OTR: Why are Phishing Messages so Lame?

I was taking a quick troll through my spam folders this morning to make sure nothing of importance got stuck there before I flush them. I find that Yahoo! does a decent job of catching spam and phishing messages with few false positives, but Google seems to catch a lot of legitimate messages (btw, Google, if I have a rule that tags a message, that should override the spam filter,... just sayin'). I'm easily amused by a lot of the more obvious phishing messages. I've been of the opinion that the people writing these things ought to invest in native English speakers for more effectiveness. But they keep coming, so obviously they are working on some people.

I read somewhere recently, that one theory about why lame phishing messages continue to be sent is that they work. If someone actually bites on one of these, they are clearly not too bright and if they aren't too bright (and usually greedy to boot), they won't overthink the messages that come next. I guess that is one theory. I suppose another is that there are more than a few people who are either naive or extremely trusting souls and they get hooked fairly easily. These are generally the same folks who fall in with con artists and withdraw money from the bank in exchange for an envelope full of stacked newspaper.

At the Day Job, we see the more advanced phishing messages. These are targeted and are called "spear phishing" messages because they tend to selectively target individuals with "bait" indicative of some knowledge of the individual. There's another class of phishing messages referred to as "whaling", which targets high value individuals -- we haven't seen much of that. But even some of the best spear phishing messages are lame. Seriously, why would a C-level executive send you an email from a Yahoo! account? But people clicked away on that because it was "signed" by that exec. It was a low number, but still... and the funny thing is that the phisher could have done a few simple things to disguise the message, but didn't. So I have to think that even the spear phishers are looking for people who are either too harried to really look at email or simply aren't bright enough to realize that they are being phished.

So for today's lesson: Stop. Think. Connect.

ATR: BYO Mobile

It's been a while since I posted last. The iPad experiment continues with varying degrees of success. I haven't completely given up bringing the laptop home, but it certainly stays in the office a lot.

I'm now looking at my cell phones. As some of you know, I'm seldom found without two phones on my hip. One is the personal phone; the other is the work phone. Some of you likely have heard me talk about why I carry two phones, with the punch line being, "I know what my forensics guys can do." My stance to this point has been that I wanted to keep my personal life apart from my work life. Problem is, in this day and age of smartphones, it is quite hard to do. Android phones prefer a Gmail account in order to function properly and that means the work phone has my personal Gmail account on it. And with smart phones, even a couple short generations apart, there is a lot of redundancy. That said, my personal phone is newer and more capable. And with two phones, I have to buy Bluetooth devices that come with dual pairing capability so I can use both phones in the car.

The work phone is about two and a half years old. It is the first Droid. In cell phone terms, it is geriatric. It is somewhat flaky, and periodically needs a factory reset to behave. I keep taking apps off that phone since my personal phone is more useful to me. Now I could go and have the company buy me the latest and greatest, but I'm finding that I don't use the work phone much for phone calls and it seems like a waste of resources simply to have that quasi-separation of personal from corporate. I'm always going to carry my personal phone around with me, so why have to carry two? Just carrying the personal phone also means carrying one phone charger and only having to find a single outlet in a hotel room. It makes for a little less spaghetti in the computer bag.

We're in the process of looking at our BYO policies and the associated risks. My mindset is changing as I spend time thinking about the issues. For quite a while, the concern has been that litigation would mean turning over a phone for forensic examination. That would mean that personal data could get exposed. In some cases, that might be embarrassing and disruptive. But it seems that cell phones are seldom requested in our litigation. And honestly, I would expect that an opposing attorney determined to take a look at a cell phone is also going to subpoena all mobile devices for examination and likely manage to convince a judge that even the target's personal devices should be examined.

The next risk area is loss of corporate intellectual property. While cell phones and tablets can hold a remarkable amount of data, I can go buy a two terabyte hard drive and walk out the door with much more data that I could manage to get from a mobile device. There is certainly a risk, but the risks from other portable / concealable devices are much greater. That said, mobile devices that contain Active Sync enabled email can generally be wiped by the user or a corporate email administrator with a couple of mouse clicks. So if a device goes missing, it is a relatively simple matter to delete the email from the device (although in most cases, the device will be subject to a factory reset, wiping all personal data from the device as well). That is a significant difference from other portable storage devices. For organizations with a much lower risk tolerance relative to theft of data, they will likely ban cell phones and tablets, as well as other storage devices.

Our focus right now is on risks associated with malware. As the hackers out there seek softer targets, they will write more malware designed for cell phones and tablets. The risks here are several-fold: 1) loss of credentials -- loss of your login ID and passphrases that would enable a hacker to get access to your accounts; 2) eavesdropping -- the concern here being the ability for a hacker to listen in on phone conversations or use the phone as an eavesdropping device (while the average employee is not likely to be a target, executives are the biggest concern); 3) leveraging a trusted account -- an attacker taking control of a cell phone or tablet could use the email accounts, IM, or other communications to contact other employees and pass along malicious links or malware-infected attachments that look authentic.

At the same time, I'm not real keen on nuking an employee's phone when they leave, regardless of what the employee agreed to when they signed up for BYO. It seems a little excessive to be that disruptive when all we want to do is kill off the email account. That said, software that creates separate "containers" for corporate and personal data is not inexpensive, and given many competing priorities, is it worthwhile to invest in this software simply to not tick off a former employee? Certainly one argument would be that if the employee is saving the company the cost of the device and service, perhaps the company could deploy some software to preserve the employee's data.

Clearly, every organization has different risk tolerances. Many organizations will find it inconceivable to consider ever allowing a personally-owned device to hold corporate information, regardless of protections, software implementations, policies, and agreements. That's understandable. Certain geographies with restrictive data privacy laws will also find use of personal devices to access corporate data problematic. But I would expect that many organizations will move quickly down this path, with some less thoughtful than others. Point being, of course, that the organization needs to think the issue through and consider their risk tolerance thoroughly.

In my case, I've moved the email container (Touchdown) to my personal phone, along with my RSA soft token. I understand the risks personally, but I'm ok with them. That may change. But the Droid will get nuked in the next few days. And I'll let my forensic guys see what they can do with a nuked cell phone.

More thinking on this topic to follow.

ATR: Changing the Way We Certify

I've been thinking a lot about certifications lately. On my goals for this year, I'll probably try to get a CISSP via the "boot camp" method, as that certification is more relevant to what I do now than the CRM or the CIP. I'm now 20 years a CRM and I plan to mothball that certification. Records Management isn't my primary job responsibility and the annual dues and hassle of doing certification maintenance paperwork isn't necessarily yielding a benefit to me at this stage of my career. I suppose some will rail against me for this stance, but with my job much more focused on information risk and information security, the CRM doesn't quite measure up. Be that as it may, I'd like to throw into the wind some thoughts that I have about certifications.

You've seen some of my concerns about the CIP. I also raised some issues earlier about the CRM. For the former, the bar is probably too low. For the latter, too high. And that got me to thinking... what about a gradated series of records management certifications. It would be an interesting change, but would provide some differentiation for candidates.

I think the CRM is the best candidate for some disassembly.

Level 1: We'll call this the "RRM" or "Registered Records Manager". Candidates who successfully complete the five multiple choice sections of the CRM exam would have this status conferred upon them. This would reduce cycle times and enable candidates to walk away with a designation more quickly. In some respects, this is like the "ABD" (All But Dissertation) that a PhD candidate can post to a CV. Ideally, the candidate would move on, but some might find it a comfortable stopping point wherever they are in their career. This is still differentiated from the CIP by the number of questions and the depth of the questions, but it enables the candidate who isn't ready for the essay exam to walk away with something after a fair amount of work to pass exams one through five.

Level 2: The existing CRM.

Level 3: I'd call this "FRM" or "Fellow in Records Management". That probably needs work, but it is a higher level distinction. It's also going to be very hard to judge. My thinking is that, in lieu of the essay portion of the CRM exam, the candidate would need to write a proper scholarly research paper on some aspect of records management. That means a minimum page length, proper citations, and so forth. It would have to be juried by records managers with advanced degrees and, like a dissertation, I think it would also need to be defended. Probably not as rigorous as a dissertation, but we'd want to see that the candidate did the work. Perhaps the defense could be a session at ARMA where the candidate defends his or her research for an hour with a distinguished panel, and then the audience gets an hour. I'm not sure there are many folks who would run that gauntlet, but I think it would be interesting to try out. I would also suggest that given the rigor of the process, this level of designation would be permanent. The benefit here would be advancing the profession with proper research that would be published.

In addition, the CRM process needs additional specialty designations. At present, there is only the "/NS" for candidates working with records relating to nuclear energy. I'd suggest that there needs to be a "/LS" for the legal profession, "/FS" for financial services (mainly to cover the specialized regulatory environment), and perhaps a "/DP" for a round of questions dealing with Data Privacy. While the last designation would not substitute for the CIPP, I think it could be a nice warm up or even something that the IAPP and the ICRM collaborate on.

ATR: Rant On, Rant Off

A colleague forwarded a job ad to me the other day. Not because he thought I needed a job, but because I suspect that he knew it would initiate a launch sequence in me. Houston, we have liftoff...

I'm going to name names because this job posting is a matter of record and frankly, the institution should be ashamed. The B&O Railroad Museum in Baltimore apparently needs an archivist. However, they seem to have very low regard for archivists. The position pays between $25,000 and $27,500.

Yes, annually. But you do get benefits. To quote another blogging colleague, "Are you kidding me?"

However, you do need to, "...be able to stoop, bend, reach, crouch, climb ladders and lift up to 40 pounds to retrieve, store, and work with objects." And bring a Master's degree and three to five years of experience with you. And just in case you think this is really something of an intern's job, nope -- plan to manage a budget and train and manage interns, docents, and volunteers. And be ready to scrounge up some money by writing grant requests.

I was paid that sort of money in 1988 by the Archdiocese of Chicago with similar experience and responsibilities.

Now we are talking about a non-profit here. I get that. But this is a non-profit organization with over $20 million in assets, a lot of which is physical plant. They have, however, modestly grown their over $9 million in cash and investments each of the past several years. Seeing positive investment growth over the past couple years is something remarkable. I'm sure they work at that. I'm sure that their budgets are relatively tight. But I fear that those results come at the expense of their "professional" staff. I doubt that someone earning the sort of money being offered could afford a decent rental unit in a safe neighborhood in the Baltimore area. How do you pay back the loans for your Master's degree? How do you even try to get ahead? Twenty-some years ago it was difficult to live on that money, even with two adults in the household working.

The problem is that the archival profession is glutted with unemployed and underemployed professionals so there are plenty of people who are archivists who will take any job to build their resume for the "big" job some day. Supply, meet demand. But for a profession that prides itself on generally exclusive requirements for the positions that become available, AND usually require an advanced degree, this pay is insulting.

This is why I shifted from archives to records management. The pay is better. And we have cookies.

I'll also point out that some archivists "get" this. They are embarrassed as well. And they do their best to embarrass institutions that do this sort of thing. This job hasn't made it to the blog yet, but I suspect it will.  http://eatingouryoung.wordpress.com/