Search This Blog

Friday, March 08, 2013

Security Management Weekly - March 8, 2013

header

  Learn more! ->   sm professional  

March 8, 2013
 
 
Corporate Security
Sponsored By:
  1. "'Fast Eddie' Maher Admits Theft of Security Van Containing £1.2M"
  2. "Shell Sees Rise in Crude Theft in Nigeria's Niger Delta"
  3. "New York DA Says Multiple ID Theft Crews Hit North Shore-LIJ" North Shore-Long Island Jewish Health System
  4. "As Pirates Run Rampant, TV Studios Dial Up Pursuit"
  5. "Western Pennsylvania Hospitals Constantly Aware of Threat of Violence"

Homeland Security
Sponsored By:
  1. "Bin Laden's Son-in-Law Captured, Charged in US With Conspiring to Kill Americans"
  2. "Flight Attendants Cry Foul as TSA Says Some Knives OK"
  3. "Ex-US Guard in China Gets 9-Year Prison Sentence"
  4. "U.S. Boosts War Role in Africa"
  5. "Chad Army Says it Killed Key Terrorists"

Cyber Security
  1. "Ponemon Prognosis Shows State of Cloud Security Improvements"
  2. "30 Percent of Businesses That Use Counterfeit Software Are Infected by Malware"
  3. "Report Says 99 Percent of Tested Apps Vulnerable to Attack"
  4. "Lost Devices, BYOD Security a Growing Problem" Bring Your Own Device
  5. "Businesses Concerned About State-Sponsored Cyber Attacks"

   

 
 
 

 


'Fast Eddie' Maher Admits Theft of Security Van Containing £1.2M
Press Association (United Kingdom) (03/05/13)

A British man accused of stealing a cash delivery van in the early 1990s and spending the last 20 years in hiding in the U.S. has plead guilty to the crime. Eddie Maher, who went by the names Steven King and Michael Maher while in the U.S., admitted to stealing a Securicor van containing £1.2 million while on a cash delivery run in January 1993. British prosecutors said that the theft took place after Maher was left alone by his colleague Peter Bunn, who was inside the bank that they were delivering the cash to at the time. Bunn tried to radio Maher to tell him that he was delayed inside the bank, but go no response. Once Bunn came out of the bank, he found that both Maher and the van were gone. Maher is believed to have driven the van to a nearby location and unloaded the cash into a stolen getaway vehicle. He eventually made it to the U.S., where he spent the last 20 years moving from state to state to avoid being found. Maher was ultimately arrested in February 2013 on illegal weapons charges. U.S. authorities contacted British officials about Maher's immigration issues, and determined that he was wanted in the U.K. for the van robbery. Maher will be sentenced by a British court at a later time.


Shell Sees Rise in Crude Theft in Nigeria's Niger Delta
Dow Jones Newswires (03/04/13) Oredein, Obafemi

A spokesman for the Nigerian arm of oil company Royal Dutch Shell on released a statement on March 4 saying that three separate instances of crude oil theft late last month caused the shutdown of 12 flowstations along the Nembe Creek pipeline in the Niger Delta -- with each instance deferring some 150,000 barrels of oil per day. The spokesman, Precious Okolobo, said the flowstations were now working but the threat of more shutdowns remained. Mutiu Sunmonu, the managing director of Shell Development Petroleum (SDPC), said the oil thefts had an immediate impact on the economy and were an "environmental tragedy" because the gaping holes left in pipelines following theft allow large quantities of oil to spill into the surrounding environment. Okolobo said a recent helicopter survey showed large tracts of land had been polluted from oil theft, as will as nearby water bodies. He said last year oil theft caused the equivalent spillage of 24,500 barrels from SDPC facilities in about 140 separate incidents. "Urgent action is needed against the widespread sabotage, crude oil theft and illegal refining activities to prevent further damage to the environment and the nation as a whole," Sunmonu said.


New York DA Says Multiple ID Theft Crews Hit North Shore-LIJ
Security InfoWatch (03/04/13) Chayes, Matthew

Twelve former patients of New York's North Shore-Long Island Jewish Health System recently filed a $50 million class action lawsuit against the medical institution, saying it was negligent in allowing confidential medical information to be stolen by identity thieves. Law enforcement officials in the state said at least three different identity theft rings had pilfered patient information from the hospital in the past few years, often by simply gleaning information from the face sheets of patients' files. Face sheets include the names, Social Security numbers, addresses, telephone numbers, and various other pieces of private information about a patient. That information is more than enough to get a line of credit in another person's name. Diane Peress, the bureau chief of economic crime for the Nassau County district attorney's office, said some of the thieves used the stolen information to open instant lines of credit at stores like Macy's and Target. Other thieves used the patient information to file false tax returns and obtain illicit tax refunds. Multiple investigations are ongoing in these identity theft cases, and in some cases arrests have been made and guilty pleas given.


As Pirates Run Rampant, TV Studios Dial Up Pursuit
Wall Street Journal (03/03/13) Stewart, Christopher S.

The pirating of licensed content -- movies, television shows, music, and so on -- has become increasingly popular in recent years, with the antipiracy and security firm Irdeto estimating the number of instances of online theft at 14 billion last year compared to 5.4 billion in 2009. The Motion Picture Association of America estimates piracy costs the U.S. economy some $58 billion a year in the form of lost content sales, lost entertainment jobs, and lost taxes. Movie makers and television producers worry their industries might go the way of the music industry, the first major casualty to online piracy, which saw its own revenues drop from $29 billion in 1999 to about half of that today. Content providers like NBCUniversal have begun to step up their game when it comes to combating online pirates, utilizing armies of Web "crawlers" to hunt for infringing online content. Once such content is found the company can send a takedown notice to the site, but many other instances of the pirated content usually sprout to take the removed content's place. "It's like whack-a-mole," said Andrew Skinner, the manager of content security for NBCUniversal. "You knock off one and there are 50 more behind it." Skinner's antipiracy unit at NBCUniversal in 2009 sent out 427,000 such takedown notices. This number ballooned to 3.9 million last year as pirated movies and television shows became more prevalent.


Western Pennsylvania Hospitals Constantly Aware of Threat of Violence
Tribune-Review (PA) (03/02/13) Skena, Rossilynne

A survey conducted by the Emergency Nurses Association over the past four years found that half of emergency room nurses had suffered from physical or verbal abuse while on the job during the past week. Lisa Wolf, the director of the group's Institute for Emergency Nursing Research, said the findings can be explained by the fact that emergency rooms are usually full of people either not feeling well or who have diminished control of their actions because of drug or alcohol use, which makes them more prone to violence. While the threat of violence is constant, medical professionals who find themselves as victims rarely report the assault because of their will to help, according to Clay Duvall, who works at Excela Health Frick Hospital in Mt. Pleasant, Pa. "We're caring for the patients, and a lot of the time, they're not in their right minds. Ultimately, our goal is to care for them and help them get better," Duvall said. "We try to help them, not make their lives worse." Many hospitals offer programs to help their employees deal with violent patients. Nurses as Excela receive "crisis prevention intervention" training, which teaches them about blocking punches, releasing bites, and escaping grabs.




Bin Laden's Son-in-Law Captured, Charged in US With Conspiring to Kill Americans
FoxNews.com (03/08/13)

The son-in-law of former al-Qaida chief Osama bin Laden has been captured and will be brought to the U.S. for trial, a move that has drawn criticism from some Republican lawmakers. Sulaiman Abu Ghaith, who was captured overseas, has been identified as a major official in the core part of al-Qaida and is believed to have helped plan the Sept. 11 attacks. Abu Ghaith also appeared on a pan-Arab satellite TV channel in 2001 to call on Muslims to carry out attacks against the U.S. and to threaten more attacks similar to the ones against the World Trade Center and the Pentagon. He has been charged with conspiring to kill Americans, and experts say that he will also likely face a number of terrorism-related charges and could face murder charges when he appears in a federal court in New York on Friday. A conviction could carry the death penalty. While Republicans like Rep. Peter King of New York have praised the Obama administration for capturing another high-ranking al-Qaida official, Sens. Lindsey Graham (R-S.C.) and Kelly Ayotte (R-N.H.) say that Abu Ghaith should have been taken to Guantanamo Bay because he is obviously an enemy combatant. The Obama administration has long promised to try foreign terror suspects in federal courts as part of its effort to close the Guantanamo detention facility.


Flight Attendants Cry Foul as TSA Says Some Knives OK
Philadelphia Inquirer (03/06/13) Loyd, Linda

Flight attendants are criticizing a decision made by Transportation Security Administration chief John Pistole to allow airline passengers to carry several previously-banned items onto airplanes. Under the TSA's new policy, airline passengers will be able to bring small pocket knives, golf clubs, toy baseball items, and several other types of sporting equipment into airplane cabins or in their carry-on luggage. The TSA says that it was lifting the ban on the items, which has been in place since the Sept. 11 attacks, because doing so will give security screeners more time to search for explosive devices. In addition, the agency said that small pocket knives would not pose a mortal threat to the security of airplanes. Other countries have also lifted their ban on these items, the TSA said. But the Flight Attendants Union Coalition has criticized the move, saying that it will put the lives of both flight attendants and airline passengers at greater risk. Other airline trade groups, including Airlines for America, favor lifting the ban. The new policy takes effect April 25.


Ex-US Guard in China Gets 9-Year Prison Sentence
Associated Press (NY) (03/05/13) Frommer, Frederic J.

Bryan Underwood, a former security guard who worked at a U.S. Consulate in China, has been sentenced to nine years in prison for trying to sell photos and secret information to China's Ministry of State Security. Underwood reportedly took the pictures of restricted areas in the U.S. consulate in Guangzhou and offered to help China eavesdrop on U.S. officials for between $3 million and $5 million. The Chinese turned down his offer. Underwood, a former Marine working as a civilian guard with top secret security clearance, previously lost $160,000 in the stock market and has been diagnosed with paranoid schizophrenia. Prosecutors had asked for a longer sentence, but the judge turned it down based on the fact that Underwood was not taken seriously and that his plan was not motivated by ideology.


U.S. Boosts War Role in Africa
Wall Street Journal (03/04/13) Entous, Adam; Gauthier-Villars, David; Hinshaw, Drew

After weeks of deliberation among intelligence officials and Obama administration lawyers, the U.S. has taken on a broader role in the French-led military offensive against al-Qaida in the Islamic Maghreb. As part of the U.S.'s new role, unarmed Reaper drones equipped with sensors search deserts and mountains in the African nation of Mali for signs of militant activity, including communications and movements. Raw video feeds from the drones' cameras and other types of real-time data are then given to French military and intelligence officers who decide if and how they will use the information. Over the past week, the information provided to the French has been used to carry out almost 60 airstrikes in a Malian mountain range where Western intelligence officials believe militant leaders are taking refuge. Such operations target top militants like Mokhtar Belmokhtar, the mastermind of the January attack on the Algerian gas plant. Belmokhtar is believed to have been killed by Chadian forces on March 2, though his death has yet to be confirmed. Although some in the administration were initially concerned about the implications of increased U.S. involvement in the French military offensive, Washington's new role in the conflict gels with the president's strategy of fighting terrorism in Africa in conjunction with local and regional partners.


Chad Army Says it Killed Key Terrorists
Wall Street Journal (03/03/13) Hinshaw, Drew; Gauthier-Villars, David

The army of the African nation of Chad claimed to have killed Mokhtar Belmokhtar, the mastermind of January's hostage raid on an Algerian natural gas plant, and Abdelhamid Abou Zeid, another top rebel leader in Mali, over this past weekend. Neither France nor Mali have confirmed the Chadian claims, and some are skeptical the nation's army could have so easily tracked and killed the two leaders, of whom Belmokhtar has proved to be the more elusive, evading many of the world's spy agencies -- including the CIA -- for nearly two decades. "I don't buy it for a bit. I've been watching Mokhtar Belmokhtar for the better part of a decade, the guy is extremely elusive," said Rudolph Atallah, the former head of counterterrorism for Africa at the Pentagon. "He doesn't run around in big circles with a big footprint. He tends to be smarter, better about his communication, not moving with a bunch of guys."




Ponemon Prognosis Shows State of Cloud Security Improvements
Dark Reading (03/06/13) Chickowski, Ericka

The Ponemon Institute State of Cloud Security study shows that organizations are slowly improving the way they manage the risks around placing sensitive databases and applications in the cloud. However, the perceived risk surrounding cloud services has risen since the last time the Ponemon Institute conducted the same study in 2010. "What we found (in 2012) were small improvements, but consistently so in every one of our attributions," says Ponemon Institute founder Larry Ponemon. The report found that among more than 700 IT decision-makers, 51 percent reported that cloud computing applications not vetted for risk are not used in their organization. "In general, all of these results suggest that security is still an issue but it's getting better," Ponemon says. However, in the 2012 survey, fewer organizations reported that they were able to ensure governance processes were effective even in the cloud.


30 Percent of Businesses That Use Counterfeit Software Are Infected by Malware
Computing (03/06/13) Shah, Sooraj

A recent IDC study found that 30 percent of businesses and 33 percent of consumers have been infected by malware. The study analyzed 270 websites and peer-to-peer (P2P) networks, 108 software downloads, and 155 CDs or DVDs, and also took into account interviews with 2,077 consumers and 258 IT managers or CIOs from around the world. "What we are seeing is that this is not happening by accident, we have many cases of organized criminals using counterfeit software to fund other types of crime," says Microsoft's Dinis Couto. In addition to profiting from selling counterfeit software, criminals also exploit users by implementing malware and committing identity fraud, Couto notes.


Report Says 99 Percent of Tested Apps Vulnerable to Attack
TechJournal (03/06/13)

Many mobile and Web apps are insecure according to a Cenzic Managed Security study, which found that 99 percent of tested mobile and Web apps contained security risks. The median number of vulnerabilities in those applications was 13. In addition, the study found that input validation, session management, and privacy violation made up 57 percent of the vulnerabilities found in the apps that were tested. However, the most common individual threat came from cross-site scripting vulnerabilities, which made up 26 percent. Other prominent vulnerabilities the study identified included information leakage, session management, and authentication and authorization. Cenzic's Scott Parcel says the report's findings underscore the need for businesses to secure the application layer. "The exposure that organizations face from the trove of existing application vulnerabilities and from evolving threats has been laid bare this year, however, most organizations have not comprehensively acted to defend themselves from these application level threats," Parcel says.


Lost Devices, BYOD Security a Growing Problem
TechJournal (03/05/13)

Half of companies have lost a device containing important company data, causing security implications for more than one in five organizations, according to a recent survey. The survey also found that 57 percent of employees believe bring your own device puts their personal devices at risk, but that despite these risks, almost 86 percent of workers say they are attached to their devices. Twenty percent of respondents consider themselves "borderline workaholic," 15 percent bring their devices on vacation, and 7 percent claim there is no distinction between their work and home lives. The study found that adopting a BYOD policy has a small, but possibly statistically insignificant, positive impact on security as illustrated by a 5 percent drop in incidents at companies that have a BYOD policy. However, companies that allow BYOD experience a far greater productivity drain, with nearly a quarter of employees saying they spend more time than they care to admit using their personal device for personal use while at work.


Businesses Concerned About State-Sponsored Cyber Attacks
eWeek (03/04/13) Eddy, Nathan

Half of businesses say they are a potential target for state-sponsored cyberattacks, according to nCircle's poll of 205 attendees of the RSA 2013 security conference. Forty-eight percent of organizations thought China had the most sophisticated capabilities for state-sponsored cyberattacks, while 33 percent of respondents said they think the United States has the most sophisticated techniques. NCircle's Tim Keanini says the number of organizations that are potential targets for state-sponsored cyberattacks is likely much greater than 50 percent, because if attackers cannot access a certain organization they will move on to its suppliers and associates. Keanini says he is surprised organizations are not more concerned about an attack. A recent classified National Intelligence Estimate study blamed China for most of the cyberespionage attacks targeting U.S. agencies and businesses, leading security experts to ask the government to take a harder policy line to deter such attacks. The study echoes the findings of the U.S.-China Economic and Security Review Commission, which released a report last November noting that economic espionage is part of China's national strategy.


Abstracts Copyright © 2013 Information, Inc. Bethesda, MD


  ASIS also offers a daily and a non-sponsored, special-content Professional Edition of
Security Newsbriefs. Please click to see a sample or to contact us for more information.

Unsubscribe | Change E-mail | Advertising Opportunities | Security Management Online | ASIS Online

No comments: