May 2013: Book of the Month

In April I mentioned Chip and Dan Heath’s book, “Made to Stick,” this month it will be our book of the month.  This is a book about change. Many of us have ideas and concepts that are very good, and we try to convey these ideas for the sake of beneficial change.

Made to Stick teaches us why some ideas “stick” and some ideas do not.  They convey these concepts through innovative story telling and the concepts of such things as “urban legends.”

No matter what your business, if you have good ideas and want to see how to make your ideas work, this is a must read book for you!

If you get a chance to read this informative and excellent book and you want to discuss or send me your thoughts, please send me an email at duane.hagelgans@millersville.edu

Posted in Uncategorized | Comments Off

Boston Lessons Learned from the Good Leaders

Emergency Management 101: Good people, who are well trained, will always rise to the occasion!  The New Yorker has a nice article by Dr Atul Gawande, author of The Checklist Manifesto.  He interviewed some of the leadership in the emergency room at his hospital, Brigham and Women’s Hospital (part of the Harvard Medical School), about what they did during the rush of patients after the horrific bombing last Monday.  The answer was quite simple and words to the wise for good leaders and those aspiring to be good leaders, “I mostly let people do their jobs.”  And further, “…everyone spontaneously knew the dance moves….didn’t have to tell people much of what to do at all.”   Not words you would expect to hear with the magnitude and details of what had happened at the Boston Marathon, but exactly the words good leaders would expect.  Why?  Because, good leaders don’t micromanage, good leaders train their people and then like a mother bird, when it is time, they let them jump out of the nest and do what they do…those are the good leaders.  The good leaders can do this because they have confidence in their people.  They have confidence because they have trained and nurtured those subordinates. They don’t have to worry about how they will perform, because they have gotten them ready long before they need to use these skills.  How?  The article does a great job, very succinctly, of explaining how when various events took place previously around the country, the personnel in these various hospitals, because it was not just this hospital that was prepared it was every Boston hospital, studied and learned lessons from those events.  They studied what happened, what went right, what went wrong and trained based upon these events.  Just like any good professional athlete, they “studied” film to be prepared for when and if the day came when they had to go to work.
Just like Boston, emergency mangers and emergency responders all around the world that study and learn from past events, while preparing for events that may have yet to ever been faced, will perform well….and it all starts with good leadership!

Posted in Uncategorized | Comments Off

April 2013: Book of the Month

Chip and Dan Heath, Authors of the book, “Made to Stick,” also wrote this month’s book, “Switch: How to Change Things When Change is Hard.“  This book is about transformational change, through the concept of getting both sides of your brain working together for the common purpose, allowing each side to serve its purpose.  It doesn’t matter if you are trying to change your eating habits, your study habits or your company, this book is an easy read and puts together key ideas that can spell success for you in trying to bring about necessary “change.”

If you get a chance to read this informative and excellent book and you want to discuss or send me your thoughts, please send me an email at duane.hagelgans@millersville.edu

Posted in Uncategorized | Comments Off

Securing your Identity

Most of us depend heavily on technology, whether we like or use technology or not!  Go to the store, use online banking, shop for your next vacation or even clothes…you are using technology.  The same technology that makes our lives easier, can also become a nightmare when someone gains access to our personal information and begins “shopping as you.”

We are told that we need to have passwords that are hard to break and different passwords for each of our various accounts, but how many of us don’t follow this advice?  How many of us have the list of passwords sitting beside our computers so we can remember them when we need to use them?  I know what you are thinking, who is going to have access to them at my computer?  Good point!  So, how do these identity thieves get your information? Easy, you give it to them, or they steal it from business computers, government computers, and from the open airwaves!

Free wi-fi is a wonderful thing, right?!  You save that data time on your phone bill by using it with your smartphone or laptop down at the local coffee shop or airport, and all is good.  But, what if someone is sitting in the coffee shop or airport with software that is capturing all your personal information?  Reading the news on your phone or computer is okay, but once you type in your username and password to one of your accounts, the chance is out there that someone just acquired your information.  Recently malware (software used for bad purposes), has been discovered at some of those “free” charging stations at airports.  You plug in your device to charge it before your flight, and the malware downloads all your private information for an internet thief to acquire.

Did you know that there are over 28.2 billion, with a “B”, attempts at stealing data every hour, and that there are 7+ million fake “IP addresses” on the internet.  These fake addresses are being used to “mine” for your data.  You receive an email from a friend or business telling you to update your data or check out the latest picture and you click on the “link” that seems like a legitimate link.  Either it takes you where you need to go and your none the wiser, or it does nothing and you think that it is a broken link, no big deal.  The problem is that your data has been acquired and your computer may now have software inside of it feeding your information to the identity thieves.

I was recently sitting in a conference with an internet security expert and he has solved this problem….never go on the internet!  Okay, so option A isn’t going to work, because even if you don’t use social media, or wireless devices, or shop and bank online, your information is still out there.  You reduce your chances of having it acquired by not doing these things, but in today’s society your information and the technology that “secures” it is everywhere in everything we do.

What can you do?  There is not much you can do about letting the bank, government, healthcare providers, etc. to have your information, but you can protect yourself.

There is software that allows these thieves to read the information from your credit card in your wallet as you walk by due to the chips installed in the credit cards.  Solution: buy a wallet or protective slips for your cards that shield them from being read.  How many of you knew this was even possible?!

Don’t use your work computer for social media, online services or with your personal information.  First it puts your personal information out where it can be stolen and second, it allows hackers to back door in to your work computers.

Make sure you always have passwords on your home and work routers.  Make sure the passwords you use are at least eight characters, use both an upper and lower case letter, use at least one number and use a character such as: #, $, &, + if the system you are using allows you to use these symbols.  Also, DO NOT use the same password for all your accounts.  Finally, if you are making online purchases, and it requires an email account, set up a gmail, hotmail or other free account that you use ONLY for these online shopping accounts.

Don’t make it easy on the people out there trying to steal your identity, use common sense and these few precautions. I will continue to provide updates and additional information in upcoming posts!

Be Smart, Be Prepared, Be Safe!

Posted in Uncategorized | Comments Off

March: Book of the Month

With the first day of the Sequestration upon us, this month’s book is a book subtitled: A radical new theory of collapse.   Rebecca Costa’s book, The Watchman’s Rattle is an intriguing look at problem solving and what prevents us from being able to solve problems.  Has technology outpaced our ability to solve problems that are created?

If you get a chance to read this informative and excellent book and you want to discuss or send me your thoughts, please send me an email at duane.hagelgans@millersville.edu

Posted in Uncategorized | Comments Off

OPSEC: A student’s work

Based upon what you have learned so far, find an OPSEC violation that has occurred and was written about in the media or on the internet. Write a 2 to 3 page paper about this issue. Start with a brief summary of the event, give the OPSEC violations and conclude with how to prevent this type of situation from happening again. You can include any training that you think is important.

For my research of an Operational Security (OPSEC) violation I have chosen to use everyone’s most coveted device; the cell phone. I have witnessed firsthand that it provides precise data that can be used to track someone and detail their movements at a scene. This information created a blueprint of a building, where evidence was collected and processed and then to the location off site where it is currently being stored with time stamps for each data point. The offender does not even know he created this map that he shared via HYPERLINK “http://www.google.com/latitude” Google Latitude with friends. This is only one of the many ways you share data from the phone that may put you and your comrades in harm’s way.

The site was to be secured, have limited access, and declared a no fly zone while the investigation was underway. This is normal operating procedure. From the site cell phones were used for operational coordination in conjunction with an encrypted radio system. As part of OPSEC, cell phones camera, recorder, data and GPS services were to be turned off. So how did this happen then? Simple the app was running on his personal phone that was in his pocket and he simply had forgotten that he was using it. Did it create a hazard, put us at risk, or expose our operation to the press? Not directly, since there was no incident, but indirectly it may have since several times there were reports on the news of the operations of the preceeding day that were not included in the official press releases.

Today’s phones use an Operating Systems (OS) that is basically a personal computer which links all of your information, social networking, and current location then stores it in multiple places. Today with cloud services offered by Google, Apple, and many other companies your information is readily accessible on multiple devices and updated globally. This is convenient but puts this information at risk of being accessed by others. For example, Apple accesses their devices twice a day without the users’ knowledge, uploading current location by default. From this information they have created a database similar to Google Street View. They did obtain permission from the end user by the following language which is within the contract from Apple that states ‘To provide location-based services on Apple products, Apple and our partners and licensees may collect, use, and share precise location data, including the real-time geographic location of your Apple computer or device. This location data is collected anonymously in a form that does not personally identify you and is used by Apple and our partners and licensees to provide and improve location-based products and services.’ [1] HYPERLINK “http://www.apple.com/privacy/” Apple’s privacy policy states that the company may disclose customer information “if we determine that for purposes of national security, law enforcement, or other issues of public importance, disclosure is necessary or appropriate.”

How do we minimize the risks posed by having and using a modern phone with all of its apps and features? First are the simple things like lock the keypad so that it is not easily accessed and used if lost. Don’t store all of your personal data on the phone such as bank account numbers, passwords to access accounts on line, and change them often.

Geotagging and Location Tracking Services are great services for sharing up to the minute location, and letting people know where you have been. During a demonstration of how geotagging can be used to gain information on an individual, a person was observed using their phone to take photos and by noting the location, time of day, and type of phone, a third party was able to go back and find the photos on “Flickr” including some of the party’s residence inside and out. The third party stated and I quote “ HYPERLINK “http://www.wired.com/gadgets/wireless/magazine/17-02/lp_guineapig?currentPage=all” Now I know where she lives.” [2] It is the equivalent of adding a 10-digit grid coordinate to everything you post on the Internet.[3] To avoid exposing your personal location you should not check into geotagging sites while you are home, don’t add tags that state who and where you are, turn off the geotagging and GPS features in your phone.

Avoid using “Free” Wi-Fi networks. At O’Hare airport in Chicago there were found to be 20 wireless networks that were setup to collect user data in a HYPERLINK “http://charlotte.bbb.org/article/bbb-warns-hackers-set-up-fake-wi-fi-hotspots-in-airports-34411″ 2008 study. [4] Hackers set up networks in public gathering places and collect the data by using an ad-hoc or peer-to-peer network that allows you to surf the web, and allows them to collect your personal data. To minimize the risk you should turn off file sharing, automatic wireless connections, and use a Virtual Private Network (VPN) connection whenever possible.

Bluetooth devices offer a potential hacker an easy way to add software to your phone. In public, if the Bluetooth is enabled and not restricted to your personal interfaces, it acts as a mini network and allow others to access it and add software such as “ HYPERLINK “http://features.techworld.com/security/1259/it-managers-battle-mobile-viruses/” CommWarrior” which slowly deletes the phones contacts, calendar and email, then transfers itself when you send an Email to phone. If you are not currently using a Bluetooth device, turn off the service, and in the settings ensure that it is only allowed to pair with your devices.

To protect yourself and minimize the data you share, especially if it is sensitive in nature, add software to the phone that uses an encryption service. The information is protected by requiring a key and if the phone is lost or stolen can be remotely wiped or if the pass code is entered wrong 3 consecutive times the phones software will wipe the data for you. Ensure that the phones software and applications are up-to-date. This month alone JAVA was hacked multiple times, leading to large amounts of data being gathered by a third party and the ability to change credentials from a low level to administrator of mobile devices running Java applications. Never answer unsolicited texts, Emails, call numbers, open links that arrive via unsolicited texts or Email. Only enter your passwords into the site or account that you have navigated to, never follow a link that was sent to you or found within a text, twitter tweet, or email.Tthis is known as phishing and is widely used to collect your personal data.

In conclusion treat your phone as a device that is constantly tracking, recording and monitoring your activities. From location to communications, it’s all tied to your phone. Even removing the battery does not always fully shut it down and actually may set a flag that causes you to be watched. The information we leave behind in data bits may be factual information but does not necessarily give a true representation of our lives. It is a great invention and lets you do so much more, but with that freedom there is a risk. So take proper precautions, for it is a wonderful tool if you treat it appropriately.

References:

Google Latitude lets you stay close with your friends from your phone, computer, or both

Retrieved February 20, 2013

HYPERLINK “http://www.google.com/latitude” http://www.google.com/latitude

1. Apple’s Privacy Policy and data processing

Retrieved February 20, 2013

HYPERLINK “http://www.apple.com/privacy/” http://www.apple.com/privacy/

2. Mathew Honan, I Am Here: One Man’s Experiment With the Location-Aware Lifestyle

Retrieved February 20, 2013

HYPERLINK “http://www.wired.com/gadgets/wireless/magazine/17-02/lp_guineapig?currentPage=all” http://www.wired.com/gadgets/wireless/magazine/17-02/lp_guineapig?currentPage=all

3. Army Geotagging Safety.pdf

Retrieved February 20, 2013

HYPERLINK “http://www.nv.ngb.army.mil/Army%20Geotagging%20Safety.pdf” http://www.nv.ngb.army.mil/Army%20Geotagging%20Safety.pdf

4. BBB Warns: Hackers Set Up Fake Wi-Fi Hotspots in Airports

Retrieved February 20, 2013

HYPERLINK “http://charlotte.bbb.org/article/bbb-warns-hackers-set-up-fake-wi-fi-hotspots-in-airports-34411″ http://charlotte.bbb.org/article/bbb-warns-hackers-set-up-fake-wi-fi-hotspots-in-airports-34411

IT managers battle mobile viruses

Retrieved February 20, 2013

HYPERLINK “http://features.techworld.com/security/1259/it-managers-battle-mobile-viruses/” http://features.techworld.com/security/1259/it-managers-battle-mobile-viruses/

Posted in Uncategorized | Comments Off

Book of the Month: February 2013

This month, I had a hard time deciding which of several great books to use for the book of the month. I have decided to share with you, “Predictable Surprises” by Max Bazerman and Michael Watkins. The authors make a lot of great points about what most of us would classify as “surprises” or “unknowns.” Using a lot of analogies and true stories, the authors explain how many times these “unexpected events” are predictable. As an emergency manager, a health and safety professional, or merely a person trying to work your way through each day, this is a good book about better planning and avoiding adverse outcomes.
When you have finished reading this book, drop me an email and let me know your thoughts: duane.hagelgans@millersville.edu

Posted in Uncategorized | Comments Off

Introduction to Business Continuity Planning Management

Introduction to Business Continuity Planning Management:
Millersville University in collaboration with Disaster Recovery International is sponsoring the 16 hour “Introduction to Business Continuity Planning Management Course this Spring.
This course will be offered in two formats, completely online or face-to-face in Harrisburg, Pa.
For more information, go to: http://www.millersville.edu/cdre/

Posted in Uncategorized | Comments Off

Active Shooer Info:

All,

DHS released a new website dedicated to Active Shooter Preparedness. The site is located at the following link: http://www.dhs.gov/activeshooter . Please keep for your own personal reference and feel free to share with your partners and stakeholders as widely as possible.

The purpose and a list of resources currently included on the site are listed below:

The Department of Homeland Security (DHS) aims to enhance preparedness through a ”whole community” approach by providing training, products, and resources to a broad range of stakeholders on issues such as active shooter awareness, incident response, and workplace violence. In many cases, there is no pattern or method to the selection of victims by an active shooter, and these situations are by their very nature are unpredictable and evolve quickly. DHS offers free courses, materials, and workshops to better prepare you to deal with an active shooter situation and to raise awareness of behaviors that represent pre-incident indicators and characteristics of active shooters.

The more awareness training we give, the better prepared all of us will be in dealing with any event.

Posted in Uncategorized | Comments Off

New “See Something, Say Something” Mobile App

News for Immediate Release

Jan. 10, 2013

Pennsylvania State Police Launch New “See Something, Send Something” App to Help Fight Terrorism

Harrisburg– A new smartphone application has been developed to help the Pennsylvania State Police receive reports regarding suspicious activity that may be linked to terrorism.

The new See Something, Send Something app allows suspicious activity to be captured as a photo or written note and sent to the Pennsylvania Criminal Intelligence Center (PaCIC).

“This App provides concerned citizens with an effective communications and reporting tool,” State Police Commissioner Frank Noonan said. “The See Something, Send Something mobile app, developed by My Mobile Witness, sends terrorism-related tips directly to PaCIC where tips are evaluated by analysts and assigned for investigation as warranted,” Noonan said.

The application, which is available at no cost for iPhone and Android phone users, also includes information on what to look for and when to report suspicious activity, along with how to receive important alerts.

“No one knows what goes on in your neighborhood better than you,” Noonan said. “You may see or hear things that seem out of the ordinary and raise your suspicions — if you see something suspicious taking place, report it.”

“One tip from an alert citizen can prove valuable and protect Pennsylvania from a potential terrorist act,” Noonan said.

My Mobile Witness uses patent-pending privacy protection software for safeguarding the integrity of tips and citizens’ personal information. The system allows the PaCIC to engage citizens without tracking location or storing of personal information. Submitted tips are immediately removed from the mobile device and purged from the My Mobile Witness system once delivered to the intelligence center for analysis.

Factors such as race, ethnicity, national origin, or religious affiliation alone are not suspicious activity. For that reason, the public should report only suspicious behavior and situations (e.g., an unattended backpack or briefcase in a public place) rather than beliefs, thoughts, ideas, expressions, associations, or speech unrelated to terrorism or other criminal activity. Only reports that document behavior reasonably indicative of criminal activity related to terrorism will be shared with local, state and federal partners.

“Prevention is everyone’s responsibility,” Noonan said. “We are one neighborhood, one state, one nation; and it is the responsibility of all to remain vigilant and to report suspicious behavior — one report can make a difference.”

In addition to the new mobile app, people can call the toll-free State Police Terrorism Tip Line at 1-888-292-1919 or email tips@pa.gov to report suspicious individuals or activity.

The Pennsylvania State Police have been receiving terrorism-related tips from the public since 2003.

In the case of an immediate threat or emergency, call 9-1-1 immediately.

Posted in Uncategorized | Comments Off