untangling_the_web

DID: 4046925
UNCLASSIFIEDUFOR OFFIGIAL blSE ONLY
never distribute software directly via email) and all Microsoft downloads are from
their site .
Microsoft Policies on Software Distribution
http://www.microsoft.com/technet/security/bulletin/info/swdist.mspx
Although it is not new, another type of con called "pretexting"205 made headlines
during 2006 when some executives at Hewlett Packard got into serious trouble
because of this method of obtaining information. The HP execs weren't after
financial data but telephone records, and at that time it was not clear if pretexting to
obtain phone records was illegal or not in the US. HP admits that it hired a firm to
investigate board leaks to the press. The firm HP engaged to look into the leaks in
turn hired private investigators who impersonated HP board members to get phone
records belonging to at least nine reporters and one HP board member.
This is just the most high-profile complaint about the ready availability of personal
records obtained by "data brokers." You need to be aware that pretexting is a
widespread tactic, and the laws governing fraudulently obtaining non-financial
personal records and information are murky at best. Frankly, there isn't much
you can do to protect yourself from a clever and determined con artist who is going
after your phone records at your phone company. The best ways to combat
pretexting are laws that make pretexting a crime and companies that train their
employees better.
Understand Website Certificates
If you are concerned about phishing attacks and other social engineering scams,
you have probably been advised to make sure the site you are visiting has a valid
site certificate. And then you probably scratched your head and wondered, "how the
heck can I tell if that certificate is valid or not?"
First, it is important to understand what a site certificate is and what it does for the
site and for you. Any website that wants a secure connection must use encryption. In
order to use encryption over the Internet, the website owner must obtain a site
certificate. There are, then, two parties involved in verifying the validity of a
certificate: the website owner and the trusted certificate authority. At present, your
browser is probably set to recognize more than 100 trusted certificate authorities, but
not all of these have the same strictness about ensuring the validity and security of
205 The earliest use I have found of the term 'pretexting' to mean obtaining private or confidential
information by pretending to be someone who has a legitimate right to or need for that information is
1980: Fair Financial Information Practices Act: Hearings Before the Subcommittee on Consumer
Affairs by the United States Senate Committee on Banking, Housing, and Urban Affairs,
Subcommittee on Consumer Affairs. .
UNCLASSIFIEDHFOR OFFIOIAL l:J5E ONLY 585