ICD Brief 28.
30.01.2017. –06.02.2017.
ICD 28 reports on new bilateral partnerships, crime, punishment; politics and intrigue, laws, regulations, metrics and audits in the US, Australia, Czech Republic, India, NATO, Netherlands, Norway, Poland, Russia, UK. We feature French Caldwell’s article: Which Comes First – Death or IoT Security Regulations and Ben Rothke’s The Security Reading Room: The Best Information Security Books of 2016 | RSA Conference .
USA
Cisco 2017 Annual Cybersecurity Report: Chief Security Officers Reveal the True Cost of Breaches
“According to the Cisco 2017 Annual Cybersecurity Report (ACR), over one-third of organizations that experienced a breach in 2016 reported substantial customer, opportunity and revenue loss of more than 20 percent. Ninety percent of these organizations are improving threat defence technologies and processes after attacks by separating IT and security functions (38 percent), increasing security awareness training for employees (38 percent), and implementing risk mitigation techniques (37 percent).”
USA Eases Restrictions on Cyber-Security Sales to Russian Spy Agency
“The U.S. Treasury Department on Thursday eased economic sanctions on Russia, allowing some cyber-security transactions with the Russian Federal Security Service accused of meddling in the U.S. electoral process. Some Russian officials applauded the move as signalling a thaw in relations with Washington. But several members of Congress decried the move as pandering to Russia and its hacking attempts. The Trump administration, meanwhile, denied any easing of sanctions, describing the changes as routine tweaking of complicated policy.”
Trump Order May Give Pentagon Bigger Role In Civilian Cybersecurity
“The Department of Homeland Security fears losing its primacy in civilian cybersecurity through an impending White House executive order, according to current and former officials, raising concerns about digital security in the Donald Trump era becoming a stalking horse for surveillance. Trump had been expected on Tuesday afternoon to issue an executive order on cybersecurity, a long-forecast first venture into a subject central to rising public, security and international anxieties after mass hacks of big companies and the US government itself. But the White House abruptly told pool reporters that the signing was cancelled without explanation.”
How Did Cybersecurity Become So Political?
Congress Is Writing Cybersecurity Legislation Under A Cloud of Uncertainty
Audit: DHS Cyber Center Lacks Metrics The 24-hour cybersecurity watch centre at Department of Homeland Security is performing all the functions Congress wanted, but DHS has no way of measuring how well it is aligning with the guiding principles lawmakers set down, a new audit says. Congress’s investigative arm, the Government Accountability Office, published the audit of the National Cybersecurity and Communications Integration Center, or NCCIC, on Wednesday. At the NCCIC, DHS officials sit side-by-side with representatives of state and local governments and the private sector owners of vital national industries to monitor the security of their computer networks.” GAO: DHS Cyber Communications Center Could Communicate Better
DHS Cyber Division Prioritizes DDoS and Smart Vehicle Cybersecurity “Defending against distributed denial of services (DDoS) attacks, such as the one directed at the domain name management company Dyn in October, is one of the Department of Homeland Security (DHS) Science and Technology Directorate’s (S&T) priorities for the upcoming year.”
USA to Assist Ghana Fight Cybercrime “The United States of America (USA) is providing technical assistance to help Ghana protect its cyber- space and empower the law enforcement agencies. Dubbed “The Security Governance Initiative”, the assistance is three-pronged and comes under Ghana’s international cooperation with the US government.”
Australia
Australia: Can Government & Industry Come Together to Advance FinTech Security?
“In a follow-up to Australia’s National Fintech Cyber Security Summit in May 2016, Data61 published a new report called “Startup Secrets: How Australia Can Create New Businesses with Fintech and Cyber Security Industry Collaboration”. The report highlights how the government and private sector can invest in startup talent and opportunities to strengthen financial services and their security infrastructure.”
Indonesia, Australia Strengthen Cyber-Security Ties
“Australia and Indonesia agreed on Thursday to focus on cyber security in their fight against terrorism and transnational crimes after a meeting in Jakarta. The agreement was reached at the third ministerial council meeting on security and law despite the ongoing suspension of military cooperation between the two countries. The meeting highlighted an array of issues related to counterterrorism, such as deradicalization, cyber intrusion, as well as tracing and stopping that funding terrorism online.”
Australia Plants Seeds for Fintech Cybersecurity Industry
“Australia wants to nurture a homegrown cybersecurity speciality in fintech, a move that is part of a government and industry effort to be less dependent on technologies from overseas to secure the country’s infrastructure.”
Czech Republic
Czech Cyber-Attack: Russia Suspected of Hacking Diplomat’s Emails
“The Czech Republic has suffered a damaging security breach after hackers infiltrated the emails of dozens of its most senior diplomats in a massive cyber-attack thought to have been carried out by Russia. Lubomír Zaorálek, the country’s foreign minister, admitted that his own email account had been breached in a “sophisticated” operation he compared to the onslaught against the Democratic party in the recent US presidential election.”
India
Report Cyber Attacks in 6 Hrs: RBI to Banks
“RBI has asked banks to report any cyber security incident within two to six hours. RBI has also warned lenders that any delay in reporting and flagging loan frauds could result in banks and bankers being charged for abetting the criminal offence.”
Cybersecurity and Compliance Challenges in India Drive Growth for Skybox Security
“Skybox Security, a cybersecurity analytics company, has announced a 154% increase in year-over-year revenue earned from Indian business in 2016. The company’s customer base in India consists of national and global enterprises, including 10 of the Indian-based Forbes Global 2000 organizations.”
India’s Cyber Security Startups Are Gaining Traction, Thanks to Demonetization
“A push towards digital economy (otherwise known as demonetization) by the Indian government is changing the way businesses and governments are run in the country. However, at the same time, these recent changes are creating vulnerabilities by moving processes online, resulting in an increased incidence of cyber-attacks among enterprises in India.”
Israel
Global Entities Come Shopping for Israeli Cybersecurity
“As computer devices and Internet of Things (IoT) connectivity continue to break new boundaries and create changes to our lifestyle, new cybersecurity technologies to defend our tech-savvy lives are crucial. “Not many years ago, computers were far away. Then they came to our desktops, then to our laptops, and then to our pockets; now they’re in our clothes and, for some, in our body — medical devices. All this needs to be defended,” Erez Kreiner, CEO of Cyber-Rider and former director of Israel’s National Cyber Security Authority, told a press gathering at this week’s Cybertech 2017 conference in Tel Aviv.”
Israel’s Cybersecurity Leadership No ‘Accident’, Netanyahu Tells Global Confab In Tel Aviv
“Israeli Prime Minister Benjamin Netanyahu, during a keynote address Jan. 31 at Cybertech 2017, the world’s second-largest cybertechnology exhibition, said it is “no coincidence that you are here in Israel” and “not an accident” that the Jewish state is a world leader in cybersecurity.”
NATO
NATO’S Baltic Outpost Digging Cyber Trenches for Europe
NATO’s Baltic outpost is gearing up to test decision-making among European Union defense ministers during a simulated cyber assault. Estonia, a nation of 1.3 million people that borders Russia and is home to NATO’s cyber-defense centre, will host the exercise during its six-month presidency of the European Union, which starts July 1, Defense Minister Margus Tsahkna said in an interview. The country is no stranger to electronic attacks, having significantly bolstered security measures after strikes on key websites during a spat with Russia, he said.”
Netherlands
Average iPad Better Secured Than Dutch Voting System: Cyber Security Expert
The software used at Dutch polling stations to send election results is outdated and very vulnerable to hackers and there are not enough rules around where and where the software can be installed, according to security expert Sijmen Ruwhof, who investigated the software on behalf of RTL Nieuws. According to Ruwhof, “the average iPad is more secure than the Dutch voting system”.”
Norway
Norway institutions ‘targeted by Russia-linked hackers’
“Several institutions in Norway have been targeted by hackers believed to be linked to Russia, the security service (PST) has warned.
The Labour Party, defence and foreign ministries and the security service itself were among those hit, it said. On Friday Norway announced it had chosen Germany’s Thyssenkrupp (TKMS) to deliver four submarines to its navy, part of a wider military upgrade. It comes amid tensions between Norway and Russia, which share a border.”
Poland
Hackers Break Into Polish Banks Through Government Regulator Charged With Bank Security Standards
“Polish banks have spent the last week searching for hackers who broke into several of the country’s financial institutions in an incident that looks to be three months old, according to Polish media. The malware infection appears to have come through — of all things — compromised servers at the Polish financial regulator KNF, which is responsible for enforcing security standards in the banking industry.”
Russia
Top Russian Cyber-Security Agent to Face Treason Charges
“A top cyber-security specialist in Russia’s Federal Security Service (FSB) has been arrested on charges of treason, the Kommersant newspaper reported Wednesday. Sergei Mikhailov, deputy chief at the FSB’s Information Security Center (CDC), stands accused of receiving money from “foreign organizations,” Kommersant reported, citing unnamed FSB sources.
Mikhailov has been detained in pre-trial detention since December 2016, alongside Ruslan Stoyanov, the head of cyber-crime investigations at Russia’s Kaspersky Labs.”Russia Accuses Cybersecurity Experts of Treasonous Links to CIA
UK
UK Cybersecurity: Permanent Job Salaries Growing Faster than Contractor Pay Rises
“Demand for cyber security skills in the UK means that salaries for full-time IT security jobs are increasing faster than contractor rates, according to a new survey. Annual IT security permanent salaries climbed by 5 per cent (from Q4 2015 to Q4 2016) to £57,706, compared to a 0.62 per cent increase for contractor day rates (up to £484) over the same period, according to tech recruiting firm Experis.”
Government ‘Needs to Raise Its Game’ On Cyber Security, MPs Warn
“Despite cyberattacks being one of the top four risks to UK national security for the past six years, there appears to have been no coordination across the public sector, according to the report by the Public Accounts Committee. It said that ministers have also taken too long to consolidate the “alphabet soup” of agencies tasked with keeping the country safe. Committee chair and Labour MP Meg Hillier said: “Government has a vital role to play in cyber security across society but it needs to raise its game.”
Feature
Which Comes First – Death or IoT Security Regulations?
French Caldwell, Chief Evangelist, MetricStream
The Canadian Business Journal February, 2017
“In October 2016, the company Dyn, which is one of the hosts of the domain name system whose servers monitor and direct traffic on the internet, experienced a major distributed denial of service (DDS) attack. This DDoS caused North American users of several websites and services such as Netflix, Twitter, Reddit, and others to experience sporadic outages. The attack began about 7am ET and spred westward into the evening. This cyberattack was not the first to target core components of the internet’s infrastructure, but it was the largest attack ever to be launched through the Internet of Things (IoT).”
The Security Reading Room: The Best Information Security Books of 2016 | RSA Conference Ben Rothke
The Car Hacker’s Handbook: A Guide for the Penetration Tester – “plus ça change, plus c’est la même chose. Lots of features combined with poor security make cars the next big avenue for hacking. Craig Smith shows everything the car manufacturers have done wrong, and what they need to do to make it right. But is Detroit listening?”
Pinpoint: How GPS Is Changing Technology, Culture, and Our Minds – “GPS is an absolute marvel, but it comes at a cost. Both from a cognitive and security perspective. People are driving into lakes and into snowdrifts, blindly trusting GPS. One of the shortest books around is that on GPS security. It simply does not exist. The Iranians for example have capitalized on this on numerous occasions and have launched GPS spoofing attacks against the US military.”
InfIrastructure as Code: Managing Servers in the Cloud “Infrastructure as code (IaC) is the process of managing and provisioning servers and their configuration via definition files, rather than physical hardware configuration or the use of configuration management tools. The rise of IaaS has led to the widespread use of IaC. With that, if one does not built in security, the entire infrastructure is at risk.”
Bitcoin and Cryptocurrency Technologies: A Comprehensive Introduction –” there are many new cryptocurrencies, of which Bitcoin is the largest. Just regular banking, cryptocurrencies also need good security.”
The War on Leakers: National Security and American Democracy, from Eugene V. Debs to Edward Snowden – “When it comes to Edward Snowden, the question has often been posed as: is he a patriot or a traitor? This book shows that the question of leakers and whistleblowers is rarely so binary or simple.”
See more HERE.