Category Archives: Opinion

The Security of the Small Business

Image by Charlie, used under Creative Commons

In the United Kingdom, as in many other economies around the world, smaller businesses are the lifeblood of national prosperity. In essence SMEs *are* the private sector, according to the Department for Business, Innovation & Skills, they employ more people (60% in the UK in 2014) and generate almost half the total turnover of the private sector (48% in the UK in 2014).

Given the importance of these businesses to the UK economy, Trend Micro decided to attempt to discover just how ready many of these businesses are for the potentially devastating consequences of compromise.

Small businesses represent an attractive target for online criminals for several reasons; of course many of them hold or process a large amount of personal information, identities, legal, financial and medical records just for example. They also have less convoluted financial and banking arrangements, making them easier to exploit with traditional banking malware whilst also being less likely to be compensated for any fraudulent transactions. Quite aside from the dangers of information or financial theft, small and medium businesses are increasingly in the sights of sophisticated criminals looking for ways into larger organisations. In an attack technique that has become known as “island hopping“, determined attackers seek out the smaller business partners of their eventual target in the hope that they will be less security savvy and less well-protected. Fazio Mechanical Services has become the unfortunate poster child of the island hopping attack ever since it was used as a stepping stone to the huge Target data breach in late 2013.

So what did we discover?

We interviewed 500 key decision makers and business owners in UK SMEs to compile the research. Amazingly, only half of them said they rely on internet security tools to protect their organisation from cyber attack. In addition, just 44% said they knew how to check if their laptops, mobiles or tablets had been infected with malware. Three-quarters (74%) admitted to not fully understanding the legal implications of a cyber attack, while 67% said the same was true of the financial implications of an attack.

Tellingly, just 18% said they thought their data was worth stealing.

What now?

It isn’t only the internet security industry that is sounding the alarm and offering assistance to SMEs. The UK government too has recognised the threat. Last month Ed Vaizey, the Digital Economy Minister outlined how the voucher scheme, operated by the government’s Technology Strategy Board,  Innovate UK would be extended to cover cybersecurity. This scheme offers businesses the chance to apply for £5000 in funding for specialist advice to help better secure their businesses and digital assets. Unfortunately right now there isn’t enough in the pot to cover every application, so lucky recipients are selected in a random draw on a quarterly basis, still as they say, you’ve got to be in it to win it…

in the meantime the key to online security lies in the selection of a trusted security partner. As a small business, your core skills are not in cyber security or network or system administration. You are focussed on growing your business, on being succesful and on being the best in your field, and rightly so.

There are other small and medium businesses like yours who are striving to be the best in their field too and their field is security. A specialist partner, providing a managed security service, will be able to provide you with the assurance and peace of mind that you need to focus all your efforts on success and who knows… You may even get the funding!

The research was conducted on behalf of Trend Micro via Vital Statistics – sampled 500 UK business owners and decision makers in August 2015.

Small Business Advice Week runs from 31st August -6th September 2015. More information can be found here: www.smallbusinessadviceweek.co.uk

Where’s Wally? Tracking the president with GPS

Is the security of wearable technology really a big deal? Is the security of IoT devices really such a big deal? I mean, my fridge, my light bulb, my other cliché, what use are they to an attacker? Who really cares where I am, how fast my heart is beating or what my typical pace is over any given distance?

Maybe this photo of the President of the United States sporting his shiny new fitbit Surge gives you all the answer you need. The POTUS, wearing a fitbit, with GPS, being tracked 24/7, by a third party… See where I’m going?

The Internet of Things (IoT) and even more broadly, the Internet of Everything (IoE) are still nascent areas of technology where individual physical devices with embedded electronics, software and sensors are internet connected in order to provide greater value by exchanging data without the need for direct human intervention. This rapidly expanding arc of the information technology rainbow has attracted much attention recently from security researchers; with presentations at the high profile security events, breaking the security of home security systems, cars and many others.

Whilst this research is important in practical terms, hopefully driving some manufacturers to resolve the issues identified, it is also somewhat misdirected.

IoT devices themselves are almost invariably sold as a “black box” solution,; little to no user interface and no options for aftermarket security or tweaking. They are most often low memory, low storage, low processor-power devices designed primarily to harvest data and forward it on for the actual processing. And there’s the rub. The data is sent off-device, to the cloud, where it can be processed, mined, correlated and cross-referenced. Where it can be BIG data.

It is a simple matter for a security researcher to acquire a piece of interesting technology and begin to dissect it for vulnerabilities. Of course it takes skill to do so, but there are no significant barriers aside from that. You buy the kit and you break it.

It is a far more complex minefield to navigate if you set out to test the security of the back-end to those devices. In fact, more often than not it is illegal. To probe the security of someone else’s data centre without their permission, to break in and see what treasure is there for the taking, that ventures outside the realms of research and into the criminal, so the good guys don’t do it.

The bad guys, of course, don’t have to play by those rules, targeted attacks are their stock in trade, and data centres are fast becoming targets of choice. If the President of the USA is wearing technology x, then technology x’s back-end suddenly presents a juicy looking target for criminal or state-sponsored attack and they won’t be discerning about who else’s data they make available either.

Data in general is gold dust to attackers, the more of it one can accumulate, the more tailored, credible and successful one’s attacks can become. All too often devices destined to be connected and used online are designed and produced either by traditional organisations who have typically not had to pay attention to digital security during the manufacture and design process or by entrepreneurs who are too interested in getting their first product to market to be slowed down by some nagging security concern.

It is becoming a significant challenge to regulatory bodies and to governments to ensure that safety standards, which have previously focused on the physical risks of a product and its components, accurately and clearly identify digital risks and outline the minimum safety criteria.  Perhaps in the near future we can hope for a kind of digital kite-mark, offering at least some assurance that physical goods and their supporting infrastructure have been designed and built to a defined standard of digital security, that security was baked -in, not glossed over and that none of the small parts may cause choking. The need for this becomes ever more urgent as pretty much every £100+ good becomes connected in some way, in fact Gartner estimated in 2013 that by the year 2020 (have you watched our award-winning web series yet?) there will be more than 30 billion “connected devices”.

What you really accept when you use How-Old.net

 

ToU for How-Old.net

Microsoft had an apparently unexpected hit on their hands with the unveiling of the “How Old Do I Look?” service at the Microsoft Build conference last week. By the weekend my Facebook feed was filling up with friends from all over the globe sharing the results of their own submissions to the service. For the three of you that haven’t come across this viral hit recently, “How Old Do I Look” allows a user to upload a photo and will attempt to correctly guess the age of the subject of the picture, with the results ranging from the spectacularly awful to the incredibly accurate.

My vanity drove me to the website to upload a picture of my ageing mug. Before uploading though, unlike most users it would seem, I paused to read the Terms of Use linked from the landing page of the service. After being initially reassured by the clear and unambiguous “P.S. We don’t keep the photo”  right below the upload button, the ToU told a very different story…

From the “Materials Posted on this Website” section of the ToU (my own bolding):

“[…] by posting, uploading, inputting, providing, or submitting your Submission, you are granting Microsoft, its affiliated companies, and necessary sublicensees permission to use your Submission in connection with the operation of their Internet businesses (including, without limitation, all Microsoft services), including, without limitation, the license rights to: copy, distribute, transmit, publicly display, publicly perform, reproduce, edit, translate, and reformat your Submission; to publish your name in connection with your Submission; and to sublicense such rights to any supplier of the Website Services

These are actually the standard ToU for Microsoft’s Azure cloud services, they are broadly similar to the ToU of many, many other online services. While I am not trying to insinuate that Microsoft have some sneaky photo-stealing agenda, these ToU do really serve to illustrate a couple of perennial problems in information security.

– The scale of customers’ unwillingness to inform themselves of what exactly they are agreeing to when making use of information technology.

These terms were not hidden away, they were clearly linked from the front page of the service, yet not one of the people I spoke to had bothered to click through. Perhaps we have been educated into apathy. Many companies are certainly guilty of producing reams and reams of agreements and terms that a customer could never reasonably be expected to digest (*cough*iTunes*cough*) but this was not an example of that. These Terms were relatively clear and concise and not overly long.

The cult of overasking.

It seems that the developers of the How Old service had no intention at any time of storing your images, or of “publishing your name in connection with your submission”, but instead of crafting a Terms of Use document specifically for their own service, potentially one that could have been far more brief, human-readable and accessible, they fell back on the default Microsoft Azure ToU.

These kinds of clauses help no one.  In most cases the motivation behind such a broad legal definition of rights is a technical one. The service provider needs to cover the processing, caching,  and publishing of user submitted data. They need to legally define the normal operation of their service. However, the legal eagles, in attempting to define that service, grant themselves such a broad swathe of rights, going on to qualify them with phrases such as “without limitation” that the end result is Orwellian in scope.

When the rights reserved by the operators of “How Old” are pointed out to the users of the service they are clearly concerned, often to the extent that they wish they had never used the service. This isn’t fear-mongering, this is a natural and understandable reaction to the feeling that a faceless corporation is “taking liberties” with their data or duping them with a “bait and switch” scam. “We don’t keep the photo (but we can if we want to)”.

These things must end. It is our own responsibility to keep ourselves informed of the content of agreements that we make. Whether that’s a pen and ink signature on an agreement of a digital click of acquiescence. We need to reject terms with which we are uncomfortable and push back on overly greedy legal documents.

At the same time, the legal officers, particularly of the global mega-vendors have a duty to become more tech-savvy. To be able to better define the technical rights necessary for the operation of a service accurately, without the need for land-grabbing phrases such as “without limitation”