Homeland Security to host closed-door security forum
126900
(InfoWorld) - The U.S. Department of Homeland Security will host a invite-only conference two months from now that will bring together security experts from law enforcement, Internet service providers, and the technology industry. The Internet Security Operations and Intelligence (ISOI) workshop will be held on August 27 and 28 at the Academy for Educational Development in Washington D.C. It is expected to draw about 240 participants who will engage in a frank discussion of the latest trends in cybercrime, said Gadi Evron, a security evangelist with Beyond Security who is one of the event's planners. "It's an organized group of volunteers from all across the industry, governments, and services," he said via instant message. "All trusted people, all people who do something extra than their job... We respond to international threats and mitigate them, and establish global cooperation across borders daily." The conference will be hosted by the U.S. Computer Emergency Response Team, part of the Department of Homeland Security. This group has met previously in hush-hush events hosted on the campuses of Microsoft and Cisco Systems, and has helped in the response to a number of cyber-crime incidents including the denial of service attacks in Estonia and the recent compromise of Miami's Dolphin Stadium Web site, whichÂ was hackedÂ just days before the stadium played host to the National Football League's Super Bowl game. Because the conference is attended by a pre-screened audience (the press is not invited, thank you very much), presenters at the ISOI workshops offer a deeper level of technical detail than at other events, said Dan Hubbard, vice president of security research with Websense, who is presenting in August. "It really helps communicate the struggles on both sides of the coin." Hubbard will be discussing a new tool he has developed for detecting infections of social networking Web sites, called HoneyJax. Similar to a "honeypot" computer, which is designed to lure cyber-attackers, HoneyJax "allows you to track exploits in the Web 2.0 world and helps assist in the identification of misuse of these technologies" Hubbard said. Other scheduled talks will cover topics such as theÂ Estonian cyber-attacks, the use of Web-based mail for spam, and "Phishing and the IRS." Speakers will be from organizations such as Cisco, AOL, McAfee, the U.S. Department of the Treasury, and the Computer Emergency Response Team of Estonia. The workshops attract a "pretty good spread of people," said Exploit Prevention Labs Chief Technology Officer Roger Thompson, another presenter. "It's really just a forum for security professionals in different disciplines to get together and talk over a beer." Â
685523
Â· Tehran urged to stop arming Iraqi militiasÂ· Qomi proposes trilateral forum to discuss security
199150
Description: NPR&#39;s Mike Pesca talks with NPR&#39;s Alex Chadwick about President Bush&#39;s nomination of former New York Police Commissioner Bernard Kerik to be the new head of the Department of Homeland Security.
188835
The United States will begin issuing   high security biometric identification cards for port workers   as planned at the year-end, but the roll-out of card readers   will be postponed to next year, the Department of Homeland   Security (DHS) said on Wednesday.
740982
SEPTEMBER 15, 2004  - SAN MATEO, Calif. -- The Department of Homeland Security is actively planning several new pilot projects that officials hope will help solve one of the most pressing cybersecurity
129977
Homeland Security Secretary Tom Ridge said Wednesday that security measures for the Republican National Convention are as strong and well-coordinated as officials have had for any event.
354456
Pakistan News, Islamabad,Pakistani and Indian experts began talks here Tuesday on confidence building measures (CBMs) aimed at averting any accidental outbreak of hostilities between the nuclear-armed neighbours.
450369
(InfoWorld) - The creation of aÂ pan-European systemÂ to notify small and medium-size businesses of IT security threats came a step closer Tuesday, as security experts from industry and academia refined plans for the European Information Sharing and Alert System (EISAS) at a conference in Berlin. The conference attendees, from 27 European Union countries, are considering how best to distribute information about new threats across the European Union, said Ulf Bergstrom, press officer for the European Network and Information Security Agency (ENISA), the E.U.'s computer security agency. An interim feasibility study published on Tuesday outlines several proposals for the system. One proposal calls for a multilingual portal that collects and publishes security information from member countries. Another idea under consideration would have individual countries collecting security information and publishing it in their own language on Web sites, then feeding that information to other countries. Further specifics on exactly how those scenarios would work are under discussion, Bergstrom said. Bergstrom said the focus is on keeping the information accessible as possible for end users and also in their own native language. Funding issues, including cost of translation, are also being discussed, he said. The delegates' input will be included in a final feasibility study, due for release later this month, Bergstrom said. That study will be forwarded to the European Commission, which will give its opinion before passing the report around September or October to the European Parliament and European Council for consideration, Bergstrom said.ADVERTISEMENTIBM Information On Demand 2006Industrial Industry Leaders, please join us at IBM's premier information management global event, IBM Information On Demand 2006, October 15-20, Anaheim, CA. More IBM business and technical solutions content in one place than ever before! Select from  over 800 sessions. Register today!
579686
The U.S. Embassy here was closed to visitors Wednesday and security increased after officials received credible threats of an attack on the building, a spokesman said.
753910
The Sept. 11 commission was to close down Saturday, but its members plan to continue testifying before Congress and traveling the country to try to get the government to improve homeland security.
583406
Most people in town for the Republican National Convention will never see it, or know that it's considered crucial to their safety. But tucked away in a windowless, eighth-floor room in lower Manhattan is a high-tech command center where authorities are directing a massive security effort aimed at thwarting terrorist attacks and other threats.
488166
Congress neared agreement Thursday on legislation to strengthen security at the nation's ports, regarded since the Sept. 11 attacks as one of the most vulnerable targets for a catastrophic act of terrorism.
709584
(InfoWorld) - While stopping short of volunteering to host the event, Mozilla chief security official Window Snyder said that it could prove helpful for the open-source community to meet at its own conference to debate secure coding, vulnerability reporting, and product patching issues. In a recent interview with InfoWorld, Snyder -- whose official title with browser maker Mozilla is "chief security something or other" -- said that she would back a meeting of open-source software developers centered on a discussion of security issues. Working at Microsoft as part of its Secure Windows Initiative prior to joining Mozilla in 2006, Snyder helped organize Blue Hat, the software giant's now annual closed-door meeting with security researchers. Security has vastly improved in the open-source community over the last several years as an increasing number of contributors have stepped up to identify software vulnerabilities and help ward off potential attacks, but such a meeting of the minds could help developers improve their products even further, Snyder said. The event wouldn't likely adopt the same closed-door approach as Blue Hat, to which media members and other security industry onlookers remain uninvited, and security researchers and open-source developers would need to focus on both existing issues, such as improving vulnerability disclosure methods, and emerging topics, such as new threats aimed specifically at open-source technologies, according to the expert. If created, the event would likely take on the same grassroots feel of smaller security research conferences, such as the annual ShmooCon gathering in Washington, she said. "It would take a lot of work to coordinate, and we would need a lot of people to organize it, but something like [an open-source Blue Hat] could be very useful," Snyder said. "Anyone who wanted to contribute would have to be welcomed, and the idea would have to be to help people make their own security decisions more intelligently rather than to put pressure on people to change the ways they build things." Backers of the open-source model have long defended that they enjoy a significant advantage over makers of proprietary software -- such as Microsoft -- in the area of finding and patching security flaws in their products. Unlike Microsoft, which keeps its code under wraps and issues monthly updates that typically contain patches for multiple vulnerabilities that have been publicly identified by researchers, open-source companies like Mozilla -- perhaps best known for its Firefox browser -- have legions of contributors who attempt to find and fix any problems in its freely-distributed code on an ongoing basis. The ability to respond to problems so rapidly, and tap into a wider group of security experts in the form of the larger open-source community currently makes Firefox a more secure alternative to Microsoft's Internet Explorer and other proprietary software products, Snyder contends. By meeting as an industry, open-source security experts could also glean more detailed feedback from researchers, she said, as open-source flaws are typically only approached as an element of any published papers issued by security technology vendors. "The majority of reports that come out of the security researchers have a tremendous amount of knowledge, and we would love to get further involved in the overall process and understand the coding implications of what they find," Snyder said. "We could get more suggestions on building out our architecture in the future, which is something we always want to have an eye on." Overall, the security expert said that the open-source model continues to prove itself as advantageous in fighting off attacks, especially as Mozilla continues to hear from a growing number of people who are actively scouring its products for potential issues. "Transparency continues to be one of Mozilla's key factors for success," she said. "Some people might see it as an obstacle in terms of doing security with the whole world watching, and at times it can be a challenge, but we have ten thousand people testing our nightly builds, which is a lot more than you find on your typical browser development team."
56330
For months, homeland security officials have privately debated how to blunt criticism of their planned aviation screening system that passengers and airlines complained was overly intrusive.
57499
(InfoWorld) - Officials from the U.S. Department of Homeland Security will hold a hearing on Capitol Hill on June 20 to discuss the findings of an investigation into the agency's own problems in battling electronic attacks and IT systems intrusions. In a hearing labeled "Hacking the Homeland: Investigating Cyber-security Vulnerabilities at the Department of Homeland Security," officials including DHS chief information officer Scott Charbo and Gregory Wilshusen, director of information security issues at the Government Accountability Office (GAO) are scheduled to detail their findings in response to requests from Congress to test the agency's IT security defenses. In a letter sent to Charbo on April 30, members of Congress led by Rep. Bennie G. Thompson (D-Miss.), chairman of the House Committee on Homeland Security, asked DHS to conduct a review of its information system security in the wake of news that the departments of commerce and state were successfully hacked during 2006. Details of those systems intrusions were first revealed at a hearing coordinated by the House Subcommittee on Emerging Threats, Cyber-security, Science, and Technology on April 19. "These incidents jeopardize the integrity of our government's information. We are concerned that similar incidents may be occurring within the networks of the Department of Homeland Security," read the letter, which was also signed by ranking members of the House Subcommittee on Management, Investigations, and Oversight. Among the issues expected to be addressed by Charbo and other witnesses -- including Keith A. Rhodes, director for the Center for Technology and Engineering in the GAO -- at next week's hearing will be a review of cybersecurity incidents reported to the DHS Security Operations Center (SOC), such as instances of rootkits, classified leaks, compromised Web sites, bot infections, unauthorized use of networks by contractors, and virus attacks. According to a Congressional press release distributed ahead of the hearing, the GAO witnesses will also describe an investigation they conducted on a specific DHS network that is "riddled with significant information security control weaknesses that place sensitive and personally identifiable information at increased risk of unauthorized disclosure." The subcommittee also plans to air some of its concerns with the DHS OneNet project, which is aimed at consolidating all of the agency's information networks under one roof, and to question a perceived lack of IT security funding by Charbo. The Congressional committee has said it will call for further investigation of security issues existing within DHS at the hearing. Among the specific questions posed to DHS leaders by Thompson and other members of the House Committee on Homeland Security are what responsibility Charbo has over management of the agency's networks, and his relationship with the department's chief information security officers (CISOs) and chief information officers. Charbo was also asked to provide details of the agency's information security policies and incident response plans, along with data on how many and what types of security events it has reported to the U.S. Computer Emergency Readiness Team (US-CERT), which was established in 2003 and operates as a partnership between DHS and the public and private sectors. Among the incidents that Congress has specifically asked for more information about are the most severe threats encountered by the agency between 2004 and 2007. The committee has also asked DHS officials to reveal whether or not they have taken an inventory of each access point on the agency's network, and how it has approached the practice of penetration testing for its internal and external systems. In addition to questioning the department's security testing policies, the committee has asked DHS to turn over details of any secure software coding initiatives it has launched in the name of eliminating vulnerabilities in its applications, as well as statistics on how much of its coding is being performed by outside contractors. The committee has also asked for information on whether or not DHS is requiring two-factor IT systems authentication for all privileged personnel and systems administrators. A good deal of discussion at the hearing is likely to be given over to the process that DHS has employed to meet the terms of the Federal Information Security Management Act (FISMA), which was enacted by Congress in 2002 and is aimed at improving IT security in the federal space via a system of mandated annual audits. The hearing may be seen as a bellwether moment in the continued development of government IT security policies and enforcement, as the DHS has been charged with helping to oversee the performance of other agencies, including via its work with US-CERT. If the DHS is found to have failed to protect its own systems adequately, some observers believe that the agency will be put under significant pressure to completely retrench its IT operations in the name of improving security, a process that may then be pushed out to other federal agencies. Some experts believe that adopting such an approach will soon become a fact of life for all government agencies, as many legacy computer systems and policies are not suited to respond to today's fierce security climate. Dave Nelson, a retired deputy CIO for IT security at NASA, who also worked in the White House Office of Scientific Research, said that the government, much like enterprise businesses, has been put in the uncomfortable position of coping with security threats in a cat-and-mouse game, based on long-standing flaws in the technologies and processes it employs. "Until the Internet and the computers that are on it are fundamentally reengineered to be inherently secure, we will always be in coping mode," Nelson said. "The government and IT industry may not know how to make these types of technologies yet, but if they don't get cracking, things will only get worse; as the economic and political payoff of attacks continues to rise, that's our only choice." While Nelson said he has not been made privy to information on attacks on government IT infrastructure for several years, he estimates that there are still many breaches, and that the sophistication of the attacks is ramping up quickly. One of the specific areas that Nelson said needs to be investigated more closely is to what extent foreign governments or politically motivated groups such as terrorists may be involved in cyberthreats. "We don't have any public information that would conclusively prove that some of these attacks are being launched by other nations, but there seem to be significant resources behind them in terms of people and financing," Nelson said. "That's the scariest part, and extrapolating that idea into the future, I don't see a lot of encouraging signs for improvement. If you look at the zero day attacks, they only seem to be getting worse, and I don't see evidence that the systems vulnerabilities they target are going away anytime soon."
24261
As the 108th Congress scrambles in its final days to address homeland security issues, US Reps. Mac Thornberry (R-Texas) and Zoe Lofgren (D-Calif.
416606
(InfoWorld) - Fixing cybersecurity problems in the U.S. is a top priority at the U.S. Department of Homeland Security, said the agency's leader, but lawmakers didn't focus on the issue during a hearing in Congress Wednesday. Cybersecurity is a "very big issue" that DHS remains concerned about, said DHS Secretary Michael Chertoff, testifying before the House of Representatives Homeland Security Committee. Chertoff didn't go into details because much of the department's cybersecurity efforts are classified, he said. "I can assure you that we are working with other elements of the federal government and giving highest priority an enhanced strategy with respect to cybersecurity," he said. Cybersecurity threats have "enormous potential to do damage to the United States in years to come," Chertoff added. Chertoff testified before the committee in a hearing titled, "Holding the Department of Homeland Security Accountable for Security Gaps." But while cybersecurity problems continue inside and outside of the U.S. government, lawmakers focused on other issues during the hearing, including the hiring of border agents, training of bomb-sniffer dogs, and the scanning of airline cargo. Just this week, the U.S. Department of Defense acknowledged a successful attack on an unclassified e-mail system earlier this year. While not focusing on cybersecurity, committee chairman Bennie Thompson, a Mississippi Democrat, said DHS needs to improve in several areas. Thompson has criticized the department's cybersecurity efforts in the past, but cybersecurity issues were not on Thompson's list of top priorities for Chertoff in the remaining 16 months of U.S. President George Bush's administration. Instead, Thompson called on Chertoff to fill vacancies at DHS, to finish regulations for container security at ports, and to implement a biometric air passenger screening program. "We owe the American people security," Thompson said. "We owe them accountability. And most importantly, we owe them freedom from fear." Other than the short Chertoff statement on cybersecurity, the issue did not come up again in more than 90 minutes of questions from lawmakers. Representative Mike Rogers, an Alabama Republican, used part of his question time to complain to Chertoff that many bomb-sniffing dogs used by DHS came from overseas. Rogers urged Chertoff to find ways to breed bomb-sniffing and cadaver dogs in the U.S. "I'm concerned that we are increasingly relying on foreign imported dogs," he said.