British computer society blunders on BCC
525826
Email gaffe leaves 700 emails out to dry The British Computer Society (BCS), home to the "Professionalism in IT" campaign, has made an amateur email error. This morning it sent over 700 members an email without using the blind carbon copy field - so all recipients could see all the other email addresses.â¦
594072
Frame spoof vulnerabilities rife, warns Heise Several major UK bank websites are subject to security flaws that make it easier for phishing fraudsters to craft more convincing scams, according to a study by Heise Security, a UK arm of the German firm behind c't magazine and German IT portal Heise Online.â¦
23544
Cybercrime reporting confusion The HMRC child benefit data loss debacle has reinvigorated calls to establish a central police unit to tackle cybercrime. Business leaders are expressing concern that not enough is being done to help victims of computer crime, who are unsure of who to turn to in the event of being subjected to computer-related fraud or attack.â¦
337072
p2pnet.net News:- British police have arrested a man in connection with source code stolen from Cisco Systems. The Metro police computer crime unit, &quot;searched residences in Manchester and Derbyshire, England, on Sept.
416394
Firm may be facing greater difficulties than previously thought in getting hold of chips to power its high-end PCs.
272360
Government's top boffin disagrees The Commons defence committee today released a report on Blighty's defence-tech research efforts, warning that there are several areas of concern.â¦
339243
Computing Which? hack gets skinned With the UK's 2005 Gambling Act coming into force tomorrow, and online gambling hugely more popular than it was*, is it time to assess the landscape of internet betting for British consumers? Computing Which? magazine says yes, and publishes the result of its painstaking investigation today.â¦
103643
Makers of security software question the thoroughness and accuracy of evaluations.
544588
Some 40,000 computers in the U.K. Department for Work and Pensions were cut off from their network last month when an IT technician erroneously installed a software upgrade, according to EDS.
320548
The FBI's failure to roll out an expanded computer system that would help agents investigate criminals and terrorists is the latest in a series of costly technology blunders by government over more than a decade.
348960
The huge losses reported by French bank Soci?t? G?n?rale, apparently caused by a rogue trader with inside knowledge of the bank's procedures, don't necessarily point to an IT systems failure but rather to poor management of those systems, analysts say.The bank has accused 31-year-old employee Jerome Kerviel of creating a fraudulent trading position in the bank's computers that ultimately caused it to lose around ?4.9 billion ($7.3 billion).Kerviel achieved this by, among other things, misappropriating computer passwords, the bank said. It has revealed few other technical details of what caused the losses.Management of passwords, including rescinding the old passwords of employees who move to different positions within the bank, or modifying the level of access those passwords allow, is often a task given to the lowest-level IT worker."It's dull and routine 99 percent of the time, but a vital backstop," said Bob McDowall, senior analyst at the TowerGroup. Senior IT managers should conduct more frequent reviews of password policies, he said.In some cases, it may not have been the security of the passwords themselves that posed a problem, but rather the access those passwords allowed, said Ian Walden, professor of information and communications law at Queen Mary, University of London.Organizations tend to think of access as being binary in nature: you get access to it all, or you don't, Walden said. In reality, there are many more levels of access. "In modern, complicated systems, the granularity has to be much more sophisticated."To make the best use of systems with advanced access controls, the IT department must have a thorough understanding of how the business works and where there is risk.IT departments and business managers have yet to find a way to wrap security into business processes so it is not an impediment, Walden said."IT in a company is not given a sufficient status," Walden said. "What's shocking is you would have thought that the financial sector was more sophisticated than this, but it still tends to be the case that security is an add-on and a block, something you've got to live with but you don't have to like, rather than being viewed as an integral part of the business structure."Workers should be able to do their job without having to share passwords when someone goes on holiday, and the IT department should not make it harder for people to perform their duties, Walden said.In one extreme example at telecommunications company BT, one employee didn't have the right to use a computer at all, but he found it helped him do his job, Walden said."By the time he was found, he had 90 passwords of different employees," Walden said.It's possible that financial institutions could use biometric systems, such as fingerprint scanners, to provider an added layer of security, McDowall said. Those systems, however, are expensive. Also, the sometimes-finicky fingerprint scanners may not be appropriate in a frantic trading environment, McDowall said.Questions remain about how Kerviel's losses could be so high given his job as relatively low-level trader. But Kerviel's career progression in 2005 from the bank's back office to the front office -- where he would have had access to client accounts -- is also troubling since he would have gained greater knowledge on the bank's inner controls, McDowall said.As an arbitrage trader, Kerviel made money off price differences between different financial products. Soci?t? G?n?rale said Kerviel balanced real and fake trades in order to avoid setting off internal alarms.Kerviel has been described in some press reports as a computer genius. However, most attackers used unsophisticated methods for exploiting systemic vulnerabilities in applications, processes and procedures, according to the 2005 "Insider Threat Study" by Carnegie Mellon Software Engineering Institute.That report notes that sophisticated tools are also used in some attacks, which would demand that internal financial systems need to be designed on a more defensive footing.Programmers should code under the assumption that a hacker or employee will use every means in order to break in, said Ben Rothke, senior security consultant at BT's International Network Services."The underlying issue is that many systems are designed to stop honest people from making mistakes, but do not take into account those with malicious intent," Rothke said.It makes insider jobs one of the toughest to defend against. The psychological profile of an insider tends to be a disgruntled employee who feels wronged by the company, according to the Insider Threat Report.That in turn can lead to a suspicious behavior such as staying late at work, which paradoxically might only signal a committed employee."It's always the insider," Rothke said. "It's often harder to steal $10,000 from a bank than $10 million."
272146
Computer engineers were at a loss last night to explain why the Government had been hit by arguably the worst electronic meltdown in the history of Whitehall.
286377
Organisations are risking seeing sensitive information ending up in the wrong hands, because they are failing to ensure that their unwanted PCs are properly datawiped.
75003
UC Berkeley officials issued a statement of regret about a computer hacking that may have exposed the names and social security numbers of about 600,000 people.
87383
Secondary IPS site in shared credentials snafu Digital certificate glitches have affected the operation of a secondary website used for UK passport applications.â¦
710525
Cyber crime experts yesterday expressed their shock at a &quot;basic&quot; security flaw at internet bank Cahoot that could allow hackers to view private account details.
248717
MacCentral - A handful of Web sites, including the site for the popular open source bulletin board project phpBB, have been compromised this week by a group apparently trying to make a political point.