Omerta.com

101 KB
18 sty 24 13:17

First, let me underline once again that the goal of this book is to make you understand what the heck is going on around. Because all the extremes, be it total negligence or total paranoia, are harmful. You can’t, like Don Vito Corleone, fully give up some very useful and important channel of communication – this is not a solution for the 21st century, and this is not a solution for your business. Especially so, that you have a company, you have an office, and you have employees. And if you don’t screw up, they may easily screw up. Therefore, don’t deny dangers, but undertake necessary and sensible security measures. And for that you need to know what are the dangers of the cyber era, what means of security exist, and how to apply them. Forewarned is forearmed.

24 KB
18 sty 24 13:14

23. What happens in the Internet stays in the Inte rnet.pdf

At the end of our fascinating journey in the world of the information security and data protection, you must clearly understand that any information released in the Internet stays there practically forever, at least as far as the predictable future is concerned. Masses of users leave there their confidential information that can be easily identified and collected not only by professional investigators, but also by any user possessing sound logical thinking, and at least general knowledge of what does searching the Web mean.

29 KB
18 sty 24 13:13

22. Few words about traditional banking.pdf

Security measures of the traditional (off-line) banking are not directly related to the subject of this book, which is about the questions of security of the digital data. Yet, since the book deals with the information security as such, I’ve decided to include this short chapter with few pieces of advice regarding this topic, involving some hi-tech aspects. So, here are few useful advises about operations with your banking account.

22 KB
18 sty 24 13:10

21. Digital wallet.pdf

Practically any businessman uses banking services. In our times it means working with Internet banking, electronic money, and electronic payment systems, and buying on-line (that is mostly in the Internet in one or another way) goods and services. Most recently there were invented so-called cryptocurrencies – an entirely electronic cash. And since we are talking about money, the question of safety and security poses a particularly acute electronic concern. As far as my experience is concerned, it seems that most of the Big Bosses are confused about these issues. Some of them don’t do electronic payments because they are afraid to be robbed, and others enthusiastically brace for electronic payments for everything and everywhere, and then wonder why were they robbed.

26 KB
18 sty 24 13:09

20. Spy mania.pdf

There is a whole shebang of spy applications to install on your computer. And they can be installed not only by your staff, but also from the Internet. Through the open ports, and by the means of the trojans exploiting those vulnerabilities we discussed in the chapter Epidemiology.

17 KB
18 sty 24 13:07

19. Biometrics.pdf

A short chapter on the modern means of identification. Smart cards, e-tokens, and other means are gradually but steadily getting out of use, because they all have one common flaw: They rely on a password or another technical factor, and ain’t bound to a specific person. So, if one hypothetically meets that given person at the back door of your office, and under the threat of physical violence, or something else equally unpleasant, asks for the thing, the villain will obtain quite a realistic opportunity to penetrate your premises, and lay his hands on sensitive data.

19 KB
18 sty 24 13:06

18. Burn before reading.pdf

What exactly is the tracking changes feature? With that feature turned on, text editors can track changes made in the document, that is to preserve the entire history of editing the text. On one hand it’s a very useful feature, but on the other hand – a very dangerous one from the point of view of the information security. Because if you make any corrections in some document (a contract, for example, a letter of intent, or agreement), you address them not to your partners, but to your secretary, who has to come out with the final version, and those corrections should not get there, because you surely don’t munch your words.

24 KB
18 sty 24 13:05

17. Burn after reading.pdf

Proper disposal of documents is an art. To tear them in halves and dump them in the waste basket is the best way to unpleasant surprises when you least expect them. There’s nothing easier than to bribe the cleaning lady to bring the scraps of the torn documents to the compassionate young man waiting for her with ten bucks and a pair of stockings. No need to nurse any delusions – the money you pay her is not big enough to stand for better and for worse for the company’s information security.

36 KB
18 sty 24 13:01

16. Paperless office for the mindless secretaries.pdf

Meanwhile, you can’t do any useful work by pushing papers. Try to find a paper you need even among documents in one office file. And now do it for all the files in one closet! And now all the closets in the office!!! You will simply go mad before you finish the work! Unlike in case of working with a computer: You click a button, type in words to search, and a few seconds later you get the list of documents containing those words, no matter if it’s a hundred, a thousand, or a hundred of thousands of files.

35 KB
18 sty 24 13:00

15. Everything under control.pdf

I don’t like, when strangers read my letters, lurking through my shoulder from behind, used to sing this great singer, poet, and actor. This is certainly a great maxim for the champions of human rights, but it has absolutely no right to exist in business. Security of your information presumes strict control over what happens to the corporate documents and mail of each and every employee. A situation when they keep something somewhere on a local disk, encrypted with some private keys, and when you request this or that document they answer that in a moment they’ll unpack it, decrypt it, and upload to the server must not happen. This is absolutely intolerable, with no exceptions, period!

38 KB
18 sty 24 12:56

14. D-Day.pdf

As I have already mentioned, a lot of things in the system of corporate information security is designed to solve problems that may occur on the D-Day – the day of alien landing in your office. I am not going to speculate if the aliens are actually extraterrestrials, terrorists, mobsters, competitors, business partners, lovers, children, or law enforcement officers. What matters is that there’s a rogue penetration on your territory.

23 KB
18 sty 24 12:54

13. Dispose of the body.pdf

Don’t get scared. I won’t teach you anything criminal. I’ll only discuss the necessity of disposing electronic documents. Not everybody knows that if they delete a document from the disk, by highlighting and pressing Delete key, this document isn’t physically erased yet. The file with the document is moved to the Trash , where it can be restored at any time. This is not a disposal! This is just the process of careful moving of the document from the desktop to the waste basket under the desk, where they’ll be accessible to everyone.

44 KB
18 sty 24 12:52

12. Corporate electronic mail.pdf

Most of the managers, or to be perfectly correct – their system administrators, prefer not to bother with building and maintenance of a mail server, so the staff receives mailboxes at best from some commercial services, and at worst – that is usually – from some free services like Gmail, Yahoo, or Hotmail.

26 KB
18 sty 24 12:49

11. Encryption.pdf

If some information is somewhere passing through something, that means it can be copied, stored, and examined for further use. This way your secrets can be revealed to who knows whom. Or rather, we all know to whom. Every Internet Service Provider (ISP) obtains the licence to operate under the condition of conformity with the telecommunication laws of the country of operation. In the United States, for example, they are legally required to allow law enforcement agencies to monitor some or all of the information transmitted, and even store the browsing history of users to allow government access if needed, under the Communications Assistance for Law Enforcement Act (CALEA). Furthermore, in some countries, ISP’s are subject to monitoring by intelligence agencies, like, for example, the National Security Agency program known as PRISM, which provides for broad monitoring of Internet users traffic. Modern ISP’s integrate a wide array of surveillance and packet-sniffing equipment into their networks, which then feed the data to law-enforcement or intelligence networks, such as DCSNet in the United States, allowing monitoring of Internet traffic in real time.

37 KB
18 sty 24 12:46

10. Guarding the mail.pdf

Let us now discuss what’s a really protected mailbox, and what’s a letter from Romeo to Juliet, accessible to the Capulets with the Montagues. You can use the electronic mail in two ways: through the Web interface, and through the mail client. You use Web interface when for working with the e-mail you open the site of the mail service, enter login and password, and after successful authorization you work with your e-mail on the provider’s server. The mail itself remains on the server as well.

25 KB
18 sty 24 12:41

09. Spam, spam, spam, spam.pdf

I am sure you are familiar with the following situation: You open your mailbox, and pull out, while swearing and cursing, various speckled leaflets with eye-hurting headlines, which advertise all kinds of fantastic offers you need so badly. To have an all-inclusive trip to Kandahar, to make money fast if you enlarge your penis, to buy a second-hand pink crocodile, perfectly matching your swimming pool, to send an evil eye to your neighbour drilling walls on Saturday mornings, to get rid of the evil eye you received from your wall-drilling neighbour, to bewitch your French teacher, to learn Klingonian in three weeks, to buy a trainload of two-by-fours at a bargain price, and so on, and so on, and so on...

22 KB
18 sty 24 12:38

08. Epidemiology.pdf

Many years ago, when the grass was greener, water was wetter, and the Internet was younger, I used to ask people what seemed a rhetoric question to me: “If someone you don’t know brought you a parcel from unknown person and address, and you found inside a grenade, would you pull the safety pin out to see if it explodes?”

21 KB
18 sty 24 12:35

07. Intrusion prevention.pdf

The point is that a serious business can’t fully isolate itself from the surrounding world, which in the modern world means the Internet as well. I will say more – without the proactive use of the Internet there’s no business nowadays, which means that you are immersed in the Internet by default. Therefore, the first and foremost task in defending your information is acquiring skills of surfing the Web without much risk for the health of your data (and you personally too). It means that you must know everything about the dangers, waylay you in the streets of the World-Wide Metropolis. Also, you must have handy all the means of individual protection – from condoms to guns.

24 KB
18 sty 24 12:30

06. Save 'em all!.pdf

Being the products of the high technologies, computers don’t like such stunts. I mean it. They react in the ways that not always are pleasant: They may turn off, reboot, or break down. Different cases, but the effect is the same – data loss. Sometimes those data can be restored. Alas, not always. In the most unfortunate circumstances voltage spikes may damage hard disks, and that means the four-letters collapse of all the hopes for successful recovery. In such cases the information on the broken disks is lost forever, and you consider yourself lucky if you have recently archived it somewhere.

23 KB
18 sty 24 12:27

05. Your very own office octopus.pdf

Proper organization of the local network in your office is the guarantee of the proper level of security. All Big Bosses must memorize this simple rule. Big Bosses also need to know, more or less, what is a local network. It is when computers are connected one with another with cables, and from the computer placed in the Marketing Department one can print documents on the printer placed in the Human Resources. Yet, what Big Bosses really need to know is what the proper organization of the office local network means.

22 KB
18 sty 24 12:23

04. Access rights.pdf

Access rights and access control are the basic means of the information security. They seem similar to you, and you probably wonder, what the heck is the difference. Let us say this way: Fully closed access is a special (extreme) case of the access control, while the fully open access is another special (and extreme, as well) case. Between them, that is between the full access ad no access, stretches the domain of the access control. While access rights is the way to let the system know, who is seeking access, and where he should be let, and where he should not be let.

23 KB
18 sty 24 12:17

03. Information security & its classification.pdf

Someone to whom this information isn’t intended will get access to the data. That someone may happen a casual friend, a casual foe, or non-casual foe. All three cases are different, but the result is the same, because a casual friend may disseminate the information, which can fall in the hands of non-casual foes. Nope, I’m sober. I am just trying to systematize my experience on the level available to your perception. Do not worry, I will explain it with picturesque real-life examples at hand, and everything will become clearer.

28 KB
18 sty 24 10:51

02. On IT specialists.pdf

This book will deal with many quite specific technical things – simply because information security is chiefly and directly related to the computers. And there is no way around this. So, as long as the questions of the information security in your company are left in the hands of that guy in torn jeans, who did not even turn his head when I entered his room, because he was so absorbed with contemplating his Instagram account, you should at least in general understand some technical basics, because only this way you can demand something from such, pardon mon Canadien, “specialists”.

60 KB
18 sty 24 10:42

01. Those Magnificent Men in their Magnificent Off ices.pdf

Before I will start the difficult process of making the revolution in your mind, let us talk a little bit about all those magnificent, and simultaneously horror-striking scenes that open before me, each time I show up in an office, whose security I’m supposed to audit as an IT expert. Or the sleuth, if you wish.