Security crisis? Keep your cool, expert says
105890
(InfoWorld) - Security managers have to keep their cool and clearly communicate with chief information officers (CIOs) during a crisis affecting company networks, a top security official with Microsoft said Wednesday. Otherwise, trying to educate CIOs in a panic mode will complicate how an attack is countered, said Greg Galford, Microsoft security architect, who gave a presentation at the EuSecWest 2007 security conference in London on Thursday. Galford was a technical lead during a massive attack on Microsoft's network in 2000 that prompted the company to make many changes to its networks and its response approach. He now works with Microsoft's Security Response Center, which handles new vulnerabilities and exploits affecting the company's software. The hacking attack in 2000 wasn't a huge surprise, since Microsoft was using much of its own newly developed software that had security faults, Galford said. At the time, the company wasn't nearly as vigilant as it is now about security, he said. Microsoft had a huge web of insecure connections leading to its corporate network, including employees who worked from home and connections security officials were unaware even existed, Galford said. The company also mistakenly made public much information on how its own corporate networks were constructed, which likely aided hackers. One network engineer had even made most of the information on his hard drive available over the Internet, he said. "We shot ourselves in the foot," Galford said. During its response, Microsoft learned hard lessons in how to communicate developments up the chain of command. Technical people have to be separated from management. CIOs need to be told regularly when they will be briefed again after receiving an update, Galford said. "We had executives coming down to the offices of people that were doing the actual technical work," Galford said. Ideally, management should be briefed before a crisis, so they know how the response will proceed, Galford said. Also, security managers need to know how to communicate in nontechnical terms for CIOs who may not have the same background, he said. CIOs "are always worried about what's going on," Galford said.
676651
(InfoWorld) - The more money that companies spend on securing their IT operations from external attack, the more it seems they become aware that the potential threat posed by their own employees remains their most significant risk. A new study published by consultants Deloitte on Tuesday finds that financial services companies -- among the most advanced and deep-pocketed consumers of security technologies in the world -- are still struggling with the concept of handling the insider threat issue despite all the cash they're dropping on security technologies. In the survey of 100 global financial services firms, Deloitte found that 91 percent of those questioned were concerned about their inability to respond to insider threats, while 79 percent were willing to cite "the human factor" as the root cause for a majority of their security issues. Despite that and all the different types of security tools companies have adopted, the survey found that 22 percent of the companies interviewed hadn't provided any new security training to their workers in the past year, and only 30 percent indicated a belief that their current employees were skilled enough to respond to an emerging security crisis. The apparent lack of faith in their ability to control the insider threat shows that many businesses are aware that they are only just beginning to tackle the problem, report authors said. "The contradictory findings highlight the security paradox financial institutions are facing," Mark Steinhoff, leader of the firm's financial security and privacy services practice, said in the report. "Security training and awareness, along with access and identity management -- of employees, clients, and suppliers alike -- are among organizations' top initiatives this year as they fight to keep pace with the ever-changing threat landscape." Beyond training, more companies are also enlisting the help of additional security systems aimed specifically at thwarting internal attacks and preventing mistaken data breaches. In addition to tools that offer the ability to track IT systems usage more comprehensively -- and create electronic paper trails that give forensics experts a string of clues when investigating any misbehavior or mistake -- enterprise organizations claim that they are also blending physical and IT security to stay abreast of what their workers are up to. "We've been putting cameras on all entrances and exits, looking at using badge numbers for tracking purposes, and keeping a closer eye on what people are doing and where they are going," said Adam Le, director of IT infrastructure at Alliance Imaging, a healthcare testing specialist. "We're also contemplating things like fingerprint scanners and other biometrics and looking at encrypting all data at rest on laptops." Companies walk a fine line in balancing the need to watch over their workers for security purposes and becoming too intrusive, the expert admitted. However, Le said that with businesses like Alliance facing mounting pressure from regulators to lock down every piece of patient data they record, employees must understand that the process is about protecting the firm and not about assessing personal work habits. In another effort to deal with the insider threat, Alliance, which provides outsourced medical imaging capabilities to hospitals and other healthcare organizations, has added new user authentication and monitoring tools made by ConSentry to its IT environment. By increasing security for remote workers and giving the firm a more detailed roadmap of file access activities carried out by its employees and customers, Le said he believes Alliance is finally getting ahead of the insider problem and arming itself with a way to keep everyone honest. One of the most significant issues the company has dealt with in the past are efforts by insiders to view the records of famous or high-profile patients, activities that are directly at odds with the Health Insurance Portability and Accountability Act medical data protection regulation. In some cases, the incidents have been the result of mere nosiness, while in others, the firm suspects that workers may have been looking to share sensitive data with outsiders for a profit. After conducting both technological and physical penetration tests on its operations, Le said that Alliance feels it is making the right moves to address the issue after augmenting its operations as such. "With the threat of data theft for identity fraud or to get information on our high-profile customers, we had to work to get a better picture of who was accessing what files," said Le. "Since putting the tools in place, we've been able to track people down when they do something wrong, and I think that type of response travels among workers by word of mouth; overall those types of issue have almost disappeared now that people know that their activities will be monitored." Data leakage prevention tools become more popular Another angle on preventing insider data breaches is being pursued via the use of so-called DLP (data leakage prevention) tools. At WebEx, the well-known online conferencing applications vendor, Security Engineering and Operations Manager Mike Machado said that the company is using advanced DLP technologies made by Reconnex to ensure that workers aren't walking out of the building with the company's next big idea. "Up until now, we didn't have anything in place that could capture everything that goes over the wire, but the ability to use technology do to do this type of testing, versus doing sampling in the past, has given us a much clearer picture of where data is going on the network and who is touching it," Machado said. "Most of the incidents we find today are people unaware of policies, it's only occasionally that we find something malicious, but typically the result is a simple behavior discussion, and that's helping people expand their own understanding of what they should or shouldn't do," he said. Another advantage to using DLP to keep an eye on all the data being transmitted out of WebEx's network is that the tools serve as another proof point to show external auditors when those groups are testing to see if the firm is employing comprehensive information protection. Perhaps the best use case for the technology yet, however, is when WebEx used the tools to catch an employee attempting to participate in a malware-distribution ring. In addition to joining sides with the malware gang, the employee had also agreed to allow the group to use excess WebEx network capacity to harbor potential attacks -- a problem that would have reflected poorly on the entire company if it were discovered and publicized, said the expert. "It's taught us that a lot that goes on that we know didn't about and verified things we suspected. Overall, it's been a valuable tool for detecting problems and putting us in position to prevent bigger problem down the road," Machado said. "In the rare case we find something to investigate, the technology gives us a much more credible case." The tools have also proven useful for helping the WebEx 's IT security team closer ties with the company's traditional security unit, which has helped the firm coordinate efforts to look for suspicious employee user behavior and policy violations. "Because we were able to help them shed light on some valuable issues, the technology has really closed the loop in that sense," Machado said. "The relationship wasn't always very good, but now, they're willing to be more forthcoming with us, and we can rely on each other more to reach our common goals, which is a big advantage." Some experts contend that companies will spend the next several years loading up on technologies that can help control insider threats now that they have invested so heavily in network defense protections. Brian Contos, chief security officer at ArcSight, an IT security management specialist, said that businesses must consider the insider problem as a dynamic, ever-changing issue, much like protecting against malware, if they hope to stay ahead of major incidents. "The network security side of things has increased at a much faster rate, but it's still the Wild West to a certain extent inside many large companies when it comes to protecting applications, databases, and other systems with a lot of rich data stored in them," said Contos, who previously authored the popular insider threat tome Enemy at the Watercooler. "To be successful, you can't ever be more concerned with internal or external threats. In reality you have the very real chance for either type of attack on a daily basis," he said. "The vast majority of employees, almost all, are not malicious, but you have to constantly watch for that one person who obtains employment deliberately to cause harm or who becomes disgruntled and decides to use what they know against you."
603428
com September 21, 2004, 8:12 AM PT. Most IT Managers won&#39;t question the importance of security, but this priority has been sliding between the third and fourth most important focus for companies.
349823
With Amit Yoran&#39;s sudden departure from the nation&#39;s top cybersecurity job, industry officials said they fear another setback in efforts to make government and corporate networks secure from attacks that hurt business and national security.
257408
MINNEAPOLIS -- It must say something about our times that Bruce Schneier, a geeky computer encryption specialist turned all-purpose security guru, occasionally gets recognized in public.
419900
InfoWorld - Experts gathered for the ongoing InfoWorld Enterprise Data Protection Forum in New York today said that companies need to get a better handle on all the factors that make their sensitive information susceptible to attack and become more proactive with their overall defensive strategies if they are to improve on their current security status.
201749
com September 18, 2004, 12:05 PM PT. Most IT Managers won&#39;t question the importance of security, but this priority has been sliding between the third and fourth most important focus for companies.
404305
(InfoWorld) - Governments and businesses face a variety of cybersecurity threats, but they also need to allow for increasing demands from computer users across the globe, the former information security advisor for the U.K. Ministry of Defense said Wednesday. David Longhurst, who retired this week, called for businesses and governments to take a risk-based approach to cybersecurity by balancing the advantages of new applications and capabilities with the security risks. Too often, Longhurst found himself between the U.K. military, which wanted new networked capabilities, and in-house cybersecurity experts, who wanted no new networking functionality, he said during Microsoft Corp.'s Security Summit East in Washington, D.C. "IT security folks don't want to connect anything," he said. "They believe safe sex is no sex." Longhurst didn't downplay cybersecurity risks as he spoke to a crowd of developers and network security administrators. Protecting the global information infrastructure is one of the top -- if not the top -- challenges for governments, developers and infrastructure providers, he said. It's difficult to fully assess the magnitude of the threat, he said, with IT security experts often saying, "We just have to tell you, it's bad." But as security threats continue to be a large problem, IT users are demanding increased functionality that supports their business, is easy to use, is reliable and safe, and "makes the coffee in the morning," he said. Maybe users don't want their computers to make coffee, but IT security professionals can face demands from users who want to access sensitive data from Internet cafes in Beijing, he said. "They say, 'I'd like to connect to anybody, anywhere, access anything for practically any purpose, at any time,'" Longhurst said. "You could do all this ... if we didn't have a Wild West out there." Longhurst called on everyone in the IT chain, including developers, integrators and users, to give cybersecurity a higher priority. But he also advised companies and government agencies to weigh the risks of new technology with the benefits to themselves or their customers. "This is a risk-based business," he said. "There are no absolutes in this." To fully access risk, businesses and government agencies need to hear from IT security experts, from those wanting the new functionality and from engineers who estimate how long any identified problems will take to fix. In some cases, the U.K. government has rolled out new technology even with security concerns, but set a deadline for fixing any problems, he said. Earlier, George Stathakopoulos, Microsoft's general manager for product security, said the company continues to push security in its upcoming Windows Vista OS. Vista will include several security features, including support for smart-card access to computers, and the Windows Defender scanning tool, he said. Stathakopoulos called on governments and courts to increase penalties against attackers who are caught. "Right now, you write a Sasser [worm] and get a two-year suspended sentence," he said, referring to a 2005 conviction in Germany. "You may even get a security job."
416981
To see the e-mail I get every day from readers about security issues is to develop a deep discomfort with the state of computing today. Keeping a Windows PC safe can demand a high degree of vigilance. -Rob Pegoraro
420806
Top Democrat suggests CIO isn't fit to keep his job amid reports of security-related "incidents." CIO points to "significant progress."
566018
As director of research at the SANS Institute, Alan Paller has a unique window from which to view the U.S. governmentâs efforts to secure its vast computer networks. An original member of the National Infrastructure Advisory Council, Paller has had the ear of high-level White House officials.Â  Paller has also been a reliable critic of the governmentâs cybersecurity plans, which he says are ineffective and mired in bureaucracy.
622153
You wouldn't believe some of the sites that have fallen victim to this security threat, but Martin Heller tells you how to protect yourself.
769512
com September 30, 2004, 12:52 PM PT. Most IT Managers won&#39;t question the importance of security, but this priority has been sliding between the third and fourth most important focus for companies.
406695
(Source: Symantec) In today's sophisticated online environments, traditional security controls are not enough to protect critical network assets. Discover more about a solution that is delivering real-time protection to help organizations strengthen their security posture in the face of today's emerging threats.
146808
Tom Noonan, the CEO of Internet Security Systems, talked with Computerworld about why companies need to stop simply reacting to security threats and focus on preventing them as well.
38008
Vulnerabilities could allow attackers to gain remote control of a system, security company says.
11046
(InfoWorld) - Organizations that experience data breaches must move quickly to assuage the fears of their constituents and go beyond expectations to address the situations effectively, according to those most familiar with the incidents. Speaking at the ongoing Security Standard Conference in Chicago, a pair of experts offered advice for handling situations where sensitive user or customer data is lost or stolen, and examined the missteps taken by retailer TJX Companies in handling its now-notorious credit card information theft. First to the podium was David Escalante, director of computer policy and security at Boston College, which in March 2005 experienced a break in to a server containing sensitive alumni fund-raising information. By addressing the situation head-on and moving to inform anyone whose data may have been exposed in the incident -- which was ultimately blamed on a third-party IT services provider that managed the affected system -- Escalante said BC was able to minimize the impact of the event and quickly move on. "This was probably the low point of my career," said Escalante. "But while it was a bad thing to have happen, it seemed at the time that we were doing the right things to handle it, and I'm glad to say that turned out to be the case." Less than two weeks after BC discovered the breach, the school had assembled a comprehensive incident response plan and had mailed out 100,000 warning letters to anyone whose data may have been stored in the system. By aggressively seeking to communicate with its constituents, including setting up phone lines on which its alumni could call and complain about the issue, the school was able to move past the situation and better prepare for any future breach events, he said. Among the tips that Escalante offered for managing such a crisis was to huddle different organizational officials "like a football team" and loop in everyone from the school's public relations department to its campus police force and IT management groups. By creating a cross-organizational strategy to handle different aspects of the breach, the administrator said, the school was able to assemble the right mix of people to work on different tasks -- from applying computer forensics to study aspects of the breach itself to aligning the right mix of leadership to oversee the entire response process. At the same time, it was crucial to establish separation of duties early in the game, Escalante said. "It's good to keep your upper management separate from your response team because they can get in the way. You want management involved, but you don't want them focusing on every little issue," said Escalante. "At the same time by bringing together a diverse response team, IT and security didn't have to coordinate every issue for themselves." In addition to seeking legal help from its attorneys, the school was able to communicate effectively with law enforcement officials investigating the incident since BC had already familiarized itself with those people before the breach. On the flip side, when Tufts University experienced a similar issue, administrators at the school called Escalante to seek his advice as they didn't know what to expect from law enforcement agencies, he said. Overall, Escalante said organizations should go slightly overboard to impress on their constituents how serious they feel the problem is and how they can help to fix any related problems. "Put the people whose data is lost up front. If you don't tell them and apologize, it will hurt more in the end," Escalante said. Addressing the problematic breach response of TJX Companies, a Framingham, Mass.-based retailer that reported in March 2007 that over 45.6 million customer credit and debit card numbers were stolen from one of its systems over a period of several years, was Richard Stiennon, a well-known security pundit who currently serves as chief marketing officer at filtering appliance maker Fortinet. Stiennon said that many people now believe the TJX attacks came from kiosks in the company's stores that were used by job seekers to fill out applications. People who were hacking the company simply applied for jobs at TJX stores and planted programs that could be used to intercept credit card data being transmitted in unencrypted form from point of sale systems in the locations. Handling sensitive data in such a careless way was the first mistake TJX made, and it had plenty of warning that such attacks could be carried out on point-of-sale systems, the expert contends. Among the additional mistakes made by TJX was not reporting the incident for months, or even years, after it first discovered the hack, he said, as well as failing to address the situation in public and apologize sufficiently to its customers. TJX has also refused to share information about the attack publicly to help other companies avoid such incidents, Stiennon said. "There's been a significant lack of core with TJX's response. They didn't overreact as they probably should have, unlike BC," Stiennon said. "As a result they've become the poster child for data breaches and how not to communicate risk to the rest of the security industry."