Cyberwarfare - The Debate

Two security leaders - two quotes - two positions?
1.  “There is no cyberwar,” Quote from Howard Schmidt, White House Cybersecurity Director for President Obama.
Or, 
2.  "The United States is fighting a cyberwar today, and we are losing," Quote from  Michael McConnell, the former Director of the National Security Agency, written in a Washington Post article.




You will read a post by Fortalice intern, Steven Elliott, about Cyberwarfare shortly.

It has been an interesting debate out there about the term, "Cyberwarfare".

Ask anyone in law enforcement or even a small business who has been hacked and they may tell you that they feel they are at war with cybercriminals.

The term cyberwarfare has been used and critiqued by leaders in the security community.

Critics: "Warfare" in the traditional sense implies a level of involvement from Department of Defense.  You cannot label trojans, viruses, and other malware that steals identities or helps criminals commit fraud as "warfare".

Supporters of Warfare:  Typically use the term "Warfare" in a broader sense.  A focus on the larger picture sees fraud as a potential source to fund criminal activities that fund terrorists.  An assault on our critical infrastructure that creates a lack of confidence in the infrastructure is also seen as "warfare".

Whatever your position on the debate, I hope you will enjoy Steven's posts.

As always, we are open to ideas, suggestions, and feedback.

Guest Post - Nick Volpe - Summary of What's Hot in the Security Headlines

Guest Post from Nick Volpe.  Spring Semester Intern at Fortalice®, LLC.  Attending Immaculata University.

Facebook Expect to Launch Location-Aware Feature

It seems as if Facebook has long been put into the hot seat over its data privacy features. More specifically, what settings Facebook deem are appropriate defaults have come under scrutiny with less sophisticated users not knowing what information from their profile is available to whom and how to change that selection of information. In April 2010, Facebook will begin to allow its registered users to share their geographical location with their friends in their news feeds. The supposed location-based feature(s) are expected to be unveiled in late April at Facebook’s annual f8 developer conference in San Franscisco. According to company reports, the feature will be opt-in allowing users to choose if they wish to participate or not. Given the companies track record on security, however, users should be vigilant and check changes to privacy policies and settings. The news comes after popular micro blogging competitor, Twitter, announced a similar location-based feature for their offering. Officially, Facebook will neither confirm nor deny the anticipated announcement.

Sources:

AllFacebook.com: “Facebook Prepares To Release Location Service At f8” by Nick O’Neil http://www.allfacebook.com/2010/03/facebook-prepares-to-release-location-service-at-f8/
NYTimes.com Bits Blog: “Facebook Will Allow Users to Share Location” by Nick Bilton http://bits.blogs.nytimes.com/2010/03/09/facebook-will-allow-users-to-share-location/
PC Magazine: “Report: Facebook to Add Location Info to Updates” by Brian Heater http://www.pcmag.com/article2/0,2817,2361237,00.asp

New Statistics Show About 12% of Employees Willingly Violate Company IT Policy

One of the biggest and most difficult to address points of failure in terms of IT security problems is employee error. According to a new survey conducted by firm Harris Interactive, 12% of the United States workforce claimed to have willingly violated their companies IT policies. The employees are something that IT departments need to worry about maybe even more so, in some sense, than antivirus and malware infection in the network. IT departments and companies simply are not tough enough on enforcing their policies as they should be thus making employees the largest cause of corporate data loss.

Sources:

Ars Technica: “Bad employee! 12% knowingly violate company IT policies” by Jacqui Cheng http://arstechnica.com/business/news/2010/03/bad-employee-12-knowingly-violate-company-it-policies.ars?utm_source=rss&utm_medium=rss&utm_campaign=rss
Pivotal Payments: “12% of employees intentionally breach corporate IT policy, study shows” by Kristen Lawrence http://www.pivotalpayments.com/ca/industry-news/12-of-employees-intentionally-breach-corporate-it-policy-study-shows-19667517/                                                               

Highly Marketed Identity Protection Agency LifeLock Fined by FTC

The identity protection industry is highly lucrative and popular amongst individuals that aim to keep their confidential information private. There are firms that, for a monthly fee, claim to protect your identity by closely monitoring credit reports and other identifying accounts and information in order to protect your identity or at least attempt to do so.
LifeLock, one of these identity protection services, was fined by the US Federal Trade Commission for false advertising. The company guaranteed its clients that for as long as they paid, their identity would never be stolen and they would not be susceptible to fraud. As it turns out, you really can’t guarantee that a person’s identity can’t or won’t be stolen. There are simply too many factors in that. Ironically, the CEO of LifeLock, who freely gave out his social security number publicly as a testament to his service, fell victim of identity theft himself.

Sources:

Total Bankruptcy: “LifeLock Fined for Inappropriate Identity Theft Protection Claims” http://www.totalbankruptcy.com/blog/lifelock-fined-for-inappropriate-identity-theft-protection-claims/
Ars Technica: “LifeLock fined $12 million over lack of life-locking ability” by Jacqui Cheng http://arstechnica.com/tech-policy/news/2010/03/lifelock-cant-guarantee-id-theft-prevention-after-all-settles-with-ftc.ars?utm_source=rss&utm_medium=rss&utm_campaign=rss

Guest Post - Nick Volpe - Stealing Your Identity!

Guest Post from Nick Volpe

Nick Volpe is at student at Immaculata University.  He is also a cybersecurity research analyst intern for Fortalice®, LLC.

Research Outline  

Topic: Electronic ID Theft
Date: 3/1/10 

Electronic identity theft jumped by 12% over last year. 

SUMMARY PARAGRAPH: Identity theft online is on the rise. The crime itself is expanding as criminals and ID thieves are finding new means of stealing a consumer’s identity either through consumer mistake or a corporate lack of security. All sectors are affected by this crime including government, business, consumers, etc. Overall awareness is up yet the crime is still very serious and very lucrative for evil doers. They want everyone’s money.  

KEY FINDINGS
 Electronic ID theft is on the rise because of thieves finding new holes in the system to exploit and more consumers are being targeted by more ID thieves than ever before

• Total cost to consumers in 2007 was $1.2 billion according to FTC estimate
• About $691 loss on average
• Total cost to business in 2007 was about $6.3 million per incident
• In 2009, in increased number of people were affected by ID theft however the average dollar loss and time loss dropped

   
BACKGROUND
The rise in ID fraud is happening in many new ways electronically. Thieves are using public Wi-Fi to sniff the data from other people on the network, using sophisticated software to crack passwords to online accounts, and using skimmers at ATMs and the like to collect personal data that can be distributed or sold online. There have been increases in phishing attacks that trick consumers into giving a fraudster their personal information, malware attacks that capture the information on a workstation or personal computer, and attacks against processing systems that store critical financial or personal data.
Electronic ID theft makes up about 10 to 12 percent of all identity theft. Another interesting and less heard of form of electronic ID theft is vishing, or voice phishing, which involves the use of an electronic telephone system to trick a consumer into giving a fraudster their sensitive information for whatever purpose.  

STRATEGIC PLANNING ASSUMPTIONS:


ANALYSIS:
 Businesses, like consumers, also fall victim to electronic identity fraud schemes. Individuals tend to be easier targets for fraudsters than businesses but businesses take the bigger hit. Businesses should make a major effort to protect their employees and especially their customers so that nobody has to fall victim to this crime that can destroy reputations and financial aspects of people’s lives. There are simple cost effective steps that businesses can take to prevent this crime from happening within their brand.
Consumers, however, have the biggest burden to protect themselves from this crime as they have to use their own time and money getting out of ID theft. Consumers are also much easier for ID thieves to target online because many victims are unaware of what information is out there about them. It can even be as simple as doing a Google search to find out a victims date of birth in order to fraudulently change the victims password by answering security questions on banking websites. People simply need to take action and think outside to box rather deny that it can happen to them. Once a person agrees that it can happen to them, they are already on the way to protecting their identity.


IMPLICATIONS:

•  Steps that businesses need to take in order to effectively prevent electronic ID theft on consumer or employee/company data
• Securing the corporate network with firewalls, anti-malware protection, and intrusion protection
• Keeping all systems up to date including operating systems and web browsing software
• Insuring an employee web/technology use policy to protect both the company and employees
• Enforce strong passwords in all systems online and off as well as changing of the passwords frequently
• Complete regular maintenance and security checks on all company PCs and systems regularly

RECOMMENDATIONS:

•  Guarding against consumer electronic ID theft
• Be wary of e-mails requesting any kind of personal information
• Most companies will never ask you for personal information such as SSN, online username, and password via e-mail
• If an email looks suspicious, it is better not to open it
• Purchase an internet security suite to help aid in protecting your data and privacy which will in turn help protect your identity
• Never download unknown files from the internet especially from websites you don’t trust
• Monitor all online accounts for fraudulent activity such as banks and other financial institutions
• Do a simple Google search of your name – what information is out there about you?
• Businesses can protect themselves by educating their employees to take the same proactive measures as consumers within the workplace

   
SOURCES:

1. Hines, Matthew. "Report: ID Fraud Grows At Record Pace." eWeek Security Watch. 11 Feb 2010. Ziff Davis, Web. <http://securitywatch.eweek.com/identity_theft/report_id_fraud_grows_at_record_pace.html>.
2. "Javelin Study Finds Identity Fraud Reached New High in 2009, but Consumers are Fighting Back." PRNewswire. 10 Feb 2010. Javelin Strategy & Research, Web. <http://www.prnewswire.com/news-releases/javelin-study-finds-identity-fraud-reached-new-high-in-2009-but-consumers-are-fighting-back-83987287.html>.
3. "More Consumers Experience Fraud, but Mean Consumer Costs and Resolution Hours Drop." NewsCom. 10 Feb 2010. NewsCom, Web. <http://www.newscom.com/cgi-bin/pub/s?f=PRN/prnpub&page=1&xtag=PRN-prnphotos-89538&redir=detail&TAG_ID=prnphotos089538>.
4. Steiner, Sheyna. "The costs of ID theft." Bankrate.com. 21 Apr 2008. Bankrate, Inc., Web. <http://www.bankrate.com/brm/news/Financial_Literacy/identity_theft/costs_of_identity_theft_a1.asp?caret=92a>.
5. "New Research Shows Identity Fraud Growth Is Contained and Consumers Have More Control Than They Think." BBBOnline. 31 Jan 2006. Better Business Bureau, Web. <http://www.bbbonline.org/IDtheft/safetyQuiz.asp>.
6. "Don't Be an On-line Victim: How to Guard Against Internet Thieves and Electronic Scams ." FDIC. Web. <http://www.fdic.gov/consumers/consumer/guard/>.

Guest Post - Nick Volpe - Groups Working on our Cyber Problem

Guest post from Nick Volpe.

Nick Volpe is at student at Immaculata University.  He is also a cybersecurity research analyst intern for Fortalice®, LLC.

Research Outline  

Topic: Groups that Track Emerging and Current Security Threats
Date: 4/9/2010 

GROUP 1: CERT/CC 

• GROUP DESCRIPTION:

The CERT/CC is the Computer Emergency Response Team Coordination Center run by Carnegie Mellon University in Pittsburgh, PA. It is federally funded and serves as a major reporting center for internet security threats and problems including breaches at the software and system levels. CERT/ CC staff coordinates responses to security issues and offer technical assistance. 

• COST TO JOIN: N/A, Free resources available

• SIMILARITIES WITH OTHER GROUPS:

• Deals with cyber security response much like US-CERT and other CERT groups
• Collaborates with information between government and the private sector
• Federally funded

• UNIQUENESS FROM OTHER GROUPS:
• Run by an academic institution

GROUP 2: InfraGard 

• GROUP DESCRIPTION:
  
  InfraGard is a collaboration of the US Federal Bureau of Investigation and private sector businesses and organizations with the intention of promoting the open communication between business and law enforcement for the purpose of protecting proprietary information and assets. Local chapters are available to facilitate information sharing and various member benefits including training. 

• COST TO JOIN: Free for US citizens

• SIMILARITIES WITH OTHER GROUPS:

• Federally funded
• Facilitates information sharing between sectors

• UNIQUENESS FROM OTHER GROUPS:

• Gives access to sensitive government data
• Local chapters with access to information and training
• Close ties with the FBI for coordination

GROUP 3: US-CERT 

• GROUP DESCRIPTION:

The US-CERT or United States Computer Emergency Readiness Team of the National Cyber Security Division at the US Department of Homeland Security provides response support and defense against various cyber attacks for the Federal Civil Executive Branch and information collaboration between government agencies and industry. 

• COST TO JOIN: N/A, Free subscriptions

• SIMILARITIES WITH OTHER GROUPS:

• Deals with cyber security response much like CERT/CC and other CERT groups
• Collaborates with information between government and the private sector

• UNIQUENESS FROM OTHER GROUPS:
• Part of the Department of Homeland Security
• Defends the Federal Civil Executive Branch

   
GROUP 4: SANS 

• GROUP DESCRIPTION:

The SANS (SysAdmin, Audit, Network, Security) Institute is a cooperative research and educational organization with programs for security professionals all over the world and is one of the most trusted and largest source of information security training and certification. SANS also operates the internet early warning system called “Internet Storm Center.” 

• COST TO JOIN: Free information security research documents, training, and whitepapers

• SIMILARITIES WITH OTHER GROUPS:

• Offers training to information security professionals
• Cooperative with training and certification programs

• UNIQUENESS FROM OTHER GROUPS:
• Has its own early warning system

GROUP 5: FS-ISAC 

• GROUP DESCRIPTION:

The FS-ISAC or Financial Services Information Sharing and Analysis Center gather information about both cyber and physical risks for the financial services sector. It was established to protect critical US infrastructure and constantly gathers information that is reliable and timely for financial providers and firms. 

• COST TO JOIN: Ranges from $850/year to $49,950/year depending on organizations assets and revenue

• SIMILARITIES WITH OTHER GROUPS:

• Protects US infrastructure
• Coordinates sharing of critical data

• UNIQUENESS FROM OTHER GROUPS:

• High cost to join
• Specifically intended for the financial services sector
• Deals with both cyber and physical attacks

SOURCES:

1. CERT Coordination Center (CERT/CC) http://www.cert.org/certcc.html
2. CERT/CC Definition from PC Magazine Encyclopedia http://www.pcmag.com/encyclopedia_term/0,2542,t=CERTCC&i=39534,00.asp
3. About InfraGard http://www.infragard.net/about.php?mn=1&sm=1-0
4. US-CERT: About Us http://www.us-cert.gov/aboutus.html
5. SANS: About SANS http://www.sans.org/about/sans.php
6. About the FS-ISAC http://www.fsisac.com/about/

Guest Post - Nick Volpe - Skimming, we're not talking about milk, we're talking about ATM $$ theft

Nick Volpe is at student at Immaculata University.  He is also a cybersecurity research analyst intern for Fortalice®, LLC.

Here is his guest post regarding ATM Skimming

Research Outline  

Topic: ATM Skimming
Date: 2/23/10 

TEASER/TITLE: ATM Skimming is among the top forms of fraud 

SUMMARY PARAGRAPH: There are more than 360,000 ATMs in America. Some belong to banks and others belong to malls, stores, hotels, and airports. Despite the fact that most ATM skimming crimes happen at an ATM machine, the crime can also be committed at restaurants and retail establishments where ATM/debit or credit cards can be used. There are skimming devices that can read cards in retail points-of-sale or with a manual swipe by any person that comes in contact with your card.  

KEY FINDINGS

• 2 types of ATM skimming
• Devices that interact with ATM machine
• Causes ATM to malfunction and not dispense cash
• Devices that do not interact with ATM machine
• Allows ATM to function normally
• Using skimmed ATM card information, scammers can create fake duplicates and use them in ATM machines to withdraw money very quickly and easily
• Many times ATM skimming scammers will using a card-skimming device in conjunction with a hidden camera to record the users PIN number when it is typed on the ATM keypad

BACKGROUND
 Crimes at ATMs started around 20 years ago when a person would be injured and their money stolen after using the ATM. As the crime got more sophisticated, it would be a person looking over another person’s shoulder to get their ATM card number and PIN. ATM Skimming has been a problem since the 90s. It has recently became a much more massive problem because of smaller and more mobile computing devices that allow the criminals to store lots of data they need to steal and sell many ATM cards and PINs.


There are 2 common types of ATM skimming. The first type interferes with the operation of the ATM machine and the other type does not interfere with it. The second type is simply a device that records the card and PIN information from the magnetic strip of the card without being suspicious. The first type, however, interferes with the ATM by replacing it’s built in card reader thus not allowing the ATM user to get their money which is much more suspicious.  

STRATEGIC PLANNING ASSUMPTIONS:

•  Jitter is a new technology being utilized in brand new motorized card readers in ATMs. The technology ultimately randomizes the speed and direction of the card insertion/ejection which confuses or nullifies skimming devices that may be in use.
• Criminals will bypass card readers to collect ATM card and bank account information by hacking into payment processing databases or other databases that store the same information

   
ANALYSIS:
Recent cases of ATM skimming include an Australian fast-food chain’s point of sale system which compromised about AU$2.5 million in October 2009. In November 2009, some new high-tech skimmers were discovered with Bluetooth transmitters to steal the stolen information. A terminal in a 


New Zealand car park was compromised and potentially exposed about 100,000 people in a short time period. Some co-operation has existed between USA and Europe to prosecute suspects in an earlier compromise of major US processor, RBS WorldPay.


Although much of the crime of ATM skimming started and is occurring in the UK and parts of Europe and Asia, much of the crime is happening right here in the US where stand-alone ATM machines are very common in many venues around the country. There are many tactics that criminals use to skim necessary information to perform the crime including cameras, wireless pin pads, Bluetooth transmitters, laptops, mobile devices, external card readers, skimmers, etc. At the same time ATM manufacturers, banks, and authorities are using their own tactics to combat the criminal activity including swipe card readers versus manual card readers, surveillance cameras, PIN encryption, etc. 

IMPLICATIONS:

•  Avoid ATMs in public locations such as malls, hotels, and airports. Stick with ATMs in bank lobbies and ATMs monitor with security surveillance.
• ATM skimming will continue to be on the rise as the crime becomes more and more lucrative with bigger and bigger amounts of money being scammed.
• ATM card readers will get more and more advanced with emerging technologies but criminals will use other methods to steal ATM card information such as hacking into databases of payment processors that contain that necessary information.

   
RECOMMENDATIONS:

•  Safeguard your ATM pin at all times
• Never let a stranger give you assistance at an ATM
• Always check statements to beware of fraudulent activity on the account
• Inspect the machine before use and if the machine has any visual defects or something seems odd, don’t use it
• Beware of people around you that may be able to see your information
• If your ATM card is not returned after your transaction, contact your financial institution immediately
• Never use an ATM that exhibits a sticky substance such as glue which is sometimes used to trap cards

SOURCES:

1. "ATM Camera." Snopes.com. 01 Feb 2010. Web. <http://www.snopes.com/fraud/atm/atmcamera.asp>.
2. Bruce, Laura. "Skimming the cash out of your account." Bankrate.com. Bankrate, Web. <http://www.bankrate.com/finance/checking/skimming-the-cash-out-of-your-account-1.aspx>.
3. "ATM Skimming is on the Rise." Complaints Board. Consumer Complaints Board, Web. <http://www.complaintsboard.com/news-stories/atm-skimming-is-on-the-rise.html>.
4. Russell, Douglas. "2009 - Skimming Review." ATMSecurity.com. 19 Jan 2010. DFR Risk Management, Web. <http://www.atmsecurity.com/monthly-digest/atm-security-monthly-digest/2009-skimming-review.html>.
5. "How to Protect Against ATM Skimming." eHow. Demand Media, Web. <http://www.ehow.com/how_5025049_protect-against-atm-skimming.html>.

APPENDIX 
Timeline of 2009’s biggest data breaches at major financial institutions (including major skimming crimes): http://www.bankinfosecurity.com/articles.php?art_id=1766&pg=1

Don't take offense but the biggest risk to security - It's Likely To Be You!

Everyone asks me what the greatest theat to security is.  They are visibly disappointed when I give them my answer.  I think most of them expect me to say, "China!  They are out to get us!" or, "The Russian Business Network - they are wicked smart!"or, "Cybercriminals, they are always after your money."  These are real threats and you need to protect yourself from them.

I believe there is a bigger threat, and dear reader, I believe it is you or maybe your co-worker.

Are you Mr. Incredible?  You do it all - juggle kids, work, family obligations.  This requires you to take work with you everywhere you go.

Imagine this...
You have work to do but your kid's soccer game is coming up.  Well, just download 3.3 Million borrower records to your thumb drive and you are in business.  Can work anywhere.  You might be able to work in the car while your kid's team warms up.

Well, Mr. Incredible, if you worked at ECMC, you just created the largest most incredible breach ever.

We don't know why an employee downloaded to a thumb drive, 3.3 million people's student loan records, but we will soon.  3.3MM people equates to as many as 5% of all federal student-loan borrowers.  Their data is on a thumb drive that is now missing.

Not to worry, students, I think it only had on it your Names, addresses, Social Security numbers and other personal data.

This particular Mr. Incredible works in St. Paul, Minn., at the headquarters of Educational Credit Management Corp., a nonprofit guarantor of federal student loans.

You will be glad to read this quote from the ECMC spokesperson, Paul Kelash:  "It was simple, old-fashioned theft.  It was not a hacker incident."  Wow, that is comforting!

This is right on the heals of another data theft earlier in March 2010, a former employee of HSBC Holdings PLC allegedly stole data on about 24,000 Swiss private-bank accounts.


The conversation about the insider threat, is the non-sexy side of security but it can cause some of the greatest chinks in the armor.  The “insider threat”, is often like carbon monoxide poisoning, silent and hard to detect.  I break the threat down into three character profiles:
1.  Robert Hanssen
2.  Eve from Wall-E
3.  Mr. Incredible

Robert Hanssen – Intentional:
Robert Hanssen was a former U.S. FBI agent who turned over information to Russian intelligence services for cash and diamonds.  It is also suspected he did it because he wanted to prove something to himself and others.  This employee-type knowingly wants to cause harm either because they want to make a buck or because they feel it is their version of payback time.

Eve from Wall-E – Unintentional Public Disclosure (Think Millenials):
Eve is on a mission and she wears that mission on her chest.  She’s after plantlife and she does not care who she broadcasts that mission to.  She cannot keep a secret and she is overjoyed and beams when she finds plant life.  The generation joining the workforce now and for the next 10-15 years is a lot like Eve.  When they experience emotions, they will wear them openly via cyber space.  That openness may also include blogging, tweeting, and Facebooking posts about the latest project they are working on.

Recently, an over exuberant Microsoftie was caught talking about the virtues of Windows 8.    His posts have been removed.  Before they were, we did manage to learn that the next version will be “unlike anything users expect of the operating system”. And that they are moving to 128-bit.  A tough blow for their competitors and for bad guys that want to be ready to hack the new version the moment it arrives.

Mr. Incredible – Accidentally Breaks Your Defenses:
Your model employee, the hidden threat until it’s too late:
I love Mr. Incredible.  He has great strength and a heart of gold.  He wants to take on the world and use his talents but was forced to hide his talents within the system.  In one scene, in striving to do what is right and just, he accidentally injures his own boss.

I tell organizations that their biggest threat may actually be their Mr. Incredible employees.  These are the people that will do whatever it takes to work for you days, nights, weekends, and holidays.  They are the fearless defenders of creating the latest report or implementing the last technology for your company.  If that means downloading tons of information to a portable device so they can work on their vacation, they will.  If it means throwing the laptop in the car on the way to pick up their kids with a stop at the grocery store and the laptop is left unattended…whoops!  They do not mean to put the company at risk but their drive to get it done exposes your data.

The missing data costs your reputation, puts your intellectual property at risk, may expose innocent people to identity theft, and can create lengthy, costly lawsuits.  Just ask the VA.  A model employee was working on VA business at home and their home was burglarized.  A VA laptop was among the stolen goods and had the Social Security numbers of 26.5MM active duty military and veterans on it.  The VA has agreed to pay $20MM to settle a class action lawsuit.  In a true miracle mix of skills and luck, the FBI managed to recover the stolen laptop and it is believed the data was not used by the criminals.

Until we deal with the insider threat, I will not run out of blog posts!

As always, would love your comments and feedback.

Avoid the nightmare of losing your address book. Helpful tips.

Link the WBTV Video


n the US, over 12 million cell phones are lost each year and 700,000 are stolen.

This is a nightmare scenario.  You need to make a phone call and find out that your address book is suddenly empty or your cell phone is missing.  If your job counts on you having a large rolodex this situation can be overwhelming.

What would happen to you if your contacts were lost?

Former White House Cyber Security Expert, Theresa Payton has some options for saving your contacts to a safe place and recovery options in the event something happens to your cell phone.

How to avoid a BAD situation:

B - Back up files.  Most smart phones and cell phones come with software that you can use on your computer so you can create a back up file.

A - Access to your contacts may be available another way.  You may have files on your computer or Mac that you could use.  For example:

 ."ipd" at the end, that file has BlackBerry contacts.

."csv" at the end, that file can be imported into most address book and email programs and then synchronized to your phone.

vCard files can be imported into most contact programs.

D - Don't rely on just having your contacts on your phone or computer.  Keep a copy in multiple places.  Have a hard copy of the 5 most important contacts in the event of an emergency.

The following are resources that can help you build or re-build your list of contacts on your phone and computer.

See this link for helpful resources on how to back up your contacts:  Website Tips & Resources

As always. please make comments and suggestions on what you want to hear about!

Thank you!

Cybercreeps Grab Your Stash, Hide the Cash, While Using Bogus Bank Statements

Cybercrooks have a new trick up their sleeve! 

Cybercriminals are rewriting your bank statement so it looks like small transfers have been taken out and your balance looks okay.

A Security firm called, Finjan, found that cybercriminals stole $440K from online banking customers in Germany last year.

To fake out the customer and the bank, the cybercreeps transacted small transfers.   They used money mules to help them move the money out.  (More on money mules in another post but they are usually good people doing "work at home" and have no idea that they are a pawn in this scheme).

To continue the fake out, these cybercreeps displayed altered statements showing only a small amount transferred. 

 “They successfully evaded the banks' anti-fraud systems," says Ben-Itzhak. "We dubbed it anti anti-fraud."

Link to original USA Today story:  http://blogs.usatoday.com/technologylive/2009/09/cybercriminals-rewriting-bank-statements.html


Follow us on Twitter:  twitter.com/fortalicellc


Fan us on Facebook:  FortaliceLLC


Website:  Company Website

Watchlist - Top 10 for 2010

I spent some time looking at various research notes about 2010 and what to expect regarding technology adoption...which, unfortunately, also leads to criminal uses of technology.

Based on my reading, I've created my watchlist of "The Top 10 for 2010".

Would love to hear your comments and feedback on the list.

1. Net Now:
Using the internet and key services on phones, laptops, and computers, you can do anything now.
a. If you need to know the name of a song, hum into your phone and Midomi will tell you.
b. Catching up from vacation, access the discussion with the gang back at the office, using Google
        Wave.

2. Noplace to Hide:
GPS, Smartphones, and applications like Google Latitude and Foursquare allow you to track your friends and your friends can track you.  If you are planning a trip, use TripIt and you’ll learn which of your friends will be in the same place for work or play.

3. Search Seasons:
In the words of U2, you may often say, “I still haven’t found what I’m looking for” even when you try multiple search engines.  We are still living in the Information age but we are soon moving to the Knowledge age where we can cull all the information resident in our heads, on our PC, and in our colleagues heads across the globe and be able to access it real time via a search engine.  Expect Bing and Google search to continue to improve and become more personalized in search terms and results.

4. Money Movement:
Mobile payments and online banking via smartphones will make a quantum leap this year.  Banks will make it easier and so will payment platforms such as PayPal and Square.  Square allows merchants to take payments via your iPhone.

5. Connected Cars:
Not only will they be more fuel efficient, but more cars will come online that let you integrate your smart phone into your car system for tasks such as caller id, hands free calling, and looking up contact information.

6. Short and Sweet:  140 Characters...or less!
More people will adopt quick communication options such as phone texting, twitter, and other social media options that support short text messages.

7. It Takes an Online Village:
More people will use social media to stay connected to friends and family.  They will also congregate to social site places of interest such as work, health, investing, politics, and hobbies.

8. Social Engineering:
Attackers will target people on a personal level to try and trick them into clicking on a link so they can steal information.

9. Cyber Creeps & Rogue Security Software:
Cyber Creeps will create rogue security software that makes you think you are unprotected, convincing you to click on a link and installing bad software programs.

10. That Darn Spam!
Spam mail will continue to increase by at least 15% this year according to Symantec’s research.

To learn more about these Top 10 Trends for 2010 look at the following sites:

1. Net Now:
a. Mashable.com
b. Midomi.com
c. Wave.Google.com

2. Noplace to Hide:
a. Google.com/Latitude
b. Foursquare.com
c. TripIt.com
d. MoLoGoGo.com

3. Search Seasons:
a. Bing.com
b. Wikipedia.com
c. Yahoo.com
d. Google.com

4. Money Movement:
a. PayPal.com
b. Square.com
c. Check your banking to see if they have a mobile platform

5. Connected Cars:  
a. Ask your favorite dealer for 2010 specifics

6. Short and Sweet:
a. Twitter.com
b. Google.com/talk

7. It Takes an Online Village:
a. Type in your area of interest + “Social Media Sites” to find sites suited to your needs
b. Profession:  LinkedIn.com
c. Financial Advice:  Fool.com
d. FaceBook.com
e. MySpace.com

8.–10.  Cyber Security & Protecting Yourself Online:
a. Symantec.com
b. McAfee.com
c. PandaLabs.com
d. FBI.gov or IC3.gov
e. DHS.gov/cyber

Great People to Follow On Twitter re:  Online Safety.

I am sure to miss a few but here's the best list off the top of my head:

@HeyKim

@AndyWillingHam

@Pranheim

@BurgessCT

@MaryKayHoal

@Co2HOG

@LindaCriddle

@WiredMoms

@CrispThinking

@MarjieKnudsen

@RobertSiciliano

@Schoogo

@MomsMaterial

@SueScheff

@GoogleBombBook

@Security_FAQs

@MBenLakhoua

@Suzidk

@PandaLabs

@Intel_Chris

@RebeccaNewton

@e_Mint

@Cvallejo64

@Bugspy

@DigitalSteward

@D_Rittenhouse

@WebEyesOpen

@McAfeeAvertLabs