Encrypting USB Drive (at least for Windows Users) - TC2027

A lot of people use USB drives, and we put sensitive information on it

We obviously don't want anyone accessing our information without our consent, but what if we lost that USB? then it would be completely vulnerable and free to use for anyone that finds it (or we could "lose" a rubber ducky and have fun with it).  

We can protect our USB by encrypting it, it can still be hacked but it's much more difficult and it requires technical skill that a random person that could find your USB laying around may not have.

I read that you can use BitLocker for it, however, since I dont have BitLocker on my computer, I did my research on more ways to do this, if you want to try BitLocker, check my references at the end.

Steps:

1. Download Rohos from https://www.rohos.com/products/rohos-disk-encryption/
2. Select the language you want it installed
3. Click next
4. Accept terms and agreements
5. Select where to put the folder and click Next
6. Click install
7. You're done, you can run Rohos now

So after I ran Rohos, I plugged in my USB and clicked Cypher the USB unit, and it checks for connected USBs. 

After that, I entered the password clicked Next and you have to wait for the process to finish.

And there you have it, you can add important documents or stuff you want inside your USB and don't worry (that much) if you lose it.

There are many options, you can search for one that fits you the best but I found this one to be pretty easy and with a free 30 day trial. 

References:

http://www.tomsguide.com/faq/id-2318737/encrypt-usb-flash-drive.html

https://www.online-tech-tips.com/computer-tips/encrypt-usb-flash-drive/

https://beebom.com/best-usb-encryption-software/

Baby Monitor - TC2027

To introduce you to the topic I'll be writing about, I'll first explain the context.

My father works and lives out of Jalisco, but he comes and visits us every two weekends or so.
My brothers and I (we're 3 male, young adults - this might be relevant) live with my mother, she went a few days ago to my place of birth, to take care of her parents. 

Why do I have to tell you this? Well... because before my mother left, my father set up two Baby Cameras to "watch the house", more like keeping an eye on their sons.
Some of you might ask what does this have to do with security, well, let me tell you some stories that came up in the news:

• A couple's 3 year old son told their parents he was afraid of the man talking over the monitor at night. One day, the father heard “Wake up little boy, daddy’s looking for you,” coming from the monitor. (CBS)
• A family in London was sleeping their child when they heard eerie music coming from the monitor and a voice that said "you're being watched". (CTV News)

These news are creepy, but we're not babies, so what could go wrong? Well, if someone gained access to the monitors, they could watch us everytime, see our movements, when do we go out, at what time do we come back, what do we do when we're at the house, etc. There is a webpage, insecam which has this on their webpage:

Welcome to Insecam project. The world biggest directory of online surveillance security cameras. Select a country to watch live street, traffic, parking, office, road, beach, earth online webcams. Now you can search live web cams around the world.

Meaning that they have access to many cameras all around the world that don't have passwords protecting them, or they have the default ones "root : password", etc.
This sure raises awareness, and I found a really good post and I will try to explain it, just not as in depth, for how hackers get access and how to protect yourself, I encourage you to read the full post here: https://www.groovypost.com/howto/secure-your-video-baby-monitor/

First, how do hackers get access to a monitor?

It can be by gaining administrative access to your router, unless you've enabled port forwarding or created a demilitarized zone, you're safe here. This is done by BitTorrent clients or high bandwidth online video games. They can also gain access if you have an open wireless network (no password), but, you wouldn't do this, right? (another tip for protecting your router is to update the firmare regularly, when there's an update)

After they gained access, they can access the baby monitor configuration, these monitors usually come with a default password (or no password at all), so be sure to put a strong password in place.

However, many parents (like mine) want to access that monitor via the internet, when they're not at home, but "the bandwidth and security implications of enabling this feature are too great if you don't know what you're doing", because instead of hackers first gaining access to your router, they just have to gain access to the monitor (a strong password is needed, please, and keep the firmware of the camera updated)

My father and I took the required measurements to secure the webcams, so for now, I can rest in peace knowing that only my parents are watching me...


Read more:

http://newyork.cbslocal.com/2015/04/21/seen-at-11-cyber-spies-could-target-your-child-through-a-baby-monitor/

https://london.ctvnews.ca/baby-monitor-camera-hacked-while-child-rocked-to-sleep-1.2483149

Security or Convenience, TC2027

With the increasing number of devices connected to the Internet, sometimes (most of the times, really) we do things thinking they are making us more secure on the internet, but we are unintentionally doing the opposite.

I will talk about some authentication methods or things we do on the Web and analyze if they are keeping us safe or actually harming us.

Whenever we go to a park, a mall, or any public space, we are tempted to see the latest memes, videos, check/send important work emails, or do some work on a coffee shop. To do this, we connect (sometimes automatically) to Free Public Wi-Fi's, I know it is very convenient, but please DO NOT USE FREE PUBLIC WI-FI to do important work or send sensitive data, WHY? Because you need NO AUTHENTICATION to establish a network connection, this means anyone can see whatever information you're sending (important emails, credit card information, you name it). Some measures you can do to be safer are: use a VPN (maybe I will write a Blog about this), on your browser, type "https" instead of "http" for the websites you're visiting, this adds an extra layer of security.

 = not safe

 = safe!

A very convenient thing for when we forget our password, is to recieve a code via SMS to your mobile phone, this is kind of safe but there are some risks with it:
SMS are not protected from someone else seeing them.
There's no assurance they will go to the intended recipient. (Databreach)

Fingerprints! I think most smartphones nowadays come with this option, forget about those boring, old-fashioned secure passwords, now you can unlock your device wih your fingerprint! Is this convenient? hell yes, is this safe? maybe not so much.
Researchers developed a set of MasterPrints that could match real prints similar to those used by smartphones as much as 65% of the time. (NY Times)

I can't list every single authentication method and its risks, these methods change over time, but we must start thinking about which authentication methods we use and why we use them, is it for security (most times, really secure methods are a pain in the buttocks) or is it for convenience? Then we should search for the risks of doing so, to stay more secure.

If you want to learn more:

https://www.kaspersky.com/resource-center/preemptive-safety/public-wifi-risks
https://www.lifewire.com/disable-automatic-wireless-connections-153376
https://www.databreachtoday.com/blogs/convenience-over-security-often-best-policy-p-2233
https://www.nytimes.com/2017/04/10/technology/fingerprint-security-smartphones-apple-google-samsung.html

Authorization vs Authentication, TC2027

I think these concepts are sometimes used incorrectly, or used one meaning the other, but these two concepts are closely related which is why it can cause some confusion to some.

Today I will try to explain these concepts.

Authentication

It is a way to prove that you are who you say you are. Outside the tech environment, if an officer pulls you over and asks for your ID, is a way for him to know who are you. If he asked your name, you could come up with a fake name, but an official ID will let him know your name, and other accurate information about you, proving that you are you. 

In the tech world, authentication is used by a server to know who is trying to access the information, and it is used by a client to know if the server is who it claims to be. 

There are different types of Authentication:

• Single-factor: it is giving access to a system by using only one category or credentials. An example could be passwords. 
• Two-factor: it is giving access to a system by using two categories or credentials, in order to add an "extra layer" of security. It's usually added to the username - password authentication but adding information that only the user knows or has, this can be a token, an SMS they send to your phone number.
• Multi-factor: it is giving access to a system by using two or more categories or credentials. 
• Strong: it is combining two mutually-independent factors of authentication so if one is compromised, the other isn't automatically compromised. Usually, a category or credential is non-reusable, like a specific token for only one transaction, to add even more security.

______________________________________________________________________________

Authorization

Simply put, are you allowed to do that? Whenever we go to a building, there are always certain doors or areas that not everyone is authorized to go in. For example, ITESM students can access the campus with their ID, but there are certain rooms that, even if you're a student, you're not allowed (authorized) to go in (only authorized personnel). 

But it can also mean of giving specific access rights or privileges to resources related to information security and computer security in general and to access control in particular (Wikipedida). And this is usally implemented as a role in the user to specify and limit the actions they can perform within the system. 

______________________________________________________________________________

In the beginning I said these two concepts are closely related, why? Take the following example, my 

User in my computer has administrator rights, but in order for me to use them and access every right on my computer, I have to login and verify that it is actually me, Sebastián, who is trying to get access. I am authorized to do any changes to my computer, however, only after I've authenticated myself, is that I am granted the access.

In conclusion, these two concepts are really important for Computer and Information Security, to prevent damages, unauthorized access, loss of data and bad stuff like that.

Computer and Information Security, TC2027

CIA? Probably ot what you're thinking

In Information Security there are three big goals that every organization should take into consideration, which are:

• Confidentiality
• Integrity
• Availability

The first one, Confidentiality, is to ensure that sensitive information of the organization is accessed only by those authorized to look to that information. There can be different levels of classification to the information, depending on how important it is. For example, someone getting unauthorized access to an email about which type of coffee someone likes, doesn't have the same impact as if the email contained the nuclear launch code. 

There are several ways to keep information confidential, I'm not going to go in depth about these but I can mention the following: secure passwords, two-factor verification or encryption. 

Integrity means to keep the information consistent, for example, if a document is being manipulated by someone, an unauthorized person shouldn't be able to modifiy it, because that document becomes untrustworthy and stops being consistent. This doesn't mean that information's integrity is compromised only if someone external does something to it; it can happen that a person has access and is authorized to certain document, and works on it all day but forgets to save it or loses the most actual version, this affects the documents integrity because it stops being accurate. 

Availability is the cherry on top of the previous concepts. Think about it, you can keep Information in the most secure way, only the ones authorized to the information can access it, it's up to-date, accurate and trustworthy. But what happens if it's stored on a computer that's kept under key and the key is lost, and there is no copy of such key. That totally makes the information useless, the information should be accessed and available whenever it's needed. I may only want to get that information once a month, following this concept, I must be able to access it every single month. 

The CIA concepts are to keep the Information Secure, however, there are many procedures and ways that can be implemented and this doesn't guarantee 100% the information's security. 

CIA's challenges

Organizations must try to implement these concepts on all their information, following many and different steps in order to achieve this. 

Since this means work on information, there are some challenges we're coming up against.

The amount of information produced nowadays is A LOT, thanks to Big Data and IoT, we have a lot of information to handle, and to keep all these information secure is an increasing challenge. 

I remember when I worked on a company as a Staff Consultant, I learned these concepts and we implemented them within the organization, and we helped other organizations to follow these concepts. It required some work to make sure Information was handled properly, I can only imagine what it's like for different organizations that handle way more information, and it makes my head hurt.