Welcome!

@CloudExpo Authors: Yeshim Deniz, Liz McMillan, Elizabeth White, Zakia Bouachraoui, Pat Romanski

Related Topics: @CloudExpo, Cloud Security, @ThingsExpo

@CloudExpo: Blog Post

What ‘Mr. Robot’ Can Teach Us About Incident Response | @CloudExpo #IoT #Cloud #Security

It is not often that movies and television shows give viewers the opportunity to explore the world of hacking & digital security

It is not often that movies and television shows give viewers the opportunity to explore the world of hacking and digital security in a realistic manner. After two seasons, "Mr. Robot" has attracted its share of IT professionals as well as average citizens. The show has offered numerous depictions that are of particular interest to those who make their living by protecting their organizations.

The critically acclaimed television series offers fictional situations rather than documentary evidence. However, the plots and actions of both the security engineers and hackers are realistic enough that they can send a shiver down the spine of any professional responsible for safeguarding their organization's system and responding to incidents. This two-part post explores some of the most chilling incidents depicted on the show - incidents that are especially disturbing because they can and do happen in the real world.

People Are the Weak Link
Employees are walking, talking cyber-risks. Sometimes they commit breaches out of anger or because they have been offered payment for sensitive data. At other times, they are innocent pawns or fall victim to a phishing attack. For example, in one episode of "Mr. Robot," Elliot is able to gain physical access to Steel Mountain by manipulating an eager-to-please employee. Elliot himself is an example of an employee who is working to sabotage his employer. One of the worst things about insider hacking is that it can be months or years before it is detected. Controlling access and permissions by employee can help as well as keeping a log of everything that comes in and goes out over the network.

Passwords Present Problems
Users prefer to select passwords that they can easily remember and, in many cases, they use the same password or a slightly modified form of it for all of their sites. If the password is difficult to remember, the user will probably write it down. In one episode, an attorney kept the password to her email account on a sticky note on her desk. In case you're wondering whether users are still playing fast and loose with passwords, you need only check SplashData's list of the worst passwords found in 2 million leaked passwords. Despite compiling and publishing the list annually, the password "123456" still tops the list, followed by "password," "12345678," and "qwerty." Security professionals must be more proactive about training users in the selection of easy-to-remember but hard-to-guess passwords, keeping passwords private and choosing different passwords for every platform.

There Are Times When Being Social Is a Mistake
It is amazing what you can learn from many people's Facebook pages. Information such as their mother's maiden name, the users' date of birth, names of children, favorite pet and much more is often posted for all to see. In many instances, this is all the information that a hacker needs to respond correctly to a secret question in order to have the password reset. Hackers can also use the information to guess passwords. In one episode, Elliot is able to access his therapist's accounts by guessing that her password was a combination of her birth year and the name of her favorite musical artist. However, Elliot has also been able to glean information over the phone and in person by misrepresenting himself.

Never Expect Privacy from a Public Network
In the very first episode, Elliot exposes the manager of a coffee shop as the owner of a website featuring child pornography. He discovered the truth by observing the manager's activities through the coffee shop's public Wi-Fi network. With just a bit of free software and a little technical knowledge, intercepting people's activities is relatively easy on an unprotected network. Employees should be warned to avoid using public networks to access email accounts or conduct other activities that could leave their personal data exposed.

Skimping on Security Investments Is a Mistake
In one episode, Elliot winds up in a hospital, and it's revealed that he chose the hospital because of its one-person IT department that operates on an inadequate budget. He has no problem hacking the hospital's database to alter records. Organizations that do not make the necessary investments in personnel and hardware could suffer a similar fate, especially if they do not bother to keep software updated.

More Stories By Rishi Bhargava

Rishi Bhargava is Co-founder and VP, Marketing for Demisto, a cyber security startup with the mission to make security operations - “faster, leaner and smarter.” Prior to founding Demisto, he was Vice President and General Manager of the Software Defined Datacenter Group at Intel Security. A visionary and technology enthusiast, he was responsible for delivering Intel integrated Security Solutions for datacenters.

Before Intel, he was Vice President of Product Management for Datacenter and Server security products at McAfee, now part of Intel Security. As an intrapreneur at McAfee, he launched multiple products to establish McAfee leadership in risk & compliance, virtualization, and cloud security. He joined McAfee by way of acquisition in 2009 (Solidcore, Enterprise Security Startup). At Solidcore, he was responsible for Product Management and Strategy. As one of the early employees and member of the leadership team, he was instrumental in defining the company's product strategy and growing the business.

Rishi has over a dozen patents in the area of Computer Security. He holds a BS in Computer Science from Indian Institute of Technology, New Delhi and a Masters in Computer Science from University of Southern California, Los Angeles. He is passionate about new technologies and industry trends and serves as an active advisor to multiple startups in silicon valley and India.

Comments (0)

Share your thoughts on this story.

Add your comment
You must be signed in to add a comment. Sign-in | Register

In accordance with our Comment Policy, we encourage comments that are on topic, relevant and to-the-point. We will remove comments that include profanity, personal attacks, racial slurs, threats of violence, or other inappropriate material that violates our Terms and Conditions, and will block users who make repeated violations. We ask all readers to expect diversity of opinion and to treat one another with dignity and respect.


CloudEXPO Stories
The now mainstream platform changes stemming from the first Internet boom brought many changes but didn’t really change the basic relationship between servers and the applications running on them. In fact, that was sort of the point. In his session at 18th Cloud Expo, Gordon Haff, senior cloud strategy marketing and evangelism manager at Red Hat, will discuss how today’s workloads require a new model and a new platform for development and execution. The platform must handle a wide range of recent developments, including containers and Docker, distributed resource management, and DevOps tool chains and processes. The resulting infrastructure and management framework must be optimized for distributed and scalable applications, take advantage of innovation stemming from a wide variety of open source projects, span hybrid environments, and be adaptable to equally fundamental changes happen...
For years the world's most security-focused and distributed organizations - banks, military/defense agencies, global enterprises - have sought to adopt cloud technologies that can reduce costs, future-proof against data growth, and improve user productivity. The challenges of cloud transformation for these kinds of secure organizations have centered around data security, migration from legacy systems, and performance. In our presentation, we will discuss the notion that cloud computing, properly managed, is poised to bring about a digital transformation to enterprise IT. We will discuss the trend, the technology and the timeline for adoption.
Bill Schmarzo, Tech Chair of "Big Data | Analytics" of upcoming CloudEXPO | DXWorldEXPO New York (November 12-13, 2018, New York City) today announced the outline and schedule of the track. "The track has been designed in experience/degree order," said Schmarzo. "So, that folks who attend the entire track can leave the conference with some of the skills necessary to get their work done when they get back to their offices. It actually ties back to some work that I'm doing at the University of San Francisco which creates an "Outcomes-Centric Business Analytics" degree." Bill Schmarzo, author of "Big Data: Understanding How Data Powers Big Business" and "Big Data MBA: Driving Business Strategies with Data Science" is responsible for guiding the technology strategy within Hitachi Vantara for IoT and Analytics. Bill brings a balanced business-technology approach that focuses on business ou...
CloudEXPO New York 2018, colocated with DXWorldEXPO New York 2018 will be held November 11-13, 2018, in New York City and will bring together Cloud Computing, FinTech and Blockchain, Digital Transformation, Big Data, Internet of Things, DevOps, AI, Machine Learning and WebRTC to one location.
Wooed by the promise of faster innovation, lower TCO, and greater agility, businesses of every shape and size have embraced the cloud at every layer of the IT stack – from apps to file sharing to infrastructure. The typical organization currently uses more than a dozen sanctioned cloud apps and will shift more than half of all workloads to the cloud by 2018. Such cloud investments have delivered measurable benefits. But they’ve also resulted in some unintended side-effects: complexity and risk. End users now struggle to navigate multiple environments with varying degrees of performance. Companies are unclear on the security of their data and network access. And IT squads are overwhelmed trying to monitor and manage it all.