Search This Blog

Friday, June 12, 2009

Security Management Weekly - June 12, 2009

header

  Learn more! ->   sm professional  

June 12, 2009
 
 
Corporate Security

  1. "Lengthy Recession an Impetus for Piracy, Expropriation, Lloyd's Says"
  2. "French Court Curbs Disputed Internet Piracy Rules"
  3. "FAA Orders Scrutiny of Pilot Training Programs"
  4. "U.S. Protests N. Korea's Treatment of Journalists"
  5. "Going 'Paperless' to Thwart Scalpers" Ticketmaster Using New Technology to Prevent Scalpers From Profiting on Miley Cyrus Tour
Homeland Security

  1. "Flu Pandemic Is Declared -- First Time in 41 Years" Declaration Could Speed up Development of Swine Flu Vaccine
  2. "UN Set to Adopt Tougher NKorea Sanctions"
  3. "Md. Man Held in Museum Attack" Authorities Believe Holocaust Museum Shooter Had Ties to Neo-Nazi, White Supremacist Groups
  4. "Attacks Validate DHS Report, Some Say"
  5. "'Blood' Wires on the Mexican Border" Arizona AG Asks Money Transfer Companies to Release Records of Payments Tied to Human Smuggling
Cyber Security

  1. "China Faces Criticism Over New Software Censor"
  2. "Adobe Plugs 13 Security Holes in Critical Update"
  3. "Researcher: Popular Internal IP Addressing Scheme Could Leave Enterprises Vulnerable"
  4. "Security Pros Find Cyberspace Review Lacking" Report Finds Public and Private Sector IT Systems Need Infrastructure Improvements to Protect Against Cyberattacks
  5. "Black Hat Founder Tapped to Advise Homeland Security"

   

 
 
 

 


Lengthy Recession an Impetus for Piracy, Expropriation, Lloyd's Says
National Underwriter (Property & Casualty - Risk & Benefits Management Edition) (06/10/09) McDonald, Caroline

Lloyd's has released a report that warns that the global economic downturn could exacerbate a number of different threats to businesses. According to the report, entitled "Global Recession: The Magnifying Glass for Political Instability," one of threats to businesses that could worsen as the result of the recession is the threat of piracy. The report noted that the recession could result in the growth of piracy in other areas besides the Horn of Africa, including Latin America and Asia. Kidnapping could also increase in these areas, the report said. In addition, the report warned that businesses could face an increased risk of confiscation of their property by the governments of some countries, particularly those in Latin America, Russia, and Africa. The report urged businesses to continue to assess the risk of government expropriation on a country-by-country basis. Lloyd's Chief Executive Officer Richard Ward noted that the growth in the threats to businesses means its more important than ever that companies undertake thorough risk assessments across all of their global operations and businesses. Ward added that companies also need to be sure to plan for the possibility of future political instability in the countries they do business in.


French Court Curbs Disputed Internet Piracy Rules
Reuters (06/10/09) Picy, Emile

France's top constitutional court on Wednesday struck down several provisions in a law that aimed to stop Internet users from illegally downloading music and films. Under the court's ruling, the government will no longer have the authority to track the illegal downloading of copyrighted material over the Internet, and will not be able to cut off Internet access for those found to be habitually engaging in illegal downloading. The court ruled that giving the government these powers "could restrain… people's right to express themselves and to communicate freely." In the aftermath of the ruling, the government will only be able to issue warnings to Internet users found to be illegally downloading copyrighted material. In addition, the decision to cut the Internet access of habitual offenders will now be made by a judge, not the government. The decision was praised by Jean-Marc Ayrault, the president of France's Socialist party in the lower house of parliament. Ayrault said the ruling means that Internet access is a right in France.


FAA Orders Scrutiny of Pilot Training Programs
Wall Street Journal (06/10/09) P. A2; Carey, Susan; Pasztor, Andy

The Federal Aviation Administration announced on June 9 that it was ordering immediate inspections of pilot training programs at smaller, regional airlines as part of an effort to improve safety on those carriers. The training given to pilots at regional airlines has been criticized in the wake of the crash of a Colgan Air turboprop in February near Buffalo, which killed 50 people. During a National Transportation Safety Board hearing on the incident last month, it was revealed that the pilots were fatigued, inattentive, and did not have enough emergency training on the plane they were flying. In addition, the flight's captain was found to have failed several flight-proficiency tests. The FAA is also planning to hold a safety meeting of major airlines, regional carriers, labor and aviation-industry groups in conjunction with the Department of Transportation on Monday. That meeting will likely focus on training problems at regional airlines. Despite its efforts, the FAA could find it difficult to overhaul pilot training at regional airlines. Pilot training is a complex, expensive process that lasts several years, which means it is difficult to change quickly. In addition, any effort to change pilot training will likely affect the business models of regional airlines, which compete with one another to fly routes for large carriers for the lowest cost possible.


U.S. Protests N. Korea's Treatment of Journalists
New York Times (06/09/09) Sanger, David E.; Sang-Hun, Choe

The U.S. government is currently working to secure the release of two American journalists on "humanitarian grounds." The two journalists, Laura Ling and Euna Lee of California, were sentenced to serve 12 years of hard labor in North Korea after reportedly crossing the country's border with China by mistake. The Obama administration is eager to secure the release of the reporters as they could be exploited by the North Korean government to obtain concessions from the United States regarding the North's recent nuclear and missile tests. The United Nations Security Council is currently considering a new set of sanctions for North Korea that would cut off funding for the country and allow other nations to search its ships for missiles, weapons, or nuclear technology. In order to keep negotiations regarding the release of the women separate from these security talks, the Obama administration may choose to send a high-profile envoy to the country. Possible candidates include former Vice President Al Gore, who employs the two journalists at his Current TV station, and New Mexico Gov. Bill Richardson, who has often visited North Korea and previously arranged for the release of American prisoners. However, neither the administration nor the possible candidates have had much comment on the envoy.


Going 'Paperless' to Thwart Scalpers
Wall Street Journal (06/08/09) Smith, Ethan

Ticketmaster Entertainment Inc. plans to implement its new technique of "paperless tickets" at Miley Cyrus' 45-date concert tour this fall, as a new anti-scalping strategy. The concert seats cannot be transferred or sold, but can be redeemed only at the concert, where the credit card used to purchase them will be swiped, and a hand-held scanner will print out the "seat locator." The move has been criticized by professional scalpers, who say that this new technology will cause bottlenecks at concert sites and personal-safety risks. In addition, StubHub spokesman Sean Pate predicts that a paperless ticket system will force parents to accompany children who do not have their own credit cards. Pate also expressed concern that Craigslist ads claiming to help young fans get into the concert could create new safety threats. Ticketmaster has said that a staff of up to 10 people will be at every venue to address any problems. Last year, Ticketmaster used paperless tickets for some seats at different shows, and although the events went relatively smoothly, the shows' attendees did report delays getting in. Competitors have also expressed concerns that this strategy will give Ticketmaster and its clients monopoly power over prices--power they say could be increased if the company's proposed merger with Live Nation Inc. proceeds.




Flu Pandemic Is Declared -- First Time in 41 Years
Wall Street Journal (06/12/09) Esterl, Mike

The World Health Organization (WHO) declared a global influenza pandemic on June 11, the first in more than 40 years, after weeks of delay for fear of causing unnecessary public alarm. WHO Director General Margaret Chan says that while the "overwhelming majority" of people diagnosed with the virus since it surfaced experienced mild symptoms and recovered quickly without medical treatment, the H1N1 virus, also known as swine flu, is likely to continue to spread and that it could turn more virulent or affect populations differently. "This early, patchy picture can change very quickly," she says. Phase 6, the maximum on the WHO's pandemic alert scale, means the flu strain is spreading globally. It is not a measure of severity. Dr. Chan says that on the evidence so far the pandemic would be of moderate severity, but public-health authorities worry that the new flu strain could prove more dangerous in undeveloped countries with fewer health-care resources and higher rates of chronic diseases that weaken immune systems. The declaration requires countries not yet exposed to the new influenza strain to unveil pandemic-prevention plans and step up monitoring efforts. It also is expected to hasten efforts to develop a vaccine, expected to take several months.


UN Set to Adopt Tougher NKorea Sanctions
Agence France Presse (06/12/09)

The U.N. Security Council is expected to approve new sanctions against North Korea when it meets Friday morning. The sanctions, which are being adopted to punish Pyongyang for its recent nuclear and missile tests, call for more stringent inspections of cargo suspected of containing prohibited items related to North Korea's efforts to produce nuclear weapons and ballistic missiles. A tighter arms embargo and new financial restrictions will also be put in place against North Korea. In addition, the sanctions call for U.N. member states to prevent the transfer of money or other types of assets that could potentially contribute to the North's nuclear or ballistic missile programs. A previously-enacted assets freeze and travel ban will also be expanded to include additional North Korean entities, goods, and individuals. Finally, the draft resolution outlining the sanctions calls on North Korea to rejoin the Nuclear Non-Proliferation Treaty and return to the six-party talks on its nuclear program without precondition. The sanctions may do little to stop North Korea's aggressive behavior, U.S. intelligence officials say. Those officials have told President Obama that Pyongyang will likely respond to any U.N. sanctions by conducting another nuclear test.


Md. Man Held in Museum Attack
Baltimore Sun (06/11/09) Meyer, Josh; Oliphant, James; Zajaz, Andrew

An 88-year-old Annapolis, Md., man walked into the U.S. Holocaust Memorial Museum in downtown Washington, D.C., Wednesday afternoon and opened fire, killing a security guard. The shooter, who FBI officials identified as James W. Von Brunn, was shot in the face when security guards returned fire. He was taken to a Washington hospital, where he was in critical condition. Although the museum was crowded with tourists at the time of the shooting, no one else was injured in the attack. In the aftermath of the shooting, police found a notebook in Von Brunn's possession that contained a list of a number of locations in Washington, including the Washington National Cathedral. Bomb squads were sent to at least 10 of those sites as a precaution. Authorities say they believe that there are no threats to area landmarks, though they plan to monitor the situation closely. Law enforcement officials are now looking into what prompted Von Brunn to open fire in the museum. Officials believe that he has a long history of ties to several neo-Nazi organizations and white supremacist groups. However, the FBI says that it believes Von Brunn acted alone. The Holocaust Museum will remain closed until Friday.


Attacks Validate DHS Report, Some Say
Politico (06/10/09) Gerstein, Josh

Civil rights activists say a string of recent attacks blamed on right-wing extremists, including the June 10 shooting at the Holocaust Museum, show that the Department of Homeland Security's April report warning about the potential for such violence was prescient. The report was criticized by Republicans for painting conservatives as a threat, particularly military veterans and those opposed to abortion or immigration, and DHS later withdrew the report. "I think this latest round of killing once again shows how ridiculous the criticism from the right of the Department of Homeland Security report was. That whole brouhaha was absurd," says Mark Potok of the Southern Poverty Law Center. "We felt the DHS report was pretty right on," says Deborah Lauter of the Anti-Defamation League. "Clearly the election of Obama, the current financial crisis, and the discussion of immigration reform - those things have certainly fueled the right wing extremist movement in this country ... there are clear indications that the rhetoric is manifesting. We hope it's not the tip of the iceberg." The man alleged to have killed a security guard at the Holocaust Museum Wednesday, James von Brunn, was a hardcore white supremacist and Holocaust denier who often railed against Jews and African-Americans.


'Blood' Wires on the Mexican Border
Los Angeles Times (06/08/09) Meyer, Josh

Arizona Attorney General Terry Goddard has asked Western Union and other companies that perform cash transfers to release records of transfers he believes to be connected to human smuggling between Mexico and the United States. While Western Union has complied with some such requests others it has refused because it argues that supplying certain data to Goddard would be a violation of its customer's privacy. Several judges have agreed with Western Union. Most recently the Arizona Supreme Court ruled that Goddard had overstepped his bounds by attempting to seize records of any wire transfers over $500 from 29 states to Sonaro, Mexico. According to Goddard tracking such money transfers is the best way to track and shut down smugglers who are often paid in wire transfers by migrant's relatives. Until the wire comes through the migrants are held captive at stash houses. If the smuggler's demands, which often increase exponentially while the migrants are held, are not met the migrants may be beaten, raped, or even killed.




China Faces Criticism Over New Software Censor
New York Times (06/10/09) Jacobs, Andrew; Yang, Xiyun

A government directive that all PCs sold in China come with software that can censor pornography and other "vulgar" content from the Internet has sparked howls of outrage among industry executives, proponents of free speech, and computer users. Manufacturers are facing a July 1 deadline to preinstall the software on machines, and U.S. PC makers say meeting this deadline is impossible. They note that it raises a complicated issue as to whether manufacturers would be held accountable if the software clashes with operating systems or causes computers to crash. Computer experts are worried that the software could enable the Chinese government to watchdog Internet use and collect personal information. The designers of the filtering software, which is called Green Dam, insist that it cannot function as spyware. Green Dam uses image recognition technology and text filtering to block content, and its designers say the software can be disabled or deleted. Critics claim the software underperforms, censoring perfectly innocent content while allowing objectionable material to slip through. Also inspiring criticism is the Chinese government's decision not to consult computer users on the regulations or allow other companies to submit comparable software.


Adobe Plugs 13 Security Holes in Critical Update
eWeek (06/09/09) Prince, Brian

The first of Adobe Systems' promised quarterly security updates for the Windows and Mac versions of its Adobe Acrobat and Reader applications included patches for 13 "critical" vulnerabilities. Among the vulnerabilities that were corrected in the update were several heap flow vulnerabilities and a memory corruption flaw in JBIG2 filter. Adobe said the memory corruption bug could have led to code execution if it went unpatched. The security update also corrected a stack overflow vulnerability and several heap overflow vulnerabilities that also could result in code execution. The release of the quarterly security updates is just one step Adobe is taking to respond to the recent controversy over its handling of a zero-day bug in Reader and Acrobat. In addition to the security updates, Adobe also is working to improve incident response and has begun reviewing legacy code as well as new code as part of its secure code development process. Qualys CTO Wolfgang Kandek said he believes the release of the security updates will help the IT admin community by raising the visibility of Adobe patches on the IT admin and IT management side and by increasing the amount of attention paid to vulnerabilities in Acrobat and Reader.


Researcher: Popular Internal IP Addressing Scheme Could Leave Enterprises Vulnerable
Dark Reading (06/09/09) Wilson, Tim

Security researcher Robert Hansen warned business leaders to be mindful of vulnerabilities in internal Internet protocol (IP) addresses, even those not used to connect to the Internet. In his blog and in recent presentations in Sweden and Las Vegas, Hansen referenced the Internet Engineering Task Force's RFC 1918 standard, which details proper use of private IP addresses that are frequently used for internal systems and devices. The problem comes when organizations assume RFC 1918 addresses are safe and fail to account for hackers who can create similar environments that also utilize RFC 1918, and then take advantage of IP address encounters across the networks to gain access to the organization's networks, he said. "Most of these attacks could be thwarted by simply not using actual IP addresses, but rather fully qualified but internal domain names because this would require an attacker to have prior knowledge about the IP to DNS mapping," Hansen added.


Security Pros Find Cyberspace Review Lacking
Government Computer News (06/08/09) Leffall, Jabulani

President Obama's Cyberspace Policy Review, unveiled in May, lacks the teeth to effectively ensure "security and resilience" in the public and private sectors, concludes a new report from leading industry security professionals. Unless these systems receive critical infrastructure improvements, "it is doubtful that the United States can protect itself from the growing threat of cybercrime and state-sponsored intrusions and operations," the 76-page report cautions. One software security expert says the policy review should address the sources of threats, as well as the response time for such attacks. A basic security standard such as the Federal Desktop Core Configuration would even provide a substantial level of protection for the government's networks, says Shavlik Technologies executive Chris Schwartzbauer.


Black Hat Founder Tapped to Advise Homeland Security
InformationWeek (06/08/09) Claburn, Thomas

Sixteen people were appointed to the Department of Homeland Security Advisory Council (HSAC) last Friday, including Jeff Moss, the founder of the Black Hat and DefCon security conferences. In an interview on Monday, Moss said he believes he was appointed to the HSAC--which advises the Department of Homeland Security on how to keep the U.S. safe from a variety of threats, including cybersecurity threats--because the government was looking for the viewpoint of a younger person who had grown up with computers. Moss added that while he is not certain what he will be doing as a member of the HSAC, he said that he does believe that his new role will help to encourage increased communication between authorities and hackers. Moss also said he believes the Obama administration will launch a number of new cybersecurity initiatives over the next several months because it takes cybersecurity very seriously. The U.S. government has already started setting up a system to collect online feedback from the cybersecurity community. In addition, President Obama is expected to name a cybersecurity coordinator in the near future.


Abstracts Copyright © 2009 Information, Inc. Bethesda, MD


  ASIS also offers a daily and a non-sponsored, special-content Professional Edition of
Security Newsbriefs. Please click to see a sample or to contact us for more information.

Unsubscribe | Change E-mail | Advertising Opportunities | Security Management Online | ASIS Online

No comments: