Go into any leadership meeting and talk about I.T. and you will start to hear a lot about security. The discussions can get emotive, with the IT guys getting hammered about the security of their servers, networks, etc.
However, I perceive there are growing risks elsewhere simply because of the numbers of laptops being carried around the world by YWAMers. For many of us, it is our portable office. Recently a laptop was stolen in a country from one of our international senior leaders and I shudder to think about what was on his hard drive. Best case scenario is that the hard drive was wiped and the hardware was sold on. Worse case... (insert scenario here)
That's one issue, but another issue that I have been reading more and more about is "Evil Twins". http://en.wikipedia.org/wiki/Evil_twin_(wireless_networks) Do a bit of travelling with YWAMers and they constantly look for free WiFi access to check emails, etc. The trouble is, this is becoming more and more of a risky game with hackers setting up rogue access points simply for the purpose of harvesting information. Airports, coffee shops, even computer security conventions are becoming targets.
I suggest we need to start to educate users that just because a WiFi connection is open, it doesn't mean it is safe or legitimate. If in doubt, they need to tunnel everything through a VPN tunnel or just wait until they can connect through a trusted source.
I don't even trust wireless WEP encryption any more either. One of the largest security gaffs in the last couple of years was through someone hacking into TK Max's (a big department store) network by cracking one of their wireless WEP connections at a store. They just sat out in the parking lot of the store, monitored traffic and then went home to have fun. For many months they were undetected because they came in through "secure means". They set up new user accounts, installed rogue software and harvested tonnes of credit card info. Throw your expensive firewall out the window because the hackers had login details and other information to walk right in the front door of your network!
Personally, I do not use a public wireless or WEP encrypted connections without tunnelling everything through VPN. VPN is relatively cheap and easy to set up and I don't know of any other practice that gives some level of protection to mitigate this risk, but would be interested in any other potential solutions.
Comments
Educating the leaders
Dear Donovan,
I think you are spot on with these security thoughts. The risk of theft is huge with a laptop. For example, how many YWAMers even have a security strap that they use with their laptops?
We have been writing about this on the KnowledgeBase (http://www.ywamkb.net/kb/index.php/Laptop_Security) and investigating encrypted filesystems etc. It is not impossible these days to buy completely encrypted Windows systems and to set up an encrypted filesystem running the latest Ubuntu is childsplay.
However, how on earth are we going to educate the GLT and senior leaders to take this seriously? You are talking about 10-40 hours of training to do it well. That is the most important question and one that leads us to ask other questions such as what really is our training ethos for leadership? (I mean in-house, not U of N) I personally think our training is wildly insufficient and leaders at all levels suffer for lack of it. I pray and rack my brains for solutions! Please add your thoughts the the KB article. I hope if we can write about it well enough we will have a resource to begin teaching from.
Cheers,
Kevin
PS WEP has been broken for a very long time. I only use WPA or WPA2.
Educating _everyone_
I definitely agree that education is very, very important. However, I think that the security education needs to be for all staff, and not just leaders. What good does it do if a base director's laptop is secure, but he has sent sensitive info via email to staff members who use lousy passwords? I too have been in very lively conversations concerning security, and have found that some of the biggest difficulties come from the myths that many YWAMers have about security. Myth #1: Substituting "key words" is an acceptable alternative to using encryption. Lol!
This reminds me of a project I've been working on in short spurts over the past three months. I am writing a guide to public key encryption, with average non-geeks as the target audience. My goal is to write a guide in such a way that it is easy to understand, and has sections explaining how to use the appropriate software for Windows, Mac and Linux. If anyone would be interested in working with me on this project, I'd love to hear from you!
My Key
By the way, if anyone wants to contact me regarding this project, you can get my public key from the address below.
http://keyserver1.pgp.com/vkd/DownloadKey.event?keyid=0x2731ABF2284005FE
Encryption
My recently acquired Thinkpad has FDE (full drive encryption) built in. This is hardware based and is supposed to not have any performance effect. Windows Vista Ultimate has a software drive encryption solution as well apparently. There are more than these two obviously and the good news is that this is becoming more and more common.
While doing some googling around on Evil Twins I found this software which is for Anonymizing your web surfing, but also has an SSL tunnel which would protect connecting on public WiFi. If someone doesn't want to set up VPN, the cost on this isn't too bad at $29/year. http://www.anonymizer.com/consumer/threat_center/evil_twin.html
I do/did like pgp, but I could count on one hand how many others used it. The GNU Windows PGP utility even worked with Outlook 2007!
I'll try to write some stuff on KB this week. :)
TrueCrypt, et. al.
Another good encryption tool I've found is TrueCrypt, which is an open source project. It supports Windows, Mac and Linux, and is very easy to use.
As far as the encryption built into Windows and Mac, I think caution is best where they are concerned. It is old news that Microsoft has given the keys to their encryption to the FBI. If that is a bad thing or not is the subject of a much more political conversation, but what other national governments might Microsoft made deals with? The same question goes for Mac. Regardless of one's opinion of if those systems are good or not, the fact remains that when it comes to the security of truly critical data, you cannot trust a technology that isn't transparent.
good point
You bring up a good point. (Another good point is, where is my article from last night? Good thing I wrote it offline and hopefully I can paste it in again...) I guess there are always rumors going around with who is giving what sort of information to governments and/or their secret services. It sounds a little bit like James Bond but really who can tell what is going on. The same is with Google, Yahoo, etc. Skype apparently has a "special" version for China so that the gov't can listen and read.
At the end it could all turn out wrong. Although, Google already officially confirmed to have worked together with some gov't departments. But I would say that no one really knows the full extend of their "partnership" and most likely not even the full potential of such a thing.
I for one don't trust Google with my email, or other information for that matter, and I don't trust MS or Apple to handle my data securely on my own computer.
Greetings from the MatriX,
neo
IT security
We have discussed that multiple times here, I believe. It's really an important topic and I think most people are seeing security mainly as a hassle or even as an assault on their ego. "What means I need more security measures, you think I can not take care of my laptop or am not careful enough with passwords or you think I would not realize an attack on my computer..." etc etc etc.
Of course no one says it exactly like that. But this is often the attitude of people. The problem is that most people don't have an understanding of that stuff. This is not because they are stupid but because there is not enough teaching around for the average non-techie. Techie magazines and web sites cover that topic pretty well and often and most techies like me have at least a basic understanding.
But IMHO the rest of the magazines etc. don't cover that topic really well. Talking about having good passwords, using a virus scanner and a firewall isn't quite enough. From my experience most people think that when you have a virus scanner and a firewall and you need to provide a password to log in to your computer you are safe. That, at least, is not safe in a terms of traveling with a laptop and connecting to unknown wireless hot spots and for sure not safe in terms of exposure of data in case of theft.
I mean, just put a hard drive in an external case and you can connect to it without needing a password. I guess most people are not aware of that. There is not even a need of hacking. Well, only a hardware hack, if you want to say so.
I guess, as techie we need to find ways to explain the reason for security, what kind of protection can prevent against what scenario, etc. But also what security measures does not really help or is insufficient for what reason. Well, everyone understands that you don't leave your bank card with the number on a sticker on it on the dashboard of your car and leave the door open when you "quickly" jump out of the car to get some goodies for morning tea in a bakery. Everyone would know that this is silly. Even that locking the door doesn't really prevent people from getting into your car to grab the card. Everyone would be aware of the potential dangers of that without further explanation.
We need to get to the same point with IT security. If, with all the gained knowledge and understood implications, people still decide to "leave the door open and place the bank card on the dash board" this is another problem. (Why do IT folks always come up with a car analogy???)
So, what I probably would do is something along the lines of the following:
If someone needs an email address that doesn't indicate any sort of Christianity (e.g. someone who travels frequently or works in restricted and/or controlling countries) that is another matter, of course, and needs to be discussed separately. But then it's not enough to have just one email address for this person.
Greetings from the MatriX,
neo
PGP/GPG
Good points Neo. Speaking of PGP/GPG, do you have any experience with ether of those on Windows or Mac? I plan to write the Linux/GNOME section of a guide, but I'll need someone to write the parts for Windows and Mac.
re: PGP/GPG
Unfortunately I don't (yet?) have any experience with Macs and Windows. We don't have any Win in the office and I don't boot my Windows really anymore. Well, every once in a while to test a website but that's really it.
But at least if one uses Thunderbird I guess it's pretty much the same procedure for all OSs. Since it's an add-on for Thunderbird it should be same everywhere. But if I get a chance I'll try to set it up.
Also, another challenge with that is how to transfer the public and private keys to another email client and/or machine. E.g. I'm thinking of starting to use Kontact and also I have a laptop and a desktop. Of course I don't want to have 20 different GPG keys.
So, when I get a change to do it then I'll report back how easy (or not) it was.
Greetings from the MatriX,
neo
PGP/GPG
A guide to the Thunderbird plugin would probably be useful, though the main part of the guide will need to be made independent of any email client, as a lot of people (myself included) use web-based email.
On a side note, I'd recommend that anyone maintaining their own private key use Truecrypt to protect it, and with a strong password. If you password gets confiscated/stolen, you don't want the person who took it to have easy access to your private key.