Posted by Mark Brousseau
As 2010 came to an end, it was no surprise that payments security was a top priority for financial institutions, credit card companies, merchants and consumers.
Progress in stopping attacks was achieved last year, resulting in many high-profile arrests. More than 50 individuals involved in the highly publicized Zeus gang were apprehended, and developers of the Mariposa botnet, which stole information from approximately 12.7 million users around the world, were arrested. Most recently, five arrests were made this year for taking part in a series of denial-of-service attacks against major websites as part of the group "Anonymous."
Despite these efforts, cyber fraud is far from being eliminated. In fact, it is evolving into groups (WikiLeaks), resulting in even more malicious and dangerous attacks on consumers and organizations in 2011.
Daniel McCann, president of NetSecure Technologies, a provider of online transaction security solutions, sees the following payments security trends and issues in 2011:
... The emergence of hacker groups
... An increase in mobile fraud as mobile commerce increases
... More attacks on Apple’s i-products as they continue to dominate the industry
... A significant increase in security spending, especially in new technologies like virtualization
What do you think?
Showing posts with label information security. Show all posts
Showing posts with label information security. Show all posts
Wednesday, February 2, 2011
Monday, November 29, 2010
There’s a Bounty on your Applications
By Anthony Haywood of Idappcom
In the last year there have been a number of organizations offering rewards, or ‘bounty’ programs, for discovering and reporting bugs in applications. Mozilla currently offers up to $3,000 for crucial or high bug identification, Google pays out $1,337 for flaws in its software and Deutsche Post is currently sifting through applications from ‘ethical’ hackers to approve teams who will go head to head and compete for its Security Cup in October. The winning team can hold aloft the trophy if they find vulnerabilities in its new online secure messaging service – that’s comforting to current users. So, are these incentives the best way to make sure your applications are secure?
At Idappcom, we’d argue that these sorts of schemes are nothing short of a publicity stunt and, in fact, can be potentially dangerous to an end user's security.
One concern is that, by inviting hackers to trawl all over a new application prior to its launch, just grants them more time to interrogate it and identify weaknesses which they may decide is more valuable if kept to themselves. Once the first big announcement is made detailing who has purchased the application, with where and when the product is to go live, the hacker can use this insight to breach the system and steal the corporate jewels.
A further worry is that, while on the surface it may seem that these companies are being open and honest, if a serious security flaw were identified would they raise the alarm and warn people? It’s my belief that they’d fix it quietly, release a patch and hope no-one hears about it. The hacker would happily claim the reward, promise a vow of silence and then ‘sell’ the details on the black market leaving any user, while the patch is being developed or if they fail to install the update, with a great big security void in their defences just waiting to be exploited.
Sometimes it’s not even a flaw in the software that can cause problems. If an attack is launched against the application, causing it to fail and reboot, then this denial of service (DOS) attack can be just as costly to your organisation as if the application were breached and data stolen.
A final word of warning is that, even if the application isn’t hacked today, it doesn’t mean that tomorrow they’re not going to be able to breach it. Windows Vista is one such example. Microsoft originally hailed it as ‘it’s most secure operating system they’d ever made’ and we all know what happened next.
A proactive approach to security
IT’s never infallible and for this reason penetration testing is often heralded as the hero of the hour. That said technology has moved on and, while still valid in certain circumstances, historical penetration testing techniques are often limited in their effectiveness. Let me explain - a traditional test is executed from outside the network perimeter with the tester seeking applications to attack. However, as these assaults are all from a single IP address, intelligent security software will recognize this behavior as the IP doesn’t change. Within the first two or three attempts the source address is blacklisted or fire walled and all subsequent traffic is immaterial as all activities are seen and treated as malicious.
An intelligent proactive approach to security
There isn’t one single piece of advice that is the answer to all your prayers. Instead you need two and both need to be conducted simultaneously if your network’s to perform in perfect harmony: application testing combined with intrusion detection.
The reason I advocate application testing is, if you have an application that’s public facing, and it were compromised the financial impact to the organization could potentially be fatal. There are technologies available that can test your device or application with a barrage of millions upon millions of iterations, using different broken or mutated protocols and techniques, in an effort to crash the system. If a hacker were to do this, and caused it to fall over or reboot, this denial of service could be at best embarrassing but at worst detrimental to your organization.
Intrusion detection, capable of spotting zero day exploits, must be deployed to audit and test the recognition and response capabilities of your corporate security defences. It will substantiate that, not only is the network security deployed and configured correctly, but that it’s capable of protecting the application that you’re about to make live or have already launched irrespective of what the service it supports is – be it email, a web service, anything. The device looks for characteristics in behavior to determine if an incoming request to the product or service is likely to be good and valid or if it’s indicative of malicious behavior. This provides not only reassurance, but all important proof, that the network security is capable of identifying and mitigating the latest threats and security evasion techniques.
While we wait with baited breath to see who will lift Deutsche Post’s Security Cup we must not lose sight of our own challenges. My best advice would be that, instead of waiting for the outcome and relying on others to keep you informed of vulnerabilities in your applications, you must regularly inspect your defences to make sure they’re standing strong with no chinks. If you don’t the bounty may as well be on your head.
What do you think?
In the last year there have been a number of organizations offering rewards, or ‘bounty’ programs, for discovering and reporting bugs in applications. Mozilla currently offers up to $3,000 for crucial or high bug identification, Google pays out $1,337 for flaws in its software and Deutsche Post is currently sifting through applications from ‘ethical’ hackers to approve teams who will go head to head and compete for its Security Cup in October. The winning team can hold aloft the trophy if they find vulnerabilities in its new online secure messaging service – that’s comforting to current users. So, are these incentives the best way to make sure your applications are secure?
At Idappcom, we’d argue that these sorts of schemes are nothing short of a publicity stunt and, in fact, can be potentially dangerous to an end user's security.
One concern is that, by inviting hackers to trawl all over a new application prior to its launch, just grants them more time to interrogate it and identify weaknesses which they may decide is more valuable if kept to themselves. Once the first big announcement is made detailing who has purchased the application, with where and when the product is to go live, the hacker can use this insight to breach the system and steal the corporate jewels.
A further worry is that, while on the surface it may seem that these companies are being open and honest, if a serious security flaw were identified would they raise the alarm and warn people? It’s my belief that they’d fix it quietly, release a patch and hope no-one hears about it. The hacker would happily claim the reward, promise a vow of silence and then ‘sell’ the details on the black market leaving any user, while the patch is being developed or if they fail to install the update, with a great big security void in their defences just waiting to be exploited.
Sometimes it’s not even a flaw in the software that can cause problems. If an attack is launched against the application, causing it to fail and reboot, then this denial of service (DOS) attack can be just as costly to your organisation as if the application were breached and data stolen.
A final word of warning is that, even if the application isn’t hacked today, it doesn’t mean that tomorrow they’re not going to be able to breach it. Windows Vista is one such example. Microsoft originally hailed it as ‘it’s most secure operating system they’d ever made’ and we all know what happened next.
A proactive approach to security
IT’s never infallible and for this reason penetration testing is often heralded as the hero of the hour. That said technology has moved on and, while still valid in certain circumstances, historical penetration testing techniques are often limited in their effectiveness. Let me explain - a traditional test is executed from outside the network perimeter with the tester seeking applications to attack. However, as these assaults are all from a single IP address, intelligent security software will recognize this behavior as the IP doesn’t change. Within the first two or three attempts the source address is blacklisted or fire walled and all subsequent traffic is immaterial as all activities are seen and treated as malicious.
An intelligent proactive approach to security
There isn’t one single piece of advice that is the answer to all your prayers. Instead you need two and both need to be conducted simultaneously if your network’s to perform in perfect harmony: application testing combined with intrusion detection.
The reason I advocate application testing is, if you have an application that’s public facing, and it were compromised the financial impact to the organization could potentially be fatal. There are technologies available that can test your device or application with a barrage of millions upon millions of iterations, using different broken or mutated protocols and techniques, in an effort to crash the system. If a hacker were to do this, and caused it to fall over or reboot, this denial of service could be at best embarrassing but at worst detrimental to your organization.
Intrusion detection, capable of spotting zero day exploits, must be deployed to audit and test the recognition and response capabilities of your corporate security defences. It will substantiate that, not only is the network security deployed and configured correctly, but that it’s capable of protecting the application that you’re about to make live or have already launched irrespective of what the service it supports is – be it email, a web service, anything. The device looks for characteristics in behavior to determine if an incoming request to the product or service is likely to be good and valid or if it’s indicative of malicious behavior. This provides not only reassurance, but all important proof, that the network security is capable of identifying and mitigating the latest threats and security evasion techniques.
While we wait with baited breath to see who will lift Deutsche Post’s Security Cup we must not lose sight of our own challenges. My best advice would be that, instead of waiting for the outcome and relying on others to keep you informed of vulnerabilities in your applications, you must regularly inspect your defences to make sure they’re standing strong with no chinks. If you don’t the bounty may as well be on your head.
What do you think?
Tuesday, November 23, 2010
Network Security Facing Dual Challenge
By Dan Joe Barry, Napatech
Network security systems are under pressure. You might not be experiencing it yet, but you will soon. The dual challenge of dealing with more attacks at higher speeds threatens to undermine the stability of the most important commercial platforms of the 21st century; namely the Internet.
What can be done to address these challenges and avert the economic impact of an Internet collapse?
For many, the Internet is synonymous with web browsing, email and chat. But, the Internet and, IP-based networks in general, are now the foundation for a host of commercial services with significant impact on our daily lives.
On-line shopping is familiar to many, as is net-banking, but the financial world has now become reliant on the Internet for executing banking and investment transactions, sometimes thousands per second. Government services have also moved on-line. The Internet is used extensively in education and healthcare to provide distance services and expert consultation. The advent of cloud computing means that corporations will be more reliant than ever on the Internet to support their business.
In short, without the Internet, our lives would come to a grinding halt.
The development of the Internet as a commercial platform has not gone un-noticed by criminal organizations, which are exceptionally innovative in finding new ways of generating revenue! They have displaced the amateur hacker enthusiasts as the key threat to the Internet.
The open and global advantages of the Internet are now suddenly disadvantages as cybercriminals can attack from any location in the world, beyond the reach of domestic law enforcement agencies.
To understand the scope of the network security challenge, consider figures from Trend Micro, a leading provider of network security solutions, who have reported an explosive growth in the number of unique malware samples (i.e. types of attack) over the last 20 years.
Network security system vendors are struggling to respond to these new attacks as quickly as they occur. In a sense, they are playing a cat-and-mouse game with adversaries who are at least as intelligent and innovative at exploiting weaknesses in networks and applications, as they are at detecting attacks.
Higher data rates compound the challenge facing network security system vendors. IP networks are now being upgraded from 1 Gbps to 10 Gbps link speeds with 40 Gbps and 100 Gbps on the horizon. At 1 Gbps, a network security system needs to analyze up to 1.5 million packets per second. At 10 Gbps, this becomes 15 million packets per second. This is per port and only in 1 direction.
The challenge for network security system vendors is to ensure that their systems:
• Can handle up to 15 million packets per second per port in each direction
• Have the necessary processing power and memory to analyze packets in real-time
• Can scale to detect millions of new malware samples and higher line rates
The traditional approach to building network security systems is to build customized hardware including ASIC chip development. However, with the exponential growth in malware and higher line-rates, network security systems need to scale in both terms of data handling and computing power on a regular basis. This in turn means that the lifetime of a product revision will be shorter.
This begs the question: can network security system vendors keep up and have they got the deep pockets required to fund custom hardware and chip development on a regular basis?
It also leads to the question: is there another way?
High-performance network security systems can be based on standard, off-the-shelf PC servers when these are combined with Intelligent Real-time Network Analysis adapters for handling full line-rate data.The advantage of this approach is that it takes advantage of the strong roadmap of PC server and CPU chip vendors who are updating their performance and the number of processing cores they support on a yearly basis.
Basing high-performance network security system development on standard PC servers with Intelligent Real-time Network Analysis adapters provides a path to addressing the dual challenge of more malware at higher line-rates. It provides a cost-efficient, yet high-performance model that allows network security system vendors to focus on their expertise, namely combating cybercriminals and protecting the vital commercial platform that the Internet has become.
What do you think?
Network security systems are under pressure. You might not be experiencing it yet, but you will soon. The dual challenge of dealing with more attacks at higher speeds threatens to undermine the stability of the most important commercial platforms of the 21st century; namely the Internet.
What can be done to address these challenges and avert the economic impact of an Internet collapse?
For many, the Internet is synonymous with web browsing, email and chat. But, the Internet and, IP-based networks in general, are now the foundation for a host of commercial services with significant impact on our daily lives.
On-line shopping is familiar to many, as is net-banking, but the financial world has now become reliant on the Internet for executing banking and investment transactions, sometimes thousands per second. Government services have also moved on-line. The Internet is used extensively in education and healthcare to provide distance services and expert consultation. The advent of cloud computing means that corporations will be more reliant than ever on the Internet to support their business.
In short, without the Internet, our lives would come to a grinding halt.
The development of the Internet as a commercial platform has not gone un-noticed by criminal organizations, which are exceptionally innovative in finding new ways of generating revenue! They have displaced the amateur hacker enthusiasts as the key threat to the Internet.
The open and global advantages of the Internet are now suddenly disadvantages as cybercriminals can attack from any location in the world, beyond the reach of domestic law enforcement agencies.
To understand the scope of the network security challenge, consider figures from Trend Micro, a leading provider of network security solutions, who have reported an explosive growth in the number of unique malware samples (i.e. types of attack) over the last 20 years.
Network security system vendors are struggling to respond to these new attacks as quickly as they occur. In a sense, they are playing a cat-and-mouse game with adversaries who are at least as intelligent and innovative at exploiting weaknesses in networks and applications, as they are at detecting attacks.
Higher data rates compound the challenge facing network security system vendors. IP networks are now being upgraded from 1 Gbps to 10 Gbps link speeds with 40 Gbps and 100 Gbps on the horizon. At 1 Gbps, a network security system needs to analyze up to 1.5 million packets per second. At 10 Gbps, this becomes 15 million packets per second. This is per port and only in 1 direction.
The challenge for network security system vendors is to ensure that their systems:
• Can handle up to 15 million packets per second per port in each direction
• Have the necessary processing power and memory to analyze packets in real-time
• Can scale to detect millions of new malware samples and higher line rates
The traditional approach to building network security systems is to build customized hardware including ASIC chip development. However, with the exponential growth in malware and higher line-rates, network security systems need to scale in both terms of data handling and computing power on a regular basis. This in turn means that the lifetime of a product revision will be shorter.
This begs the question: can network security system vendors keep up and have they got the deep pockets required to fund custom hardware and chip development on a regular basis?
It also leads to the question: is there another way?
High-performance network security systems can be based on standard, off-the-shelf PC servers when these are combined with Intelligent Real-time Network Analysis adapters for handling full line-rate data.The advantage of this approach is that it takes advantage of the strong roadmap of PC server and CPU chip vendors who are updating their performance and the number of processing cores they support on a yearly basis.
Basing high-performance network security system development on standard PC servers with Intelligent Real-time Network Analysis adapters provides a path to addressing the dual challenge of more malware at higher line-rates. It provides a cost-efficient, yet high-performance model that allows network security system vendors to focus on their expertise, namely combating cybercriminals and protecting the vital commercial platform that the Internet has become.
What do you think?
Friday, September 3, 2010
The buck stops here: the role of CEOs in data security
Ray Bryant, CEO of idappcom explains why the big chair in most organizations can carry a lot more responsibility than you might think:
You would never consider purchasing an inferior accounting system that opens your organization up to financial loss through bad record keeping - potentially putting it out of business and generating the wrath of shareholders and other stakeholders this would cause.
Yet many managers will cheerfully purchase an inferior, but lower-cost, IT security defense system for their company, and later regret that purchase when hackers successfully compromise their firm's data, ruining the firm's reputation and opening it up to financial penalties that could well put it out of business.
Welcome to the business horror that is a data breach.
As with all technology-driven issues, to make a decision on which IT security system to go with, the CEO (and his team) must first understand where the problem is - in this case, where a data breach originates.
While the popular media perception is that IT security defenses are there to protect an organization's digital assets from external attack, the reality is that a large number of incidents are the result of internal threats compromising the firm's data. However, a quick scan through the constant stream of media reports about the unfortunate companies - and their equally unfortunate senior managers - who are put through the data breach wringer, will frequently reveal that the data breach was due to an internal hack.
Beware, internal does NOT always mean the person is physically in your premises. It just means they are internal to your systems. More and more cases revolve around a hacker gaining entry through ‘back doors’ into your computer, they could be anywhere on the net certainly outside your jurisdiction even if you ‘caught’ them.
But it gets worse, as an increasingly common hacker methodology is to crack the security of one company and use that system as a launch pad to hack into other systems. Ever had an email returned “undeliverable” and you did not send it? You’ve been hacked and probably been sending emails with attacks/backdoors in them to your entire contact list, and a list the attacker wanted to send to. You may now be a spammer as well.
The liability for all attacks including ‘secondary’ attacks lies with the CEO who has allowed - either directly or indirectly - his/her company systems to be misused in this manner.
The problem of inter-linked computer systems is a growing one, as the larger the company, the more reliance it places on computers and connections. These connections are the lifeblood of the cybercriminals, who tap into the fact that the privilege levels of user IDs that interconnect with third-party systems invariably tend to be higher than direct external accounts. Put simply, this means that an internal account from company A will have a much greater degree of access to company B's computer systems than an individual’s external account to company B's systems.
It's all about trust - as today's IT professionals will confirm, the interconnectivity between companies is now so pervasive it increases the risk profile of inter-system IDs to much higher levels than most people are aware of. This is the stuff that lawsuits are made of and can you guess who carries the can for these problems? That's right - the CEO and his/her senior management.
In many `hacked' systems, a risk analysis/penetration test - no matter what the size of company concerned - would normally have revealed the weaknesses in its security that the hacker(s) exploited. Questions that are asked by a risk assessor include what are the system's entry points and what data is accessible, and, of course, whether fraudulent transactions can be originated.
Issues addressed by the risk assessor include whether the data is classified, and what levels of protection are used in which areas of the system. Other topics up for discussion include whether the organisation has the level of expertise available, internally or externally, that understands the security requirements, and whether the security devices are configured to meet the organizational needs.
We often find that following a data breach, it becomes apparent that not only was the organisation's security lacking and poorly configured, but there is often a lack of understanding amongst senior management as to what the role of IT security is within the business. This brings us back to the popular misconception that IT security systems are there to protect the company IT resources against external attacks, ranging from fraudsters all the way to cybercriminal phishing attack vectors.
The reality, as our research team has discovered, is that fraud normally comes from the inside - either a rogue employee generates the fraud or, increasingly, a hacker who has got through a security device and installed a backdoor on the system that now allows them to freely move around, monitor and appear to be an internal person. You don’t know they are there until it’s too late.
One of the most interesting aspects of dissecting a given security breach is how often, apart from the breach itself, the hacker has been able to get inside the company's IT systems. This has the potential to be even more damaging than it may at first appear because in the build up to the fraud and subsequent data breach, most cybercriminals operate in `stealth mode' and can therefore milk the company's finances for a lengthy period before they are rumbled by conventional IT audit methodologies. This means that, for almost all organizations, enhancing the IT security of the company - by ensuring it is maintained as up to date as automatically possible - is an absolute necessity, and not the IT luxury that many senior managers perceive it to be.
Put simply, this means that spending hundreds of thousands of dollars, pounds or Euros on a security system, plugging it in and switching it on - then presuming your company is secure - is a totally inadequate approach, because it usually results in relatively poor levels of protection for your organisation as the threats from criminals are constantly changing. Configuration, constant evaluation and constant updating of security rules are essential to the IT security of a business. Of course, the degree to which protection is needed is a matter of balancing risk and cost, and this equation is a unique business decision as with any other senior management process.
Assuming that the ROI charts have been prepared and the risk analysis process completed, the next step on the road to deploying effective IT security is to ensure it is working properly, and stays that way. This is a stumbling block that many companies fall at, as frequent verification checks on the efficiency - and efficacy - of an IT security platform need to be made. Whatever the system - and whatever the smoke and mirrors from the 'theory' sellers - there is only one way to validate against KNOWN threats, and that is to play those threats in a controlled way, through the company's actual live prevention set-up. Test, review, and test again - not in the lab, but in a real business environment, where actual threats exist and can be tested against. It's my supposition that a good CEO should also look for the IT teams ability to not only define the threat but also have a solution that can be deployed to meet that threat in as short a timeframe as possible.
Our own tests suggest, in fact, that one of the most popular (free) security systems will spot very few threats without the necessary configuration, and new security rules issued by the vendor each month represent about 10% of the actual new, very relevant, threats that appear each month. This issue arises because configuration needs a method of evaluation to ensure its efficacy and, in the event that faults are discovered during the review process, to allow the configuration to be revised and new rules introduced to remediate the problem; immediately not months later.
In an ideal world, it would be possible to remediate all threats, but in the real world, this would significantly slow the IT system down, meaning that a compromise between threat checking and system performance is usually required. By using an optimum configuration validation system, you can get the best of both worlds. The amount of IT security your organisation actually needs can only be judged by an effective risk analysis process, followed by a cost/benefit exercise.
It's also worth noting that in most countries - particularly the US and member states of Europe - there is now clear legislation and/or good corporate governance requirements that make the CEO clearly responsible for any security breaches.
CEOs are not only responsible for the effect of attacks to their own IT systems, but they are responsible for hackers who use their system to attack others. The growing trend for major corporations systems - particularly in manufacturing and distribution - to link their computers together using electronic data interchange (EDI) systems, with very little manual intervention, opens yet another `backdoor' for hackers to spread their activities. As with any pain, it comes after the attack. Your defences need to be up at all times, not just when audited or it will be the audit that shows you where you may have been slowly bleeding to death.
What do you think?
You would never consider purchasing an inferior accounting system that opens your organization up to financial loss through bad record keeping - potentially putting it out of business and generating the wrath of shareholders and other stakeholders this would cause.
Yet many managers will cheerfully purchase an inferior, but lower-cost, IT security defense system for their company, and later regret that purchase when hackers successfully compromise their firm's data, ruining the firm's reputation and opening it up to financial penalties that could well put it out of business.
Welcome to the business horror that is a data breach.
As with all technology-driven issues, to make a decision on which IT security system to go with, the CEO (and his team) must first understand where the problem is - in this case, where a data breach originates.
While the popular media perception is that IT security defenses are there to protect an organization's digital assets from external attack, the reality is that a large number of incidents are the result of internal threats compromising the firm's data. However, a quick scan through the constant stream of media reports about the unfortunate companies - and their equally unfortunate senior managers - who are put through the data breach wringer, will frequently reveal that the data breach was due to an internal hack.
Beware, internal does NOT always mean the person is physically in your premises. It just means they are internal to your systems. More and more cases revolve around a hacker gaining entry through ‘back doors’ into your computer, they could be anywhere on the net certainly outside your jurisdiction even if you ‘caught’ them.
But it gets worse, as an increasingly common hacker methodology is to crack the security of one company and use that system as a launch pad to hack into other systems. Ever had an email returned “undeliverable” and you did not send it? You’ve been hacked and probably been sending emails with attacks/backdoors in them to your entire contact list, and a list the attacker wanted to send to. You may now be a spammer as well.
The liability for all attacks including ‘secondary’ attacks lies with the CEO who has allowed - either directly or indirectly - his/her company systems to be misused in this manner.
The problem of inter-linked computer systems is a growing one, as the larger the company, the more reliance it places on computers and connections. These connections are the lifeblood of the cybercriminals, who tap into the fact that the privilege levels of user IDs that interconnect with third-party systems invariably tend to be higher than direct external accounts. Put simply, this means that an internal account from company A will have a much greater degree of access to company B's computer systems than an individual’s external account to company B's systems.
It's all about trust - as today's IT professionals will confirm, the interconnectivity between companies is now so pervasive it increases the risk profile of inter-system IDs to much higher levels than most people are aware of. This is the stuff that lawsuits are made of and can you guess who carries the can for these problems? That's right - the CEO and his/her senior management.
In many `hacked' systems, a risk analysis/penetration test - no matter what the size of company concerned - would normally have revealed the weaknesses in its security that the hacker(s) exploited. Questions that are asked by a risk assessor include what are the system's entry points and what data is accessible, and, of course, whether fraudulent transactions can be originated.
Issues addressed by the risk assessor include whether the data is classified, and what levels of protection are used in which areas of the system. Other topics up for discussion include whether the organisation has the level of expertise available, internally or externally, that understands the security requirements, and whether the security devices are configured to meet the organizational needs.
We often find that following a data breach, it becomes apparent that not only was the organisation's security lacking and poorly configured, but there is often a lack of understanding amongst senior management as to what the role of IT security is within the business. This brings us back to the popular misconception that IT security systems are there to protect the company IT resources against external attacks, ranging from fraudsters all the way to cybercriminal phishing attack vectors.
The reality, as our research team has discovered, is that fraud normally comes from the inside - either a rogue employee generates the fraud or, increasingly, a hacker who has got through a security device and installed a backdoor on the system that now allows them to freely move around, monitor and appear to be an internal person. You don’t know they are there until it’s too late.
One of the most interesting aspects of dissecting a given security breach is how often, apart from the breach itself, the hacker has been able to get inside the company's IT systems. This has the potential to be even more damaging than it may at first appear because in the build up to the fraud and subsequent data breach, most cybercriminals operate in `stealth mode' and can therefore milk the company's finances for a lengthy period before they are rumbled by conventional IT audit methodologies. This means that, for almost all organizations, enhancing the IT security of the company - by ensuring it is maintained as up to date as automatically possible - is an absolute necessity, and not the IT luxury that many senior managers perceive it to be.
Put simply, this means that spending hundreds of thousands of dollars, pounds or Euros on a security system, plugging it in and switching it on - then presuming your company is secure - is a totally inadequate approach, because it usually results in relatively poor levels of protection for your organisation as the threats from criminals are constantly changing. Configuration, constant evaluation and constant updating of security rules are essential to the IT security of a business. Of course, the degree to which protection is needed is a matter of balancing risk and cost, and this equation is a unique business decision as with any other senior management process.
Assuming that the ROI charts have been prepared and the risk analysis process completed, the next step on the road to deploying effective IT security is to ensure it is working properly, and stays that way. This is a stumbling block that many companies fall at, as frequent verification checks on the efficiency - and efficacy - of an IT security platform need to be made. Whatever the system - and whatever the smoke and mirrors from the 'theory' sellers - there is only one way to validate against KNOWN threats, and that is to play those threats in a controlled way, through the company's actual live prevention set-up. Test, review, and test again - not in the lab, but in a real business environment, where actual threats exist and can be tested against. It's my supposition that a good CEO should also look for the IT teams ability to not only define the threat but also have a solution that can be deployed to meet that threat in as short a timeframe as possible.
Our own tests suggest, in fact, that one of the most popular (free) security systems will spot very few threats without the necessary configuration, and new security rules issued by the vendor each month represent about 10% of the actual new, very relevant, threats that appear each month. This issue arises because configuration needs a method of evaluation to ensure its efficacy and, in the event that faults are discovered during the review process, to allow the configuration to be revised and new rules introduced to remediate the problem; immediately not months later.
In an ideal world, it would be possible to remediate all threats, but in the real world, this would significantly slow the IT system down, meaning that a compromise between threat checking and system performance is usually required. By using an optimum configuration validation system, you can get the best of both worlds. The amount of IT security your organisation actually needs can only be judged by an effective risk analysis process, followed by a cost/benefit exercise.
It's also worth noting that in most countries - particularly the US and member states of Europe - there is now clear legislation and/or good corporate governance requirements that make the CEO clearly responsible for any security breaches.
CEOs are not only responsible for the effect of attacks to their own IT systems, but they are responsible for hackers who use their system to attack others. The growing trend for major corporations systems - particularly in manufacturing and distribution - to link their computers together using electronic data interchange (EDI) systems, with very little manual intervention, opens yet another `backdoor' for hackers to spread their activities. As with any pain, it comes after the attack. Your defences need to be up at all times, not just when audited or it will be the audit that shows you where you may have been slowly bleeding to death.
What do you think?
Wednesday, March 3, 2010
Turn Off WiFi To Help Prevent Laptop Theft
Posted by Mark Brousseau
From the UK, Credant Technologies is warning laptop users to turn off their WiFi signals before stowing their laptop in the trunk of their car or stashing their laptop in an office file cabinet or desk drawer, apparently out of sight of thieves.
"BT Openzone recently announced it had passed the million WiFi access point mark in the UK and cellular carriers are also boosting their WiFi coverage areas to take the load off their hard-pressed 3G networks, which all adds up to something of a WiFi explosion in the UK," said Sean Glynn, Credant's vice president of marketing.
"This in turn has triggered the widespread availability of low-cost keyfob WiFi detectors for under a fiver, and quite sophisticated directional detectors for around the 30 pounds mark, both of which can be used by thieves to detect the presence of an out of sight laptop," he added.
Glynn's warning comes after a warning from a security analyst in Jamaica has reported that a large number of laptops are being stolen using WiFi detection techniques for later criminal use.
And, he says, with auction sites selling WiFi detection kit for pocket money prices, it is only a matter of time before this type of laptop detection technique finds its way to the UK.
Credant's observations, he went on to say, suggest that the real focus of identity thieves is the company laptop, which, as well as being a saleable item in its own right, can also contain valuable company data that can potentially be sold to thehighest bidder online.
Identity theft is now big business, he noted.
Glynn went on to say that, because the latest laptops have a set time - sometimes up to 30 minutes - before they go into sleep mode when the laptop lid is shut, it doesn't take a genius to realize that shopping malls around 6 p.m. on weekdays can be a prime source of potential notebook computers, just waiting to be stolen from cars.
"You may not be able to totally prevent your laptop being stolen, but only switching on your WiFi when you really need it, and, of course, encrypting your data on the notebook drive, will go a long way to preventing your computer becoming just another statistic," he added.
From the UK, Credant Technologies is warning laptop users to turn off their WiFi signals before stowing their laptop in the trunk of their car or stashing their laptop in an office file cabinet or desk drawer, apparently out of sight of thieves.
"BT Openzone recently announced it had passed the million WiFi access point mark in the UK and cellular carriers are also boosting their WiFi coverage areas to take the load off their hard-pressed 3G networks, which all adds up to something of a WiFi explosion in the UK," said Sean Glynn, Credant's vice president of marketing.
"This in turn has triggered the widespread availability of low-cost keyfob WiFi detectors for under a fiver, and quite sophisticated directional detectors for around the 30 pounds mark, both of which can be used by thieves to detect the presence of an out of sight laptop," he added.
Glynn's warning comes after a warning from a security analyst in Jamaica has reported that a large number of laptops are being stolen using WiFi detection techniques for later criminal use.
And, he says, with auction sites selling WiFi detection kit for pocket money prices, it is only a matter of time before this type of laptop detection technique finds its way to the UK.
Credant's observations, he went on to say, suggest that the real focus of identity thieves is the company laptop, which, as well as being a saleable item in its own right, can also contain valuable company data that can potentially be sold to thehighest bidder online.
Identity theft is now big business, he noted.
Glynn went on to say that, because the latest laptops have a set time - sometimes up to 30 minutes - before they go into sleep mode when the laptop lid is shut, it doesn't take a genius to realize that shopping malls around 6 p.m. on weekdays can be a prime source of potential notebook computers, just waiting to be stolen from cars.
"You may not be able to totally prevent your laptop being stolen, but only switching on your WiFi when you really need it, and, of course, encrypting your data on the notebook drive, will go a long way to preventing your computer becoming just another statistic," he added.
Saturday, January 9, 2010
Greatest Cyber Risks
Posted by Mark Brousseau
More than 40 percent of executives polled by Deloitte believe remote internet access to corporate systems, embedded malware in computers, applications and devices, and little visibility into the security protocols of suppliers and business units are the greatest cyber risks today.
"Cyber attacks today are not only about identity theft, but about stealing information behind companies' firewalls," said Mark White, principal, Deloitte Consulting LLP. "An entire underground economy has been built for the purpose of stealing, packaging, and reselling electronic information. Never before in history has the threat landscape been as deeply penetrated or more rapidly evolving. Never before have nations, corporations or individuals been more electronically exploited."
Richard Baich, a principal in Deloitte & Touche LLP's Security & Privacy practice, noted that security programs need to be strengthened as it has become increasingly evident that criminals with advanced cyber skills continuously invent new and insidious ways to perpetrate criminal acts. "The cyber crime landscape has evolved into a set of highly specialized criminal products and services that are able to target specific organizations, regions, and customer profiles by using a sophisticated set of malware exploits and anonymization systems, which routinely evade present-day security controls," said Baich.
Baich also stated that cyber criminals are now able to target specific individuals within an organization, such as a payroll clerk, and misuse that role to steal information for direct monetary gain. Nation-states are also able to recruit and leverage cyber criminal resources to target organizations or other nations for the purposes of espionage, monetary gain, or to gain military advantage.
"This leaves executives asking what they can do to quickly identify and contain malware and then protect their data. This is after they already spent a good deal of money on traditional protection programs," said Baich. "Companies should consider establishing cyber threat intelligence programs as well as leveraging existing technology and architecture investments to help detect and prevent these problems."
"Data is more valuable than money. Once money is spent it is gone. Data can be reused and can give you the ability to access online banking applications, use credit cards and penetrate firewalls over and over. A famous bank robber from the 1900s was asked why he robbed banks. He said 'because that is where the money is.' Cyber criminals today go to where the data is, because it allows them to access money. Executives need to develop cyber programs to stay ahead of criminals and stop old cat and mouse games," added Baich.
Other polling results included:
... Only 2.8 percent of the participants indicated they did not need a type of cyber threat intelligence or detection program.
... 62.2 percent of respondents did not know how their organization understands what data is leaving the company's network, though 14.1 percent did confirm that their organizations were using a data loss prevention solution.
... 41.4 percent reported that they did not know how their organizations found compromised devices inside of their network.
... More than a quarter (27.4 percent) indicated their organizations rely on some type of antivirus and intrusion detection system.
Peter Makohon, senior manager, Deloitte & Touche LLP, said that "cyber crime may already be in their neighborhoods" and cited the following issues facing executives:
... Current signature-based information security controls are not effective against sophisticated, cyber threats and exploits, which are evolving at a phenomenal rate.
... Companies lack the automated systems and skilled analysts to rapidly analyze, identify, contain, analyze, and remediate compromised devices.
... Information provided by various cyber intelligence sources is often outdated and high level; therefore, companies cannot take effective counter-actions based on that information alone.
... Organizations lack expertise, resources, technology, and process capabilities for taking timely action on these near real-time cyber threats.
What do you think? Post your comments below.
More than 40 percent of executives polled by Deloitte believe remote internet access to corporate systems, embedded malware in computers, applications and devices, and little visibility into the security protocols of suppliers and business units are the greatest cyber risks today.
"Cyber attacks today are not only about identity theft, but about stealing information behind companies' firewalls," said Mark White, principal, Deloitte Consulting LLP. "An entire underground economy has been built for the purpose of stealing, packaging, and reselling electronic information. Never before in history has the threat landscape been as deeply penetrated or more rapidly evolving. Never before have nations, corporations or individuals been more electronically exploited."
Richard Baich, a principal in Deloitte & Touche LLP's Security & Privacy practice, noted that security programs need to be strengthened as it has become increasingly evident that criminals with advanced cyber skills continuously invent new and insidious ways to perpetrate criminal acts. "The cyber crime landscape has evolved into a set of highly specialized criminal products and services that are able to target specific organizations, regions, and customer profiles by using a sophisticated set of malware exploits and anonymization systems, which routinely evade present-day security controls," said Baich.
Baich also stated that cyber criminals are now able to target specific individuals within an organization, such as a payroll clerk, and misuse that role to steal information for direct monetary gain. Nation-states are also able to recruit and leverage cyber criminal resources to target organizations or other nations for the purposes of espionage, monetary gain, or to gain military advantage.
"This leaves executives asking what they can do to quickly identify and contain malware and then protect their data. This is after they already spent a good deal of money on traditional protection programs," said Baich. "Companies should consider establishing cyber threat intelligence programs as well as leveraging existing technology and architecture investments to help detect and prevent these problems."
"Data is more valuable than money. Once money is spent it is gone. Data can be reused and can give you the ability to access online banking applications, use credit cards and penetrate firewalls over and over. A famous bank robber from the 1900s was asked why he robbed banks. He said 'because that is where the money is.' Cyber criminals today go to where the data is, because it allows them to access money. Executives need to develop cyber programs to stay ahead of criminals and stop old cat and mouse games," added Baich.
Other polling results included:
... Only 2.8 percent of the participants indicated they did not need a type of cyber threat intelligence or detection program.
... 62.2 percent of respondents did not know how their organization understands what data is leaving the company's network, though 14.1 percent did confirm that their organizations were using a data loss prevention solution.
... 41.4 percent reported that they did not know how their organizations found compromised devices inside of their network.
... More than a quarter (27.4 percent) indicated their organizations rely on some type of antivirus and intrusion detection system.
Peter Makohon, senior manager, Deloitte & Touche LLP, said that "cyber crime may already be in their neighborhoods" and cited the following issues facing executives:
... Current signature-based information security controls are not effective against sophisticated, cyber threats and exploits, which are evolving at a phenomenal rate.
... Companies lack the automated systems and skilled analysts to rapidly analyze, identify, contain, analyze, and remediate compromised devices.
... Information provided by various cyber intelligence sources is often outdated and high level; therefore, companies cannot take effective counter-actions based on that information alone.
... Organizations lack expertise, resources, technology, and process capabilities for taking timely action on these near real-time cyber threats.
What do you think? Post your comments below.
Tuesday, October 20, 2009
Is Your Information Secure?
By Mark Brousseau
The records management industry has entered into a new era where organizations need to place a much greater emphasis on securing their electronic information, says Steve Adams, senior records analyst for the National Archives and Records Administration. “We’ve got to change our mindset. We’ve got to become more suspicious,” Adams said during a presentation last week at the 54th annual ARMA International Conference and Expo, in Orlando’s World Center Marriott in Florida.
“The more we get into technology, the more vulnerable we have become,” Adams told attendees, adding that “Microsoft software is so vulnerable to cyber attacks that it is not even funny.”
Adams noted a Gartner study predicting that 30 percent of enterprises using wireless LANs will experience serious security exposure. Adams said over known 200 malicious software programs have been developed for this very purpose. What’s more, a survey by the Computer Security Institute found that 85 percent of computers have been damaged by cyber attacks – despite the fact that 89 percent of these computers had firewalls and 60 percent had intrusion detection. “The really frightening part is that 60 percent of these breaches were from inside the organization,” Adams said.
Sound security practices protect electronic information by preventing, detecting and responding to cyber attacks and other data breaches, Adams told the three dozen people in attendance.
One challenge to good information security is some common myths. These include the notion that:
... Anti-virus software and firewalls are 100 percent effective
... Once software is installed, you don’t have to worry about it again
... There is nothing important on your computer, so you don’t have to worry about it
... Attackers only target rich people
... When computers slow down, it means they are getting old
To help secure your electronic information, Adams provided the following strategies:
... Maintain and use anti-virus software (“But too much or the wrong kind can also cause problems,” Adams said)
... Install a firewall
... Regularly scan for Spyware
... Keep your operating software up to date
... Remove unused software programs
... Follow good security practices
... Be careful what Web sites you visit
...Turn your computer off when you’re not using it
... Never leave your computer unattended at an airport or other public place
Adams said companies should also use good password protocols – requiring staff to use at least eight characters (which take longer to crack) and change their passwords often. And nobody should be exempt from the policy; Adams said senior managers are the worst offenders of password policies.
Organizations should also be mindful of thumb drives, Adams said. While they are excellent tools for transporting information, they also can get through most metal detectors undetected – providing a vehicle for crooks to get information out of your organization without anyone ever noticing, he said.
“We’ve got to have good strategies for how we protect our information,” Adams concluded.
What do you think? Post your comments below.
The records management industry has entered into a new era where organizations need to place a much greater emphasis on securing their electronic information, says Steve Adams, senior records analyst for the National Archives and Records Administration. “We’ve got to change our mindset. We’ve got to become more suspicious,” Adams said during a presentation last week at the 54th annual ARMA International Conference and Expo, in Orlando’s World Center Marriott in Florida.
“The more we get into technology, the more vulnerable we have become,” Adams told attendees, adding that “Microsoft software is so vulnerable to cyber attacks that it is not even funny.”
Adams noted a Gartner study predicting that 30 percent of enterprises using wireless LANs will experience serious security exposure. Adams said over known 200 malicious software programs have been developed for this very purpose. What’s more, a survey by the Computer Security Institute found that 85 percent of computers have been damaged by cyber attacks – despite the fact that 89 percent of these computers had firewalls and 60 percent had intrusion detection. “The really frightening part is that 60 percent of these breaches were from inside the organization,” Adams said.
Sound security practices protect electronic information by preventing, detecting and responding to cyber attacks and other data breaches, Adams told the three dozen people in attendance.
One challenge to good information security is some common myths. These include the notion that:
... Anti-virus software and firewalls are 100 percent effective
... Once software is installed, you don’t have to worry about it again
... There is nothing important on your computer, so you don’t have to worry about it
... Attackers only target rich people
... When computers slow down, it means they are getting old
To help secure your electronic information, Adams provided the following strategies:
... Maintain and use anti-virus software (“But too much or the wrong kind can also cause problems,” Adams said)
... Install a firewall
... Regularly scan for Spyware
... Keep your operating software up to date
... Remove unused software programs
... Follow good security practices
... Be careful what Web sites you visit
...Turn your computer off when you’re not using it
... Never leave your computer unattended at an airport or other public place
Adams said companies should also use good password protocols – requiring staff to use at least eight characters (which take longer to crack) and change their passwords often. And nobody should be exempt from the policy; Adams said senior managers are the worst offenders of password policies.
Organizations should also be mindful of thumb drives, Adams said. While they are excellent tools for transporting information, they also can get through most metal detectors undetected – providing a vehicle for crooks to get information out of your organization without anyone ever noticing, he said.
“We’ve got to have good strategies for how we protect our information,” Adams concluded.
What do you think? Post your comments below.
Subscribe to:
Posts (Atom)
