Search This Blog

Friday, January 11, 2013

Security Management Weekly - January 11, 2013

header

  Learn more! ->   sm professional  

January 11, 2013
 
 
Corporate Security
  1. "Chinese Police Probe Foxconn for Alleged Bribery"
  2. "Former Internet Pharmacist Sentenced in Fake Drug Case"
  3. "Police Fire Rubber Bullets at South African Farm Strikers"
  4. "EU Organized Crime Makes 1.5 Billion Euros a Year on Credit Card Fraud"
  5. "'20 Under 40' Winner: Protecting Critical Infrastructure" Birmingham (Ala.) Water Works Board Security Superintendent Scott Starkey

Homeland Security
  1. "California School Shooter Targeted Bullies, Sheriff Says"
  2. "Lawyer Claims Tunisian Suspect in Libya Attack Freed Due to Lack of Evidence"
  3. "CIA Choice is Trusted Adviser on Terror" John Brennan
  4. "Alabama Teen Accused of Plotting to Bomb Classmates in 'Potential Terrorist Attacks'"
  5. "U.S. Legal Officials Split Over How to Prosecute Terrorism Detainees"

Cyber Security
  1. "Banks Seek NSA Help Amid Attacks on Their Computer Systems"
  2. "How Do You Know if Your Data is in Good Hands? Here's How"
  3. "Cyber Attacks Bring Call for Help"
  4. "Nations Prepare for Cyber War"
  5. "BYOD Keeps Expanding, and IT Just Has to Deal With It" Bring Your Own Device

   

 
 
 

 


Chinese Police Probe Foxconn for Alleged Bribery
Wall Street Journal (01/09/13) Poon, Aries

The Taiwanese electronics manufacturer Hon Hai Precision Industry, more commonly known to Westerners as Foxconn, has released a statement saying it is cooperating with a Chinese police investigation into allegations of bribery. The statement comes after reports in the Chinese media on Wednesday that, among other things, a Hon Hai executive in the city of Shenzhen had been detained by police on suspicion of bribing the company's supply-chain partners. Hon Hai says in its statement that the police investigation was initiated by the company as part of an internal audit investigating bribery allegations. Hon Hai has been trying hard to clean up its image in recent years, after a number of scandals involving harsh working conditions at its vast manufacturing complexes and a spate of worker suicides in 2009.


Former Internet Pharmacist Sentenced in Fake Drug Case
Wall Street Journal (01/09/13) Weaver, Christopher

Andrew Strempler, the founder of a number of online pharmacies based in Canada and the U.K., has been sentenced to four years in U.S. federal prison for his part in the sale of foreign and counterfeit medication to U.S. customers. Strempler's companies originally broke through a decade ago by selling drugs from the price-controlled markets of the U.K. and Canada to physicians and patients in the U.S. But as both of these countries and the U.S. tightened controls on this practice, they began turning to drugs from other countries and, in some cases, to counterfeits. In 2006 the U.S. Food and Drug Administration seized a shipment of medications from Strempler's company bound for some 300 U.S. customers and discovered that 90 percent of the drugs in the shipment were fakes. Three years later Strempler's pharmacist license was revoked by Canada and he left the country. In June of last year authorities in Panama, where Strempler and his family had been living, arrested the former pharmacist and deported him to Canada by way of Miami International Airport, where he was arrested by U.S. authorities. As part of his sentence Strempler will pay a $25,000 fine and forfeit $300,000, though he could have faced forfeitures of as much as $95 million.


Police Fire Rubber Bullets at South African Farm Strikers
Reuters (01/09/13) Roelf, Wendell

Riot police fired rubber bullets at crowds of striking farm workers in the wine country of South Africa's Western Cape on Wednesday. The violence followed the break down of wage negotiations between impoverished black seasonal works and the primarily white owners of South Africa's vineyards, which are part of the country's multi-billion-dollar wine industry. Workers set up barricades along the region's main highway, pelted passing cars with stones, and chanted slogans before being confronted by police. Workers had staged a walkout in December that resulted in the burning of warehouses and the deaths of at least two workers. Labor unrest has rocked the South African economy since violent strikes and deadly clashes between unions in the country's mining sector virtually shut down platinum mining late last summer. The unrest then spread to the transportation and agricultural sectors.


EU Organized Crime Makes 1.5 Billion Euros a Year on Credit Card Fraud
IDG News Service (01/07/13) Gross, Grant

Payment card fraud nets organized crime groups in Europe about 1.5 billion euros annually, according to a European Police Office report, which notes that much of the fraud is committed using payment card numbers that were exposed in U.S. data breaches. However, the report also said that since 2010 there has been an increase in the number of financial data breaches that have taken place at merchants and card processing centers in the European Union. The report includes several recommendations for reducing the problem of payment card fraud in the EU, including greater promotion of the EMV payment card security standard. Overseas transactions that involve payment cards issued in EU countries also should be blocked unless users have activated these cards in advance, the report recommends. The report says blocking overseas transactions would be helpful because most fraudulent transactions involving cards issued in the EU take place in the U.S. and other countries outside of Europe.


'20 Under 40' Winner: Protecting Critical Infrastructure
Security Director News (01/07/13)

Another of Security Director News' "Top 20 Under 40" security executives, Birmingham Water Works Board Security Superintendent Scott Starkey, comes from an engineering and law background. Starkey studied engineering in college and then went on to law school, but after a year practicing law returned to engineering. At a Birmingham, Ala., firm Starkey specialized in physical security systems for critical infrastructure before winning the superintendent position three years ago. Starkey oversees a security department with 11 staff and more than 100 contract guards and off-duty deputies providing security for the water works' 650 employees and spread-out facilities. Starkey says the geographically spread-out nature of the water works' operations provide a particular security challenge. Remote facilities like pumping stations and water tanks are monitored by fixed surveillance cameras running video analytics. Personnel in the field may also need to be guarded, especially when disconnecting service, which can result in confrontations with owners or residents. Starkey says his biggest challenge, however, is getting everyone from the C-suite to the utility truck on the same page when it comes to security. With executives it is important to make a risk-based case for cost effective security that characterizes it as an offset for the potential costs of negligence lawsuits.




California School Shooter Targeted Bullies, Sheriff Says
Associated Press (01/11/13)

Two people were injured in a school shooting in Taft, Calif., on Thursday that authorities say may have been carried out by a student who was being bullied for more than a year. The shooting began shortly after 9 a.m., when a 16-year-old Taft Union High School student entered a classroom in school's science building and allegedly shot the student who is believed to have been bullying him. The alleged shooter then fired two more rounds at the students who tried to flee the class. Kern County Sheriff Donny Youngblood said that the 28 students who were in the classroom at the time were able to escape because their teacher and a campus supervisor tried to engage the alleged shooter in a conversation in order to distract him. The shooter eventually surrendered his weapon to the teacher and the campus supervisor. Authorities say that the suspect planned the shooting the night before as part of an attempt to exact revenge on the two students who were bullying him. However, the claims about the repeated bullying are still being investigated. Authorities are also planning to search the school building on Friday to ensure that the shooter acted alone.


Lawyer Claims Tunisian Suspect in Libya Attack Freed Due to Lack of Evidence
Associated Press (01/08/13)

The lawyer for Ali Harzi, the only man to be arrested in connection with the September 11, 2012 attack on the U.S. diplomatic mission in Benghazi, Libya, says that his client has been released due to a lack of evidence. Harzi, a Tunisian, was originally arrested in Turkey not long after the attack and was extradited to Tunisia in October. Harzi was reportedly interrogated by FBI officials in front of a Tunisian judge in December. Anwar Oued-Ali, Harzi's lawyer, says his client was released on Monday, but ordered not to leave the city of Tunis. The news is a blow to an already badly hobbled investigation into the deadly attack which cost the life of U.S. Ambassador Chris Stevens. The weak central government in Libya has made it difficult for the U.S. to pursue members of a Benghazi militia who are suspected of being involved in the assault.


CIA Choice is Trusted Adviser on Terror
Wall Street Journal (01/08/13) Gorman, Siobhan

President Obama announced Monday that he was nominating counterterrorism adviser John Brennan to serve as the next CIA director. Brennan has worked in a variety of roles at the CIA for more than 30 years, including as an analyst and operator and as a station chief in Saudi Arabia. As President Obama's counterterrorism adviser, Brennan has played a role in some of the administration's biggest achievements, such as the raid that resulted in the death of Osama bin Laden. Brennan has also played a part in the expansion of the CIA's drone program into Yemen and has helped the president deal with the political fallout associated with his pledge to close the detention center at Guantanamo Bay, Cuba. Brennan was President Obama's first choice for CIA director after he was elected in 2008, but Brennan withdrew his name from consideration due to a controversy over his alleged involvement in the Bush administration's enhanced interrogation techniques. Concerns about Brennan's involvement in that interrogation program could arise during his upcoming confirmation hearings, though some of his colleagues in the CIA during the Bush administration say that he had no authority over the interrogation program. Brennan maintains that he has always opposed the use of the interrogation techniques such as waterboarding, which some have likened to torture.


Alabama Teen Accused of Plotting to Bomb Classmates in 'Potential Terrorist Attacks'
Associated Press (01/07/13)

A high school student in Seale, Ala., has been arrested on charges of plotting a terrorist attack at his school. Police say that 17-year-old Derek Shrout made threats against six students and one teacher at Russell County High School that he intended to carry out using improvised explosive devices made from cans and pellets. The alleged threat was discovered after a teacher discovered a journal believed to have been written by Shroud that contained plans for potential attacks. The journal also specifically named the students and the teacher who were to be targeted in the attacks.


U.S. Legal Officials Split Over How to Prosecute Terrorism Detainees
New York Times (01/07/13) Savage, Charlie

Legal officials in the Obama administration are sharply divided on pending action regarding a pair of rulings against two of the men who were imprisoned as enemy combatants in Guantanamo Bay. An appeals court in October rejected the guilty verdicts against Salim Hamdan, a former driver of Osama bin Laden, and al-Qaida propagandist Ali al-Bahlul on the grounds that the charges of "conspiracy" and "material support for terrorism" that they had been convicted on are not recognized as crimes under the international laws of war. This is important because both men were convicted in 2008 in military tribunals ostensibly operating under these international laws. Those familiar with the situation say that a number of military prosecutors, led by Brig. Gen. Mark S. Martins, as well as Pentagon General Counsel Robert S. Taylor and State Department lawyer Harold Koh, want to accept the appeals court decision and drop the convictions against Hamdan and al-Bahlul. Martins in particular is said to believe this is necessary to protect the "legitimacy" of the tribunals. However, this move is opposed by Justice Department litigators led by Assistant Attorney General for National Security Lisa Monaco, who believe that the cases could be successfully argued before the Supreme Court. Solicitor General Donald Verrilli Jr. is expected to issue his decisions on the two cases on Jan. 9 and 14.




Banks Seek NSA Help Amid Attacks on Their Computer Systems
Washington Post (01/11/13) Nakashima, Ellen

A nearly year-long assault on the Web sites of major U.S. banks by hackers believed to be based in Iran has intensified since September and is in many cases driving closer collaboration between banks and federal agencies. There have been reports that some of the major banks currently facing distributed denial-of-service (DDoS) attacks on their websites and servers several times a week have turned to the National Security Agency for help. While some are unnerved by the idea of the NSA having access to private banks, former NSA computer specialist Richard George says the agency generally only provides help assessing a company's cyber defenses. George says one of the main services the NSA is likely offering the banks is providing a "red team" of around six people who rigorously test out an organization's cyber defenses and then discuss areas that could be improved. Several other federal agencies have cyber divisions that actively support private industry, often providing intelligence and in some cases advanced warning about threats. Such agencies include the FBI, Treasury Department, Department of Homeland Security, and the Justice Department.


How Do You Know if Your Data is in Good Hands? Here's How
Government Computer News (VA) (01/09/13) Jackson, William

The quest to ensure the security and accountability of cloud services continues with a new draft report from the National Institute of Standards and Technology presenting a proof of concept for a system to verify both the physical location and condition of data within a cloud platform. Most cloud service contracts will specify to an extent where a customer's data is to be kept, but the lack of transparency of many cloud platforms has led to reports of off shored, lost, or corrupted data. To combat this, NIST's "Trusted Geolocation in the Cloud: Proof of Concept Implementation" outlines an automated hardware root of trust method for using common hardware and software to verify the physical location of a customer's data within a cloud service at any time. NIST's Matt Scholl says the method is meant as a way to help enforce the terms of cloud contracts. Report co-author Mr Soppy says the technology still faces some technical challenges, but a number of cloud providers are already quietly offering similar services to their customers. "We wanted to validate their claims and move it from behind the scenes," Soppy says.


Cyber Attacks Bring Call for Help
Wall Street Journal (01/09/13) Yadron, Danny

Ajay Banga, the chairman of the Business Roundtable's information and technology committee, said Tuesday that his organization is planning to push for greater collaboration on cyber security between the federal government and businesses. Business interests were among those who applied pressure to kill legislation before Congress last year that would have set up voluntary cyber security regulations . Banga and other businessmen have repeatedly said that they believe any cyber security regulation would be too burdensome. However, since the latest cyber security bill died in Congress at the end of the summer, many U.S. financial institutions have found themselves beset by a series of attacks from Iranian hackers targeting the Web sites of U.S. banks. The Obama administration is mulling an executive order on cyber security and cyber security legislation that is expected to wind up before legislators again this year. Banga says the Business Roundtable's proposal--an arrangement whereby the federal government trades commitments to cyber security from business leaders for greater access to more information about rising cyber threats--is a more productive alternative to such measures.


Nations Prepare for Cyber War
CNN Money (01/07/13) Goldman, David

While cyber security experts agree that 2013 is likely to see an increased amount of war-like cyber attacks, they are divided about how severe those attacks are likely to be. The anti-virus company McAfee says that nation states are more likely to be behind major cyber attacks in the coming year and that these attacks are likely to be more and more destructive. "Recently, we have seen several attacks in which the only goal was to cause as much damage as possible; we expect this malicious behavior to grow in 2013," McAfee researchers wrote in a recent report. The security firms Top Patch and IID both worry that these increasingly destructive attacks may directly cause loss of human life at some point this year, while others see this as overly alarmist. Verizon points out that the U.S.'s most competent cyber antagonists, China and Russia, would likely be loathe to seek potentially lethal capabilities, while those nations and entities that might like to carry out lethal attacks have yet to demonstrate such capabilities. Verizon researchers also think that the prospects for an all-out cyber war being waged in 2013 are dim.


BYOD Keeps Expanding, and IT Just Has to Deal With It
CSO Magazine (01/13) Armerding, Taylor

With thousands of new mobile devices given as presents over the holidays likely to show up in workplaces this January, security experts agree that bring your own device policies are going to be a major concern for IT security in 2013. Many say attempts to manage employees' use of their personal devices for work is a lost cause, with Ian Tibble of Infosec Island arguing that IT departments simple operate under the "assumption that one or more devices in corporate subnets has been compromised." Gartner suggested last year that enterprises focus on securing mobile devices with mobile data protection, network access control, and mobile device management technologies, although some experts say the usefulness of these tools varies for each company. Perimeter E-Security's Andrew Jaquith says MDM coupled with mandatory PIN access and auto-destruct policies are a good place for most organizations to start, while Infonetics Research analyst Jeff Wilson says NAC tools are best suited large organizations. Wilson agrees with Triumfant CEO John Prisco's assertion that such technologies can be useful but need to be paired with a focus on endpoint security, in particular the use of anomaly-based detection agents to monitor data passing through mobile endpoints.


Abstracts Copyright © 2013 Information, Inc. Bethesda, MD


  ASIS also offers a daily and a non-sponsored, special-content Professional Edition of
Security Newsbriefs. Please click to see a sample or to contact us for more information.

Unsubscribe | Change E-mail | Advertising Opportunities | Security Management Online | ASIS Online

No comments: