The "RISKY BUSINESS" Blog

Lost in the glow of Operation Aurora was the American Bankers Association (ABA) recommendation “that small to midsized businesses only conduct online banking on dedicated work-stations”.  On first blush,  sounds like sound information security advice; so why is it that I find this so significant?

Because the banking industry  finally “gets it”. 

When the ABA (dedicated to enhancing the competitiveness of the nation's banking industry and strengthening America's economy) suddenly throws a wet blanket onto online banking we have reason to be concerned.  In short, what they are saying is that online banking is only as secure as the end-point that it is conducted on and that the viruses, spyware, Trojans and identity-stealing key-loggers that regularly infect computers are something they no longer can pretend they can control.

They finally get that HTTPS, strong passwords, and two-factor authentication can’t keep us safe from ourselves and the increasing risk posed by organized crime.

Unfortunately, the proposed solution, while it may be the best we have, is insufficient.  Even a dedicated workstation is vulnerable to malware infection, even if “safe” web practices are followed (comically, AVG just reported that I happened upon a malware loading site following  a link on organized crime and online banking while researching this post).  What we need is a trusted, fully immutable, computing device – I have to think someone really smart is working on this right now.

In the meantime, I’m not worried enough to give up on online banking.  However, I won’t do it from a windows machine any longer.  Right now, I’m only using my iMac, but plan on moving to either a dedicated Ubuntu machine or a bootable USB Linux. 

I thought this blog post on “more secure” options for online banking was well done.

Much Ado About "nothing" ... A Very Significant "nothing"

Unless you have been living under a rock for the last few weeks you are likely aware of “Operation Aurora” – the Chinese state sponsored cyber attack on Google and at least 20 other prominent US firms (Adobe, Juniper, Rackspace, Yahoo, Symantec, Northrop Grumman and Dow Chemical).  It’s a big enough story that our clients have enquired as to why we have not blogged about it to this point.

Honestly, in much the same way that Seinfeld was a show about “nothing” (the Chinese Restaurant episode where the entire episode is them waiting for a table, is perhaps the best example), I look at the Operation Aurora story the same way (the irony of using the Chinese Restaurant episode is not lost on me.) 

The only thing surprising about state sponsored cyber attacks against key US companies is that people were surprised by it.

Over the last five or six years we have seen a steady increase in the number of projects where we have helped defend our clients against industrial espionage, insider attacks, and cyber-attacks by organized groups.   Even more “telling”, we have been approached by “potential clients” with malicious project opportunities: hacking into Gmail, industrial espionage, eradicating evidence of criminal activities in advance of an FBI forensic investigation, etc. (needless to say our hats are white and these potential clients were rebuffed. 

Seinfeld was significant in that a show about “nothing” was really something, and that “nothing” became part of our collective cultural consciousness.  Operation Aurora is significant in that  “nothing new” has been escalated in the media to a point where it may become part of our collective information security consciousness. For that reason … it was a very significant “nothing” – and will hopefully have a positive impact on our understanding of evolving information security risks.