Security (b)log - English edition: June 2025

2025-06-20

At the theatre

Picture from author

The Red Hall of the Meervaart Theatre in Amsterdam looks empty in the photo. Just a few minutes later, it was filled with around three hundred employees from the National Collection Centre (LIC) of the Dutch Tax Administration. And that laptop in the picture? That’s mine.

A few months ago, the organizers of this annual event got excited about my blog posts. Probably under the slightly risky assumption that “if he can write in an engaging way, he can probably speak that way too,” they invited me to take part in the program. So, on Tuesday, I braved the railway strike and headed to the capital. I had three missions: a presentation in the breakout program before lunch, a plenary talk in that big hall after lunch, and at the end of the day, the same story from the morning, but for a different group of about forty people. The colleagues who came to hear me in Room 9 were 92% women. Someone like me, from IT and security, rarely sees that many women together in a work setting. They were a fantastic, engaged audience and gave me a great glimpse into their world.

I mainly owed the invitation to my blog about Girl’s Day. (Quick recap: for a presentation to high school girls, I googled their names and showed them what I — an amateur in that field — had managed to find out.) The LIC folks wanted to hear that story too. There was one difference: on Girl’s Day, my talk was about the girls in the room, while at the Meervaart, it was about those same girls — so, not about the actual audience itself (and of course, I didn’t mention any names or overly sensitive details in either presentation). Still, the tension was visible on the faces in the Red Hall. Especially the revelation that presentations made with the free version of PowerPoint alternative Prezi are publicly available online triggered an audible “Oh!” from the audience. A video showing a ‘psychic’ effortlessly uncovering personal details about his clients wrapped it up nicely.

My other presentation was titled Phish & Chats and covered phishing, chat apps, and artificial intelligence. The first part was a nostalgia trip for many: “Who of you has never received a phishing email?” No hands. “Hey Dad, this is my new phone number.” Murmurs in the room. English, with an Indian accent: “Hello, this is the Microsoft Helpdesk.” Nods all around. Naturally, I also gave them some tools to recognize phishing — because on a bad day, any individual employee might be the organization’s last line of defense when a phishing email lands in their inbox. And in that moment, you really want your colleague to respond appropriately.

The chat apps segment covered the pros and cons of various platforms. In short: don’t use WhatsApp for work due to privacy concerns, and don’t use Telegram at all. For internal government communication in the Netherlands, Webex is available. Signal is also an excellent choice.

Artificial intelligence (AI) also fell under the “Chats” part of Phish & Chats, because all those handy tools like ChatGPT, Gemini, and Copilot are smart chatbots — you can literally chat with them. I discussed how they work, how I view them from a professional standpoint, and what our organization does and doesn’t allow (allowed: Copilot Chat; not allowed: all others).

For me, the day was a warm bath of thumbs-ups, compliments, and thank-yous. And I hope that those who haven’t yet started reading the Security (b)log will now begin — not for me, but to become familiar with what’s happening in information security and their own role in it. Soon, I’ll be visiting a team closer to home, and after the summer, I’ll be back at our IT auditors’ annual conference. Yesterday, we discussed potential topics, and I’ll be working on finding a connecting thread in the coming weeks. In the meantime, I’ll also be a guest on a podcast. But more on that later.

And in the big bad world…

2025-06-13

The Hague brought to a standstill

Image from Pixabay

By now, you’ve probably heard, at least, if you live in the Netherlands: in just over a week, the city of The Hague will become an impenetrable fortress.

People living and working anywhere near the World Forum conference center have already been dealing with the disruptions caused by the largest security operation in history. But just like with an iceberg, what you see is only a fraction of the whole picture.

The last event of this scale was the Nuclear Security Summit in 2014, which also brought dozens of world leaders to that same conference center. In the eleven years since, the threat landscape—especially in terms of cybersecurity—has changed dramatically. Attack methods have become more sophisticated, and so have the people behind them. Much more sophisticated. And cunning. Which is troubling, because as an ordinary citizen, there’s little you can do to defend yourself.

“I’m just a regular person—what does this NATO summit have to do with me?” I hear you think. And yes, most of us won’t be directly involved. But that doesn’t mean you won’t be affected. In fact, you might be—without even realizing it.

Here’s why. Major events like this act as a magnet for what we broadly call malicious actors. Just like pickpockets flock to crowded markets, cybercriminals and spies are drawn to high-profile global gatherings. They’re after three things: money, information, and influence. The first is mostly the domain of criminals, though some rogue states aren’t above it either (looking at you, North Korea).

Stealing information is typically associated with state actors from countries like Russia, China, and Iran (plus a few others not on the public list). But don’t underestimate the criminals here either: ransomware attacks not only paralyze organizations but also steal data, which they then threaten to publish unless a ransom is paid. That increases their chances of getting paid.

Influence can be exerted in various ways. One is through disinformation—shaping public opinion, or even swaying the views of summit attendees. Some heads of state are surprisingly susceptible to such manipulation. Another tactic is disrupting the summit itself, throwing off schedules or even derailing the entire event.

Whatever the motive, these activities often start in the same place: phishing. Around events like this, phishing attempts spike—often themed around the event. You might get an email that looks like it’s from the City of The Hague: “Are you experiencing disruptions due to the NATO summit, such as being unable to get to work? Click here to apply for compensation.” Malicious actors know they’re more likely to succeed if they strike a nerve and dangle the promise of money.

Regular phishing is like shooting with a shotgun: blast it out to as many people as possible and see who bites. But there’s also targeted phishing—spearphishing—where a specific individual is the target and the message is custom-crafted. Expect to see more of that in the context of the NATO summit too.

I do wonder how they manage it in the Vatican. The Pope passed away, and five days later his funeral was held—with many dignitaries in attendance, including the U.S. President. Meanwhile, the Netherlands has been preparing for the NATO summit for months. Maybe it’s time for an educational field trip to Rome.

And in the big bad world…

2025-06-06

From slippers to biometrics

Image from Pixabay

Some nursing homes use facial recognition to keep elderly people with dementia inside, the Dutch tv news reported a few months ago. Because I am always on when it comes to possible topics for this blog, I made of note. And now I finally get around to explaining why that report caught my attention.

Facial recognition is a form of biometrics, just like a fingerprint scan or voice recognition. Biometrics means something like 'measuring biological characteristics'. The technology is based on the fact that every person has a number of unique characteristics. Based on these, you can identify someone. And to reassure you: biometrics doesn’t store your complete fingerprint or a photo of your face. Instead, a number of specific characteristics are recorded, such as the distance between your eyes and other proportions. When checking your access rights, a camera or scanner is used to check whether these characteristics are in its database. That is why the fingerprint scan on your phone suddenly works less well if you have been doing a lot of DIY: your finger is too rough to match.

So we use biometrics to gain access to something. Not to be denied access. But that is exactly what those nursing homes do. The front door is always open, but if the camera sees someone approaching who is not allowed outside because it is not safe for them, the door is locked. The nursing homes love it: "Otherwise we have to keep the doors closed for all residents. Now we turn that around: the doors are open."

And what if a smart resident sticks on a fake moustache, I wonder. Or puts on sunglasses. There is a good chance that he will not be recognized and will happily walk outside. Now I don't know if smart and demented can go together, but yes, I am obliged to my position to assume that things can go wrong. Edward Murphy is my role model (you know, the one with that law: everything that can go wrong, will go wrong).

What we see there is biometrics turned upside down. Why is biometrics not applied in the usual way? Everyone who is allowed to go outside is in the system. If he or she is recognized, the door swings open. If someone comes shuffling along who is not allowed to go outside and therefore is not in the system, the door stays closed. You have to be very clever to fool the system.

Before those nursing homes switched to biometrics, they used wristbands or sensors in their clients' slippers. Even then, they worked with open doors, which were locked only for some. But of course, you could easily work around that: take off your slippers and voila, you were outside. And a bit of fiddling with the wristband also turned out to work. Incidentally, the switch to biometrics has a double face: on the one hand, a band that is visible to everyone has a stigmatizing effect, on the other hand, the barely visible biometrics makes it difficult to enter an official protest – a right that also dementia patients have.

A nursing home is not a prison. Only residents who, due to their condition, are not safe to go outside alone, are kept inside – with the permission of themselves or their legal representative. Visitors are welcome and must be able to walk in and out freely. Open doors give a relaxed feeling, and thus contribute to a dignified existence. From that perspective, I understand the reverse approach, and I can imagine that there will not be that many clients who know how to hack the system. For most other applications, however, I like to stick to biometrics as they are intended.