We’re getting ready and will have a couple of video clips and other things to keep everyone on top of there game today. The majority of today’s show will be recorded and put up on our web site today and tomorrow, as time allows.

Tuesday January 25, 2011 8:36 jconcannon
9:12 jconcannon: Ask about our Summer Research Position at UAB…

Tuesday January 25, 2011 9:12 jconcannon
9:13 jconcannon: http://www.cis.uab.edu/uabccrimereu is the web site for more details.

Tuesday January 25, 2011 9:13 jconcannon
9:21 jconcannon: Next up will be Mark Cappers discussing the NSA’s 60 minute Network Security Guide

Tuesday January 25, 2011 9:21 jconcannon
9:31 jconcannon: Mark Cappers now on….60 minute guide.

Tuesday January 25, 2011 9:31 jconcannon
9:33 jconcannon: http://www.nsa.gov/ia/_files/support/I33-011R-2006.pdf link for the 60 minute security guide

Tuesday January 25, 2011 9:33 jconcannon
9:43 [Comment From GuestGuest: ]
Joe Power just blippped just rebooted sorry I can go on

Tuesday January 25, 2011 9:43 Guest
9:43 jconcannon: Mark if you can provide the links here please do…

Tuesday January 25, 2011 9:43 jconcannon
9:44 [Comment From Mark CappersMark Cappers: ]
nute Network Security Guide (First Steps Towards a Secure Network Environment) – authored by the NSA’s Systems and Network Attack Center (SNAC) It can be downloaded from here:

Tuesday January 25, 2011 9:44 Mark Cappers
9:46 [Comment From Mark CappersMark Cappers: ]
NSA’s IA/SNAC Security Configuration Guidelines:

Tuesday January 25, 2011 9:46 Mark Cappers
9:46 [Comment From NetDrNetDr: ]
The 60 Minute Network Security Guide is exremely dated. It discusses configuration of Windows 2000. Win 2k was obsolete 6 years ago!

Tuesday January 25, 2011 9:46 NetDr
9:46 [Comment From Mark CappersMark Cappers: ]
The NSA 60 Minute Network Security Guide here: http://www.nsa.gov/ia/_files/support/I33-011R-2006.pdf

Tuesday January 25, 2011 9:46 Mark Cappers
9:55 [Comment From Mark CappersMark Cappers: ]
While the WIndows OS discussed in that document are old/obsolete, the concepts discussed still are relevant, and sadly most of the specifics still apply in more current MS-OS’s.

Tuesday January 25, 2011 9:55 Mark Cappers
9:55 [Comment From NetDrNetDr: ]
Will you be discussing how the Internet Kill Swich would be the largest, most damaging attack on the USA in all history? How: giving the Goverment the capability to stop all citizen speech via the internet would set the USA back to the 1700s.

Tuesday January 25, 2011 9:55 NetDr
9:55 [Comment From Mark CappersMark Cappers: ]
NSA’s IA/SNAC Security Configuration Guidelines: http://www.nsa.gov/ia/guidance/security_configuration_guides/index.shtml

Tuesday January 25, 2011 9:55 Mark Cappers
9:59 Phil F. (IGtv]: The Guidelines Mark mentioned (NSA Configuration Guidelines) are much more current than the 60 Minute Guide. A combination of the two would be quite useful.

Tuesday January 25, 2011 9:59 Phil F. (IGtv]
10:03 jconcannon: Now playing….Andrew Tallmer interview. Case in California. Andrew straightens it out. Let’s listen in.

Tuesday January 25, 2011 10:03 jconcannon
10:04 [Comment From Mark CappersMark Cappers: ]
Thanks for that clarification Phil, that’s precisely it – use the 60 Minute Guide to provide non-security IT and other people a common reference and concepts around security. If you are involved in hardening actual technology, use the specific NSA IA/SNAC Guides as well as looking at things like SANS or CERT for references to best practices.

Tuesday January 25, 2011 10:04 Mark Cappers
10:11 Phil F. (IGtv]: Cell phone? PDA? What’s the difference? Exactly, Joe. And, where will the distinction lie in another year or two? Tablet PCs? The lines of the form factor will blur. How about USB storage devices? (Perhaps not, since there is (today) no concern with volitility of memory. Then again, maybe these will be self-powered in the future…)

Tuesday January 25, 2011 10:11 Phil F. (IGtv]
10:11 jconcannon: Here’s our second segment with Andrew Tallmer….search and seizure

Tuesday January 25, 2011 10:11 jconcannon
10:11 jconcannon: Yes, Phil….these cases Diaz and Murphy are Huge Cases.

Tuesday January 25, 2011 10:11 jconcannon
10:12 Phil F. (IGtv]: There are already folks who have had chips (with information storage) embedded in their bodies. (Ouch! Just thinking about that sounds painful.)

Tuesday January 25, 2011 10:12 Phil F. (IGtv]
10:12 jconcannon: If mutliple Circuits hear similar cases or as Andrew says the Supreme’s weigh in this could really have quite an impact.

Tuesday January 25, 2011 10:12 jconcannon
10:12 [Comment From NetDrNetDr: ]
What coercion is legal to make the arrestee give up the cell phone password?

Tuesday January 25, 2011 10:12 NetDr
10:13 jconcannon: Read the two cases and review the videos with Andrew. This is all established case law.

Tuesday January 25, 2011 10:13 jconcannon
10:14 Phil F. (IGtv]: Expertly conducted cell phone forensics may bypass the need for an access password.

Tuesday January 25, 2011 10:14 Phil F. (IGtv]
10:14 jconcannon: Understanding the legal process is not only important to Law Enforcement, but also to our citizens.

Tuesday January 25, 2011 10:14 jconcannon
10:16 [Comment From NetDrNetDr: ]
Doesn’t sound like the “in plain view” foundation assumption would hold if “Expertly conducted cell phone forensics” are used.

Tuesday January 25, 2011 10:16 NetDr
10:20 jconcannon: if you listen to Andrew talk about Schimmel. Katz, Gant and Belton….you’ll understand how the courts would consider “in plain view”.

Tuesday January 25, 2011 10:20 jconcannon
10:23 jconcannon: Playing the final sesson with Andrew Tallmer on Search and Seizure.

Tuesday January 25, 2011 10:23 jconcannon
10:34 jconcannon: Next up DHS Open source reports…..

Tuesday January 25, 2011 10:34 jconcannon
10:38 jconcannon: January 19,20, 21, and 24th reports…

Tuesday January 25, 2011 10:38 jconcannon
10:56 Phil F. (IGtv]: See more information on NY Metro InfraGard’s Security Awareness Program at https://www.nym-infragard.us/cms/resources/news/1-latest/172-information-security-course

Tuesday January 25, 2011 10:56 Phil F. (IGtv]
10:58 [Comment From Mark CappersMark Cappers: ]
Joe makes a great point here – if you are hit by a exploit or zero day vulnerability you can help yourself a great deal by taking a few minutes and putting together a simple document or presentation or even just an email describing how much man hours would be spent in recovery, and describing the value of the data at risk, if you don’t know the value of the data or system, a quick phone call to the business leaders that use it can be very helpful, and demonstrates proactive involvement.

Tuesday January 25, 2011 10:58 Mark Cappers
11:27 Phil F. (IGtv]: US Secret Service Tips to protect against credit card skimming: http://www.secretservice.gov/Skimming%20Fraud.pdf

Tuesday January 25, 2011 11:27 Phil F. (IGtv]
11:32 jconcannon: Now playing the FBI’s Best in practice CCTV….If you haven’t gotten this DVD or haven’t seen this before contact the FBI or InfraGard and we’ll direct you. Let’s listen in…

Tuesday January 25, 2011 11:32 jconcannon
11:58 jconcannon: That’s our program today. Thank you for joining us and give us some feedback at jconcannon@nym-infragard.us and let us know how we can improve our operations. We look forward to joining you next week on IGtv, a production of NYC Metro InfraGard Members Allance, Inc. Be well….

Tuesday January 25, 2011 11:58 jconcannon

Enjoy

NY InfraGard Team

This is our monthly InfraGard Fraud Alert developed by Eleanor Spring of SAFE (Spring Action Fraud Elimination). Eleanor is a Certified Fraud Examiner.

January 2011: POA (Point OF Sale) Skimming Devices Target Card Readers

Merchants are vulnerable to fraudsters attaching magnetic strip skimming devices to the merchant’s own point of sale systems. Simply replacing a merchant’s POS terminal with one modified by the fraudster to capture a cards magnetic strip and PIN data is all that is needed. A recent study concluded that eighty percent of card data breaches were due to attacks on POS devices.

According to the Secret Service, the crime is responsible for about $350,000 of monetary losses each day in the United States and is considered to be the number one ATM-related crime.
Global ATM Security Alliance estimates that skimming costs the U.S.-banking industry about $60 million a year.

Example: Bank ATM machines are converted to steal identities from banking customer
How is that accomplished? A false card slot is attached over the original card slot; a pamphlet holder carrying a hidden micro-camera is attached to a nearby wall and angled to view the monitor as well as the keypad and transmits wireless photos of them up to 656 feet away.
Example: A Stop & Shop Supermarket in Quincy, Mass. said that some of its customers’ credit and debit card numbers were stolen due to tampering with EFT pin pads at two check-outs in two Rhode Island stores.

How not to become a victim of POS scams.
 Survey your surroundings:
Before making a withdrawal at an ATM,
take a look at your surroundings. Watch for any sort of suspicious
activity and, if anything appears to be out of the ordinary, or if the
ATM is obstructed from view or poorly lit, leave the area and try
another location.
 Keep an eye out for terminal tampering:
If you suspect the ATM or POS terminal you are using has been altered, go to another
terminal.

Signs to watch for include unusual-looking card slots, plastic overlays on the PIN pad, or the appearance of damage.

You can review the video on our web site at: www.nym-infragard.us/cms.

Stay Alert!

Your NY InfraGard Team

Mozilla Corp. plans to add a do-not-track feature to its Firefox Web browser, which could let users avoid having their actions monitored online.

The announcement makes Firefox the first Web browser to heed the Federal Trade Commission’s call for the development of a do-not-track system. The Wall Street Journal reported last year that Mozilla was exploring the development of such a system.

For Firefox’s tool to work, however, tracking companies would need to agree to not monitor users who enable the do-not-track feature. So far, no companies have publicly agreed to participate in the system, but Mozilla urged them to join in.

“Mozilla recognizes the chicken and egg problem,” the company’s newly appointed global privacy and public-policy leader, Alexander Fowler, wrote in a blog post. But, he wrote, Mozilla is asking that websites and advertisers join its efforts to “honor people’s privacy choices.”

Mozilla’s move comes amid growing privacy concerns about the online-tracking industry. Last month, the FTC called for the creation of a do-not-track system and the Obama administration called for an online “privacy bill of rights” focused on the commercial data-gathering industry. Lawmakers on Capitol Hill have said they will examine online-privacy issues this year.

As gatekeepers to the Internet, the Web-browsing-software makers are in the best position to block unwanted tracking. However, the biggest Web-browser makers—Microsoft Corp. and Google Inc.—also operate online advertising businesses that use online-tracking tools. Firefox doesn’t run an ad business but receives the bulk of its funding from an advertising arrangement with Google.

Until recently, the competition between the big three Web browsers focused more on speed and technical features than on privacy tools.

Last month, however, Microsoft said it would revive a powerful privacy feature in its Internet Explorer 9 that would let users stop certain websites and tracking companies from monitoring them.

The Wall Street Journal reported in a front-page article last year that Microsoft removed similar features from Internet Explorer 8 after online advertisers expressed concerns about the impact on their business.

On Monday Google is expected to announced a privacy tool called “Keep My Opt-Outs” that enables users of its Chrome Web browser to permanently opt out of ad-targeting from dozens of companies, according to a person familiar with the matter.

However, these tools still aren’t easy to use. Microsoft’s feature requires users to create a list of tracking companies they want to block. The Google tool is not embedded in its Chrome Web browser. Instead, users will need to download software onto their computer, according to the person familiar with the tool.

The Firefox tool will be embedded in the Web browser, but it won’t be turned on by default. Users will need to check a box to turn on the do-not-track feature.

Once users enable the feature, Firefox would broadcast a do-not-track message to each website a user visits, and to the many tracking companies that are hosted on that website.

Mozilla is asking those who receive the do-not-track request to stop collecting data about the user and stop using that data for marketing purposes. That is one step further than most opt-outs that tracking companies offer, which prevent data usage but don’t prevent data collection.

Mozilla said it isn’t clear if the new tool would be ready to be included in the coming Firefox 4.0 release, or a later version of the software.

—Amir Efrati
contributed to this article.

It’s always interesting when Bill starts talking about the things on his radar screen for industry to be looking at in the year ahead. This New Year will most certainly see increased capacity and speed. The video is posted below however the audio Quality is not up to our normal standards.

Here’s the video:

What’s on your radar screen for 2011? Let us know and later in the year we’ll look back.

NY InfraGard Team

We talked with and interviewed John Phelps from Axis Communications as a part of our monthly update today. John is one of Axis Academy’s trainers who is constantly on the move as he trains with the rest of the training academy staff from East to West Coast here in the US.

Today, John talked about ACP (Axis Certified Professionals). If you’re wondering what Axis Communications is up to you can navigate over to www.axis.com/academy and then get additional information on the certification at: www.axis.com/certification. John acknowledges that other companies in the industry will no doubt be in the business of gaining traction in the certification area which John thinks will help the overall industry improve the installation process as we move forward.

Here’s my interview with John:

There are numerous resources available on the AXIS Communications web site. You can also gain considerable insight by viewing the FBI CCTV BEST PRACTICES DVD. Email: cctvdvd@leo.gov for your copy of the DVD.

NY InfraGard Team

Here’s Bill’s Video:

2010 has been a rough year for a great many companies. Let’s hope as we look out to 2011 some sanity, some stability and steadiness will work its way back into the national discussion and marketplace.

Happy New Year!

Your NY InfraGard Team

As we wind down 2010 we focus on RFID and will continue into the New Year for 2011 working ever closer to understanding RFID and its parts so that we can bring into context a flash email send around the industry a few weeks ago. RFID is Radio Frequency Identification. Its radio transmissions, as Frank Thornton explains in his text, “RFID Security” published back in 2005.

The Context:
Recently, the CEO of Identity Stronghold a manufacturer of protective gear for electronic cards equipped with RFID was interviewed by a subsidiary of CBS News NY. The two-minute video concentrated on several “man in the street” style encounters wherein Identity Stronghold CEO came in close proximity of an individual and stated I bet I can guess what’s in your wallet or words to that effect. In the end, he was equipped with a card reader in a concealed bag and successfully captured card numbers, pins, etc….all contained on the unprotected magnet stripe on the rear of the credit cards.

Consequently, IGtv picked up on an email sent to hundreds of security directors in NYC and sought to verify the contents of the CBS interview and alas we found a SME (subject Matter expert) amongst our ranks…welcome Frank Thornton. Below while we’re trying to get our hands on Frank’s book we sought to get Frank on the show and begin the RFID discussions and then once we had the book take a deeper dive. Here’s the first of the two video’s recorded with Frank, the first is audio with the InfraGard banner and second is the full video. Let’s listen in and start to learn.

Video No. 01

Video No. 02

If you had been on IGtv and live chat you no doubt would come to the same level of understanding as most as RFID is widely, very widely in use today. Our initial discussion began with Wow….you can do that! To well…..okay…. with effort and investment allot can be accomplished, but what about the distance? Identity Stronghold CEO was standing right next to the man in street “victims”? The chat line lit up and now we were given examples of tags in retail department stores that we’re being read from distances of 6-10 feet. Then we thought harder and came up with RFID readers that are mounted on overhead steel structures so that as vehicles pass by at 14 mph at a height of about 20 feet thousands of vehicles per hour can pay “Easy Pass”. The examples starting piling up as our readers no doubt will acknowledge. We ended our discussions on RFID while on the show acknowledging that some readers can accomplish reading 200 mag stripes per minute. Its public knowledge and a part of VISA’s promotion to get its customers to use their credit cards with the RFID chip inside. What they don’t tell you is that the chip is fully exposed and vulnerable to attack.

Over the next couple of weeks we’ll explore RFID and update some folks and just settle in with others. The technology is very useful. But like all useful tools there is both an upside and a downside. Stay with us over the next few weeks and we’ll explore it. We invite your comments and observations as well. InfraGard is all about learning and understanding. Herein we’re re-introducing and learning some things we already know, adding some new things as well as building more value each day.

Thanks

Your NY InfraGard Team

Advertisement

NYC InfraGard welcomes Accretive Solutions as one of our web advertisers. Contact Steven Greenstein at Accretive and let them know InfraGard NYC sent you.

See: www.accretivesolutions.com

Your NY InfraGard Team

The chopper will be on display for the length of the raffle in OCC’s Retail Store and Showroom. The drawing will take place there on March 19, 2011. Full rules and regulations for the raffle can be found online at www.occfoundation.org. Purchase your $25 raffle ticket and select the option to receive this signed photograph of Paul Teutul, Sr. with the FBI Custom Chopper today!

Orange County Choppers Partners with the FBI and InfraGard to Build an FBI-Themed Chopper An Orange County Chopper with an FBI logo was a unique item created for a fundraising effort to support youth anti-violence in Newburgh, New York. The FBI partnered with InfraGard and Orange County Choppers (OCC)—a custom motorcycle manufacturer in Orange County, New York run by Paul Teutul, Sr.—to build a custom-made chopper in support of Newburgh youth. The chopper, unveiled in August, 2010 on the waterfront in Newburgh, attracted a crowd of spectators who waited in anticipation as it made its way down Front Street accompanied by FBI agents and local police. New York State Senator Bill Larkin and Newburgh Mayor Nicholas Valentine joined the crowd along with FBI Special Agent in Charge (SAC) Diego Rodriguez, Assistant Special Agent in Charge (ASAC) Belle Chen, Chairman of the InfraGard National Members Alliance Kathleen Kiernan, InfraGard Community Outreach Chairman Laurie Venditti, InfraGard coordinator and FBI Special Agent Maryann Goldman, and members from the “Center for Hope.”

The FBI, the InfraGard, and OCC are working with Orange County, the Newburgh Police Department, and community organizations on an awareness building and fundraising campaign to help Newburgh youth stay out of gangs and to reduce the violent crime that is synonymous with the gang culture.

SAC Diego Rodriguez, who oversees the Criminal Division in the FBI’s New York Office, was excited to see the arrival of the FBI chopper. “There are approximately one million gang members belonging to more than 20,000 gangs in the U.S. Gangs have long posed a threat to public safety, and gang activity is a problem for cities big and small. In 2009 alone, Newburgh led the state in violent crime per capita. The FBI is proud to partner with OCC and InfraGard National Members Alliance on this unique initiative to reach out to the youth of our communities and help provide them with opportunities to steer their future in the right direction.”

Accepting the bike on behalf of the InfraGard National Members Alliance was Chairman Kathleen Kiernan, who added, “We are pleased and excited to support this project, which we hope will have a positive influence on the youth of this community. Projects such as this reinforce our private sector partnerships with the public and demonstrate for our youth the possibility of a life with limitless opportunities.” “I think it’s vital that we as OCC get involved with the youth anti-violence campaign in Newburgh. This is the community that we all work and live in, and we are committed through our relationship with InfraGard and the city to ensure that kids in Newburgh know that they’ve got options outside of gang culture,” said Paul Teutul, Sr., founder of Orange County Choppers.

OCC also worked with Infragard community partners in Newburgh by donating another custom “Stop-the-Violence” chopper. This chopper, also built by OCC and debuted in August, will be raffled off in March, 2011 by local partners to raise money for a “Center for Hope,” conceptualized and built by InfraGard and community partners in the center of Newburgh for youth at risk of becoming involved in gangs and gang violence. Paul Teutul Sr. helped the kids of Newburgh paint the walls of the “Center for Hope,” which his raffle bike will help to support. The proceeds will help build key educational and recreational programs geared at providing positive alternatives and activities for Newburgh youth and families to help them say no to gangs and violence in their community. The programs, which the kids themselves have identified, include music production, dance, and boxing along with mentoring programs and life skills training, which will teach the kids the self-control, respect, self-confidence, and discipline they need to succeed in life. Both motorcycles were built at the OCC facility in Newburgh. The TLC TV series American Chopper will feature the building of the FBI chopper aired in the September episode. For more information on the FBI’s InfraGard program, please visit www.infragardmembers.org Source: http://newyork.fbi.gov/pressrel/pressrel10/nyfo080910.htm (photos credit: FBI) Program contact Information: Laurie Venditti INMA Community Outreach Chair Venditti@partnerforsecurity.com 917-596-3037 (bb)

The Center for HOPE serves at-risk youth vulnerable to the violence and gang activity in the City of Newburgh. “We’re excited to be kicking off the OCC Foundation with a raffle to benefit the Newburgh youth anti-violence program through the Center for HOPE. With our partnership with the FBI’s InfraGard program, NSAC and others in the community we’re set to get the word out to kids in Newburgh that there are options outside of gang culture,” said Paul Teutul, Sr., founder of Orange County Choppers. Dr. Kathleen Kiernan, Chair of InfraGard’s National Members Alliance added “Community involvement and the building of our future generation of leaders are at the core of both our friendship and our partnership with OCC and the NSAC. Their selfless commitment to the kids makes a difference not only in Newburgh, but to our nation as well”.
Raffle proceeds will help to build key educational and recreational programs geared towards providing positive alternatives and activities for Newburgh youth and families, helping them resist gangs and violence in their community. The programs, which the kids themselves have identified, include music production, dance, and boxing along with mentoring programs and life skills training that teach kids the self-control, respect, self-confidence, and discipline they need to succeed in life.
Tickets for the “Stop the Violence” chopper raffle can be purchased at www.occfoundation.org or by calling 1-877-608-BIKE. The chopper will be on display for the length of the raffle in OCC’s Retail Store and Showroom. The drawing will take place there on March 19, 2011.
Full rules and regulations for the raffle can be found online at www.occfoundation.org.
Purchase your $25 raffle ticket and select the option to receive this signed photograph of Paul Teutul, Sr. with the FBI Custom Chopper today!
www.infragardmembers.org
Raffle Bike
Receive this signed photograph of Paul Teutul, Sr and the FBI Bike!

In our continuing evolution and discovery on the video analytics topic this week was a continuation of a two-part look at advanced video analytics. Mr. Hackett is a very candid CCTV professional who comes right out front in stating that everyone involved really has to manage their expectations. One of the ways to do this is to make sure you have all the right players at the table…..so a nice short list would be the security director, facility vp, risk management, operations and of course the vaulted Information Technology professionals where no doubt a lot of this application is going to reside.

It makes perfect sense to call in Law Enforcement or get a solid former law enforcement professional who can also sit in on the discussions so that outside expectations are also considered and weighed as you consider what the total application will cover. This way in the event that an incident occurs your staff will be trained and fully aware of what the government expectations are. Careful viewing of the FBI’s CCTV best practices DVD should be a requirement for everyone in the pre-planning phases. This DVD has been done to aid you in understanding what’s expected. Companies and agencies can also take advantage of NYPD’s Crime Prevention Surveys and DHS’s Protective Security Advisors who also will do a site assessment.

Here is Anthony’s Video:

The video analytics topic will continue until the end of December 2010. After which we will look for monthly updates from Aimetis. The first Tuesday of the month you’ll hear from AXIS Communications on camera technology, Aimetis Inc on Video Analytics and as we move into January we will turn our sites at DVR and NVR technology.

If there is a specific topic in the CCTV area you would like us to cover, do let us know.

Thank you

NY InfraGard Team