Google Giveth and Taketh

Google, the company whose name is part of the common lexicon as a generic term for a computer search, has been much in the news -- and not all of that news has been good, especially when it comes to the topic of safeguarding data.

By Ara Trembly

According to the Economic Times for example, France's regulator of online data protection iscurrently in the process of determining whether Google's new privacy policy violates European laws protecting privacy.

Now a report in InformationWeek notes that while Google has provided hackers with information that helps them perpetrate their nasty deeds, Google can also be used as a tool to help prevent unauthorized access.

Avoid a Legal Black Hole (04/12/13)
Technological Obsolescence (05/01/13)
Part 3: Big Data Masters (04/12/13)
Defending Your Networks (04/12/13)
Excess and Surplus At the Ready (04/12/13)

According to the report, Google, Bing and other major search engines, have made it easy to find everything from exposed password files to SQL injection points. This has led to the emergence of Google hacking, a technique used to identify and then exploit system and data vulnerabilities. The good news, however, is that while such activity is a problem for information technology security professionals, those same professionals can leverage the very tools and techniques hackers use in order to identify and fix any vulnerabilities their companies may have, the report said.

"In other words, they can Google themselves to find security problems before the bad guys do."

Since I run a few small businesses that have Web presences, I frequently "Google" myself and the businesses I run in order to get a clearer picture of what is happening in cyberspace with respect to the data I hold dear. As the InformationWeek piece points out, Google enables me to search interfaces to actively track down and eliminate sensitive information disclosures and vulnerabilities in public systems. It also lets me take a defensive look at things, like real-time RSS updates from search engineers to provide user alerts -- "a sort of intrusion detection system for Google hacking."

"Malicious hackers have already embraced search engine hacking as an effective way to target and exploit vulnerabilities on a massive scale," the InformationWeek report said. "It is imperative that security professionals learn to take equal advantage of these techniques to help safeguard their organizations."

This should come as no surprise to anyone who has researched the world of hackers and looked into the way they operate. Often, the security tools we use to foil hackers are the same tools that hackers use to attempt to breach our systems and steal information. Nmap ("Network Mapper") for example, is a free and open-source utility for network exploration or security auditing. Many systems and network administrators also find it useful for tasks such as network inventory, managing service upgrade schedules, and monitoring host or service uptime. It can also be used, however, to see what's open on your network, what operating system you have, and what type of firewall you have in place -- all useful information for the bad guys.

The bottom line is that while we have or should have a variety of automated intrusion detection and prevention measures in place, these alone are not sufficient to effectively deal with the ever-growing problem of cyber-crime. As the trusted keepers of sensitive data, we cannot afford to sit back and hope that our systems are enough to protect the information that is our industry's lifeblood. Sometimes, we actually have to sit down and think about our vulnerabilities and physically use the tools available to stay one step ahead of those who would compromise our systems and our enterprises.

ARA TREMBLY is founder of Ara Trembly, The Tech Consultant. He can be reached at riskletters@lrp.com.

June 1, 2012

Newsletter Sign-up