Friday, May 15, 2009

Security Management Weekly - May 15, 2009

header

  Learn more! ->   sm professional  

May 15, 2009
 
 
CORPORATE SECURITY  
  1. " Steelworkers Attack ArcelorMittal"
  2. " Crash Probe Examines Pilot Fatigue"
  3. " To Protect and Serve" Although Small Businesses Can Benefit by Outsourcing Network Security Services, They Can Also Lose Control and Flexibility
  4. " Business Still Booming for One Industry: Shoplifting"

HOMELAND SECURITY  
  5. " Unease Grows for Democrats Over Security"
  6. " A Flap Over Masks"
  7. " Swine Flu May Be Human Error; WHO Investigates Claim" Australian Researcher Claims Virus May Have Accidentally Evolved in Lab
  8. " Obama Moves to Bar Release of Detainee Abuse Photos"
  9. " New Virus Could Still Mutate, Spark Pandemic: WHO"

CYBER SECURITY  
  10. " Obama Aides Debate Role of Proposed Cyber Czar"
  11. " Hard Questions in Wake of Reputed Health Data Theft" Virginia
  12. " Tracking Cyberspies Through the Web Wilderness" Sniffer Programs Help Track Cybercriminals
  13. " Cadets Trade the Trenches for Firewalls" West Point and Other Military Academies Participate in Cyberwar Games to Teach Cadets How to Respond to Cyberattacks
  14. " Cybercrooks Profit by 'Squatting' on Brand Names"
  15. " Researchers Find Missile Defense Data on Used Hard Drive"


   






 

"Steelworkers Attack ArcelorMittal"
Wall Street Journal (05/13/09) P. B1 ; Matthews, Robert Guy

ArcelorMittal's employees are protesting the closure of steel plants in the United States and Europe, even as the company plans to shrink steel production by an additional 20 percent this year. Attendees to the company's annual shareholders meeting in Luxembourg on May 12 were met with violent demonstrations by approximately 1,000 steelworkers from the company's facilities in Belgium and France. ArcelorMittal CEO Lakshmi Mittal told shareholders that consumers are buying less new steel and are instead using existing resources, making the production of new steel unnecessary. Though he did not give specific details, Mittal said he plans to close more of the company's factories in Europe because they have higher labor costs and are farther removed from the mines that produce the raw materials. Plants in those markets are also closely affiliated with the automobile industry, which has taken numerous hits in the past year. A steel union in Chicago launched a non-violent protest in early May after ArcelorMittal permanently closed its plant in Hennepin, Illinois.
(go to web site)

"Crash Probe Examines Pilot Fatigue"
Wall Street Journal (05/14/09) ; Pasztor, Andy

A federal investigation into the deadly crash of a Colgan Air twin-engine turboprop near Buffalo, N.Y., this year is raising broad questions about the flight training and working conditions for pilots at regional airlines across the country. A National Transportation Safety Board hearing on May 13 revealed that the pilot and co-pilot of the ill-fated plane were low-paid, had to commute hundreds of miles to work, and probably were fatigued as they made the evening flight Feb. 12 from Newark, N.J. On approaching Buffalo, the Bombardier Dash 8 Q400 went into a stall that the pilots were unable to correct. Fifty people died in the worst transportation accident in the United States in seven years. Co-pilot Rebecca Shaw had flown overnight from her home in the Seattle area, changing planes in Memphis, Tenn., before dawn. By the time she got to Newark International Airport in New Jersey at 6:30 a.m. on the day of the crash, she was eager for some rest. She told a fellow pilot, "there was a couch in [the airport] crew room which had her name on it," Kitty Higgins, a member of the National Transportation Safety Board, said at the hearing. Mary Finnigan, Colgan's vice president for administration, said the airline paid Rebecca Shaw, the co-pilot, $16,200 a year. The board disclosed that Shaw once supplemented her salary by with a second job in a coffee shop. Including the Buffalo accident, 135 people have been killed in five crashes involving regional airlines since 2002. NTSB officials looking into the crashes found pilot fatigue, high turnover rates among pilots, and a pattern of sloppiness at the airlines.
(go to web site)

"To Protect and Serve"
Wall Street Journal (05/11/09) ; Cheng, Roger

Outsourcing network security services to a third-party vendor is an attractive option for small business owners who do not possess the resources or know-how to do the job themselves. However, what businesses gain through cost savings they lose in security control and flexibility. Anita Miller hired a third-party vendor to handle network security at her Ideal Image Development Inc. franchise in Scottsdale, Ariz., to meet customer confidentiality standards under the Health Insurance Portability and Accountability Act (HIPAA). For $2,000 a month, Qwest Communications International Inc. of Denver provides a firewall for the system and deflects unwanted spam, in addition to detecting for suspicious activity. Qwest's security services bundle includes a phone line and a high-speed Internet connection. Companies with the expertise to set up firewalls may hire an outside vendor to fill in the security gaps. Fieldglass Inc. Security Manager Jim Krev had this in mind when he hired Verizon Communications Inc. to regularly scan his Chicago-based company's workforce management software for vulnerabilities that hackers could exploit. Monthly rates per customer vary between $1.90 for one service and $3.90 for the full package, which includes virus protection and content and spam filtering.
(go to web site)

"Business Still Booming for One Industry: Shoplifting"
Washington Times (05/11/09) P. A1 ; Harper, Jennifer

Statistics released by several organizations show that shoplifting is on the rise across the country. According to the Retail Industry Leaders Association, 61 percent of the nation's largest retailers and chain stores have seen increases in "opportunistic" shoplifting over the past four months. Another 75 percent of retailers said they had experienced a significant increase in "organized retail crime," or large-scale shoplifting. In addition, the RILA found that no retailers had experienced declines in shoplifting. Meanwhile, the Tennessee Bureau of Investigations has reported that shoplifting has risen by 30 percent in the state, while Michigan authorities say shoplifting is up 27 percent in the Great Lakes area. The increase in shoplifting is troublesome because thefts of merchandise and the subsequent sale of these items can be used to fund more serious crimes. According to the RILA, assassination attempts on federal prosecutors and police in Texas were funded by the thefts of more than $1 million in baby formula by gangs. The problem has caught the attention of lawmakers in Washington, including Sen. Richard J. Durbin (D-Ill.) Durbin recently introduced the Combating Organized Retail Crime Act of 2009, which aims to fight shoplifting. A number of states have also taken action by increasing funding for law enforcement and by making shoplifting a Class 4 felony instead of a misdemeanor.
(go to web site)

"Unease Grows for Democrats Over Security"
New York Times (05/14/09) ; Herszenhorn, David

President Barack Obama's national security policies are drawing increasing concern from Congressional Democrats, many of whom worry about the major commitment made in Afghanistan and the issue of how to deal with prisoners held at Guantanamo Bay. While it is almost certain that the Democratic majorities, with solid Republican support, will approve $96.7 billion in spending for the wars in Iraq and Afghanistan and for other military operations, the unease expressed by Democrats points to a harder road ahead for the Obama administration. Representative David Obey (D-Wis.), the House Appropriations Committee chairman, warns that Democrats will most likely give the administration just one more year to get a handle on the military situation there before they start losing patience. "With respect to Afghanistan and Pakistan, I am extremely dubious that the administration will be able to accomplish what it wants to accomplish," Obey says. "The problem is not the administration's policy or its goals. The problem is that I doubt that we have the tools there that we need to implement virtually any policy in that region." The House spending bill requires that the Obama administration deliver a report early next year on progress in Afghanistan and Pakistan, though it does not set any benchmarks for American military performance. Representative John P. Murtha (D-Pa.), chairman of the defense appropriations subcommittee, says the administration had not provided a clear enough plan to reassure lawmakers about the operations in Afghanistan. "We keep asking for a plan,” Murtha says. "I think the Democrats are nervous just because they haven't seen a plan yet." Murtha also cautions the administration about taking any steps that would prolong the operations in Iraq, adding that debate over the administration's national security policies will only intensify over the next few weeks as Congress begins to consider the full military authorization bill for next year.
(go to web site)

"A Flap Over Masks"
Washington Post (05/15/09) P. A17 ; Franke-Ruta, Garance

Legislators scolded the Department of Homeland Security on May 14 for its "lame" enforcement of health codes that left some Customs and Border Protection (CBP) agents along the U.S./Mexico border unprotected from swine flu pathogens. Elaine C. Duke, the department's undersecretary for management, told lawmakers in a House subcommittee that the department followed recommendations from the Centers for Disease Control and Prevention (CDC) and other federal health agencies. She admitted to committee members that some CBP supervisors did not permit agents to wear masks as they screened passengers entering the United States. Some committee members accused the department of overlooking employee safety in order to meet bureaucratic requirements.
(go to web site)

"Swine Flu May Be Human Error; WHO Investigates Claim"
Bloomberg (05/13/09) ; Gale, Jason; Bennett, Simeon

Australian researcher Adrian Gibbs is claiming that the swine flu virus that is spreading across the globe may have accidentally evolved in eggs scientists use to grow viruses and drug manufacturers use to make vaccines. According to Gibbs, the new strain of swine flu is the product of two separate lineages of flu viruses that have spread among pigs in North America and Europe for more than 10 years. An analysis by Richard Webby, a virologist at St. Jude Children's Research Hospital in Memphis, came to a similar conclusion. Gibbs also noted that he has found that the rate of genetic mutation in the swine flu virus is about three times faster that that of the most closely related viruses in pigs--a finding that he said suggests the new virus evolved outside of swine. Gibbs added that he has no evidence that the swine flu was deliberately made in order to cause harm. The World Health Organization is currently reviewing Gibbs's study. The Centers for Disease Control has already reviewed the findings, and has said that there is no evidence to support Gibbs's conclusion.
(go to web site)

"Obama Moves to Bar Release of Detainee Abuse Photos"
New York Times (05/13/09) ; Zeleny, Jeff; Shankler, Thom

President Obama announced Wednesday that he was backtracking on his decision to release photos depicting the abuse of prisoners in Iraq and Afghanistan at the hands of U.S. military personnel. In announcing his decision, Obama said the release of the photos--which had been sought by the American Civil Liberties Union--would only to serve inflame anti-American opinion and endanger U.S. troops in Iraq and Afghanistan. Obama's announcement was criticized by the ACLU, which recently came to an agreement with the government to release the photos on May 28. Anthony D. Romero, the executive director of the ACLU, said the photos needed to be released because they documented abuse that was worse than what was seen at Abu Ghraib, the prison in Iraq where U.S. military personnel photographed prisoners naked or in degrading positions. Romero also noted that the fact that are 2,000 images that the Pentagon is not releasing shows that abuse can no longer be blamed on "a few bad apples" and that policies allowing for the abuse of prisoners were "set at the highest level." Despite Obama's decision, litigation over the photos is continuing.
(go to web site)

"New Virus Could Still Mutate, Spark Pandemic: WHO"
Reuters (05/12/09) ; Nebehay, Stephanie

The World Health Organization has issued a report that says that the swine flu virus could change from a mild strain to a more powerful form over the next several months. The report, which is entitled "Assessing the Severity of an Influenza Pandemic," noted that while the virus has only caused very minor illnesses in otherwise healthy people, flu viruses tend to mutate frequently and unpredictably and that a stronger version of the virus could develop over the course of a pandemic. The 1918 flu pandemic, for example, began as a mild virus and returned six months later in a deadlier form, the report noted. Tens of millions of people were ultimately killed in that pandemic. The WHO also noted in its report that in the event there is a swine flu pandemic, the virus could circle the globe two or three times. The impact of such a pandemic would vary. The report noted that countries with weak and poorly equipped hospital systems and drug shortages could see "devastating" outbreaks, while countries with good health systems could see only mild illnesses.
(go to web site)

"Obama Aides Debate Role of Proposed Cyber Czar"
Washington Post (05/13/09) P. A6 ; Nakashima, Ellen; Hsu, Spencer S.

The U.S.'s leading security officials want President Obama to create a new White House cybersecurity czar as part of the National Security Council, who would be charged with protecting both public and private-sector computer networks, sources say. Meanwhile, at a recent cabinet meeting, other officials said the new cyberczar also should report to the National Economic Council. At the end of the cabinet meeting, Obama aides concluded that the new cyberczar's role, which is a deputy assistant to the president, would be limited to security and not broader cyberpolicy issues such as tax or antitrust matters. The review of the position has led to significant debate over how much power to give the position. "The United States must treat cybersecurity as one of the most important national security challenges it faces," according to a report issued by a commission formed by the Center for Strategic and International Studies. The report recommended the president appoint an assistant and establish a National Office for Cyberspace to oversee Homeland Security and intelligence community cyberoperations. However, jurisdiction fights have complicated the review, which was supposed to last only 60 days but has been ongoing for three months. "The bottom line is, whatever title this person has, if they don't have real authority, then they will not be effective," says Richard A. Clarke, a security adviser to the administrations of Bill Clinton and George W. Bush.
(go to web site)

"Hard Questions in Wake of Reputed Health Data Theft"
Washington Post (05/13/09) P. B2 ; Kumar, Anita

Several Virginia officials appeared before the commonwealth's House Appropriations Committee on May 11 to answer lawmakers' questions about the recent breach of a database in which hackers purportedly stole 8 million patient records and 35 million prescriptions. The purported theft was uncovered April 30, when state officials learned that hackers had placed a note on the database's home page demanding $10 million by May 7 in exchange for the password needed to retrieve the records. The hackers also threatened to sell the records to the highest bidder if the ransom was not paid. Officials in Virginia did not pay the ransom. However, it remains unclear whether the hackers made good on their threat to sell the data, or even if they were actually able to steal the information at all. Although the database—which was created in 2003 to help doctors and pharmacies track and reduce the abuse, theft, and illegal sale of certain narcotics and painkillers—was supposed to have been secure, the breach indicates that proper security measures were likely not in place, Del. Joe T. May said at the hearing. But Pat Paquette, the technology director for the Department of Health Professions, said security measures were in place at the time of the breach and have always been in place. The database's computer system was shut down in the wake of theft, though all data was backed up and secured, said Sandra Whitley Ryals, the director of Virginia's Department of Health Professionals. The FBI, the U.S. attorney's office, and Virginia State Police are still investigating the breach.
(go to web site)

"Tracking Cyberspies Through the Web Wilderness"
New York Times (05/12/09) P. D3 ; Markoff, John

The Internet is rife with cybercriminals and online eavesdroppers, and countering this threat is the job of cybersleuths. One of the key tools in cybersleuths' arsenal is sniffer programs that can sort out and decode scores of common Internet protocols that are used for all kinds of data communications. One such sniffer is Wireshark, a free and easy to use open source software program. Wireshark was used by the University of Toronto's Information Warfare Monitor research team to uncover evidence that the Dalai Lama's office had been compromised by Ghostnet, a surveillance operation that may possibly be run by the Chinese government. The biggest challenge to cyberforensics is the issue of attribution, or determining who precisely is spying, stealing data, or perpetrating other kinds of cybermischief. The Toronto researchers are seeking to address this problem through a fusion methodology in which Internet data is studied in the context of real world occurrences. "We had a really good hunch that in order to understand what was going on in cyberspace we needed to collect two completely different sets of data," says social scientist Rafal Rohozinski. "On one hand we needed technical data generated from Internet log files," Rohozinski says. "The other component is trying to understand what is going on in cyberspace by interviewing people, and by understanding how institutions work."
(go to web site)

"Cadets Trade the Trenches for Firewalls"
New York Times (05/11/09) P. A1 ; Kilgannon, Corey; Cohen, Noam

Throughout the U.S. military there is heightened awareness that the threat of a computer attack is just as urgent as a physical attack, and that military units must be trained to counter it. In April, cadets at West Point and other military academies participated in annual cyberwar games in which teams had to set up secure computer networks and defend them against attacks engineered by the National Science Foundation (NSF). Last year, the Army set up the Network Warfare Battalion, which many of the cadets in the cyberwar games hope to be assigned to. Meanwhile, Nellis Air Force base in Nevada is home to the 57th Information Aggressor Squadron, a group of hackers who use the latest offensive software--some of which was developed by NSF cryptologists--to probe military computer networks for chinks in their armor. Only 80 students graduate each year from the Defense Department's cyberwar schools, but the current Pentagon budget proposals seek to boost the number of students cycled through the schools by 400 percent in the next two years. Defense Secretary Robert M. Gates says the Pentagon is "desperately short of people who have [cyberdefense] capabilities in this area in all the services, and we have to address it." Establishing a secure Internet link is an early priority for military units when they deploy in combat zones or during a domestic emergency.
(go to web site)

"Cybercrooks Profit by 'Squatting' on Brand Names"
USA Today (05/11/09) P. 1B ; Howard, Theresa

Cybersquatting appears to be growing increasingly popular. According to MarkMonitor's Brand Jacking Index, the number of daily instances of cybersquatting against 30 of the top global brands jumped from 382,246 in 2007 to 449,484 last year, an increase of 17 percent. The company also says that cybersquatting cost marketers around the world roughly $175 billion in lost revenue. "When the economy goes south, white-collar criminals don't quit," says MarkMonitor's Fred Felman says. The increase in cybersquatting has been attributed to the growing use of search engine optimization among marketers trying to reach consumers online. But despite the increase in cybersquatting, many marketers are not investing large amounts of money to protect their brands. A study by the Chief Marketing Officer Council found that 52 percent of marketers spend less than $100,000 on brand protection each year, while just 2.7 percent spend $5 million or more. "We're at a point in which marketers need a wake-up call in what's happening to their brand," says the council's Liz Miller. "Marketing is in the dark, and cybercriminals are ramping up their game."
(go to web site)

"Researchers Find Missile Defense Data on Used Hard Drive"
Dark Reading (05/08/09) ; Wilson, Tim

Researchers at the University of Glamorgan in Scotland recently purchased 300 random hard disks at computer fairs and online auctions in the United States, Britain, Germany, France, and Australia, and found personal or sensitive data on 34 percent of the drives. A variety of different types of information was found on the drives, including the test-launch procedures for the U.S. Terminal High Altitude Area Defense, a ground-to-air missile defense system built by Lockheed Martin. The drive, which was bought on eBay, also included information about Lockheed Martin's security policies as well as data about employees. Officials at Lockheed Martin say they have no knowledge of a security breach. Researchers also found hard drives containing data from companies such as Laura Ashley and Ford Motor and medical records from Britain's Lanarkshire National Health Service agency. BT's Andy Jones says the findings underscore the fact that most organizations and individuals have no idea of how much and what type of information is stored on computer hard drives.
(go to web site)

Abstracts Copyright © 2009 Information, Inc. Bethesda, MD


  ASIS also offers a daily and a non-sponsored, special-content Professional Edition of
Security Newsbriefs. Please click to see a sample or to contact us for more information.

Unsubscribe | Change E-mail | Advertising Opportunities | Security Management Online | ASIS Online

No comments:

Post a Comment