Approaching the end of apprenticeship

Time to get summative portfolio ready

Personal out of work project

EDIBLE SNAPS

As part of evidence for my apprenticeship, I have started a new personal project.  My aim is to make this into it's own viable business.

I have started by securing the domain ediblesnaps.com

The business will be an online portal for ordering edible prints.  It is a custom built eCommerce platform which utilise several javascript libraries to produce content that is dynamic, and will utilise training provided by Escalla during my last training week.

There is still prior work to be done before this gets it's first soft launch, but I expect this to happen next week.

Luddite Risk article

Below is my latest article with the aim of publication on our companies Todays Legal Cyber Risk website

Luddite risks and how to solve them 

Etymologically the term luddite is an early 19th Century noun but in modern meaning refers to philosophy opposing technology and is broad in meaning.  Source: wikipedia

Managing risk within a law firm is challenging as it demands multipotentiality i.e the ability to excel in several areas of specialism.  As such people responsible for managing risk in a law firm need to be experts in the companies’ law specialisms, risk management and cyber security.  From a cyber security perspective this creates a luddite risk where technological risks are less likely to be discovered and controls not put in place. The problem was made evident in a recent Australian study carried out by LexisNexis, which highlighted 86% of legal practitioners believe the industry needs to upskill in cyber-security measures.  An example of a recent luddite risk was the IT meltdown at TSB where 1,300 people lost money from fraudsters who took advantage.  In this example the IT infrastructure was implemented by its’ parent company Sabadell, but the ultimate responsibility for the IT meltdown was on the banks’ CEO.  This demonstrates that ultimate responsibility against cyber risk is handled within a multipotential capacity, which further has the potential to cause bottlenecks for putting solutions in place. 

Due to the complexity of law, defining risk is already a challenge, and further luddite risks are often considered an unwelcome challenge.  As cyber criminals become ever more polymorphic it is a challenge that law firms need to address.  The government has already put into place ‘Cyber Essentials’ to help businesses manage these risks, and guidance is offered by the SRA and NCSA, as well as there are multiple insurance products out there to help mitigate risks and help with risk management.   

Solutions that can be put in place for Law Firms: 

Insurance 

• Insurance can be taken that covers first/ third-party reputational costs, cybercrime investigation, data recovery, system restoration, lost income, extortion payments and notification costs. 

Cyber Essentials 

• The government has taken action to help organisations guard against common cyber threats.  The scheme offers two levels 
• The first level is cyber essentials where organisations carry out a self-assessment which is independently verified. 

• The second level is cyber essentials plus where the organisations systems are independently tested, and cyber essentials is integrated into the organisations risk management framework. 

Guidance 

• The SRA offers guidance on their cyber security page: https://www.sra.org.uk/risk/outlook/priority-risks/cyber-security.page 
• The NCSC offers guidance for businesses: https://www.ncsc.gov.uk/collection/small-business-guide 

PHP Development Week

I'm currently building on a personal project for a edible printing website.  I have already developed the dynamic front-end of the website using an array of javascript functionality.  I am now integrating the PayPal payment gateway into the site, and building an SQL database where form data will be submitted.

I have further developed a chart to show how I expect the dynamic content to work once the site is completed.

 

Projects

Projects I am working on

SDLT Calculator - The business has generated a Zoho form which generates a CSV file - My role will be to build a platform which uploads the form to an SQL database.  I would then build a series of PHP conditions built around that which queries the data to produce a 'Stamp Duty Report' which can be printed and sent to the clients solicitor.

Spoofing Platform - Build a platform that sends emails with false headers to take advantage of email protocols that are not protected.  The platform should use pixel tracking to monitor open activity, and have support to check if links have been clicked, and if the user has entered data.  The platform should also provide report generating support.

Spoofing Platform Stage 2 - Create an interface that is accessible to the public that provides templated spoofed emails applicable to the legal industry, and reporting functionality.

LMS Platform - Build a platform using wordpress themes / plugins to provide a Learning Management System for members of the legal sector who are interested in learning about Cyber Security.  This would be an ongoing project and part of my role would be to make sure the system can be customised as the platform is continuously used and developed.

Advanced Persistent Threats

How to tell if the organisation you are dealing with is the victim of an ‘Advanced Persistent Threat’.  These are one of the hardest threats for an organisation to remove and can be extremely difficult to detect even when audited by an external body.  However, your security as a customer of these organisations is significantly impaired as fraudsters are more likely to know their internal procedures and how to exploit them and may have snippets of your personal details that they have access too.

These are threats that are embedded within organisations, often from a previous cyber-attack that could have been carried out years in the past.  The fraudsters understand they are better able to exploit the security vulnerability by remaining undetected over long periods of time.

The company may not have the powers to deal with the threat, the activity is likely to be highly malicious and illegal and compliance with employment laws will restrict the ability of the organisation to deal with the threat.

Within the organisation they will be looking for several indicators:

·         Late night logins

·         Increase in malware stored on computers

·         Data being transferred to single points

·         Large transfers of data externally

·         Usage of flash drives to carry data

·         Increase in spear phishing activity

However, these activities do not necessarily trigger examination from regulatory bodies, a company can have a robust policy framework in place but still have fundamentally malicious activity being carried out from within its system.

So, what to look out for as a customer:

·         Monitor chat forums such as mumsnet.com, thisismoney.co.uk, moneysavingexpert.com

·         An increase in phishing emails

·         An increase in smishing text messages

·         Beware of links in emails

·         Does the company publish a strong anti-fraud message?

·         Does the company act to inform you of what a fraudulent email looks like?

 In truth it is even harder to detect if the company you are dealing with has an ‘Advanced Persistent Threat’.  If the company you are dealing with cannot detect the shortcoming or regulatory bodies are unable to detect the threat, you as a customer are less likely to know.  What is important is that people should be wary of the threat, and take any communication received with some caution.

USA/Iranian Cyber War

Should we be concerned?

What we know?

It was reported by the ‘Washington Post’ on the 24^th June 2019 the Trump Administration launched a cyberattack against Iranian rocket and missile launching systems.  The source of this information is unknown, but it cites current and former U.S Government officials, although Iranian Telecommunications Minister Mohammed Javad Azari has said ‘No successful attack has been carried out by them’.  Spokeswomen Heather Babb has said ‘As a matter of policy and for operational security, we do not discuss cyber-space operations, intelligence or planning’.  In truth we know very little about the reported attack, however cybersecurity companies who regularly monitor increases such as FireEye and CrowdStrike in spear phishing attempts have seen an increase.  It is not clear if this is down to increased awareness or a real rise, but this has been coupled with warnings from the US government including messages such as ‘Non-military targets have greater effect’.  In this case there is a cause to believe that there is a case for increased vigilance, not just for governmental targets but for private sector targets.

What types of attacks should we be looking for?

CrowdStrike have shared images of spear-phishing emails with news agency AP and FireEye have confirmed one that appears to come from the Executive Office of the President seeming to be trying to recruit targets for economics adviser positions.  We also know there is a long history of tensions between the US and Iran, and past attempts from Iran have typically included software to erase data.  We should however give the threat a wide birth as attacks that are often shrouded in secrecy, and as companies typically do not want to give away their security vulnerabilities.  This secrecy is inherent for all sides in cyber-war which breeds anxieties, and although traditional cyber-attacks have been targeting infrastructure targets such as banks and ‘energy supply’ we can expect these targets to broaden.  In the event of a physical war a broader cyber-attack would allow Iran to bring the war home to the USA and allies and inflict harm.  One risk is that they may have already embedded vulnerabilities for ’advanced persistent threats’ that they would exploit if the political situation evolved.

Spear phishing Iranian missile systems

The US government has just tested the power of spoofing/phishing emails with a cyber attack on Iranian missile systems and has reported they were able to disable those systems.  Spoofing/phishing emails are the tool of the average fraudster and is something that can be implemented without someone who is overly technical.  We are not talking of the type of hackers portrayed in Hollywood films we are only talking about the ability for someone to send an email.  If someone can disable missile systems from an email, it is certainly worrying.  In this case however the attacks are spear-phishing whereby malicious software is downloaded and installed.  This would require a certain sophistication and require an infrastructure to understand the systems that the Iranian military use, however in this case the attack may have been aimed at a more general systems sent in large waves.   

We should however be worried as this tactic is used by the average fraudster sending 1000’s of emails every day in the hope that one email will seem legitimate to the right person.  More so in the case of law firms who may receive targeted attacks.  We can protect ourselves by being aware of the types of attacks out there and being hyper-vigilant when a large number of phishing attacks appear in your inbox at any one time and being aware if the tactics people use.  

Researched Mobile News App 

Discovered Wordpress REST API and the support it provides for app development - wordpress is becoming more of an application framework which means that coding for wordpress no longer includes just working with PHP but other languages such as JAVA by writing the code to JSON.

First week with Practical Vision

Familiarisation of company policies

Setup on system