In August 2015 The Register reported that some phones that utilize fingerprint security were storing fingerprint scan data in unsecured files. At the time the Samsung Galaxy S5 and the HTC One Max were storing the fingerprint data used to unlock them in a easily accessed “world readable” image file that any unprivileged apps or processes can steal.
That prompted us to speculate what happens when your biometric data gets compromised? Passwords can be reset but fingerprints and retina scans cannot!
Well, fast forward a year and a piece on Bloomberg.com is addressing that very real concern.
As it turns out, an obscure Illinois law is virtually the only think protecting your biometric data, regardless of how it has been obtained. The 2008 law, known as BIPA (Biometric Information Privacy Act) was established after Pay By Touch, a fingerprint scan to pay company went bankrupt and proposed selling its database.
From that very specific, obscure and humble beginning BIPA has morphed into the only credible law on the books in the United States that serves to protect your biometric data. On a near daily basis you or someone you know is passing their biometric data willingly (using a fingerprint to unlock a smartphone) or unwittingly (being identified and tagged on Facebook).
So who owns this data and what protections do you actually have?
“Under the Illinois law, companies must obtain written consent from customers before collecting their biometric data. They also must declare a point at which they’ll destroy the data, and they must not sell it. BIPA allows for damages of $5,000 per violation. “Social Security numbers, when compromised, can be changed,” the law reads. “Biometrics, however, are biologically unique to the individual; therefore, once compromised, the individual has no recourse, [and] is at heightened risk for identity theft.”
Multiple lawsuits against Facebook are moving forward in California after a May ruling that upheld the jurisdiction of BIPA in California. This will likely prove to be pivotal battles between citizens who value their privacy and biometric information and tech giants who are looking to access as much user data as possible.
Over Memorial Day 2016, just hours before the Illinois Legislature was heading into recess an amendment was proposed by Democratic State Senator Terry link that would have effectively neutered portions of BIPA and handed a behind the scenes victory to Big Tech. Rumor has it that Facebook was behind the amendment.
Spearphising, DDOS, and yes, Mobile Security threats, are what we live and breathe here at Konsultek. Whatever your particular situation, we are always at the ready to listen, analyze and recommend. Give us a call today and together let’s put together a solution that minimizes risk in an intelligent, well thought out way.
Last week our friends at Checkpoint dropped a bombshell on the mobile security world when they published a 26 page report on a mass Android infection they dubbed HummingBad.
According to the report, for five months, Check Point mobile threat researchers had unprecedented access to the inner-workings of Yingmob, a group of Chinese cyber criminals behind the HummingBad malware campaign.
First discovered in February of 2016, the HummingBad malware establishes a persistent rootkit on mobile devices using the Android operating system. Once the root kit is installed it generates fraudulent ad revenue and begins installing fraudulent apps.
“Yingmob runs alongside a legitimate Chinese advertising analytics company, sharing its resources and technology. The group is highly organized with 25 employees that staff four separate groups responsible for developing HummingBad’s malicious components.”
Since HummingBad entrenches itself as a rootkit it is far more dangerous than other more benign ways of generating click fraud revenue. Once installed, HummingBad connects your device to a Yingmob server through which they have complete access and control.
For example, they could:
While it appears that so far YingMob is content with perpetrating click fraud (to the tune of $300,000 USD/mo) and adding apps to phones, they could take a more criminal bent themselves or sell the rootkit on the black market where anyone could access it and deploy it for their own means.
Learn more about HummingBad and what you can do to protect your organization’s Android devices here.
There is a reason why we partner with world class security firms such as Checkpoint and HummingBad is just one example. In order for us to develop world class solutions for you, we need to have access to the best minds and the best technologies in the business.
If you are ready to put the power of our engineering staff our relationships with the world’s best security technology companies to work for you, just give us a call.
The life of a road warrior is tough enough already– Airplanes, rental cars, hotel rooms, stale breakfasts and late nights. And yet now we learn courtesy of csoonline.com that road warriors, particularly senior executives are frequently the targets of cyber criminals and hackers when traveling abroad.
The very tools that allow today’s traveling executive to be more efficient and effective than ever also put his or her personal and company information at risk.
According to Jim Jones, an associate professor in the Computer Forensics program at George Mason University “Adversaries in the form of businesses, governments and criminals target traveling business executives for the same two reasons they always have: the actual person, and information the executive has.”
And it is the information contained in their mobile phones, tablets and laptops and the ready access they can give to the network back at the home office that is making the road warrior executive more of a target than ever.
For this reason there are a number of best practices traveling execs can follow to avoid becoming a victim.
Finally, all 6 of the preceding elements should be included in a training program that prepares you and your fellow road warriors for their upcoming battles abroad.
Security both here and abroad is always a combination of business process, human factors and security technology. At Konsultek we pride ourselves at “looking beyond the box” to create customized security solutions that protect your organization’s most sensitive data.
Give us a call to begin a dialogue about your unique situation and to see how our approach can help.
A report released by Juniper Research late last year forecasts that over 1 billion employee-owned smart phones and tablets will be utilized in enterprise by 2018. Most companies either incorporate BYOD now, or will in the near future.
Much discussion has been raised about the security risk of the various devices and operating systems providing access points for hackers. One security advantage of BYOD is that individual employees tend to upgrade smart phones and tablets more frequently than employers would, thus minimizing the use of outdated operating systems and software. But what happens to the all the old, discarded equipment?
According to NBC News, identity theft expert Robert Siciliano recently purchased 30 used devices online and was able to retrieve data from over half of them. Sicilano was able to find photos, legal and tax documents, usernames, passwords, social security numbers, birthdates and employee records. Perhaps the most alarming finding was that most people thought they had removed all data before selling their devices.
An IT Asset Disposal (ITAD) policy should clearly spell out all acceptable options to dispose of old equipment and any partner vendors. The policy should specify what types of devices are covered by the policy and under what circumstances (e.g. theft, damage, trade-in, upgrade, leaving the company). The policy needs to be enforced and consequences for not following the policy should be clearly defined and communicated. Then of course, the policy needs to be enforced.
For 20 years, Konsultek has prevented network attacks and improved network performance for enterprises both large and small. Our managed solutions take the burden of network security up-keep off your organization and onto ours. We can help you set up your network to be BYOD ready in no time. Not only is this simple and easy, it is cost effective!
Ready for a dialogue? The conversation is free and the value is enormous. Please give us a call! Or sign up below to join our VIP list so you can receive the latest information on events and webinars!
How do you monitor and manage corporate assets along with the devices used by 25,000 people connecting to the networks? That was the challenge faced by Queens College a senior college of the City University of New York, the third largest university system in the U.S. in terms of enrollment. According to SourceWire ”the college was struggling with maintaining intelligence and security provision of both a large number of college-owned devices, as well as the huge influx of personal devices (BYOD) being used by its employees and students.”
As further reported by SourceWire “Queens College initially turned to ForeScout CounterACT to help protect them against the onslaught of advanced threats and propagating worms, which in the past would have infected hundreds of computers, literally bringing the network to a crawl. ‘Once we had CounterACT in place, the first time a new worm broke out, we had only three computers that became infected. They were immediately isolated and the infection was contained,’ said the school’s Director of Network Services and Internet Security Officer Morris Altman.”
The obstacles faced by large universities are similar to the challenges faced by the largest corporations. Konsultek has worked to successfully deploy ForeScout CounterACT in a wide variety of environments.
KNACMAN, Konsultek’s managed service solution for NAC is built upon the same CounterACT platform that Queens College uses and can be rapidly deployed in schools and other enterprises across the country. Since we package it as a managed service we can offer a variety of innovative investment options. Imagine all of the benefits of ForeScout’s CounterAct with the ease, convenience and financial flexibility of a managed service. Call us today at (847) 426-9355 to discuss how KNACMAN can ease the pain of securing BYOD in your organization.
Ensuring the safety of your network, big or small, is one of the top priorities of any organization. It can be tough trying to keep up with technology in today’s mobile world and the security issues that come with it. While BYOD, is practical and cost effective for many companies – employees take their personal devices to and from work anyways. The information distribution and access that allows them to easily and efficiently work from home and from the road can also make network and device security a nightmare.
EnterpriseNetworkingPlanet interviewed Bask Iyer, CIO of Juniper Networks to talk about the BYOD trend and possible security concerns. Iyer is “at the center of all the major trends in IT and networking today, including SDN, delivering on the need for BYOD from employees as well as the demand for more cost-effective IT for the business”. When asked about the company’s budget for BYOD, Iyer says that the way “IT budgets typically are done is you get X amount of budget and the CIO and IT department put together a business plan with a list of projects” and that then there is a “a food fight on which projects get done”. Since Juniper is a “lean organization, the food fight is not as difficult as you would find in other organizations”.
As promising as BYOD sounds, it can be an intimidating and challenging endeavor for many organizations. Some look to BYOD to lower their IT budget, others to improve productivity. None however look to BYOD to simplify their network security!
BYOD is a top priority at Konsultek and we ensure you get the same level of security and control in your mobile device suite that you apply to laptops and desktops. This includes the ability to identify, tag, and assign policies to both employee- and business-owned smartphones and tablets. Interested? Please give us a call today.
In the world of higher education IT security is a top priority. With tens of thousands of students and hundreds of faculty, a large university faces the same security challenges as the largest corporations.
It should therefore come as no surprise to anyone that the IT solutions chosen by colleges and universities are similar to those used by the most technically advanced corporations. Network Access Control is a great example.
Consider the challenges represented by the mobility of traditional students, commuting students and online students. Monitoring and controlling access for a user group of such diversity would have been extremely expensive and difficult just a decade ago. But times have changed…
According to MarketWatch, New York Law School has recently adopted ForeScout’s CounterACT network access control to secure their university. Reportedly “NYLS found CounterACT easy to administer and deploy, while its lightweight agent was trouble-free for its 1,500 students and 200 faculty members”.
The university IT staff found that they “gained full visibility and control of all devices on the network; the means to easily monitor, control, and inventory systems while allowing for flexible enforcement; and the ability to thwart zero-day threats”.
As for the new BYOD trend, the team will “soon institute an executive trial utilizing ForeScout MDM, a cloud-based, mobile device lifecycle management solution that complements ForeScout network access control capabilities”. Forescout is the recognized leader in all things network access control related, taking the leadership position in Gartner’s 2012 Magic Quadrant for network access control.
Frost & Sullivan “has acclaimed the company as the largest independent NAC vendor and one that is growing the fastest in the market”.
Still, CounterACT can be more capital and resource intensive to deploy than some organizations are prepared to invest. That is where KNACMAN shines.
Konsultek can help!
KNACMAN, Konsultek’s managed service solution for NAC is built upon the same CounterACT platform that many highly secure organizations such as the EOUSA use and can be put into use for your organization as well.
Imagine all of the benefits of ForeScout’s CounterAct with the ease, convenience and financing flexibility of a managed service. Please call us today to discuss how KNACMAN can ease the pain of securing your organization’s network.
In today’s world it seems that almost everywhere you turn someone is using a smartphone, an iPad or some other mobile device. You could blame Apple or the late Steve Jobs for the introduction of the not watered down internet to mobile devices, however one could argue that it was Blackberry that really primed the pump and got the whole mobile revolution going. Either way, it was Jobs that found a way to market Apple devices worldwide and set the stage for the smartphone and tablet ubiquity we are seeing today. And that of course is what is driving the BYOD movement corporate IT is struggling to control.
According to fiercemobileit, “BYOD is spurring a resurgence in the network access control market”. This is coming from a study which predicts that “the NAC market will increase at a 22 percent compound annual growth rate, reaching over $1 billion by 2017”. The big three that own 70% of this market are Forescout, Juniper Networks and Cisco, and with this technology they can use it to “determine if a user and/or device should be able to gain access to a corporate network.” NAC brings together endpoint security technology, user authentication and network security enforcement”
Mike Tilkian, VP of Business Development at Konsultek notes; “At Konsultek we prefer Forescout’s CounterACT NAC solution. It is a robust, easily scaled platform that is proven to work well in organizations who are implementing BYOD. Our KNACMAN, NAC as a Managed Service offering bundles all of the CounterACT platform’s benefits into a rapidly deployable and cost effective turn-key solution.”
BYOD has proven to be a huge security risk for corporations over the last couple of years and with ever changing security trends continuing to grow it can be very difficult to keep up and maintain.
We Can Help!
BYOD is a top priority at Konsultek and we ensure you get the same level of security and control in your mobile device suite that you apply to laptops and desktops. This includes the ability to identify, tag, and assign policies to both employee- and business-owned smartphones and tablets.
Interested? Please give us a call today.
Security is definitely not the first thing that pops up in a person’s head when someone mentions the latest trends. Sure the headlines are grabbed by businesses trends, fashion trends and diet trends but that doesn’t mean that there aren’t trends in the world of network security!
This year at the RSA Conference F5Networks conducted a trend survey of attendees directly involved in IT security. They found that “organizations are struggling to keep pace with the changing face of security.”
The results of this survey show that organizations are just not prepared for cyber attacks and other malicious malware. Reportedly, “security trends such as virtualization (73%), BYOD (66%), and the complexity of attack types (72%) have the greatest impact on securing today’s organizations”. That is not all; the survey also reported that “nearly half of respondents admit that traditional safeguards are less than adequate in protecting against threats related to these trends” and amongst the trends respondents said that “the shift from data center focused infrastructure to cloud-based infrastructure” is the most insecure.
Head over to the F5 site to see the full survey results: RSA Security Trend Survey
While you’re over there you might want to check out F5s White Paper on BYOD 2.0.
Whether you are a fan or not, BYOD is here to stay, and it is transforming the way enterprise IT looks at mobility. BYDOD can potentially provide your organization with a significant cost savings and productivity boost, but it is fraught with risk if not handled correctly.
Here at Konsultek we find that by applying solutions from F5, ForeScout and MaaS360 we can provide BYOD solutions that meet even the most demanding situations.
If you are interested in beginning a dialogue on your BYOD situation, please give us a call.