What actually means the security and certifications?

Kimmo Huosionmaa

When some people come to make certificates about companies they normally show the people, who they really are. They are formers of their companies or other organizations and they show that position with some identification card. They will go around the workgroup, and also talk with the people. Those consults mission is to get all information about their target organization, and also find out weaknesses about it. This is what the real consults do in the real life.


They don’t hide behind some code names or if they use code name the organization contact information and homepages are able to find in the public place. When we are talking about security checks, we must realize that no firm in the world leaves to one source. They use also official members, who have identification cards and the stealth-operators, who work invincible. That deals mission is to ensure, that those persons who authorize certificates get the right information about the target organization. And also security personnel must patron in the area by physically and using electronic equipment. That is calling “the offensive security”. The security personnel wants to patrol all the time in their workspace and make the sudden tests how the security works in the company.


That is important when certifications are given for training or educational purpose. There is a risk that those companies just take the money don’t make any educations. And that might cause the situation, that the trust of that certificate and systems decreases. Educational certificates are normally given for some specific system, and they are controlled by the organization, what delivery of the system. And if those systems don't work good, the result might be devastating for that organization business. Here we must say that the golden rule of the security analyses is “the quieter you become, the more you are able to hear and see”. That motto is from Kali-Linux homepages.


That is because if there are some problems, those people can contact to their boss to inform that person of those things. And of course, they will inform if something disturbs them. They don’t call to target organization couple of days later and tell the people, that somebody disturbs them when they want to speak with senior specialists. Also, the report what those people, will make is always public. Or at least there is the couple of words to say about it. The target organization chief normally mentions what kind of picture they got from the organization and its workers.


Sometimes there are so-called fake certificate makers who are possibly some unemployed persons, who are from another country. They think that if that person is coming from other country and speaks foreign languages, the target organization will not doubt them. That is the legendary trick what is used in industrial spying and stealing the information. That’s why those companies what offers that kind of service must have strong background checks, and they must show their authority of the certificate.


A couple of persons from the United States will come to the workplace and then they will take photographs and collect the information about target organization. And when there was wait for the report, it won’t come on the time, and after the reclamation, there was no that kind of company even exist. That is the lesson, what everybody must always remember when there is coming to some certificate to the company.

Devil's best trick is to claim, that he is not exist

Kimmo Huosionmaa

When we are talking about intruders of data systems, we must know that those intruders might be people who have spent years in the system, before they begin to leak information. This kind of intruder is harmful and hard to remove because he or she had become a member of the team. And that's why those sleepers are very hard to locate and isolate. Many people noticed that is written with spy term, what is in John  Lé Carre's novels.


Those methods are used in everyday life of industrial spying and information stealers world. A methodology of this kind of operation is, that when spying organization will get one person to the certain position of the system, he or she can make very much harm to that system. An agent might use harassment as a weapon with fumigate other workers out of their job and replace them with people like him or herself. That's why in systems must use offensive security, where security workers work undercover that they see what really is going on in their system.


That real-life sleeper is an agent who is put in the system, and that way make very much trouble to his or her clients. The best place to put that sleeper is some antivirus software company's coder, where that person can pollute many systems with malware code. Agent means a hostile operator, who works against companies interests. Normally those agents are very social and people want to believe their stories about how fine workers they are. But when we are talking about agents, we must realize that those persons are more often normal criminals that some governmental workers.


They might work for some criminal organization, what is led by organized crime, whose interests are stealing money from banks with hacking. Those operators might want to steal money from many bank accounts, what means that crime might stay out of security personnel's eye. That kind of criminals might steal the only couple of euros from millions of bank accounts, and because the transfer is so little, some people won't even notice, that their account is missing one or two euros.


And using this "cheese slider" methodology, those gangsters might take a couple of transfers in the same bank. If those people are clever, and use port accounts in many banks, to collect that stolen money in data form. Many gangsters make that kind of mistake, that they steal too much. If somebody realizes suddenly that his or her account is empty, that person normally calls to police. And that makes those money transfers easily to track. Where those people need an agent? They need that person to put their malware program to the server.


That kind of operations must be done outside from building because if all actions will happen inside from house, will data tracked immediately. But when gangsters will make them transfers with remote using the computer, they need access card and another kind of stuff, that they can accomplish the mission. But the problem is that bank's central computer will collect data of those transfers, and if gangsters have done that kind of operation they must destroy that database, that bank can't track them from the net. And that action must be done by malware because if that action is done by the agent the all actions will be uncovered by inner circle job.


But how an agent will rise to that kind of place, where that person make unlimited actions inside that network? Normally the agent will make him needful and helpful actor in the system. That rises he or she social rank in other person eyes. And what makes computer security team suspect that there is an agent inside the system, is that there is more so-called "little mistakes or errors" in system. How can data projector cut communication to the computer if cables are untouchable? Answer in machine or component called router.


Some operator must only disband that data port, and after that computer can't get the connection to the projector.  Normally that happens by giving router orders to shut down that gate what allows communication between data-projector and computer. After that even the best ICT-specialists can't get computer's screen to data-projector. What makes people harass other. One answer is that they do it for money, that somebody can replace some workers with the new one.