| |
Survey on PCI: How It's Impacting Network Security
Network World (01/12/11) Messmer, Ellen
Compliance with the PCI security standard is "burdensome but necessary," according to 51 percent of 500 information technology professionals surveyed by Cisco. About 85 percent expected their organizations to pass a PCI audit, while a third expected making revisions to their virtualized networks, such as using firewall and intrusion protection systems as virtual security appliances, to fulfill future PCI compliance requirements. The survey results indicate that 60 percent of respondents were employing point-to-point encryption to streamline their compliance initiatives and perhaps reduce the scope of their next PCI evaluation. Sixty percent reported that their five-year PCI compliance budget ran from $100,000 to more than $1 million, while about 70 percent agreed that their efforts to facilitate compliance increased the security of their organizations. Fifteen percent said they had already followed security best practices prior to the existence of PCI compliance requirements, 10 percent said compliance does not increase the security of organizations, and 6 percent remained uncertain. Bryant University's Rich Siedzik says PCI is worthwhile, but notes that compliance requires working on security enhancements and reports to convene with auditors and others involved in PCI compliance review. "Our take on PCI is we look at security first, PCI second," he says. "If you focus on security, a lot of the PCI pieces fall into place."
Renault to File Spy Complaint Thursday
Wall Street Journal (01/12/11) Mooradian, A.H.
Renault has announced that it plans to file a complaint in Paris's criminal court on Thursday in relation to the case of suspected industrial espionage at the auto maker. It remains unclear who the complaint will be filed against. Three Renault employees have been suspended for allegedly providing sensitive information about an electric car program operated by the French auto maker and Nissan to unidentified outside interests. There are reports that China was involved in the organized spying effort, though the Chinese government has denied any involvement. One of the three executives who were suspended for allegedly being involved in the spying has denied any involvement as well. The French secret service is still investigating the case. Meanwhile, the French government is considering taking steps to crack down on industrial espionage.
Police Investigating Employee Theft
Panama City News Herald (Fla.) (01/12/11)
The theft of nearly $14,000 in deposits was reported by Amerigas in Panama City, Fla. on Jan. 11. Amerigas says that the theft happened between December 5, 2007 and January 3, 2008. The company claims the theft was found during an audit, but the employee suspected of doing it was terminated in February 2008. About $11,000 of the stolen deposits was in checks that had not been cashed and $2,600 was cash. The Panama City Police Department is investigating and they have a person of interest in the case. However, the investigation is ongoing.
Web Outruns Privacy Law
New York Times (01/10/11) Helft, Miguel; Miller, Claire Cain
Internet and telecommunications companies have seen increased requests for information from law enforcement agencies in recent years. In the first half of 2010, Google received more than 4,200 such requests in the United States alone, and in 2007 Verizon reported some 90,000 such requests each year. The main law of communication privacy was enacted in 1986, before the use of cell phones, email, and social networking; many Internet companies and consumer advocates say it is outdated. "Some people think Congress did a pretty good job in 1986 seeing the future, but that was before the World Wide Web," said Susan Freiwald, a professor at the University of San Francisco School of Law and an expert in electronic surveillance law. "The law can’t be expected to keep up without amendments." Law enforcement agencies, however, argue that changes to communication and technology could hamper investigations and their access to information. Last year, the Justice Department argued in court that cell phone users should not expect location privacy since they provide that information to carriers, and earlier the department argued in a federal court to access some emails without a search warrant. Internet providers say that the privacy law provides weaker protection to online data, arguing that email should have the same protection as any other information, including use of a search warrant approved by a judge or a magistrate to obtain online data. The 1986 Electronic Communications Privacy Act's rules depend on the type of information sought and how old it is, with different courts interpreting the rules with different results. Generally, law enforcement officials do not need a warrant for email messages older than 180 days, a different rule than surveillance of postal mail or phone calls.
U.S. Asks Twitter for WikiLeaks Data
Wall Street Journal (01/10/11) Sonne, Paul
The U.S. Justice Department has served Twitter with a subpoena seeking detailed information on the accounts of Julian Assange and other Wikileaks members and supporters. The department is demanding information dating back to November 1, 2009, and covering user names, session times, messages, IP addresses, and credit card and bank account information. The U.S. government is scrutinizing WikiLeaks in the wake of the website's release of classified U.S. diplomatic cables. A U.S. district court in Alexandria, Va., granted the order on Dec. 14, asking Twitter to disclose information connected to four WikiLeaks-related accounts. The court order also asks Twitter for any information it may have regarding Julian Assange, WikiLeaks' founder, and Pfc. Bradley Manning, who is being held by the U.S. in connection with a leak. The court order was unsealed at the request of Twitter on Jan. 5. Issued by U.S. Judge Theresa C. Buchanan, the order says the Justice Department provided "specific and articulable facts" to show the records were "relevant and material to an ongoing criminal investigation." Although the Department of Justice has been investigating WikiLeaks for weeks, little is known about the dimensions of the probe. Attorney General Eric Holder, who has condemned WikiLeaks for putting U.S. national security at risk, has confirmed the existence of an "active, ongoing criminal investigation," but hasn't given details of its direction. WikiLeaks said on its Twitter feed on Friday that it assumes Google Inc. and Facebook Inc. received secret U.S. government orders related to WikiLeaks as well. The two companies have not commented on the matter.
Suspect Fixated on Giffords
Wall Street Journal (01/10/11) Emshwiller, John; Barrett, Devlin
Prosecutors charged Jared Lee Loughner, a troubled 22-year-old college dropout, with five federal counts on Jan. 9, including the attempted assassination of a member of Congress, in connection with a shooting rampage on Jan. 8 that left six people dead and 14 wounded. Loughner appeared to have been long obsessed with U.S. Rep. Gabrielle Giffords (D-Ariz.). Evidence seized from Loughner’s home, about five miles from the shooting, indicated that he had planned to kill Giffords, according to documents filed in Federal District Court in Phoenix. Special Agent Tony Taylor Jr. of the F.B.I. said in an affidavit that an envelope found in a safe in the home bore these handwritten words: "I planned ahead," "My assassination” and “Giffords." Loughner, who is believed to have acted alone, is in federal custody and is scheduled to make his first court appearance before a magistrate judge in Phoenix on Jan. 10. Loughner had complained to a friend about how he was treated by the Arizona lawmaker during an event several years ago, which aggravated Loughner, according to Alex Montanaro, who described himself as once having been one of "Jared's best friends." On Jan. 8, as U.S. District Court Judge John Roll greeted Giffords in front of a Safeway supermarket, Loughner allegedly fired a Glock 9mm semiautomatic pistol into the back of her head. In the seconds that followed, say authorities, Loughner shot 19 others, six fatally, including the judge and a 9-year-old girl, before his gun jammed and he was wrestled to the ground. Montanaro said his friend "was never really political," but "really tried to be philosophical." Loughner liked "contemplating the meaning of words and the origin of language," according to Montanaro. Montanaro recalled his friend developed "a hate for government and just how everything was systematic...He thought government controlled people too much."
After Shooting, Fresh Look at Protecting Lawmakers
New York Times (01/10/11) Hulse, Carl; Parker, Ashley
In the aftermath of the Jan. 7 Arizona shootings, lawmakers and those responsible for their safety are confronting the issue of how to gauge the risks posed by people they might have shrugged off in the past while maintaining open channels to the public. “In each district you represent your share of unstable people,” says Representative Jack Kingston, Republican of Georgia, as he and other House members struggled with how to respond to the shootings. “Now you are aware that they do show up at your town hall meetings and maybe they are not all harmless.” While representatives of the United States Capitol Police and the office of the House sergeant-at-arms told lawmakers that the attack on Rep. Gabrielle Giffords (D-Ariz.) was not part of a wider threat, they are urging them to review their security arrangements, make contact with local law enforcement officials and name a staff member as liaison with law enforcement. On Jan. 12, the Capitol security agencies are to join the FBI in conducting a joint security briefing for Republicans and Democrats, who acknowledge new worries about their safety.
After the shootings, lawmakers said some security improvements might need to be made, from working more closely with the local police when holding public meetings or perhaps giving the United States Marshals Service some role in Congressional protection.
Loughner's Supremacists Tie Debunked
Politico (01/11/11) Vogel, Kenneth P.
A Fox News report that Jared Loughner, the suspect in Saturday's shootings in Tucson, Ariz., had ties to a white supremacist organization has been proven incorrect. The report was initially made on Sunday, when a Fox News anchor said that a reporter had obtained an internal memo from the Department of Homeland Security that had some significant clues about the investigation into the shootings, which resulted in Rep. Gabrielle Giffords (D-Ariz.) being critically injured. The document noted that there were strong suspicions that Loughner was possibly linked to an "anti-government, anti-immigration, anti ZOG (Zionist Occupational Government), and anti-Semitic" group known as American Renaissance. The document also suggested that Giffords may have been targeted because she is Jewish. But on Monday that Department of Homeland Security said that it did not issue such a memo, and that it did not establish a link between Loughner and American Renaissance. The commander of the Arizona Counter Terrorism Information Center said that the document actually came from his agency, and that it was simply an e-mail from one of the detectives at the center to his supervisor about some of the angles that the investigation into the shootings was looking at. The commander also noted that he does not remember why the detectives connected Loughner to American Renaissance, and that the document made a mistake in labeling the organization as being anti-Semitic. American Renaissance, for its part, says that it is a non-violent group that believes that many of the nation's social problems are the result of racial diversity, forced integration, and the influx of minorities from other countries.
Report: Port Devices Not Duly Tested
Washington Post (01/14/11) P. A18 O'Harrow Jr., Robert
The National Academy of Sciences has issued a report criticizing the way in which a Department of Homeland Security office handled the testing of Advanced Spectroscopic Portal (ASP) machines, which were developed to detect radiation at the nation's ports of entry. According to the report, the Domestic Nuclear Detection Office's tests of the machines were so poorly designed that officials were not able to draw reliable conclusions about whether the technology worked as it was intended to. In addition, the report found that DNDO presented the results of tests in an incorrect and potentially misleading manner. The report concluded that DNDO should follow a standard scientific approach to testing ASPs, which the Obama administration has decided to use only for the secondary screening of vehicles and cargo containers at the nation's ports of entry. Sen. Joseph Lieberman (I-Conn.) said that he found the report's findings to be "troubling," adding that they raise questions about whether DNDO should be responsible for developing, testing, and buying ASPs.
WikiLeaks Hits Out Over 'Terror List' Threat
PC Pro (01/14/11) Mitchell, Stewart
The U.S. House Committee has called for WikiLeaks to be placed on the "Specially Designated National and Blocked Persons List" in retaliation for the Web site's release of sensitive documents. This designation, which is usually reserved for terrorists and hostile countries, would criminalize any U.S. companies doing business with the Web site or its editor Julian Assange. In response to the proposal, Assange commented that, "There is no allegation by the U.S. government that WikiLeaks has hurt anyone as a result of anything it has published. WikiLeaks has 'terrorized' politicians, but that doesn’t mean we are 'terrorists' — it means we doing our job.”
UConn Reports Data Breach of Online Retail Site
Network World (01/12/11) Cox, John
A University of Connecticut retail Web site is warning thousands of customers that their billing data may have been breached. The information was exposed when an attacker managed to penetrate the HuskyDirect.com database, which has billing information for about 18,000 customers who peruse the site for Husky-branded merchandise from the UConn Co-op. The information includes names, addresses, email addresses, credit card numbers, expiration dates, and security codes. The unnamed third-party vendor that operates the retail site notified the co-op of the breach, according to a statement issued by the co-op on Jan. 11. In a separate message, the co-op says the Web site vendor reported that the attacker had hacked an administrative password to gain access to the encrypted credit card information. "The hacker appears to have unencrypted that data," the co-op message says. The credit card information was encrypted, but the attacker appears to have unencrypted the numbers. The co-op responded initially by pulling the Web site and database offline. It then informed the customers, and "is in the process of arranging for credit protection" for them. The breach only impacts those who purchased items online via the HuskyDirect site.
NIST Revises Specs for Automating Security
Government Computer News (01/11/11) Jackson, William
The U.S. National Institute of Standards and Technology has released a revised version of the Security Content Automation Protocol (SCAP), which includes seven specifications that aim to develop a standard method for security software products to use to identify and share information about software configuration and flaws. The biggest change to the new version of the protocol—which also aims to standardize information system security management, encourage the interoperability of security products, and make it possible to use standard expressions of security content—is the inclusion of the Open Checklist Interactive Language. In addition, the Open Vulnerability and Assessment Language has been upgraded to Version 5.8. These and the five other specifications included in SCAP are grouped into three categories—languages, which provide standard vocabularies and conventions for expressing security policy, technical check mechanisms, and the results of assessments; enumerations, which define a standard nomenclature and an official dictionary or list of items that are expressed in that standard nomenclature; and measurement and scoring systems that evaluate the characteristics of a vulnerability and use those characteristics to create a score that reflects the severity of the vulnerability.
Amassing a Small Army Against a Growing Enemy
BU Today (01/11/11) Feinberg, Cara
Boston University (BU) researchers have developed software aimed at identifying unwanted Internet traffic, which would enable network providers to stop botnets from ever reaching personal computers. The software captures and analyzes unusual patterns, such as statistical anomalies in the amount or type of data being transferred, in traffic information at regular intervals as the data flows through the Internet. "If you see a large variety of Internet protocol, or IP, addresses--numbers that identify individual computers--coming from one source in a short period of time, that kind of activity is statistically anomalous," and potentially malicious attacks, says BU professor Mark Crovella. The software uses a technique called principal component analysis, which also is being used by GEANT, Europe's primary multigigabit computer network, for research and academic purposes. All of the data must be manually validated before submitting it, which is a time-consuming process.
Experts Fear Cyberspammers Are Plotting New Attack Modes
USA Today (01/11/11) Acohido, Byron
Email spam has plummeted by more than 50 percent since Christmas Day when the largest criminal spam syndicate in the world mysteriously closed down. Nevertheless, cybersecurity professionals are concerned that top spamming botnets might be transitioning to more stealthy and lucrative online schemes. On Dec. 25, leading global spam source Rustock shut down, along with two smaller operations. The Rustock botnet enlisted as many as 1.7 million PCs to disseminate email ads for sham pharmaceuticals. Symantec reports that it filters 47 billion spam messages a day from the email systems at large organizations, down from a daily average of 131 billion last year. Other email security companies report a similar decline. On Jan. 10, after a 16-day break, Rustock began sending spam again, although at lower volumes. Dozens of such large spamming networks remain resilient and pervasive, says Damballa's Gunter Ollmann. Cyber-syndicates could retool compromised PCs to dupe consumers and companies by corrupting searches, driving click fraud, and changing ad routing, cybersecurity experts warn.
1986 Privacy Law Is Outrun by the Web
New York Times (01/09/11) Helft, Miguel; Miller, Claire Cain
Rising use of the Internet has overtaken the main statute governing communication privacy, according to many Web companies and consumer proponents. Although they acknowledge that access to information is critical for anti-crime and counterterrorism efforts, they must contend with a hodgepodge of standards that the courts have not interpreted consistently. "Some people think Congress did a pretty good job in 1986 seeing the future, but that was before the World Wide Web," says University of San Francisco School of Law professor Susan Freiwald. Meanwhile, law enforcement agencies are worried that their access to important information will be obstructed by advancing communications technology. Internet companies argue that online data is afforded less protection under existing privacy laws, and they argue that email should be just as protected from law enforcement inquiries as information stored in a residence—with access only granted through a judge- or magistrate-approved search warrant rather than a prosecutor's subpoena. Freiwald says that in many instances the government does not inform people that they are searching their online data or prove probable cause, and if the government breaks the law in acquiring information, defendants usually cannot exempt that evidence from a trial. In general, law enforcement officials do not require a warrant to read email messages that are more than 180 days old, and this differentiates online surveillance from phone call or postal mail surveillance. Moreover, since 9/11 it has become increasingly common for law enforcement to demand the sealing of its requests for information from the targets of probes.
Abstracts Copyright © 2011 Information, Inc. Bethesda, MD |
No comments:
Post a Comment