#jolera

My last few posts were not very happy. They dealt with computer security and the need for most, if not all businesses, to consider a safety audit to provide an understanding of where there were potential vulnerabilities and what steps could be taken to shore up their system defenses. The articles sounded a general alarm. I wanted to complete this series of entries on a more positive note by highlighting some excellent research being done right here in Ontario at the University of Waterloo’s Institute for Quantum Computing ( https://uwaterloo.ca/institute-for-quantum-computing/ ). Funded initially by Mike Lazaridis of Blackberry fame, the IQC is at the core of an ecosystem designed to take quantum research projects all the way from initial conception to commercialization.

IQC Professor Thomas Jennewein is a graduate of the University of Vienna ( Ph.D. 2002) and is presently working on a satellite communication system that cannot be hacked. Given the alarms we read almost daily about computer system being violated this seems almost “pie in the sky.”

While I won’t pretend to be an expert in Quantum Mechanics ( 2 lectures 25 years ago does not an expert make) my recollection is that that any attempt to measure a quantum of energy immediately results in a change to it so that any associated information would change as well. This is at the core of secure quantum computing. So while we are not quite there yet, computer security is on the verge of a significant leap forward. All this begs the question as to what can be done in the interim.

Let me suggest 5 reasons to get Jolera involved:

1) We deal with security issues daily and have a Rolodex of support contacts who have specific knowledge and experience dealing with situations like yours.

2) We value our reputation and will tell you the truth. There is nothing like an arm’s length relationship to put the facts on the table.

3) We will keep you disciplined. Our project teams will assure that security schedules are maintained and budgets are respected.

4) You will make more money. Your client relationships will deepen as they learn of the steps you are taking to protect them.

I recently visited the Identity Theft Resource Center’s website  at  http://www.idtheftcenter.org/ 

The ITRC is a non-profit organization.  Its mission is to assist identity theft victims at no charge, educate both consumers and organizations on best practices for fraud and identity theft detection, reduction and mitigation and serve as a resource on consumer issues related to cybersecurity, data breaches, social media, fraud, scams and other issues.  

It was a useful experience and I suggest everyone bookmark the link and visit the site at least once or twice a month to keep up with developments.  Let me quickly summarize some of the facts I discovered.  I’ll just focus on a few 2015 breaches to keep things simple: 

 Nov. 10, 2015- Dow Corning Suspects Internal Data Breach.   4000 employees are possibly affected. Personal information may have been stolen. 

http://www.idtheftcenter.org/Data-Breaches/dowcorningbreach.html 

 Oct 15, 2015-  Dow Jones Data Breach Reveals Surprising Shift in Identity Theft Crime.  Investigators believe that between August 2012 and July 2015, cyber thieves began accessing information stored on subscribers in the system. This breach was discovered in July 2015.  

http://www.idtheftcenter.org/Data-Breaches/dowjonesbreach.html 

 Oct 1, 2015- Hilton Hotels Suspects Ongoing Data Breach.  A pattern of credit card fraud suggests hackers have compromised point-of-sale registers in gift shops and restaurants at many  Hilton Hotel and franchise properties. 

http://www.idtheftcenter.org/Data-Breaches/hiltonbreach.html 

 Sept 23, 2015- Molina Health Data Breach an Inside Job.  A CVS employee had downloaded patient information to his laptop, information which included full names, CVS-specific numbers on each patient, prescription coverage plan numbers, and coverage dates.  

http://www.idtheftcenter.org/Data-Breaches/molina-health-data-breach-an-inside-job.html 

 Dell summarized its observations on Cyber Security in its 2015 Annual Security Report in a statement of best practices: 

1. Continuously train employees for security awareness. 

2. Vigorously employ endpoint defenses.  Most network infiltrations begin with a compromised user device. 

Deploy secure mobile access technology that checks the security posture of user 

devices before granting network access and enforces policies that grant VPN access 

only to trusted users, mobile apps, and devices. 

 Deploy secure workspace technology to establish and enforce on-device data 

protection policies and app management. 

 Implement 2FA ( 2 Factor Authentication) for both administrators and users. 

 Protect privileged accounts. 

Manage contractor, partner, intern, patient, and vendor access differently than internal 

resources. Control and monitor access rights regularly. 

3. Replace traditional or legacy firewalls with a Next-Generation Firewall (NGFW). 

4. Invest in a capable intrusion prevention system (IPS). 

5. Add an SSL/TLS inspection capability to detect and block malware that is hidden in SSL/TLS-encrypted  traffic. [Transport Layer Security (TLS) and its predecessor, Secure Sockets Layer (SSL), are cryptographic protocols which are designed to provide communication security over the Internet.] 

6. Implement continuous threat counter-intelligence feeding security updates to NGFWs and intrusion prevention systems. 

7. Deploy an email security solution. 

8. Consistently update software.  

9. Secure remote work environments by segmenting router access. 

 10. Implement the same level of defense throughout a distributed enterprise’s locations, including kiosks, executive homes, and remote offices. 

Francois Mathy, JR & Talisman De Mazure Jolera International Jumper Welcome