Cyber Security Night In Bosaso University

[DR OSMAN]

 

[DR OSMAN]

This is my industry, I know I should be talking about it more. But my brain is always thinking about new knowledge as I get bored of my current knowledge in ICT. He is an 'engineer' he hasn't reached 'architect' level. In IT technical world. U start off as an 'officer' which is basic admin/support work, then go into engineer/programmer/project manager/business analyst.

Then it's 'architecture' which is highest level in your field. He doesn't know much knowledge about the business side of operations and needs since the 'tech' guy just knows the 'software and hardware' side of technical solution for companies or industries. We are in the game of 'data' ma garatay and people have to 'secure' it by legislation or get 'huge fines' by government and also for customer 'safety' of information. It's purely 'information' that technology is intended for.

The hacker scenario he gave requires many pre requisites before he can kill someone on a 'heart pacer'. He needs to identify where the 'server' is for 'heart pace' which is usually hospital. He will need to 'social engineer' in the hospital to find out 'passwords or find someone to follow and look at their password' to get access into their system. He will need 'remote' application tool to connect to that 'server' and that's only if 'security' systems allow incoming connection and if it doesn't he will need to turn it off some-way. He can plant the 'app' on any desktop inside the company but then inside companies they have 'rules and security profiles' so not all workers share the same view of the system thru permissions and rights. Hacking isn't easy. It can be 'done' but it requires lots of time n effort. It's usually done to ppl who are 'gulliple'. But u don't want extrem security @RasCanjero refusing to download files, the world wud stop if we didn't transact and send each other stuff. It's like when u drive, their is damn chance u will die but u dont stop driving right? IT is the same be cautious but not to the point it stops you from doing what u need on the internet.

I balance out our dept security risk profile and the information they need secured trust me Ras wud be fired with his 'dont touch it mentality' loooooooooool, it shows 'your not very tech savy' which means u must work in another industry bruv which is cool, we are all not experts of all industries. Trust me policy guys or accountants are like RAS DONT TOUCH IT LOL we security guys just laff it means the whole department can't function with the DONT TOUCH IT. We need awareness we have to spent alot of time educating our user base you can still do u work, just ensure it has no .exe on it. to hack your computer u need to 'write' a program first which is 'exe' platform or else its not even a program duhhhhhhhhh. Most dont write program, it's already available the 'algorithm' online u just click n save it. Its how u get it on other people is thru sending millions of emails and hoping for one loser to click it. Its not worth the time/effort truly.

 

[DR OSMAN]

I hope to do a security audit for PL. Your communication lines for civilians and 'military' need to be separated. Military must never use civilian facilities, this is the security communication line and must be invested into by PL, every country protects it's govt communication and military. Nacala idin ku yaal @Jablibax war sida aduunka uma shaqaysan idinku iyo @Libaaxseendheer welina waad isla doodaysan abahina wase. Khatarta ka imadi kara golis iyo somtel mana garanaysan inta wiil xun oo hindi ah ka iibsado wararkina cadowyashina. Siiba statekina iyo warkisa. I will perform a security audit of puntland communication facility, anigu dhinaca technology waan ka cawin kara, lakin dhinaca telephonyada ma aqani lakin waxan huba labaduba waa 'secure' line in australia.

As a short term solution.

1. Ensure your routers(international networks), switches(local network) has been reviewed to ensure communication is secure.
2. Ensure you have 'security' vetted the people who do your 'infrastructure' at GOLIS, and the manager because they are up for 'bribes' and this can hurt your whole state.

In security we are taught it's about your 'goals' ama 'hadaf'. Noone cares for civilians sxb, inta waqti iyo juhdi ka baxayso qof shacab ah without any real 'return' is why civilians are not targetted, plus they have nothing of worth to invest in. But some areas in your state 'target' bala saaraya oo waxaa loo arka 'high return'. Ogow aduunka waa 'hisaab' ma aha sidina oo kale oo dood

 

[DR OSMAN]

I will need to set up a new 'cable' run for military sites and ministries to separate them from civilian networks. This will be manned by puntite officials only who are trained in ICT. We don't need civilian around here, u need to 'security' vett people waryaa, dadkina oo dhan ayaa burburi karo. Aduunka nidaamkisa la gabsada u dumb fucks. I will connect up the router and switches for your 'govt a nd military' needs. I have to remove that terrorist guy duduble as shareholder who is a 'risk' and has funds to access to send to shabab your communications at GOLIS. His 'shareholder' and needs to leave immediately, looma iibsado dadkina router yar la geliyay iyo cable u know how CHEAP THHAT SHIT IS

I will bring my australian security team to help me 'secure' puntland lakin way igu qoslayan markay arkan ahmed jimacale oo sharholder ah thats number 1 risk. its like bin laden sitting as shareholdder of ATT.

PL govt needs to tell us their communication needs locally/globally, we will only 'open' those ports and traffic, and shut down the rest. We work on the principle of open only whats needed, close whats not. Like house adeer, u dont open all ur windows if you dont need it. All ministers will be given laptops and phones from our secured facility of communication. Waan yaaba marka arko iyaga civilian iska dhigayo, waaba qarsada si aysan australianka dawlada ila shaqayo uu arkin JAHILNIMADA

 

[DR OSMAN]

It's a shame that cyber security is attended by one office, this is the 'war' now. Ma jiro diplomatic oo naag loo diri jiray, everyone wants to hear your telephone or emails now. African union itself was bugged by china and transmitted to china. U need to have 'security' audit team of your ministries see loo hubiyo inaysan meeshani ku jirin 'cable' yar oo computuerkagi aado oo warka transmit gareeyo. I will ask my department team in australia govt to come to puntland with me on volunteering project because i cant convince them inu yahay dan australia dee, waa SADAQO, fucking hell. wadan sadaqo waxaa keenayo caqli jablibax iyo libaxsandheer oo number ku shaqayn karin lakin aduunka number weeye waa luqadisa.

I have to convince my department on 'charitable grounds' there is no australian interest in Puntland, ma aha meel istahilo 'xirir australia'. Lakin dhinaca sadaqo waa nidaam kale, waa in aan puntland ka dhiga meesha ugu haboon sadaqo, because xitaa safkasi sadaqo african dhan ba fadhiya oo list ku jira oo raba 'cawiinad' idinka isku keenteen oo ka baxdeen cilmiga aduunka. Somalia is in safka sadaqada, iyo xitaa safkasi waa inaad keenta business case si loo kala dorto yaa istahila ileen nidaamku waa HISAAB

 

[DR OSMAN]

Let's talk 'cyber' security. I would've attended this wallahi because it is so critical to keep our people safe, what's the point if your information everyone knows like terrorists, other nations, etc. U r always planning for failure. Today is a cyber security environment. So we need to prepare our 'defences'

1. Internal
2. External

This how we organize our departmental strategy in Australia. We look at all the 'risks' internally be it people, technology, processes. Yes processes can be a risk like if everyone is outside with govt information and leave it in public cafe, that is a failure of 'process' not a person or technology.

 

[DR OSMAN]

Based on Internal security.

We need people 'vetted' especially 'employees' who have 'access' to PL technology and 'phones'. This person can just walk out and pass this information to 'shabab' or 'sl' or anyone that gives them money. I will audit our 'employees' to ensure they are following a 'system', if there is no system, then we know it's chaos and 'chaos' produces nothing. I will create the Australian 'system' for employees. You need 'cards' to identify your 'govt' worker, Before their hired I want a 'security' assessment if they were 'criminals' because once a 'criminal' always 'criminal' except in special circumstances where they have proven to 'reform' and have 'evidence' and 'support' from their 'university' or workplaces. PL doesn't even have a 'criminal record' database for it's criminal judicial system so PL ministries can request the police to 'carry' out a 'criminal background' check. A-lot of our institutions are not even there which is half the problem in PL. I can plan for so much but if there is no 'institutional' organs to communicate with, there is nothing you can do in 'security' assessment.

In PL waxaa idin yimaado 'NGO' ama 'shirkado' not 'government' wallahi, we are not allowed to 'attend' non structured 'societies' because it is a 'conflict of interest' and no 'government interest'. They send you NGO to set up like a 'NGO GOVT' not a proper govt, you need to hire 'experienced' government officials or academics not businesses kkkkk. The problem is there is no 'nidaam' in PL and in Australia they know no 'nidaam' is 'chaos'. So they avoid unless on humanitarian intervention because in chaos or vacuum they know what comes sxb. Hadi manta nidaamka wasarada aan ka shaqayo ka baxo, hawshisa wasarada waa burbura, same with anything be it schools, universities, legal institutions, etc. I can't wait to retire for government and assist PL, but it's hard now because there is no 'govt' policy in Australia about Puntland, I have to follow 'Nidaamka'.

In Australia u have to follow systems since we are all made of complex parts and it needs to unified into 'system' it doesn't matter what it is but it has to have defined rule at all times. I will help PL to 'target' party donations for 'labor' party in Australia but we must assess his 'worth' ama hadu yahay niin ka soo bixi kara hisbigisa dhinaca dawlada, most of them are just MP and have one voice. We also need to set up relationship with companies who are 'donor funders' of political parties so they put in a 'good word for us' so we do not become a 'policy' and then I can help you because I am in the system of ministry markasi waxan haysta POLICY lagu hadli kara ama waa 'vacuum' like your region lama rabe. Remember the rules never 'bad mouth' other 'regions' they deem you 'conflict of interest' like when u go to an interview u can not speak badly of your previous employer. The same goes for Hamar/Hargeisa haba soo hadal qaadin and if u do always be positive of them and balanced about their needs and what is stopping them, dont get emotional because emotion is dead give away your not following 'nidaam' which means 'vacuum'

 

[DR OSMAN]

Anyways the technological side is the easiest to 'secure'. In IT security we focus on the unpredictable side 'people, processes, mistakes' not so much the 'tech' because the 'tech is easy to deal with'.

For example we use a 'mapping system' of the technology. In networks we define the critical infrastructure that needs protecting. For example the 'routers, switches' the main ones. They are kept in secure cabinets. We only allow 'security cleared people' to tamper with it. Infact 'highest level', even the people I work with have access to some thing and not others so security is broken down into 'layers'.

We also need to 'configure' the router and switches but we follow 'designs' which tell us what the client needs achieved. Once we know that, we know what port needs to be open depending on their 'needs' such as 'incoming/outgoing'. We need to configure 'vpn tunnels' sometimes when their scared to use 'public' networks of the world, we need to put in 'vpn server' in our routing table. We need to consider if their 'transacting' a-lot or 'storing' information. We need to configure for 'speed' so the department productivity isn't slowed down. That's just 'routers' bro but there is always other concepts in there depending if you need it.

Then we need to look at 'applications' and check the 'code' is suitable to our operating system security and yes we even 'secure' desktops with permissions and anti viruses, their quite extreme I say to waste money on all that but their is different philosophies.

The money we put into licenses is it really worth 'damage' of one PC, especially a PC with low level security anyways? they argue a sophisticated hacker can use that as 'loading' bay to 'navigate' into other areas of the dept. But our 'defence' is in-depth how is going to get thru different 'data' that are password secured? person secured low level rights, hardware secured with cards. Security guys are always arguing about is it 'worth it' because half the time the shit isn't worth it. Like Ras canjeero is it worth all the investment, time, effort, resources to get into his 'phone or laptop' the philosophy argues no it's not because u wasted so much resources for 'nothing' but a 'civilian' dude who has no power in his nation. That's why the hackers in civilian market are not considered 'sophisticated' their like our militias in somalia, u cant compare it to america or the west right? hackers have 'classes' also.

Plus we got a 'coder' in our team who 'writes' codes for different 'kernals'. It's copy n paste that, it's called a 'language' or 'script' like algebra. It's already been defined. U want the code to execute instructions on the computer, so u need to know how to 'instruct' it, it's all languages wallahi. I am not interested in coding, but once u learn the 'kernel' langauge, u can write a code quite quick for it. Coders are usually paid the least in our team cuz the 'answers' are available in the kernel language u just copy it over into your coding platform and compile.

Anyways the important area is 'networks' because u can't breach into a PC if u dont get past the routers and switches anyways.

 

[DR OSMAN]

It's a bit more then that. That's just simple security. In govt it's all a 'need to know' basis, u won't know their full 'design' but whatever area your assigned on. But it can include 'ISLANDS' for example u can configure an 'island' for each network and sub divide in the dept. We have back up strategies 'off site' to recover quickly from in the event of a breach, we have defined responses for each breach. For example 'logging' we have guys looking at 'logs' of all servers' to ensure it's healthy and following normal departmental activity, if there is even a little variation, they go back to 'reports' kkkk. We got policy team also who has to ensure we are in line with legislations, auditing, and following the department policy, we must then follow the minister policy, and then 'provide' savings on top of that which is another report. Cayaar ma jiro dawlada australia, everything is accountable. Ma jiro siyasi in our department beyond the MINISTER, inta kale 'qorsho' weeye iyo pay GRADE. Our ministry is like machine iyo system, meesha aad ka gashid waa lagu sheegaya on induction day. U have no right to political opinion under taxpayer funds in australia, u r hired for a job and pay grade and report to the department worker agreement

 

[Fresh]

Mashallah dr knows his shit

 

[Libaax-Joore]

How much security cyber make a year

 

[DR OSMAN]

How much security cyber make a year

It depends level, exp, qualification, contacts, industry. Meeshad ka gasho waa arin kale dawlad iyo private(banks) waa labo meeloodka ugu muhimsan oo technology budget wayn leh ileen 'data iyo lacag' bay mamulayan kkkkk, meelaha kale waxaa la dhaha medium size-small size kaasi waa liita. It depends on their budget how important cyber is. Hada sheekadu waa Defence due to govt investment

 

[DR OSMAN]

How much security cyber make a year

Me personally more govt experience then private sector(except first job) low level ahaa small place oo experience ku samaysan kari oo ku carari kari dawlada ama foundation ka dhigto on my CV, as it hard to compete as grad with thousands of grads, so I did 1 year experience in small place. As u know qof walbo waxay uu safan yihin CVgooda meeshay dan ugu jirto like dawlada or big banks to be exposed to technology at large scale environment

 

[Libaax-Joore]

Do u still work at cyber security or you are home takin pills

 

[DR OSMAN]

Do u still work at cyber security or you are home takin pills

Study leave baan qatay to do my master, it's half paid leave also of 1 year. I needed a break from the place it's very difficult culture, accountability, rules based structure. Wa Sida ciidamada bay uu dhisan yihin structurekooda gudaha dawlada not just shaqaalaha iyo management but systemka gudaheeda waa security strategykooda

 

[Libaax-Joore]

Ninyahow am coming to Australia ninyahow hadhan ah haye nin ina adeerka wa ina sifican Melbourne Australia igu so daweesa

 

[Libaax-Joore]

@DR OSMAN kuma hayo lol