Lucas Videlaine – Articles (English)

Control versus Liberalism in Cyberspace 🌌

2022-09-24T12:00:00Z

As part of my studies at TalTech - Tallinn University of Technology, I was asked to write an essay on the topic of ‘Control VS. Liberation in Cyberspace’. This reflection was part of the ‘Legal Aspects of Cyber Security’ module, but it is more of an ethical and documented approach to the subject.
Representing several hours of research and writing, I am sharing my writing here in order to open up the debate more widely with you. Please feel free to give me your opinion on the subject, or constructive feedback on the overall drafting of the document, via Twitter for example.

Multi-factor authentication solutions in roaming 🔒

2022-09-20T12:00:00Z

MFA is now a major topic within organisations, particularly as they move towards a remote working approach. You hear about it regularly but don't know exactly what it is? Would you like to find out more? You've come to the right place, because in this short, easy-to-understand article, we'll define the principles and issues related to MFA, particularly in the context of roaming.

# Key terms and concepts

Let's start with an overview of the existing vocabulary, so that we can better appreciate what follows!

Digital nomadism: Digital nomadism refers to any form of use of information technology that allows a user to access the IT system of their company/organisation or employer from remote locations that are not controlled by the entity.
2FA - Two-Factor Authentication: Digital nomadism refers to any form of use of information technology that allows a user to access the IT system of their company/organisation or employer from remote locations that are not controlled by the entity.
MFA - Multiple Factor Authentication: Multi-factor authentication (MFA) is a security process that requires more than two verification factors to prove a user's identity. These can include biometric factors (facial recognition, fingerprint recognition, etc.), a unique code sent by SMS or email, a unique code generated by a dedicated application, etc.
OTP - One-Time Password: Multi-factor authentication (MFA) is a security process that requires more than two verification factors to prove a user's identity. These can include biometric factors (facial recognition, fingerprint recognition, etc.), a unique code sent by text message or email, a unique code generated by a dedicated app, etc.
Point of vigilance: Since 2021, ANSSI, the French National Agency for Information System Security, has distinguished between strong authentication and multi-factor authentication: strong authentication, in this definition, is based on cryptographic mechanisms considered strong but not necessarily on multiple authentication factors.

# The challenges

We can define two key objectives of MFA in the context of nomadic working, each of which can be adapted to the applicable context.

Calculate and reduce the degree of information exposure:

During business travel (at a hotel, at a client's premises)
During commuting (on public transport)
In public places (in coworking spaces, airports, stations)

Contain risks:

Loss or theft of equipment
Compromise of information contained in lost/stolen equipment
Compromise of equipment (user absent with workstation open)
Illegal access to the IS
Interception/alteration of information (data confidentiality/integrity)

The objective of a mobile IS is to achieve a level of security as close as possible to that of the internal IS, by addressing the most significant exposure risks.

# Regulatory developments

In order to prevent the risks associated with nomadism and regulate its use, it is important to integrate nomadism into the entity's Information System Security Policy (ISSP):

Identify the professions eligible for nomadism and teleworking
- Establish the level of sensitivity of data and activity

Establish regulatory constraints

Ensure proper control of nomadic users

Ensure the management and revocation of accounts and rights of nomadic users
- Manage mobile nomadic equipment

Raise awareness and train nomadic users

Warn about the risks associated with theft or compromise of IT equipment
Warn about information leaks and other indiscretions

Dedicate access equipment to an identified nomadic user

Link each piece of equipment to an identified and referenced nomadic user

# The main providers

The market for MFA solutions is quite extensive. We can quickly list the leaders in the field, but also a few products that also target SMEs.
Each manufacturer offers its own solution, which can be integrated more or less easily into an existing IT system, either on-premise and/or SaaS.

These include:

Microsoft MFA
Thales SafeNet Trusted Access
Okta MFA
OneLogin MFA
Cisco Duo MFA
Ping Identity
Fortinet FortiToken
inWebo MFA

The Recommendations on digital nomadism from ANSSI (French National Agency for Information System Security).

Hackers come to the rescue in a sex tape blackmail case 🕵️

2022-08-31T11:00:00Z

It was a Friday evening in November when I received a call for help from a mother who was being subjected to odious blackmail. Laure, as we will call her to protect her identity, had been given my contact details by one of her friends with whom I had already had the opportunity to work. She contacted me so that I could try to resolve the unfortunate situation.

Alongside my engineering studies at ENSIBS engineering school, I am developing an entrepreneurial activity providing cybersecurity services and consulting, but this situation is a first for me! No less motivated and particularly determined to defeat this despicable blackmail, I took stock of the situation, began to establish a context and drew up the premises for an action plan: we will not give in, we will not pay, and we will prevent the publication of the stolen content ✊

The troublemaker regularly renews his intimidation attempts using Laure's partner's stolen Messenger account, which contains photos and videos shared by the couple.
After several exchanges, I conclude that he is just an opportunist who took advantage of the account's weak password to set up his ransom demand. While buying time with the attacker, we complete the steps to close the Facebook account.

Drawing on my experience in crisis management, I advised Laure for over a week, reassuring her and listening to her concerns. I am fully aware of the constant stress she is under and am committed to helping her: people are my priority.
A few days later, there was relief: the account had been deleted by Facebook support, and the attacker no longer had access to the exchanged content. The attacker, who was likely operating from an internet café, did not take the time to back up his only means of leverage.

The mission is a success! 🔥 Still reeling from this experience, Laure and her partner ask me at length about the best habits to adopt to avoid going through this again:

✔️ Use passwords that are sufficiently long and include upper-case letters, lower-case letters, numbers, and special characters.
✔️ Use a different password for each of your accounts (use a password manager such as KeePass, Dashlane, or 1Password).
✔️ Enable and configure multi-factor authentication whenever possible.
✔️ Favour the use of secure messaging apps such as Signal.

The full article published in a local newspaper (in French) "Hackers Rennais" in PDF format.
The article in Le Télégramme newspaper in PDF format.

Memo - Docker commands 🐳

2022-07-28T00:00:00Z

Docker is free software that allows applications to be launched in software containers.
It is not virtualisation, but containerisation, a lighter form that relies on certain parts of the host machine for its operation. This approach increases the flexibility and portability of an application's execution, which will be able to run reliably and predictably on a wide variety of host machines, whether on the local machine, a private or public cloud, a bare machine, etc.
Technically, Docker extends the standard Linux container format, LXC, with a high-level API that provides a practical virtualisation solution that runs processes in isolation. To do this, Docker uses LXC, cgroups, and the Linux kernel itself, among other things. Unlike traditional virtual machines, a Docker container does not include an operating system, but instead relies on the operating system features provided by the host machine.

# Vocabulary definition

# Containers

Unlike traditional virtual machines, a Docker container does not include a guest operating system. Instead, it relies on the host kernel's features and leverages resource isolation (CPU, memory, I/O, network connections, etc.).

# Images

A Docker image represents the file system, without the processes. It contains everything you have decided to install on it, such as a database system, a web server, a Python application, etc. Images are created from configuration files, called ‘Dockerfiles’, which describe exactly what needs to be installed in the container. A container therefore corresponds to the execution of a specific image.

# Dockerfiles

The Dockerfile is your source file that enables the construction of an image. A Dockerfile can be included in other Dockerfiles and serve as the basis for several different images. You can choose to use official images, modified images, which you can find on Docker Hub or other image repositories, but you can also choose to customise your own images by writing a Dockerfile.

# Compose

Compose is a tool for defining and running multi-container applications. Since containers are ideal for microservice-based applications, it becomes necessary to manage the various containers and their interconnections.

# Volumes

Volumes are a mechanism that enables the persistence of data generated by and used by Docker containers. Docker volumes offer numerous advantages, such as ease of backup and migration, as well as simplified management thanks to Docker tools and commands.

# Kubernetes

Kubernetes is an open-source system that aims to provide a platform for automating the deployment, scaling, and implementation of containers.

# Essential commands

# Various information about Docker

docker info
docker version

# Create and start a container

docker run [image_name]

# Stop a container

docker stop [container_id]

# Start a container

docker start [container_id]

# Delete a container

docker rm [container_id]

# List started containers and list all containers

docker ps 
docker ps -a

# Stop all containers

docker stop $(docker  ps -a -q)

# Start all containers

docker start $(docker ps -a -q)

# Delete all containers (after stopping them)

docker rm $(docker  ps -a -q)

# List local images (pulled or built)

docker images

# Delete one or more images

docker rmi [image_id] [image_id] ...

# Building an image from a Dockerfile

docker build -t [wanted_image_name] -f [path_to_dockerfile]

# Run a docker-compose file in detached mode

docker-compose -d -f [path_to_docker-compose-file]

# Run a command within a container

docker exec -it [container_id] [command]
docker exec -it [container_id] bash

# Display the logs of a container

docker logs [container_id]

# Sources

Official documentation
My original article from 2018