Taking care of business. Keeping the hackers out.

Colonial Pipeline has just shown us all how bad things can get for a company that doesn’t take care of its computer security.  Colonial has just admitted to paying the hacker[s] $5 mil to get their files back.  They didn’t say if they had recovered their files, the hackers may have just kept the $5 mil and split.

This is aimed at suits, those fairly clueless senior business people. 

   First off, your company has valuable information on its computers.  Information that will do you great harm if it falls into the hands of competitors.  Things like your payroll, your sales contacts, the plans, schematics, parts lists, and source code for your product[s].   If you don’t believe me, have a chat with the Colonial Pipeline people.  They will tell you.

   Know that Windows computers are totally insecure.  High school kids can break into them.  Windows is like Swiss cheese, hole of holes.  Connect a Windows computer to the public internet, and you have exposed every thing on that computer to every passing internet hacker.  You should not use Windows computers to monitor or control generators, pumps, pipelines, or anything that controls physical product.  Use Apple, use Linux, use a workstation, anything but Windows. 

   Important and confidential paperwork can be kept on Windows machines if and only if, that machine is not connected to the public internet.  Keep these machines in a locked room.  Snip off all their USB ports.  Windows computers will silently load and execute any code, malware, they find on flash drives inserted in the USB ports.  That is how we spread Stuxnet on the Iranian uranium enrichment centrifuges.  Back them up weekly to DVD disks.  Store the backup disks off site, in case of fire or flood in your office.  In 40 years in the business I never had a fire.  I did have a flood once, right in the computer room, made an awful mess. 

   Separate the stuff that makes the business run, the generators spin, the pipelines pump, the trucks get dispatched, the product to come off your production line, from your paper work.  If the hackers get to your paper work it should not shut down your business.  You ought to be able to operate with out your paper work for a few days.  Billing may be delayed a bit but you can survive that.

   Make sure every computer in the company needs a password to access.  Use strong passwords, some upper case, some lower case, some numbers, and some punctuation.  Change the passwords every 90 days.  Take care to close out the computer accounts of departing employees.  Do it on the day they leave.