New cyber-security rules for power cos.
603337
Federal regulators on Thursday approved the first cyber-security standards for the nation's electric industry, following growing concerns about the power grid's vulnerabilities.
640724
IT managers were urged by security experts to develop careful policies about how employee-owned devices are used in the workplace.
664008
Leveraging IP Network Resources to Enable Next-Generation Corporate Communications.
243864
The Federal Communications Commission has made changes to its regulations that will allow power companies to provide broadband services over electric lines.
587844
New federal regulations that could result in fines of up to $1 million a day for utilities that suffer blackouts are prompting an increase in IT spending, particularly on cybersecurity technology.
369967
A NEW level of cyber-crime potential looms ahead as increasingly sophisticated attackers aim to steal intellectual property, personal identities and the contents of bank accounts across international borders, and within organisations and social networks.
587407
Smaller and newer businesses will now be able to get security certificates that trigger a green address bar in Microsoft browsers under new rules ratified this week.
644368
New cybersecurity standards proposed by the North American Electric Reliability Corp. (NERC) to protect the nation's power infrastructure are not broad enough and fail to cover a significant number of interdependent assets.The standards also give electric utility owners, operators and users too much discretion when it comes to implementing the prescribed controls, a group of experts told members of the House Subcommittee on Emerging Threats, Cybersecurity, and Science, and Technology on Wednesday.James Langevin (D-R.I.), chairman of the committee, said the NERC's proposed standards require stakeholders in the power grid to establish plans, protocols, and controls for safeguarding physical and electronic access to the control systems that manage the national's electric infrastructure.The problem is the standards are focused purely on the reliability of "bulk power systems" and don't require electric sector owners and operators to secure their generation systems, distribution systems, or telecommunication equipment, Langevin said in prepared testimony."We know from countless real-world examples that these units are highly vulnerable to intentional and unintentional cyber-events. Knocking any of these units off could affect the power supply to our nation's critical infrastructure," he noted in his statement.The narrow focus of NERC's proposed cybersecurity standards is especially troubling, Langevin said, in light of a recent simulated attack against a power utility control system that was carried out by Department of Homeland Security researchers at the Idaho National Laboratory. The same methods that were used in that experiment could be used to carry out attacks against larger generators and other equipment and cause "widespread and long-term damage to the electric infrastructure," he warned."I'll be blunt: If this administration doesn't recognize and prioritize these problems soon, the future isn't going to be pretty," Langevin said.Joseph Weiss, managing partner of Applied Control Solutions, testified as an expert at the hearing. He said the growing interconnectedness of control systems with other networked computing systems is happening without a corresponding appreciation for the security risks resulting from such connectivity.For the most part, he stated in written testimony submitted to the committee, security issues have been the purview of the IT organizations within utility companies, whose control system groups manage grid and plant operations. As a result, it's often the case that some parts of the system are sensitized to security while others do not fully appreciate the risks, he said.Exacerbating this issue is the fact that many control system applications run in Windows and Unix environments and are therefore susceptible to the same security threats as other systems are. Traditional IT security controls, Weiss said, can help alleviate some of these issues, but they can also cause control system reliability problems.Against this backdrop, he said in his prepared remarks, the NERC's proposed standards are too narrowly focused on bulk power grid reliability, and not, for instance, on smaller substations that might support a major oil or gas pipeline in a remote locale. Similarly, there's not much priority given to securing the continuity of electricity to facilities such as municipal waterworks, manufacturing plants, refineries, hospitals and military installations.Experience has already shown the significant impact that an attack or a security incident against a control system can have on the electricity infrastructure, said Gregory Wilshusen, director of information security issues at the Government Accountability Office. Wilshusen provided written testimony to the committee.As examples, he cited a 2006 incident in which a foreign hacker planted malicious software capable of affecting a water treatment plant's operations, and another incident in which excessive traffic in a nuclear power plant's control system caused two circulation pumps to fail -- forcing the unit to be shut down manually.David Whiteley, executive vice president of the NERC, said that the security issues raised by the interconnectedness of the electric infrastructure and other infrastructures are important and need to be addressed. However, under its existing mandate, the NERC has the authority and responsibility for enforcing reliability standards on only the bulk power grid, not on the distribution system. Developing and enforcing standards on connected infrastructures is beyond the capability of a single body, he said.Whiteley said that in July of this year, the NERC sought comments from the Federal Energy Regulatory Commission on a proposal for approving eight CIP reliability standards. Those cybersecurity standards have been in development for several years and were developed with extensive input from industry experts.Computerworld is an InfoWorld affiliate
588001
Among the security concerns that have been raised is the possibility of someone being able to cast multiple ballots. Other concerns are about a sudden power outage and whether data would be lost in such a scenario.
599092
Research displayed on new security techniques, search advances, more.
81045
(Source: Computerworld) Peace of mind is in short supply these days among IT managers and network administrators, given the dangers out there today. Not only are internal threats ever-present, but highly paid cyber criminals half a world away are almost constantly trying to knock down security walls. The best defense, as it turns out, is a comprehensive risk management strategy.  Download this Technology Briefing to learn more.
530421
Company's subscription services now include an array of security tools, including the basics.
366031
Quick and determined action RSA The US's latest chief of cyber security has pledged quick and determined action to protect the nation's critical infrastructure from attack.â¦
433612
Port25 has released a new version of its PowerMTA, geared to address E-mail-authentication specs and accreditation services. By Thomas Claburn.
204491
(InfoWorld) - Moves by several European countries to tighten laws against computer hacking worry security professionals who often use the same tools as hackers but for legitimate purposes. The U.K. and Germany are among the countries that are considering revisions to their computer crime laws in line with the 2001 Convention on Cybercrime, a European-wide treaty, and with a similar European Union measure passed in early 2005. But security professionals are scrutinizing those revisions out of concern for how prosecutors and judges could apply the laws. Security professionals are especially concerned about cases where the revisions apply to programs that could be used for bad or good. Companies often use hacking programs to test the mettle of their own systems. "One useful utility in the wrong hands is a potentially malicious hacking tool," said Graham Cluley, senior technology consultant at Sophos PLC in Abingdon, England. In the U.K., legislators are debating amendments to the Computer Misuse Act (CMA) of 1990. The proposed revisions would make it illegal to create or supply a tool to someone who intends to use it for unauthorized computer access or modification. Likewise, the proposed changes to German law would also criminalize making and distributing hacking tools. The German government said the changes will bring it into compliance with the 2001 Convention on Cybercrime. Several German security companies are planning to lobby against the law, as they fear it could hamper those who test security systems, said Alexander Kornbrust, founder and chief executive officer of Red-Database-Security GmbH in Neunkirchen, Germany. For example, tools to check the strength of passwords, often freely distributed, could also be used by malicious hackers, he said. "The security community is very unhappy with this approach," Kornbrust said. "The concern is that the usage and possession of so called hacker tools will become illegal." The U.K. and Germany are trying to align their laws with Article 6 of the Convention, which bans the creation of computer programs for the purpose of committing cybercrime. So far, 43 countries have signed the Convention, which indicates their willingness to revise their laws to comply. Fifteen have ratified the Convention. After a country changes its laws, it can ratify the convention and put it into force. The Convention does not mandate a deadline for when countries must comply, and the process of changing laws can be lengthy depending on the country, said Margaret Killerby, head of the European Committee on Crime Problems, which tracks implementation of the Convention. But the goal is for Europe -- and other countries, such as the U.S., which also said it will implement the Convention soon -- to mount a consistent defense against computer criminals given the transnational nature of computer crime, Killerby said. A key point of the Convention requires countries to have a law enforcement contact available at all times to assist foreign authorities in obtaining electronic evidence, which can disappear quickly without quick moves by law enforcement. "What we want to have is an institution to allow states to cooperate with each other as rapidly as possible," she said. Those requirements are devoid of controversy. Individual countries can draft their own customized legislation to comply with the Convention, which can be used as a checklist, Killerby said. The Council has provided assistance to countries in central and eastern Europe in creating computer crime laws where none were on the books, Killerby said. Countries with existing laws will have find a medium that satisfies their own legal requirements and the Convention. In the U.K., the House of Lords is scheduled next month to debate changes in the part of the CMA concerning creation and distribution of hacking tools. The proposed revision to the CMA says a person is guilty of an offense if he makes or supplies something intending it to be used to commit an offense or "believing that it is likely to be so used." But officials are confident that the wording can be smoothed. The controversy could be dampened merely by changing "likely" to "primarily" which could "make sure we don't catch the legitimate penetration testers," said Merlin Erroll, a Lord who sits on the All Party Parliamentary Internet Group (APIG), during a recent presentation in London. REFERENCES: UK bill would increase penalties for cybercriminals, Jan. 27, 2006Analysts eye revamp of UK cybercrime law, Jun. 7, 2006UK teen pleads guilty to DOS e-mail attack, Aug. 24, 2006
738930
(InfoWorld) - The Cyber Security Industry Alliance has given the U.S. government D grades on its cybersecurity efforts in 2006, and renewed its call for the U.S. Congress to pass a comprehensive data protection law in 2007. The CSIA, a trade group representing cybersecurity vendors, gave the U.S. government D grades in three areas: security of sensitive information, security and reliability of critical infrastructure, and federal government information assurance. "Government needs to take these issues very seriously," said Liz Gasster, the CSIA's acting executive director and general counsel. Among the problems in 2006: The U.S. Department ofÂ Veterans Affairs reported a data breach involving the personal information of 26.5 million military veterans and family members. Other agencies also reported multiple lost laptops containing personal information. The CSIA called on agencies to notify citizens of data breaches. After a rash of reported data breaches in early 2005, members of Congress introduced multiple bills requiring companies with data breaches to notify affected consumers. ButÂ a breach-notification law failed to pass, partly because of jurisdictional fights between multiple congressional committees. A comprehensive data security bill should include breach notification, but also a requirement that all organizations holding sensitive data -- including private companies, government agencies, nonprofits, and educational institutions -- use reasonable security standards, Gasster said. The U.S. Federal Trade Commission has taken action against several companies, but a comprehensive law would give the FTC or another agency broad jurisdiction to investigate data breaches, she said. The CSIA is optimistic a comprehensive data breach law will pass in the next year, even though it stalled in the last Congress, Gasster added. Major data breaches continue to happen, and consumers will increase the pressure on Congress to act, she predicted. In mid-January, retailerÂ TJX Companies Inc. reported a massive data breach. "Consumers just are not going to put up with is," Gasster said. Here's how the CSIA generated its government cybersecurity grades: -- Security of sensitive information, grade D: Congress ratified the Council of Europe Convention on Cyber Crime, allowing the U.S. to work with other signatories on cybersecurity investigations, but failed to pass a comprehensive law to protect sensitive personal information. -- Security and resiliency of the critical information infrastructure, grade D: The Department of Homeland Security appointed an assistant secretary for cybersecurity and telecommunications and implemented some cybersecurity program, but it hasnât offered a clear agenda for its top cybersecurity research and development priorities or established a survivable emergency coordination network to handle a large-scale cybersecurity disaster. -- Federal information assurance, grade D: Government continues to offer a "mixed bag of successes and failures," the CSIA said, with progress within the White House Office of Management and Budget's enforcement of cybersecurity directives and implementation of U.S. President George Bush's Homeland Security Presidential Directive 12, requiring agencies to start issuing smart identification cards. But the government needs to do a better job in several areas, including security issues with telecommuting and releasing information on the cost of cyberattacks, the CSIA said. In addition to a comprehensive data protection bill, CSIA called for the U.S. government to strengthen the power of agency chief information officers and called on agencies to increase testing of cybersecurity controls.
383169
Grid architecture aims to protect corporate networks from interior security threats.