As of June 19, 2017 a report of sensitive information belonging to nearly 200 million US citizens was found on a public Amazon cloud service. The sensitive information contained names, birth-dates, home addresses, telephone numbers, and political views. This information was used by the Republican National Committee and was accidentally exposed by a marketing firm.

Although this information was on the service publicly and did not need authentication to gain access, the marketing firm stated that “…we do not believe that our systems have been hacked,". The way to access the information was through a provided link, but this is susceptible to phishing emails, hijacking accounts, or general user error. If this service was compromised it could take months to know the full details of who may have gained access, and if there was a breach. The information could have also been altered within the service itself, changing the values of the information, which is even harder to detect.

This example illustrates why making sure that the files we share use services that we know are secure. When using the City of Portland approved cloud service, OneDrive, ensure that you limit the number of people able to see the information. The Information Security best practice is to only give rights to those on a need-to-know basis. Only grant access to those who have a business need for the information you want to share.

For more information on how to use OneDrive, please read the “OneDrive for Business” section of the BTS Helpdesk portal: https://www.portlandoregon.gov/bts/68984

Authentication Definition: https://en.wikipedia.org/wiki/Authentication

Article: http://www.bbc.com/news/technology-40331215

As of June 27^th, 2017 a ransomware called Petya or NotPetya had started infecting organizations globally. The reason why this ransomware is causing more concern is the way it infects devices. WannaCry was a previous ransomware that infected thousands of devices across dozens of countries. WannaCry used exploits in the Windows Operating System released by the Shadow Brokers, a hacking group. The exploit was leaked from the National Security Agency (NSA). Experts are saying Petya is using the same exploits as WannaCry used to infect devices.

A Security researcher found a way to stop WannaCry prior to the United States started work, protecting many US organizations and individuals. Microsoft patched the vulnerability in the Windows operating system a month before WannaCry hit the Internet. Microsoft stated the preferred method of protection from the ransomware is to apply supplied patches. Petya also infected devices missing the supplied update. Businesses and local governments in the United Kingdom and Ukraine have already stated that Petya has infected their devices.

City of Portland Bureau of Technology Services assists in the process of updating City devices. However, your personal devices may be at risk if you haven’t updated them consistently. Information Security recommends applying patches as soon as vendors release them (often monthly) and to only use Operating Systems that are supported by the vendor. The affected organizations above had not patched, or were running on outdated software. Update as often as possible.

Article: http://www.bbc.com/news/technology-40416611