Hackers target business secrets

Many net-savvy thieves are scouring corporate networks for saleable secrets

Intellectual property and business secrets are fast becoming a target for cyber thieves, a study suggests.

Compiled by security firm McAfee, the research found that some hackers are starting to specialise in data stolen from corporate networks.

McAfee said deals were being done for trade secrets, marketing plans, R&D reports and source code.
It urged companies to know who looks after their data as it moves into the cloud or third-party hosting centres.

"Cyber criminals are targeting this information based on what their clients are asking for," said Raj Samani, chief technology officer in Europe for McAfee.

He said some business data had always been scooped up when net thieves compromised PCs using viruses and trojans in a search for logins or credit card details.

The difference now was that there exists a ready market for the data they are finding. In some cases, said Mr Samani, thieves were running campaigns to get at particular companies or certain types of information.

The McAfee report mentioned cases in Germany, Brazil and Italy in which trade secrets were either stolen by an insider or cyber thieves tried to get hold of via a concerted attack.

In some cases, said the McAfee report, companies made the job of the criminals easier because they did little to censor useful information about a corporate's culture or structure revealed in e-mails and other messages.

Such information could prove key for thieves mounting a "social engineering" in which they pose as employees to penetrate networks.

The report detailed efforts by firms to watch casual and contract employees and the use of behavioural analysis software to spot anomalous activity on a corporate network.


Perimeter defences
Thefts of intellectual property or key documents could be hard to detect, said Mr Samani.

"You may not even know it's stolen because they just take a copy of it," he said.

Defending against these threats was getting harder, he said, because key workers with access to the most valuable information were out and about using mobile devices far from the defences surrounding a corporate HQ.

"Smartphones and laptops have crossed the perimeter," said Mr Samani.

The report comes in the wake of a series of incidents which reveal how cyber criminals are branching out from their traditional territory of spam and viruses.

2010 saw the arrival of the Stuxnet virus which targeted industrial plant equipment and 2011 has been marked by targeted attacks on petrochemical firms, the London Stock Exchange, the European Commission and many others.

Mr Samani said that, as firms start to use cloud-based services to make data easier to get at, they had to work hard to ensure they know who can see that key corporate information.

Otherwise, he warned, in the event of a breach, companies could find themselves losing the trust of customers or attracting the attention of regulators.

"You can transfer the work but you cannot transfer the liability," said Mr Samani.

[BBC]

Five security secrets your IT administrators don't want you to know

As valued members of your organization, IT administrators work every day to keep your infrastructure up and available. But in today’s rush to contain operational costs, your IT administrators could be taking more shortcuts than you’d expect. And perhaps no aspect of IT suffers more from cutting corners than does security. Here are five facts about IT security that your administrators probably don't want you to know.

Most passwords never change

Certainly, regulations may call for frequent password changes on all accounts in your infrastructure. But though your IT administrators may be tasked to change passwords on a regular basis, your organization probably lacks the automation to reliably change what could be thousands of the passwords that matter most.

Sensitive accounts like administrator logins, embedded application-to-application passwords, and privileged service accounts often keep the same passwords for years because IT staff may not have the tools to track and change them. And, because systems and applications often crash when IT personnel attempt to change interdependent credentials, many of your organization’s most privileged logins can go unchanged for extended periods of time.

Ad-hoc change processes and handwritten scripts might succeed in updating the passwords of some types of privileged accounts, but unless your organization has invested in privileged identity management software you can be sure that many of the passwords that grant access to your organization’s most sensitive information are never changed. This means that access to this data – whether by IT staff, programmers, subcontractors and others who ever had access – will continue to spread over time.

Too many individuals have too much access

Regardless of your written policies, highly-privileged account passwords are almost certainly known to large numbers of IT staff. And chances are, for the sake of convenience these logins have been shared with individuals outside of IT.

As a result contractors, service providers, application programmers, and even end-users are likely to have the ability to gain privileged access using credentials that may never change. Unless you’ve got technology in place to track privileged logins, delegate access, and change these powerful credentials after each time they’re used you’ll never know who now has access.

Your CEO's data isn't private

With all the recent headlines about corporate and government data leaks, you might still be surprised to know how many individuals have access to the files on your executive’s computers, and to the data resident in the applications that senior managers use every day. Anyone with knowledge of the right credentials can gain anonymous access to read, copy and alter data – including the communications and application data belonging to your executive staff. In many cases these credentials are known not only to senior IT managers, but also to IT rank and file, application programming teams, contractors and others. More than likely your low paid help desk workers have access to more sensitive data than your CFO. And those subcontractors in India? It’s likely that they can access the CEO's account, too.

IT auditors can be misled

If your administrators know about security gaps or failed policies that your IT auditors haven’t discovered they will most likely try to take the knowledge to their graves. IT staff have limited time to complete higher-visibility projects that influence performance ratings and paychecks, so in most cases you can forget about them fixing any security holes that your auditors fail to notice.

Security often takes a back seat

Is your IT administrators’ pay structure tied to security? No? Then they’re probably not as proactive as you might expect when it comes to securing your network. Most IT administrators won’t tell you about the security vulnerabilities they discover in the course of their jobs because they’re not paid to fight losing battles to gain resources necessary to close each discovered security gap.

Because pay packages are rarely tied to safeguarding your network, your IT administrator is also probably not taking the initiative to update her technical skills when it comes to security. As a result, even when budgets allow for purchases of new security technologies, your staff may have no clue how to actually use these new tools effectively.

Fundamentally, the security of each organization hinges on how well IT balances convenience with controls and accountability. All too often IT is given free reign to operate under its own rules when it comes to security and resists working under the same types of controls that apply to others in the organization.

Those organizations that work to bring IT into balance – introducing accountability through segregation of duties and adequate auditing controls while providing sufficient resources and incentives to provide proactive security – often come out ahead.

[Net-Security]

Hackers tackle secure ID tokens

The SecurID tokens are widely used to grant access to sensitive information

Hackers have stolen data about the security tokens used by millions of people to protect access to bank accounts and corporate networks.

RSA Security told customers about the "extremely sophisticated cyber attack" in an open letter posted online.

The company is providing "immediate remediation" advice to customers to limit the impact of the theft
It also recommended customers take steps, such as hardening password policies, to help protect themselves.


Proof positive
In the open letter, written by RSA boss Art Coviello, the company said that the data stolen would not help a "direct" attack on the the SecurID tokens.

It did not disclose exactly what had been purloined and only said that the information "specifically related to RSA's SecurID two-factor authentication products".

RSA's SecurID tokens are used by millions of people alongside passwords to beef up security.
As its name suggests, two-factor authentication involves improving security using two methods of identifying a user. The first factor is usually the traditional login ID and password combination.
The second factor can be a SecurID token that is paired with back-end software that generates a new six digit number every minute.

A token paired with this software generates the same numbers so only the holder will be able to type in the right digits and get access.

RSA said the information stolen could reduce the effectiveness of this two-factor authentication system if a company came under a broader attack by malicious hackers.

This could potentially put a lot of people at risk as RSA claims to have millions of people using its security technology to secure online accounts and access to corporate systems.

RSA recommended that firms monitor social network sites to spot if hackers were trying to capitalise on what they now know about RSA's systems.

This could be because hackers have got information about who has which token and might try to exploit that to trick employees into giving them access.

RSA also recommended reminding users about the dangers of responding to suspicious e-mails, to limit who can access critical infrastructure systems and to reinforce all policies surrounding SecurID token use.

There could be "tremendous repercussions" if criminals piggy-backed on what they know to stealthily get at corporate and other critical systems, said Richard Stiennon, chief research analyst at security firm IT-Harvest.

"You'd never have a sign that you've been breached," he said.

[BBC]

UK Government counts the Cost of Cybercrime

The British government has released a report on the annual cost of cybercrime to the United Kingdom. The study mechanism seems greatly flawed, in that it relies almost exclusively on published reports and expert opinions, rather than on any structured gathering of information from victims.

The news was announced in the press this week, for example in the Independent.

They came up with a 2010 annual cost of cyber crime of £27 billion (or $ 43 billion US Dollars). If the costs were projected evenly from the $ 2.2 trillion UK economy to the $ 14.1 trillion US economy, that would estimate our own costs of cybercrime at $ 275 billion (roughly 6.4 times larger economy.) There is no basis to believe that projection is accurate, but the scale is probably similar.

The study was paid for by the OCSIA, the Office of Cyber Security and Information Assurance. It was conducted by Detica, a BAE Systems company.

The full 32 page report is available from the Cabinet Office

They place costs at:
£3.1 billion to citizens with
£1.7 billion in Identity Theft
£1.4 billion to online scams.
£2.2 billion to the government
£21 billion businesses of which:
£9.2 billion in Intellectual Property theft
£7.6 billion in industrial espionage
£2.2 billion in extortion
£1.3 billion from direct theft
£1 billion in costs related to lost customer data

The Intellectual Property theft was certainly not evenly distributed. They put the most likely industries as:
£1.8 billion = pharmaceuticals & biotech
£1.7 billion = electronic & electrical material
£1.6 billion = software & computer services
£1.3 billion = chemicals
£800 million = automobiles & parts
£800 million = non-profits
£400 million = aerospace & defence

The greatest risk in Intellectual Property theft was believed to be untrustworthy insiders who fell to the pressure of bribery.

The Espionage Impact was largely in three areas:
£2.1 billion = financial services
£1.6 billion = mining
£1.3 billion = aerospace and defence
£900 million = software & computer services      

[GaryWarner] via [ComputerSecurityArticles]

BMI taken out by Anonymous

Hacktivists affiliated to Anonymous have taken out the website of Broadcast Music Incorporated in a protest against its stance against file-sharing.

The denial of service attack against the US-based performing rights society began late on Wednesday and remains ongoing, leaving its main bmi.com site difficult to access.

Anonymous claimed responsibility for the attack via a notice on a news site used by the loosely-knit 4Chan-spawned hacking collective.

The attack on an entertainment industry website represents a return to the type of attacks that were commonplace last year before the group turned its intention towards financial service firms that severed links with WikiLeaks and others seen as opposed to the whistle-blowing website. ®

[The Register]

Cyber attack on France targeted Paris G20 files

The French finance ministry has confirmed it came under a cyber attack in December that targeted files on the G20 summit held in Paris in February.

Budget Minister Francois Baron said an investigation had been launched, adding: "We have leads".
It follows a report in Paris Match magazine that claimed a sustained cyber attack sought documents related to the G20 and international economic affairs.

More than 150 computers at the ministry were affected.

'Determined professionals'


"We noted that a certain amount of the information was redirected to Chinese sites," an anonymous official was quoted by the French magazine. "But that [in itself] does not say very much."

An official complaint has been filed with French courts, and the matter has been taken up by the secret service.

"The actors were determined professionals and organised," Patrick Pailloux, director general of the French National Agency for IT Security told Paris Match.

"It is the first attack of this size and scale against the French state."

The summit agreed a list of targets for reducing imbalances in the global economy in order to head off future financial crises.

The topic was particularly contentious for the Chinese, who resisted calls to target exchange rate valuations, currency reserves and economic surpluses.

The US and other countries accuse China of buying up trillions of dollars in foreign reserves in order to hold down the value of the yuan and gain an unfair competitive advantage in trade.

[BBC]

Cyber Crime Costs Over $1 Trillion Globally?

A recent post on LinkedIn's Information Security Community piqued my attention yesterday with the following teaser for a Webinar:

As you may have read recently, Cybercrime is now costing the UK $43.5 billion and around $1 trillion globally.

The UK government report UK Cyber crime costs UKP 27BN/year published on the BBC’s website offers a top-level breakdown of the costs of cybercrime to Britain and is one of the most dubious reports I have seen recently in a long list of security-vendor and political hype around the cyber crime story.

Regardless of how badly UK businesses are hit by cybercrime, there are several extremely weak points in the work done by Detica for the UK government.

a) First  - they don’t have any empirical data on actual cybercrime events.

Given the number of variables and lack of ‘official’ data, our methodology uses a scenario- based approach.

Which is a nice way of saying

The UK government gave us some money to do a study so we put together a fancy model, put our fingers in the air and picked a number.

b) Second – reading through the report, there is a great deal of information relating to fraud of all kinds, including Stuxnet which has nothing to do with the UK cyber crime space.

Stuxnet does not seem to have put much of a dent in the Iranian nuclear weapons program although, it has given the American President even more time to hem and haw about Iranian nuclear threats.

What this tells me is that Stuxnet  has become a wakeup call for politicians to the malware threat that has existed for several years. This may be a good thing.

c) Third – the UK study did not interview a single CEO in any of the sectors they covered. This is shoddy research work, no matter how well packaged. I do not know a single CEO and CFO that cannot quantify their potential damage due to cyber crime – given a practical threat model and coached by an expert not a marketing person.

So – who pays the cost of cyber crime?

The consumer (just ask your friends, you’ll get plenty of empirical data).

Retail companies that have a credit card breach incur costs of management attention, legal and PR which can always to leveraged into marketing activities. This is rarely reported in the balance sheet as extraordinary expenses so one may assume that it is part of the cost of doing business.

Tech companies that have an IP breach is a different story and I’ve spoken about that at length on the blog. I believe that small to mid size companies are the hardest hit contrary to the claims made in the UK government study.

I would not venture a guess on total global cost of cyber crime without empirical data.

What gives me confidence that the 1 Trillion number is questionable is that it just happens to be the same number that President Obama and other leaders have used for the cost of IP theft – one could easily blame an Obama staffer for not doing her homework….

If one takes a parallel look at the world of software piracy and product counterfeiting, one sees a similar phenomenon where political and commercial organizations like the OECD and Microsoft have marketing agendas and axes to grind leading to number inflation.

I have written on the problems associated with guessing and rounding up in the area of counterfeiting here  and software piracy.

Getting back to cyber crime, using counterfeiting as a paradigm, one sees clearly that the consumer bears the brunt of the damage – whether it’s having her identity stolen and having to spend the next 6 months rebuilding her life or whether you crash on a mountain bike with fake parts and get killed.

If consumers bear the brunt of the damage, what is the best way to improve consumer data security and safety?

Certainly – not by hyping the numbers of the damage of cyber crime to big business and government. That doesn’t help the consumer.

Then – considering that rapid rollout of new and even sexier consumer devices like the iPad 2, probably not by security awareness campaigns. When one buys an iPhone or iPad, one assumes that the security is built in.

My most practical and cheapest countermeasure to cyber crime (and I will distinctly separate civilian crime from terror ) would be education starting in first grade. Just like they told you how to cross the street, we should be educating our children on open, critical thinking and not talking to strangers anywhere, not on the street and not on FB.

Regarding cyber terror – I have written at length how the Obama administration is clueless on cyber terror.

One would hope that in defense of liberty – the Americans and their allies will soon implement more offensive and more creative measures against Islamic and Iranian sponsored cyber terror than stock answers like installing host based intrusion detection on DoD PCs

[InfoSecIsland]

Malware has 'exploded,' says security manager

A report released earlier this year by Panda Security reveals just how sophisticated the business of cyber crime has become. Among its findings: botnets are now available as a service for criminals to rent and launch spam attacks --- with prices that start as low as $15 for the rental of a SMTP server.

See also: Smartphone botnets? New report predicts mobile devices will be part of DDOS attacks

Botnets, a network of infected computers controlled by a master bot to send out spam, spread viruses and launch attacks, are responsible for as much as 85 percent of all email spam, according to many estimates. While efforts by some security groups to stop them have been successful, botnets continue to be the attack vector of choice from criminals, making botnet detection and evasion an increasingly crucial part of the security program in many organizations.

More about botnets

* What a botnet looks like

* The botnet hunters

* Report: Rustock still top dog among spam botnets

* With botnets everywhere, DDoS attacks get cheaper

So what does an effective strategy look like? CSO spoke with Todd Ferguson, a network security manager at Raymond James Financial, a financial services holding company with subsidiaries engaged in investment, financial planning, investment banking and asset management. According to Ferguson, fighting botnets is like shooting at a moving target -- and there is no clear way to know if you're winning.

CSO: What would you say the threat landscape is like now in terms of botnets?

Ferguson: In my organization, we have a unique situation in that we have both independent and employee advisor models. In the case of our independent financial advisors, they are responsible for their own computing systems, networks, etc. The botnet issue is far more prevalent today than just for corporate users and financial advisors. It really transcends all users. It applies to clients, associates and independent contractors alike. Everyone is potentially at risk today. Botnets are not picky about who they target. Any user can be attacked and become a member of a botnet unwillingly. There are challenges to deal with once one of these devices is located, which includes cleaning and assessing the potential damage.

How do you locate a compromised device?

We are big believers in the layered security methodology. We don't rely on any one technology or intelligence source. We use a mixture, as well as our own internal monitoring. We are using the Damballa Failsafe component to monitor network traffic to identify potentially compromised machines through network behavior and intelligence applied. We also use conventional antivirus, IDS, IPS and some proprietary monitoring.

It's a combination of technologies and leveraging intelligence. There is no one silver bullet out there. Everyone has been struggling with the velocity of malware in the past few years. The landscape has changed quite a bit and we've been looking at some emerging technologies, such as Damballa. Internally, we refer to it as an alternative malware identification technique.

It's all about finding an indicator of compromise. We know that the antivirus vendors have struggled to keep up with the velocity of the malware, so we're looking at other services that can give us indicators of possible compromise. Once we see an indicator, we can intervene before it gets too far down the line.

How have things changed with regard to this threat in recent years?

One of the issues around the malware threat today, and the botnet threat specifically, is that in general creators of malware are no longer seeking notoriety. They're doing it for financial gain. Malware is centered around profit and it will interact with anyone. Once it connects to a device it will communicate with someone to either steal data or take other actions. So we're always concerned around loss of data or credentials that could be used to commit fraud.

I can't give you exact numbers on how much the threat has grown in recent years, but I can tell you it's exploded. You don't have to be technically proficient to write malware anymore. You can pay someone to do it as a service. You can easily find kits that will build malware, and you can even choose what you want it to do. We are to the point now where some of these kits and malware authors even offer support for their product.

Does part of your strategy also include an awareness campaign among employees?

Awareness is critical. One of my colleagues is dedicated to educating our associates and advisors through articles published internally, conferences, educational classes, and our annual attestation for policy review. We offer resources through our e-learning campus, and we initiate awareness campaigns if we see a threat or an emerging threat.

The attackers continue to target the same vectors, such as e-mail campaigns luring users to click on links within e-mails. We still see a lot of that, as do many other organizations.

How do you measure success?

It's a constant challenge. Success is a moving target, because the threats are ever changing. The landscape is not what it was a year ago, even two years ago, but we believe we are managing to stay ahead of the curve.

[ComputerWorld]

Five Myths About Fraud

We’ve all heard so much in the news about fraud over the last several years. Not a day goes by that we don’t hear about an executive caught with his hand in the cookie jar, a company that failed to follow proper accounting rules, or a compensation structure that led someone to cheat with the numbers.

In some ways, I think people are becoming immune to fraud. The cases don’t seem as significant as they would have been five years ago. They’re not as shocking as they used to be. It is sad that fraud is becoming more commonplace. And the more we hear about fraud, the more I think companies run the risk of not taking it seriously.

Most importantly, I think people are running around with some big misconceptions about employee fraud. If they mistakenly believe their company is not at risk, they are probably not actively preventing fraud. Companies must know the truth about fraud and its perpetrators in order to actively protect themselves.

The following are five of the fraud myths that I regularly run into in my fraud investigation practice. Whether owners and executives actually utter these out loud or not, merely buying into these myths mentally can be a recipe for disaster.

1. Our company does not have an internal fraud problem.


While companies would like to believe they have good employees and adequate controls to prevent fraud, the fact of the matter is that 45 percent of companies will be significantly affected by fraud, according to one international study. A separate study estimates that the average internal fraud will cost $159,000, and that almost one-fourth of fraud cases will cost companies over $1 million each.

Companies cannot afford to ignore the risk of fraud and the likelihood that fraud is occurring internally. It is too expensive, particularly when one considers the fact that there are many indirect costs of fraud, including investigation and legal costs, employee attrition, and decreased employee morale.

Actively fighting fraud means implementing policies and procedures that prevent and detect fraud. Anti-fraud professionals who are experienced with the common methods of fraud can be invaluable to this process. Whether a company gets there with employees or outside consultants, it is important to secure company information and assets to prevent internal fraud.

2. Most people are honest and won’t commit fraud.


This is a dangerous approach to take to the business of fraud. It is true that most people are generally honest. But to rely on this instead of putting controls in place to prevent fraud is a big mistake.

While it’s wise to hire those with a track record of honesty, past behavior doesn’t necessarily predict future behavior. Almost 88 percent of employees and executives who commit fraud against their employer have never before been charged or convicted of a fraud-related offense. This means it’s nearly impossible for companies to predict who is going to commit fraud and when they are going to do it.

It is a fact that honest people can and do commit fraud. Outside pressures can cause people to behave in ways they normally would not. Things that could push someone toward fraud include addictions, divorce, overwhelming debt, and gambling problems. When pressures like this are present, it’s difficult to predict who will commit fraud.

In the end, those who commit fraud come from all walks and ways of life. From clerks to executives, no one is immune. Thieves come from all social classes and all economic backgrounds. If given a strong motivation and ample opportunity, anyone can commit fraud against her or his employer.

3. If our company follows government regulations, we will be protected against fraud.


Unfortunately, the current accounting rules and regulations do not really provide protection against fraud. Sarbanes-Oxley is probably the most widely-recognized regulation dealing with fraud. It has had some positive effects because it has forced companies to review and document their policies and procedures.

Companies have spent enormous amounts of money on implementing Sarbanes-Oxley, and it’s probably discouraging to admit that even such an extensive project isn’t really preventing fraud. The regulation forces management and the board of directors to accept responsibility for issuing accurate financial statements, however, it doesn’t really ensure that companies have fraud prevention procedures in place.

In order to effectively prevent fraud, companies must create and implement policies and procedures specifically designed to deter and detect fraud. Again, this should be accomplished with the help of an anti-fraud professional who is experienced in the methods used by corporate fraudsters. A good fraud prevention program will actively prevent and detect fraud while still complying with the applicable regulations.

4. Small frauds aren’t important enough for management to worry about.


Virtually every big fraud started out as a small fraud at one point. Whether it is a minor theft of cash or a financial statement manipulation intended to cover up a substandard quarter, what starts out as a small fraud can quickly grow into a major fraud scheme. A theft of $500 may not seem significant enough for management to devote time and effort to the problem. But what if an employee was stealing $500 a week for three years? Suddenly, there is a theft of over $75,000, which could be very material to the company.

It’s important for companies to take small frauds and ethical lapses seriously. Not only does management want to cut off frauds while they are in their early stages, they also should be sending a message to employees that dishonesty is not tolerated. A zero tolerance policy is a necessary part of any good fraud prevention program.

It may be expensive to monitor and investigate smaller thefts from the company. However, in the long run, the cost will be worthwhile because the company will have stopped frauds from growing into the hundreds of thousands and millions of dollars. Therefore, an effective fraud prevention program will contain components that help the company discover fraud early.

5. Fraud will be detected by our auditors.


History has shown us that a company’s independent auditors cannot be relied upon to find fraud. This is true primarily because audits are not designed to detect fraud. They are designed to give “reasonable assurance” that the numbers shown on the financial statements are materially accurate.

Because fraud involves the active concealment of the truth, it makes it difficult for auditors to discover. Further, auditors have a tendency to become complacent with their clients. They see the same things year after year in the audit, and they may stop paying close attention. Employees who are concealing a fraud may also be comfortable with the auditors and know what procedures are coming. If that’s the case, count on the employees to be very careful with the fraud as it relates to those expected procedures.

Auditing rules have attempted to address how auditors approach the potential for fraud within companies. While the current rules are somewhat better than those of several years ago, a traditional independent audit still cannot be relied upon to detect fraud. Executives who believe differently are setting their companies up for disaster.

The Solution


Preventing fraud in companies all comes back to active prevention techniques and educating employees about fraud. First, owners and executives must be aware that they are very much at risk of experiencing internal fraud, and that the statistics show that the losses can be expensive. Then they need to take decisive action in formulating a fraud prevention program.

Education of everyone is still a very important part of fraud prevention. No company is immune to the problem, and no employee is completely free from the possibility of committing a fraud one day. After owners and executives appreciate the true magnitude of the problem, it will be through action that fraud will be prevented at their companies.

Tracy L. Coenen, CPA, CFF is a forensic accountant and fraud investigator with Sequence Inc. in Milwaukee and Chicago. She has conducted hundreds of high-stakes investigations involving financial statement fraud, securities fraud, investment fraud, bankruptcy and receivership, and criminal defense. Tracy is the author of Expert Fraud Investigation: A Step-by-Step Guide and Essentials of Corporate Fraud, and has been qualified as an expert witness in both state and federal courts. She can be reached at tracy@sequenceinc.com or 312.498.3661. 


[InfoSecIsland]

Private Smartphones, Tablets Threaten Office Networks

From the moment the first telecommuter logged into his work e-mail account from his personal computer, the line between work and home began to blur.

Today, thanks to mobile devices such as smartphones and tablets, we can surf the Web, send and receive e-mail and modify work documents from virtually anywhere.

Most smartphones and tablets are purchased by consumers for personal use. But many — even those on a family wireless plan — will also be used for work purposes both inside and outside the office.

This home/work overlap of mobile devices has created three major problems for the security industry as a whole.

Corporate IT teams can too easily lose control of the devices. Legal frameworks find it hard to demarcate between personal and corporate use. And security developers haven’t caught up with the new software.

Out of control


Smartphones and tablets streamline the way we communicate today. Forget about phone calls and e-mail -- these new devices make it easier to use social media, which is the way an increasing number of people, especially young adults, “talk” to each other.

However, the budgets of small or medium-size businesses often won’t cover networked mobile devices for anyone below top management levels.

So people bring their own devices to work and put them on the office network --- and, in many cases, don’t alert the IT or security departments about it.

Without knowing who’s accessing the network, or how often, it is difficult for a network administrator to make sure security policies are met.

The added risk of mobile devices is that they are easily lost or stolen. If the smartphone or tablet isn’t locked with password protection, outsiders will have access to potentially sensitive data and company e-mail messages.

IT departments do have options to protect corporate data on personal phones, said James Lyne, senior technologist at England-based security company Sophos.

“Platforms such as [Microsoft] Exchange can give administrators visibility of the types of devices users are using to access key services,” he said. “Acceptable use policies should also clearly outline users’ responsibilities: which devices are allowed, what security practices must be adhered to and how to notify IT if a device is lost or is otherwise compromised.”

If organizations don’t want employees using personal devices for business uses, devices can be restricted to services based on managed corporate assets, such as corporate-compliance software.

Many enterprises, however, will consciously allow users to mix personal and professional business on their smartphones or tablets. In these scenarios, it's critical that a security baseline is met and enforced.

No legal basis


Legal departments have their own challenges to face. Corporations have jurisdiction over company-owned devices, no matter how and where they are used. But privately owned devices aren’t as easily supervised.

In November, National Public Radio reported about a woman whose personal smartphone had been wiped clean by her employer. The remote wipe, which deleted everything on her phone, was a mistake, but the case raised the question of whether a company should have that much access to a personal device.

For corporate legal departments, it’s not clear which activities on a smartphone or tablet count as private use and which don’t.

What should legal departments be concerned about, and how should those concerns be passed along to the employee?

Lyne said mobile devices should be covered by the same compliance regulations as laptops or conventional computers. Loss of work-related data on a personal device is not acceptable.

“That said, the expectations of security controls on mobile devices are also less developed in many countries’ legal frameworks,” Lyne added. “Enterprises should make sure employees understand their obligations to manage and protect the device, but also should be conscious of the risk of data loss to their businesses. Where possible, minimize the flow of sensitive data to these device types to reduce the risk of loss.”

Hard to keep up

Mobile platforms present a new set of challenges to security, said Lyne. First of all, their presence greatly expands the number of operating systems – Android, BlackBerry, Apple’s iOS, HP’s WebOS -- that need to be protected.

“Microsoft operating systems have long been the primary focus area for security investment,” Lyne explained. “The broader set of platforms being used requires not only more coverage from solutions, but fundamentally protecting each of these devices is quite different in implementation and policy. These platforms, without standards, could increase the cost notably.”

Second, the mobility of these gadgets itself is a challenge. Each device constantly moves in and out of the network, and it almost certainly will be used for a blend of work and personal matters.

These changes in user behavior challenge conventional security policies, and will have a significant impact on the behavior of security technologies.

“The industry should not fall into the trap of trying to protect mobile devices with an identical model to the traditional computer,” Lyne said. “While security issues undoubtedly exist on these devices and we all need to recognize the likelihood of greater focus on these device by attackers, the threat vectors and protection model is different platform to platform.”

The immediate priority for businesses will be to manage the basic compliance of each mobile device.
Enterprises should know which devices are being used and ensure that password security, encryption and patching are all up to scratch.

Compliance is the key starting position for those looking to secure their mobile devices. However, as the threat evolves, so, too, will product requirements.

[SecurityNewsDaily]

Workers expose businesses to malware and data loss

Organizations are at risk of malware as 76% of workers plug unknown USB flash drives into company PCs, potentially compromising corporate network security, according to BlockMaster.

“This is alarming as many viruses on USB sticks can run as soon as they are plugged into a PC, without user activation and causing widespread damage to a corporate network,” says Anders Kjellander, CSO, BlockMaster.

Even if unprotected USB sticks are not infected with viruses or worms, they can contain sensitive corporate data, leaking important information to external organizations causing harm for the party that lost the device.

The research of over 1,000 UK office workers initiated by BlockMaster to reveal attitudes to handling portable devices, such as USBs, also revealed that 20% have lost unprotected USB drives holding sensitive information, exposing businesses to huge potential risks, such as loss of IP and reputational damage.

Around 83% of office workers use USB sticks today, making them almost as common as the mobile phone. However, although we often have work email on our mobile phones, it’s quite rare to store a significant quantity of sensitive business data on them.

Unsecure USB drives pose a unique security threat, as they are usually small, easy to lose and have a high capacity for storing documents, videos or corporate presentations.

The survey also discovered that approximately 85% of lost USB sticks are later found, so office workers hoping that lost sensitive data will simply ‘vanish’ will frequently be disappointed.

Organizations need to put technology and policies in place to secure and remotely manage their USB devices.

A lost unsecure and unmanaged USB stick can contain sensitive data including customer details – or in the case of public sector organizations, details of patient records, benefits or tax details – so it is imperative that organizations put in place a managed secure USB drive solution that automatically protects stored data and allows administrators to centrally manage them to perform policy updates and remotely erase any lost device. 

[net-security]

Unmasking Security Threats in the Workplace

Corporate security risks can creep up on you from anywhere in your company. Most people think that the greatest risks reside outside of the organization, from hackers trying to get their hands on company lists and other information they can sell.

Unfortunately, there are still a lot of internal risks that need to be addressed, as employees remain a major corporate security threat as well. Keeping up to date on new threats is important, as cyber-criminals and those from within your company can move from one scheme to the next in the blink of an eye.

Knowing where to start can be difficult. In the SANS document, "The Top Cyber Security Risks," it states:

"The number of attacks is now so large and their sophistication so great, that many organizations are having trouble determining which new threats and vulnerabilities pose the greatest risk and how resources should be allocated to ensure that the most probable and damaging attacks are dealt with first."

Common Corporate Security Threats

In order to determine where to start, you need to assess the workplace and figure out which threats exist inside and outside of the organization. Then, you'll want to prioritize these risks to figure out which ones to address first. Here are some of the common security threats your company might encounter:

Human Error: Intentional or not, people are security threats. Some examples of common human errors include:

• Misplacing information.
• Opening spammy emails.
• Failure to properly process information.
• Improper disposal of documents (electronic and paper).
• Sending email to someone other than the intended recipient (one of the dangers of auto fill!)

Disgruntled Employees: If your systems aren't secure, employees could be stealing all kinds of data before anyone notices it. There are a lot of reasons why a disgruntled employee might engage in these types of activities, including the fact that the employee see the opportunity and could use the money, or they feel the desire to take revenge on the company. Simple measures such as removing disc drives from computer towers can make a difference.

Cyber Criminals: Cyber criminals have developed a number of sneaky tactics to break into systems to get the information they want. In an article I read about a big-time cyber criminal in the NY Times, it almost seemed as if it wasn't about the information or the money, but simply the ability to hack into as many systems as possible. The tactics used by cyber criminals can be hard to catch, as many companies report that their systems had been invaded long before they knew anything was wrong.

Property Theft/ Misplacement: Information stored on laptops, USB keys and other portable devices increases security risks as these devices can be misplaced or stolen. These devices must be guarded by strong passwords and other recognition systems- facial scan, fingerprint, etc., in order to make sure information stays protected.

Insufficient Network Security: If your systems aren't properly guarded, it's easy for someone to break in. There are tons of ways that hackers weasel their way into your systems, so I recommend consulting a security or IT professional to find out which types of attacks you need to be on the lookout for. Find out which ones are most common and which ones could do the most damage, this way you can prioritize your actions.

Accessibility: When everyone has access to information in your organization, everyone could potentially steal that information. Sensitive information or information that doesn't pertain to one's job shouldn't be accessible to that employee. Clearly defined access roles make it easier to take control over sensitive information.

Social Media: The main security risk surrounding social media is personal information breaches and the sharing of confidential information over these networks. Some people post work related information in a Facebook wall post or when tweeting at someone, making the information available for a lot of people to see. There's a time and place for everything, and it's probably best not to have sensitive work related conversations with a colleague on a social media site.

Corporate security is the responsibility of everyone in the organization - not just the IT department. Security requires commitment from the upper-most levels of the organization so that the appropriate resources are available. No employee should be lazy about corporate security.

[infosecisland]

There's no money back if your account is drained by malware

Commentary - Phishing attacks on small and medium-sized businesses are on the rise with thousands of organizations falling victim. If a cybercriminal gets on to a computer with access to your business' financial accounts they can withdraw funds and your business is out of the money. That's it. Gone. See ya. Have a nice day.

Unlike consumer accounts that are subject to Federal Reserve Regulations E which require banks to provide reimbursement for certain losses, business accounts are not covered by this statute and therefore not assured repayment for certain losses. So don't bank on getting your money back.

And it's not just big business being targeted any longer. According to the FBI, cybercriminals now have their sights set on the financial accounts of small and medium-sized businesses, leading to significant disruption and substantial monetary loss due to fraudulent transfers from these accounts.

Online job postings could cost you more than you planned
Just last month, the FBI reported that cybercriminals had stolen more than $150,000 from a US business via an unauthorized wire transfer resulting from a malware infected email. In the latest phishing scams cyberthieves are embedding malware in email responses to job postings placed on employment websites with the aim of obtaining the credentials of an employee authorized to conduct financial transactions within the company. They then easily can change account settings to send wire transfers -- which is just what they did in the latest attack reported by the FBI. In its "New E-Scams & Warnings" the FBI identified the malware as a Bredolab variant, svrwsc.exe, which is a malware connected to the ZeuS/Zbot Trojan and commonly used by cybercriminals to defraud US businesses.

If the cybercriminal can get a company employee to open an infected attachment or click on a link that contains hidden malware they are in the door. The malware logs the key strokes and allows the thief to "see" and track the employee's activities across the business' internal network and on the Internet - be it visits to a financial institution, and/or online banking credentials. Using this information the thief can and does conduct unauthorized transactions that appear to be legitimate.

What you don't know can cost you
While you read about the latest malware or Trojan what you may not be hearing about are the financial losses that are hitting local businesses - like the NY marketing firm Little & King, LLC that reportedly faced bankruptcy last year, but apparently recovered, after $164,000 was drained from its account.
While privacy laws may require a business to notify its customers of a database breach, a business checking account that gets robbed in cyberspace, does not necessarily require notification. After all it is the cash of the business and not directly associated with customers. So the local business gets robbed, their money wired to who knows where -- lost and never to be recovered -- and no one outside the business is the wiser.

This is an issue for the FBI which is hamstrung to deal with the matter because the money moves offshore without a trace as increments of less than $10,000 are not reported.

And with more small to medium-sized businesses conducting online banking and with employees using the same computer they surf the net to check or store business financial information things look set to only increase.

And if you assume that the credit card protection policies apply to your business checking account, they do not. This problem is ugly for the banks because the money is withdrawn from them but with your credentials captured by the key-logger, so they avoid the liability.

This could change, but so far has not.

So what can you do?


1. Mind the cookie jar, because no one else is. Protect your business' computers that have access to financial accounts or information. After all, in addition to protecting your customers' privacy, without money to fund your business you have no business.

2. Know your bank's policy on fraudulent business wire transfers before you are hit.

3. Don't rely on traditional reactive anti-virus solutions as they clearly are not enough. Once you've been hit there is no turning back.

4. Implement proactive technologies like application whitelisting which stops these attacks.

5. Enforce business policies, if possible, to only allow dedicated computers access to financial accounts (although for the small to medium-sized business entrepreneur on the go this is often impractical).

6. Insist that your endpoint protection vendor deal with the problem. Symantec and McAfee are making billions on your annual subscription payments, but are not providing protection from these threats. As a business you may be required to use these anti-virus vendors for PCI DSS and other regulations and standards. They must be laughing all the way to their bank.

While many businesses have spent the past few years achieving compliance, overall small to medium-sized businesses have lost ground in keeping up with the evolving malware and endpoint security threats. If something isn't done quickly your business may not only lose business you may lose the business. You can take that to the bank.

biography
Paul Paget is CEO of Savant Protection, an application whitelisting provider for SMEs and MSPs. Based in Hudson, NH, Savant Protection's automated application whitelisting is being used by SMEs, including regional banks, credit unions and local governments, as well as MSPs to proactively and easily stop malware and safeguard endpoints. You can contact Paul at Paul.Paget@SavantProtection.com.


[ZDNet]

Failure to invest in secure software a major risk

Failure to take software security seriously is putting organizations, brands and people at risk, according to a report by Creative Intellect Consulting.

Key highlights from the report included:

Key software security and quality processes are not being followed
Despite many respondents carrying out reviews of their development and delivery processes, 59 percent of respondents are not following key security and quality processes ‘rigorously’. Twenty-six percent have little or no secure software development processes. Only 48 percent claim to follow audit procedures rigorously. Change control processes are followed by more than 93 percent of respondents, however.

Managers are jeopardizing secure software delivery, but they are not alone
When asked what was preventing respondents from improving security across the software delivery lifecycle, lack of management support and investment were cited by nearly two-thirds of respondents as the key reason. Sixty-nine percent claimed not having the right culture, attitude and mindset were to blame, and 69 percent said not having appropriate processes was the culprit.

There is a clear mandate for better education and training that cannot be ignored
More than 57 percent of respondents claimed that a lack of education and training support hampered their ability to deliver secure software. Over 70 percent felt that there was insufficient security guidance for key technology models such as cloud, virtualization, mobile devices and mainframes.

A mentality exists to invest in what we know
More than half of respondents claimed that investment in Quality Assurance (QA) tool and process support would have the most impact on improving security across the software delivery lifecycle. Yet less than five percent blame QA for failing to detect bugs and issues. Creative Intellect advised that QA is the goalkeeper in the development process and should not be the primary investment focus.

Compliance and regulation is a key driver
Sixty-six percent of respondents claimed compliance and regulation were key drivers for applying security to the software development lifecycle. These factors were closely followed by corporate security and risk management strategy (56 percent) and new customer or business requirements (45 percent), highlighting that companies are beginning to enforce better behavior on their suppliers and the business channel.

John Colley, CISSP, Managing Director EMEA, (ISC)2 said, “This report highlights significant gaps on following key security and quality processes required to develop and deliver secure systems and software. It appears that there is a significant failure to assess the risks associated with not recognizing the need for tight controls to deliver secure systems and software. Even though the industry seems to have recognized the significance of following a change control process, lack of management support and investment for improving security across the software development lifecycle is preventing it from following the rigorous discipline required to deliver secure systems and software.” 

[net-security.org]

What is an Information Security Expert?

I think of an expert as an individual who has attained superior performance in a particular domain. According to Dr. K. Anders Ericsson’s research on the topic, expertise is accomplished by instruction and extended practice, even though experts’ performance might look “so effortless and natural that we are tempted to attribute it to special talents.”

How can one become an information security expert? What does it mean to be one? Three types of expertise come to mind…

An Expert in an Area of Information Security
A classic way of thinking about an expert involves focusing on the specific area in which the person possesses the expertise. Even though the field of information security is a niche in the larger context of information technology or jobs in general, infosec has numerous areas of specialization, including:

• Application security
• Network defense
• Intrusion detection
• Incident response
• Security program management
• Virtualization security
• Malicious software

Therefore, one way to consider whether someone is an information security expert is to consider the extent to which the person has attained superior performance in one or more of the infosec domains.

An Information Security Expert with Business Savvy
Individuals who do not exhibit superior performance in one of the information security domains—sometimes called generalists—wouldn’t fall under the previous definition of an expert. However, another category of an information security expert is a person who has extensive understanding of business practices relevant to security.

Since information security exists in support of organizational goals, rather than an end in itself, infosec professionals can stand out in their ability to understand the business processes that influence their decisions and actions. This is why some information security professionals have perused an MBA education or are focusing on learning the business of the organization where they work.

“Business” isn’t a subset of information security, but rather a context within which security is conducted, which is why I didn’t list it among the infosec domains in the previous category. Also, note that business savvy is different from the skill of managing people.

An Expert in Combining Information Security Components
Another type of an infosec expert is a person who is able to piece together components from various security domains into a cohesive entity, be it a solution to a particular problem or an overall security program. This type of an expert is sometimes called an architect, as he is able to design a greater whole from the individual building blocks.

Security architecture could be listed as one of infosec domains. Yet, I see it as an overarching skill that typically stems from the experience of succeeding and failing at integrating security controls with each other. In the best case, such expertise is paired with the business savvy I mentioned in the previous scenario.

One perspective on expertise, described by Dr. Ericsson, is that experts “acquire a larger number of more complex patterns and use these new patterns to store knowledge about which actions should be taken in similar situations.” This, in my mind, is the key characteristic of an expert security architect.
It’s easy to mistake an expert security architect for a generalist, because such a person might no longer have in-depth expertise in any one of infosec domains.

Becoming an Information Security Expert
A common path of progressing in an infosec career involves mastering one security domain, then possibly another. The person might then find the need to obtain business expertise and also develop architecture skills. Those who achieve superior performance at one or more of these area are considered experts. Yet, like with all generalizations, this is one of many possible paths.

Becoming an expert is usually a matter of spending sufficient time on attaining the expertise. However, time alone isn’t enough. Dr. Ericsson points out that:

“Most individuals who start as active professionals or as beginners in a domain change their behavior and increase their performance for a limited time until they reach an acceptable level. Beyond this point, however, further improvements appear to be unpredictable and the number of years of work and leisure experience in a domain is a poor predictor of attained performance.”

Then what’s the magic ingredient? In addition to time spent practicing in the relevant field, a critical element is the extent to which the practice was deliberate, focusing on improving specific aspects of the person’s performance. This is where the individual’s education, training and apprenticeship experiences probably come into play.

Update 1: I outlined my thoughts on the role that notoriety plays in promoting one’s infosec expertise in a follow-up post.

Update 2: For more thoughts on information security careers, read Michael Kassner’s interview with Andre’ DiMino and I.

[Lenny Zeltser's Blog]

Corporate espionage via social networks

We've all heard about HBGary Federal's COO Aaron Barr's claims that he leveraged the information gathered on various social networks to discover the identities of Anonymous' leaders, and about the repercussions this claim had upon the company.



In the end, we still don't know whether Barr's work in this case has allowed him to come to accurate conclusions regarding those identities, but what we should know is that he isn't the only one who thought about using social networks to dig up information that might be worth a lot to someone - and I don't mean advertisers or stalkers here.

At this years' edition of the RSA Conference in San Francisco, Abhilash Sonwane - VP of Product Management and Technology for Cyberoam - gave an interesting talk about the possibility of using social media to map out the organizational DNA of a company.

He demonstrated that by using information gathered on LinkedIn, Facebook, Twitter and other social networks, they were able to discover who the decision makers are, how activities are coordinated and how knowledge is transferred, what objectives and incentives do the employees have and what the overall organization model is in a number of randomly selected small and medium sized companies from around the world.


According to their research, 57 percent of Fortune 500 companies engage in some form of social media activity - bulletin boards, social networking, online videos, blogging, wikis, etc. And is good they do, since these activities give them the ability to communicate individually with each member of the audience and helps them gather direct feedback that allows them to fine tune their approach and efforts.

But there's also a downside to all of this, and that concerns the information that is prematurely shared - and especially that which wasn't intended to be shared in the first place. "Unlike the traditional media where there are very defined and controlled inlets of information, social media is free," explained Sonwane. "Organizations cannot control who communicates what about them and to what audience. The whole eco system of the organization is free to communicate. Employees, partners, customers, ex-employees - they all have the same resources and power available as the official spokesperson of the company."

Knowingly or unknowingly, they occasionally misuse that power, and share what shouldn't be shared with the public - making corporate espionage a feat that doesn't require a lot of expertise.

To prove their point, Cyberoam researchers spent almost six months monitoring 20 companies with an active social media presence with the intention of verifying the extent to which employees and organizations can leak information and of mapping their organizational DNA.

This was their general modus operandi:


"When we started out, Facebook did not have the same privacy settings it has today, and that made things easier for us," Sonwane shared. "But I guess that still does not make that much of a difference, since one can work around the privacy settings by using social engineering."

The companies in question were from all over the world: eight from the USA, four from India, two from Germany, seven from the UK and couple from Singapore and Australia. They were also a mixture of PR agencies, pharmaceutical companies, banking and financial institutions, consultancies, media and entertainment companies, manufacturers and IT/tech firms.

So, what did they find out?

One of the targets was a Singapore-based multimedia company selected because of an impressive list of clients. They monitored the private Twitter accounts of the sales director, department head and various designers, and found out that employees were not getting a salary, that there were cash flow problems in the organization, that salary checks bounced and that employees were looking for new jobs.

They also discovered that the department head and the sales director have resigned, that the owner is likely to wind up the business and that the company was actually a subsidiary of another company (meaning that the decision rights resided with managers of the parent company - information that was not available on the company's website or any other official literature).

The availability of all this information puts both the company and its employees at risk. These disclosures decreased its chances to bounce back since vendors and customers privy to that information can stop doing business with it and new employees might consider not joining the organization after all.

And current employees searching for another employment might have difficulties negotiating a good salary since prospective employers could be aware of the fact that the company is going down the drain and that its employees might be getting desperate for a new job.

While looking for information on another company, researchers discovered - through publicly available information about the employees - that the financial director was a divorcee. So, they created a dummy female profile on Facebook, befriended him and cultivated an online relationship that ended in him sharing confidential information about the company with "her".

Similar tactics were used with all targets, and the end result was this:

• All 20 organizations monitored gave disclosure of at least one negative sentiment
• 17 organizations talked about issues internal to the organization that would not have been available otherwise
• 14 organizations disclosed the whole company profile of their organizations with information about employee demographics, business demographics and customers
• 14 disclosed information about the personal profile of the top management
• 14 disclosed information about their customers at one time or the other
• Eight organizations disclosed information confidential to their companies, financial details, prior announcement of senior management moving out, etc.

In short, the full organizational DNA of almost half of the companies was decoded, and that's the disappointing and worrying conclusion of this experiment.

Sonwane ended his presentation with stressing how important it was for each company to be aware of this danger, and take proactive or corrective measures to minimize the risks associated with the use of social media.

"Companies must prepare and educate their employees not only about the benefits of using social computing, but also about the consequences of its misuse. This education process should involve every department in the company including the management team, human resources, legal, sales and marketing," he concluded.

[net-security.org]

Under growing pressure, security pros may be ready to crack, study says

Faced with an attack surface that seems to be growing at an overwhelming rate, many security professionals are beginning to wonder whether their jobs are too much for them, according to a study published last week.
 
Conducted by Frost & Sullivan, the 2011 (ISC)2 Global Information Security Workforce Study (GISWS) says new threats stemming from mobile devices, the cloud, social networking, and insecure applications have led to "information security professionals being stretched thin, and like a series of small leaks in a dam, the current overworked workforce may be showing signs of strain."

"In the modern organization, end users are dictating IT priorities by bringing technology to the enterprise rather than the other way around," said Robert Ayoub, global program director for network security at Frost & Sullivan. "Pressure to secure too much and the resulting skills gap are creating risk for organizations worldwide ... They are being asked to do too much, with little time left to enhance their skills to meet the latest security threats and business demands."

As of 2010, Frost & Sullivan estimates that there are 2.28 million information security professionals worldwide. Demand for professionals is expected to increase to nearly 4.2 million by 2015, with a compound annual growth rate of 13.2 percent.

Application vulnerabilities ranked as the No. 1 threat to organizations among 72 percent of respondents, while only 20 percent said they are involved in secure software development.

Nearly 70 percent of respondents reported having policies and technology in place to meet the security challenges of mobile devices, yet mobile devices were still ranked second on the list of highest concerns by respondents. The study concludes that "mobile security could be the single most dangerous threat to organizations for the foreseeable future."

Cloud computing illustrates a serious gap between technology implementation and the skills necessary to provide security. More than 50 percent of respondents reported having private clouds in place, while more than 70 percent reported the need for new skills to properly secure cloud-based technologies.

Most security pros aren't ready for social media threats. Respondents reported inconsistent policies and protection for end users visiting social media sites, and nearly 30 percent had no social media security policies whatsoever.

The main drivers for the continued growth of the profession are regulatory compliance demands, greater potential for data loss via mobile devices and mobile workforce, and the potential loss of control as organizations shift data to cloud-based services, the study says.

Nearly two-thirds of respondents don't expect to see any increase in budget for information security personnel and training in 2011. Salaries showed healthy growth, with three out of five respondents reported receiving a salary increase in 2010.

[DarkReading.com] via [InfoSecurityNews]

Exxon, Shell said to have been hacked via Chinese servers

Exxon Mobil Corp. headquarters in Irving, Texas. Photographer: Jon Freilich/Bloomberg

A tanker enters Royal Dutch Shell Plc's Stanlow oil refinery in Ellesmere, U.K. Photographer: Paul Thomas/Bloomberg

Computer hackers working through Internet servers in China broke into and stole proprietary information from the networks of six U.S. and European energy companies, including Exxon Mobil Corp., Royal Dutch Shell Plc and BP Plc, according to one of the companies and investigators who declined to be identified.
McAfee Inc., a cyber-security firm, reported Feb. 10 that such attacks had resulted in the loss of “project-financing information with regard to oil and gas field bids and operations.” In its report, Santa Clara, California-based McAfee, assisted by other cyber-security firms, didn’t identify the energy companies targeted. The attacks, which it dubbed “Night Dragon,” originated “primarily in China” and occurred during the past three years.
The list of companies hit, none of which disclosed the attacks in filings with regulators, also includes Marathon Oil Corp., ConocoPhillips and Baker Hughes Inc., according to the people who worked on or are familiar with the companies’ investigations and asked not to be identified because of the confidential nature of the matter.
Chinese hackers broke into the computer network of Baker Hughes, said Gary Flaharty, spokesman for the Houston-based provider of advanced drilling technology. Baker Hughes concluded the incident didn’t need to be disclosed because it wasn’t material to investors, he said, declining to comment further.

Undetected Access

In some of the cases, hackers had undetected access to company networks for more than a year, said Greg Hoglund, chief executive officer of Sacramento, California-based HBGary Inc., a cyber-security company that investigated some of the security breaches at oil companies. Hoglund, who was cited by McAfee as a contributor to its report, declined to identify his clients.
“Legal information, information on deals and financial information are all things that appear to be getting targeted,” Hoglund said, summing up conclusions his firm made from the types of documents and persons targeted by the hackers. “This is straight up industrial espionage.”
Hackers targeted computerized topographical maps worth “millions of dollars” that show locations of potential oil reserves, said Ed Skoudis, whose company, Washington-based InGuardians Inc., investigated two recent breaches of U.S. oil companies’ networks. He declined to name his clients or the origin of the hackers.
‘Unsophisticated’ Techniques
The McAfee report described the techniques used to get into the energy company computers as “unsophisticated” and commonly used by Chinese hackers. The attacks began in November 2009, McAfee said. Two cyber investigators familiar with the probes said the attacks began even earlier -- in 2008 -- and involved several well-financed groups. The investigators asked not to be identified because the company investigations are private.
McAfee based the report on information gathered from its own work on the breaches and from others who were directly involved in investigating them. The report, produced on the condition that the affected companies not be identified, was done to “educate the community,” said Ian Bain, a McAfee spokesman.
The thefts of oil company data like those in the McAfee report match the profile of industrial espionage operations that have the backing or consent of the Chinese government, said Joel Brenner, former head of U.S. counterintelligence during the Bush and Obama administrations and now a lawyer with Cooley LLP in Washington. In his former post, one of Brenner’s jobs was tracking spying efforts against U.S. companies from foreign countries.

‘On the Hunt’

“The Chinese are on the hunt for natural resources to fuel this massive economic leap forward,” Brenner said.
Ma Zhaoxu, spokesman for China’s Ministry of Foreign Affairs, said he had no information about the attacks on the oil companies when asked about the issue at a regular briefing today.
“The Chinese government opposes hacking activities,” Ma said. “China falls victim to hacking itself. We will step up efforts to crack down on hacking crimes.”
The thefts might trigger legal liability for companies that chose not to disclose them to investors, said Blair Nicholas, a San Diego-based partner at law firm Bernstein Litowitz Berger and Grossman.
“To the extent that there aren’t adequate procedures in place to protect the companies’ crown jewels and somebody gets the key to jewelry box, there is certainly potential for shareholder derivative liability,” Nicholas said.

Securities Laws

Investors might also argue they had a right under U.S. securities laws to be informed of the thefts, which a judge might construe as a “material” fact that should have been disclosed, Nicholas said.
John Roper, a spokesman for Houston-based ConocoPhillips; Lee Warren, a Marathon Oil spokeswoman at its Houston headquarters, and Alan Jeffers, a spokesman for Irving, Texas- based Exxon, said in e-mail messages that their companies don’t comment on security-related issues. David Nicholas, a spokesman for London-based BP, and Kim Blomley, a spokesman in London for Shell, which is based in The Hague, declined to comment.
Jenny Shearer, an FBI spokeswoman in Washington, said she couldn’t comment on whether the agency was investigating the attacks. Laura Sweeney, a Justice Department spokeswoman, said the department can’t comment on a possible investigation.

Hacker Activists

Some aspects of the attacks were disclosed in internal e- mails made public after a February security breach at HBGary. The e-mails were stolen from HBGary’s computer network by the group of hacker activists called Anonymous, which posted them on the Internet.
“I’ve been able to confirm that the same attackers are conducting coordinated IP thefts against Baker Hughes and Shell Oil, going after bid data and operational reporting, as well as projects/plans and related financial information,” according to an e-mail written on Jan. 13 by an independent security consultant working on the cases.
“I reached out to some friends at Conoco and Exxon and they also experienced similar breaches,” the consultant wrote in the e-mail. “This is of course client confidential,” he added under the subject line “coordinated Chinese attacks on oil companies.”
In a separate e-mail, an HBGary investigator discussed the analysis of malware designed to steal data in the computers of a drilling rig working on a ConocoPhillips project.
Marc Zwillinger, an attorney representing HBGary, declined to comment on the e-mails’ content.

‘Stolen E-Mails’

“Those are stolen e-mails and they contain confidential information relating to clients,” Zwillinger said.
The McAfee report, which cites several attacks connected to the Chinese hacking underground, doesn’t link the “Night Dragon” attack directly to the Chinese government.
Analysts who assessed the attacks on energy companies said the source of the breaches was easier to pinpoint than in previous hits by Chinese hackers, including an attack against Google Inc. that that company disclosed in January 2010.
The hackers used tools prevalent in China’s underground hacking forums, the McAfee report said, and they appeared to work from 9 a.m. to 5 p.m., Beijing time. McAfee traced the hackers’ command-and-control operations to servers operated by a company in China’s Heze City in Shandong province.
The owner of the company, Song Zhiyue, said he wasn’t aware of any hacking taking place from his servers and that he always seeks to verify the activities of customers who rent server space from him.
“There are so many servers in the world,” Song said. “This has nothing to do with me. This is very unfair.”

[Bloomberg] via [Info Security News]

DDoS attack forces Dutch bank offline

The outage of Dutch bank Rabobank last weekend was caused by a massive DDoS attack. The perpetrators are still unknown. The bank reports the attack to the police.

After two days of mystery surrounding the outage Rabobank gave Dutch IDG-title Webwereld a statement explaining the breakdown of both its website and its e-banking services. The Dutch bank was hit by a large DDoS attack (Distributed Denial of Service). The outage of Rabobank happened saturday evening and again sunday afternoon. The website and e-banking services were inaccessible for desktop and mobile users.


Domino effect

The DDoS attack also caused an outage in the Dutch central payment system iDeal. That alternative to PayPal was flooded with returned transaction messages from the attacked bank. This DoS-'attack' (Denial of Service) caused the payment system to go partially down.

A spokesperson for iDeal-operator Currence tells Webwereld that the buffer of one of its two platforms was filled up. Banks that were connected to that affected platform were also unable to process iDeal payments.

Attackers

Rabobank has now stated that is was under attack by unknown parties. The website Rabobank.nl was bombarded with large amounts of traffic and subsequently collapsed. This was done with intent, says the bank. It will therefore file a police report about this DDoS attack. A spokesman could not tell Webwereld where the DDoS attack originated. "That is part of the investigation, about which we wil make no statements."

The bank already suspected that the outage was caused by malicious intent. It did not utter this suspension publicly until tuesday evening after it had confirmed the cause of the breakdown. Questions from Webwereld about the nature of the problem and the countermeasures had therefore not been answered yet.


Customers cut off

Rabobank's e-banking service was unreachable during the weekend on both saturday and sunday. To deflect the attack Rabo altered the DNS (domain name system) records for it's website. As a result the site was unreachable for the attackers but also for the general public.

Dutch customers of the bank have been complaining about the site and e-banking system being down long after the actual outage had been resolved. The bank was in discussions with local telecoms companies and internet providers to provide connections to Rabobank for their respective customers. This took until monday. Customers outside of the Netherlands were cut of until at least tuesday afternoon.


Government site hit by DDoS

Last week the centralized website of the Dutch government (Rijksoverheid.nl) was hit by a massive DDoS attack. A spokesperson told Webwereld that the attack originated "from a foreign country", but refused to specifiy that claim. The government website was offline for several hours. During that attack the website of the government organisation Rijkswaterstaat.nl was also hit, albeit only for a short time. The government has filed a police report.

[idg.no]

Man admits hacking into NASA, e-commerce servers

A Texas man has admitted hacking into servers owned by an e-commerce company and making off with about $275,000.

Jeremey Parker of Houston also copped to charges of breaking into servers maintained by NASA's Goddard Space Flight Center in Maryland and causing some $43,000 of damage.

The hacking spree spanned a 10-month stretch starting in December 2008 with the breach of systems owned by SWReg. A subsidiary of Digital River of Minnesota, the company manages royalties for independent software developers. “Parker hacked into SWReg's system, created the money by crediting the SWReg accounts, and then caused that money to be wire transferred to his bank account instead of the accounts of several developers,” a press release issued by the US Attorney's office in Minnesota said.

The NASA servers Parker hacked gave paying members of the scientific community access to oceanic data being sent to Earth from satellites. Eventually, the data was made available to everyone.

Parker faces a maximum penalty of 20 years in prison for a wire-fraud charge and 10 years on a separate computer-hacking charge. A sentencing hearing has not yet been scheduled. ®

[The Register]