Friday, April 02, 2010

Security Management Weekly - April 2, 2010

header

  Learn more! ->   sm professional  

April 2, 2010
 
 
Corporate Security

  1. "Delta CEO to Workers: Call Cops if Union Threatens"
  2. "Burglars Tunnel Into French Bank Vault"
  3. "Violence Against Health Care Workers a Growing Concern"
  4. "In Mexico, Security Is in the Planning"
  5. "Rio Tinto's Hu Sentenced to 10 Years in Jail on Secrets"
Homeland Security

  1. "National Disaster Exercises, Called Too Costly and Scripted, May Be Scaled Back"
  2. "New Rules for Screening Fliers in Place"
  3. "Wiretap by U.S. Illegal, Judge Says"
  4. "Russia Boosts Security as Capital Mourns"
  5. "Vulnerable Transit Systems Step Up Security"
Cyber Security

  1. "Demand Keeps Growing for Cyber-Security Workers"
  2. "DHS Studying Global Response to Conficker Botnet"
  3. "Vietnamese Dissidents Targeted by Botnet Attacks"
  4. "Study Calls for More C-Level Involvement in Cybersecurity"
  5. "Cybersecurity Threats to Government Departments"

   

 
 
 

 


Delta CEO to Workers: Call Cops if Union Threatens
Associated Press (04/01/10) Weber, Harry R.

Delta Airlines CEO Richard Anderson on Thursday warned employees that some representatives of union at the center of a representation dispute have been showing up unannounced at workers' homes to harass them. According to Anderson, representatives from the union, the International Association of Machinists and Aerospace Workers, have frightened the spouses or children of some employees and have sometimes blocked the driveways to their homes to prevent them from leaving. Anderson urged employees who feel threatened by representatives from the union to call police. For its part, the union has denied Anderson's claims that its representatives harassed Delta employees. Union spokesman Joseph Tiberi noted that representatives have been respectful to workers.


Burglars Tunnel Into French Bank Vault
AFP (03/30/2010)

French law enforcement reports that thieves were able to break into the vault of the Credit Lyonnais bank branch in Paris last Saturday by tunneling in from a neighboring cellar and passing through ventilation pipes. The noise made by the tunneling drew the attention of a security guard at the bank, which was closed for renovations. However, the thieves were able to overpower the guard and tie him to a chair. While the guard was tied up, the thieves used drills to cut a hole in the vault so that some of them could squeeze through. The gang was able to make off with the contents of approximately 125 private safety deposit boxes, but not before setting fire to the vault to in order to disguise their identity. The fire set off the bank's automatic sprinklers, delaying the police investigation of the robbery. However, law enforcement says the crime bears a striking resemblance to the robbery of 117 safe deposit boxes at a bank undergoing renovations in the Paris suburbs.


Violence Against Health Care Workers a Growing Concern
Danbury News Times (CT) (03/29/10) Miller, Robert

Data released by the federal government shows that healthcare workers face more violence in the course of their jobs than do employees in other fields. These violent incidents can take a number of forms, such as patients assaulting nurses or shootings at hospitals like the one that took place at Danbury Hospital in Connecticut on March 2. Experts say that there are a number of reasons why healthcare workers are at a greater risk of violence, including the fact that there are a growing number of elderly patients suffering from dementia, said Danbury Hospital President Frank Kelly. In addition, psychiatric patients are also prone to violent outbursts, said David Schildemeier, a spokesman for the Massachusetts Nurses Association. Long hours of waiting in overcrowded emergency rooms and the increasingly violent nature of society have also contributed to an increase in violence at hospitals and other healthcare facilities, experts say. In response to the rising rate of violence against healthcare workers, Massachusetts is considering legislation that would require healthcare facilities to implement violence protection programs. Legislation has already been passed in New York that requires healthcare institutions in the state to perform individual risk assessments to prevent violence and to develop policy statements to address violence. Hospitals are also taking steps to increase security, such as equipping security guards with Tasers and installing metal detectors.


In Mexico, Security Is in the Planning
New York Times (03/29/10) Sharkey, Joe

Security experts urge business travelers to Mexico to take appropriate precautions as drug-related violence and crime continues to escalate, particularly in border towns like Tijuana, Nogales, Ciudad Juarez, Monterrey, and Matamoras. John Kewell, vice president for security consulting for Mexico, Central America, and the Caribbean at Control Risks, says travelers should try to avoid staying overnight anywhere and travel only by day. He also suggests careful coordination with clients and other business contacts in the area to ensure that a well-planned itinerary for the trip is established well in advance. These contacts can help business travelers avoid known problem areas. Although some businesses have resorted to armored cars and armed gunmen to protect employees, Kewell says that type of overkill could be more trouble than its worth. "Keep a low profile," he recommends. Samuel Logan, regional manager for Latin America at iJet Intelligent Risk Systems, agrees with him. Often, Mr. Logan says, the best way to avoid transportation risks is by using a radio-taxi service recommended by a reputable hotel.


Rio Tinto's Hu Sentenced to 10 Years in Jail on Secrets
Business Week (03/29/10)

A Chinese court on Monday handed down sentences in the case of the four Rio Tinto employees who were found guilty last week of taking bribes from steel mills and infringing commercial secrets. The harshest sentence was given to Wang Yong, who was sentenced to 14 years in prison and ordered to pay a fine of 5.2 million yuan. Former Rio Tinto Chief Executive Stern Hu, meanwhile, who was accused of taking nearly 1.8 million yuan in bribes, was sentenced to 10 years in prison and ordered to pay a fine of 1 million yuan. The other two defendants, Liu Caikui and Ge Minqiang, were sentenced to 7 and 8 year prison terms, respectively. In addition, Liu was fined 700,000 yuan, while Ge was fined 800,000 yuan. All four will also lose their jobs at Rio Tinto.




National Disaster Exercises, Called Too Costly and Scripted, May Be Scaled Back
Washington Post (04/02/10) P. A01; Hsu, Spencer S.

The Obama administration is considering scaling back large-scale national preparedness exercises, which have been conducted since 2000 to test how government officials would respond to nuclear, biological, or chemical attacks. The 2011 National Level Exercise, which would have tested officials' responses to a natural disaster for the first time, could be shortened by the Federal Emergency Management Agency and used to simulate a disaster that is less severe than originally planned. Meanwhile, the Obama administration has decided to cancel an exercise that would have simulated a 10-kiliton nuclear bomb going off in Las Vegas next month. That decision was made after Sen. Harry Reid (D-Nev.) complained that casino and business interests in Las Vegas were afraid that the event would scare away tourists. FEMA will instead conduct an exercise that will focus on what can be done to respond to a nuclear bomb going off in Las Vegas without the help of state and local law enforcement. That exercise will consist primarily of table-top drills and contingency operations based in Washington, D.C. Emergency planners and state officials have expressed concern about efforts to scale back the exercises, which they say are the best way to determine whether the nation is ready to respond to a major disaster. However, officials in the Obama administration say that they want to improve the tests by moving away from large pre-planned exercises to drills conducted without notice, which they say will better test the response of government officials to disasters.


New Rules for Screening Fliers in Place
USA Today (04/02/10) Frank, Thomas

The Obama Administration is planning to begin phasing in new airport security rules this month. Under the new rules, airport security screeners will no longer focus solely on passengers flying to the U.S. from one of 14 terrorism-prone countries, and will instead screen all travelers bound for the U.S. As part of the new screening system, airport security officials will use pieces of intelligence about terrorists whose full names are unknown, including the part of the name that is known, their facial features, and recent travel history. Any passengers who match those descriptions will be forced to undergo additional screening at airports overseas. According to administration officials, the new rules are an improvement over the old security policy, which was implemented in the wake of the failed bombing attempt onboard Northwest Airlines Flight 253 last Christmas, because it is geared towards intelligence information and possible threats, not stopping people of a certain nationality. In addition, the new rules should result in fewer passengers undergoing additional airport security.


Wiretap by U.S. Illegal, Judge Says
Wall Street Journal (04/01/10) Perez, Evan

U.S. District Judge Vaughn Walker of the northern California district ruled Wednesday that government wiretapping of communications between an Islamic charity and its lawyers was illegal. The wiretapping was uncovered in 2006, when the federal government accidentally gave the charity, the now defunct Oregon branch of the Saudi al-Haramain Islamic Foundation, and two of its lawyers records of calls that had been intercepted. The government ordered that those records, which were handed over after al-Haramain filed a lawsuit against the federal government, be returned. In addition, both the Bush and Obama administrations tried to block the lawsuit on the grounds that it could expose intelligence methods. But Judge Walker disagreed, saying that the 1978 Foreign Intelligence Surveillance Act superceded the government's state secrets claim. The Justice Department has said that it is reviewing Judge Walker's ruling, which challenges the legality of the Bush administration's Terrorist Surveillance Program and could allow plaintiffs to seek damages from the government for violating FISA. The Justice Department's review of the ruling could eventually result in an appeal.


Russia Boosts Security as Capital Mourns
Wall Street Journal (03/31/10) White, Gregory L.

Security is being stepped up throughout Russia in the wake of Monday's bombings on the Moscow subway system, which killed 39 people and injured more than 70. The number of police patrols on the subway system was increased on Tuesday, though traffic on trains appeared to be lighter than normal. Meanwhile, Russian President Dmitry Medvedev said that his government would continue to work to "destroy" terrorists in order to prevent future attacks. The Russian government has also announced plans to create a warning system that would alert citizens to potential terrorist threats. That proposal was criticized by Gennady Gudkov, the deputy chairman of the Security Committee in the State Duma, who said that Russians would eventually ignore the warnings because the system would indicate a high threat level every day given the situation in the North Caucasus, the region that is home to the militants believed to have been responsible for the subway bombings. Proposals have also been made to check the identification of passengers traveling on intercity buses like the ones the suicide bombers are believed to have used to travel from the North Caucasus to Moscow. Gudkov also criticized that proposal, saying Russia needs to improve security by boosting enforcement of existing laws rather than enacting new legislation.


Vulnerable Transit Systems Step Up Security
Wall Street Journal (03/30/10) P. A13; Levitz, Jennifer

Security has been stepped up on U.S. mass transit systems in the wake of the March 29 bombing in Moscow's subway. In New York, Los Angeles, and Atlanta, for example, police increased patrols on their cities' subway systems during Monday's morning rush hour. In Washington, D.C., meanwhile, bomb detection teams conducted random security sweeps at Metro stations and rail yards. Despite the increased security, there does not appear to be an increased threat to subway and rail systems around the world, intelligence officials say. Nevertheless, officials are closely watching Arab and Islamist Web sites for signs that another group may be planning an attack similar to the one that took place in Moscow. Should an increased threat be detected, however, mass transit systems will not be able to respond by implementing the same security measures found in airports, terrorism experts and transportation agency officials say. According to Cathy Asato, a spokeswoman for the Washington Metropolitan Area Transit Authority, implementing airport-style security screening at subway stations would be impossible because it would change the whole nature of mass transit service.




Demand Keeps Growing for Cyber-Security Workers
SF Gate (04/02/10) Martinez-Cabrera, Alejandro

The federal government is looking to recruit cyber-security professionals as the field becomes a major priority for national security. At a recent RSA Conference, both FBI Director Robert Mueller and Homeland Security Secretary Janet Napolitano expressed an interest in hiring more cyber-security experts at their agencies. This increased interest follows a series of recent high-level security breaches, successful takedowns of government Web sites, and discouraging military simulations of coordinated cyber attacks that illustrate the nation's vulnerabilities. In order to reduce these vulnerabilities, Market Research Media estimates the federal government will spend $55 billion in cyber-security investments over the next five years, much of which is expected to go to recruitment. The Department of Homeland Security (DHS) has already acquired the authority needed to hire up to 1,000 new cyber-security specialists over the next three years. The agency has extended official job offers to approximately 200 candidates thus far, according to a DHS representative. However, the task of finding these cyber-warriors to serve their country may not be the easiest task. A recent survey of 175 government security managers found that almost 80 percent said it was very or somewhat difficult to find good candidates. This difficulty is largely due to an overall shortage of truly skilled cyber-security professionals, and the fact that the government does not have the funding to offer salaries comparable to those they could earn in the private sector. Still, experts say that working for the government appeals to many professionals' sense of patriotism. They also argue that the government may be able to offer nontraditional cyber-security researchers a position who may have had trouble gaining work in the private sector. Furthermore, federal work offers cyber-security professionals the opportunity to work in the trenches of their field while also offering them an unmatchable sense of job stability during the ongoing economic turmoil. Should the government be successful in its efforts, there are concerns that it could create holes in the private sector's talent pool. In order to prevent this problem, DHS and the National Security Agency have already begun sponsoring academic grants and programs to help develop young cyber-security experts. They have also launched the United States Cyber Challenge, a set of competitions designed to find thousands of skilled young people to further train and recruit.


DHS Studying Global Response to Conficker Botnet
Computerworld (04/01/10) McMillan, Robert

The Department of Homeland Security (DHS) is currently preparing a report on the worldwide response to the Conficker botnet. The report shows how an ad hoc group of security researchers and Internet infrastructure providers came together to form the Conficker Working group in order to address the botnet that was once the Internet's most serious cyber threat. The report is expected to describe those things about the response that worked well and those that could have been done differently, thus providing a template for future cyber-security responses. Conficker began infecting computers in November 2008, and is thought to still control between 4 million and 7 million computers. However, the botnet was only put to use briefly in April 2009, indicating that its creators may have been unprepared for the vehemence of the response it triggered. The Working Group was at the head of this response, setting the standard for the kind of organizational structure needed to ensure international cooperation. The group divided itself up into DNS, sinkhole, and malware analysis subgroups. At one point there was public discussion of group tactics, but that has since discontinued as it became apparent the criminals behind Conficker were reading their playbook. Although the Working Group is not as active as it was a year ago, it still meets weekly for conference calls. As Rodney Joffe, senior technologist for Neustar and a member of the working group, says, "There is still an ongoing effort to identify the people behind [Conficker] and to try to find a mechanism to try to help remediate it."


Vietnamese Dissidents Targeted by Botnet Attacks
CNet (03/31/10) Krazit, Tom

Google and McAfee are reporting that cyberattacks were recently used against opponents of a bauxite mining project in Vietnam that has Chinese ties. In the attack, the attackers disguised malware as a Vietnamese-language Windows keyboard driver and used it to create a botnet. The botnet then launched distributed denial of service (DDoS) attacks to shut down blogs run by opponents of the mining project. The attack was discovered during the investigation into Operation Aurora, the cyberattack that was launched against Google and a number of other companies last year. However, the two incidents do not appear to be related, since the Vietnamese DDoS attacks used code that was much less sophisticated than what was used by Operation Aurora.


Study Calls for More C-Level Involvement in Cybersecurity
IDG News Service (03/31/10) Gross, Grant

A report released by the American National Security Institute (ANSI) and the Internet Security Alliance (ISA) on Wednesday says that organizations stand to lose large sums of money as the result of cybersecurity breaches when their top executives are not involved in making cybersecurity decisions. The report, which is entitled "The Financial Management of Cyber Risk," noted that organizations lose an average of $2 million in typical security breaches involving 10,000 personal records. In addition, the report noted that U.S. businesses lost $1 trillion worth of intellectual property as the result of cyber attacks between 2008 and 2009. According to ISA President Larry Clinton, the findings show why companies need to make changes to their cybersecurity practices. For instance, top executives should implement cybersecurity risk management programs, including appointing a cyber risk team, the report said. The report also called on executives to develop a cyber risk management plan for all departments and to develop a total cyber risk budget.


Cybersecurity Threats to Government Departments
Processor.com (03/26/10) Vol. 32, No. 7, P. 35; Harler, Curt

A recent survey of 300 federal information technology (IT) professionals by CDW Government found that more than half experience a cybersecurity breach each week. Experts say that there are a number of steps that these IT pros can take to mitigate their risk of becoming victims again. Perhaps the most important thing IT professionals can do to protect their agencies from cyberattacks is to educate their users about security policies. Such training sessions should teach users the basics of cybersecurity, including the importance of not clicking on links in emails, and should educate users about how cybersecurity policies protect their jobs. Experts say that educating users about cybersecurity is important because uneducated users tend to bypass security measures when trying to meet deadlines or when they are overloaded with work. In addition, it is important for federal agencies to use cybersecurity technologies such as filtering, intrusion detection, and white lists to protect themselves from cyberattacks. Federal agencies and contractors also should join the Trusted Internet Connections program, which helps improve security by reducing the number of Internet connections federal agencies have. Finally, IT departments need to be aware of what cybersecurity regulations they need to comply with.


Abstracts Copyright © 2010 Information, Inc. Bethesda, MD


  ASIS also offers a daily and a non-sponsored, special-content Professional Edition of
Security Newsbriefs. Please click to see a sample or to contact us for more information.

Unsubscribe | Change E-mail | Advertising Opportunities | Security Management Online | ASIS Online

1 comment: