Aug 28, 2015 | Cybersecurity News, Data Breach News, Industry News
Did you think the Ashley Madison data breach was mildly humorous? Did you think that it serves the people right for cheating on their husband, wife or life partner? If you did, you certainly didn’t have an account with the online cheating website. Those who did simultaneously broke out in a cold sweat when they realized the website had been hacked and the perpetrator was threatening to make the data public.
Ashley Madison data breach exposed millions of confidential records
The Impact Team was the hacking group behind the Ashley Madison data breach. The company announced it had hacked the company’s database on the Tor network. The hackers claimed they would release details of the website’s patrons – people looking to have extra-marital affairs – if the company did not shut down its website. Avid Life Media Ltd., the company behind Ashley Madison, did not agree to close its business. The hackers then made good on their promise and started publishing data. A large data dump caused many of the website’s subscribers to panic.
The methods used by the attackers to gain access to the website have not been disclosed, although they were able to obtain the records of more than 30 million individuals in the attack. Unfortunately for the people who have had their privacy violated, there is little that can be done apart from take precautions with their financial accounts. Their data cannot be un-exposed and it is out there and can be used by whoever finds it. That will mean phishers, cybercriminals, identity thieves, and anyone who has taken an objection to their extra-marital activities may try to expose them.
A data breach can seriously damage a company’s reputation
This was a high profile breach due to the nature of the website and the total confidentiality that is expected and demanded by the company’s clients. A data breach such as this has potential to cause considerable damage to a brand with a marketing strategy and service that depends on privacy. However, brand reputation damage occurs following any security breach. Target, Anthem Inc., eBay, OPM. All have had their reputations damaged to varying degrees as a result of security breaches and data theft.
Many IT professionals believe that it is not a case of whether a security breach will be suffered, but when it will happen. A great many security professionals believe that most companies have already suffered a security breach. They just do not know yet.
Lessons learned from the Ashley Madison data breach
Consumers can learn lessons from the Ashley Madison data breach. They should be aware that disclosing any information increases the risk of someone else accessing that information.
The lessons for consumers are:
- If you want to do anything in secret, the Internet is probably not the best place to do it
- When disclosing information of a sensitive nature, ask yourself what the consequences would be if someone found out or exposed that information
- Would you be able to recover from a breach of that information?
- Is the service or product more or less important than it being kept a secret?
- No matter how secure a website, service, or application claims to be, there is always a risk of a security breach being suffered
- There is never a 100% guarantee of privacy online – All networks and systems are vulnerable to attack
Businesses must conduct a risk analysis
Businesses must also consider the risks to data security. Many security threats exist, and they must all be effectively managed. In order to determine what risks exist, an organization must conduct a thorough risk analysis. It is only possible to address and manage risk if a company knows what security vulnerabilities exist. Unfortunately, many hackers already know about the data security risks that are present, as well as how they can be exploited.
Once a risk is identified, unless state or federal legislation demand that the risk is addressed, a company must decide what measures to employ, and whether they are actually worthwhile.
To do that a company must calculate the annualized rate of occurrence (ARO) of a security breach via a given vulnerability, which means how often a vulnerability is likely to be exploited in any given year. Then the company must determine the repercussions from that vulnerability being exploited. How much the security breach would cost to resolve. That figure is the single loss expectancy (SLE). Once these figures are known it is possible to determine the annual loss expectancy (ALE) by multiplying those two figures. A decision can then be taken about how the risk can be managed.
Sean Doherty, Head of Research & Development at TitanHQ recently pointed out that “the notion of having ‘perfect security’ is ludicrous”. What must be done is to make it as hard as possible for systems to be infiltrated and data stolen. It is essential to implement good security measures which will be sufficient to repel attacks from all but the most skilled, motivated, and determined individuals. There is no such thing as zero risk, but it is possible to manage risk and get it down to a minimal level.
Aug 14, 2015 | Industry News, Internet Security, Network Security
The role of a systems administrator is certainly challenging, mainly because it is constantly changing. This is the way it always has been since the role of a systems administrator was first defined. Now if you were to write down the role of a systems administrator, it would virtually be out of date before the ink had dried.
The role of a systems administrator evolves quickly. That is the very nature of the job. For many sys admins, that is what makes the job so interesting and enjoyable.
Anyone contemplating entering the professions should not be afraid of hard work. They also need to know that they will need a lot of training, and even more experience in order to excel in the position.
The role of a systems administrator over the next five years
Over the course of the next five years there is expected to be 12% growth for systems and network administrators according to the US Bureau of Labor Statistics. The last report issued by the BLS indicated a much higher growth rate, but it has now been adjusted and matches the average of all industries tracked by the BLS.
In years gone by you may have been able to get away with just having a MCSA qualification to become a good systems administrator. Today, that is not nearly enough. Not only will you need to know your way around Microsoft, you will also need to become an expert in every system used by your employer.
To excel in the role of a systems administrator you must be technically gifted, and you will need to be something of a jack of all trades. New technology is frequently introduced and part of the role of a systems administrator is to get to grips with that technology quickly. After all, you will be required to configure it, troubleshoot it, and repair it as necessary. The role of the systems administrator has grown enormously since IT has become so pervasive in business.
Fortunately, it is much easier to access training and information resources than ever before. Vendor websites provide a wealth of information, Udemy and other online learning resources can easily be accessed, and social media networks and online forums allow a sys admin to tap into the knowledge of colleagues and other sys admins when help is required.
How important is certification?
You will need an MCSA certificate to get your first job, but in order to retain your position, or even to progress and get a better paid job, further qualifications may be required. But not necessarily. They look great on a CV and can impress potential employers, but experience really does counts. If you know your stuff and have experience it does make sense to get certificated, but never underestimate the value of experience over a piece of paper. Certification is not everything.
If you want to take on the role of a systems administrator be sure to learn these technologies!
A system administer should be familiar with emerging technologies, but there are some tech trends that are an absolute must to become familiar with. These include:
- Software-as-a-service
- Cloud services
- Virtualization
- Voice Over IP (VoIP)
- Technologies that can automate tasks performed by a sys admin
Automation of daily sys admin tasks
Automation of sys admin tasks will not mean you will be ultimately made redundant. It means you can use your time more efficiently. You will need to be familiar with the tools that allow you to automate a lot of tasks. They are essential for managing large, complex networks.
Without any automation of daily tasks, the role of a system administer would be an absolute nightmare. Imaging trying to keep track of system messages for a network with 1000 connected devices if you did not have a centralized logging system!
While automation is vital, it is not without its problems. Automation can make the management of a computer network easier, but on a day to day basis your job is likely to be much more complicated, especially when it comes to troubleshooting problems.
Let’s say you have a red X showing on your management dashboard. What does that red X mean? Well, it could mean any number of things. For instance:
There could be a problem with the device hosting the dashboard, or it could be caused by a routing error. It could be a cable issue, or a problem with the device itself. It may be an error with the discovery protocol, or maybe the network dashboard is faulty. Automation may save time, but it doesn’t necessarily mean it is always quicker and easier to resolve problems. It also requires a sys admin to undergo further training on the automation system itself and the equipment used to host it.
In order to be able to automate tasks you will need to learn a scripting language such as Python or Windows PowerShell. One thing is for sure. If you are planning on becoming a sys admin you will need to learn at least one scripting language before you get your first job. As for the others, they can be learned on the job.
Use of SaaS and the Cloud is Increasing
You must be familiar with cloud archiving and backups as these have proven to be invaluable in improving efficiency. Many man-hours have been cut by using the cloud for routine data operations. However, that said, there is now a need for sys admins to become familiar with APIs – Application Programming Interfaces.
With many companies now using outsourced cloud services, the sys admins role has become much more valuable. Without a sys admin, businesses would have no alternative but to believe what cloud service salespersons say. An experienced sys admin will be able to assess the services being offered and determine whether they have the required functionality to adequately serve the needs of the business.
The Two V’s – VoIP and Virtualization
Many companies are taking advantage of the huge cost savings possible by switching from traditional telephone services to VoIP. Unfortunately, while business leaders love the cost savings, users do not like the potential downtime. In fact, they can be pretty intolerant. They expect 99.999% uptime like they get with traditional telephony. It is therefore essential that sys admins understand network load dynamics and are able to successfully implement and maintain VoIP services.
Businesses nowadays use many virtual networks, which add new levels of abstraction. They also require advanced knowledge of switching and routing. It is therefore essential that a good working knowledge of virtualization is acquired.
The role of a system administrator requires these skills…
A study conducted by the Association for Information Systems (AIS) and Association for Computing Machinery (ACM), detailed in the IS 2010 Curriculum Guidelines, suggests an individual in the role of a systems administrator must have the following skills and attributes in order to succeed in the position:
- Creative, analytical, and critical thinking skills
- Excellent communication and negotiation skills
- Collaboration and leadership skills
- Good mathematical knowledge
Do you think you have what it takes? If you do, make sure you are aware of all the critical technologies. Work on your mathematical and communication skills, and make sure you expand your social network. Many companies are looking for experience, which can make it hard to get your first position. Hang in there. If you can prove your knowledge and demonstrate your skills, you should be able to get your first position. And we wish you the very best of luck with that.
