Article Review: The Conficker Worm: A Potential Threat to PCs

While the frequency of computers getting infected from malware has decreased over the years, thanks to swift and organized responses from security response companies such as Symantec, VeriSign and Microsoft, some still pass through the cracks and pose huge threats to millions of computers worldwide. The latest of these malware comes in the form of an infectious worm which attacks a Windows Server Service flaw(MS08-067). This worm has been named the Conficker worm, aka Downadup, and has infected millions of computers worldwide, from French navy systems to British Hospitals, in the last year or so. The worm was intended to quietly make money by sending spam and stealing financial data or sensitive documents from infected computers. It was initially spread in its first stage where it enters the computer and targets the MS 08-067 flaw in the Windows Server Service, a flaw that attackers could target remotely, making it a large target for worms. Then updates to the worm would spread and take swipes at debilitating security programs such as Symantec or Microsoft Update. Then it would eventually gain access and steal passwords and data. However, its massive infection rate drew heavy attention from security response developers which may have halted the plans of the perpetrators of this Conficker worm. Currently, the worm is stuck in the second stage where it is not yet able to steal data and passwords and it is crucial for computers infected with this virus to download the appropriate anti-virus software.

To determine if your PC has been infected with the Conficker worm, you should try accessing anti-virus security websites, such as f-secure.com, kaspersky.com, symantec.com and others. If your computer is infected, you will not be able to gain access to these web sites. If this is the case, it is recommended that you download, from a separate computer, a Conficker removal tool and then run it on the infected computer to remove the worm, otherwise, should the authors of the Conficker worm proceed to find a payload for the worm, then it might steal personal data and you might get hit financially!

Larkin, Erik (May 2009). The Conficker Worm: A Potential Threat to PCs. PCWorld, 37-38

Chapter 8: A stolen laptop at the VA: The worst data theft ever?

1) List and describe the security weaknesses at the Department of Veteran Affairs.

-lack of appropriate data security policies in place/disregard for privacy rights of veterans:
When policies are developed with proper foresight and safety considerations, they are typically the most important step to preventing undesirable occurrences from happening. In the case of the stolen laptop from a Veteran Affairs (VA)data analyst's home, there were very loose security policies which allowed for this security breach to occur. More specifically, the data analyst was allowed to take a laptop home containing data from millions of veterans for approximately three years. Furthermore, he was allowed to use at-home software to access and manipulate millions of veterans' social security numbers, addresses, phone numbers, etc. For lack of a better word, this ignorant decision demonstrates the VA's lack of foresight and demonstrates a disregard for the privacy of veteran's rights. There are many obvious risks with removing sensitive data from a secure location and taking it to someones home, such as an unauthorized person tampering and/or stealing data, deletion of data, acquiring a virus, etc. I am sure that none of those VA staff or management would want their personal data being taken home regularly and without proper security features to a stranger's home. It doesn't take a genius to realize that there is a risk posed by allowing laptops with personal data to be removed from the building and taken to employee's homes. This was a case of failed leadership to protect data and policies should have been in place disallowing this type of activity.
-delayed reaction to theft of sensitive identity data:
The VA Inspector General was not informed of the incident promptly after its occurrence and he found out about seven days after the fact, through"office gossip," that the burglary took place. Furthermore, the Secretary of Veteran Affairs, Jim Nicholson, did not find out about the burglary until 13 days after it occurred. This type of delay can inhibit the FBI and Justice Department's investigative process and prevent them from solving the case. Luckily, the thieves were not extremely computer savvy and did not access the data. Also, they were eventually caught but had it been a computer savvy hacker, all that personal data may have been stolen and used within a matter of days and could have created huge financial losses.
-decentralization of IT security systems:
Apparently, an audit conducted in 2004 of the VA's IT system revealed that a centralized management system should be implemented to improve information security at the VA. The current decentralized system in place at the VA made it difficult to implement necessary changes/updates to their systems and made them more susceptible to delays and performance failures. The VA's chief information security officer lacked direct authority to enforce security policies and mandates.
-weak information security program:
Sensitive data held in the laptop that was stolen, did not have adequate access control features. Data on the computer was not encrypted and there were no biometric authentication programs linked to their large database of confidential data. Theft, in general, whether at home or at the workplace is often difficult to prevent, but with stringent security features in place protecting the personal data, it would limit any unauthorized exposure and limit damages.


2)What management, organization, and technology factors contributed to these weaknesses?

It is clear that the stolen data was a result of failure on many levels. From a management perspective, the VA failed to implement adequate security policies to protect the privacy rights of the veterans. An important role of a manager is to be able to recognize risks to an organization and its stakeholders. In addition, managers should demonstrate solid judgement and foresight when making decisions. The decision to allow unprotected, confidential data to leave the VA premises on a laptop and into an employee's home for three years demonstrated poor judgement from management. With regards to organizational factors that led to the VA's weakness, I would claim that their decentralized management structure made it difficult as an organization to swiftly recognize potential threats and implement change. In this type of organizational structure, information systems security has to clear many levels and reach multiple approvals prior to its implementation. A more direct, centralized organizational structure may have allowed for a more secure IT environment. Finally, in terms of technological factors which led to the VA's weaknesses, they lacked up-to-date access controls which protected the data from unauthorized access. Whether the data was stolen from home or the workplace, there should be both biometric authentication controls and encryption controls protecting the data.

3)What solutions would you suggest to prevent these security problems?
I would propose the following three suggestions to prevent the VA's security problems:
1)The VA must update their corporate security policies and specify on each position's job descriptions, proper guidelines regarding what data they can access, to complete work on intrusion detection systems and immediately prohibit the removal of confidential data, whether by laptop or flash drive, etc., from the main server computers.
2) Implement access controls which encrypt data and install biometric authentication devices on computers which would need access to confidential data. This would protect data from unauthorized exposure in the event of a theft and would make it nearly impossible for unauthorized access to be gained into personal records.
3) Development of a centralized management structure with less levels of bureaucracy in the VA's IT department. As the two former CIO's, McFarland and Gauss, suggested, it would be beneficial for the VA to appoint a chief information security officer with direct authority to monitor IT security and enforce security policies and mandates swiftly.

Article Review

Article Review coming soon...

Chapter 3 Case Study: Blockbuster vs. Netflix

Question #1:
What is Blockbuster's business model? Blockbuster is one of the largest, well known, movie retail chains in the world. Their business model is one composed of heavy marketing and advertising to the public along with strategically placed retail stores to cater to customers seeking video rentals and/or purchases. They have been around since 1985 and were able to thrive throughout the years by offering their customers a recognizable brand to rent and buy movies from.

How successful has it been? Based on their market share in the rental video industry of 40%, it is safe to conclude that their business model has led them to success. By 2004, Blockbuster generated yearly revenues of $7-9 billion from video rental business and $16 billion from video sales.

Question #4:
How successful is Netflix and its business model? Netflix developed a unique business model in 1998 which allowed customers to rent movies through an online store without the risk of late fees. This provides the customer with unparalleled convenience which other video rental stores were not providing at the time.
Netflix is enjoying success from its online video rental business and has seen steady growth in their yearly revenues. In 1998, Netflix generated $522 million ; in 2005 they generated $1 billion and they are projected to generate $3 billion in sales in 2009. Apparently, their entry into the video rental industry has been well-received.

Question #5:
Do you think that Blockbuster or Netflix will succeed in the future? Explain your answer.
Given today's shaky economic landscape and the emergence of convenience through technology, it is difficult to predict the success of any company, but I strongly believe that Netflix holds a better chance of succeeding than does Blockbuster. Although, Blockbuster has the added advantage of having retail stores placed in numerous locations, they carry a large burden of maintaining a large workforce and mounting capital long/term liabilities such as rent, mortgages, etc. Nevertheless, I doubt that either company is going to go bankrupt anytime soon and that they will remain as competetive forces in the movie rental industry. I see both companies adapting to, if not setting, future trends in the industry.

ABOUT ME

My name is Igor Molchanov and this is a little blog about my history and background. I was born in Odessa, Ukraine and moved with my family to Los Angeles in 1979 where I was raised.

I attended UCLA and obtained my B.S. degree in Physiological Science in 2000 and went on to work in the field of geriatric services/health care. Currently, I am pursuing an MBA degree from California State University, Channel Islands. Since 1999, I have been fortunate enough to be a part of a team that provides adult day health care services to seniors. Serving as administrator of the facility, I have been able serve and offer an assortment of therapeutic activities and treatments to many seniors who suffer from various illnesses and those who need assistance with acitivities of daily living. Unfortunately, our ADHC has recently undergone an ownership change and the new owners are bringing in their own management team, so I was forced to look for a new job and was successful in landing one with a great company: Sunrise Senior Living. I will serve as their Alzheimer's Care Director for their Santa Monica facility. I am very excited to be making this career transition.

My greatest blessings in life, undoubtedly have been my wonderful wife, Violet, and my son Nicholas. They are my motivation and the main reason why I am pursuing my MBA degree at CSUCI.

In 5 years from now, I hope to climb the management ranks at Sunrise Senior Living and become an Executive Director in about a year or so. As boring and mundane as it might sound, I strongly believe that my career calling in life is healthcare and given the demographic projections of the aging population in the next 20-30 years, I am confident that the geritric services industry will continue to grow. On the family front, I hope I am lucky enough to have another child in the next couple of years...