Security Management Weekly - September 16, 2011

Learn more! ->     September 16, 2011     Corporate Security Sponsored By: "PCI Point-to-Point Encryption Guidelines Raise New Questions" Payment Card Industry "Ten Most Overlooked Security Threats for Small Businesses" "Fan Uses Illegal Taser at Cowboys-Jets Game" "Attacks Continue to Push TVA Security Upgrades" Tennessee Valley Authority "After 9/11, Most Employers Still Stress Security" Homeland Security Sponsored By: "At White House, Weighing Limits of Terror Fight" "Al Qaeda Agent Killed" "Kabul Siege Ends as Last Insurgents are Killed" "CIA Investigates Whether Laws Broken Helping NYPD" "Military Jets Safely Escort NYC, Detroit Flights" Cyber Security Sponsored By: "DHS Seeks to Share Top-Secret Info With Banking and Finance Cybersecurity Pros" "Vending Machine Company Announces Major Data Breach" Vacationland Vendors "Android Targeted as Tablet and Smartphone Malware Jumps 270 Percent" "Study Warns US Must Develop Cyber Intelligence" "Researchers Use Firesheep to Snag Google Search History Data"                   PCI Point-to-Point Encryption Guidelines Raise New Questions Network World (09/15/11) Messmer, Ellen The PCI Security Standards Council issued guidelines on use of point-to-point encryption in shielding payment card data. The guidelines urge hardware-based encryption of point-of-sale data to the fringe of the acquiring bank's network, according to the council's Jeremy King. By year's end the council plans to issue more technical requirements to vendors about building this type of encryption, and it expects to start certifying encryption devices in early 2012. King says point-to-point encryption's main advantage should be for the merchant, as it promises to make PCI audits much simpler. To be outlined later are plans for specifying either a fully software-based approach or a hybrid software/hardware approach, as well as guidance associated with mobile payments security. Gartner analyst Avivah Litan notes that merchants and their processors have begun a gradual adoption of network point-to-point encryption based on their own unique methodologies. More than 20 percent of 77 larger retailers Gartner surveyed about encryption said they already had implemented measures. The findings imply that various encryption techniques are already being employed significantly, and the issue for retailers, payment processors, and banks is whether to continue using such methods or change to whatever equipment might eventually be certified by the council. Web Link | Return to Headlines Ten Most Overlooked Security Threats for Small Businesses Globe and Mail (CAN) (09/12/11) Popa, Claudiu Small businesses have the same security vulnerabilities as larger companies, but their smaller size can be both advantageous and problematic. Security issues include malware infections that can lose data and productivity, weaknesses from poorly configured systems, and long-term, undetected security vulnerabilities. Automatic software updates and monitoring attacks and network changes can help small business owners make better decisions about security. Accountability over employee accounts, security awareness training, and proper data encryption can help avoid or control some security risks. While IT security is gathering more attention, business owners also should not ignore physical theft, a booming business that often occurs in unguarded offices. Web Link | Return to Headlines Fan Uses Illegal Taser at Cowboys-Jets Game Associated Press (09/12/11) According to New Jersey state police, a South Carolina man was arrested after allegedly using an illegal Taser in a fight with other fans during the Dallas Cowboys-New York Jets game on Sept. 11. The 59-year-old man, Leroy McKelvey, was charged with three counts of aggravated assault and two weapons counts. He was taken to the Bergen County (N.J.) Jail and bail has been set at $22,500. According to MetLife Stadium CEO Mark Lamping, nobody was seriously injured during the incident. Because the game fell on the 10-year anniversary of the Sept. 11 terror attacks, there was an increased security presence at the stadium. Bomb-sniffing dogs were out and checked every car that entered the stadium, and fans were subjected to pat downs and bag searches. Web Link | Return to Headlines Attacks Continue to Push TVA Security Upgrades Chattanooga Times Free Press (TN) (09/11/11) P. A5 Sohn, Pam TVA has spent more than $100 million to increase security at its three nuclear plants, in the 10 years since the 9/11 terror attacks. Additionally, the Tennessee Valley Authority has spent millions more to secure its 29 hydroelectric dams, 11 coal plants, four gas plants, and its power grid system and transmission lines. "If you think about it, there are several ways we can get attacked. There's physical attacks; there's insider [grid or safety systems] attacks; there's cyber attacks," said David Jolley, vice president of TVA police and physical security. TVA security must also ensure the safety of its offices in Chattanooga, Knoxville and Muscle Shoals, Ala., as well as its power-generating plants in seven states. The utility was unable to provide an exact number of the costs because the expense came out of the budgets of each facility or plant. According to TVA general manager for nuclear security, Mark Findley, the company has increased the number of its nuclear plant security personnel by 60 percent. "The security at nuclear plants has evolved "to a very sophisticated biometrics system that requires workers to not only have a valid badge, but also a valid hand print that is read by the computer," Findlay explained. Jolley said the utility has had some negative interest by adversaries in the past. Web Link | Return to Headlines After 9/11, Most Employers Still Stress Security MarketWatch (09/09/11) Hoak, Amy Nearly 75 percent of respondents recently polled by CoreNet Global said that companies are as careful about security today as they were during those initial days following the Sept. 11, 2001, terrorist attacks. Richard Kadzis, vice president of strategic communications for CoreNet, notes, "It's not just a matter of 'stick this badge on your lapel' or 'wear an employee name tag.' It's knowing how many people are in the building at a given time, and what function they're performing." Kadzis adds that he does expect companies will retrench when it comes to security. The 9/11 attacks also pushed more companies to embrace so-called “distributed work,” in which employees work from various sites such as homes. So, if something dire happens in one location, business can go on elsewhere. Kadzis observes, "Mobility will help empower your business continuity. It feeds right into risk management -- whether it is an act of man or God, you have a plan in place." CoreNet's survey respondents represented large companies in such industries as finance, insurance, technology, and consulting. Twenty-five of the 50 firms that took part in the survey recorded annual revenues between $250 million and $5 billion. Meanwhile, 28 percent had revenues of $5 billion to more than $25 billion. Web Link | Return to Headlines At White House, Weighing Limits of Terror Fight New York Times (09/16/11) Savage, Charlie Some members of the Obama administration disagree with one another over who can be targeted in counterterrorism efforts in Yemen and Somalia. On one side of the debate is Defense Department General Counsel Jeh C. Johnson, who has said that rank-and-file militants can be targeted if they are members of a group that has allied itself with al-Qaida. This is particularly true if these militants are in a country that has been unable or unwilling to suppress them, Johnson has said. Meanwhile, top State Department lawyer Harold H. Koh has said that the U.S. cannot target militants outside of Afghanistan and Pakistan unless they are thought to be plotting to attack the U.S. One senior official has said that the disagreement is a difference in policy emphasis rather than a difference in legal views, though other officials have said that the lawyers do not agree on the underlying legal authority of the U.S. to carry out strikes against terrorists in Yemen and Somalia. At this point, the disagreement is still theoretical, since the Obama administration's current policy is to focus on attacking only "high-value individuals" in the region. Meanwhile, Congress could make its views on the matter known. The House Armed Forces Committee has inserted a provision into a pending defense bill that would broaden the number of militants that the U.S. could target, making it easier to go after low-level militants in Somalia and elsewhere. Web Link | Return to Headlines Al Qaeda Agent Killed Wall Street Journal (09/16/11) Gorman, Siobhan The CIA has announced that Abu Hafs al-Shahri, who served as al-Qaida's operations chief in Pakistan and was a go-between for al-Qaida and affiliated groups in the region, was killed in a drone strike in Pakistan on Sunday. Shahri, who had helped plot attacks against the U.S. and had worked with the Pakistani Taliban to carry out attacks in that country, was being considered for the position of al-Qaida's second-in-command. The drone attack was part of the CIA's efforts to defeat al-Qaida while it is still struggling to get back on its feet following the death of Osama bin Laden in May. More than 20 drone strikes have been carried out since then. In addition, the attack on Shahri is seen as being part of the CIA's strategy of targeting al-Qaida members who could be successors to key members of the group. One U.S. official said that the death of Shahri could create difficulties for al-Qaida chief Ayman al-Zawihiri as he tries to put the group's Pakistan-based leadership team back together. Web Link | Return to Headlines Kabul Siege Ends as Last Insurgents are Killed Wall Street Journal (09/14/11) Abi-Habib, Maria; Totakhil, Habib Khan The coordinated series of attacks that rocked the Afghan capital of Kabul on Tuesday finally ended on Wednesday, 20 hours after they began. When all was said and done, at least seven Afghans--including four police officers and three civilians--were dead, while roughly 20 civilians were injured. The number of injuries is expected to rise, according to Afghanistan's Interior Ministry. The attacks began with an assault on the U.S. Embassy. Insurgents armed with machine guns and grenades took cover in a nearby building site while attacking the embassy and nearby NATO offices. Attacks were then carried out in a number of different locations across Kabul, apparently as part of an effort to give the impression that the entire city was under attack. Those attacks included five suicide bombings, one of which took place near Kabul International Airport and another in front of a high school near the Afghan Parliament building. The Afghan border-police headquarters was also attacked, and a rocket exploded near the Norwegian Embassy, which is located near the U.S. Embassy. Fighting was also observed in the Kabul neighborhood that is near a number of major United Nations facilities. Although the attacks may have been part of an attempt by insurgents to show that Afghan security forces are unable to secure the capital, a U.S. military official said that the country's security forces were able to bring the attack to an end without much in the way of assistance from Western security personnel. Web Link | Return to Headlines CIA Investigates Whether Laws Broken Helping NYPD Associated Press (09/14/11) The CIA's inspector general is launching an investigation into the agency's cooperation with the New York Police Department following the Sept. 11 terrorist attacks. Beginning in 2002, CIA officer Lawrence Sanchez helped create intelligence-gathering programs aimed at monitoring events in Muslim neighborhoods. These programs involved NYPD intelligence officers analyzing hundreds of mosques and student organizations and infiltrating some of them. In addition, undercover officers listened in on conversations in cafés and restaurants and wrote reports on a daily basis about the information they gleaned from their eavesdropping. Much of this work was done by the Demographics Unit, which was made up of plainclothes officers that worked to map and monitor ethnic communities in New York, New Jersey, and Connecticut. The NYPD has said that the Demographics Unit never existed, though documents and interviews indicate that it did. The investigation by the CIA's inspector general will determine whether or not any of these programs broke the law. The CIA is not allowed to engage in domestic spying. The NYPD, the CIA, and John Brennan, the counterterrorism adviser to President Obama, said that no such spying ever took place. Web Link | Return to Headlines Military Jets Safely Escort NYC, Detroit Flights Associated Press (09/12/11) The North American Aerospace Defense Command (NORAD) scrambled several F-16 fighter jets to respond to security scares onboard two passenger jets on the tenth anniversary of the Sept. 11 attacks. One of the security scares took place onboard an American Airlines flight from Los Angeles to New York City's John F. Kennedy International Airport. Two F-16 fighter jets were scrambled to shadow the flight after concerns were raised about three passengers who made repeated trips to the bathroom. Some onboard the plane also thought that the three may have been using hand signals to communicate with one another. The fighter jets escorted the plane until it landed safely at JFK at 4:10 p.m. The passengers were interviewed by the FBI but were released after it was determined that they had no ties to terrorism. A similar security scare took place onboard a Frontier Airlines flight from Denver to Detroit after two people were noticed spending an unusually long amount of time in the plane's bathroom. Two F-16 fighter jets were also scrambled to escort that plane to Detroit, where it was swept by a SWAT team to determine if there was any potential terrorist threat. None was found. Three people were also detained after that flight but were released. Detroit Metropolitan Airport spokesman Scott Wintner said that the airport's response to the possible threat was not unusual and was not prompted by heightened vigilance surrounding the tenth anniversary of 9/11. Web Link | Return to Headlines DHS Seeks to Share Top-Secret Info With Banking and Finance Cybersecurity Pros Network World (09/15/11) Greene, Tim Greg Schaffer, the acting deputy undersecretary for the Department of Homeland Security's National Protection and Programs Directorate, recently testified before a House Financial Services subcommittee on financial institutions about DHS' collaboration with the financial sector on cybersecurity issues. He noted that DHS already works with financial institutions to prevent cyber attacks by assisting with analysis and helping them improve the cyber defenses they have in place. In addition, Schaffer noted that DHS has a formal private-sector security-clearance pilot program in place that finds financial information security professionals who are capable of analyzing and responding to threats to the banking and finance sector's critical information systems. DHS wants to expand this program to include other areas that are part of the nation's critical infrastructure. This expansion will include an online collaboration portal that will allow for the discussion of the threats and possible threats to those systems. DHS is asking Congress to pass laws that would authorize greater sharing between the government and the private sector in order to allow for this increased collaboration, Schaffer said. Web Link | Return to Headlines Vending Machine Company Announces Major Data Breach Computerworld (09/12/11) Vijayan, Jaikumar A data breach impacting about 40,000 visitors to Tennessee and Wisconsin waterpark resorts between Dec. 12, 2008, and May 25, 2011, has been disclosed by Vacationland Vendors, a supplier of vending machines to entertainment venues. According to the vendor, a hacker penetrated certain areas of its point-of-sale systems used to process card transactions at the resorts, and "improperly acquired credit card and debit information." In a statement, Vacationland claimed that no internal security vulnerabilities at either of the waterparks were to blame for the breach. "Vacationland Vendors has learned that other businesses just like its own have been affected by this computer hacker," the statement said. Malicious software has been blamed for previous point-of-sale network breaches, which was used to intercept payment card data as the information is transmitted to the bank for authorization. Those breaches have led to recommendations for the employment of end-to-end encryption solutions to shield cardholder data across the entire payment cycle. Web Link | Return to Headlines Android Targeted as Tablet and Smartphone Malware Jumps 270 Percent V3.co.uk (09/12/11) Muncaster, Phil Mobile malware spiked by more than 270 percent in the first six months of 2011 compared with the same period in 2010 as cybercriminals sought new ways to make money, according to G Data. G Data SecurityLabs found more than 1.2 million new computer malware programs in the first six months of this year, up 15.7 percent on the second half of 2010 and a year-over-year increase of 273 percent. Trojan malware was the largest threat category, and Android in particular was badly hit as the platform becomes more popular and therefore a bigger target for cybercriminals, the report found. One example offered by G Data is the Zsone malware, which was spread via the Android Market and contained a Trojan that sent subscription registrations to premium-rate Chinese cell phone numbers. The vendor predicts that the growth in malware targeting smartphone and tablet platforms will continue over the next six months, and anticipates 2.5 million new malware variations surfacing by the end of the year. Web Link | Return to Headlines Study Warns US Must Develop Cyber Intelligence Associated Press (09/12/11) Baldor, Lolita C. The U.S. needs to cultivate cyber intelligence as a new and better coordinated government discipline capable of anticipating and deterring computer-related threats, according to a new INSA study. "The impact [of cyber attacks] has increased in magnitude, and the potential for catastrophic collapse of a company has grown," the report says. INSA warns that the business community may not comprehend or accept this fact. Among the report's recommendations is the development of strategies beyond the current "patch and pray" processes, the generation of cyber intelligence policies, improved coordination and sharing of intelligence among government agencies and the private sector, increased research on attack attribution and warnings, and the creation of effective cyber intelligence so officials can evaluate and mitigate risks. The INSA report also cites growing threats from other countries, noting that failed states create opportunities for hackers, while other countries tolerate cyber criminals, provided their operations are focused outside of their borders. In addition, the study points to the U.S. outsourcing computer technology design and maintenance to other nations, where potential foes can easily embed themselves within the supply chain. "The present situation is as dangerous as if the United States decided to outsource the design of bridges, electrical grids, and other physical infrastructure to the Soviet Union during the Cold War," the report cautions. Many of INSA's views align with those of Pentagon and DHS officials striving to enhance information sharing between the government and key businesses, but attempts to devise cyber security legislation have ground to a halt in Congress. Web Link | Return to Headlines Researchers Use Firesheep to Snag Google Search History Data V3.co.uk (09/12/11) Nichols, Shaun; Muncaster, Phil Researchers have tweaked the Firesheep Web attack tool to follow user activity via Google search cookies. Alcatel-Lucent Bell Labs' Vincent Toubiana and Vincent Verdot published a report demonstrating a process in which Firesheep could harvest search cookies and use the intercepted information to view a user's click history and contact information. The researchers used an altered version of Firesheep to find cookie traffic on unsecured wireless networks. Firesheep allows an attacker to automatically amass account credentials and other user data moving across unsecured channels. Reconfiguring Firesheep to find the Google search session identifier cookies allowed the researchers to view large chunks of Web history on targeted test machines. "The objective is to recover a large portion of the victim's visited search results with the smallest set of search queries," the researchers said Reducing the number of queries that will show up in the Web search history lowers the risk that the victim notices the attack, they noted. Web Link | Return to Headlines Abstracts Copyright © 2011 Information, Inc. Bethesda, MD   ASIS also offers a daily and a non-sponsored, special-content Professional Edition of Security Newsbriefs. Please click to see a sample or to contact us for more information. Unsubscribe | Change E-mail | Advertising Opportunities | Security Management Online | ASIS Online