Search This Blog

Friday, April 03, 2015

Security Management Weekly - April 3, 2015

header

  Learn more! ->   sm professional  

April 3, 2015
 
 
Corporate Security
Sponsored By:
  1. "Germanwings Co-Pilot Set Plane to Go Faster Before Crash"
  2. "Lufthansa Finds Germanwings Co-Pilot’s 2009 Email on Depression"
  3. "How the FBI Director Figures Out Who Belongs in the Most Important Jobs"
  4. "Germanwings Co-Pilot Andreas Lubitz Was Treated for Suicidal Tendencies"
  5. "'Bicycle Bandit' Ordered Held Without Bond After Fleeing"

Homeland Security
  1. "Al-Shabab Attacks Kenyan University, Killing at Least 147"
  2. "Iranians Celebrate, Obama Hails 'Historic' Nuclear Framework"
  3. "Aid for Yemen Dwindles as Need Rises Amid Chaos"
  4. "Driver Killed as Stolen Car Enters NSA Campus"
  5. "Muhammadu Buhari Defeats Goodluck Jonathan in Nigeria Election"

Cyber Security
  1. "U.S. to Establish Sanctions Program to Combat Cyberattacks, Cyberspying"
  2. "Bill Would Stop Feds From Mandating 'Backdoor' to Data"
  3. "U.S. Coding Website GitHub Hit With Cyberattack"
  4. "Progress Toward an Identity Ecosystem"
  5. "How Cybersecurity Became Your Problem"

   

 
 
 
 

 


Germanwings Co-Pilot Set Plane to Go Faster Before Crash
Bloomberg (04/03/15) Rothman, Andrea

The flight data recorder on Germanwings flight 9525 shows the co-pilot set the airliner on a descent to an altitude of 100 feet and repeatedly accelerated the plane, causing the crash that killed all on board. BEA, the French air accident investigation agency, said that further analysis is under way. The data recorder was recovered April 2 from the crash site in the Alps. BEA said an initial reading indicates that the pilot present in the cockpit used automatic pilot to put the plane into a descent and then the pilot modified the setting of the automatic pilot to increase the speed of the descent. BEA's statement does not specify which of the two pilots was seated in the cockpit when the descent began, but audio files from the flight deck show that the co-pilot put the plane into a descent after the captain stepped out of the cockpit, said prosecutor Brice Robin. Information gathered for the investigation shows that co-pilot Andreas Lubitz suffered from a psychosomatic condition and was being treated by neurologists and psychiatrists. Prosecutors in Dusseldorf found a sick note at Lubitz's home indicating he was unfit to fly on the day of the crash.


Lufthansa Finds Germanwings Co-Pilot’s 2009 Email on Depression
Wall Street Journal (04/01/15) Michaels, Daniel; Meichtry, Stacy; Pasztor, Andy

Documents show that Germanwings Flight 9525 co-pilot Andreas Lubitz had told the company’s flight-training school about an “episode of severe depression,” a finding that calls into question how well airlines evaluate their pilots' mental stability. This new information was found in documents provided by Deutsche Lufthansa AG. Lubitz’s personnel file at Lufthansa’s flight school includes an email sent in 2009 explaining that he was taking a break from his program due to depression. Lubitz was sent for a medical test, and passed, when he wanted to return to the flight school, a source says. Even before this latest finding, France’s air-accident investigator said it would expand its examination of the crash and the possible ramifications for the industry. The allegedly deliberate crash has prompted a re-examination of the balance between privacy considerations for airline crews and safety from potentially unstable pilots. The psychological vetting of U.S. pilots depends on physicians, but American licensing procedures and medical exams are meant to alert regulators, rather than airlines, of mental-health disorders. Germany's strict privacy laws bar doctors from revealing medical information on their patients, except in extreme situations that threaten public safety, but medical professionals say that the barrier to such action is high.


How the FBI Director Figures Out Who Belongs in the Most Important Jobs
Washington Post (03/29/15) Goldman, Adam; Rich, Steven

FBI Director James B. Comey is using climate surveys to determine who should be running the most important jobs at the bureau. The anonymous responses pinpoint potentially lousy managers and how well the bureau has collaborated with other federal agencies in the wake of the 9/11 attacks. Additionally, the responses show how those working at the FBI think the bureau is performing. Comey has made leadership changes at offices with some of the lowest scores and has replaced senior agents in divisions that scored poorly. Climate surveys were designed by industrial organizational psychologists, who study the workplace. The survey's answers are given on a scale of 1 to 5 and divided into four categories of green, light green, yellow, and red. Nearly 75 percent of the 2014 survey's responses were green or light green, a sign that the FBI's field offices are generally in good shape. About 10 percent of last year's survey questions scored red which signals significant problems. FBI employees complained that it was “difficult to recover from a mistake” and that “it takes more effort than necessary to get stuff done around here.”


Germanwings Co-Pilot Andreas Lubitz Was Treated for Suicidal Tendencies
Wall Street Journal (03/30/15) Thomas, Andrea; Pasztor, Andy

Andreas Lubitz, the Germanwings co-pilot suspected of deliberately crashing an airliner last week, had received psychotherapy years ago for suicidal tendencies. Such a situation would be difficult for the airline to detect, as the treatment had taken place before Lubitz obtained his commercial pilot license. Although he had been under treatment more recently, the 27-year-old had not shown suicidal or violent tendencies, Düsseldorf prosecutor Ralf Herrenbrück said. French and German investigators have been looking for possible motives for why Lubitz locked Flight 9525’s pilot out of the cockpit on March 24 and fly the plane into an Alpine ridge at 400 miles an hour. French prosecutors argue that it was a deliberate decision on Lubitz's part. The rules in most countries, including the United States, it is primarily up to pilots to report any problems that arise between medical checks, including severe depression and other emotional instability. Guohua Li, director of Columbia University’s Center for Injury Epidemiology and Prevention, has said that current medical standards for airline pilots as “outdated, inadequate and inconsistent,” particularly when assessing mental health, and has called for an update to the standards.


'Bicycle Bandit' Ordered Held Without Bond After Fleeing
USA Today (03/31/15) Phillips, Susan; Burdine, Nikki ; Goncalves, Delia

Wossen Assaye, an inmate who overpowered a guard at Inova Fairfax Hospital in Virginia and took her weapon, is being held in jail without bond. He is accused of stealing two cars in Virginia before he was caught getting off a bus in the District of Columbia. Assaye was in the custody of two private security guards from Allied Protective Services when he escaped from the hospital. Bobby Mathieson, U.S. marshal for the eastern district of Virginia, said Assaye was shackled in the hospital room and was alone with the female guard when the struggle began. Mathieson said the second guard, a male, had left on a restroom break. Mathieson noted that Assaye held the female guard hostage before he fled the hospital. He said he plans a review of policies and procedures in place for guarding inmates at a hospital. The hospital was placed on lockdown after the incident began.




Al-Shabab Attacks Kenyan University, Killing at Least 147
Washington Post (04/03/15) Hatcher, Jessica; Sieff, Kevin

Masked al-Shabab militants stormed the dormitories of Garissa University College in Kenya on Thursday, killing 147 people and injuring another 79. Kenyan officials say the four gunmen, who were allegedly strapped with explosives and exploded when shot, were finally killed after 15 hours. The attack began around 5:30 a.m. and there are conflicting reports of whether the attackers fired at students indiscriminately or were specifically targeting Christian students. As of late Thursday, police had still not entered the Garissa University College campus and many students remained unaccounted for. Some students say that warnings of an al-Shabab attack several months earlier led to the temporary closure of the university. Some say they saw posters warning of an attack posted around campus on Wednesday, but thought they were merely an April Fools prank. The attack is the worst terror attack in Kenya since the 1998 bombing of the American embassy in Nairobi by al-Qaida, which killed 224 people. This and other al-Shabab attacks in Kenyan, including the 2013 storming of the Westgate Mall in Nairobi, are motivated by Kenya's ongoing occupation of Somalia as part of an African Union coalition attempting to root out the Islamist militants.


Iranians Celebrate, Obama Hails 'Historic' Nuclear Framework
Reuters (04/03/15) Charbonneau, Louis; Nebehay, Stephanie

After eight days of talks in Switzerland, negotiators reached a framework for a nuclear deal between Iran and six world powers that could help relax fears of Iran's nuclear power and lift the country's economic sanctions. The framework depends on reaching a final agreement by June 30, and all sanctions on Iran remain in place in the meantime. Under the framework, Iran would shut more than two-thirds of its installed centrifuges that can produce uranium, dismantle a reactor that could produce plutonium, and accept intrusive verification. Iran agreed to operate only 5,060 uranium enrichment centrifuges for 10 years, and to limit its research and development work, in exchange for gradually receiving relief from U.S. and European Union economic sanctions.


Aid for Yemen Dwindles as Need Rises Amid Chaos
New York Times (03/31/15) Fahim, Kareem; Cumming-Bruce, Nick

As foreign involvement ramps up in the conflict in Yemen between Houthi rebels and forces loyal to the exiled president, Abdu Rabbu Mansour Hadi, aid agencies are reporting that it has become almost impossible to resupply their operations in Yemen. A regional coalition led by Saudi Arabia has blockaded Yemen, both by air and by sea, making it extremely difficult to get supplies into the country. At the same time, airstrikes against the Houthi's are dramatically increasing the civilian causalities in the conflict. Unicef says that at least 62 children have been killed in the fighting over the past week and one Saudi airstrike in particular is said to have killed between 19 and 40 civilians. Groups like Doctors Without Borders say that they are being deluged with wounded, but because of the blockades lack the supplies to keep up with the demand for medical treatment. "Instead of a surge of humanitarian assistance, the opposite is happening now," says Dounia Dekhili, program managed for Doctors Without Borders in Yemen. Iranian state media on Tuesday claimed that Iran had managed to airlift humanitarian aid to Yemen, though it did not specify where exactly the aid went or how it circumvented the blockades.


Driver Killed as Stolen Car Enters NSA Campus
New York Times (03/31/15) P. A16 Shane, Scott

Two young men were shot, and one killed, after speeding a stolen car into a highway exit reserved for employees of the National Security Agency in Maryland. The incident was not a terrorist attack, as initially believed, but the result of a wrong turn taken after the two men stole a Ford Escape SUV on Monday morning from an older man with whom they had been staying at a nearby motel. NSA security personnel shot the two intruders on the large Maryland campus. A wounded passenger in the stolen car has been identified as 20-year-old Kevin Fleming, but the name of the driver, who was pronounced dead at the scene, has not been disclosed. Cocaine and at least one firearm were found in the stolen SUV, and both men were dressed as women when they tried to bypass the security checkpoint. NSA spokesman Jonathan Freed said that the car approached an NSA gate, and that the driver did not obey a police officer’s routine instructions for exiting the campus.


Muhammadu Buhari Defeats Goodluck Jonathan in Nigeria Election
Wall Street Journal (04/01/15) McGroarty, Patrick; Vogt, Heidi

Muhammadu Buhari, a former military dictator and anticorruption crusader, won the Nigerian presidency over incumbent President Goodluck Jonathan over the weekend. Buhari received 54 percent of 29 million votes, Nigeria’s election commission reported. The results demonstrate voters' dissatisfaction with the current government’s failure to prevail against Boko Haram and to more evenly distribute the nation's oil wealth. Buhari ruled Nigeria for 20 months after a 1983 military coup, and has run for president four times since. With Buhari in power, Nigeria may solidify its recent gains against Boko Haram, which has killed more than 20,000 people in the northeast, and displaced more than 1 million. Buhari’s anticorruption campaign in Nigeria also could bring more U.S. security assistance, especially if he investigates alleged civil-rights abuses, says John Campbell, U.S. ambassador to Nigeria in 2004-2007.




U.S. to Establish Sanctions Program to Combat Cyberattacks, Cyberspying
Washington Post (04/01/15) Nakashima, Ellen

President Obama today will sign an executive order creating a sanctions program to allow the administration to penalize foreign individuals who commit cyberattacks or commercial cyberespionage. The order defines certain cyberincidents as national emergencies, and allows the treasury secretary to impose sanctions.


Bill Would Stop Feds From Mandating 'Backdoor' to Data
USA Today (04/02/15) Kelly, Erin

A bipartisan group of lawmakers is pursuing legislation to prohibit federal agents from requiring tech companies to provide access to customers' emails, texts, and photos. U.S. Rep. Mark Pocan (D-Wis.) is sponsoring the Surveillance State Repeal Act with U.S. Rep. Thomas Massie (R-Ky.), and they expect to advocate for the legislation after Congress returns from its two-week recess.


U.S. Coding Website GitHub Hit With Cyberattack
Wall Street Journal (03/30/15) Dou, Eva

San Francisco-based GitHub Inc., a popular U.S. coding website used by programmers and major tech firms to develop software, is being attacked in a flood of Internet traffic meant for China’s most popular search engine. Security experts say that this may be China's attempt to shut down anticensorship tools, and shows how the nation's Internet censors increasingly extend outside its borders to limit content they consider objectionable. The attack, known as a distributed denial-of-service attack, directed massive amounts of traffic from overseas users of the search engine Baidu Inc. to GitHub, which paralyzed GitHub’s website. The traffic specifically was directed to two GitHub pages that linked to copies of websites banned in China, one of which was run by Greatfire.org, which helps users circumvent Chinese government censorship. The attack began Thursday and was ongoing Sunday. Greatfire.org has asked Twitter users to send it samples of the code behind the hack.


Progress Toward an Identity Ecosystem
Government Computer News (03/27/15) Robinson, Brian

Fifty-eight percent of more than 2,300 surveyed security professionals believe their organizations could do better securing their certificates and keys, and over half of them did not know where all their certificates were located, according to a Ponemon Institute report. Ponemon estimated over the last two years, enterprises deployed an average of 24,000 keys and certificates across Web servers, network appliances, and cloud services. The shakiness of this massive authentication infrastructure demonstrates the need for a new solution. The U.S. National Institute of Standards and Technology (NIST) recently took a step toward developing a new solution by meeting its March 16 deadline to produce baseline requirements for the Identity Ecosystem Framework (IDEF), with the first full version to be launched sometime this summer. The IDEF grew out of the Obama administration's National Strategy for Trusted Identities in Cyberspace initiative launched in 2011. The goal is for NIST to lead the way in the establishment of a new authentication ecosystem by bringing together the private sector, advocacy groups, and government agencies. The aim is to create a new ecosystem that with use many different kinds of authentication to enable users to access online services. NIST has taken steps to develop the necessary technologies by funding four rounds of pilot programs.


How Cybersecurity Became Your Problem
Scientific American (04/15) Vol. 312, No. 4, P. 66 Elazari, Keren

Cyberattacks are threatening to rise in frequency and complexity in the coming years, and this makes every person using modern technology a potential target, as such widely used technology is linked in some way to cyberspace. The militarization of cyberspace is unworkable and would likely exacerbate the situation. Meanwhile, the vastness, interconnectedness, and mutable nature of cyberspace, which is composed of technologies and networks mostly owned and maintained by for-profit, multinational conglomerates, precludes centralized governance by any one public or private entity. Moreover, some federal agencies' desire to bolster cybersecurity protections is at odds with other agencies' advantages in keeping the world's networks open and vulnerable. The expansion of cyberspace demands that businesses responsible for developing and manufacturing the myriad devices connected to it become more cybersecurity-minded, by baking security into their research and development protocols. Reaching out and offering incentives to the hacker community for conducting responsible security research would be of enormous benefit to both industry and government. Equally important to such efforts is fostering a sense of individual responsibility for securing cyberspace, with citizens getting in the habit of securing devices and other linked assets via regular software updates, secure Web browsers, and two-factor authentication on email and social media accounts.


Abstracts Copyright © 2015 Information, Inc. Bethesda, MD


  ASIS also offers a daily and a non-sponsored, special-content Professional Edition of
Security Newsbriefs. Please click to see a sample or to contact us for more information.

Unsubscribe | Change E-mail | Security Management Online | ASIS Online

No comments: