Friday, April 10, 2009

Security Management Weekly - April 10, 2009

header

  Learn more! ->   sm professional  

April 10, 2009
 
 
CORPORATE SECURITY  
  1. " Standoff With Pirates Shows U.S. Power Has Limits"
  2. " Piracy Causes Changes in Routes, Insurance"
  3. " Microsoft Ordered to Pay $388 Million in Patent Lawsuit" Rhode Island
  4. " French Kill Web Piracy Bill, by Accident"
  5. " Security Guard Held in String of Business Burglaries" Beaverton, Ore.

HOMELAND SECURITY  
  6. " CIA Has Quit Operating Secret Jails, Chief Says"
  7. " Terrorism Charges Against RNC 8 Are Dropped" Ramsey County, Minn.
  8. " Security-Clearance Checks for OPM Allegedly Falsified"
  9. " CIA Bans Interrogations by Outside Contractors"
  10. " Top U.K. Police Official Resigns After Security Gaffe"

CYBER SECURITY  
  11. " Electric Utilities May Be Vulnerable to Cyberattack"
  12. " Fake Antivirus Software on the Rise"
  13. " Growing Threat From Cyber Attacks: US General"
  14. " Defense Cos Seek Czar for Cyber Security Overhaul"
  15. " Short-Lived Web Malware: Fading Fad or Future Trend?"


   






 

"Standoff With Pirates Shows U.S. Power Has Limits"
New York Times (04/10/09) ; Mazzetti, Mark

The standoff between the U.S. Navy and four Somali pirates holding the captain of a cargo ship hostage in the Indian Ocean underscores the limits of the nation's military in dealing with the growing piracy problem off the coast of Somalia. Despite having a task force made up of a number of expensive destroyers, the U.S. Navy has been unable to end the standoff with the pirates, who are holding Richard Phillips, the captain of the Maersk Alabama, hostage onboard a lifeboat. The ship was hijacked Wednesday by pirates, though its crew quickly fought back and managed to regain control. There is no sign that the U.S. plans to confront the pirates, and it is also unlikely that it would directly attack pirate sanctuaries along the Somali coast. Shipping companies are hoping that the U.S. will refrain from using its military might to go after pirates in the region, since a military confrontation could disrupt the shipping lanes that run from the Suez Canal to the Indian Ocean. Many companies would rather not confront the pirates. According to experts, companies would rather pay pirates large ransoms instead of arming merchant crews or paying large liability insurance premiums. Companies have already paid pirates a large amount of money in ransoms. Last year alone, merchants paid roughly $40 million to Somali pirates, experts say.
(go to web site)

"Piracy Causes Changes in Routes, Insurance"
Wall Street Journal (04/09/09) P. A10 ; Miller, John W.

Shipping routes have changed as pirates in and around the Gulf of Aden continue to seize vessels and crews. Since the gulf is one of the busiest trade routes, shipping rates have increased significantly as ships sail around the Cape of Good Hope, which can take two to three extra weeks. Suez Canal revenues have declined as a result of the route changes, and Suez Canal revenues account for up to 20 percent of the Egyptian government's annual budget. Insurance carriers offering shipping coverage to vessels have raised rates for those traveling through the Gulf of Aden and the Suez Canal, and in some cases tankers carrying oil and chemicals are required to purchase "war zone" coverage. Some shipping firms have curtailed their routes through the region to keep insurance costs low, but critics say the threat of piracy off the coast of Somalia is low given that only a small portion of the 50 commercial ships traveling through the gulf daily are attacked. Shipping firms, on the other hand, are taking the risks to heart and offering basic training to crew members to help them deal with pirate attacks, such as huddling in safe rooms, repelling pirates with water canons, and sending signals to nearby military vessels. Some expect these firms to begin hiring private armed security guards, though this could place crew members in more danger.
(go to web site)

"Microsoft Ordered to Pay $388 Million in Patent Lawsuit"
Wall Street Journal (04/09/09) ; Letzing, John

A jury in the U.S. District Court for the District of Rhode Island has ruled in favor of the software company Uniloc Singapore Private in its patent infringement lawsuit against Microsoft. In its decision, the jury agreed with Uniloc's assertion that Microsoft's anti-piracy registration system infringes on a patent that it owns along with its U.S. subsidiary. The jury ordered Microsoft to pay Uniloc $388 million for violating the patent--an amount that was based on compensation owed to the company from October 1, 2003, court documents said. Microsoft says it will challenge the verdict because it believes the patent is invalid and that the award of damages is "legally and factually unsupported."
(go to web site)

"French Kill Web Piracy Bill, by Accident"
Christian Science Monitor (04/09/09) ; Gaylord, Chris

A bill that would have taken away the Internet access of Web surfers caught illegally downloading music or movie files at least three times has unexpectedly been defeated in France's parliament. With many of the conservative lawmakers who supported the bill on Easter recess, Socialist lawmakers--who consider the legislation to be an invasion of personal privacy--voted down the bill 21 to 5. The bill must now be reintroduced by French President Nicolas Sarkozy's conservative UMP party. Parliament could vote on the bill again sometime this month. U.S. music companies are hoping the bill will pass, and that it will provide a model for similar laws in this country.
(go to web site)

"Security Guard Held in String of Business Burglaries"
Beaverton Valley Times (OR) (04/07/09) ; Lent, Christina

A security guard with First Response Inc. in Beaverton, Ore., has been charged with stealing office equipment from at least six businesses she was charged with protecting. The businesses, which were located in two office buildings in the Griffith Business Park in Beaverton, began noticing the thefts of items such as a laptop computer, petty cash and other inexpensive items in February, said Beaverton Police Det. Sgt. James Shumway. After receiving complaints from the businesses about the thefts, police set up surveillance cameras in some of the office suites and identified the security guard as the suspect. Detectives then contacted the security guard and searched her home, where they found the stolen laptop, several $300 pairs of telephone headsets, and a number of other stolen items from burglaries that were never reported. The security guard--who does not have a prior criminal history--has since been arrested and is being held on five counts of second-degree burglary, one count of first-degree theft, two counts of second-degree theft, and six counts of second-degree trespass. She has also been fired from her job with First Response and could have her Private Security Certification and State Private Security License revoked, said First Response branch manager Derek Bliss.
(go to web site)

"CIA Has Quit Operating Secret Jails, Chief Says"
Washington Post (04/10/09) P. A03 ; DeYoung, Karen

CIA Director Leon Panetta issued a message to CIA employees on Thursday in which he addressed a number of issues surrounding the detention and interrogation of terrorism suspects. In his message, Panetta said his agency no longer operates any so-called "black sites," the secret overseas prisons where the CIA held and interrogated as many as 100 high-ranking members of al-Qaida and other terrorist suspects who were captured after the September 11, 2001 terrorist attacks. The CIA has said that many of the prisoners at these facilities--which are believed to be located in Thailand, Romania, Poland, and several other countries--were subjected to interrogation techniques that some have described as illegal torture. Panetta also said that CIA personnel will oversee a plan to decommission the black sites that are still in existence but are no longer operational. That statement was the first public acknowledgement by an official in either the Obama or Bush administrations that some of the black sites still exist. Finally, Panetta said that the CIA will no longer use contractors to conduct interrogations of terrorism suspects or to provide security at the remaining black sites. He added that any outside contracts still involved in site security will be terminated.
(go to web site)

"Terrorism Charges Against RNC 8 Are Dropped"
Minneapolis Star Tribune (04/10/09) ; Furst, Randy

The Ramsey County, Minn., attorney's office has dropped terrorism charges against eight activists in an anarchist group that planned disruptions at the 2008 Republican National Convention. The prosecution would have been the first such effort under the 2002 state terrorism law. Officials say they will file amended complaints in the cases of the eight defendants. The charges of conspiracy to commit riot and conspiracy to commit criminal damage to property will remain. But charges of conspiracy to commit riot and conspiracy to commit criminal damage to property "in furtherance of terrorism" will be dismissed. The Minnesota Legislature enacted the terrorism law in 2002 in the wake of the federal Patriot Act. It provides longer sentences for felonies that involve premeditation and violence to people or property and that are intended, among other things, to intimidate the public and disrupt the right of lawful assembly. "It was clear to us as we prepared for trial that the terrorism enhancement was going to become the focus of the proceeding," Ramsey County Attorney Susan Gaertner said. "We felt it would distract the jury from the core illegal conduct that is at issue. Keep in mind that even if they had been convicted of terrorism charges, they would have received no additional punishment under the sentencing guidelines." The trials of the eight, who are accused of planning actions to "shut down" the convention, are expected to begin in September.
(go to web site)

"Security-Clearance Checks for OPM Allegedly Falsified"
Washington Post (04/09/09) P. A15 ; Wilber, Del Quentin

Since 2007, six investigators who conducted security-clearance checks for the federal government in Connecticut, Maryland, and Washington, D.C., have been charged with making a number of false statements in the reports they submitted about their investigations to the Office of Personnel Management. For example, some of the reports said that investigators conducted interviews with the friends, co-workers, or former professors of applicants seeking government jobs requiring security clearances at several agencies, when in fact no such interviews took place. In the case of one investigator, who has been convicted and sentenced to more than two years in prison for making false statements in his reports, recommendations were made to give applicants security clearances after they were interviewed for just a few minutes. Other investigators were also found to have conducted interviews that were not long enough to gather meaningful information about the applicant. Officials say they do not believe that the reports were falsified to help someone who did not deserve a security clearance to get one or to help people evade screening. Instead, the false statements were made because investigators were overworked or were trying to earn more money by performing as many background checks as they could. Nevertheless, government officials say they were concerned about the falsified reports. Among them is Assistant U.S. Attorney Ellen Chubin Epstein, who said that the lax investigations could create serious risks to national security.
(go to web site)

"CIA Bans Interrogations by Outside Contractors"
Wall Street Journal (04/09/09) ; Gorman, Siobhan

CIA Director Leon Panetta wrote in a letter to lawmakers on Thursday that his agency will no longer use contractors to conduct interrogations of terrorism suspects--a controversial practice that was used at secret CIA prisons overseas. However, contractors could still be use to support interrogations in some circumstances, such as when special language skills are needed, according to an intelligence official. Panetta said that CIA officers will continue to conduct interrogations and that it will hold detainees on a "short-term transitory basis if needed." He added that no terrorism suspects are in the CIA's custody now, and that any suspects held in the future would quickly be turned over to U.S. military authorities or to their country of jurisdiction. A memo to CIA employees that accompanied the letter also reaffirmed that the CIA would follow the same interrogation rules that the U.S. military uses. Those rules ban interrogation techniques such as waterboarding.
(go to web site)

"Top U.K. Police Official Resigns After Security Gaffe"
Wall Street Journal (04/09/09) ; Mollenkamp, Carrick; Macdonald, Alistair

Bob Quick, the London Metropolitan Police Service's assistant commissioner and its most senior counterterrorism official, resigned Thursday after he accidentally disclosed the details of a planned raid on suspected Islamic militants who were believed to be planning a major terrorist attack. The leak occurred Wednesday when Quick briefed Prime Minister Gordon Brown on the raids, which were scheduled to take place in roughly three days. When he arrived for the meeting, Quick was photographed carrying secret documents about the raids. Several pieces of important information about the raids were clearly legible in those photographs, including statements that the raids were part of an investigation into "suspected AQ (al-Qaida) driven attack planning within the U.K." The documents also said that 11 subjects would be arrested at raids on seven addresses and that "dynamic entry" using firearms would be needed. Although the British government put a media blackout in place to block the release of the photos, authorities launched the raid immediately instead of waiting three days as they normally planned. Counterterrorism units eventually arrested 12 suspected terrorists in raids across northwest England on Wednesday.
(go to web site)

"Electric Utilities May Be Vulnerable to Cyberattack"
Washington Post (04/09/09) P. A4 ; Nakashima, Ellen; Smith, R. Jeffrey; Hsu, Spencer S.

An assessment by the North American Electric Reliability Corp. found that U.S. electric utilities have not fully examined their susceptibility to cyberattacks from foreign countries and hackers. Thus far the federal government has not made a heavy effort to establish computer security regulations for the power grid, and to date the North American Electric Reliability Corp.'s main thrust has been to mandate that companies identify their vulnerabilities to cyberattack. The group's chief security officer Michael J. Assante submitted a letter to industry and government officials warning that "system planners and operators" must pay more scrutiny to the threat of "simultaneous manipulation" of computers within power substations and the impact of such assaults on the larger grid. He wrote that the fact that "an intelligent cyberattacker" can penetrate "multiple assets at once, and from a distance" demands more protection than utilities have considered, and they must reevaluate "the potential consequences ... of not only the loss of assets that they own or control, but also the potential misuse of those assets by intelligent threat actors." Several independent experts noted that federal authorities have identified Russia- and China-based penetrations of power grid computer controls. The North American Electric Reliability Corp.'s advisory coincided with a senior military official's disclosure that the Pentagon has spent over $100 million in the past six months responding to cyberattacks or other network problems. A two-month review of cybersecurity policy has almost been completed by the Obama administration, and experts say the assessment will probably call for a stronger federal role in setting cybersecurity standards for utilities and other industries of critical importance to the U.S. economy. Homeland Security Secretary Janet Napolitano informed reporters that as far as she knows no part of the U.S. electricity grid has been "compromised by a deliberate cyberattack."
(go to web site)

"Fake Antivirus Software on the Rise"
Wall Street Journal (04/08/09)

Microsoft is reporting that cyber criminals are increasingly using fake antivirus software to steal information. An analysis of computers that received automated updates from Microsoft in the second half of last year found that fake antivirus software was on hundreds of millions of machines. George Stathakopoulos, Microsoft's general manager for product security, said a large number of people likely downloaded fake antivirus software over the last several weeks when the media was focusing a great deal of attention on the Conficker computer virus. "People who read about that stuff will be worried so they will go and search for more information including products that will protect them," he said. Microsoft says that computer users can protect themselves from the threat posed by antivirus software by only downloading applications from companies they know.
(go to web site)

"Growing Threat From Cyber Attacks: US General"
Agence France Presse (04/07/09)

General John Davis, the deputy commander of the joint task force for global operations, told Agence France-Presse in a recent interview that U.S. government and commercial networks are facing a growing threat from cyber attacks. Davis noted that such attacks can be anything from simple hacking attempts by teenagers to extremely sophisticated assaults on networks. He added that although the U.S. military has taken steps to protect its networks from such attacks, it is still somewhat vulnerable because many of its systems use the commercial infrastructure. Davis also discussed a number of other issues related to cyber security, including the worm that made its way onto military networks several months ago. According to the general, the Defense Department spent more than $100 million over the past six months repairing the damage done from that and other cyber attacks. Davis also praised Defense Secretary Robert Gates' plans to provide funding to train an additional 170 cyber experts each year.
(go to web site)

"Defense Cos Seek Czar for Cyber Security Overhaul"
Reuters (UK) (04/06/09) ; Dixon, Kim

The Intelligence and National Security Alliance, a group made up of defense companies such as General Dynamics and Northrop Grumman, will issue a report today that calls on the Obama administration to take several steps to improve cyber security. For starters, the group wants the administration to choose a czar to lead a cyber security overhaul, which would include creating a cyber security plan and ensuring that all government agencies have the same cyber security priorities. According to the report, choosing a cyber security czar and his leadership team now would send the message that the federal government is serious about taking an active role in improving cyber security. The report also called for the federal government to work with the private sector to come to an agreement on industry standards for cyber defense. The report said that these standards should spell out what level of security is needed for different applications, including electrical and financial applications. The report will be given to Melissa Hathaway, who is the primary official in the Obama administration that deals with cyber security issues. The report comes as Hathaway and others in the Obama administration work on a 60-day review of all government cyber security plans, which is expected to be completed by the end of this month.
(go to web site)

"Short-Lived Web Malware: Fading Fad or Future Trend?"
SearchSecurity.com (04/01/09) ; Christodonte II, Marcos

Today's malware attacks are designed to be "secretive, short-lived and fast-moving," according to the security software manufacturer AVG Technologies, which has studied the transition from the bulky malware attacks loaded onto floppy disks and email attachments to the more sophisticated Web-based attacks using Trojans and worms. Malware delivery that relied upon word-processor documents and disks required a lot of time and patience, and it was largely ineffective. Modern-day threats go undetected and can infect and steal data from a user's computer using a "drive-by download" without the user having to do anything. One method for screening new Web sites designed as malware traps for unwitting users is to use a filter that blocks access to any site not yet classified into a certain category, such as entertainment or sports. Though this method helps with new sites, it does not prevent a user from accessing an established site that has been hijacked. Coupling these filters with controlled and monitored employee network access mitigates the risk of a company's data becoming compromised.
(go to web site)

Abstracts Copyright © 2009 Information, Inc. Bethesda, MD


  ASIS also offers a daily and a non-sponsored, special-content Professional Edition of
Security Newsbriefs. Please click to see a sample or to contact us for more information.

Unsubscribe | Change E-mail | Advertising Opportunities | Security Management Online | ASIS Online

No comments:

Post a Comment