WFH Risks

This pandemic has popularized a new acronym - WFH - Work From Home.

That scares me. I worry that WFH security is not what it should be.

IBM published a Work From Home Study. Here are their Key Points:

1. 93% of those newly working from home are confident in their company’s ability to keep personal identifiable information (PII) secure while working remotely, yet 52% are using their personal laptops for work – often with no new tools to secure it, and 45% haven’t received any new training.
2. More than half have yet to be given any new security policies on how to securely work from home, leaving 47% concerned about impending cybersecurity risks
3. 53% of employees are using their personal laptops and computers for business operations while WFH, however 61% also say their employer hasn't provided tools to properly secure those devices.
4. More than half have not been provided with new guidelines on how to handle PII while working from home, despite more than 42% newly being required to do so as consumers lean on customer service representatives for a variety of services. 
5. 66% have not been provided with new password management guidelines, which could be why 35% are still reusing passwords for business accounts.

Wow!

WFH scares me to death. What does this look like in another year?

Total Cost of Ransomware

So you think that the ransom payment is the biggest cost of a ransomware attack?

Not even close.

A recent article by Decrypt covers the costs of ransomware.

Cybersecurity company Emsisoft estimated that total ransom payments that were demanded in 2019 was $25 billion.

That's bad enough. But Emsisoft estimated that the total cost was as much as seven times this, as much as $170 billion.

Most of the difference results from downtime and from dealing with the attack.

Coveware reports that it takes victims of a ransomware attack 16 days to restore their network. Think about your network being down 16 days.

Gartner suggests that the average cost per minute is $5,600. Tick-tock.

That's why 1 out of 3 companies just pay the ransom.

Don't be in that group.

Worry. React. Invest.

Windows Tools

From time to time, I run across Windows tools. I'm NOT recommending any of these but just giving you a place to start looking.

O&O AppBuster

O&O AppBuster shows you which of these Microsoft-supplied apps with Windows 10 are installed on your computer and which you can install on request - even hidden apps are displayed here.

Remote Utilities

You can view screens remotely, send keystrokes, control the mouse pointer, transfer files and do any other operation just as if you were physically sitting in front of the remote PC.

Win10 All Settings

The main aim of the application is to help users customize Windows 10 in all circumstances with alternative configuration interfaces, and it can also perform some hidden settings.

Winaero Tweaker

Winaero Tweaker is a freeware app created by Sergey Tkachenko. It is an all-in-one application that comes with dozens of options for fine-grained tuning of various Windows settings and features.

It also includes most options which were available in free standalone apps at Winaero.com and extends them as much as possible.

 I will continue to maintain this list. Leave me a comment if you have suggestions.

Social Engineering Risk

Recently I posted about Accenture Strategy's assessment on "Securing the Digital Economy."

My closing advice was:

Worry. React. Invest.

This week I want to share a real world example of the risk.

Waterloo Brewing Ltd. is a brewery in Kitchener, Canada. Their 2019 annual revenue was just under $50M.

Then in November 2019 they got hit with a social engineering attack.

The Ontario brewery says the incident occurred in early November and involved the impersonation of a creditor employee and fraudulent wire transfer requests.

They lost $2.1M! That's more than 1/2 their quarterly EBITDA.

How would that look on your balance sheet?

Teams in the Tank

Shortly before the Coronavirus hit the world in early 2020, Microsoft had it's own crisis.

Microsoft was pushing its Teams platform heavily, even running TV commercials during the NFL playoffs.

Then just after 9AM EST on February 3, 2020, it all stopped.

We've determined that an authentication certificate has expired causing users to have issues using the service.

Microsoft let a certificate expire.

Around noon, Teams was mostly back up. Microsoft confirmed the fix was successfully deployed around 4:30PM.

Maybe they should have put a reminder on their Outlook calendar.

Chrome Tab Hover Cards

Google's Chrome 85 has lots of new bells and whistles. One I've been playing with is Tab Hover Cards.

Although I have Chrome 85, this specific feature is not enabled. Google tends to roll these out in waves.

If you want to see it now, go to chrome://flags and search for "tab-hover-card". I intentionally omitted the "s" at the end so you'll see both flags.

For each entry, click on the blue box and change the setting to "Enabled".

"Tab Hover Cards" has choices for "Enabled", "Enabled B", and "Enabled C". These affect how quickly the preview pops up.

Then you'll need to relaunch Chrome.

This is what the preview looks like.

Not all of the previews come up immediately. It seems that Chrome is building them in the background. It may take a few minutes before all the previews are ready.

Trillions with a "T"

 In late 2019, Accenture Strategy did an assessment on "Securing the Digital Economy."

Topics included:

• The Internet Just Can't Keep Up
• The IoT Effect
• Identities in Crisis
• No Flow Versus Free Flow
• The Cost of Insecurity
• Keeping Tabs on Cybersecurity Investments

Then they gave recommendations for actions in the following areas:

• Governance
• Infrastructure
• Technology

This is a great read.

But I want to emphasize just one of their findings - The Cost of Insecurity

Here's their chart:

In the private sector, over the next five years companies risk losing an estimated US$5.2 trillion in value creation opportunities from the digital economy

Yes, that TRILLIONS with a "T."

If that's hard to get your head around, this will help you apply this to your company.

This translates to 2.8 percent in lost revenue growth for the next five years for a large global company.

Worry. React. Invest.

Dashcam Wiring - OBD Power Cable

I got a new dashcam for Father's Day so I had one to "trickle down."

I'd always wanted to put a dashcam in my Honda S2000.

But the S2000 is a different animal. I didn't want to tackle the power like I had done on my newer Hondas. But the cigarette lighter in the S2000 is on the bulkhead behind the seats.

Then I came across some OBD power cables. There are a variety of alternatives with various connectors, e.g. mini-USB, micro-USB, USB-A.

But the OBD port supplies power even when the ignition is off. Some of the OBD power cables have a "smart" switch that gives 2 different modes. The first is always on, at least until the battery runs down. Unless your dashcam has a motion sensor that will cut it off when no motion is detected, that's not what you want.

The other mode on these "smart" switch OBD power cables is called "ACC". It kills the power 5 minutes after the car is turned off,

The one I ended up with was the Universal OBD Power Cable for Dash Camera,24 Hours Surveillance/Acc Mode with Switch Button (Mini-USB).

But I'm cautious of recommending it just because of the seller. The seller is in China which normally takes several weeks for delivery. But that seller offered "Local Express Shipping" with expected delivery in 1-2 days. I opted for that.

It didn't work out so well. The shipping took 3 weeks. When I tried to contact the seller, the e-mail address that Amazon had failed. But it did arrive and it was well packaged.

Overall, the cable does exactly what I wanted it to. There are several observations to add, though.

The OBD connector doesn't have any mechanism to secure it to the car's OBD port. I'm not sure that that is even possible but since my car's OBD port faces downward, I'm worried that the connector will just fall out.

Similarly, the mini-USB connector seems loose in the mini-USB port of the dashcam.

But it hasn't fallen out.

I'm using the "ACC" mode.

The other consideration I ran into as I researched these OBD power cables was that sometimes they interfere with the normal operation of the OBD system, even sometimes affecting operation of the car.

Toward this end, this OBD power cable only uses 3 pins.

So far, so good.

This looks like the exact product from an on-shore seller. This one has a USB-A port so you could power anything with a USB-A cable, e.g. a GPS or a cell phone.

This has also led me on a quest for other uses of the OBD port. Since the S2000 sits in the garage all winter, I have a battery maintainer for it. But the battery maintainer uses alligator clips that connect to the battery terminals. This means that to connect the battery maintainer I have to open the hood.

This cable plugs into the OBD port and has a connector for the battery maintainer!

I wonder what else I can use the OBD port for?