My CTO Was Hacked!

You see a lot of interesting things when you are in the business of internet security and privacy. The neat thing for me is that we are at such a momentous time in the evolution of mankind's relationship with technology that almost every day feels a bit like history. Some days it's obvious, like the Target breach. Or, earlier last year, when the Snowden story broke. Other times it is anecdotal, and more personally observed. It's the latter I want to talk about today.

At one point early in the process of building a commercially viable ecosystem for online security and privacy for my customers, I needed some help with network architecture. I was introduced to an exceptionally experienced engineer from Orlando, FL, referred to here, for the sake of this story, as Mr. Nethead. Long story done short; I decided to hire  him for a temporary assignment with me in order to help take my project to the next level. In going with my better judgement, I'm going to leave Mr. Nethead's real name out. You will understand why later in my story.

Back to the basics for a minute; clearly cyber-risk has been democratized. The internet is probably, at the out-most, 6 months away from being considered entirely infected. The details of 110 million individuals from the Target breach are just a piece of the big-data pie that includes many, many other large breaches. In an environment like this, you have to take the responsibility to immune yourself and not rely on the government or any other 3rd hand to protect you and those around you. Total Digital Security exists to empower all of us with the best tools available today to insulate ourselves, our homes and families, offices and small businesses, from the escalating probabilities and deepening consequences of being victimized by cyber-crime.

So, the "best tools available today"? Where do the best defenses for online security and privacy come from? The answer; at the enterprise, or institutional level. These entities are governments, corporations, and other institutions that have invested vast sums of money over the past few decades in a very intense effort to protect themselves from precisely the same things that you worry about today; the safety and security of your identification, your passwords and credentials, your "content" (such as pictures, videos, scans, and documents). Also, their employees, (think; your family or office team), their reputation, and so on. You get the idea. And, as technology goes, these online security and privacy solutions are more powerful than ever, very easy to use, and now, extremely affordable to almost anyone. But, I needed someone to help me design the infrastructure in which to deliver these institutional tools to my consumer-level market, which operates outside of a server environment. Really it was almost that simple.

With this concept in mind, we set off to figure out how to put the pieces in place. We had to make it enormously scalable, very efficient, and I wanted it open-source in order to deliver the best architecture from a security stand-point. At the same time, I wanted my customers to know they were completely in control with total portability and assured compatibility. So, while I wanted fresh thinking with the business, I wanted to use established technology that had served and proven itself to the business customer for a long time.

It's not hard to imagine Mr. Nethead. He started back when no one knew how to spell LAN.  He grew up in the environment and standards of the time, and though while experienced and knowledgeable, he wasn't exactly an "out-of-the-box" thinker. Also, he had that imperial attitude of impatience and disdain for anyone that wasn't following everything just the way he saw it. Like, we just didn't "get it". On one hand it was aggravating  but on the other hand it was reinforcing. Much of my 35 years in personal and professional experience with IT-land wasn't too far off this mark. The experience with Mr. Nethead was kind of validating to the reason for Total Digital Security's existence.

Well, some weeks in to the project it was clear he was not really buying in to what we were doing and frankly I was never even sure that he ever "got it".  It was clear to me that Mr. Nethead didn't think the general public was smart enough to spend $10 or $20 bucks a month on online security and privacy services. That they didn't understand or appreciate the real risks at hand, to them and their family, and wouldn't be able to distinguish what we were doing as opposed to say, the retail versions of some of this stuff, like McAfee, Symantec, and the others. It left me wondering what he did for himself and his home. I knew he had young daughters, loved his family and valued his time with them so, I guessed he probably had some techie version of firewall security and maybe a home local area network, running some industrial-strength software that he found someplace, file sharing with his network-geek friends. Right?

After a couple of months on the project, one Saturday night, the Nethead family was enjoying the weekend when one of the daughters' computer was hacked. Unfortunately, it was of the creepiest version of cyber-crime; spyware. Spyware is when an outsider, the hacker, takes control of the computer and uses the audio and visual inputs, your webcam for example, to spy on you. It happened, in one case, to Miss Teen USA. Last year, a hacker that has also attacked at least two dozen other women in the US, Ireland and elsewhere, posted naked photos on the internet and blackmailed them by demanding more pictures. Sadly, this type of cyber-crime, again the creepiest of all and obviously linked to one's physical security as well, is not all that uncommon. The Nethead girls were enjoying themselves that Saturday night, jumping up and down on their bed, and unknowingly being filmed in the process.

Fortunately this story ends with no major consequences, other than a complete re-set in Mr. Nethead's notion of "risk management" and "value". And so fast-forwarding my thought process here; is there a better risk/reward, or economic decision you can make in 2014 for the sake of you, your family, and your business? With these types of stakes at hand, and the increasing probabilities of being victimized increasing daily, at prices that are $10 to $20 bucks a month? And in my mind, protecting one's self is not like buying just insurance alone, but also akin to battening down the hatches for the coming storm. In the case of insurance, the risk is unpredictable, like a flood. With a storm, you see it on the horizon, it's on the radar, and you take precautionary measures. With cyber-crime, it's time to do both.

It is almost assured that if you are a user of technology in your daily life, you will either be proactive or reactive to the emerging threats. But, one way or the other, you will have to change your approach to online security and privacy. We all want to continue to leverage the awesome power of technology in our busy and productive lives, but we must do it responsibly and we must claim control now. 2014 is the pivotal year to shore up your digital footprint and create systems that will insure a sustainable state of online security and privacy for you, your home, family and business.






Thanks for reading,

Brad

brad@totaldigitalsecurity.com
www.totaldigitalsecurity.com

3 Steps to Internet Security and Privacy

Every day since my last post I am compelled to share a new media or insider report about the state of our internet security and privacy today. Of course I do just that through Twitter and LinkedIn but one report especially struck me and energizes today's blog. The article
was published yesterday by Bloomberg News and exemplifies the rapidly increasing levels of risk mounting in cyberspace today. It's a call to action.



Thanksgiving Day, Bloomberg News;

http://www.bloomberg.com/news/2013-11-27/zurich-s-kerner-says-matter-of-time-until-dramatic-cyber-attack.html




Stay with me a moment here and let's look at the choice of words by #MichaelKerner, who oversees property-casualty coverage at Zurich Insurance Group AG (ZURN) #ZURN  -

"... said computer threats are escalating and may soon cause “dramatic” disruptions for businesses and individuals."

Some serious words here; "soon", "dramatic", "disruptions for business and individuals."

INDIVIDUALS - Yes, I am shouting for emphasis. In my last blog on #offshoreemailaccounts I explained how and why we, as individuals, are the next high-value target for the most sophisticated and aggressive criminals on the internet.

"... he said yesterday in an interview at Bloomberg’s headquarters in New York. “You’ll look back and say, ‘We should have seen this coming.’” 

I differ here; anyone that is awake will have to say "I saw this coming." And yes YOU should see this coming. You, as the head-of-household, leader, protector, and if not for you, then who? Protecting yourself is not rocket-science and it is extremely affordable, especially from a risk vs. reward standpoint. The purpose of today's blog is to show you how in 3 steps you can pull yourself off the radar from the criminal, commercial and state actors that are stealing your digital assets every day. The three-pronged approach I describe here will prevent them from targeting you for the likes of financial extortion, ID theft, revenge, ... you know the gig, and give you the ability to seize back the control of your personal information, identity and digital assets.



The real challenge in doing this is in the "when" and "how" you will decide it's time to suit-up and insulate yourself from the risk. Attaining and retaining control of your online security and privacy is the subject matter of this week's post. It's 3 Steps. Three important steps so you can stop thinking about it, feel really smart, and position yourself for control and success in a digital world.


Step #1 - Secure Your Email. It's easy. You will want to domain your email offshore and out of the hands of the NSA and the public services. The information they are aggregating about you and your life is at the stage where it absolutely is surveillance. A simple inquiry by an ambitious federal employee can spin out of control, take on a shape never originally intended and completely upend and disrupt your life for a very long time to come. Witness the Op-Ed piece from the Wall St Journal, #howthegovernmentspiedonme, where a routine email check led to the resignation of the Director of the CIA (I wish I could make this up).

 http://online.wsj.com/news/articles/SB10001424052702303482504579179670250714560

At #totaldigitalsecurity we use real servers and base them in Zurich, Switzerland. Our partners are at #kolab  where #georggreve  http://linkedin.com/in/GeorgGreve   is CEO. There is no better email solution today. And, it's open-source. That's a really big deal when it comes to security. Switzerland's constitution is very clear in terms of the rights individuals have to privacy and the country really is the antithesis to the U.S. today. For more on "Why Switzerland" see my last blog and refer to the chart:

We are actively setting up family and business domains that include email, calendar, contact and to-do and is an Exchange-like experience, but without the bugs and transparency of the public email services like  #gmail and #yahoomail .

  
Step #2 - Secure Your Online Presence. 

First, a couple of definitions.

Privacy - #onlineprivacy is when they know who you are, but not what you are doing.
Anonymity - #onlineanonymity is when they see what you are doing but not who you are.


Ideally, you want both, every step of the way. Tor, for example, provides anonymity and a VPN, for example, provides privacy. But there are many more links in the chain and each must be as robust as the last.


Securing your online activity also includes anti-virus and malware, intrusion prevention, a firewall, anti-spam engine, and browsing protection. And, very importantly, immediate updating of operating system and 3rd party software applications. The fact is, most intrusions could have been prevented with current software patches and updates. With Microsoft, this is practically a full-time job but with our system, it's monitored and automated, never skipping a beat.

Here's how;

Large institutions have long recognized the value and potential liability of their digital assets and have invested vast sums of money to protect themselves from the associated risks. It's still a whack-a-mole game at that level and always will be, and this is precisely the point;  this tension between the institution and the hackers is an amazing and energizing force that has created remarkable innovation and solutions that become evermore robust and inexpensive. It is a fact of physics that technology gets better at an exponential rate and cheaper just as quickly. If you don't know Moore's Law, honestly, it's time you do because not only is the rate of change getting faster but so is the rate of the rate of change. When it comes to math, that's a huge phenomenon.

http://en.wikipedia.org/wiki/Moore%27s_law


Check this graph out;






The graph illustrates computer performance from 1975 to 2011. The crucial point here though is that we are now in the zone of the "hockey stick". That's where the line starts to go vertical. Since the computer chip was invented it has been evolving at a rate previously unheard of in any activity. The accumulation of these exponential gains (think compound interest rates) put us at a point, right now today, where the rates of change are literally going vertical, like straight up. That's the hockey stick piece. If you take one thing away, take this; you ain't seen nothin' yet. This is not "bad" news, it just is what it is but it could be tragic if you don't recognize it. And, what Step #2 is all about is using this awesome progress in technology by leveraging it's performance and ridiculously low prices to your advantage in the realm of your personal security and privacy.

OK, so, back to securing your online presence; it is all about taking the solutions provided at the institutional level and engineering them for the individual consumer. That's you and me and our families and our offices. This is precisely what we do for our customers.  At this level of protection security is operated as a service, as opposed to a product.  "Products" are installed and expected to go to work. Today's cyber-environment requires a more dynamic process of monitoring, assessing and adapting. For this we use a network ops center in Helsinki, Finland, (another country that is maniacal about privacy rights) operated by the F-Secure company. They are the real deal, check them out. The monitoring is 24/7/365 and defenses are automated, including software patches and updates, anti-virus and malware, intrusion prevention, a firewall, anti-spam engine, vulnerability testing and browsing protection.


Step #3 - Secure Your Digital Assets.  
Have you noticed the price of a bitcoin? In less than a year it's gone from $10 to $1,000, in round numbers. I don't know if this tulip-mania and I don't really care because it's a symptom. The cause of this phenomenon is the rapidly increasing value to anonymity. It's supply and demand all over again. Anonymity is so valued now because their is so little of it left. The inherent value to anonymity is the information behind the curtain. Everyone wants it. Your government is just taking it, the corporation is suckering you into giving it to them and the criminal is stealing it from you. All at the same time. The scarcity of today and the foreseeable future is privacy and anonymity.  This makes me laugh because it used to be so valuable to be famous! Perhaps one day we will all have our 15 minutes of pure anonymity. Like a surreal bliss I suppose.

So the point is to secure your stuff. All your digital stuff, because it's becoming more valuable to someone somewhere more and more every day. And this can be tricky.
This is why so much is "free" on the internet. Free social media, email, storage, and the rest. You name it and the billionaires of silicon valley want you to give it to you. Because they are nice guys you suppose? Maybe they are, some seem like it, but we know they aren't "giving" you something without coming out the winner in the exchange. That's what billionaires do really, really well. Remember; if you aren't paying for the product, you are the product. The billionaires made in silicon valley over the last several years have done it faster than ever because they have figured out how to get you to work for them, everyday, and to have you pay them for doing it. No wonder they got so rich so fast. Imagine having millions of others doing your work for you, giving you their stuff, and then paying you for the privilege. That's the dominant business model for the time.

Do what I did and what I do for others; create a digital "Family Vault". Base it in on real servers, offshore, Switzerland or Finland preferably, and encrypt the hell out of it. Create access and user permissions and you then have a family that collaborates around their digital assets. Decades of photos, scans, movies, financial records, legal documents, passwords, ... you get it. Sync and backup is a cinch, legacies are assured and future generations will always have their "digital fort" because we do it in open-source. Like our email solution, our storage solution is open-source and this means you are always portable and format compatible.

You know, at first draft I was going to say 3 "Simple" or "Easy" Steps to Online ... as the title but I couldn't get honest with the words "Simple" and "Easy". We simply, aren't there, yet. That's why we are here, do it for you. And I see our entire service operation as open-source too. We only apply the best-in-breed technology to our solutions and when the title of "best" changes hands, well we do too. We have put together an amazingly robust, effective and affordable system that will not just survive the challenges of change but will thrive on them as well. With our service, the awesomeness that is the nature of technology will be leveraged for the sake of protecting you and those around you, 24/7/365. This is effective risk management for the digital age.

Thanks,

Brad