T.Byrd Computer Forum "LIVE" Talk Show

Trina's Column     Rick's Column    TechPicks      Show TOPICS     Hardware Review    Software Review   Internet Review   TechTips      Q and A   Term of the Week

Rick's Column -   March 2006

What is a Stratelite

COMMON  VULNERABLE PORTS

• If offered by the vendor, register for security update emails when registering software.
• Most of the security mailing lists announce kernel vulnerabilities as they are announced.
• Trackinging the version of the kernel running on systems should be part of standard procedure.
• Security assessment software can be used to determine the version of kernel running onsystems. Nessus has a number of plug-ins for testing systems for kernel vulnerabilities. Caution: many of these plug-ins are capable of causing denial of service conditions, and care should be taken when scanning your systems to prevent unanticipated down-time.

 How to Protect Against It
There are two classes of parameters that can be configured on the kernel to thwart attacks. One is to tune the system resources to restrict denial of service attacks and buffer overflows. The second class is to harden the network configuration settings against network attacks. The commands and parameters to configure are platform specific. Platform specific documentation should be consulted to understand how to tune the kernel appropriately.

It is recommended that all modifications be tested thoroughly before implementation in a production environment and that backups be taken and made readily available in case a problem were to occur.

There are several useful resources to help you to tighten systems by tuning the system kernel appropriately.

Big Spam Bust, Texas Style
State Files Lawsuit Against Two of Nation's Largest Spammers

Texas became the latest state or federal entity to take a swipe at spammers Thursday when it sued a University of Texas student and a California resident over what spam watchdog calls the world's fourth largest illegal e-mail operation.

The lawsuit contends the two were pitching mortgage refinancing services, although neither Pitylak nor Trotter are licensed in Texas to provide such services. According to Abbott, consumers, after being assured in the e-mail their privacy would be protected, provided personal information which Pitylak and Trotter then sold to other companies for as much as $28 per lead.

"We want to make clear that these defendants we are suing today and any other spammers in the State of Texas can't hide behind a computer screen any longer," Abbott said at the press conference. "Sending spam with misleading subject lines violate both federal and state law, and there is a very heavy price to pay for that illegal spamming."

Abbott said he was suing Pitylak and Trotter under the federal Can Spam Act, the Texas Electronic Mail and Solicitation Act, and the Texas Deceptive Trade Practices Act. Violations of the Can Spam Act carry penalties of $250 per violation, up to $2 million. The Texas spam violations allow for fines of up to $10 per unlawful e-mail or $25,000 per day.

Under the Texas Deceptive Trade Practices Act, penalties are authorized for up to $20,000 per violation.

Although Abbott did not disclose the specific amount of spam involved in the scheme, he noted that "spam traps" set up by Microsoft in cooperation with the Texas attorney general identified 24,000 illegal e-mails sent by Pitylak and Trotter over a six-month period. The Federal Trade Commission (FTC) also cooperated in the investigation.

Pitylak and Trotter ran their spam operation through a complex set of corporations and assumed business names. The lawsuit identifies corporations set up in both Texas and Nevada and more than 250 different business names.

Last summer, U.S. Attorney General John Ashcroft announced more than a hundred individuals were arrested and charged in a federal computer and Internet-related crime sweep known as Operation Web Snare. In all, Ashcroft said, approximately 350 individuals were targeted for major forms of online economic crime and other cybercrimes, resulting in 103 arrests and 53 convictions.

1.1              Purpose of Risk Management Plan

This plan describes the standardized, structured process the project/plateau/evolution cause to identify, categorize, analyze, and mitigate risks.  This plan also describes the method used to determine risk status and measure the progress of risk mitigation efforts. In addition, this plan contains the results of the risk identification , categorization , analysis , and mitigation planning (i.e., mitigation strategies, analysis of the strategies, planned implementation, and results of implementing the planned mitigations).

The risk management approach documented in this plan is based on proven risk management techniques developed by the Software Productivity Consortium. The Consortium and its members have successfully applied this methodology on numerous projects/projects, and the methodology is reliable, adaptable, and well suited to the current project/plateau/evolution.

The key ingredients of this methodology are:

·         A dedicated Risk Analyst is responsible for the risk analysis and management with a reporting line directly to Product Assurance (or management, as appropriate). The Risk Analyst has been trained in the methodology (or is experienced with the methodology) and has been dedicated to the project. The Risk Analyst is also an integral part of the project/plateau/evolution team, thus ensuring a comprehensive appraisal is conducted.

·         The risk management method is consistent and comprehensive. This method identifies, analyzes, and evaluates technical and non technical risks. Risks are categorized to aid in analysis, selection of mitigation strategies, and tracking related risks; that is, risks that are tightly coupled or linked in some way are assigned to the same category because they are best tracked and evaluated together. Examination of the risk relationships provides insight into how the risks interact and their potential project/plateau/evolution impact. The risk analysis provides criteria for determining which risks are sufficiently significant and must be mitigated and continuously monitored.

·         Periodic risk reviews are conducted. During the reviews, significant risks are reanalyzed, and the progress of their mitigation efforts is determined. Also, during the reviews, newly identified risks, or risks that were not considered significant, are reexamined. The methodology is then reapplied.

Section 2 describes in more detail the risk management methodology that is used on the project/plateau/evolution and includes techniques that ensure that risks, once identified, are properly tracked and mitigation strategies implemented at the appropriate time.

          The Risk Management Method

The 7 steps in risk management are:

1.       Determine Objectives and Stakeholders

2.       Identify Risks

3.       Analyze Risks

4.       Review Risk Analysis

5.       Evaluate Mitigation Strategies

6.       Plan Risk Mitigation

7.       Mitigate Risks

1.2              T. Byrd Computer Summary

This is a proactive risk management approach. Performing a risk analysis prior to estimating the project parameters enables the team to maintain project/evolution control and provide quality products within the proposed cost and schedule. We have successfully applied this method in the past on tightly constrained projects/projects and feel comfortable and confident with the approach.

Rick's Tech TV Live - click here for the latest 

You’ve always paid your bills on time and closed inactive accounts. You have spent years meticulously grooming a spotless credit record. Yet when you apply for a home loan, you are rejected because your credit report says you’ve racked up unpaid balances on several credit cards and written tons of bad checks on multiple bank accounts that you didn’t even know existed. Someone stole your identity, and there’s an increasing chance he did so with the help of the Internet. All a person needs is your name, address, SSN (Social Security number), and sometimes your date of birth and mother’s maiden name, and he can open an account in your name or even access existing accounts. In some cases, when a thief opens accounts using bogus addresses, the major credit reporting bureaus switch your contact information over to the new address, so you may not even know what’s happening until it is too late. According to the Consumer Sentinel (http://www.consumer.gov/sentinel), an online fraud database the FTC (Federal Trade Commission) maintains, of the 380,103 fraud complaints made to the FTC in 2002, 161,819 were identity theft complaints. When the complaints are broken down by category, identity theft accounted for 43% of all complaints; Internet auction fraud complaints came in second with 13% of total complaints. It’s clear that identity theft is a growing crime, with the total number of victims varying depending on whom you ask. “If you talk to the credit reporting agencies, they’re going to tell you it’s a minor problem,” says Jay Foley, director of Consumer and Victim Services at the Identity Theft Resource Center (http://www.idtheftcenter.org). “If you talk to law enforcement, they’re going to tell you it’s a growing problem. If you talk to us, it’s obscene. We’re looking at 700,000 to a million victims last year, and we’re anticipating a 25% to 35% growth rate this year.”  Spiders Of The Web There are a slew of ways thieves use the Internet to gather personal information about their victims, and most are variations on real-world stunts. Many rely on social engineering to get victims to voluntarily cough up information. Some thieves create bogus Web sites that look like a business, government, or other legitimate Web site and use forms to collect information on misled visitors. They also send email messages that appear to come from a bank, a gift award center, the government, or another official-sounding source, requesting a person’s Social Security number for “verification” or other imaginary purposes. Some fabricated email messages even threaten the recipient with an electronic IRS audit. “I have it on personal authority from half a dozen auditors from the Internal Revenue Service that they will not electronically audit anybody,” says Foley, adding, “the auditors say that they’d all quit en masse because their only joy in life is being able to sit across from you and watch you sweat while they go through your paperwork.” Aside from giving identity thieves wider access to potential victims, the Internet helps criminals in ways you wouldn’t expect. Online shopping is one of them. “They’ll shop on the Internet because they don’t have to show plastic,” says Beth Givens, founder and director of the Privacy Rights Clearing House (http://www.privacyrights.org), and the Internet also makes it much easier for them to apply for credit cards and other accounts in their victims’ names. “I can order the credit cards over the Internet, and no one ever has to see me,” says Foley. “No one even gets a piece of paper with my signature on it. I don’t have to go to all the trouble of getting preapproved credit card applications in the mail.” The volume of information you can collect about people by doing simple Internet searches is frightening. Type a name and ZIP code into any of the online white pages and you can get addresses and phone numbers for millions of people. If you have only a phone number, you can do a reverse number lookup to get a person’s basic information. A quick trip to a few genealogy sites can unearth a mountain of additional information, including a mother’s maiden name and previous residences. Then there are the online news archives, which may contain wedding announcements that yield parents’ names, the places people work, the schools they attended, and other juicy tidbits. If any of the groups you belong to have a Web site, your company has a Web site, or you maintain a personal Web site, all could provide a treasure trove of information to people who want your identity. Take measures to protect personal information if you use a computer and the Internet. Use a strong antivirus product, such as Symantec’s Norton AntiVirus 2003 ($49.95; http://www.symantec.com) and keep it updated. Also use a hardware or software firewall, which prevents outsiders from accessing your computer. Two good free software firewalls are Zone Labs’ ZoneAlarm (http://www.zonelabs.com) and Sygate’s Sygate Personal Firewall (http://soho.sygate.com). Encrypt personal files on your PC, so even if a thief steals the files, he won’t be able to read the contents. Good freeware programs include OVSoft’s PowerCrypt (http://www.ovsoft.com) and HandyBits’ Easy Crypto-Deluxe (http://www.handybits.com). If you get rid of a computer, deleting files or reformatting the hard drive won’t protect your data from determined eyes, either. With the right data recovery tools, it’s easy to find, search, and restore “deleted” files. Use software that overwrites the files several times; try the free HandyBits File Shredder (http://www.handybits.com) or the free AnalogX SuperShredder (http://www.analogx.com). Strong degaussing magnets also are available that reorient all of the magnetic particles used to store data on a hard drive, but using special software is usually adequate.  Out Of Your Hands The real downside to identity theft is no matter how many tips you follow or steps you take to protect your identity, ultimately there’s little you can do to prevent the crime. “Identity theft doesn’t start with the consumer, it starts with the businesses,” says Foley. Every employee at every company you’ve provided with personal information is a potential identity thief. The same goes for every school you’ve attended and every organization you’ve joined that requested your Social Security number or other sensitive personal information. Even if all of those people are honest, you have to worry about an identity thief breaking into a computer and stealing all of that information from a central database. Thieves don’t have to hack into computers to get your information, as demonstrated in a recent study by MIT graduate students Simson Garfinkel and Abhi Shelat. The two bought more than 150 used hard drives, mainly in Internet auctions, and out of 129 working drives, they found thousands of credit card numbers and other sensitive data. Many of the drives came from old business computers and were not properly erased before becoming someone else’s property. To avoid having your personal information exposed like this, Foley says that when you are dealing with any company that wants your personal information, ask a representative from that company to answer the four Ws: Why are you collecting this info? Who’s going to have access to it? What steps are you taking to protect it? What steps will you take to dispose of it? If you can’t get satisfactory answers, take your business elsewhere.  Red Alert If you have been victimized by an identity thief or even think you are a potential target, there are many steps you must take to report the incident and begin the process of protecting or restoring your identity. First you need to file fraud alerts with all three of the major credit reporting bureaus: Equifax (800/525-6285; http://www.equifax.com), Experian (888/397-3742; http://www.experian.com), and TransUnion (800/680-7289; http://www.transunion.com). The three credit bureaus will send copies of your current credit report, which you can review and then dispute. A standard fraud alert stays on your credit record for 90 days, but you can ask each bureau in writing to extend the alert to seven years. “Send it by postal mail; don’t rely on the telephone with the bureaus,” says Givens. “They’re notorious for ignoring telephone communications.” Unfortunately, the fraud alert isn’t a cure-all. “Credit monitoring doesn’t do diddly-squat for prevention,” says Foley, “it just gets you early detection at best. At worst it gives you a false sense of security.” Creditors are not legally obligated to deny credit if there is a fraud alert on an account. Because of this, Givens recommends checking your credit quarterly if you are a victim of identity theft and then at least once a year if you’re not. The next step is to contact the banks, credit card companies, and other creditors directly to alert their security or fraud departments that fraudulent accounts were opened in your name or that your existing account was accessed without your permission. They can tell you what forms, affidavits, reports, and other information you’ll need to establish your case and get your accounts back in order. You also should contact your local police department and ask an officer to take an official statement, and you should file a report at the FTC’s Identity Theft Clearing House (http://www.consumer.gov/idtheft). This excellent Web site also contains a wealth of tips, instructions, and forms that will help you prevent and recover from identity theft, including a downloadable ID Theft Affidavit that will help you report the crime to the proper authorities and organizations. In the end, most of the cost of identity theft is absorbed by credit card companies, banks, and businesses, and you’ll eventually get your money back and clean up your credit, but the bad news is that it takes a lot of time and effort to put it completely behind you.

        Rick's Column

    Identify Theft on the Internet