Search This Blog

Friday, May 29, 2009

Security Management Weekly - May 29, 2009

header

  Learn more! ->   sm professional  

May 29, 2009
 
 
Corporate Security

  1. "Pilots Allege That Gulfstream Falsified Work-Hour Records"
  2. "Fla. Man With Steroids Claim May Face Charges" Lakeland, Fla.
  3. "Doing Business in the Time of Mexican Drug Chaos" Smugglers Increasingly Moving Drugs With Legal Cargo Bound for U.S.
  4. "U.S. Cracks Down on Corporate Bribes" Justice Department Investigating Companies For Allegedly Violating Foreign Corrupt Practices Act
  5. "Assessing Witness Credibility in Workplace Investigations"
Homeland Security

  1. "Taliban's Foreign Support Vexes U.S."
  2. "Swine Flu Vaccine Possible by October"
  3. "Tests Point to Spread of Weapons Trade"
  4. "FBI Planning a Bigger Role in Terrorism Fight"
  5. "North Korea Fires Short-Range Missiles"
Cyber Security

  1. "Obama to Create Cyber Czar in Awareness Effort"
  2. "Group Calls for Overhaul of Privacy Regulations" NIST's Information Security and Privacy Advisory Board Urges Congress to Update Laws to Reflect Technological Changes
  3. "90 Percent of E-mail Is Spam, Symantec Says"
  4. "Defense Dept., Industry Join to Protect Data"
  5. "Viral Epidemics Poised to Go Mobile"

   

 
 
 
 

 


Pilots Allege That Gulfstream Falsified Work-Hour Records
Wall Street Journal (05/29/09) P. A5; Pasztor, Andy

The Federal Aviation Administration is considering a $1.3 million fine for Gulfstream International Airlines after the airline allegedly violated FAA regulations. Current and former pilots and other employees at the airline say the company routinely falsified flight-time records so that pilots would be scheduled to work more hours than permitted under federal safety rules. Gulfstream flies commuter routes under contract for three large carriers and has received increased scrutiny since the Feb. 12 crash of Continental Connection Flight 3407 that was blamed on pilot error. While it was operated by another regional carrier, Colgan Air Inc., Flight 3407's captain previously worked for Gulfstream and trained at its affiliated training academy. Pilots involved in the two other most recent fatal crashes involving U.S. regional airlines had also either spent time at Gulfstream or its training academy. David Hackett, chief executive of Gulfstream International Group Inc., the airline's parent, says the carrier never changed flight times with the intent of skirting the rules. He notes the FAA investigation, which took place over a nine-month period, found 18 instances of suspect schedules, but the company believes there was only a single instance of pilots flying longer than allowed. Hackett says the airline's dispatch system wouldn't generate the paperwork necessary for a flight to depart if crew members would be exceeding their legal time limit. Gulfstream is now auditing all of its flight logs to ensure they match the schedules in the computer systems, something that wasn't done in previous years. "We can say without equivocation," Hackett says, "there was no systemic" problem. The FAA is also expected to charge the airline with installing unapproved air conditioner compressors, as well as neglecting the maintenance of vent blowers on the airline's fleet of 27 BE-1900-D aircraft. Gulfstream International has 30 days from the receipt of the civil penalty letter to respond to the FAA.


Fla. Man With Steroids Claim May Face Charges
Washington Times (05/29/09) Lemke, Tim

The Lakeland, Fla., man who was arrested Tuesday along with his wife for having $200,000 in anabolic steroids, testosterone, and related paraphernalia in his home could face federal charges, Florida law enforcement officials say. A spokesman for the U.S. attorney's office for the Middle District of Florida has confirmed that federal officials are indeed reviewing the case of Richard "Andy" Thomas, but would not say whether charges would be filed. Polk County, Fla., detectives and agents from U.S. Immigration and Customs Enforcement are planning to meet with federal attorneys on Friday to discuss the case. Thomas and his wife Sandra have already been charged locally with 21 counts of possessing and importing steroids. Meanwhile, officials with Major League Baseball are continuing to look into Thomas' claims that he sold steroids to members of the Washington Nationals. Thomas did not mention the names of any specific players he sold the performance-enhancing drugs to. Thomas also said that he sold steroids to athletes in other professional sports leagues, including the National Hockey League and members of the Washington Capitals. Officials with the NHL and the Capitals say they have no reason to believe that any of their players purchased steroids from Thomas. Law enforcement officials have not found any evidence to support Thomas' claims.


Doing Business in the Time of Mexican Drug Chaos
Wall Street Journal (05/27/09) Millman, Joel

U.S. customs agents' recent discovery of 9,000 pounds of marijuana in a tractor trailer filled with auto parts destined for U.S. factories illustrates the increasingly difficult task of preventing drug smugglers from manipulating security clearances for open trade. As a matter of practice to ensure expedited transit through border checkpoints, customs officials encourage exporters to fortify internal security measures through certification under U.S. government programs that designate compliance. Thousands of shippers, cargo expediters and manufacturers have achieved certification. However, law enforcement officials say an unintended byproduct of that compliance is that these same exporters are targeted by drug smugglers seeking to stash their contraband on legal cargo. Cases of smugglers piggybacking on legal cargo has increased in the wake of the escalating violence between Mexican drug cartels. As a precaution, some trucking firms have installed GPS systems in their trucks to ensure their fleets arrive safely to the U.S. border.


U.S. Cracks Down on Corporate Bribes
Wall Street Journal (05/26/09) Vol. 253, No. 121, P. A1; Searcey, Dionne

The U.S. Justice Department is investigating at least 120 firms for violations of the Foreign Corrupt Practices Act (FCPA), a law passed after Watergate that forbids multi-national U.S. companies from extending bribes. According to Mark Mendelsohn, whose Justice Department division is responsible for managing the prosecution of firms, 100 U.S. companies were investigated for bribery in 2008. Sun Microsystems Inc. and Royal Dutch Shell PLC are among the companies now facing review, according to the firms' disclosure statements. The language of the FCPA is broad enough to include cash, favors, and other gifts, and has many companies concerned about gray-area practices such as buying meals for foreign dignitaries. "When you have a law that can result in criminal sanctions and jail time and that you can violate without actually realizing you're violating it, that's terrifying," explained President Alexandra Wrage of Trace International Inc., a nonprofit in Washington, D.C. that specializes in compliance with antibribery laws. Because of heightened enforcement by the Justice Department, many firms are hiring consultants to identify expensive gifts, dinners, and trips that may violate bribery laws. The department has given a break to some firms that have preemptively confessed their wrongdoings.


Assessing Witness Credibility in Workplace Investigations
Business Management Daily (05/25/09) DiLorenzo, Louis

Rather than bringing a workplace investigation to a halt, HR investigators can take several practical steps when they meet with contradicting witnesses and evidence. Investigators must recognize their own biases, and maintain a calm, objective mindset when conducting interviews and taking notes, which should reflect observations and not conclusions. Having another investigator present for the interviews can provide assistance and another perspective of witnesses' accounts. How the witnesses present themselves can help determine the truth of a story, as does comparing the consistency of a witness's account with those of others. Determining a witness's truthfulness may be easier when there is a definite chronology of events, with physical evidence such as e-mails, notes, and expense reports. Investigators also need to examine witnesses' possible motivations, including bad blood between the witness and the accused or complainant based on incidences in the past.




Taliban's Foreign Support Vexes U.S.
Wall Street Journal (05/29/09) Dreazen, Yochi J.

U.S. officials have found that the Afghan Taliban may receive as much money from donors outside the country as it does from the opium trade, a finding that could be problematic for the administration's strategy to cripple the Taliban by cracking down on Afghanistan's illegal drug industry. In a recent interview, Gen. David Petraeus said the three major sources of funding for the Taliban are drug revenue; donations from foreign charitable foundations and individuals; and payments from local businesses secretly controlled by the group or paying it kickbacks. While the United States does not have specific figures for each of these sources, officials speculate that the Taliban raises a total of "hundreds and hundreds of millions of dollars" each year. As part of the effort to reduce foreign funding for the Taliban, the Central Intelligence Agency has reportedly identified individuals and charities providing the majority of such funding but has declined to release any specific names, citing ongoing investigations. However, officials said the Taliban received significant donations from Pakistan as well as Gulf nations such as Saudi Arabia and Kuwait. Officials also noted that most of these donations are sent to the Taliban through the informal hawala money-transfer system, which is a network of money brokers that operates with minimal oversight from any government officials. According to the World Bank "the majority of the country's cash payments and transfers" are carried out through this system.


Swine Flu Vaccine Possible by October
Associated Press (05/29/09)

The Centers for Disease Control and Prevention has announced that a swine flu vaccine is on track to be available by October, so long as production and testing go as planned this summer. According to the CDC's Anne Schuchat, samples of the swine flu virus have been shipped to vaccine manufacturers over the last several days. Once the manufacturers have produced a vaccine, the government will have to test it for safety and effectiveness and decide whether or not to launch a vaccination campaign. The announcement came as officials in Illinois revealed that a 42-year-old man with underlying health problems died from complications from swine flu. He is the third person in the state to die from the disease.


Tests Point to Spread of Weapons Trade
Wall Street Journal (05/28/09) Solomon, Jay

The progress of North Korea's nuclear program is raising new concerns about Pyongyang's weapons trade. Though North Korean arms have been sold to U.S. allies such as Pakistan and Egypt, trade has also focused on countries Washington has classified as state sponsors of terrorism such as Iran, Syria and Libya. Sales of short- and medium-range missile systems make up the bulk of North Korea's exports, generating $1.5 billion a year for the country. U.S. and United Nations officials are concerned that North Korea's recent arms test could fuel the nation's need to smuggle weapons of mass destruction as the international community considers economic sanctions against the nation for its recent arms test. To compensate for the loss of foreign aid and trade in markets such as South Korea and Japan, officials say Pyongyang could step up its export of nuclear and missile technologies to countries that sponsor terrorism. "The concern is not just that they have a nuclear weapon; it's what they're going to do with the technology and where it's going to go," said a senior U.S. defense official.


FBI Planning a Bigger Role in Terrorism Fight
Los Angeles Times (05/28/09) Meyer, Josh

In a major shift from Bush administration national security policy that relied more on a CIA-dominated system of covert actions, the FBI and the Justice Department will be given a larger role in overseas counter-terrorism operations. As part of the new "global justice initiative", FBI agents will be assigned more responsibilities in global counter-terrorism cases, including interrogation of suspects and evidence-gathering. The change is part of President Obama's recently unveiled national security strategy that seeks to increase transparency in counter-terrorism investigations and prosecutions. The move is the latest effort by the Obama administration to distance itself from Bush-era policies. Since taking office, President Obama has shuttered the CIA's clandestine "black site" prisons and prohibited the use of harsh interrogation tactics. By transferring power from the CIA to the FBI and the Justice Department, some national security officials see it as a vindication of FBI agents, who supported non-coercive interrogation practices and were essentially replaced by CIA in international terrorism investigations after 9/11.


North Korea Fires Short-Range Missiles
CNN International (05/26/09)

South Korea's Yonhap news agency has reported that North Korea fired two short-range missiles on Tuesday, one day after the communist country conducted a nuclear test and launched another short-range missile. According to an unnamed South Korean official, the latest North Korean missile launch is a continuation of the isolated country's tactic of "saber-rattling." Meanwhile, the international community is deciding how to respond to North Korea's nuclear test on Monday, which Russian officials believe was about as powerful as the bombs dropped on Hiroshima and Nagasaki in World War II. The United States' ambassador to the United Nations, Susan Rice, said Washington will seek "strong measures" to punish North Korea for its nuclear test, which she said was "a grave violation of international law and a threat to regional and international peace and security." In addition, France and Japan have signaled that they would be willing to support new sanctions against North Korea. The U.N. Security Council has already voted to condemn the attack, which analysts say was likely an attempt by North Korean leader Kim Jong-Il to demonstrate that he is still in control after his reported stroke.




Obama to Create Cyber Czar in Awareness Effort
Associated Press (05/28/09) Baldor, Lolita

The White House recently announced that President Obama is creating a "cyber czar" position to better coordinate U.S. computer security. According to officials, the cyber czar will act as a "special assistant" to the president, supported by a new cyber directorate within the National Security Council (NSC). As a special assistant, the czar would not have direct access to the president but would report instead to senior NSC officials. This announcement comes on the heels of a report, to be released on May 29, that will supposedly call for private industry to improve network protection and will ask both public and private sector entities to become more accountable for their own cyber security. However, the report does not indicate explicit instructions for achieving these goals. Critics of the cyber czar proposal worry the position will not have enough budgetary and bureaucratic power to make any substantial changes. For this reason, several potential candidates have reportedly removed themselves from contention for the position. That leaves several names still being considered and Obama is not expected to announce his final choice for the job until after the report is released.


Group Calls for Overhaul of Privacy Regulations
CongressDaily (05/27/09) Noyes, Andrew

The National Institute of Standards and Technology's Information Security and Privacy Advisory Board has sent a report to Office of Management and Budget (OMB) director Peter Orszag that calls on Congress to update the 1974 Privacy Act and several provisions of the 2002 E-Government Act. According to the board, which is made up of technology experts from private industry and the academic world, both of these laws should be updated in order to bring privacy law and policy in line with the technological changes that have taken place during the last several years. Among the revisions the board called for were amendments that would improve federal privacy notices, clearly cover sources of commercial data, and update the definition of the term "system of records" so that it includes relational and distributed systems based on government use of records instead of its possession of them. The board also called on the government to take on more of a leadership role on privacy issues and to hire a full-time chief privacy officer at OMB who would provide regular updates on Privacy Act guidance. Major agencies should also hire chief privacy officers, and a chief privacy officers council similar to the Chief Information Officers' Council should be created, the report said. Finally, the report called on OMB to issue privacy guidance for federal agencies' non-law enforcement use of location data and to work with the U.S. Computer Emergency Readiness Team to create interagency information on data loss across government agencies.


90 Percent of E-mail Is Spam, Symantec Says
IDG News Service (05/26/09) McMillan, Robert

A study by Symantec has found that 90.4 percent of messages on corporate networks in April were spam messages, an increase of 5.1 percent from March. Most of the spam, 58 percent, comes from botnets, which are networks of compromised computers that hackers can also use to steal financial information and launch cyberattacks. Symantec's study found that the worst of these botnets is a network known as Donbot, which generates 18.2 percent of all spam. However, spammers are also increasingly using other techniques to send out spam, says Cloudmark's Adam O'Donnell. For instance, spammers sometimes rent out legitimate network services in an Eastern European country and send out a large amount of unsolicited message to a particular ISP's network before filtering software can detect the email blast. O'Donnell noted that spammers are sending out hundreds of thousands of messages per day using this strategy. In addition, spammers are increasingly launching phishing attacks on social networking users in order to steal their passwords and take over their accounts. Once spammers take over an account, they then send spam messages to the friends of the phishing victim. Experts say this technique is very effective because the spam messages cannot be filtered at the corporate firewall and because the messages appear to come from a trusted sender.


Defense Dept., Industry Join to Protect Data
Washington Post (05/25/09) P. A19; Nakashima, Ellen

Since 2007, the Defense Department has been working with a number of private companies to prevent cyberattacks. Under that partnership, private companies such as defense contractors have been providing the Defense Department Cyber Crime Center with information about such things as significant network breaches. The Defense Department would in turn analyze the information provided by the companies and use it to alert other firms about possible cybersecurity threats. The alerts would help companies in a number of ways, such as identifying the IP address of a potential hacker. In addition, the alerts would help firms know who is behind an attack and what techniques an attacker tends to use. Two years later, the Obama administration is considering expanding the program so that the Pentagon's threat data is shared with other companies, such as telecommunications firms and Internet service providers. However, there are several reasons why the program may not be able to improve the nation's cybersecurity. For instance, intelligence and law enforcement agencies have been hesitant to release threat data gathered under the program that they considered to be classified. In addition, some participating companies have shied away from sharing intrusion data because of fears that they would lose control over personal or proprietary information.


Viral Epidemics Poised to Go Mobile
National Science Foundation (05/21/09) Van Pay, Lisa; Cruikshank, Dana W.

A research team led by Northeastern University Center for Complex Network Research director Albert-Laszlo Barabasi set out to investigate why smartphone and mobile device users have been largely unaffected by computer viruses. The researchers examined calling and mobility data from more than six million anonymous mobile phone users to create a comprehensive picture of the threat mobile phone viruses pose. The results of the study indicate that a highly fragmented market share has effectively prevented virus outbreaks so far. However, the researchers predict that viruses will become a serious threat once a single mobile operating system's market share grows large enough, which could happen sometime soon. "We haven't had a problem so far because only phones with operating systems, so-called 'smartphones,' are susceptible to viral infection," says researcher Marta Gonzalez. "Once a single operating system becomes common, we could potentially see outbreaks of epidemic proportion because a mobile phone virus can spread by two mechanisms: a Bluetooth virus can infect all Bluetooth-activated phones in a 10-30 meter radius, while a Multimedia Messaging System virus, like many computer viruses, spreads using the address book of the device." Gonzalez says that hybrid viruses, which can infect via both routes, are the most significant threat.


Abstracts Copyright © 2009 Information, Inc. Bethesda, MD


  ASIS also offers a daily and a non-sponsored, special-content Professional Edition of
Security Newsbriefs. Please click to see a sample or to contact us for more information.

Unsubscribe | Change E-mail | Advertising Opportunities | Security Management Online | ASIS Online

No comments: