HW #3

Bill Hurley

Zappos Breach: 8 Lessons Learned

January 17, 2012 12:30 PM

http://www.livebinders.com/play/play/283368

In an unfortunate set of events, Zappos.com was hacked, leaving 24 million of its customers with their privacy breached. This has led to eight lessons that a business should focus on when being in a virtual aspect of the market. Number one is to advance planning mitigates breach fallout, which Zappos did fallow through with but there is still a chance of breach. So, it would be smart to put all credit card and user data in a separate database. Number two is to create a response plan in advance. Zappos did mane a precautionary plan, which all employees were emailed with details of the breach and had them notify customers. Now this part of any business plan that includes the public as a whole reacting to something comes number three, issuing a timely and clear warning. With Zappos, they immediately issued a clear and timely notified its customers of the breach. They were notified to change passwords and the list goes on. In step four, it covers how to secure stored credit card data with crypts. These are really helpful because the hacker never got the credit card info from Zappos for this reason. Next with number five, you have to notify customers in multiple ways. Zappos only emailed its customers, while a good provision would be to use other methods as well. Something all businesses that go overseas with their merchandise because of an online market is that you have to think about these people as well, not just people from the U.S.. number six is to focus on the customers your business holds outside of the United States. Now number seven is to tap external sites if necessary. Zappos did not do this and it really hurt their reputation with customers from other countries because they cut them off to slow down internet traffic on that site. Lastly, number eight is to pick the right breach support channels. Zappos cut phone support but informed all employees to help customers with their questions or concerns, this is a good call because it let their customers know that they cared and were trying to fix what went wrong with everyone’s accounts.

10 Security Trends To Watch In 2012

In 2011 there were nonstop waves of hacking, malware, and spear-phishing attacks that succeeded in exploiting well-known businesses, including RSA and Sony. The article I chose is called "10 Security Trends to Watch in 2012" and written by Mathew J. Schwartz. Throughout the article, I learned that according to the 2011 data breach investigations report from Verizon, for example, the number of attacks launched online against businesses between 2005 and 2010 increased by a factor of five. A good way for business' to keep their mobile devices safe could be to take a more rigorous approach to securing mobile devices, including tracking them when they go missing, and ensuring that remote-wipe capabilities are in place should it be too difficult or expensive to recover the devices. All social-engineering attacks succeed based not on technological sophistication, but rather by fooling users. It costs little to send someone an email that redirects them to a fake PayPal website, which tricks them into entering their actual PayPal username and password, which is then passed to attackers. Today, all 50 states effectively require that businesses notify their customers when their personal information has been potentially exposed. But different notification requirements, for example, for medical records means that although many breaches might be disclosed to government watchdogs, they might never be fully disclosed publicly. Germany enacted a federal data-breach notification law in 2010, and other European countries have expressed interest. Meanwhile, Canada is weighing changes to its Personal Information Protection and Electronic Documents Act (PIPEDA) that would make data breach disclosures mandatory for that country's businesses. Accordingly, social engineering attacks aren't going away. Furthermore, with 800 million people now registered on Facebook, and 175 million on Twitter, expect attackers to spend more time targeting social networks.  To wrap this up, I feel that not only as a country, but the whole world should take a close look at this and change what we’ve been doing to be more prepared if anything like this was to happen to your company.

HW #3 Google's Privacy Policy Change

The following blog post is commentary on an article on Information Week titled "Google Privacy Change Provokes Outrage" by Thomas Claburn on January 25th, 2012.

Google’s new privacy policy is provoking outrage across the world. They have recently combined all of their privacy policies into one. All of their services – Google Plus, Gmail, Google Maps, and over 60 other various services have combined their privacy policy.

So, what does this mean for users? For one, it means that all of the information we give to Google – our searches and the results we find from them, our friends, our location, and more are all now integrated into the same system. Advertising has become far easier and Google’s product (its users and their information) is much more valuable.

This also means that Google is at an ethical crossroads. Information is harder for the end user to control and there is no way to turn off Google’s constant mining of your information. Use a Google product and they record exactly what you’re doing with it. They then use that information to advertise to you.

It’s worth mentioning that Google didn’t bring up the benefits they’re receiving from the privacy overhaul. Instead, they masked their own benefits by telling users what they wanted to hear: Google has a brand new privacy policy that is easy to read and understand – and it covers all of the products we’ve come to love.

Ethically, the argument could be made either way for or against Google’s new privacy policy.

From a Kantian view point (second construct), Google is using its users as an end to a mean: use our product and we’ll use your information. And so this new change is wrong. It is hard to apply the first Kantian construct because not all companies are in a position similar to Google’s and few companies have a similar business model.

From a Utilitarian view point (is it for the greater good?), one would need to assign a value to users’ privacy and determine how much of such value was lost. Then a value would need to be given to the users benefit: advertising even more focused on their needs and an easier to read and understand privacy policy. Few people even read the privacy policies to begin with and so that value would likely be small. The problem with using a Utilitarian viewpoint is that depending on who you are you may assign different values to each factor.

So, what values would you assign? Is what Google is doing right or wrong? 

You can read Google's new privacy policy at http://www.google.com/intl/en/policies/privacy/preview/

Homework #3

Google Launches Marketing Campaign on Security and Privacy

Article by Sara Yin

January 17, 2012

            According to the article, “Google launched a multi-million dollar advertising blitz promoting online privacy and security”.  This public service-like campaign is also to repair its reputation about securing users’ personal information.  The ad wants people to visit its “Good to Know” website that includes tips on staying safe online and managing data that is shared with Google and other websites.  In the campaign, it shows definitions for “cookies”, “two-step authentication” and “malware”, etc.  Google’s privacy record has not been so good.  It has violated its users’ online privacy and has been blasted by journalists, politicians, security experts, and privacy watchdogs about it.  When the Google Buzz social networking site was launched in 2010, Google accidently exposed the contacts of its Gmail users.  This resulted in a class action lawsuit and Federal Trade Commission settlements.  Executive director of the Center for Digital Democracy, Jeff Chester, said, “If grades were given out for privacy protection, Google would get a D plus.”  If I were a Gmail user, I would have been mad if all my contacts were out on the internet for people to see.  Since everyone uses Google because it is such a large search engine, they should really crack down on their privacy settings.  I think it is good they are launching this campaign because they need to secure their users’ personal information.  Before reading this article I did not really know that they had privacy issues or that personal information was being leaked.  They should be spending millions of dollars on this campaign because privacy settings and security is really important on the internet.

HW #3 Cyberterrorism

The name of the article that I chose to summarize was called FBI To Get More Cyber Crime Agents: But is the bureau focusing too heavily on cyber-terrorism, as opposed to fighting cybercrime? The article was written by Mathew J. Schwartz who is an author for the free IPAD application InformationWeek. It was published on December 20^th, 2011.

In this article, the author Schwartz talks about how the FBI is receiving more cyber special agents. This is happening due to the increase funding for a number of type of investigations such as computer intrusions and cyber investigations. A new bill called the Departments of Commerce and Justice, and Science, and Related Agencies Appropriations Bill for 2012 have given the FBI the appropriate funding to do such things. According to this bill, the FBI is in a unique position to counter cyber threats, as it is the only agency with the statutory authority, expertise, and ability to combine counter-terrorism, counterintelligence, and criminal resources to neutralize, mitigate, and disrupt illegal computer-supported operations domestically. An increase in the cyber-investigation budget will allow the FBI to fund 42 new positions in their unit.

The FBI houses about 30,000 employees and in each of their 56 field offices across the country they now hold cyber squads in those offices. The FBI also holds about 1,000 agents that are specially trained cyber agents analysts, and digital forensic examiners.

What do I think about this? I think that it is a great idea by the FBI to use our taxpayer money to help out the cyber-terrorism unit. If you think about it nowadays everyone has a computer and uses it to be in contact with someone about something. Terrorists can make a Facebook group and start planning attacks on places. They could also be in contact with other terrorist on Twitter and Facebook as well. They also post ideas to forums as well. What the Cyber-terrorism unit will do is that they will monitor those questionable groups and twitter accounts to see if any outside terrorism groups are planning attacks on the USA or another country. However I do think that monitoring people’s computers is wrong but that is a different discussion for another day. 

 Matthew Cerullo

 

Homework #3

Homework #3

Kimberly Lawlor

Cyber Attacks Becoming Top 10 Terror Threats.

            The article I chose to read was called Cyber attacks becoming top 10 terror threats, published February 1^st by information week. This article caught my attention right away because it says,” Hackers will one day outstrip terrorists as top threat to U.S., FBI director tells a Senate committee. Attacks predicted to become more complex and frequent.” This article basically talks about how the cyber attacks against the government agencies and business throughout the United States continue to grow rapidly. It is growing so rapidly that they expect it to the terrorism. Right now it is not their top worry, the FBI’s main focus is to stop terrorism but they do they say that down the road cyber attacks will definitely be number one. The interest in cyber security remains very high at this point by the house, senate, and congress and trying to make a movement. The only concern on this movement would be the price of the overall senate bill.  So this hearing for doing this will be within the next week or so. The sophistication on the internet with threats is a scary thing that people can hack into so many different things because everything is now done on the internet. Like for myself I pay my bills and online shop and it is very easy for hackers to steal your credit card numbers, social security numbers, and steal your identity or all your money. This is a huge concern for me, and I could definitely see why it is up and coming to be a number one threat to the United States. Technology is so powerful it is a scary thing; we even talked about in class how you can use a website to call someone and make it look like another number. This is only a website; imagine the millions of things hackers can do online and come up with, it is a scary thing. China and Russia are two of the biggest threats, and have enormous cyber capabilities; they are at the top of the list for cyber concern. The threats have been continuing to grow and will only get worse so I think we need to put a lot of attention to this matter and handle it the safest way.

Homework 3

Feds Seek Stronger Security For Power Grid - January 10, 2012

The Department of Energy and the Department of Defense have teamed up to create a cybersecurity model that can be tested and applied across the utility industry to provide insight into how to better protect the U.S. electricity grid. The Electric Sector Cybersecurity Risk Management Maturity Model pilot project aims to work with experts in both the public and private sector to use existing cybersecurity strategies to develop a so-called "maturity model" that can identify how secure the electricity grid currently is from cyber threats, The Obama administration has put a particular focus on protecting the electricity grid and other control systems from a persistent and growing cybersecurity threat, and patterning with the private companies that control that sector has been key to the effort. The reason I have found this article interesting is because it shows that the threat of hackers is even a concern on a national level. In class, we saw the virus that hit MIT and the affect it had. If there is a hacker out there smart enough to take down the entire power grid the country would go into complete pandemonium and chaos. All security measures for all businesses and banks are run electronically now. There will be no security cameras to watch over people. Even if the power grid went down for an hour, most businesses and banks could be wiped out. I think its a very smart idea to start testing strong cybersecurity plans for all utilities in the U.S. I also found the fact that modern day hackers are focused more on control systems rather than computer software. Basically, hackers are trying to take down the top of the line security structures in the world rather than what is now considered easy items to hack, like CPU's. The first thing to pop into my head when I first read the article was actually the movie, Live Free or Die Hard. In the movie, an ex-government hack defense agent hires the nation's best hackers to essentially hack into and shut down the power grid. So I feel that the defense for our nation's utilities systems have been a growing concern for the past decade or so.