Author Archive for John Stengel



23
Nov
11

Louis Ferrante on Business Risk

I am reading a great and also entertaining book I highly recommend by Louis Ferrante.  In his book, Mob Rules (Click Here), he has a great section that applies directly to what risks companies face and the security concerns.

People are lonely and many are unhappy with the company they work for.  Beer, wine, or a cocktail will loosen people’s screws, but most people will talk if you are willing to listen.

This is precisely why social engineering is so effective in gaining access to a company’s data.  How will your employees react to a social engineering attack?  Test before you find out for real.

09
Nov
11

Projects Delayed

Below my office they are adding a patio onto the popular restaurant downstairs.  This project started months ago and still continues today.  It seems to me to be never ending.  The workers come in each day, mess with this or that.  They never seem to make great strides.

When the project began this wasn’t the case.  The first day they started building it you would have thought they had a deadline of that weekend.   A lot of action, brick layers, carpenters, concrete trucks, landscapers, etc.

Slowly as the months progressed the work slowed down.  Now that temperatures are around 45 at night here the patio is still being built.  So the investment they made in the additional seating will not be reclaimed for several more months now.

This is often the case with enterprise as well.  Months are spent deciding on a solution.  Once purchased the project starts with great excitement and then fades away.  Another business objective starts and the original project may or may not be finished.  The money was spent though but the goals are never realized or realized later on.

As the year winds down we are in the process of wrapping up our projects and goals and starting to think about 2012.  Our business is not the same as it was 11 months ago I can assure you.  And what I thought I wanted to do has changed as well.  Some things I thought were great ideas were failures.  Some things I didn’t even think about have been a tremendous success.

With a looming recession affecting many businesses and fast changes affecting others, have your projects been reevaluated?  Have the products you are using been reevaluated?

08
Nov
11

Security Projects – Why They Never get Approved

I watched this video a couple weeks ago and immediately shared it with my team.  I think this is a fantastic explanation for why people do or do not do something.  I think this fits in perfectly with what I have been talking about lately, why IT people don’t get security projects approved.  Take a look and I would love to hear your feedback.

http://www.ted.com/talks/lang/eng/simon_sinek_how_great_leaders_inspire_action.html

01
Nov
11

International Considerations – Part II

So with the recent blocking of VPN (read blocking of company data) traffic in Pakistan announced, I thought of a question for businesses operating in that region.  What are you doing to block Pakistan and these countries from accessing your data?  That is to say, what security measures have you put in place to protect your company intellectual property?

Copyrights, trademarks, and patents don’t necessarily mean much across borders.  The countries you operate in need to back the rights you hold for them to mean anything internationally.  Several countries are known for, if not for endorsing but, not enforcing protected products and IP.

Ask yourself one question; is my company data safe when it leaves the country I am based in?  This same question holds true weather you are US based or based in Argentina, Brazil, or South Africa.  When devices leave your borders you need to maintain privacy and control.  If not employees accessing your office could very well be the target of snooping.

25
Oct
11

International Considerations

Pakistan will begin enforcing a ban on VPN traffic. The Pakistan Telecommunications Authority delivered a memo in Internet providers asking them to block encrypted VPN traffic, unless permission is obtained.

The concern is that terrorists will try and hide communications. The reality is, in my opinion, they want to snoop on all traffic. I believe this is the same country that was mad at the USA for killing Bin Laden. Are we to believe that now they are interested in only stopping terrorists?

I believe that companies that operate in the middle east and Asia Pacific regions will have these obstacles continuously added. Proper planning for a dynamically changing remote access solution will be necessary to continue to compete. Products, policies, and procedures will need to be continuously reevaluated in this climate.

21
Oct
11

The Human Side

When evaluating your company security you cannot exclude the human element of security.  No matter how secure your technology is, no matter how many products you buy if people are involved you have risk.  DLP is one way to mitigate the human element.

11
Oct
11

Let’s Talk Phishing

Phishing is one of those most dangerous scams on the internet today.  That is not news to anyone who even casually reads news.  When a phishing attack occurs the purpose is to gain access to critical data by attempting to coerce users into disclosing it.  An even more egregious attack is spear-phishing.  That is when an attack is personal to your employees.

When companies test their security they rarely test for phishing success.  Yet it is extremely relevant.  Not testing for phishing success is really just waiting to get your data stolen. 

Your employees don’t know how to react unless you train them.  You can’t train them until you know where you are weakest.

We offer this as a service to our clients.  Because not one test or assessment makes you secure.  It is through several tests can you really know where your security stands.

10
Oct
11

Communication is Key

The number one thing to make companies more secure is often overlooked.  It isn’t the firewall, the anti-virus, the, email filter, or even the 2FA process.  It is communication.

For example, if you encrypt a hard drive.  That is a great thing to do…Then an employee tapes the password to the keyboard because it is too complicated to remember.

If the risks and the process is never properly communicated to employees all the devices in the world will not make you 100% secure. 

Join me in Charleston on October 13, 2011 for a one day training class on how to make security a part of your organization. http://www.xtmtraining.com/trainingform.php

05
Oct
11

Testing for Success

How do you know the smoke detectors in your house work?  Do you assume they work or have you tested them?

How do you know the brakes on your car work?

I believe that if companies spent a small portion of their current IT budget simply testing their security they would have a better handle on their position and what they need to do next year.  Without testing the security, or lack of security, I really don’t understand how they can plan for 2012.

Basing budgets and projects off of instinct and not hard facts is never a good plan.

04
Oct
11

Phishing Attacks

Most companies do not test for user reactions to a phishing scam.  This is a mistake.  Not knowing how a user will react to a phishing attack leaves your company vulnerable.

We offer phishing tests to help our clients protect their assets.  Don’t wait for an attack to occur.  Test for it so we can train your team properly.




Enter your email address to subscribe to this blog and receive notifications of new posts by email.

Join 41 other followers

LinkedIn

Follow me on Twitter

  • Take the time to secure every user. Leave no crack in the foundation. The smallest one will lead to bigger issues. xtmtraining.com 12 hours ago
  • We often see companies wanting to secure a portion of their users while leaving the door open for others. This just doesn't make sense. 12 hours ago

Follow

Get every new post delivered to your Inbox.

Join 41 other followers