AJ's Consulting is a sole proprietorship that provides training and On-Demand consulting in the Industrial Security area for both NISP Signatories and DoD Contractors.   Have a question?  I should have an answer for you or at least know where to send you to get the answer.

Ann Martick, ISP is the owner/consultant of AJ's Consulting, a part-time FSO for 5 different companies in the Austin-San Antonio Metro area, and an Adjunct Instructor for The Graduate School USA's Security courses.  With 20+ years of experience in Industrial Security, I am sure that I can be of assistance to you.  

Did you ever think that charging a cellphone could be a threat to your desktop, laptop, or even your corporate network?

A couple of months ago I received a report from my husband that his company had just spent two hours trying to isolate and eliminate the threat to their corporate network that came from an 'innocent' cellphone plugged in to charge.

It was an android phone similar to the one in the picture above.  The person had plugged it in to charge it and unwittingly unleashed a piece of malware onto the corporate network.  All of a sudden files were being copied and hidden, the duplicate files were renamed to executables, and it spread like wildfire across

3 servers and affected both the campus where it originated and the corporate office.  Any individual clicking to open a folder was actually clicking on an executable file which then spread the malware.  I do not think they ever identified the name of the malware.

Many android phones allow you to set the option that the phone asks upon connection whether you are wishing to "charge only" or to access it as a "mobile storage device" -- just like a flash drive.

There are many antivirus and malware protection applications available for the various phones.  If you have not already downloaded one for your phone, you may want to consider using one.

Here are some cellphone security awareness presentations and articles to provide to your staff to educate them on this threat.

• Infosec Resources: Android Security 10 Tips and Settings
• CSO: 10 Tips for Android Security
• CIO Asia: Exploit Allows Access to Locked iPhone5

How much company information is accessed via your staff's smart phones?  How likely is it that an incident like this could happen to you? 

Have a suggested topic you would like to see addressed or have an article to share?  Email me at annmartick@ajsconsultingisp.com.

NISPOM Conforming Change 1 has been posted on the DSS website (www.dss.mil) as of April 1st.  The date of this change is March 26th.  The main focus of this change is to implement Executive Order (EO) 13526 and ISOO's Directive Number 1 for Industry. 

We have been waiting on a new NISPOM since EO 13526 and Directive Number 1 came out.  The recently posted Conforming Change 1 to the NISPOM dated February 2006 now incorporates those changes.  Industry now has 6 months to implement these changes - except where the implementation is required to be immediate like for changes in Chapter 10 relating to the US-UK treaty.

• Changes For Chapter 1 include -
• Replacing EO 12829 with EO 13526
• Replacing Director of the CIA with Director of National Intelligence (DNI) - responsible authority for classified intelligence
• Including the Chairman of the NRC (Nuclear Regulatory Commission) with the Secretary of Energy as responsible authority for RD and FRD
• Adding a reference to the Intelligence Reform and Terrorism Prevention Act (IRTPA) of 2004
• Timeline for implementing changes can take 6 months, except for changes in Chapter 10 relating to the US-UK Treaty which must be implemented immediately
• Addition of 2 new signatories - Office of Personnel Management (OPM) and National Archives and Records Administration (NARA)
• Addition of DNI Hotline information
• Clarifying the case history for litigation regarding a contractor's liability for defamation of an employee per the requirements of this manual
• Changes for Chapter 4 include implementation of Directive Number 1 which was implementing new marking requirements required by EO 13526
• Changes for Chapter 5 include updating required document control requirements and replacing DCID 6/9 with ICD 705 as an alternative closed room construction requirement standard
• Changes for Chapter 9 include adding Transclassified Foreign Nuclear Information (TFNI) and how to handle it
• Changes for Chapter 10 include Transfers pursuant to an ITAR Exemption and Classified technical data or certain defense articles requirements
• New Definitions in Appendix C include
• Defense Articles
• UK Community
• Working Papers and
• Edited definition for National of the United States

As indicated earlier there is a proposed NISPOM Conforming Change 2 that was submitted for Industry feedback earlier this year.  Some changes in this Conforming Change includes adding requirements and definitions regarding Insider Betrayal and training staff on how to recognize and report it.  The Insider Betrayal program will merge with the Counter Intelligence program and be more obvious than in the past.  More information on this change will be provided in later editions of this newsletter.  The timeline on receiving this change is still unknown.

Another change that is scheduled for Spring of 2013 is a revision of the Vulnerability Assessment Matrix.  This revision is currently being beta-tested at several facilities.  One of the biggest changes is in the area of the NISP Enhancements.  Instead of 13 NISP Enhancements there will only be 11.  Two of the enhancements focus on Counter Intelligence and Cyber Intrusions.  In order to be able to qualify for the CI Enhancement you must have an effective CI program and be able to provide --

• An Actionable Suspicious Contact report that results in finding or assisting in finding attempts to access protected information. or
• You report foreign visitors before a visit and a foreign intelligence agent is identified and/or during the visit you or the escort(s) prevent access to sensitive information and reports it resulting in an actionable report. or
• You report a foreign visit where you or the escort(s) stopped/prevented attempts to access sensitive information and it results in an actionable report.

Another NISP enhancement change is regarding Self Inspections; just documenting multiple self inspections is not enough to obtain that enhancement.

If you have insight on the revised Vulnerability Assessment Matrix or more questions on the upcoming changes mentioned here, please send me an email at annmartick@ajsconsultingisp.com.