bureaucracybusters

Posts Tagged ‘COMPUTER SECURITY’

, , , , , , , , , , , , , , , , , ,

FEAR WORKS: PART ONE (OF TWO)

In Bureaucracy, Business, Law, Self-Help, Social commentary on April 20, 2015 at 12:13 am

So you’ve just bought something online, with a credit card–and the item never arrives–or proves defective.

Even worse, the online company insists on charging your credit card for the item.

What to do?

Here’s what a friend of mine–Ralph–recently did when he faced just that problem.

One night, while surfing the Internet, he saw an ad for a new computer security product.  For him, its biggest selling point was: “Make yourself invisible to the bad guys with just one click.”

An even stronger selling point for him: The product was being offered by SUX, the company whose anti-virus software he had subscribed to for the last three years.

And, so far, he had never had any trouble with the company.

SUX offered several options for subscription:

  • One month
  • One year
  • Two years

Ralph decided that one month was too short, and two years were too long.  He chose a one-year subscription, intending to renew at the end of the year if he liked it.

He typed in his credit card number and clicked on “Download.”

Soon afterward, he received an Order Confirmation email from the company, outlining the product he had just purchased and the amount he had just paid for it.

He then got into the anti-virus security item on his desk.  A few clicks later a new screen popped up–and the message: “Disconnected.”

Even worse, the screen warned: “Your license has expired.  Renew now.”

The product he had just paid $60 to download hadn’t downloaded.

So Ralph called SUX–and explained to a technician what had happened.

And the tech responded: “We don’t offer phone support for that product.”

Nothing Ralph said could elicit the help he needed.  Furious at the man’s arrogance, Ralph hung up.

To avoid accidentally reaching the same worthless technician, Ralph decided to wait several hours before again calling SUX.

When he did, he reached a technician who was willing to provide help.  The tech said that he would like to run a remote scan on Ralph’s computer to try to find out what was causing the problem.

Ralph agreed.

For the next five minutes he could see his cursor moving around his screen, as the tech checked first one file, then another.

Finally, the tech said that Ralph needed to “clean out” his computer before the SUX product he bought would work properly.

“OK, how do I do that?” asked Ralph.

“You need to buy our BS2U product,” said the tech.

Now Ralph was really steamed.

He had just spent $60 on a product he couldn’t download.  And the tech was telling him he had to spend even more money on a second product to make the first product work properly.

Ralph then said he wanted to contact someone in an executive positon at SUX.  But the rep said he would have to call outside the United States to do this.

Ralph hung up, then got back onto his computer and onto the SUX website.  He drafted a short but detailed message on the problems he was facing with one of the company’s products.

And it ended:

“Frankly:

(1) I am UNABLE to make use of the product I paid $60 for; and

(2) I am UNWILLING to pay MORE MONEY FOR ANOTHER PRODUCT in hopes that this will enable me to use the one I just purchased.

“Therefore, I am requesting that the credit card transaction I had with your company on —- be canceled.  If it is not, I will dispute this via my credit card company when I receive my next statement.

“To enable you to quickly locate this transaction in your files, I am enclosing the Order Confirmation Number:  #———-.

“I am making a copy of this email, so I can establish, if necessary, that I have notified your company that I am NOT receiving the product I paid for.

“I have already contacted my credit card company and informed them that I will contest this charge if your company does not make good on this refund.”

Six days later, Ralph called his credit card company, to see if SUX was still charging him for an item he hadn’t received.

It was.

Luckily for Ralph, he had been a longtime student of Niccolo Machiavelli, the father of political science.

Niccolo Mchiavelli

In The Prince, his treatise on how to gain and hold political power, Machiavelli raises the question: Is it better to be loved or feared?

And he answers as follows:

“The reply is, that one ought to be both feared and loved, but as it is difficult for the two to go together, it is much safer to be feared than loved….

“Men have less scruple in offending one who makes himself loved than one who makes himself feared.  

“For love is held by a chain of obligations which, men being selfish, is broken whenever it serves their purpose; but fear is maintained by a dread of punishment which never fails.”

It was time to invoke the spirit of St. Niccolo.

, , , , , , , , , , , , , , , , , , , , , , , , , , , , , ,

DATA SECURITY BREACHES: “WE DON’T CARE, WE DON’T HAVE TO”

In Bureaucracy, Business, History, Law, Politics, Social commentary on February 9, 2015 at 2:06 am

Comedian Lily Tomlin rose to fame on the 1960s comedy hit, Rowan & Martin’s Laugh-In, as Ernestine, the rude, sarcastic switchboard operator for Ma Bell.

She would tap into customers’ calls, interrupt them, make snide remarks about their personal lives.  And her victims included celebrities as much as run-of-the-mill customers.

Lily Tomlin as Ernestine

She introduced herself as working for “the phone company, serving everyone from presidents and kings to the scum of the earth.”

But perhaps the line for which her character is best remembered was: “We don’t care. We don’t have to. We’re the phone company.”

Watching Ernestine on Laugh-In was a blast for millions of TV viewers.  But facing such corporate arrogance in real-life is no laughing matter.

Clearly, too many companies take the same attitude as Ernestine: “We don’t care.  We don’t have to.”

This is especially true for companies that are supposed to safeguard their customers’ most sensitive information–such as their credit card numbers, addresses, emails and phone numbers.

An October 22, 2014 “commentary” published in Forbes magazine raised the highly disturbing question: “Cybersecurity: Does Corporate America Really Care?”

And the answer is clearly: No.

Its author is John Hering, co-founder and executive director of Lookout, which bills itself as “the world leader in mobile security for consumers and enterprises alike.”

Click here: Cybersecurity: Does corporate America really care?

October, 2014 proved a bad month for credit card-using customers of Kmart, Staples and Dairy Queen.

All these corporations reported data breeches involving the theft of credit card numbers of countless numbers of customers.

Earlier breaches had hit Target, Home Depot and JPMorgan/Chase.

And on February 5, 2015, health insurance giant Anthem Inc. announced that hackers had breached its computer system and accessed the medical records of tens of millions of its customers and employees.

Anthem, the nation’s second-largest health insurer, said the infiltrated database held records on up to 80 million people.

Among the customers’ information accessed:

  • Names
  • Birthdates
  • Social Security numbers
  • Member ID numbers
  • Addresses
  • Phone numbers
  • Email addresses and
  • Employment information.

Some of the customer data may also include details on their income.

Click here: Anthem hack exposes data on 80 million; experts warn of identity theft – LA Times

Bad as that news was, worse was to come.

A February 5 story by the Wall Street Journal revealed that Anthem stored the Social Security numbers of 80 million customers without encrypting them.

The company believes that hackers used a stolen employee password to access the database

Anthem’s alleged reason for refusing to encrypt such sensitive data: Doing so would have made it harder for the company’s employees to track health care trends or share data with state and health providers.

Anthem spokeswoman Kristin Binns blamed the data breach on employers and government agencies who “require us to maintain a member’s Social Security number in our systems so that their systems can uniquely identify their members.”

She said that Anthem encrypts personal data when it moves in or out of its database–but not where it  is stored.

This is a commonplace practice in the healthcare industry.

The FBI is now investigating the hack.

According to an anonymous source, the hackers used malware that has been used almost exclusively by Chinese cyberspies.

Naturally, China has denied any wrongdoing.  With a completely straight face, Chinese Foreign Ministry spokesman Hong Lei said:

“We maintain a cooperative, open and secure cyberspace, and we hope that countries around the world will make concerted efforts to that end.”

He also said that the charge that the hackers were Chinese was “groundless.”

Click here: Health Insurer Anthem Didn’t Encrypt Stolen Data – WSJ

Meanwhile, John Herring’s complaints remain as valid today as they did last October.

“One thing is clear,” writes Hering. “CEOs need to put security on their strategic agendas alongside revenue growth and other issues given priority in boardrooms.”

Hering warns that “CEOs don’t seem to be making security a priority.”  And he offers several reasons for this:

  • The sheer number of data compromises;
  • Relatively little consumer outcry;
  • Almost no impact on the companies’ standing on Wall Street;
  • Executives may consider such breaches part of the cost of doing business.

“There’s a short-term mindset and denial of convenience in board rooms,” writes Hering.

“Top executives don’t realize their systems are vulnerable and don’t understand the risks. Sales figures and new products are top of mind; shoring up IT systems aren’t.”

There are three ways corporations can be forced to start behaving responsibly on this issue.

  1. Smart attorneys need to start filing class-action lawsuits against companies that refuse to take steps to protect their customers’ private information.  There is a name for such behavior: Criminal negligence.  And there are laws carrying serious penalties for it.
  2. There must be Federal legislation to ensure that multi-million-dollar fines are levied against such companies–and especially their CEOs–when such data breaches occur.
  3. Congress should enact legislation allowing for the prosecution of CEOs whose companies’ negligence leads to such massive data breaches.  They should be considered as accessories to crime, and, if convicted, sentenced to lengthy prison terms.

Only then will the CEO mindset of “We don’t care, we don’t have to” be replaced with: “We care, because our heads will roll if we don’t.”

, , , , , , , , , , , , , , , , , , , , , , , , , , , ,

JAMES BOND GONE WRONG

In Bureaucracy, History, Law, Military, Politics, Social commentary on January 12, 2015 at 12:23 am

James Bond, the legendary creation of novelist Ian Fleming, routinely bedded femme fatales–and sometimes killed them. But he never faced indictment for romancing them.

That’s the difference between Bond and David Petraeus, former director of the Central Intelligence Agency.

Movie poster for Thunderball (1965)

The Justice Department is deciding whether to bring criminal charges against Petraeus.  The FBI  alleges that, as CIA director, he shared classified information with his then-mistress and biographer, Paula Broadwell.

FBI agents found classified information on a personal computer Broadwell used–and determined that Petraeus had supplied it.

As an Army General, Petraeus had successfully led U.S. troops in Afghanistan and Iraq and was thought to be a potential candidate for president.

In 2011, he won appointment to CIA director–which ended abruptly in 2012 with the revelation of his extramarital affair with Broadwell.

Petraeus is one of the most highly educated men in the United States:

  • Alumnus of the United States Military Academy at West Point–graduating among the top 5% of his 1974 class.
  • General George C. Marshall Award winner as the top graduate of the U.S. Army Command and General Staff College class of 1983.
  • Earned an M.P.A. in 1985 and a Ph.D. in International Relations in 1987 from the Woodrow Wilson School of Public and International Affairs at Princeton University.
  • Served as Assistant Professor of International Relations at the United States Military Academy

David Petraeus

And Paula Broadwell is one of the most highly educated women in the United States:

  • Graduate of the United States Military Academy at West Point in 1995, majoring in political geography.
  • Earned a master’s degree in international security from the University of Denver’s Joseph Korbel School of International Studies in 2006.
  • Earned a Master of Public Administration from the John F. Kennedy School of Government at Harvard University in 2008.
  • A Research Associate in the Kennedy School’s Center for Public Leadership Fellows.

In addition, Petraeus, as director of the Central Intelligence Agency, knew the importance of secrecy in keeping clandestine affairs (military and personal) out of sight.

Paula Broadwell

So did Broadwell, having earned a reputation as an expert on counterterrorism.

Yet they both violated the most basic rules of security.

They exchanged emails using a cyber trick known to both terrorists and teenagers: Sharing a private email account, or “dropbox.”

In this they composed drafts to each other in order not to directly transmit messages to one another.  Each could log onto the same account and read the draft emails there.

By doing so, they flagrantly left a cyber-trail of their infidelities. (Broadwell was also married.)

It was Niccolo Machiavelli, the father of political science, who warned: If you don’t want it known, don’t write it down.

More than 500 years ago, in his masterwork, The Discourses, he warned:

Niccolo Machiavelli

I have heard many wise men say that you may talk freely with any one man about everything, for unless you have committed yourself in writing, the “Yes” of one man is worth as much as the “No” of another. 

And therefore one should guard most carefully against writing, as against a dangerous rock, for nothing will convict you quicker than your own handwriting….

You may escape, then, from the accusation of a single individual, unless you are convicted by some writing or other pledge, which you should be careful never to give.

Nor were Petraeus and Broadwell the only ones guilty of thumbing their noses at this most basic of precautions.

General John Allen, the top American commander in Afghanistan, exchanged thousands of emails  with Jill Kelley, a Florida socialite.

Although charged with directing American military efforts against the Taliban, Allen found time to exchange 20,000 to 30,000 pages’ worth of emails with Kelley between 2010 and 2012.

The scandal began when Kelley began receiving harassing emails from an unidentified woman.  So she complained to the FBI.

The emails allegedly came from Broadwell, who thought that Kelley was trying to move in on “her man”–Petraeus.  Apparently, Broadwell didn’t feel similarly threatened by Holly, Petraeus’ wife.)

The FBI investigation ultimately led to the discovery of the Petraeus/Broadwell affair.

There are several lessons to be learned from this behavior by Petraeus, Broadwell, Allen and Kelley:

  • They believed they were so privileged–by education, status and/or wealth–that conventional rules of morality didn’t apply to them.
  • They believed they were so clever they could violate the most basic rule of security and common sense–and get away with  it.
  • They were so caught up in their illicit passions that they threw caution to the winds.
  • David Petraeus, a highly disciplined man, clearly expected Paula Broadwell to behave in a similarly disciplined manner–and do nothing to compromise their lives.
  • Petraeus felt so confident about the secrecy of his affair he had his wife and mistress present when he appeared before the Senate Intelligence Committee in 2011 to become CIA director.

General David Petraeus’ CIA confirmation hearings. His wife, Holly (in white) and mistress, Paula Broadwell (in black).

  • Petraeus didn’t imagine that Broadwell suspected another of his admirers–Jill Kelley–of having romantic designs on him.
  • And he was utterly surprised when her harassing emails to Kelley led the FBI to uncover his illicit relationship.

Thus does hubris meet its punishment in Nemesis.

, , , , , , , , , , , , , , , , , , , , , , , ,

“WE DON’T CARE, WE DON’T HAVE TO”

In Bureaucracy, Business, Law, Politics, Social commentary on October 23, 2014 at 2:52 pm

Comedian Lily Tomlin rose to fame on Rowan & Martin’s Laugh-In as Ernestine, the rude, sarcastic switchboard operator for Ma Bell.

She would tap into customers’ calls, interrupt them, make snide remarks about their personal lives.  And her victims included celebrities as much as run-of-the-mill customers.

On one occasion, she called then-FBI Director J. Edgar Hoover, letting him know that “it really takes a Hoover [vacuum cleaner] to dig up the dirt.”

She introduced herself as working for “the phone company, serving everyone from presidents and kings to the scum of the earth.”

But perhaps the line for which her character is best remembered was: “We don’t care.  We don’t have to. We’re the phone company.”

Watching Ernestine on Laugh-In was a blast for millions of TV viewers during the mid-1960s and early 70s.  But confronting such corporate arrogance in real-life is no laughing matter.

Clearly, too many companies take the same attitude as Ernestine: “We don’t care.  We don’t have to.”

This is especially true for companies that are supposed to safeguard their customers’ most sensitive information–such as their credit card numbers, addresses, emails and phone numbers.

An October 22 “commentary” published in Forbes magazine raises the highly disturbing question: “Cybersecurity: Does Corporate America Really Care?”

And the answer is apparently: No.

Its author is John Hering, co-founder and executive director of Lookout, which bills itself as “the world leader in mobile security for consumers and enterprises alike.”

Click here: Cybersecurity: Does corporate America really care?

October proved a bad month for credit card-using customers of Kmart, Staples and Dairy Queen–all of which have reported data breaches involving the theft of credit card numbers.

Earlier breaches had hit Target, Home Depot and JPMorgan/Chase.

“One thing is clear,” writes Hering.  “CEOs need to put security on their strategic agendas alongside revenue growth and other issues given priority in boardrooms.”

Hering warns that “CEOs don’t seem to be making security a priority.”  And he offers several reasons for this:

  • The sheer number of data compromises;
  • Relatively little consumer outcry;
  • Almost no impact on the companies’ standing on Wall Street;
  • Executives may consider such breaches part of the cost of doing business.

“There’s a short-term mindset and denial of convenience in board rooms,” writes Hering.

“Top executives don’t realize their systems are vulnerable and don’t understand the risks. Sales figures and new products are top of mind; shoring up IT systems aren’t.”

Anyone who’s ever watched the operation of an airport luggage carousel has seen this principle in action.

If you’ve checked your luggage, then you need to head for the baggage carousel as  quickly as you can get out of the airplane.

Because if you don’t get there in time to grab your own bag, there’s a good chance that someone else will.

The reason?  There’s no security officer there to make sure that your luggage goes only to you, and not to someone else.

Experienced baggage thieves know this.  So they wait at the luggage carousel for a piece of luggage to go around two or three times.  If no one collects it, they assume the owner isn’t there yet–and make off with it.

Sure, there might not be anything of value in it–from the thief’s viewpoint, anyway.

No diamonds.

No jewels.

No expensive cameras.

For the thief, it’s a setback–but only a minor one.  He simply dumps the luggage and perhaps goes back to the carousel for another shot at finding a bag stuffed with valuables.

But for the traveler-victim, it’s a disaster.

Most–if not all–of his clothes are gone.

Anything personal–such as gifts he was bringing for friends or relatives–is gone.

So are any vitally-needed medications–if he was foolish enough to store these in his suitcase instead of a carry-on bag.

And does the airline care?

Don’t be stupid.

Why should they?  They got your money when you bought the plane ticket.

That’s all they wanted from you.  And the truth is, that’s all they’ve ever wanted from you–even during the “golden age of air travel” before airplanes became “flying buses.”

The skies of United were never so friendly that airlines felt an obligation to ensure that their passengers’ luggage was actually waiting for its rightful owners.

And the same principle–or lack of principle–applies with such companies as banks, department stores and insurance companies that hold the most private information of their customers.

There are two ways corporations can be forced to start behaving responsibly on this issue.

First, some smart attorneys need to start filing class-action lawsuits against companies that don’t take steps to safeguard their customers’ private information.

Second, there must be Federal legislation to ensure that multi-million-dollar fines are levied against such companies–and especially their CEOs–when such data breaches occur.

Only then will the CEO mindset of “We don’t care, we don’t have to” be replaced with: “We care, because our heads will roll if we don’t.”