business-journal

A grainy cell phone photo and Facebook posts by guests at President Trump’s plush Mar-a-Lago resort in Florida last month touched off a firestorm of concerns about potential security breaches associated by the new president’s continued use of his Android cell phone.

The photo, which was taken by a resort guest, showed President Trump, Japanese Prime Minister Shinzo Abe, assorted staff and guests huddled around a table in the patio-dining room shortly after North Korea had fired off a ballistic missile. It showed people talking on cell phones, while staff used their cell phones to illuminate papers that the two leaders were discussing.

“Holy Moly! It was fascinating to watch the flurry of activity at dinner when the news came that North Korea had launched a missile in the direction of Japan,” guest Richard DeAgazio wrote in his post.

Other guests weighed in with their breathless observations of the open-air emergency meeting, prompting Republicans and Democrats in Congress to press the administration for an explanation of the new administration’s cyber security, particularly as it applies to the use of cell phones and the president’s reported continued use of his unsecured device to communicate and tweet.

I will let those in Washington sort out the details of President Trump’s cell phone use and the propriety of conducting such a meeting in the Mar-a-Lago dining room. But the dustup does call attention to the security problems posed by the common devices in most of our pockets or purses.

Clearly many of us take for granted our cell phones, which are becoming more and more powerful computers. Our cell phones contain an increasing amount of personal and sensitive information that can leave us vulnerable to cyber-crimes, including identify theft.

Depending on the security imposed on President Trump’s cell phone, it could have allowed information access to spies through eavesdropping or hacking. Even secure devices are vulnerable to hackers, who can turn a cell phone’s microphone into a listening device and use its camera to spy on whatever is in front of the lens. Using a cell phone’s flashlight for illumination provides added light and makes objects viewed in a dim dining room even more vulnerable to spies.

We all need to take more care to “secure” our cell phones. You don’t need to be rich, famous or powerful to be a victim of a cyber-criminal.

I could write a book about the steps you should take to secure your cell phone. But likely the more I write, the more you would be overwhelmed and the less likely you would be to do anything.

So, I am going to offer up a few basic steps:

• Enable your cell phone’s “pass code access feature.” Use a strong alpha-numeric pass code to prevent access to the contents of your cell phone. Don’t use your birthday or address. For added security, most cell phones now allow the use of your fingerprint to limit access. Use this feature.
• Most modern phones allow for stored information to be encrypted. I favor using the “default” encryption system that comes with my phone.
• Set up the “remote wipe” on your phone. If the phone is lost or stolen, you can wipe your phone clean remotely. Back up the information in your cell phone onto your computer at home.
• Buy apps from your device’s manufacturer or a “trusted” source. Buying an app from an unknown third party can expose you to malware and ransomware. Be
• very
• suspicious of “free download” offers. Check and set the “privacy settings” on all your apps.
• Public wi-fi is not secure. Period! Instead, using a virtual private network will boost security for sensitive data. Better yet, use a VPN that scrambles and encrypts all cyber transmissions. Shut down wi-fi and bluetooth connections when you are done.
• Back up and update your cell phone software and apps frequently. Often these updates address security issues.

Alphonso Rivera is founder and CEO of Advanced Micro Resource, a Bakersfield-based digital forensic company that specializes in digital audits of phone and computer evidence for attorneys, human resources consultants and companies.

A few weeks ago, a California Public Radio station reported that millions of dollars were being “bled” each month from Los Angeles homebuyers by cyberscammers. But the rip-off is not happening only in Los Angeles. It’s happening throughout the country at alarming rates.

According to the FBI, a cyberscam that tricks homebuyers into wiring money to offshore accounts is costing the Los Angeles area alone $5 million a month. The scam that surfaced in 2013 has rapidly grown, with the FBI’s Internet Crime Complaint Center reporting incidents spiking 480 percent between 2015 and 2016. Last year, the Federal Trade Commission issued a joint warning with the National Association of Realtors about the threat.

Here’s how the scam works:

A criminal will hack into the email account of a person involved in a pending real estate transaction. The hacker will spend days collecting information about the deal, as well as the participants. The hacker even picks up nuances, such as the way agents and customers speak, and details of the transaction. From this information, the hacker creates authentic-looking emails.

Usually during the chaotic moments of a deal’s closing, the hacker will send an email with last-minute changes to instructions about wiring transaction-related funds. Unsuspecting buyers, representatives and financial institutions may not question legitimate-appearing changes sent from the email accounts of “familiar” participants and follow the instructions. Money will be sent directly to the hacker’s account, where it will be quickly lost forever.

There is no shortage of horror stories emerging from this cyberscam. Consider the owner of a small escrow company in Southern California who opened an attachment reportedly containing information about a lost package. The phony email inserted a virus into her computer allowing a hacker to obtain her banking password, which was used to rip off $400,000 through a series of wire transfers.

Earlier this year, a Maryland couple lost more than $400,000 in proceeds from the sale of their home in a cyberscam with roots in West Africa. Unable to recover their money, the couple reportedly now lives paycheck to paycheck.

Wherever you look, recent cases can be found.

In Long Beach, $10,000 disappeared from a real estate deal. In Greenfield, Massachusetts, $80,000 in closing funds and $20,000 in earnest-money deposits disappeared. In Minneapolis, a retired couple buying a townhouse close to their adult children lost $205,000. Another retired couple in Denver lost $272,000 attempting to buy a house. A judge in New York was victimized when she mistakenly followed bogus instructions she thought had been sent by her real estate lawyer. She lost more than $1 million.

Clearly, cybercriminals have discovered a lucrative pot of gold containing easily duped buyers and sellers who may be infrequent participants in complicated, fast-moving financial transactions. And these real estate deals often are handled by small businesses that may lack adequate cyberprotection systems.

While cybercriminals seem to keep one step ahead of their victims, measures can be taken by real estate professionals to protect themselves and their clients.

•  Inform all participants in a real estate transaction about the cyberscam and how it works.
•  Have a cyberprotection plan and communicate it. At the outset of a transaction, explain to all participants how information will be conveyed and verified.
•  Ask about the cybersecurity practices of participants, including other real estate professionals, financial institutions and vendors.
•  Change passwords regularly on accounts, including email accounts. Encourage others involved in the transaction to change their passwords.
•  Train staff to recognize bogus emails and to use caution when clicking on attachments.
•  Do not communicate sensitive information or funds over unsecured Wi-Fi or unencrypted email.
•  Immediately before initiating a wire transfer, call the intended money recipient via a verified telephone number and confirm instructions.
•  Regularly clean out email accounts.
•  Check your online bank accounts daily. Change your banking passwords on a regular basis.
•  Work with information technology and cybersecurity professionals to examine computer systems, assure security software is active and current, and audit online accounts.
•  Consider buying cyber liability insurance. A policy should cover a wide range of threats, as well as business interruption.

Alphonso Rivera is the founder and CEO of Advanced Micro Resource Digital Forensics, a Bakersfield-based digital forensic company that specializes in digital audits involving cell phone and computer evidence for attorneys, private investigators, human resources consultants and companies.

Successful entrepreneurs must be creative, competent and hard working to succeed. They also must be quick and nimble — able to recognize new opportunities and adjust their business plans and systems to capitalize on emerging markets.

Alphonso Rivera demonstrated these qualities as he guided Bakersfield-based Advanced Micro Resource through the exciting, challenging and ever-changing technology industry.

Like other local company owners who have been clients of the Small Business Development Center at California State University, Bakersfield, the key to Rivera’s success is having a strong, but flexible business plan, marketing strategy and business systems that not only accommodate growth, but encourage it.

Rivera’s company, which is located at 3434 Truxtun Ave., Suite 180, in Bakersfield, focuses on computer education and forensics.

Growing up in Bakersfield, Rivera began tinkering with electronics as a young child. His interest led to his completion of courses at Bakersfield and Taft colleges and then at the University of California, Los Angeles, where he studied systems management and information technology. He continued his studies at Western Governors University.

His work experience includes jobs with the technology giant Tandy Corp. and with Henkel’s & McCoy, a utility construction company. He worked as the Bakersfield and Rosamond training director for New Horizons Computer Learning Service before organizing his own company in 2000.

The company’s initial focus was on providing computer training and augmenting STEM – science, technology, engineering and math – programs in area schools. Advanced Micro Resource provides instructors and training equipment to enhance student computer skills.

Earlier this year, Advanced Micro Resource was honored by Assemblywoman Shannon Grove as a 34th Assembly District Business of the Year in recognition of its outstanding service to Bakersfield.

The firm was one of only 85 recipients to receive the award for bringing technology-focused after-school programs to culturally diverse students in 35 Bakersfield-area schools.

The state Legislature created California Small Business Day in 2000, with Assembly and Senate members selecting outstanding local business leaders in their districts for recognition. California Small Business Association’s annual ceremony honoring Advanced Micro Resource was held in May at the Sacramento Convention Center.

After establishing Advanced Micro Resource to meet area computer training needs, Rivera noted that local companies also needed unique, specialized forensics services.

“I started getting requests from local attorneys to perform digital forensics work,” Rivera recalled.

This work ranges from scanning and indexing large case files, which allows content to be searched and organized, to accessing information files stored in electronic devices. Even content people believe they have deleted from an electronic device often can be retrieved and used as evidence.

Prosecutors and defense attorneys have used Advanced Micro Resource’s services. The company’s Digital Forensics Division also is frequently added to a civil litigation team.

Although Advanced Micro Resource’s forensics work is confidential, Rivera said investigations generally involve computer and cell phone evidence. Cases have ranged from high-profile sexual harassment complaints to murder investigations. Rivera conducts seminars for local attorneys to explain the potential uses of digital forensics.

The need for digital forensics services is not limited to the courtroom, however. Often when companies “lose” critical files or passwords, they turn to Advanced Micro Resource for data recovery help.

Rivera notes that his team of experienced analysts and technical professionals has a nearly 20-year record of delivering results for Advanced Micro Resource’s business clients. Plus, he always keeps an eye out for talented teachers and new security information technology program graduates.

Although Advanced Micro Resource is an established technology firm with a proven track record, the Bakersfield company is constantly updating and improving its business systems. Advanced Micro Resource is just one of many local professionals and entrepreneurs who are being helped by the Small Business Development Center at CSUB. The service center is one of five within the University of California, Merced, SBDC Regional Network, which is a partnership between the university and the U.S. Small Business Administration.

The center at CSUB assists entrepreneurs and small business owners in Kern, Mono and Inyo counties by providing free one-on-one consulting, small-business training and research. For more information, go to csub.edu/sbdc.

— Kelly Bearden is the director of the Small Business Development Center at Cal State Bakersfield.

U.S. energy facilities are increasingly being targeted by cybercriminals, according to a recent report released by government and private security officials. Just one agency, the Department of Homeland Security, reported a jump in cases with its investigators receiving reports of 59 significant cyber incidents occurring at U.S. energy facilities in 2016.

The agency handled 290 cybercrime incidents last year involving numerous industrial sites, including factories, power and chemical plants, refineries and nuclear facilities. Many of these incidents originated with “phishing emails” — emails sent by hackers that trick people into downloading virus-infected attachments or links. Many others came from “network probing” and “scanning” schemes.

Some viruses result from malware that was inflicted on systems years ago but keep spreading. Others result from increasingly sophisticated schemes that continue to be created.

In a study conducted in 2015 for Hewlett Packard Enterprise, the Ponemon Institute estimated cybercrimes are costing U.S. energy and utility companies about $12.8 million a year in lost business and damaged equipment. And the possibilities of catastrophic events being caused by cyberattacks are growing.

Consider the “mother of cyberattacks” that hit Saudi Aramco in 2012, when an employee opened a phishing email and released a computer virus. Files quickly began to disappear from the company’s computers. Telephones went dead. As staff desperately yanked cables out of equipment, computers shut down. In just a few hours, 35,000 computers were wiped or totally destroyed.

Saudi Aramco, which supplies 10 percent of the world’s oil, was unable to conduct business or communicate with customers. After about two weeks, the company had to give oil away for free to keep inventories from overflowing. It took five months for the company to come back online. A bigger disaster was averted because some of the company’s functions were not networked with the infected system.

The motivations for these attacks are many: nation-states waging war by attacking adversaries’ energy supplies and production; politically or ideologically driven groups advancing their causes; criminals seeking to steal data, divert production or extort money; and competing companies engaging in industrial sabotage or espionage.

Among the most common risks are plant shutdowns, equipment damage, utilities interruptions, production cycle shutdowns, product quality problems, undetected spills and safety breaches that result in injuries and death.

Imagine, for example, what would happen if a hacker changed critical settings that controlled the filling of a tank. A cybercriminal could engineer an explosion when the tank reached its maximum capacity.

Imagine what would happen if a hacker changed the temperature and pressure settings on a remote plant, triggering a shutdown and a time-wasting, expensive investigation.

Imagine if a hacker changed the oil stock information of a company to incorrectly indicate it had a much bigger inventory. When the demand exceeded supplies, the company could no longer service customers. Havoc would be inflicted on the company, oil prices and marketplace.

The number of cybercrimes occurring in the energy industry likely is underreported because many companies do not want to divulge their vulnerabilities. But companies are increasingly addressing these risks.

ABI Research, a technology market intelligence company, estimates oil and gas companies will be spending $1.87 billion on cyber security by 2018. Industry and government initiatives also are underway to develop standards and requirements for reporting breaches and improving security.

But there are immediate steps companies can take to protect their systems.

• Make cyber-security a priority — from top management to line employees, as well as contractors. This includes investing in cybersecurity systems.
• Understand vulnerabilities. Don’t assume any operation is safe from hackers. Network systems when it makes business sense. Create “firewalls” when possible.
• Share security concerns with others in the industry. A “common enemy” should encourage common, timely solutions.
• Disseminate sensitive information on a “need to know” basis. This should not create barriers for a company’s efficient operation. Rather it should be to minimize exposure to security breaches.
• Educate the workforce. Train employees how to recognize hacking and other cyber intrusions, as well as how to prevent these crimes from occurring.

— Alphonso Rivera is the founder and CEO of Advanced Micro Resource, a Bakersfield-based digital forensic company that specializes in digital audits involving cell phone and computer evidence for attorneys, private investigators, human resources consultants and companies.

A computer virus that infected systems throughout the world earlier this year caused millions of dollars in damages to companies in nearly every industry. It also demonstrated that hospitals may be particularly vulnerable to such attacks.

The WannaCry ransomware, which targeted more than 300,000 computer systems in about 150 countries, caught the world’s attention when hospitals in the British National Health Service were infected. But this proved to be just the beginning. The attack spread like, well, a really bad virus, as hospitals in other countries reported intrusions.

In recent months, U.S. hospitals have made headlines as their computer systems have been held hostage by hackers and they have paid “ransom” to release the digital grips.

Hospitals are particularly vulnerable to these types of attacks because they often use old machines and outdated software to perform such vital functions as monitoring patients and dispensing medications. Consider, “health care hardware devices” — such as MRI machines, ventilators and even some microscopes — actually are just computers. They are no different than desktop and laptop computers and mobile devices when it comes to being hacked.

But because of the vital, lifesaving functions they perform and the expanded dependence on sophisticated “machines” that today are even performing surgery, they are often in use 24 hours a day. They often are not being taken offline for updating. And when expensive equipment grows old, it is often they are being used without the support of manufacturers.

Consider the incident Forbes magazine reported recently involving unnamed U.S. hospitals using sophisticated systems to deliver a “contrast agent” to patients undergoing radiology tests. A spokesperson for the system’s manufacturer confirmed it had received two reports from customers in the U.S. with devices compromised by the ransomware.

Hospitals and other businesses are being hit by hackers demanding ransom because it is a relatively easy way for criminals to make a lot of money.

Here’s how most ransomware attacks occur: Hackers infect malware into a computer. This malware, which is called ransomware, then encrypts the computer’s files until “victims” pay to have the files unlocked. The introduction of Bitcoin, a digital currency, has empowered hackers to demand increasingly large ransoms, with hospitals seen as lucrative targets. Because Bitcoin is traded anonymously, the transactions are difficult to track.

Hospitals, like all businesses, also are vulnerable to having customers’ or patients’ confidential information stolen and distributed. And hospital records are rich with the type of detailed patient information that criminals desire. Like other businesses, hospitals also must guard confidential, proprietary company information.

According to the U.S. National Cyber Security Alliance, small businesses account for 81 percent of all cyberattacks and 60 percent of small companies that are victimized shut their doors within six months of a cyberattack because of loss in reputation and customer trust.

Whether it is a hospital or small business trying to protect itself from a cyberattack, these steps should be taken:

• Train staff to recognize risks. While it seems hackers are always one step ahead of their prey, reminding employees not to open suspicious email attachments and to maintain secure passwords is a first line of defense.
• Adhere to a schedule for updating software. That requires taking systems offline to perform updates that often address hacking vulnerabilities.
• Harden systems. Remove equipment from networks when it is appropriate. Separate or compartmentalize systems to prevent one intrusion from infecting many operations.
• Audit systems regularly for vulnerabilities and evidence of intrusion.
• Make cybersecurity a priority. Do not become complacent.

Alphonso Rivera is the founder and CEO of Advanced Micro Resource Digital Forensics, a Bakersfield-based digital forensic company that specializes in digital audits involving cell phone and computer evidence for attorneys, private investigators, human resources consultants and companies.

Hacking, data breaches and other types of cybercrimes are targeting more retailers, as both brick-and-mortar stores and online shopping websites increasingly rely on digital systems to conduct business.

Recent studies reveal millennials, people in the 23- to 34-year-old bracket, overwhelmingly prefer to shop online, using their smartphones, tablets and computers. As the boomer generation ages, the convenience of online shopping will likely lure an increasing number of older shoppers onto the internet. We are now seeing grocery stores promoting online shopping.

With this trend, retailers are being exposed to increasing risks of attack.

Retail digital exchanges with customers and financial institutions contain a treasure trove of valuable data, including the details of customers’ accounts and personal information. Retail has become such a lucrative, easy target that “discount” schools have popped up to train cybercriminals.

A risk management company recently reported discovering a Russian-language six-week online course for aspiring cybercriminals. For just 45,000 rubles ($745 in the U.S.), the course promoters boasted that would-be criminals could make $12,000 a month, based on a 40-hour workweek. That is about 17 times more than an average Russian can make working a legitimate job.

We mostly hear about the cyberattacks on big retailers, such as Home Depot, which had to pay customers a $19.5 million settlement for its 2014 credit card breach. While few of the major retailers have escaped attack, the small, locally owned shops also are vulnerable. Basically, no retailer is too big or too small to be targeted by cybercriminals.

And every successful attack is costly – in terms of actual losses and lost reputation.

A recent study revealed that the average, per record cost of a data breach was $172 in 2016. For example, a record is one compromised credit card. Costs associated with a data breach include investigation of the attack and its scope, damage to customers and fines imposed by banks for the breach.

The international accounting firm KPMP surveyed hundreds of customers last year regarding retailers’ data breaches. The company found that 19 percent of the people surveyed would stop shopping at a retailer that had been a victim of a cyber hack, even if the company took the necessary steps to remediate the intrusion. In addition, 33 percent indicated that fears of further exposure of their personal information would prevent them from shopping at a breached retailer for at least three months.

Retailers must have their guards up in this time of increasing threats. Small retailers, whose cybersecurity strategy is to “hope for the best,” must recognize that their time will come – likely sooner than later.

Some steps to take:

• Set a high priority on implementing “chip systems.” While cyberattacks are decreasing involving point of sale exchanges, they will not disappear. Chip systems are working, but some retailers have not enabled chip scanners in their stores.
• Use only high-quality, secure domain providers.
• Train employees about cybersecurity, including the importance of cooperating across departments. Require employees to use strong passwords.
• Update software regularly and patch vulnerabilities.
• Install “firewalls,” to separate corporate, store and payment exchanges.
• Vet third-party suppliers and vendors to ensure that their systems are secure.
• Regularly audit your systems to determine if procedures are being followed and protection provided.

Instinctively, companies are tempted to hide or minimize the occurrence and scope of data breaches. But strength in combating increasingly clever and aggressive criminals will come from a united front. For the greater good, retailers should share information with each other about attacks.

Alphonso Rivera is the founder and CEO of Advanced Micro Resource Digital Forensics, a Bakersfield-based digital forensic company that specializes in digital audits involving cell phone and computer evidence for attorneys, private investigators, human resources consultants and companies.

[et_pb_section bb_built=”1″][et_pb_row][et_pb_column type=”4_4″][et_pb_text _builder_version=”3.0.106″ background_layout=”light”]

It’s an easy crime to commit and a hard one to detect. Cyber criminals are stealing millions of dollars a year from valley farmers and processors.

The high-profile thefts of valuable truckloads of California tree nuts have grabbed recent headlines and highlighted the reach of the organized crime networks that are behind them.

Consider that a truckload of pistachios, for example, may have a value of $500,000. Multiply that number by the increasing incidents of thefts and you get a real appreciation for the scope of the problem.

According to CargoNet, an organization that tracks transportation security issues, more than 30 truckloads of almonds, pistachios, cashews, pecans and walnuts were stolen from nut growers and processors in central California in 2015. That was up from five truckloads in 2012. Thieves infiltrating the complicated supply chain linking farmers to retailers stole an estimated $10 million in product that year.

Cargo thefts are not new. But for a variety of reasons, agriculture is being increasingly targeted. And the use of cybercrimes to pull off these heists also is increasing. When you think of cargo being stolen, don’t just think of trucks being hijacked. Rather, think of clever cybercriminals hacking into vulnerable computer databases to obtain the “keys” they use to drive off with the goods.

There are a variety of scenarios in these thefts. Consider one of the most common: the “fictitious pickup.” In these cases, thieves may hack into a government agency’s shipping database. They will then lift information about drivers from the social media pages of shipping and trucking companies to create fraudulent documents. Posing with these documents, fake drivers will arrive at a processing plant and simply drive away with a valuable load.

Fake documents also often include “burner” cell phone numbers. When called, customers believe they are communicating with legitimate haulers. They learn otherwise when their cargo does not arrive at its destination.

Another scenario is for thieves to pose as a “customer” — a farmer or processor — and direct a “real” truck driver to deliver his cargo to an alternate, bogus location. By the time the theft is detected, the cargo has been scattered through a black market in the U.S. or overseas.

Nuts are particularly attractive targets for thieves because of their high value and the inability to track a stolen load. Nuts do not have serial numbers and are consumed, leaving little evidence to investigate.

And as hard as law enforcement agencies work to combat this crime, criminals are working harder to come up with more clever schemes.

The answers to foiling these crimes are found in the vigilance of farmers and producers.

• Retain the services of a forensic computer consultant to examine the security of your online databases and identify vulnerabilities. Follow the consultant’s recommendations for increasing cybersecurity.
• Communicate with law enforcement agencies and others in your industry to understand the scams that are targeting farmers and producers.
• Screen your employees. Conduct background checks on drivers, warehouse workers and others who have shipping information.
• Know your haulers. Double-check the identity of drivers. While resolving questions may delay a shipment, consider the delay when a shipment is stolen.
• Create communications strategies, such as passwords or other devices, to assure the identity of a driver and the validity of delivery instructions.
• Use technology to track cargo. This might include installing sensors and other devices into the cargo to assure that it is being delivered to the proper location.
• Quickly report problems to law enforcement agencies. These crimes are hard to solve. They are impossible if the “trail” gets cold.
• Develop a “risk management” plan that includes regular forensic audits of your company’s online systems.

— Alphonso Rivera is the founder and CEO of Advanced Micro Resource, a Bakersfield-based digital forensic company that specializes in digital audits involving cell phone and computer evidence for attorneys, private investigators, human resources consultants and companies.

[/et_pb_text][/et_pb_column][/et_pb_row][/et_pb_section]