Unisys blamed for DHS data breaches
6436
FBI investigating contractor negligence Unisys, the IT computer services biz, is in hot water with the US government for allegedly twiddling its thumbs while foreign hackers had their way with Department of Homeland Security computers.â¦
537741
As the TJX Companies data leakage incident seeped its way further toward becoming the Exxon Valdez of corporate information spills this week, researchers reinforced the notion that businesses continue to make a mess of electronic data security because they fail to foster adequate internal communication.A new report from Ponemon Institute -- which has produced a series of studies into corporate data leakage over the last several years -- concluded that the various people in charge of collecting, protecting, and managing sensitive information inside large businesses typically don't collaborate sufficiently. Those constituencies also have widely differing views regarding their respective roles in safeguarding the content, the report contends.Echoing comments made by a number of security policy experts in recent months, the study highlights the fact that companies are likely failing to protect data based on broken business processes -- at least as much as they may be succumbing to complex technological challenges.Just as many software developers complain that their applications are left vulnerable to attack because business teams refuse to wait long enough for the programs' underlying code to be made secure, the results of Ponemon's survey of 3,600 IT security and marketing executives -- located in the United States, the United Kingdom, and Germany -- illustrate a distinct lack of organizational coordination in the name of protecting data.For instance, only 30 percent of the marketing workers interviewed for the study said they actually consult security teams before collecting and using sensitive information, while 80 percent of the IT security employees surveyed indicated a belief that they are typically involved in such decision-making.In addition, while only 53 percent of IT security workers surveyed said their companies have well-coordinated data protection policies, only 32 percent of those workers who handle the information said their employers are doing an adequate job. Some 45 percent of security workers don't feel that their data-handling rules get in the way of business objectives, while only 21 percent of the people using the content feel that such policies represent roadblocks to their productivity.And in yet another blow to the perceptions of security workers, only 21 percent of the marketers using sensitive information interviewed by Ponemon said that security teams play a leading role in defending the content.At the heart of the matter is the issue of poor collaboration between all the involved parties, according to the research firm. Only 29 percent of those interviewed said their companies' current policies would be adequate to handle a major breach within 24 hours of its occurrence.Based on the results, Ponemon contends that organizations with substandard data protection collaboration policies were twice as likely as to have had a data breach within the last two years.Therein lays the ultimate proof of collaboration's impact on data protection, said executives with Microsoft, which sponsored the research report."We expect the data threat environment to continue to evolve, and at the same time, clearly, there's a long way to go based on where we are today," said Brendon Lynch, director of privacy strategy at Microsoft. "There's this major issue around the degree to which marketing professionals consult with these other involved parties; they see the policies as getting in the way of business objectives, and they're not interacting with security or privacy specialists based on that, which undermines the process change that companies are already attempting to enact."As part of its connection with the study, Microsoft is pushing the notion that companies should merge their security and data privacy operations to simplify the process of interaction between the various constituencies.Some 80 percent of all respondents to the Ponemon study said that they would support further combination of those teams to improve coordination of their data defenses."We feel that most companies need to be more holistic and bring these types of roles together," said Lynch. "All of these workers are critically important to better locking down the data, so they need to look at developing appropriate-use cases, and how to better fulfill business objectives while maintaining protection."The study is just the latest expert opinion to highlight the fact that despite the ever-expanding range of security technologies available to enterprises to protect sensitive data, many organizations could be well served to start with a review of their internal policies.In addition to getting business teams to work more closely with security and privacy pros, some experts contend that organizations could improve security risks quickly by merely retrenching the settings of their network and IT systems.Many critical infrastructure systems are installed with the idea of getting an operation up and running first, with plans to bolster security after the fact, and never readdressed, said Paul Williams, chief technology officer at IT security services provider Global Security Management.Reviewing networking gear settings to ensure that they have been sufficiently obscured, along with tweaking the features of other systems crucial to protect external attack is another way that companies can significantly bolster data security with little to no capital investment, he said."Before you learn how to defend a network, you have to take a walk on the wild side and see how you can break in yourself," said Williams. "Most networks can be made more secure by simply taking the time to go back and see how things were installed and whether or not the settings were changed in a way that promotes security; people typically look to technology solutions to address these problems, but they could begin helping themselves significantly at relatively no cost."In a presentation delivered at the Gartner IT Symposium earlier this month, analyst Neil MacDonald told attendees of the show that they could save money on their security projects if they continue to push for a more thorough, process-driven approach to data protection on a high level within their organizations."This can't be about managing a set of projects, it has to be about improving process," MacDonald said. "At the end of the day, the idea of tagging every piece of data in an enterprise for the sake of protecting it is unfeasible; it sounds great on paper, but the problem is a monumental effort with new information coming in all the time, it's not a process that's sustainable."
286377
Organisations are risking seeing sensitive information ending up in the wrong hands, because they are failing to ensure that their unwanted PCs are properly datawiped.
719439
Company says affected servers were running old, unpatched versions of Ubuntu as well as a number of insecure Web applications.
620504
Symantec, a leading computer system security provider ahs warned its customers of some serious flaws in the Windows operating system.
569822
The government agency says four of five incidents involved members of staff accessing databases for unauthorized purposes.
424521
The software maker has acknowledged it was wrong when it told users certain file formats were insecure.
535433
Microsoft Corp. blamed human error for a problem that identified legitimate Windows users as pirates last week.
358421
ID theft fears blow through Chicago property market Hackers rather than an inside job are being blamed for an attack on an Illinois state agency's server that left thousands of property market workers potentially exposed to identity theft.â¦
261731
Cisco Systems and Wells Fargo found themselves this week again responding to security breaches nearly identical to ones the two companies faced only months earlier.
206983
U.S. government agencies need to take additional steps to protect against cybersecurity problems after a series of congressional hearings and reports exposed several weaknesses in 2007, representatives of Symantec said.The government sector, including state and local governments, accounted for 26 percent of data breaches that could lead to identity theft in the first half of 2007, according to Symantec&#39;s latest Government Internet Security Threat Report, published in September. The U.S. Government Accountability Office (GAO)&#160;also issued about a dozen reports in the last six months criticizing federal agencies for not fully implementing GAO&#39;s cybersecurity recommendations, noted Jim Russell, Symantec&#39;s vice president for the public sector.In addition, the House of Representatives Homeland Security Subcommittee on Emerging Threats, Cyber Security and Science and Technology hosted a series of hearings in 2007 focused on cybersecurity lapses at several government agencies, including the Department of Homeland Security and the State Department.&quot;You look at that, and you say, &#39;Why does that happen?&#39;&quot; Russell said.While U.S. agencies have a set of cybersecurity rules set out in the Federal Information Security Management Act of 2002 (FISMA), agencies aren&#39;t held accountable when they have breaches, Russell said. Agencies don&#39;t lose funding from Congress after cybersecurity incidents, he said.The federal cybersecurity rules don&#39;t have &quot;a whole lot of teeth,&quot; he added.The good news is that agencies can take more steps to fix problems, Russell said. The first step is to inventory their IT assets, a job several agencies haven&#39;t accomplished. That&#39;s not always easy, Russell said.&quot;Let&#39;s say I&#39;m an agency CIO,&quot; he added. &quot;My challenge is that my environment is so dynamic with the home workforce and telecommuting. I can see why it&#39;s a challenge to see what all the assets out there are.&quot;Russell also called on agencies to develop comprehensive cybersecurity plans, to do systematic vulnerability testing, and to have a data backup plan and back up frequently.Symantec expects that cybersecurity issues will come before Congress in 2008, particularly federal agency cybersecurity practices, said Kevin Richards, Symantec&#39;s federal government relations manager. This could be &quot;the year for information security for our federal agencies,&quot; he said.In December, Representative William Lacy Clay, a Missouri Democrat, introduced the Federal Agency Data Protection Act, which would require U.S. agencies to implement wireless data security measures. The bill would also require each U.S. agency to draft a plan to protect itself against the dangers of peer-to-peer file-trading networks, and it would give the director of the White House Office of Management and Budget new authority to establish information security policies.Clay&#39;s bill would write into law many OMB recommendations, Richards said. &quot;I always make the point that these are recommendations, and it&#39;s important to codify them,&quot; he said. &quot;It seems like our federal government IT security strategy is very reactionary and not proactive.&quot;That bill comes in addition to Federal Agency Data Breach Protection Act, which would require that federal agencies notify constituents whose data is lost or stolen. That bill, introduced last May, is sponsored by Representative Tom Davis, a Virginia Republican, in the House, and Senator Norm Coleman, a Minnesota Republican.Bills that would require private companies to notify customers when their personal information is stolen or lost seem to have stalled in Congress. But there still seems to be interest from lawmakers in agency cybersecurity and breach notification, Richards said. The hearings and information requests from Davis and other lawmakers are bringing to light multiple attacks and breaches at agencies, he said.&quot;There&#39;s no real mechanism requiring agencies to report breaches,&quot; Richards added. &quot;Now, [lawmakers] are dedicating more resources and giving better direction.&quot;
96421
We advise skepticism The Department of Homeland Security (DHS) is ditching a controversial data-mining program, the Associated Press revealed today.â¦
534307
A &quot;formidable information and technology management challenge&quot; faces the Homeland Security Department, according a report released today by the Government Accountability Office.
637030
(InfoWorld) - The U.S. Department of Homeland Security's (DHS)Â CIO was on the hot seat Wednesday on Capitol Hill after an independent audit found that a database that screens U.S. visitors lacked security controls. The chairman of the U.S. House of Representatives Homeland Security Committee called on DHS CIO Scott Charbo to explain why he should keep his job after persistent cybersecurity problems at the agency. "What happened to leadership?" Representative Bennie Thompson, the committee chairman and a Mississippi Democrat, said during a hearing of the Subcommittee on Emerging Threats, Cybersecurity, and Science, and Technology. "What happened to accountability?" Lawmakers also said they were concerned that the agency reported 844 cybersecurity incidents in 2005 and 2006. "Although we still have a ways to go, we've made measurable improvements in the management of information security at the department," Charbo said. "Certainly, we need to increase our vigilance to ensure that such incidents do not happen again." Many of the 844 incidents were minor, and the agency has taken major steps to fix past cybersecurity issues, Charbo said. Many of the reported cybersecurity incidents related to problems like lost laptops that did not result in data breaches, he added. The subcommittee did not have a breakdown of the incidents Wednesday. Asked about reports of bots installed on DHS computers that could send information out to hackers, Charbo said he had "no evidence" that the bots caused a breach. Thompson's comments came as the U.S. Government Accountability Office (GAO) issued a report saying DHS continues to have "significant weaknesses in computer security controls that threaten the confidentiality, integrity, and availability of key ... systems." GAO investigators found no security controls on the US-VISIT database, the system that screens people who want to visit the U.S. for potential terrorists and criminals. Lawmakers are concerned whether terrorists could get into the database "and change or alter their names to allow them access to this country, and we wouldn't even know that they're doing it," said Representative Bob Etheridge, a North Carolina Democrat. A contractor provides IT security for US-VISIT, but DHS has its own security controls in place to protect the database, Charbo said. He didn't disclose specific security measures. The GAO doesn't have evidence that the US-VISIT database was breached, said Keith Rhodes, chief technologist and director of the GAO's Center for Technology and Engineering. "I did not see controls in place that would prevent it," Rhodes said. "I did not see defensive perimeters, and I did not see detection systems in place whether it had or had not [been breached]." GAO started a cybersecurity review of DHS a year ago but curtailed its efforts because it kept finding "more and more" problems, Rhodes said. "If we had continued to this day, I would argue we'd still be finding things," he said. "The problems were pervasive. The problems were systemic." Charbo outlined recent measures DHS has taken to improve cybersecurity there. The agency is collapsing multiple legacy WANs into a single WAN, and it is standardizing all e-mail and directory services onto a single platform, he said. The agency had 13 separate e-mail systems when it was formed out of 22 U.S. agencies in 2002, he said. DHS also is combining multiple data centers into a shared center, he said. Thompson asked how DHS officials can preach cybersecurity practices to other agencies and private companies while continuing to have its own problems. Among the incidents DHS reported were employees sending out classified documents on unclassified networks and contractors attaching unauthorized laptops to the DHS network, he said. "How can the Department of Homeland Security be a real advocate of sound cybersecurity practices without following some of its own advice?" he said. "What the department is doing on its own network speaks so loud that the message isn't getting across to anyone else."
111984
Three-quarters of incidents involving loss of sensitive data are caused by human error, according to researchers.
732951
Weaknesses in the Energy Departmentâs cybersecurity allowed hackers to successfully penetrate its systems 199 times last year in intrusions that affected 3,531 systems, the departmentâs inspector general said.
147798
Companies disclosed a flurry of new security breaches, highlighting the need for IT managers to focus more on securing their data -- not just their corporate networks.