Security analysts downplay cyberterror threat
325075
Security analysts today said a warning from the U.S. Computer Emergency Response Team of possible terrorist cyberattacks against U.S. financial institutions shouldn't be overblown.
659879
The potential is there for serious attacks, but they haven't happened yet and probably won't in the coming year, experts say.
402450
(InfoWorld) - As director of research at the SANS Institute, Alan Paller has a unique window from which to view the U.S. governmentâs efforts to secure its vast computer networks. An original member of the National Infrastructure Advisory Council, Paller has had the ear of high-level White House officials.Â  Paller has also been a reliable critic of the governmentâs cybersecurity plans, which he says are ineffective and mired in bureaucracy. Last week, Paller was at it again, joining Eric Byres, Director of Industrial Cyber Security at Symantec to talk about cyberattacks on SCADA (supervisory control and data acquisition) systems that manage the nationâs critical infrastructure. Ahead of that event, Paller told InfoWorld Senior Editor Paul Roberts that SCADA hacks have already happened and that on the five-year anniversary of the Sept. 11, 2001, terrorist attacks, the U.S. gets an âFâÂ  for protecting its computers from hackers, terrorist or otherwise. InfoWorld: Weâve been hearing about the threat of terrorist cyberattacks for years. Is the threat for real? Alan Paller: It is a real threat, but itâs an interesting threat. What you have happening today is that terrorists are using cybercrime to get the money to buy the bombs to blow people up. But theyâre not using cyberattacks against physical things. There have been two cases that are very secret where SCADA systems that run power plants were taken over, but the crime was about extortion -- you know, âIf you donât pay us weâre going to do something bad.âÂ  In some cases the guys have proven that they can do damage by running a test denial of service attack, or a test outage. IW: Conventional wisdom was that SCADA systems are too old and idiosyncratic to be easy targets. What has changed? AP: The difference is that companies have added Windows systems to replace unknown operating systems, and then connected them to their networks, which are connected to the Internet. GAO did a great report on this back in 2004. Most of the attacks we hear about arenât aimed at SCADA systems, theyâre aimed at corporate networks, but once youâre on the network you can get into these (SCADA) systems. IW: Why should enterprise IT people care about the security of SCADA systems? AP: The big shock to us was all the places where control systems are used. NIST [National Institute of Standards and Technology] did a study that found SCADA systems were common in the electric, water, oil and gas, chemical, pharmaceutical, pulp and paper, food and beverage, discrete manufacturing, durable goods, air and rail transportation, mining and metallurgy industries. So tell me whatâs not covered there. Almost anyone who works in a major industry has this stuff on their plate.Â  IW: Is there any evidence that foreign governments are privy to information on how to attack SCADA systems in the U.S.? AP: Well, you have the statement Gen. Lord gave that the military has lost terabytes of sensitive information to the Chinese government. [Editorâs Note: Maj. Gen. William Lord told GCN in August that âChina has downloaded 10 to 20TB of data from NIPRNet, the DoDâs Non-Classified IP Router Network.â] That was the first public âoopsâ that weâve heard. It was an admission at the highest level that weâve spent all this money and systematically the Chinese have been able to come in and steal this information. IW: Recently, an article in Foreign Affairs criticized the U.S. government for playing defense on cybersecurity and missing the way terrorists are using the Internet to organize and raise money. Is that fair? AP: Youâre giving [the government] too much credit for having an active defense. They donât have an active defense. What they have is a lot of reports that have been written. Just one consulting firm increased their staff writing (cybersecurity) reports from four people to 200 in the last five years. As one chief of staff told me, the best thing to do with those reports is to pile them in front of our buildings so the terrorists canât use a car bomb to get us. IW: If you had to give the U.S. government a grade on cybersecurity, what would it be? AP: It would have to be an F. I mean, if you canât secure the boxes that you have, that would have to be an F.
80628
Cybercriminals do not stockpile exploits, then time their release to do the most damage, security researcher says.
38008
Vulnerabilities could allow attackers to gain remote control of a system, security company says.
737281
U.S. intelligence officials are cautioning that popular Internet services that enable computer users to adopt cartoon-like personas in three-dimensional online spaces also are creating security vulnerabilities by opening novel ways for terrorists and criminals to move money, organize and conduct...
17399
Security experts warn of increased cyberattacks on Windows PCs, via a known security flaw, but Microsoft says all is calm.
91510
China has been the target of a big  increase in cyber-attacks in recent years and faces more of a  threat from hackers than any country in the West, a military  researcher said on Saturday.
73476
By JUAN A. LOZANO    HOUSTON  -- Businesses and government agencies must re-examine the growing threat of cyberterrorism to automated computer systems running power grids, dams and other industrial facilities, security experts said Tuesday...
639121
(InfoWorld) - Enterprise security decision makers have long been more likely to be swayed by flashy new technologies than by the notion of comprehensive IT restructuring to protect data and other corporate assets, but the situation is evolving rapidly, according to experts participating in Forrester Research's ongoing Security Forum. Kicking off in Atlanta on Sept. 5, the two-day event will bring together a number of influential IT security consultants and researchers along with a range of vendors and end-users to debate pressing issues impacting enterprise businesses today. Whereas such technology meetings, including Forrester's inaugural 2006 security confab, have historically focused more on the acquisition of new technologies or the latest trends in malware, companies are finally beginning to spend less time on investigating individual attacks and defense mechanisms and more closely examining the idea of broad-ranging risk management, show organizers said. "There isn't any hot new technology being pitched at us these days. The process is less about shiny widgets than it is about cohesive programs that combine security and risk management," said Laura Koetzle, the Forrester analyst charged with pulling the event together. "For a long time, the power in the security industry has been in the hands of the technology providers," she said. "But as enterprise security programs are maturing, we're seeing a shift to more coherent strategies that emphasizes specific business needs." Koetzle said that the annual conference will have its fair share of security research reports on emerging threats -- including the latest on messaging security trends from specialists with Postini -- but the analyst highlighted increasing sophistication of the planned discussions, which focus on how companies can work with their customers and business partners to take a more organic approach to security. "Many people growing up in the security discipline have seen a lot over the last few years, and now they're focused on working with business partners both inside and outside of their firms to get a more holistic view of what they want to accomplish, versus blocking viruses and filtering," said Koetzle. "Today, security folks are much less likely to be a guy in a black hat in charge of some esoteric technology whom you never see, it's more about people who coordinate management strategy for companies and ensure that they have the right skills and partners in place," she said. The Forrester analyst contends that security professionals are also no longer forced to fight for attention among the ranks of IT with c-level corporate leaders having woken up to the fact that their companies' operations and reputations can be severely affected by data breaches and security gaffes. Among the scheduled speakers at the show will be representatives from IT vendors including Dell, Texas Instruments, and VeriSign, but Forester has also corralled customers from the financial services and healthcare industries to share their latest experiences. Along with a slew of Forrester's own experts, academic researchers from Johns Hopkins University and Purdue University are also slated to speak at the show. Representing Johns Hopkins will be Dr. Aviel Rubin, director of the school's Information Security Institute and a well-known expert regarding e-voting technologies and many of the issues that loom with the continued adoption of the systems. Rubin, who will also be representing his Baltimore-based consulting firm, Independent Security Evaluators, said that he will explain to show attendees how many existing IT products can still be broken by sophisticated hackers. "It will always be a fact of life that things can be broken and not always by the good guys who will publicize it, so it's important that people examine the way they handle incidents, and it's always good to encourage people to share their stories," Rubin said. However, the researcher said he will also focus on the process improvements that many companies have been able to appreciate as their security efforts have matured. "With the experience they've accrued, some companies, including vendors, are doing a better job of handling vulnerabilities and reporting," he said. "However, it's still useful to look at how things can still be circumvented and look at the measures that are being put in place to stop that sort of activity." Also presenting will be Brian Contos, chief security officer at security management specialists ArcSight and the author of the well-known insider threat tome Enemy at the Water Cooler. Contos agreed that the political battles that IT security pros needed to fight just to get attention and budget from business leaders have waned over the last several years and said that companies are getting far more aggressive in how they police their users and networks. However, that shift has also created new challenges, he said. "People want to monitor almost everything, but by adding more events, they are moving from megabytes of result information to terabytes and also trying to meld IT security efforts with physical security, which will be a long process," Contos said. "The main question we're hearing has become how companies can deal with this flood of data and turn it into something valuable, that's the challenge that many of these enterprise customers face going forward."
53314
Cyber criminals could soon be mounting sophisticated phishing attacks that are hard to detect warn experts.
676651
(InfoWorld) - The more money that companies spend on securing their IT operations from external attack, the more it seems they become aware that the potential threat posed by their own employees remains their most significant risk. A new study published by consultants Deloitte on Tuesday finds that financial services companies -- among the most advanced and deep-pocketed consumers of security technologies in the world -- are still struggling with the concept of handling the insider threat issue despite all the cash they're dropping on security technologies. In the survey of 100 global financial services firms, Deloitte found that 91 percent of those questioned were concerned about their inability to respond to insider threats, while 79 percent were willing to cite "the human factor" as the root cause for a majority of their security issues. Despite that and all the different types of security tools companies have adopted, the survey found that 22 percent of the companies interviewed hadn't provided any new security training to their workers in the past year, and only 30 percent indicated a belief that their current employees were skilled enough to respond to an emerging security crisis. The apparent lack of faith in their ability to control the insider threat shows that many businesses are aware that they are only just beginning to tackle the problem, report authors said. "The contradictory findings highlight the security paradox financial institutions are facing," Mark Steinhoff, leader of the firm's financial security and privacy services practice, said in the report. "Security training and awareness, along with access and identity management -- of employees, clients, and suppliers alike -- are among organizations' top initiatives this year as they fight to keep pace with the ever-changing threat landscape." Beyond training, more companies are also enlisting the help of additional security systems aimed specifically at thwarting internal attacks and preventing mistaken data breaches. In addition to tools that offer the ability to track IT systems usage more comprehensively -- and create electronic paper trails that give forensics experts a string of clues when investigating any misbehavior or mistake -- enterprise organizations claim that they are also blending physical and IT security to stay abreast of what their workers are up to. "We've been putting cameras on all entrances and exits, looking at using badge numbers for tracking purposes, and keeping a closer eye on what people are doing and where they are going," said Adam Le, director of IT infrastructure at Alliance Imaging, a healthcare testing specialist. "We're also contemplating things like fingerprint scanners and other biometrics and looking at encrypting all data at rest on laptops." Companies walk a fine line in balancing the need to watch over their workers for security purposes and becoming too intrusive, the expert admitted. However, Le said that with businesses like Alliance facing mounting pressure from regulators to lock down every piece of patient data they record, employees must understand that the process is about protecting the firm and not about assessing personal work habits. In another effort to deal with the insider threat, Alliance, which provides outsourced medical imaging capabilities to hospitals and other healthcare organizations, has added new user authentication and monitoring tools made by ConSentry to its IT environment. By increasing security for remote workers and giving the firm a more detailed roadmap of file access activities carried out by its employees and customers, Le said he believes Alliance is finally getting ahead of the insider problem and arming itself with a way to keep everyone honest. One of the most significant issues the company has dealt with in the past are efforts by insiders to view the records of famous or high-profile patients, activities that are directly at odds with the Health Insurance Portability and Accountability Act medical data protection regulation. In some cases, the incidents have been the result of mere nosiness, while in others, the firm suspects that workers may have been looking to share sensitive data with outsiders for a profit. After conducting both technological and physical penetration tests on its operations, Le said that Alliance feels it is making the right moves to address the issue after augmenting its operations as such. "With the threat of data theft for identity fraud or to get information on our high-profile customers, we had to work to get a better picture of who was accessing what files," said Le. "Since putting the tools in place, we've been able to track people down when they do something wrong, and I think that type of response travels among workers by word of mouth; overall those types of issue have almost disappeared now that people know that their activities will be monitored." Data leakage prevention tools become more popular Another angle on preventing insider data breaches is being pursued via the use of so-called DLP (data leakage prevention) tools. At WebEx, the well-known online conferencing applications vendor, Security Engineering and Operations Manager Mike Machado said that the company is using advanced DLP technologies made by Reconnex to ensure that workers aren't walking out of the building with the company's next big idea. "Up until now, we didn't have anything in place that could capture everything that goes over the wire, but the ability to use technology do to do this type of testing, versus doing sampling in the past, has given us a much clearer picture of where data is going on the network and who is touching it," Machado said. "Most of the incidents we find today are people unaware of policies, it's only occasionally that we find something malicious, but typically the result is a simple behavior discussion, and that's helping people expand their own understanding of what they should or shouldn't do," he said. Another advantage to using DLP to keep an eye on all the data being transmitted out of WebEx's network is that the tools serve as another proof point to show external auditors when those groups are testing to see if the firm is employing comprehensive information protection. Perhaps the best use case for the technology yet, however, is when WebEx used the tools to catch an employee attempting to participate in a malware-distribution ring. In addition to joining sides with the malware gang, the employee had also agreed to allow the group to use excess WebEx network capacity to harbor potential attacks -- a problem that would have reflected poorly on the entire company if it were discovered and publicized, said the expert. "It's taught us that a lot that goes on that we know didn't about and verified things we suspected. Overall, it's been a valuable tool for detecting problems and putting us in position to prevent bigger problem down the road," Machado said. "In the rare case we find something to investigate, the technology gives us a much more credible case." The tools have also proven useful for helping the WebEx 's IT security team closer ties with the company's traditional security unit, which has helped the firm coordinate efforts to look for suspicious employee user behavior and policy violations. "Because we were able to help them shed light on some valuable issues, the technology has really closed the loop in that sense," Machado said. "The relationship wasn't always very good, but now, they're willing to be more forthcoming with us, and we can rely on each other more to reach our common goals, which is a big advantage." Some experts contend that companies will spend the next several years loading up on technologies that can help control insider threats now that they have invested so heavily in network defense protections. Brian Contos, chief security officer at ArcSight, an IT security management specialist, said that businesses must consider the insider problem as a dynamic, ever-changing issue, much like protecting against malware, if they hope to stay ahead of major incidents. "The network security side of things has increased at a much faster rate, but it's still the Wild West to a certain extent inside many large companies when it comes to protecting applications, databases, and other systems with a lot of rich data stored in them," said Contos, who previously authored the popular insider threat tome Enemy at the Watercooler. "To be successful, you can't ever be more concerned with internal or external threats. In reality you have the very real chance for either type of attack on a daily basis," he said. "The vast majority of employees, almost all, are not malicious, but you have to constantly watch for that one person who obtains employment deliberately to cause harm or who becomes disgruntled and decides to use what they know against you."
256281
A cyber attack on the Pentagon Wednesday forced the Defense Department to shut down about 1,500 computers after its systems detected a possible compromise, it said Thursday.
13566
The average daily volume of Internet attacks declined in the last six months, according to Symantec Corp.&#39;s Internet Security Threat Report.
713463
Threats to data security are mounting, especially from within organizations, but top executives aren&#39;t helping their companies keep pace, a new study has found.
680558
Jon Oltsik says the explosion in broadband use forces a rethinking of Internet security. But a lethargic vendor response is not a promising harbinger.
289303
(InfoWorld) - The Department of Homeland Securityâs Computer Emergency Readiness Team (US-CERT) raised a few eyebrows in late November when it sent a warning out to U.S. banks and financial institutions about a possible cyber attack by Islamic militants. The alert, dated Nov. 30, was triggered by a posting on what the DHS considered an Islamic jihadi Web site calling for hackers to attack U.S. financial and banking Web sites, apparently to protest the detention of Muslims at Guantanamo Bay, Cuba. However, the warning was heavily qualified, with DHS calling the threat âmore aspirational than operational.â Financial firms downplayed the danger, too. One security executive at a major brokerage told InfoWorld that the warning was a ânon-event.â But could repeated warnings about such non-events eventually make critical infrastructure owners deaf to DHSâs warnings? InfoWorld Senior Editor Paul F. Roberts recently chatted with John Carlson, senior director of security and risk Assessment at BITS, a financial-services industry consortium focused on security, fraud, and risk management, about the DHS warning and state of the public-private partnership on cybersecurity. InfoWorld: Iâm guessing that your members received the US-CERT warning about the cyber terrorist attack? John Carlson: There were two messages sent: the first was [Nov. 30]; then a second revision came out [Dec. 1]. The gist of it was that these reports were not corroborated. IW: What was the reaction of BITS members to the warning? JC: Our members have an âall hazardsâ approach to business-continuity planning. Theyâve got well-developed approaches that have been bolstered since 9/11. In response to new regulatory requirements, firms have done a lot to improve backup, theyâve done tests with the various exchanges. Theyâre also working in closer harmony with the federal government to share information on threats and vulnerabilities. I think thereâs a spirit of appreciation that the government is willing to share information with the financial services industry. The firms take that information into account in responding and activating their business continuity plans. IW: How do your members apply information like this that comes from DHS? JC: Iâm not sure I can give a blanket answer. Each firm has its own mechanisms for gathering information. Risk-management professionals at these firms read the paper and understand the military conflicts and theyâre mindful of that. They take it into account when they have employees traveling. Theyâll monitor where they are. With the [bird flu] pandemic issue, firms were monitoring that closely and trying to figure out what impact it would have on their organizations. IW: Is there a danger from these warnings of creating a âBoy Who Cried Wolfâ situation, where firms begin to disregard the warnings? JC: Thereâs always a concern about the crying-wolf syndrome. But our firms appreciate getting the information even if itâs not corroborated. A continuous flow of information helps build trust between the private and public sectors. IW: Was this warning about the jihadist threat something that your members see all the time, or was this an unusual kind of warning from DHS? JC: I think the warning came across the transom at a high level [saying] âpay attention to this.â So it was different from what we normally get. Weâre getting a steady stream of information on threats and vulnerabilities and a range of things. For example, if thereâs a known virus thatâs being perpetrated in [the United States] or against a financial institution. Weâre also getting information on political changes around the world. IW: Do you think DHS has its arms around the cybersecurity problem? JC: My personal opinion is that the government has some capabilities, but not all capabilities. In general, our firms would like more information, but there are many reasons why if (the government) has the information they donât provide it. But itâs a touchy question. People have lots of different views. Â  IW: Do you feel like your members are getting all the information they need? JC: Thereâs some filtering, but I donât have information to compare or validate what the filter is. We talk about issues through coordinating councils that meet quarterly. Itâs a two way conversation.Â