliers and Vendors

•       State and Federal Policy Makers

•       Health Services Researchers

•       Academics

•       Chief Executive Officers

•       Chief Operating Officers

•       Chief Technology Officers

•       Chief Financial Officers

•       Compliance Officers

•       Health Law Attorneys

•       Medical Directors

•       Physicians

•       Managed Care Professionals

•       Medical Group Managers

•       Data Managers

•       Ethics Officers

•       Health Insurance Executives

•       Consultants

•       Government Agency Employees

•       Health Administration Faculty

The Los Angeles Chapter of the Information Systems Security Association (ISSA-LA) invites you to partner with us at our Fifth Annual Information Security Summit, “The Growing Cyber Threat: Protect Your Business!”  The Summit is the premier Information Security event in Southern California. Last year we drew 500 people, and our goal for this year is 700.

 

The Summit offers information systems and information security vendors a very high-value marketing opportunity. By taking advantage of Summit and meeting sponsorships, your products and services get associated in the marketplace with ISSA-LA’s leadership; this enhances the market’s perception of you as an industry leader in the 18th largest economy in the world — Los Angeles County. 

 

We have many different sponsorship levels designed for every type of budget, including a set of premier sponsorships that include the full Summit attendee list. The top level sponsorships also bring with them an opportunity to address the full audience.

 

To register to be a Summit V Sponsor, please visit our Registration Page:

http://issa-la-securitysummit-v-sponsorship-es2002.eventbrite.com/

 

For more information about the Summit, including speakers, please visit our Summit website:

http://www.issala.org/summit/

 

For more information about sponsorship, please visit:

http://www.issala.org/summit/sponsor-program/ 

 

OR

 

Contact our Vendor Director, Richard Greenberg, at:

Vendor_Director@issa-la.org

 

We hope to see you there!

Government in bed with Communications Corporations

It is now illegal for wireless customers to purchase and unlock their cell phones! We know that George Orwell's and Aldus Huxley's visions of the future have unfortunately come to pass, but this is getting ridiculous and outrageous. http://tinyurl.com/ahpzo67

Oracle, what the hell are you doing to us with Java? Be merciful, and hire some really good analysts. This cannot continue. And, what is the deal with trying to sneak the Ask Toolbar into our Java updates? You're acting like rogue software companies. Enough is enough!

OWASP Monthly Meeting - January 23, 2013

• 7:00 PM at Symantec Corporation
• 900 Corporate Pointe , Culver City, CA

  owaspla.org
• • Top Ten Web Defenses

  We cannot “firewall” or “patch” our way to secure websites. In the past, security professionals thought firewalls, Secure Sockets Layer (SSL), patching, and privacy policies were enough. Today, however, these methods are outdated and ineffective, as attacks on prominent, well-protected websites are occurring every day. Website developers must learn to code in a secure fashion to have any chance of providing organizations with proper defenses in the current threat-scape. The session will provide specific tips and guidelines to make website code both low risk and less vulnerable.

  • Bio: Jim Manico

  Jim is the VP of Security Architecture for WhiteHat Security. Jim is also the host of the OWASP Podcast Series, is the committee chair of the OWASP Connections Committee, is the project manager of the OWASP Cheatsheet series, and is a significant contributor to several additional OWASP projects. Jim provides secure coding and developer awareness training for WhiteHat Security using his 8+ years of experience delivering developer-training courses for SANS, Aspect Security and others. He brings 16 years of database-driven Web software development and analysis experience to WhiteHat and OWASP as well. Jim works on the beautiful island of Kauai, Hawaii where he lives with his wife Tracey.

  
  

  • Sponsor: WhiteHat Security

  Founded in 2001 and headquartered in Santa Clara, California, WhiteHat Security provides end-to-end solutions for Web security. The company's cloud technology platform and leading security engineers turn verified security intelligence into actionable insights for customers. Through a combination of core products and strategic partnerships, WhiteHat Security provides complete Web security at a scale unmatched in the industry. WhiteHat Sentinel, the company's flagship product line, manages thousands of websites -- including sites in the most regulated industries as well as top ecommerce, finance and healthcare companies.

  www.whitehatsec.com

Portable Device Security

Theft of tablets, laptops, smart phones, and other portable devices is on the rise. Originally stolen for their street value, these devices are becoming more and more a target for the information they carry. As these devices become smaller and lighter, they become more vulnerable to theft.

Common high risk areas of concern continue to be:

• airport security checkpoints
• airport curbsides, ticket counters, and gates
• airplane overhead compartments
• hotel rooms, and
• inside cars.

Losing a laptop is not just the loss of money: it is a significant loss in productivity and resources, especially if the data contained on it is not backed up. Even more serious is the loss of potentially sensitive information.

Basic common sense steps can be taken to help protect these now ubiquitous targets.
• Do not check your laptop with the rest of your baggage. It may become damaged, lost, or stolen.
• Keep your laptop in sight. When going through security checkpoints, do not place your laptop on the belt until the checkpoint is clear for you to walk through. Be especially careful when using the restroom or making a phone call. It takes a thief only a moment to walk off with your belongings. On the plane, if not using the laptop, stow it under the seat in front of you, not in an overhead compartment.
• Do not rest your laptop on top of a rolling luggage carrier.
• Keep your laptop with you on a train instead of putting it in the luggage compartment near the exit, where thieves have easy access.
• Don't leave your laptop or briefcase inside a car. If you must, store it inside the trunk, out of view.
• Never leave your laptop unsecured in a hotel. Use the hotel safe or a locking cable, or hide the laptop. Do not assume that your laptop is safe just because you are staying in a reputable hotel. Consider leaving the TV on at a moderate volume and placing a "Do Not Disturb" sign on the door when leaving the room so potential thieves will think the room is occupied.
• Avoid temperature extremes. To avoid damaging your laptop and data, don't start the computer when it is extremely cold or warm. Manufacturers recommend ambient temperatures of 45-95 degrees Fahrenheit. Allow your laptop to come to room temperature before powering it on.
Protecting the Information
• Ensure current antivirus protection. Connecting from a hotel or other travel site puts you outside the protection provided by the County's firewall, so be sure your laptop's virus definitions are up-to-date before traveling. Virus definitions are normally automatically updated on PCs managed by the company, when connected to the Internet.
• Never store a password on the computer or in the computer bag. A stolen laptop with a stored password provides easy entry to a company’s network.