Cybersecurity Update, 27.11.2013.


US government rarely uses best cybersecurity steps: advisers

WASHINGTON: The US government itself seldom follows the best cybersecurity practices and must drop its old operating systems and unsecured browsers as it tries to push the private sector to tighten its practices, technology advisers told President Barack Obama.

“The federal government rarely follows accepted best practices,” the President’s Council of Advisors on Science and Technology said in a report released on Friday.

Restricted Cybersecurity Information

I am loosely affiliated with a couple of different organizations that are able to provide me with information about government issued cybersecurity reports that have restricted distribution markings on them; not classified just a variety of sensitive but unclassified markings. Of course, part of the condition of my receipt of copies of this is that I am not able to publicly disclose the information contained in those reports. So, the following discussion will be a tad bit vague as I describe a disturbing trend in such information sharing activities.

We all know that US-CERT  provides a limited distribution web site where adequately vetted members of the various affected private sector organizations (this does not include me) can get up-to-date unclassified information about trends and issues in the cybersecurity realm. ICS-CERT has a portion of that portal that they use to discuss vulnerabilities in control systems and attacks on those systems that they don’t want widely disseminated so as to not allow control system adversaries to know what we know about their activities. This also includes information about specific vulnerabilities and fixes for those vulnerabilities that are being disseminated to system owners that will subsequently be publicly released on the ICS-CERT web site.

Cyberattack: a new weapon in a new war

We may all know in a general sense that the security of information we share online cannot be guaranteed – but that doesn’t stop us, or private business or government, from putting sensitive data online. The hope is that security will hold up against hackers, but in fact, cyberattacks are a growing security threat. David Hamon advises the U.S. government about that threat.

The Impact of Cybersecurity on Trade

National policies regarding cybersecurity can have a positive or negative effect on global trade efforts, says Allan Friedman, research director of the Brookings Institution’s Center for Technology Innovation.

Take, for example, a congressional report from 2012, which recommends that government systems, particularly sensitive IT systems, refrain from using equipment and component parts manufactured by two Chinese companies, Huawei and ZTE, the world’s largest and fifth-largest telecom equipment makers, respectively (see House Panel: 2 Chinese Firms Pose IT Security Risks).

FBI, Homeland Security and Counterterrorism Center Declare Cyber-Attacks Bigger Threat than Terrorism

Cyber-attacks, not terrorist ones, will be the greater threat in the coming years to the United States, according to federal officials at three agencies charged with protecting the nation.

At a recent hearing of the Senate homeland security and government affairs committee, the heads of the Federal Bureau of Investigation (FBI), Department of Homeland Security (DHS) and National Counterterrorism Center (NCTC) told lawmakers that cyber-attacks were likely to surpass terrorism as a domestic danger over the next decade.

Cybersecurity Framework: Tests Needed?

The creators of the cybersecurity framework will soon begin writing the final version of the guide to information security best practices aimed at helping the operators of the nation’s critical infrastructure secure their information assets (see: Obama, CEOs Meet on Cybersecurity Framework).

But calling it a “final version” is misleading. True, the IT security experts at the National Institute of Standards and Technology, who are shepherding the drafting of the cybersecurity framework, expect to make the Feb. 13 deadline imposed by President Obama. But Adam Sedgewick, the NIST official overseeing the cybersecurity framework, characterizes it as a living document that will be revised over the years as new cyberthreats appear and new ways to mitigate those threats emerge.

americas-private sector

2014 Cybersecurity Predictions from Symantec

Whispers. The secret to predicting the future is to listen for the whisper.

By the time you’ve heard things in a loud, clear voice they have already come true. I’ve been listening to the whispers in 2013 and have a pretty good idea for what we’ll be hearing loud and clear in 2014.

Cyber-attack at a major port could cost $1 billion per day

At a time when the nation’s infrastructure faces a growing threat from cyber-attacks, maritime and homeland security officials say they are making significant progress in protecting the nation’s ports, which handle more than 2 billion metric tons of cargo annually and are critical to the global economy.

“It’s finally picking up speed,” said Randy Parsons, director of security at the Port of Long Beach, during the Port Security Operations Conference & Expo held Nov. 19-21 at the Hilton Long Beach & Executive Meeting Center. “A lot of time and effort have been put into this by the private sector, as well as the government agencies — the FBI in particular and the U.S. Secret Service. I’ve seen a major shift in just the last 12 months.”

Network defence

Despite the rise of cloud computing and increased corporate interest in outsourced infrastructure and managed services, the enterprise network remains a complex beast to manage– and it is only going to become more so as demand for bandwidth, capacity and real-time access to business tools and applications continues to grow.

Nothing embodies this complexity as much as the challenge of securing the network. In an age of bring your own device (BYOD), holding cyber criminals, viruses and emerging threats at bay is a constant thorn in the side of the network manager. Given that no two networks are the same, the opportunity for the channel to provide customers with solutions that can be tailored to their specific circumstances, and a range of associated consultancy services, is considerable.

According to market analyst Gartner, the global security and services market will be worth $67.2bn by the end of this year – up from $61.8bn in 2012. By 2016 it will breach the $86bn barrier.

Simulated attacks on electrical grid show strengths, weaknesses in system

DOVER — Rolling blackouts, widespread power outages, damaged infrastructure and hijacked substations.

These were just some of the scenarios that bulk-power companies throughout North America were dealt in a recent 48-hour mock security exercise known as GridEx II.

Only the second exercise of its kind, GridEx II went live on Nov. 13 and 14 and tasked over 1,800 electricity subsector agencies with responding to both cyber and physical mock emergencies. The drill, which is hosted by the North American Electric Reliability Cooperation, is intended to explore both strengths and weaknesses in the bulk-power system and determine how prepared the country is for both cyber and physical attacks on its grid.

Cyber attacks – up close and personal

The traditional model of building a strong-room around the company crown jewels is certainly no longer sufficient to deal with the types of threats that have emerged more recently. Indeed over-reliance on systems that protect against one type of threat can lead to complacency. The modern cyber-attacker will work around the target’s defences, concentrating on areas of weakness including systems, software and – above all – people.

Criminals have upped their game – sometimes aided and abetted by states themselves. It is now widely acknowledged that the Stuxnet and Flame advanced persistent threats (APTs) were developed with US state backing. Russia, China and Iran are also enthusiastic players with much to gain from attacking governments and multinational businesses, and the UK government is hardly innocent in this regard either.

Rosauers warning customers following credit card fraud attack\

SPOKANE COUNTY, Wash.– Rosauers is asking its customers to pay with cash or check while its owners, URM Stores, work to clear up a recent cyber attack.

Customers are receiving hand outs that say Rosauers had their payment processing system attacked.

Secret Service agents are investigating dozens of fraudulent credit card purchases being made across the U.S.

Cyber threat: Secure process industries in an insecure world

The advent of “open” computer architectures and standard protocols has been a mixed blessing for the automation industry. On one hand, the evolution from isolated proprietary applications to open technology has expanded business information availability, yet it has also exposed the industry automation control systems to a host of cyber attacks that have made electronic security a major concern.

But then, this does not stop at the private sector; government organisations and process industries are equally vulnerable to cyber attacks. In the recent past, we have seen several incidents that have created mayhem in organisations, whether it is Rocra – a stealth cyber attack that targets government, diplomatic, public research institutions, nuclear research, aerospace and oil and gas companies – or the Stuxnet computer worm – which destroyed 2,000 centrifuges at an Iranian facility in Natanz and infected Indian computers located at critical infrastructure facilities.

Symantec head warns of intellectual property threat from hackers

The CEO of Symantec says intellectual property theft is a greater cyber security threat than cyber war and malicious attacks from hackers.

Steve Bennett said western firms had been orchestrating cyber attacks to steal intellectual property, resulting in potentially dangerous consequences for the global economy.

Bennett said companies and governments should share more data about attackers because they’re losing a war against ‘black hat’ hackers.

Adobe says breach notification taking longer than anticipated

(Reuters) – Adobe Systems Inc said it is taking longer than expected to warn customers about a massive data breach that compromised data on tens of millions of people, leaving some in the dark 10 weeks after the attack was discovered.

That puts those who have yet to be alerted at increased risk of cyber-scams and identity theft, because part of the massive trove of data stolen from Adobe is circulating on the Internet.

What IT Can Teach Utilities About Cybersecurity & Smart Grids

There is a perception within IT circles that cybersecurity threats against critical infrastructure like smart grids are a problem waiting to happen — but not right away. The reality is much more dire. Last year alone, there were a number of sophisticated attacks, and they should offer a wakeup call for the power industry.

According to figures from Department of Homeland Security’s Industrial Control Systems Computer Emergency Response Team (ICS-CERT), 41% of incidents reported and investigated by the agency last year were related to the energy industry.


Oman tops Arab cybersecurity

MUSCAT The Sultanate has been ranked first among Arab countries in the Global Cybersecurity Index. The ranking by International Telecommunication Union (ITU) and ABI Research looks at how measuring each nation’s level of cybersecurity development.

Jakarta hackers target Liberal Party’s site has Indonesian phone-tapping scandal continues

INDONESIAN hackers have attempted to infiltrate and close down the Liberal Party’s website in a series of retaliatory attacks over the phone-tapping scandal.

An aggressive cyber-attack was launched against the party’s national IT system but was successfully blocked yesterday morning. The source was traced to Indonesia.

While the party’s website and IT systems are regularly victims of attempted cyber intrusion – mainly from Chinese sources – it is believed to be the first time such activity has emanated from Indonesia.

Danish bitcoin exchange Bips latest to suffer cyber-breach

Copenhagen-based Bips is one of the largest bitcoin exchanges in Europe. The company says it was the target of a co-ordinated attack by Russian cyber-criminals last week.

“Several consumer wallets have been compromised and Bips will be contacting the affected users,” says the company in a statement on its Website. “As a consequence Bips will temporarily close down the wallet initiative to focus on real-time merchant processing business which does not include storing of Bitcoins.”

Ukraine hit by media censorship and cyber attacks

KYIV, Ukraine — Watchdog groups here are warning that the consolidation of media in the hands of a few of the country’s wealthiest businessmen connected to President Viktor Yanukovych is stifling free speech and depressing media pluralism.

They also say a so-called black PR campaign is damaging the reputations of the most influential journalists and independent news outlets, and that the two efforts are part of a single grand scheme.

Experts blame the government, which they say is concerned about criticism ahead of a presidential election in 2015, when Yanukovych will attempt to solidify his grip on power.

Racing Post website hit by ‘aggressive’ cyber attack

Racing Post has revealed that its website was hit by a “sophisticated, sustained and aggressive attack” over the weekend in which one of its databases containing customer information was accessed.

In a post on the firm admitted that reams of other information could have been accessed. “The information at risk from the database that was compromised will vary in the case of each customer, depending on how much information you gave us when you registered,” it said.

Tech fetish makes Australians a juicy target for cyber crooks

On the whole, Australians have embraced the benefits of the digital economy with great enthusiasm. When it comes to new means of communication, we can even be considered early adopters. We have 130 per cent mobile phone penetration, or 1.3 phones per person on average. A recent report by Frost and Sullivan (Australian Mobile Usage Trends 2013) showed tablet PCs more than doubling to 50 per cent in 2012 with no signs of abating. In the first six months of this year, 2.6 million tablet PCs were sold.

EU cyber security agency issues cloud deployment guide

The European Union Agency for Network and Information Security (ENISA) has recommended that the European Union (EU) develop a unified strategy for government cloud in order to enable member countries to securely deploy government clouds.

Saudi Aramco denies suffering another cyber attack

KHOBAR, Saudi Arabia (Reuters) – Saudi state oil company Saudi Aramco said on Tuesday it had shut some of its computers for an upgrade and denied it had suffered a cyber attack similar to one it experienced last year.

Posts earlier on the Twitter social network said some or all of Aramco’s computers were down, possibly because of a cyber attack.

Petroleum Ministry warns PSU oil companies of cyber attacks

Following an advisory by the Indian Computer Emergency Response Team (CERT), the Petroleum and Natural Gas Ministry has alerted all the heads of oil marketing companies (OMCs) about the possibility of cyber attacks.

UK businesses are ‘failing to take cyber security seriously’

Many of the UK’s largest companies are failing to take computer security into account in their decision making, warns the government.

A survey conducted by the Department for Business, Innovation and Skills reveals that only 14 per cent of FTSE 350 firms are regularly considering cyber threats, despite the increasingly high level of online crime.

Ottawa failing Canadians on cybersecurity, says expert

The Harper government has been raked over the coals for not providing leadership on cyberthreats to Canadian enterprises and citizens by an academic who specializes in international security.

It is “increasingly baffling” that Ottawa continues to say terrorism is the greatest threat to the country when there is clear evidence that online threats are more important, Wesley Wark, visiting professor at the University of Ottawa’s graduate school of public affairs said Tuesday at the Technicity conference in Toronto.

NATO launches massive cyber-security exercises

NATO on Tuesday launched its largest-ever cyber exercises to practise warding off massive, simultaneous attacks on member states and their partners.

Based at the alliance’s cyber defence centre in EU member Estonia, the exercises will last three days and include participants in over 30 European states.

This entry was posted in Weekly Brief. Bookmark the permalink.

Comments are closed.