How to get a job in security
http://www.wired.com/threatlevel/2012/05/airport-security-id-theft/
I often get hit on by wannabes who want to - as they put it - "break into security" and get a job as a security consultant. Perhaps the media has something to do with it, making it look glamorous when in fact it is tedious and requires a lot of study and self-discipline. The most often question is about which certification they should get first in order to get a job. Some people seem to view certification as a job ticket because so many job postings have various certifications as a requirement.
What these people are forgetting is that a certification is there to certify you have the experience; you need the experience to get the certification.
If course you could always fake it; there are plenty of diploma mills and no shortage of high profile people who have faked their resumes.
But this goes one step beyond that. This person got a job in security though faking an complete ID with all the supporting documentation:
Bimbo Olumuyiwa Oyewole, known to his fellow workers as “Jerry Thomas,” obtained his job as a security guard supervisor at the Newark Liberty International Airport with credentials he’d allegedly stolen in 1992 from a petty criminal who was shot and killed in New York that year, according to CBS.
Authorities say Oyewole, who entered the U.S. illegally in 1989, began using Thomas’ birth certificate and Social Security number three weeks before he was murdered, though there’s no immediate evidence that he was involved in Thomas’ death. He used these documents to obtain a New Jersey driver’s license in Thomas’ name, as well as a state security guard license, airport identification and credit cards.
He used the fraudulent documents to gain employment with several contractors at the Newark airport, most recently with FJC Security Services.
That really inspires confidence in the system, doesn't it?
So what careful vetting and though investigation by the FBI and others uncovered this threat, a threat that could have been practised by a 'sleeper' for a terrorist organization?
Think again:
Authorities discovered Oyewole wasn’t the man he said he was only after an anonymous letter was sent to the Port Authority of New York, which oversees the region’s main airports, and to the New Jersey’s inspector general’s office. The letter indicated that “Jerry Thomas” was known by other names.
Might we suspect a disgruntled ex-lover?
Good policing that, eh? It makes you wonder how many other TSA operatives and supervisors are using fake ID or whose backgrounds and origins have not been adequately investigated.
Oh, right, there are so many of them, that level of investigation is impractical.
Didn't Bruce Schneier say something about the TSA's approach being impractical, being "Security Theatre"?
Related articles
- 'Dead Man Walking' Tricks Airport into Giving Him Top Security Job (wired.com)
- Airport worker allegedly had man's ID before death (heraldonline.com)
- Illegal immigrant used stolen ID to work as airport security supervisor for 20 years (EndtheLie.com)
- Congress considers threats from airport employees (cbsnews.com)
- Nigerian Bimbo Olumuyiwa Oyewole was known by his co-workers as Jerry Thomas (luckmeister.typepad.com)
“Cybercrime” is still Crime and “Cyberfraud” is still Fraud
This says it all:
At the end of the day, cybercriminal activity is not all that different
from more traditional forms of organized crime. Obviously, the way the
crime is perpetrated is new, but the ways in which cybercriminals
operate is not all that different from anything that has gone on before.
Heck, once upon a time there was no telegraph, no "Royal Mail" (or whatever the equivalent in your state/nation). But when those came along they offered new opportunities for fraud. Most places have laws in place again fraud perpetrated by mail or telegraph and telegraph
includes the telephone.
And this is where I get to wonder at how our politicians work, the knee-jerk "something must be done NOW" attitude.
Here in Canada we have a criminal code. It covers fraud. We don't need new laws to deal with cybercrime because the ways our laws are written they are general and not reductionist. They specify the crime, not the technology used.
I get the impression that in the USA (and possibly other places) its the other way round. That's why they need lots of new laws to address every fine-grained detail as the technology advances. Personally I don't think this is a good way of working since it piles laws upon laws.
In science we was that in astronomy before Newton. The classical "Ptolemaic" system piled epicycles upon epicycles as corrections because the underlying model based on a geocentric approach and the idea of 'perfect spheres' was fundamentally flawed. Piling human laws upon human laws to deal with special cases of what is really a general
situation is no less flawed in approach.
Fraud is fraud is fraud. It doesn't matter if its perpetrated by a hustler in person as in the scenes in "Paper Moon", by mail, over the phone or using the Internet. Fraud is fraud is fraud.
We don't need new laws; we just need a better understanding of how criminals use technology. We perhaps we security droids don't, perhaps the public, the police, the legislators and the managers of the firms and organizations impacted by such criminals need that understanding.
But that's not what detailed, reductionist legislation is going to achieve, is it?
Related articles
- Guarding your business against cybercrime (premierlinedirect.co.uk)
- Interpol Promises New Center to Fight the E-Mob (spectrum.ieee.org)
- Russian Cybercrime pays! (toinformistoinfluence.com)
- Cybercrime 'cannot be stopped entirely' (premierlinedirect.co.uk)
- Former National Cyber Czar Creates Cybercrime TV (prweb.com)
- There's no business like Cybercrime business! (blog.bt.com)
- Impact of cybercrime underestimated as most crimes go unreported|Network security (c24.co.uk)
- European Commission wants a cybercrime centre (h-online.com)
- Everything you thought you knew about cybercrims is WRONG (go.theregister.com)
- FBI finds scammers impersonating the FBI now one of worst online threats (theneteconomy.wordpress.com)
- Educate Customers on Mass Marketing Fraud (ibaeducationblog.com)
- Cybercriminals offer bogus fraud insurance services (zdnet.com)
The FBI risk equation
It seems that to make better cybersecurity-related decisions a senior FBI official recommends considering a simple algebraic equation:
risk = threat x vulnerability x consequence
rather than solely focusing on threat vectors and actors.
To be honest, I sometimes wonder why people obsess about threat vectors in the first place. There seems to be a beleive that the more threats you face, the higher your risk, regardless of your controls and regardless of the classification of the threats.
Look at it this way: what do you have control over?
Why do you think that people like auditors refer to the protective and detective mechanisms as "controls"?
Yes, if you're a 600,000 lb gorilla like Microsoft you can take down one - insignificant - botnet, but the rest of us don't have control over the threat vectors and threat actors.
What do we have control over?
Vulnerabilities, to some extent. We can patch; we can choose to run alternative software; we can mask off access by the threats to the vulnerabilities. We can do things to reduce the the "vulnerability surface" such as partitioning our networks, restricting access, not exposing more than is absolutely necessary to the Internet (why oh why is your SqlServer visible to the net, why isn't it behind the web server, which in turn is behind a firewall).
Asset to a large extent. Document them. Identify who should be using them and implement IAM.
And very import: we have control over RESPONSE.
Did the FBI equation mention response? I suppose you could say that 'awareness' is a part of a response package. Personally I think that response is a very, very important part of this equation, and its the one you have MOST control over.
And response is - or should be - totally independent of the threats
since it focuses on preserving and recovering the assets.
I think they have it very, very confused and this isn't the most productive, most effective way of going about it. But then the FBI's view of policing is to go after the criminals, and if you consider the criminals to be the threat then that makes sense.
But lest face it, most corporations and are not in the business of policing. neither are home users.
Which is why I focus on the issue of "what you have control over".
Related articles by Zemanta
- School Spy Program Used on Students Contains Hacker-Friendly Security Hole (wired.com)
- The Top 10 Reports For Managing Vulnerabilities (lockergnome.com)
- FBI searching for 'Flavor Flav Bandit' (seattlepi.com)
- Why Security Vendors are loosing (tech.bl0x.info)
- Editorial: Flawed F.B.I. Background Checks (nytimes.com)
- FBI details surge in death threats against lawmakers (americablog.com)
