We spend a lot of time and money setting up defenses to prevent cyber threats from breaching our organizational perimeters, but we hardly spend any time on the mess we have inside. Applying Privacy by Design principles to the data and systems within your organizations can make it very much harder for cyber thieves to steal your important information when they do finally breach your networks.
Click on the link below to see the presentation I gave at this year’s Cyber Threat Summit in Dublin, Ireland on October 24, 2017:
I just gave this presentation to nearly 200 attendees of the ICTTF Cyber Threat Summit 2015 in Dublin, Ireland.
For those of you that attended; thank you!
Through this presentation I hope I was able to communicate three points:
How company/agency executives put their agencies at risk by blindly trusting that they are doing all that can be done to secure their networks, applications and data;
That leadership’s approach to motivating employee’s to practice better cyber hygiene needs to mimic principles of behavioral economics theory that advertisers use; and
By changing the way they ask questions to their senior staff (mainly their CIO/CISO), they can a) have better proof that necessary cyber protections are in-place, and b) they will have a better understanding of the unaddressed cyber risk their company/agency faces.
One reader commented on my post and asked if I would balance the conversation by creating a corollary list that identifies what leaders (and executives) do to create toxic working environments that contribute to the development of rogue employees.
So, I penned the following list of seven caustic categories of leaders that I feel help to create these environments:
The reluctant leader: They really didn’t want to be in-charge of people, through words or behaviors, they give you the feeling that they’d rather be back doing “real-work” than being a leader. They will care very little about training and development, innovation, or accountability, and will shun any activities that will cause them to act as a leader.
How this develops rogue behavior: Without leadership support, people will begin to act on their own, circumventing security policy and controls to get the job done. In the absence of real leadership many will take the lead, making decisions that are not necessarily in the best interests of the organization.
The self-centeredleader: They are more concerned about their own achievements, and are always worrying about how bad you will make THEM look if you don’t perform well. You’ll hear them talk about the job they want rather than working the one they have. They will have no time for staff that isn’t helping them to look good.
How this develops rogue behavior: This demoralizes staff and may lead them to sabotage organizational efforts, especially if senior managers don’t intervene on behalf of the staff. This can result in lost productivity, lost loyalty for the organization, and ultimately loss of good employees.
The gloom and doomleader: They are negative about everything – we don’t have enough money, our company/agency sucks, management is worthless, just be glad you get a paycheck. They are also the ones who poo-poo on any ideas their staff may offer – “don’t rock the boat, we don’t have the time, we already tried that” – rather than being supportive, they do their best maintain the status quo.
How this develops rogue behavior: This too demoralizes the staff and may lead them to hurt the organization. Disheartened staff might also seek external interactions and opportunities that could be exploited by others who want to hurt the organization.
The sociopath leader: They are quick to tell you how “lucky” you are to have a job, and how important they are to YOUR success. Rarely will they apologize for being wrong, nor will they be concerned about the consequences of their actions, and they will be also the ones to take personal credit for staff accomplishments. They will also be the ones to force polices and rules on their staff that they won’t apply to themselves.
How this develops rogue behavior: People working for this type of leader may take on characteristics of the sociopath. In an effort to “win over” the boss, they will take shortcuts, bend the rules, and abuse or hurt other people in the organization. They too will have little regard for security policies, especially ones that they perceive will prevent them from making the boss happy.
The absent leader: They seem to be busy all the time; with what, no one knows. They are never in their office and never seem to have time for their staff. When they are cornered, they defer you to someone else: “Got a pay problem? Go see HR” or “Looking for advice? Talk to (fill in the blank); just don’t bother me” – no one can nail them down for anything.
How this develops rogue behavior: Working under the absent leader is very frustrating, and over time, can lead to people in the organization to simply no longer care. People may try to do their best, but even with best effort, mistakes will be made, and eventually people will get fed up and either leave or take revenge against the leader. Either way, the organization will suffer.
The interferingleader: They are the micromanagers, distrusting of the abilities of their staff. They love to control every aspect of their organization, believing that they their staff cannot perform as well as they do. If they do delegate work, they will in your knickers every day, questioning staff actions and decisions. Rather than developing their staff, they are more likely to move or remove staff that don’t perform up to their standards.
How this develops rogue behavior: Opposite of the absent leader, this one just loves being in control. However, the results will be the same. After a while, people will just give-in to the leader, try to effect revenge on his/her actions, or will pack up and leave, possibly taking organizational information with them.
The minimalistleader: They just want to do the “absolute minimum” that needs to be done to “check the boxes.” Most likely they have been there for a long time and are quick to warn you not to stick your neck out as it will get cut-off. They will be the ones to tell you “we’re not responsible for that” or “just go back to your cubicle and do your job.” They stomp on any creative or innovative ideas, and suck the life out of their staff.
How this develops rogue behavior: Similar to the absent leader, this one actually prevents people from doing the right thing. Over time, this can lead to the same results as many of the other types of leaders described above.
I honestly don’t think that preventing ‘rogue” employees is rocket-science. If you take the time to be genuinely interested in your people’s lives, give them opportunities to grow and be creative, along with the opportunity to contribute to higher organizational goals, and thank them once in a while, they will be much less likely to want to go “rogue” and hurt you or your organization.
But, do the opposite – treat them like furniture, ignore their needs, stomp on their personal goals for growth and development, and yes, they will be pissed off. And, if you piss them off long enough they will:
Leave your organization (with your proprietary/sensitive information); or
Do something to sabotage your organization’s success; or even worse
They may just stay-on, get promoted, and be there to piss off everyone else you place beneath them.
Day Two at IACP and straight in early on Sunday morning to attend the Cyber Threats and Attacks Facing Law Enforcement Agencies session. Having attended the last two Cyber Threat Summits in Dublin, Ireland, I am well aware of the challenges we are all facing everyday in trying to protect our technology.
Mark Gage opened with a very worrisome statement, saying that we spend so much money trying to protect everything else in our lives, but not enough care is given to protecting our information and identity networks. We are at risk every single day, just by viewing Facebook or opening up an untrusted email attachment our phones/laptops can become infected, and spread malware.
We should all know better, in-fact we do know better, we know the risks associated with all these things, but yet we are all capable of making silly mistakes and suffering the consequences.
Mark says the most important thing is to educate your staff, consult with those you share systems with, do not use the same password for everything, and make your password changes a minimum of 90 days. It’s also critical that we keep all software up to date, particularly anti-virus software, and implement back up procedures. For companies, he suggests paying money to employ IT staff or contractors.
George Arruda spoke next of the worst day for him in Sept 2013, whilst driving on holiday in Florida, he received a phone call, which gave him the news he dreaded – a virus had locked down ALL of Swansea Police Department’s files thanks to a vicious virus called Cryptolocker!
The only way to get the files back was to pay a ransom of bitcoins, to some criminals out there in cyberspace. He didn’t know who there were, or where they originated from, but he gave the order to pay and get the files back.
A cyber security expert was called in and he advised against this, but they eventually began the transactions of transferring bitcoins and they started to get data back. The main problem here was that they did not have back up, so they were indeed in a vulnerable position.
Having amassed a very large amount of data, this incident shook the Swansea PD. On the back of this, George gave advice to everyone – Back Up Everything and teach your staff NOT to open anything suspicious, and only have ONE administrator access with a password.
Steve Sambar warned of the dangers of terrorist cyber attacks, and the worry of, if they attack, what do we do? Who will be responsible for handling it? How long will it take to cover? We face so many threats every day, human error, insider threats, external threats. Many big corporations have suffered already. For example, Target had 40 million accounts hacked in Dec. 2013, and Ebay’s database with 233m users was hacked in Feb. 2014.
Jim Emerson had the last word, delivering a fast paced description of the emerging threats and challenges. Everything is happening faster, he said, and we have to understand the reality of what cyber security is.
He showed two short videos from IACP about cyber security, these are available on the IACP website. Jim wants us to:
Check carefully where is the suspicious email coming from.
Be aware of who you connected to.
Jim also stressed the importance of this being a day to day footrace, and it never ends. He is right, and we do not want to be sorry when it is too late.
Everyone is missing the boat on the insider threat issue – INSA too…to paraphrase James Carville, “It’s leadership stupid.”
Government and private sector organizations are the primary reason for insider threats – senior leaders and the boardroom grow them internally.
With very minor exception, NO ONE COMES TO WORK FOR YOU ON DAY ONE WITH THE INTENT TO HURT YOU, steal your secrets, or sell your intellectual property.
It’s how you treat them, over time, that turns them into insider threats.
You put them in the wrong jobs;
You fail to trust them;
You make it hard for them to do their jobs;
You put asshole/untrained managers over them;
You treat them like furniture;
You , threaten their existence in your companies and agencies;
You kill their spirit; and
Then, you wonder why they decide to hurt you.
Want to reduce/eliminate the insider threat? Treat you staff the way you did on day one:
Welcome them as a human being;
Be aware of how they are cared for in your organization;
Show them you care about them and their families;
Give them a future;
Put r-e-a-l leaders over them;
Give them a voice; and
Pay them well.
In other words, treat them as you would want to be treated.
Now, why is that so hard?
And, why do NONE of the plans I have seen for combatting the insider threat even mention poor leadership as a factor?
INSAonline.org | 9.12.13 Assessing Insider Threat Programs of U.S. Private Sector http://www.insaonline.org/i/f/pr/9.12.13_InsiderThreat_WP.aspx
“When Johnny reports to work for you on Day 1, they DO NOT intend to do you or your organization’s information systems any harm; something happens to them, either in their personal or work life that changes this – the CEO’s or Agency Head must be held responsible for making sure they know what’s going on with all of the Johnnys (and Janes) in their organization to prevent the good people they hired from becoming insider threats.”
While most of the world is focusing on “technology” as a solution to preventing insider threat attacks to organization/agency information and systems, hardly anyone is focused on leadership’s responsibility to create and sustain a work environment that minimizes the chance for an employee to turn into an insider threat.
On October 21, 2012, I had the chance to speak on this issue at the 2012 International Cyber Threat Task Force(ICTTF) Cyber Threat Summit in Dublin, Ireland a few weeks ago; here is a video recording of my presentation, I hope you find it informative and useful.
Get on a plane and join me at International Cyber Threat Task Force (ICTTF) Cyber Threat Summit in Dublin, Ireland 20/21 September 2012, be my guest by using the registration code: nowheretohideguest – http://www.cyberthreatsummit.com/
This is one presentation I definitely wanted to attend at LEIM. Yes, the real Police of Baltimore were here. Not McNulty and his gang from The Wire, but Deputy Commissioner John Skinner and members of the Baltimore Police Force came to discuss how they are combating violence in Baltimore using video technology.
Deputy Skinner opened up the presentation to tell us that quite a few years ago, Baltimore was America’s Murder capital. In 1995, there was an estimated 1 homicide per day in Baltimore. By 2011 this was down to 197 in a year. Since 2007 they have achieved a 35% reduction in non-fatal shootings and juvenile homicides have decreased since 2008. By using technology, Baltimore Police have achieved historical lows in violent crime, whilst reducing budgets they have redirected the resources they have at the Police Department.
Gayle Guilford, Systems Director for Baltimore PD explained the Side Partner Project. This initiative came out in 2009. The aim was to ‘get Police out of their cars and back into the community’. Gayle spoke about years ago, when Officers would ‘walk the beat’, and be an integral part of the community. They knew people by name, and would walk around the neighborhoods, speaking to people and generally being involved in the daily life around them. This was comforting for people, and they trusted their Police.
Since taking police of the streets and into patrol cars, citizens have become distanced from the police and possibly lost the trust that was once had. To combat this and to get the Police back onto the streets, Blackberry phones with a “Pocket Cop” application were handed out to the Officers. With the phone in their hand, they can carry out checks on warrants, driving records and photographs. It also tells them who they should be looking out for, and what their daily priorities are.
The system also allows Officers to start taking evidence such as photos and streaming video before the forensic teams arrive. This is very useful in domestic violence situations. They can immediately upload evidence and get information out to other officers who can assist if they are nearby, if they have to look for a suspect, they will have a photograph to help them.
The application is also wired up to GPS and Google maps. This can tell Police dispatchers where officers are located and their availability to respond to a situation. Gayle hopes that future budgets will allow that every Police Officer will have a blackberry in the next few years.
Next to speak was Lt. Hood, Director of Law Enforcement Operation for CitiWatch in Baltimore PD. Lt. Hood is one of those types of people that are immediately likeable, and when he began his presentation on CCTV, I was enthralled.
The CitiWatch program is one of America’s most sophisticated surveillance networks in operation. It started off with 50 cameras and now has over 500 across Baltimore City. The cameras are monitored by the Criminal Intelligence Watch Center inside the Baltimore PD, 24 hours a day, 7 days a week by specially trained CCTV operators, mainly retired Police Officers.
Extra staff are used at weekends to monitor the busiest times, especially at night. Lt Hood likes using retired Police as they have the knowledge and are also trained on a variety of subjects including radio communications and uniform crime reporting.
CitiWatch cameras records footage, which is stored for 28 days and then archived off site. Video footage is crucial in identifying suspects and capturing evidence in many crimes. Lt Hood then proceeded to show us some footage, in which the Police were able to make subsequent arrests and help also to prevent certain criminal acts.
In many instances where a crime was being committed, it was monitored by staff, and Police were alerted to see who was the nearest to where the crime was taking place. They could then go to the scene and take control of the situation.
Many would feel that we have reached the ‘Big Brother is watching you’ stage considering how many cities around the world are using camera technology, but in reality those cameras are not there to spy on the public, but instead are there to help us and keep us safe by watching out for the bad guys.
Lt. Hood and his team proved this. I spend a lot of time in Baltimore, and I am happy that Lt. Hood is watching out for us, and I for one walked away from that presentation feeling a little bit safer.
For more information and to find out more about Baltimore Police check out:
So it’s no great revelation that public safety has benefited greatly from public private partnerships, and I’m cool with that, especially when we are dealing with technology that saves lives. However, a press release hit my email inbox today that made me think of the risks to security and privacy when we implement innovative technologies.
Before I get into the story it, let me be v-e-r-y clear…I am NOT here to debate the effectiveness or morality of red-light/speed enforcement systems, nor am I here to cast dispersions on any of the organizations involved in the press release…this blog posting is strictly about using the Gatso press release to emphasize a point about security and privacy – when we engage in innovative law enforcement technology solutions, we need to take extra care to adequately address the security and privacy of personally identifiable information.
Here’s the press release from Gatso-USA:
GATSO USA Forms Unique, Strategic Partnership with Nlets
Earlier this month, GATSO USA was approved as a strategic partner by the Board of Directors of the National Law Enforcement Telecommunications System (Nlets). Nlets is….general narrative about NLETS was deleted. The approval of GATSO is an exciting first for the photo-enforcement industry.
Nlets will be hosting GATSO’s back office and server operations within the Nlets infrastructure. GATSO will have access to registered owner information for all 50 states plus additional provinces in Canada. The strategic relationship has been described as a “win-win” for both organizations.
From Nlets’ perspective, there are key benefits to providing GATSO with hosted service. Most importantly, it virtually guarantees personal data security. Due to this extra step of storing personal data behind the DMV walls of Nlets, the public can be assured that security breaches — such as the recent incident with PlayStation users — are avoided.
From GATSO’s perspective, hosting the system with Nlets will provide a ruggedized, robust connection to comprehensive registered owner information — without the security issues faced by other vendors in this industry. Nlets was created over 40 years ago…more stuff about NLETS was deleted).
The main points I took away from this press release were:
Nlets is going to host the back-end server technology that GATSO needs to look up vehicle registration information of red-light runners;
Gatso is going to have access to vehicle registration information for all vehicles/owners in ALL 50 states in the U.S. and (some) provinces in Canada; and
And, because it’s behind Nlets firewalls, security is not an issue.
Again, please don’t call me a party-pooper as I am a huge advocate for finding innovative ways to use technology to make law enforcement’s job easier. However, I am also painfully aware (as many of you are) of the many security and privacy related missteps that have happened over the last few years with technology efforts that meant well, but didn’t do enough to make sure that they covered the bases for security and privacy matters. These efforts either had accidental leakage of personal information, left holes in their security posture that enables direct attacks, or created opportunities for nefarious evil-doers with legitimate access to use that access to sensitive information for other than honorable purposes.
After I read the press release, I thought that it would be a good case-study for the topic of this blog – it involved innovative use of technolgy for law enforcement, a psuedo-government agency (Nlets), two foreign-owned private companies, and LOTS of PII sharing – some might even say it had all the makings of a Will Smith movie. 🙂
To help set the stage, here are a few facts I found online:
Gatso-USA is a foreign company, registered in New York State, operating out of Delaware; its parent company is a Dutch company, GATSOmeter BVGatso.
Gatso does not appear to vet all of the red-light/speed violations itself; it uses another company – Redflex Traffic Systems to help with that (Redflex is not mentioned in the press release).
Redflex seems to be a U.S. company, but it has a (foreign) parent company based in South Melbourne, Australia.
Finally, there are no-sworn officers involved in violation processing. Red-light/speed enforcement cameras are not operated by law enforcement agencies; they outsource that to Gatso, who installs and operates the systems for local jurisdictions (with Redflex) for free, (Gatso/Redflex is given a piece of the fine for each violation).
There are no real surprises here either; there are many foreign companies that provide good law enforcement technologies to jurisdications across the U.S., and outsourcing traffic violations is not new…BUT what is new here is that a sort-of-government agency (Nlets), has now provided two civilian companies (with foreign connections) access to Personally Identifiable Information (PII) (vehicle registrations) for the entire U.S. and parts of Canada…should we be worried?
Maybe; maybe not. Here are nine questions I would ask:
Personnel Security: Will Nlets have a documented process to vet the U.S. and overseas Gatso and Redflex staff who will have access to this information through direct or VPN access to Nlets systems?
Data Security: Will Gatso or Redflex maintain working/test copies of any of the registration information outside of the Nlets firewall? If so, are there documented ways to make sure this information is protected outside the firewall?
Data Access: Will Gatso/Redflex have access to the entire registration record? or, will access be limited to certain fields?
Code Security: Will any of the code development or code maintenance be done overseas in the Netherlands or Australia? If so, will all developers be vetted?
Network Security: Will overseas developers/site suport staff have access to the data behind Nlets firewalls? What extra precautions will be taken to protect Nltes systems/networks from abuse/attack?
Code Security: Will Nlets conduct any security testing on code loaded on the servers behind their firewalls?
Stakeholder Support: Have all 50 U.S. states, and provinces in Canada, been made aware of this new information sharing relationship? Do they understand all of the nuances of the relationship? And, are they satisfied that their constituents personal information will be protected?
Audit/Logging: Will all queries to vehicle registration information logged? Is someone checking the logs? How will Nlets know if abuses of authorized access are taking place?
Public Acceptance: How do states inform their constituents that their personal vehicle registration information is being made available to foreign owned company? Will they care?
How these questions are answered will determine whether or not we should worry…
Did I miss any other important questions?
Beyond this particular press release and blog posting, I suggest that you consider asking these kinds of questions whenever your agency is considering opening/connecting its data systems to outside organizations or private companies—it may just prevent your agency from becoming a headline on tonights news, like St. Louis –> St. Louis Police Department computer hacked in cyber-attack .
The bottom-line is that whenever you take advantage of opportunities to apply innovative technologies to public safety, make sure that you cover ALL the bases to protect your sensitve data and PII from leakage, direct attacks, or misuse and abuse.
As always, your thoughts and comments are welcome.
Day Two at IACP and straight in early on Sunday morning to attend the Cyber Threats and Attacks Facing Law Enforcement Agencies session. Having attended the last two Cyber Threat Summits in Dublin, Ireland, I am well aware of the challenges we are all facing everyday in trying to protect our technology.
This is one presentation I definitely wanted to attend at LEIM. Yes, the real Police of Baltimore were here. Not McNulty and his gang from The Wire, but Deputy Commissioner John Skinner and members of the Baltimore Police Force came to discuss how they are combating violence in Baltimore using video technology.
So it’s no great revelation that public safety has benefited greatly from public private partnerships, and I’m cool with that, especially when we are dealing with technology that saves lives. However, a press release hit my email inbox today that made me think of the risks to security and privacy when we implement innovative technologies.