Search This Blog

Friday, May 08, 2009

Security Management Weekly - May 8, 2009

header

  Learn more! ->   sm professional  

May 8, 2009
 
 
CORPORATE SECURITY  
  1. " Flu Offers Lessons in Workplace Planning"
  2. " 10 Tips for Swine Flu Planning" There Are a Number of Steps Companies Can Take to Prepare for Possible Pandemic, Carolyn Duffy Marsan Writes
  3. " Administration Seeks to Ease Federal Aid for Terrorism Insurance"
  4. " With Piracy Odds in Their Favor, Ships Shun Armed Guards"
  5. " Wal-Mart Settles With Prosecutors in Trampling Death"

HOMELAND SECURITY  
  6. " Top Flu Expert Warns of a Swine Flu-Bird Flu Mix"
  7. " Swine Flu Cases Worldwide Exceed 2,300"
  8. " CIA Says It Briefed Congressional Leaders"
  9. " Pakistan Air Strikes Target Swat Taliban"
  10. " Justice Likely to Urge No Prosecutions"

CYBER SECURITY  
  11. " FAA's Air-Traffic Networks Breached by Hackers"
  12. " Cyber-Command May Help Protect Civilian Networks"
  13. " Zombie Computers 'on the Rise'" McAfee Report Finds 12 Million Computers Hijacked Since January
  14. " Apple, Opera Slammed Over Browser Patch Regimes"
  15. " Federal CISOs: Bad Economy Could Create Vulnerabilities"


   






 

"Flu Offers Lessons in Workplace Planning"
Tennessean (05/07/09) ; Johnson, Bonna

Experts say the swine flu outbreak can serve as a wake-up call for businesses to assess their preparedness for sudden crises. Few companies were prepared for the news of an imminent flu pandemic. The exception was BMI, an organization that collects license fees on behalf of songwriters, composers and music publishers, which had been planning its contingency strategy for 10 years. According to BMI Crisis Management Coordinator Dana Buse, essential BMI staffers are set up to work from home, and its 400-member staff is prepared to evacuate the company's six-story Music Row building in eight minutes. David Bartless with crisis management firm Levick Strategic Communications wonders whether businesses have honestly evaluated their emergency preparedness. "Have they given serious thought to what they would do if half their staff called in sick?," Bartless asks. A 2006 study by Challenger, Gray & Christmas Inc. suggests many have not. The study found that 66 percent of mid-size to large companies did not have emergency contingency plans, while 14 percent had "adequate" plans.
(go to web site)

"10 Tips for Swine Flu Planning"
Network World (04/29/09) ; Marsan, Carolyn Duffy

With the continuing outbreak of swine flu, companies and IT executives should examine their pandemic plans and prepare for the possibility of widespread employee absenteeism. Executives should stay calm and continue to be productive while practicing better hygiene as a model for their employees. All executives should be involved in planning for a pandemic, which involves the entire business. Emergency contacts and calling systems should be updated and tested, and companies should make sure they will have access to their data centers. Experts recommend that businesses perform a trial run of their telework plans and system to ensure a large number of staff can use it at the same time. Key employees should have broadband access, such as through mobile data cards, and Web-based applications should be up-to-date. Companies may want to cross-train their employees so they have enough people with the necessary skills and certifications to keep critical applications up and running, an important detail in regulated industries such as banking. A degradation plan, including lines of succession, will help companies prepare for the possibility of operating with far fewer employees. Executives also need to remember to ensure the safety of employees first before thinking about how the business will function in an emergency.
(go to web site)

"Administration Seeks to Ease Federal Aid for Terrorism Insurance"
Dow Jones Newswires (05/07/09) ; Randall, Maya Jackson

In the full budget plan released for fiscal year 2010, the Obama Administration has proposed reducing a federal subsidy for the property and casualty insurance industry beginning in 2011. That subsidy helps the property and casualty insurance industry pay for losses related to terrorism insurance payments made to commercial customers. According to the Obama Administration, the subsidy should be cut because there is new evidence that shows the property and casualty insurance market is better able to absorb losses from a terrorist attack. The administration is hoping the reduction in the subsidy, which is mandated under the 2002 Terrorism Risk Insurance Act, will encourage the private sector to take steps to mitigate terrorism, including building safer buildings.
(go to web site)

"With Piracy Odds in Their Favor, Ships Shun Armed Guards"
Christian Science Monitor (05/05/09) ; Lubold, Gordon

Shipping firms are unwilling to use armed guards to deter pirate attacks because the statistical probability of being hijacked is so slim, according to testimony given in a recent Senate hearing. Experts called to testify before a Senate panel on May 5 said less than half a percent of the ships that transit the Gulf of Aden are attacked by pirates, and of those, less than half are executed. As a result, shipping businesses are willing to accept the risk. "Many in the merchant shipping industry continue to assume, unrealistically, that military forces will always be present to intervene if pirates attack. As a result, many have so far been unwilling to invest adequately in basic security measure that would render their ships far less vulnerable," said Michele Flournoy, the Pentagon's chief of policy. Shipping firms say they are also hampered by legal rules governing the use of armed private security at port entries and insurance issues.
(go to web site)

"Wal-Mart Settles With Prosecutors in Trampling Death"
Wall Street Journal (05/05/09) ; Zimmerman, Ann

Wal-Mart has reached a settlement with the Nassau County, N.Y., District Attorney's office in the case of a temporary worker who was killed after being trampled by shoppers at a Wal-Mart store in Valley Stream, N.Y., last November. Under the agreement, which is expected to be announced Wednesday, Wal-Mart will improve the safety plans that are in place at its 93 stores in New York State. In addition, the agreement will provide funding for the victims, including the four other people who were treated for injuries sustained in the incident. No criminal charges are expected in the case.
(go to web site)

"Top Flu Expert Warns of a Swine Flu-Bird Flu Mix"
Associated Press (05/08/09) ; Mason, Margie

Dr. Robert Webster, a virologist at St. Jude's Children's Research Hospital who has been tracking the evolution of the current swine flu virus since a version of the strain sickened several people at a North Carolina pig farm in 1998, says health officials should be concerned about the possibility of the swine flu virus mixing with the bird flu virus. According to Webster, a new bug that is lethal and highly contagious could be created when the swine flu virus begins to appear in countries where the bird flu is endemic, such as Indonesia, Egypt, and China. Webster noted that it is possible the swine flu could combine with the bird flu because the current swine flu virus has shown an ability to pick up genetic material from other flu viruses. However, other experts say that they have yet to see evidence that such a scenario could happen. Others say that the more immediate concern is that the swine flu will combine with regular flu viruses when the flu season begins in the Southern Hemisphere.
(go to web site)

"Swine Flu Cases Worldwide Exceed 2,300"
New York Times (05/08/09) ; McNeil Jr., Donald G.

The World Health Organization reported Thursday that the number of confirmed cases of swine flu stood at 2,371, while the number of countries in which the disease had been confirmed stood at 24. In Europe, the number of swine flu cases had increased to roughly 150. But despite the increase, there is not enough evidence of sustained community transmission on the continent to justify a declaration of a pandemic by the WHO, said WHO assistant director general Dr. Keiji Fukuda. Meanwhile, scientists from the Centers for Disease Control and Prevention on Thursday described the cases of 11 individuals in the U.S. who were infected with the swine flu before the current outbreak began. Those cases, the first of which occurred in December 2005, appeared in young people in the Midwest who had either touched pigs or were near them. All of the infected individuals had a virus that combined human, swine, and avian flu genes. The current outbreak consists of a strain that has those genes as well as genes from Eurasian swine. All 11 patients recovered, though 4 had to be hospitalized, the scientists noted.
(go to web site)

"CIA Says It Briefed Congressional Leaders"
Wall Street Journal (05/08/09) P. A3 ; Gorman, Siobhan

An intelligence document released by the CIA shows that congressional leaders received thorough briefings on the agency's use of techniques such as waterboarding in its interrogation program. The document, which is based on several files and meeting summaries written at the time of the briefings, shows that a total of 40 briefings on the use of the interrogation techniques were provided to lawmakers on congressional intelligence, judiciary, and other panels. In the first of those meetings--which was provided to former House Intelligence Committee Chairman Porter Goss (R-Fla.) and Speaker of the House Nancy Pelosi (D-Calif.), who at the time was the committee's ranking Democrat, on September 4, 2002--lawmakers were briefed on a variety of topics related to the use of "enhanced interrogation techniques," including the use of those techniques on terrorism suspect Abu Zubaydah. Lawmakers were also given background information on legal authority and a description of the specific techniques that had been used. The document seems to support claims by Republicans that Pelosi and other lawmakers were informed about the CIA interrogation program and had a chance to object but chose not to. But a spokesman for Pelosi said Thursday that the speaker stands by the statement she made last month in which she said she was briefed that certain interrogations were legal and could be used but was not told that they would be used.
(go to web site)

"Pakistan Air Strikes Target Swat Taliban"
Guardian Unlimited (UK) (05/08/09) ; Walsh, Declan

Pakistan's army has stepped up its military offensive against Taliban militants in the Swat Valley with air strikes. In what many believe is a precursor to a ground offensive similar to the one occurring in the nearby Dir and Buner districts, Pakistani jets launched an air attack against suspected militants in the Taliban-controlled Swat area shortly after sunrise on May 6. Prime Minister Yousaf Raza Gilano explained the military's actions in a television address, saying the army had been summoned "to restore the honor and dignity of our homeland. We will destroy those elements who have destroyed the peace of our people and our nation." Over 45,000 Pakistanis have fled the north-western Swat valley and surrounding districts since the air raids began. Several militants were killed when a rocket hit a house they were held up in.
(go to web site)

"Justice Likely to Urge No Prosecutions"
Wall Street Journal (05/06/09) P. A4 ; Perez, Evan

An internal Justice Department probe into the four department memos that authorized the use of certain interrogation techniques on terrorism suspects is likely to recommend that professional sanctions be imposed on the authors of those documents instead of criminal prosecutions. Among the sanctions that could be placed on the memo's authors--John Yoo and Jay Bybee, who served as lawyers in the Justice Department during the Bush administration--is disbarment, according to a draft version of a report on the probe. Both Yoo and Bybee--who now work as a professor at the University of California, Berkeley and an appeals-court judge, respectively--responded to the draft version of the report by the May 4 deadline. The Justice Department's Office of Professional Responsibility is examining Yoo and Bybee's responses and will make revisions to the draft report if necessary before seeking a final review from Attorney General Eric Holder. President Obama has left it up to Holder to decide whether or not to prosecute Yoo and Bybee for writing the memos that authorized the use of the interrogation tactics, which some have described as torture. The Obama administration is wary of prosecuting the lawyers because of fears that a trial could be a distraction from priorities such as the economy and health care reform.
(go to web site)

"FAA's Air-Traffic Networks Breached by Hackers"
Wall Street Journal (05/07/09) ; Gorman, Siobhan; Conkey, Christopher

The U.S. Transportation Department's inspector general released a report on May 6 that said the U.S.'s civilian air-traffic computer networks had been breached a number of times during the last several years. One of those breaches, which occurred in 2006, forced the U.S. Federal Aviation Administration (FAA) to shut down part of its traffic control systems in Alaska. The report said the shut down occurred after the attack spread from administration networks to air-traffic control systems, although FAA spokesperson Laura Brown maintains the breach only affected the local administrative system that provides flight and weather information to pilots. The report also noted that hackers were able to take over FAA computers in 2008 and use the agency's networks to steal the passwords of network administrators in Oklahoma. This in turn allowed the hackers to install malicious code and steal 40,000 FAA passwords and other information used to control the administrative network, the report found. The report concluded that the FAA is not well equipped to detect breaches into its computer systems, and that when it does discover intrusions it does not address them quickly enough. Brown said the FAA is currently working on addressing a number of weaknesses in its computer systems, including scanning software for possible vulnerabilities. "The threat of hackers interfering with our air-traffic control systems is not just theoretical; it has already happened," says Rep. Tom Petri (R-Wisc.), one of the lawmakers who requested the report. "We must regard the strengthening of our air-traffic control security as an urgent matter."
(go to web site)

"Cyber-Command May Help Protect Civilian Networks"
Washington Post (05/06/09) P. A4 ; Nakashima, Ellen

The U.S. Pentagon is considering establishing a new cybercommand to oversee government efforts to protect military computer networks and to assist in protecting civilian government networks, says National Security Agency (NSA) director Lt. Gen. Keith B. Alexander. The new command would focus on better protecting U.S. military computers by combining the offensive and defensive capabilities of the military and the NSA. The NSA also wants to provide technical support to the U.S. Department of Homeland Security (DHS), which is responsible for protecting civilian networks from cyberattacks. Alexander says it makes sense for DHS and the Defense Department to use the same security technology. Former top DHS cybersecurity official Amit Yoran says the NSA has significant depth and expertise, but cautions that the effort must be transparent. "DHS needs to be very, very cautious about its participation in a program like that because you could fundamentally erode the trust DHS needs in order to be successful in its broader security mission," Yoran says. Any effort involving the NSA that goes beyond protecting military networks requires careful legal analysis, according to Yoran. Alexander says a variety of questions need to be answered before attempting a partnership with DHS, including what is the framework for sharing classified threat signatures, how to operate at network speed in a defendable manner, and what is the legal and operational framework.
(go to web site)

"Zombie Computers 'on the Rise'"
BBC News (05/06/09) ; Shiels, Maggie

A report issued by McAfee has found that 12 million computers have been hijacked by cybercriminals since January, a figure that is 50 percent higher than it was in 2008. However, McAfee said the actual number of PCs that have been compromised by hackers during the past four months is likely higher. In addition, McAfee's report found that the United States has 18 percent of the world's infected computers, which is more than any other country in the world. China came in second with 13 percent. The release of the McAfee report comes at about the same time as the release of a report from Deloitte Touche Tohmatsu that called on countries throughout the world to adopt a unified approach to cybersecurity. However, the report noted that a piecemeal approach to cybersecurity is becoming more popular. Deloitte's Greg Pellegrino says the report found that "there was a similar tone and awareness and leadership effort coming from different countries across the world." Both the United States and Canada, for example, have completed reviews of their cybersecurity strategies.
(go to web site)

"Apple, Opera Slammed Over Browser Patch Regimes"
IDG News Service (05/06/09) ; Kirk, Jeremy

The lengthy process for installing Apple and Opera updates deters users from keeping their updates current, according to new research from the Swiss Federal Institute of Technology (ETH Zurich) and Google Switzerland. Unlike Google and Mozilla, Apple requires Safari 3.2 users to download a Tiger or Leopard operating system update before applying new browser patches, which extends the repair process. ETH Zurich researcher Stefan Frei and Google Switzerland's Thomas Duebendorfer found that close to half of all Safari 3.x users wait more than three weeks to apply updates. Only one-third of Safari 3.2 users install the updates within 21 days of their release, the report says. Opera scans for updates weekly, but users must go through the installation process each time an update is issued. Fewer than one in four active Opera users downloads the updates in a timely manner, so the browser maker plans to include an auto-update feature in the upcoming version 10. Ninety-seven percent of Google Chrome users install updates within three weeks of release, due largely to the browser's automatic "silent update" feature. Mozilla Firefox users are the second-most secure, with about 85 percent downloading the updates within 21 days of their release.
(go to web site)

"Federal CISOs: Bad Economy Could Create Vulnerabilities"
IDG News Service (04/30/09) ; Gross, Grant

A recent survey by the International Information Systems Security Certification Consortium (ISC2) found that 43 percent of federal chief information security officers (CISOs) believe that the recession will create more security vulnerabilities for their agencies. ISC2's Lynn McNulty believes CISOs are concerned the poor economy will result in budget cuts and IT vendors not patching their software as often as they used to. In addition, nearly half of the CISOs who took part in the survey said outsider threats were their biggest concern, compared with just 26 percent who said the same about insider threats. McNulty says federal CISOs are likely more concerned about outsider threats because they may have experienced a large number of attacks from foreign hackers. Finally, about half of the CISOs surveyed said the federal government is making progress in its efforts but is still not getting ahead of attackers, while the other half said the government is "turning the corner."
(go to web site)

Abstracts Copyright © 2009 Information, Inc. Bethesda, MD


  ASIS also offers a daily and a non-sponsored, special-content Professional Edition of
Security Newsbriefs. Please click to see a sample or to contact us for more information.

Unsubscribe | Change E-mail | Advertising Opportunities | Security Management Online | ASIS Online

No comments: