Emergency vs Privacy

By cliangNo Comments
It is common to leave contact information in passport, contact card in wallet such that under emergency situation, others could notify your family member or significant half. This will be helpful if you are travelling alone, or aged. But how do we eliminate scam? Our contact information (email, phone number) is perhaps widely shared when register for web service as 2-step authentication, product registration for warranty, leave as call back for inquiry results, or our friends' devices carrying our contacts are compromised. There is a little trick to beat against scammer by establishing a one-way trust. Put a preset phase in the emergency contact card. Pre-arrange this with your contact(s) the caller must quote this preset phase to prove the contact info is obtained from this emergency contact card but not elsewhere. ...
Read More

Bag Tag

By cliangNo Comments
It is common practice to tag your checked bag or even hand carried bag with a tag. How are you going to fill the info there? In old days, mobile communication device is rare. If you cannot find the bag at baggage claim area, you rely on transportation service provider to contact you and deliver the bag per the stated address even though you report them about lost bag. Therefore, you have to provide the accurate address and contact information. Now, the scenario is reversed. If you cannot find your checked bag, you contact the transportation service provider to locate the lost bag with ticket number assigned at check in and tell them where to send to and how to reach you. Therefore, the bag tag shall only serve an identification means and avoid putting too much privacy information (address, contact number, email) there. In addition, the tag attached to the checked bag has RFiD to track its routing through out the entire...
Read More

Renewable Energy

By cliangNo Comments
It is one of the decarbonization means. Investment involves initial plant setup and then recurring operating cost. There is no need for fuel except resources to manage the plant properly. The entire ecosystem will need site survey, i.e. how many days with sufficient wind are there in a year and the strength, physical security from sabotage of the plant and then digital security against cyber attack - bring down the grid, damage the equipment, scheduled plant maintenance. This shall best have a Hazard and Operability (HAZOP) exercise that include everything that most cybersecurity practitioners are only focusing on cybersecurity, or technical controls. If they do, they are incompetent for the job. ...
Read More

Administrative Control #2

By cliangNo Comments
SSSS (or 4S) is Smart Site Safety System. It consists of server, workstation, mobile network, end point devices (CCTV, smart watch, RFiD helmet, other sensors) to monitor construction site and workforce situation for safety hazards alert. For client project involving civil works, equipment installation etc, contractor will bring their own 4S to ensure and compliance with safety rules and regulations. 4S is not a project deliverable but a tool during construction. I see some cybersecurity practitioners have incorrect understanding. They demand contractor 4S compliance with own organization cybersecurity policies. No doubt 4S might capture client site specific condition, coincidental inclusion of personnel other than contractor workforce causing privacy concerns. We must not forget there are administrative controls in the contractual obligation to comply with laws & regulation plus non-disclosure agreement. We shall not bother the how's in technical aspects. Otherwise, this is overkilled. This something like you walk into a mall, using the ATM - there are CCTV everywhere but you won't question...
Read More

Bunkers

By cliangNo Comments
Bunker at Diamond Head State Monument Bunkers are fortified physical infrastructure to withstand attack. However, there are side channels required for supplies, reconnaissance, defense or attack the attackers. Similarly the firewall in cyber world takes the same analogy. It is a network perimeter device to control network traffic but it requires ruleset management, health check thru the network rather than doing this locally. This will open up side channels that could be vulnerable to cyber attack if configured improperly. Best practices are to review firewall configuration (rulesets), event logs (permitted or dropped traffic) regularly. Automated tool is required as human check is nearly impossible. Log parser via SOC (Security Operation Centre) will associate network traffic from different zones providing a holistic view for better visibility, identify early sign of compromise as threat vectors are conducting reconnaissance to understand the system landscape, vulnerable component before choosing the appropriate attack kit. ...
Read More

Risk Taking #2

By cliangNo Comments
Each one is fully responsible for the consequence by own act no matter in physical or cyber worlds. In physical world, the worst consequence is fatality if waring sign is ignored. In cyber world, it could be files are locked by ransomware, identity theft leading to financial loss or criminal offence if abused by threat actor. The hard part is there won't be obvious warning sign because attacks are stealthy or via deepfake. Education, situation awareness are the essential elements to secure the human aspect. ...
Read More

Tora! Tora! Tora!

By cliangNo Comments
Lightning Attack This historical event is unexpected attack. But in cyber world, unexpected attack is always expected. It ranges from threat actors trying to penetrating into the organization network thru various means like BEC (Business Email Compromise phishing), insecure Internet-facing resources, zero-day exploits to deepfake. We can only protect threats that we know. So, we can't secure every cyber resources? That said, cyber resilience and prompt incident respond are vital to sustain business operations. All these should be the joint development among business and cybersecurity units within the organization in periodic review and drills for improvement. ...
Read More

The Forgotten Place #5

By cliangNo Comments
It is self-explanatory. There are similar faults posted previously. Risk of consequence must be understood before deploying information automation tool. If the display is for information of the mall, failure does not matter much and at most the reputation of the management office. But if the display shows real time high value trading, failure will cause substantial direct and indirect financial impacts. Direct is the loss of opportunity to conduct transaction by the users of the display. Indirect could be claims thru litigation by users of the display causing their direct loss due to this failure. Technically, multi-displays are deployed for resilience. From policy perspective, users must sign usage agreement to undertake consequence due to machine failure and disclaim the service provide for any direct or indirect losses. ...
Read More

Address

By cliangNo Comments
There is a key difference between physical and cyber worlds. In physical world, addresses for non-military areas are public. You have to label your apartment properly so that mail from postage service or goods from courier will not miss the destination. Major map service providers have the information online for public accessibility. In cyber world, IP address is sensitive information and securely protected in document, electronic information transfer. This is because if threat actor has landed in the internal network, the first thing is to conduct reconnaissance in understanding what are network nodes present, then trying to reveal its OS footprint in deciding what could be exploited. If IP address (and even worst with the host information, like in network diagram) are disclosed, it will save threat actor substantial amount of work in the discovery phase. However, whatever protections are imposed, it is just a matter of making the penetrating more difficult. There are always new threats, vulnerable OS, vulnerable software...
Read More