23 July 2016

This was a really exciting week. I got lots of phishing and spear phishing mails. Attached at the spear phishing mails were Trojan downloaders disguised as invoices. All downloaders were programmed in JavaScript, and as always, the actual download commands and URLs were hidden in a haystack of JavaScript function definitions. And the scripts were all zero-days! It seems as if the cyber criminals are back from a relaxing holiday.

Yesterday evening, I started reading the Air Force Doctrine Document 3-12, Cyberspace Operations. The doctrine documents are definitely worth reading, in particular if one develops a cyber defense strategy for a company or a governmental organization. Appendix A states the 10 Commandments of Cyber Security which everyone should know:

APPENDIX A – TEN THINGS EVERY AIRMAN MUST KNOW

1. The United States is vulnerable to cyberspace attacks by relentless adversaries attempting to infiltrate our networks at work and at home – millions of times a day, 24/7.
2. Our adversaries plant malicious code, worms, botnets, and hooks in common websites, software, and hardware such as thumbdrives, printers, etc.
3. Once implanted, this code begins to distort, destroy, and manipulate information, or “phone” it home. Certain code allows our adversaries to obtain higher levels of credentials to access highly sensitive information.
4. The adversary attacks your computers at work and at home knowing you communicate with the Air Force network by email or by transferring information from one system to another.
5. As cyber wingmen, you have a critical role in defending your networks, your information, your security, your teammates, and your country.
6. You significantly decrease our adversaries’ access to our networks, critical Air Force information, and even your personal identity by taking simple action.
7. Do not open attachments or click on links unless the email is digitally signed, or you can directly verify the source—even if it appears to be from someone you know.
8. Do not connect any hardware or download any software, applications, music, or information onto our networks without approval.
9. Encrypt sensitive but unclassified and/or critical information. Ask your computer security administrator for more information.
10. Install the free Department of Defense anti-virus software on your home computer. Your computer security administrator can provide you with your free copy.

Gen Norton A. Schwartz, Chief of Staff, US Air Force

“Defending Our Networks and Our Country”

If your company hasn’t communicated the 10 Commandments of Cyber Security to the employees yet, just adapt the above rules and off you go!

Have a good weekend.