This is the first post in a series examining how information is lost or stolen and how business owners and/or their employees may be the greatest risk to the business. If you are a business owner or concerned employee, take heed. Our thirst for convenience fueled by technology has created huge business risks that most of us are either ignoring or not even aware of. This series will follow Emily and Ernie, the typical business owner or employee, as they live their lives, and work for or run a business relying on today’s technology. These stories explore how we use technology in our everyday lives, where vulnerabilities exist, the things we do to create those vulnerabilities, and what you can do to make your company and valuable information more secure.
Part 1: A Typical Day in the Lives of Emily and Ernie
It’s Monday and Emily’s alarm goes off at 6 a.m. She excitedly jumps out of bed, ready to get started on her new business. She immediately grabs her smartphone to check to see if there are any new emails from potential customers. “Wow,” she thinks, “six new emails!” She quickly opens and begins to read each. The excitement fades slightly as she sees the first two are spam—other companies attempting to sell her something. The next seems interesting, the Subject line states, “Request for Quote.” She quickly opens it, sees a PDF attachment, and opens that. It looks interesting and may have potential, but in this light and on her little phone she decides to wait until she gets to her computer. The other emails are from friends and family: one is from her mom sending her a cute video, and another is from a potential friend asking to connect on Facebook. Emily decides these can all wait until she gets to her computer.
Emily, being the prudent business owner, does as much as she can virtually. She works from home, as do her two employees. But, home can become monotonous, so she frequently heads to her favorite coffee shop to work. While on her way to the coffee shop, Emily receives a call from one of her employees. Since she always keeps her Bluetooth on, she taps the device and chats with her employee. It seems that Ernie’s alarm goes off at 6 a.m. as well, ugh! But, having worked for the same company for many years, Ernie is in no rush to get out of bed, so he pounds the alarm for 15 more minutes of sleep. When Ernie finally gets up, he ignores his smartphone since he assumes any emails are work related and can wait. He does proceed to check sports stats and check out a little bit of entertainment news.
Ernie is what you might call the comfortable employee. He has been in his job long enough that he believes he knows more than most, certainly more than the leadership. He believes that most mandates from the top are merely a formality, do not really mean anything, and can be ignored, like the requirement to not email work home or not surf social media and other such sites at work.
Vladimir, a hacker from the east, is on a mission: make a lot of money. He has a number of scams working. First, he has created a botnet with a few hundred infected machines. The infected machines include home and office computers, business servers, and others. The owners of these infected systems have no idea their computers are being used by others to execute commands. Newly infected machines are constantly added to make up for those that are discovered and cleaned.
Even though Vladimir does not have a lot of knowledge about coding or creating malware, other hackers have facilitated the creation of botnets so it merely requires pointing and clicking. He uses the botnets to send spam messages with links in them and attachments. If the recipients click the link or open the attachment, Vladimir’s malware downloads in the background, and he is then able to take control of the system. Victims can also be infected by visiting legitimate websites that have been infected by hackers. If the security on a website is not that good or contains a vulnerability, hackers will break in and plant malware that users will unknowingly download when surfing a website. Vladimir makes use of new hacker technology and has begun using a new form of botnet control through Twitter. Once infected, a compromised machine receives commands by monitoring a particular Twitter account.
Vladimir has been using these bots to attack other systems. He can initiate a denial of service attack (DoS) to take down or slow up the network of a company, to mask his attempts to gain access to the network, or to disrupt company business on behalf of a competitor. He also uses the bots to steal data, such as banking information.
Follow-on blogs will explore the vulnerabilities what Ernie, his employer, IT person and Emily could have safeguarded against to prevent breaches and other cyber incidents.
Related Courses
Certified Ethical Hacker v8
Security+ Prep Course
CISSP Prep Course