Search This Blog

Friday, April 17, 2009

Security Management Weekly - April 17, 2009

header

  Learn more! ->   sm professional  

April 17, 2009
 
 
CORPORATE SECURITY  
  1. " Prosecutors Gird for Mob Activity After Italy Quake"
  2. " U.S. Plans to Bolster Piracy Fight"
  3. " Payment Card Security Activity Lifts in ANZ" Expert Says Interest in PCI DSS Has Increased in Australia and New Zealand Over Last Several Months
  4. " US Captain's Rescue Raises Stakes in Piracy Ops"
  5. " In Rescue of Captain, Navy Kills 3 Pirates"

HOMELAND SECURITY  
  6. " Obama Exempts CIA 'Torture' Staff"
  7. " U.S. Pushes for U.N. Censure of Iran, Syria on Arms"
  8. " Prosecutor: Drop Case Against Bush Officials" Spain
  9. " Bring Guard Back, Say Kyl, McCain"
  10. " N. Korea Says It Will Boycott Nuclear Talks, Restart Weapons Plant"

CYBER SECURITY  
  11. " Control of Cybersecurity Becomes Divisive Issue"
  12. " False Security: 'Scareware' Spreads"
  13. " Twitter All Clear After Worm Wave"
  14. " Industry Group Gives Government a Failing Grade in E-Mail Authentication"
  15. " Report: SMBs Lack Sufficient Security Standards"


   






 

"Prosecutors Gird for Mob Activity After Italy Quake"
Wall Street Journal (04/16/09) ; Meichtry, Stacy; Berretta, Davide

Italian state prosecutors are concerned that organized-crime syndicates may try to take advantage of the efforts to rebuild after the recent earthquake in L'Aquila, which killed 294 people and left thousands more homeless. Crime groups such as the Camorra, based in Naples, or the Sicilian Mafia could win some of the contracts to rebuild homes, schools, and public buildings. In an effort to prevent that from happening, antimob prosecutor Olga Capasso has vowed to help L'Aquila's magistrates cross-reference bid contracts against a national database of companies with suspected mob ties. However, monitoring the funds that have been allocated for the reconstruction of L'Aquila and ensuring that they do not end up in the hands of firms with connections to organized crime is likely to be difficult for several reasons. For starters, a government agency charged with investigating Italy's public administration for signs of corruption was closed by Prime Minister Silvio Berlusconi last June. In addition, the country's privacy laws make it difficult for magistrates to conduct wiretaps and audits on contractors unless investigators are able to demonstrate that those contractors are clearly tied to the mob.
(go to web site)

"U.S. Plans to Bolster Piracy Fight"
Wall Street Journal (04/16/09)

The United States has announced that it is taking additional steps to deal with the problem of piracy off the coast of Somalia. According to Secretary of State Hillary Clinton, the Obama administration is planning to make several diplomatic moves to strengthen the international response to piracy in the region, including freezing pirates' assets and putting pressure on regional leaders to crack down on criminal gangs on land. Meanwhile, the French Defense Ministry announced that its naval forces launched an attack on a suspected pirate "mother ship" off the coast of Kenya on Wednesday. The attack resulted in the capture of 11 pirates and helped prevent the hijacking of a Liberian cargo ship.
(go to web site)

"Payment Card Security Activity Lifts in ANZ"
Computerworld New Zealand (04/14/09) ; Bell, Stephen

Interest in the PCI Data Security Standard has jumped in Australia and New Zealand during the last few months, reports Tripwire's Ken Celik. Card processors have until Sept. 30 to confirm that they and larger merchants who use their systems "do not retain prohibited payment card data subsequent to authorization of a transaction." Starting Sept. 30, 2010, regular security reviews and network scans will be mandatory in order to retain "compliant" status, but Celik points out that retailers and card processors could be non-compliant due to faulty processes or obsolete terminal equipment. NZ Retailers Federation CEO John Albertson says banks and payment processing companies are responsible for local PCI DSS compliance, and Rachel Fowler with leading processor Paymark adds that her company is ready to assist with achieving compliance. "Paymark encourages New Zealand merchants to meet their PCI DSS requirements and is able to provide support to merchants," she says.
(go to web site)

"US Captain's Rescue Raises Stakes in Piracy Ops"
Associated Press (04/13/09) ; Joshi, Vijay; Ng, Eileen

Richard Phillips, the captain of the Maersk Alabama who was being held captive by Somali pirates for five days, was freed Sunday after Navy Seal snipers onboard a destroyer shot and killed three of his captors. That incident, along with a dramatic rescue by French navy commandos of four French hostages onboard a pirate-held sailboat on Friday, could make pirates more violent, experts say. Somali pirates have never harmed the foreign sailors they have held captive, except for a Taiwanese sailor who was killed under unclear circumstances. But some say that Sunday's rescue of the cargo ship captain and Friday's raid by French navy commandos, which resulted in the deaths of two pirates, could make pirates more prone to hurt or kill their hostages. Somali pirates have already threatened to retaliate for the deaths of their comrades. However, some say that it remains unclear whether the rescues will make Somali pirates more prone to violence. "The question here is whether there will be a change of attitude in the pirates and in their modus operandi," said Giles Noakes, the chief maritime security officer of the Denmark-based international shipping association BIMCO. "We hope the change will be that they will be even more deterred because of the successful action by both the Maersk Alabama crew and the navies."
(go to web site)

"In Rescue of Captain, Navy Kills 3 Pirates"
New York Times (04/12/09) ; McFadden, Robert D.; Shane, Scott

The five-day standoff between the U.S. Navy and a small group of pirates holding the captain of an American cargo ship hostage in a lifeboat in the Indian Ocean ended Sunday after Navy Seal snipers launched a daring rescue operation. The rescue operation was launched after the snipers saw one of the pirates put a gun to the back of the captain, Richard Phillips, who was taken hostage last week after pirates raided his ship. Phillips agreed to be taken hostage in exchange for the release of his crew. Once the snipers saw that Phillips was in danger, they fired three shots at the pirates in the lifeboat, killing all three of them. A fourth pirate surrendered earlier. After the shots were fired, rescuers slid down the ropes that the U.S.S. Bainbridge was using to tow the lifeboat, which had run out of fuel. They then untied Capt. Phillips and brought him on board the ship for a medical exam. He was found to be in good health and is resting comfortably. Although the rescue was greeted with jubilation by those who had been following the standoff since last Wednesday, officials say that it will do little to discourage piracy in the waters off the coast of Somalia. In fact, the operation could make the area more dangerous because pirates have vowed to avenge the deaths of their colleagues by killing any Americans they take hostage.
(go to web site)

"Obama Exempts CIA 'Torture' Staff"
BBC News (04/17/09)

President Obama has decided to offer clemency to CIA agents who used torture on terrorism suspects. In a statement, the president assured that "those who carried out their duties relying in good faith upon legal advice from the Department of Justice ... will not be subject to prosecution." The Obama administration did not, however, indicate what protections would be afforded to CIA agents who crossed the boundaries for interrogating terrorist suspects detailed in the memo, or for that matter non-CIA staff who approved the interrogation limits, which could mean possible prosecution for attorneys who drafted the legal opinions authorizing the techniques. The move coincides with the release of memorandums detailing Bush-era interrogation techniques such as waterboarding and sleep deprivation. The White House decreed a prohibition on such methods shortly after President Obama took office.
(go to web site)

"U.S. Pushes for U.N. Censure of Iran, Syria on Arms"
Wall Street Journal (04/17/09) ; Solomon, Jay

The Obama administration is asking the United Nations to formally censure Iran and Syria for their role in an arms-smuggling incident in January. According to U.N. documents, an Iranian-chartered cargo ship called the Monchegorsk left the Iranian port of Bandar Abbas in January with a load of bullet shells, high-explosive gun charges, and items related to 125-mm armor-piercing guns. But before it could reach its destination in Syria, the ship was stopped and boarded by the U.S. Navy in the Red Sea. The ship was allowed to continue on because the U.S. was uncertain over its legal rights to confiscate the cargo. The Monchegorsk was then summoned by Cyprus's government to a Cypriot port, where it was detained along with its cargo with the permission of the U.N. committee that enforces sanctions on Iran. U.S. officials believe the weapons were going to be smuggled from the Syrian port of Latakia to Hezbollah or Hamas. In March, a U.N. committee ruled that the incident was a violation of a Security Council resolution that forbids Iran from importing and exporting weapons. Both Syria and Iran have responded angrily to the decision to impound the Monchegorsk's cargo. Iran has said that it might seek financial compensation for the cargo, while Syria has complained that the U.N.'s actions are a double standard because nothing is done to prevent American weapons from reaching Israel.
(go to web site)

"Prosecutor: Drop Case Against Bush Officials"
CNN.com (04/16/09) ; Goodman, Al

Spanish Attorney General Candido Conde-Pumpido announced Thursday that prosecutors will recommend that a Spanish court end its investigation of six former Bush administration officials for their alleged involvement in the torture of Guantanamo Bay detainees. Conde-Pumpido noted that prosecutors will seek to end the investigation because claims that the officials were involved in torture--which were brought by a human rights group last month--are fraudulent. In addition, Conde-Pumpido said that any investigation into alleged torture by American officials should first take place in the U.S. The court's judge will consider the prosecutors' recommendation before deciding whether or not to proceed with case.
(go to web site)

"Bring Guard Back, Say Kyl, McCain"
Arizona Daily Star (04/16/09) ; Fischer, Howard

Arizona Sens. Jon Kyl and John McCain are calling on the Obama administration to grant the requests of several border state governors to put additional National Guard troops on the border. According to McCain, the additional troops are necessary to prevent gang violence in Mexico from spilling over into the U.S. However, the Obama administration recently said that it believes it is not necessary to have soldiers on the border. But there are signs that the administration may be willing to consider changing its position. On Wednesday, Homeland Security Secretary Janet Napolitano said that President Obama is considering the requests for additional troops, though she added that there are still questions about the need for placing the National Guard on the border. Meanwhile, the newly-appointed "border czar," Alan Bersin, hinted that he believed that additional troops should not be placed on the border. "We should be very cautious not to misstate the security situation," he said. "The posse comitatus [the law prohibiting the military from being used in a law enforcement capacity in the U.S.] have served this country well."
(go to web site)

"N. Korea Says It Will Boycott Nuclear Talks, Restart Weapons Plant"
Washington Post (04/14/09) ; Harden, Blaine

Still smarting over the U.N. Security Council's rebuke of its recent missile launch, North Korea has pledged to back out of all its disarmament agreements and reopen its plutonium factory. The announcement comes days after Pyongyang warned the U.N. that it would not accept criticism from the body over its attempt to launch a satellite into orbit. North Korea also pledged to "never participate" again in six-country nuclear talks with the United States, South Korea, Japan, Russia and China, saying the negotiations had "turned into a platform" to persuade it to disarm and to destabilize its system of government. "We have no choice but to further strengthen our nuclear deterrent to cope with additional military threats by hostile forces," said North Korea's Foreign Ministry in a statement.
(go to web site)

"Control of Cybersecurity Becomes Divisive Issue"
New York Times (04/17/09) ; Risen, James; Lichtblau, Eric

Civil liberties and privacy groups are worried about the National Security Agency's efforts to take over the government's cybersecurity programs. An announcement about the government's new computer-security strategy, which will determine the scale of cybersecurity initiatives for the entire federal government, is forthcoming. However, the security agency's request to preside over the government's cybersecurity program is meeting resistance from critics inside and outside of the government. Among them is former director of the National Cyber Security Center at the Homeland Security Department, Rod Beckstrom, who resigned his post in protest to the NSA's campaign to play a larger role in the protection of the government's computer systems. Such a move would give the NSA. broad powers to gather and analyze every e-mail message, text message and Google search conducted by federal government employees, a responsibility Beckstrom argues should be divided among federal agencies. "I have very serious concerns about the concentration of too much power in one agency," he says. "Power over information is so important, and it is so difficult to monitor, that we need to have checks and balances."
(go to web site)

"False Security: 'Scareware' Spreads"
Wall Street Journal (04/15/09) ; De Avila, Joseph

Computer experts report a surge in fraudulent antivirus programs. Incidents of scareware infections, as the rogue antivirus software is known, rose 48 percent in the second half of 2008, according to a new report by Microsoft Corp. The Anti-Phishing Working Group said the number of scareware programs rose three-fold from July to December 2008. Dave Marcus, director of security research and communications at McAfee Inc.'s McAfee Avert Labs, expects those figures to increase this year because they are so lucrative. Scareware infiltrates computers when a user visiting legitimate Web sites is redirected to unrelated sites that offer to sell antivirus software. The scam begins when a phony scan of the user's computer identifies a malware infection and the user is instructed to download antivirus software to correct the problem for a fee of about $50. A user's Web browser and operating system are also subject to infection if they are not secure and up-to-date.
(go to web site)

"Twitter All Clear After Worm Wave"
BBC News (04/14/09)

The social networking site Twitter was hit with four waves of worm attacks over the weekend that infected tens of thousands of its users. The worm worked by infecting Twitter accounts and displaying unwanted messages that encouraged victims to click on a link to StalkDaily.com, a rival site. After victims clicked on the link, the same unwanted messages were sent out to the users' friends. The worm did not steal personal or sensitive information, though experts say it could have been written to do just that. "It would have been simple to integrate a Web browser exploit into this so that you could have done anything you wanted to the infected computer, including recording all keyboard strokes and capturing credit card details," said Mikko H. Hypponen, the chief research officer at the security firm F-Secure. He added that it was surprising that Twitter was vulnerable to the worm attack, since similar holes were found in sites such as Facebook and MySpace some time ago.
(go to web site)

"Industry Group Gives Government a Failing Grade in E-Mail Authentication"
Government Computer News (04/14/09) ; Jackson, William

Online Trust Alliance's study of the public DNS records of 25 government domains and 20 million emails that claim to have come from those domains has found that less than half of the 25 government agencies are using email authentication technology. The study found that only 11 of the 25 government domains were using the technology, which allows servers to verify that email traffic is coming from the domain or sender that it appears to be coming from and that the email's sender is allowed to use that domain. Among the agencies who were found to be using the technology are the U.S. Census Bureau, the Central Intelligence Agency, and the Social Security Administration. The White House, the Department of Homeland Security, and the FBI were among those who were not using email authentication. A similar study of commercial sites found that 55 percent were using some type of email authentication.
(go to web site)

"Report: SMBs Lack Sufficient Security Standards"
eWeek (04/13/09) ; Eddy, Nathan

A recent survey by the security firm Symantec has found that many small to medium-sized businesses (SMBs) fail to take even the most basic cybersecurity measures. For instance, one-third of the 1, 425 SMBs around the world who were surveyed by Symantec in the first quarter said they had not installed antivirus software on their computers. Another 59 percent said they had not implemented software that protects devices such as laptops, desktops, and servers from malware. In addition, the survey found that 42 percent of SMBs do not use an antispam solution. SMBs gave several reasons for why they had not implemented basic cybersecurity measures. Forty-two percent said they did not have a dedicated IT staff, while 41 percent said their employees did not have the skills to put protections in place. Money was also a factor. The median IT security budget among the SMBs surveyed was just $4,500 a year. Finally, the survey found that when SMBs suffer an IT loss, it typically occurs in an area where basic cybersecurity measures could have protected them, such as a system breakdown or hardware failure.
(go to web site)

Abstracts Copyright © 2009 Information, Inc. Bethesda, MD


  ASIS also offers a daily and a non-sponsored, special-content Professional Edition of
Security Newsbriefs. Please click to see a sample or to contact us for more information.

Unsubscribe | Change E-mail | Advertising Opportunities | Security Management Online | ASIS Online

No comments: