Computer and Information Security
--Originally published at Mr. Robot's Imaginary Friend
Go check out the collaborative blog post that we have done about security countermeasures! It is a really interesting subject!
https://lazynesstothemax.wordpress.com/2016/11/24/you-have-activated-my-trap-card/
--Originally published at Mr. Robot's Imaginary Friend
In the Internet nowadays there are a lot of risk and it is important to know them and what they’re capable of doing to your computer and some things you can do to avoid them.
Check out my collaborative blog with Gabriel about this subjects:
--Originally published at Mr. Robot's Imaginary Friend
Various wireless security protocols were developed to protect home wireless network. These wireless security protocols include WEP, WPA and WPA2, each with their own strengths and weaknesses. In addition to preventing uninvited guest from connecting to your wireless network, wireless security protocols encrypt your private data as it is being transmitted over the airwaves.
Wireless networks are inherently insecure. In the early days of wireless networking, manufacturers tried to make it as easy as possible for end users. The out-of-the-box configuration for most wireless networking equipment provided easy (but insecure) access to a wireless network.
Although many of these issues have since been addressed, wireless networks are generally not as secure as wired networks. Wired networks, at their most basic level, send data between two points, A and B, which are connected by a network cable. Wireless network, on the other hand, broadcast data in every direction to every device that happens to be listening within a limited range.
The most common protocols for wireless security are:
--Originally published at Mr. Robot's Imaginary Friend
A network has been defined as any set of interlinks lines resembling a net, a network of roads an interconnected system, a network of alliances. A computer network is simply a system of interconnected computers.
Network Security is an organization’s strategy and provisions for ensuring the security of its assets and of all network traffic. Network security is manifested in an implementation of security hardware and software. There are three things that defines:
The policy is the principal document for network security. Its goal is to outline the rules for ensuring the security of organizational assets. Employees today utilize tools and applications to routines and focuses on the safe enablement of those tools to its employees. The enforcement and auditing procedures for any regulatory compliance an organization is required to meet must be mapped out in the policy as well.
Most definitions of network security are narrowed to the enforcement mechanism. Enforcement concerns analyzing all the network traffic flows and should aim to preserve the confidentiality, integrity and availability of all systems and information on the network. These three principles compose the CIA triad that I talked about in previous post.
Strong enforcement strives to provide CIA to network traffic flows. This begins with a classification of traffic flows by application, user, content. All applications must be first identified by the firewall regardless of port, protocol, evasive tactic or SSL. Proper application identification allows for full visibility of the content it carries. Policy management can be simplified by identifying and mapping their use to a user identity while inspecting the content at all times.
The concept of defense in depth is observed as a best practice in network security, prescribing for the network to be secured in layers. These layers apply an assortment of security controls to 
Continue reading "Making network security great again" 
--Originally published at Mr. Robot's Imaginary Friend
I have talk a lot in previous post about the importance of the information that it’s on the internet and who have access to this information, this is why the authentication and access control is really important.
Modern computer systems provide services to multiple users and require the ability to accurately identify the user making the user making request. In traditional systems, the user’s identity is verified by checking a password typed during the login, the system record the identity and use it to determine what operations may be performed.
The process of verifying the user’s identity is called authentication. Password-based authentication is not suitable for use on computer networks. Passwords send across the networks can be intercepted and subsequently used by someone else to impersonate the user. In addition to the security concern, password based authentication is inconvenient, user doesn’t want to enter password each time they access the network service, this lead to use of even weaker authentication.
An authentication factor is a category of credential used for identity verficatiion. The three most common categories are often described as something you know, something you have and something you are.
Strong authentication is a commonly used term that is largely without a standardized definition, for general purposes, any method of verifying the identity of a 
Continue reading "Let me in, I swear it’s me!" 
--Originally published at Mr. Robot's Imaginary Friend
Anyone can become a hacker, you may just be someone who spends too much time with computers and suddenly you find yourself submerged in the world of cyber-security. There are three types of hackers that I will be talking about, the first one is the black hat that.
Black hat hackers have become the most known image of all hackers around the world. The world hacker for most of the computer users has become a synonym for social misfits and criminals. This is just an injustice created by our own interpretation of the mass media, so it is important for us to learn what a hacker is and what a black hat does.
Black hat is a term used to describe a hacker who breaks into a computer system or network with malicious intentions and uses his skills with criminal intent, for example cracking bank accounts, stealing information to be sold in the black market or attacking computer networks of an organization for money.
Some famous cases of black hat hacking include Kevin Mitnick who used his skills to enter the computer of organizations such as Nokia, Fujitsu, Motorola and Sun Microsystems, Kevin Poulsen, who took control of all the phone lines in Los Angeles in order to win a radio contest for a Porsche.
There are professionals that have knowledge about security and vulnerabilities in many platforms and applications, and their goal is to identify and fix their potential threats on their system, those are the ethical hackers or white hat hackers. An ethical hacker attempts to bypass system security and search for weak points that could be exploited by black hat hackers, then this information is used by the organization to improve their system security trying to minimize or eliminate any potential attacks.
For hacking to be 
Continue reading "Now… Let’s talk about the other kind of hackers…" 
--Originally published at Mr. Robot's Imaginary Friend
Credentialing is the process of establishing the qualifications of licensed professionals, organizational members or organizations, and assessing their background and legitimacy.
In the Computer security or Information security fields, there are a number of tracks a professional can take to demonstrate qualifications. Four sources categorizing these, and many other credentials, licenses and certifications, are:
Quality and acceptance vary worldwide for IT security credentials, from well-known and high quality examples like a master’s degree in the field from an accredited school, CISSP, and Microsoft certification, to a controversial list of many dozens of lesser known credentials and organizations.
In addition to certification obtained by taking courses and/or passing exams (and in the case of CCSP , demonstrating experience and/or being recommended or given a reference from an existing credential holder), award certificates also are given for winning government, university or industry sponsored competitions, including team competitions and contests.
--Originally published at Mr. Robot's Imaginary Friend
The ethics are a really important factor when it comes to the computer security because they often have access to confidential and knowledge about users and companies’ networks and systems, so obviously that power can be abused even unintentionally , would you like all your information or the informations from your bank account spread all over the internet?
It is amazing that most of the jobs from this area of IT don’t really need a training, in fact most of them don’t even realize that their job involves ethical issues, and the training they get is only focus on technical knowledge.
There are known histories about “black hat” hackers, this is a term used to refer the hackers who use their skills to break into systems and access data without permission of the owner, I will talk about this subject in another blog, who got jobs in big companies by showing them how does they attack them and where their security is failing, this in my opinion comes in a little of a gray area.
When do we establish the line? What’s wrong? What’s right?
By this time, we all know about the big scandal about NSA having access to all our information, conversations, emails, etc, that we have online or we at some point send, this obviously with purpose of trying to keep the citizens save, but this is really the way? I mean they have so much information at their disposal that is almost impossible to actually go through all that data.
Another type of ethical problem that the persons in charge of the computer security have to deal with is the budget, what would you do if your boss tells you to cut off some of the security measures that you recommended and this will cause that 
Continue reading "Hey wait, that was supposed to be private" 
--Originally published at Mr. Robot's Imaginary Friend
In this post I will be exploring about one of the fundamental concepts of security that should be familiar with most security professionals or students, that is common known as the CIA triad.
In this context CIA is not referring to Central Intelligence Agency. CIA means Confidentiality, Integrity and Availability, many security measures are designed to protect one or more of these.
If you talk about confidentiality of information, you are talking about protecting the information from been access by someone unauthorized.
As I have said before in other post information is one of the most valuable things nowadays, because bank account, personal information, government documents are things that you don’t want to be public or have no security. That’s why protecting information is a very important part of information security.
One of the simplest ways to keep something confidential is to DON’T HAVE IT ONLINE! If you really need to have this information on the Internet or your computer then the best way to protect this kind of information is encrypting, I won’t talk about this subject deeply because it’s going to be a subject for another post, when this post is publish I will add the link to it here.
This refers to protecting information from being modified by someone without authorization.
The modification of information could be something really bad for you, if the information that is modified is your bank account, where you supposed to have $1000, but actually you “transferred” all of your money to someone’s account, prove this was a mistake will be really annoying for you.
A way to prevent this is to use GPG to digitally sign your data, files, etc. You could potentially hash all your information, but that will be a pain because to dehash it, you would
--Originally published at Mr. Robot's Imaginary Friend
Nowadays the security is a really important matter because most of our information is online, our privacy is almost none existent.
I made a collaborative work with some friends talking about the importance of security, so go check it out!
How can protection be real if absolute cyber security is not real? #JadenSmith
