News – Page 59 – CyberSecurity Institute

SOURCEFIRE FIRST TO PROVIDE NEXT-GENERATION IPS WITH INTEGRATED APPLICATION CONTROL

Posted on February 27, 2012December 30, 2021 by admini

With application detection and control in a universal NGIPS platform, Sourcefire customers can easily construct integrated security policies that balance access controls with robust threat prevention to comprehensively address application-layer risks.

In addition to application control, features in the latest NGIPS release include FireSIGHT™ contextual awareness and automation .The ability to easily create tailored reports by providing input modifiers to report templates at run time to drill down on subsets of data.

“The battle for network security is based on the concept of information superiority, in which two of the most critical tenets are visibility and control,” said Martin Roesch, founder and CTO of Sourcefire. “A significant obstacle to establishing information superiority is the rapid pace of change – both within the IT environment and the broader threat landscape… While other vendors have a framework, our real-world solution has multiple components that work in tandem to allow us to first ‘see it’ and then ‘control it’ – and by so doing, gain the information superiority advantage.”

http://www.sourcewire.com/releases/rel_display.php?relid=70430

Number of Malicious Sites Increase by 240% in 2011

Posted on February 14, 2012December 30, 2021 by admini

The Blue Coat Security Labs team first discovered the existence of these malicious networks early in 2011 and presently is the only company to specifically identify, track and block them.

Malnets are distributed network infrastructures within the Internet that are built, managed and maintained by cybercriminals for the purpose of launching a variety of attacks against unsuspecting users over extended periods of time.

The Blue Coat 2012 Web Security Report details the strategies and tactics that malnet operators deploy to snare users and funnel them to dynamic malware payloads, or software which surreptitiously installs on users computers designed for malicious or criminal purposes.

“With the average business now facing 5,000 threats per month, identifying and tracking malnets to block attacks at the source before they are launched is the most effective protection.

According to the report, the most common entry point into these malicious infrastructures rely on the path of least resistance, utilizing entry points that are easy to exploit, such as search engines/portals and email, or are utilized by large, diverse populations of users.

The 2012 Web Security Report examines the malnet ecosystem in depth, examining user behavior, malnet strategies and tactics, as well as highlighting the best defenses against these aggressive infrastructures.

WebPulse is a cloud-based, real-time analysis and ratings service that unites users in a common defense.

Delivered via Blue Coat ProxySG® appliances and the Blue Coat Cloud Service, WebPulse receives one billion Web requests each day from 75 million globally diverse users.

http://www.it-analysis.com/technology/security/news_release.php?rel=29754

Service providers lack confidence in LEAs

Posted on February 9, 2012December 30, 2021 by admini

They are still rare, indicating that the slow uptake of IPv6 makes it “not yet economically or operationally significant enough to warrant serious attention by the Internet criminal underground.”

However, there has been a significant increase in large flood-based attacks in excess of 10 Gbps, constituting “an extremely serious threat to network infrastructure and ancillary support services such as DNS, not to mention end-customer properties.”

Two things that might surprise network customers are the providers’ concern over the effectiveness of stateful firewalls, IPS and load-balancing devices in the face of DDoS attacks, and what Arbor describes as the “perennial disengagement of most network operators from law enforcement.”

On law enforcement, network operators lack confidence in LEA’s ability and willingness to investigate online attacks, and “evince strong dissatisfaction with current governmental efforts to protect critical infrastructure.”

Is Your Lawyer the Weakest Link? Hackers Are Now Targeting

Posted on February 3, 2012December 30, 2021 by admini

According to the January 31, 2012 article entitled “China-Based Hackers Target Law Firms to Get Secret Deal Data,” the attacks have been sufficiently serious that the FBI’s cyber division convened a meeting with the top 200 law firms in New York City last November to address the rising number of law firm intrusions.

The hackers “zeroed in on offices on Toronto’s Bay Street, home of the Canadian law firms handling the deal.” According to the article:

http://www.hahnloeser.com/tradesecretlitigator/post/2012/02/03/Is-Your-Lawyer-the-Weakest-Link-Hackers-Are-Targeting-Law-Firms-to-Get-Secret-Deal-Data.aspx

New SEC security breach rules no big game changer, experts say

Posted on October 20, 2011December 30, 2021 by admini

“For example, if a registrant experienced a material cyber attack in which malware was embedded in its systems and customer data was compromised, it likely would not be sufficient for the registrant to disclose that there is a risk that such an attack may occur. Instead, as part of a broader discussion of malware or other similar attacks that pose a particular risk, the registrant may need to discuss the occurrence of the specific attack and its known and potential costs and other consequences,” the SEC explained.

David Navetta, a founding partner of the Information Law Group, and Nicole Friess, an associate at the law firm, wrote in their blog, “SEC Issues Guidance Concerning Cyber Security Incident Disclosure,” not to expect a wave of new public security breach disclosures from listed companies as a result of the SEC guidance. “While cyber security risk has always been a potential financial disclosure issue, and something that directors and officers need to take into account, the SEC guidance really highlights the issue and brings it to the fore. Even so, materiality is still going to a big issue, and not every breach will need to be reported as many/most will not likely involve the potential for a material impact to a company,” they wrote.

“It’s not as if companies are not already expected to report a breach that is material to earnings, such as Heartland, TJX, and many others have in the past. What the SEC has done is underline that IT security risks to materiality are no different than any other types of risks and need to be considered as such,” he says.

While we may not see a wave of new breach disclosures, Navetta and Friess estimate that many firms are not as prepared internally as they need to be in order to determine the potential impact of IT security breaches.

http://www.csoonline.com/article/691951/new-sec-security-breach-rules-no-big-game-changer-experts-say?source=CSONLE_nlt_update_2011-10-20

‘Indestructible’ rootkit enslaves 4.5m PCs in 3 months

Posted on June 30, 2011December 30, 2021 by admini

TDL-4 is endowed with an array of improvements over TDL-3 and previous versions of the rootkit, which is also known as Alureon or just TDL. As previously reported, it is now able to infect 64-bit versions of Windows by bypassing the OS’s kernel mode code signing policy, which was designed to allow drivers to be installed only when they have been digitally signed by a trusted source.

“The changes in TDL-4 affected practically all components of the malware and its activity on the web to some extent or other,” the Kaspersky researchers wrote in their report.

Like the Popureb trojan and the Torpig botnet (aka Sinowal and Anserin), it also infects the master boot record of a compromised PC’s hard drive, ensuring that malware is running even before Windows is loaded.

In the event there is a takedown of the 60 or more command and control servers used to maintain the TDSS botnet (hard but not impossible given the recent eradications of the Rustock and Coreflood botnets), the infected TDSS machines can receive instructions using a custom built Kad client.

The Kaspersky researchers were able to analyze the number of TDL-4 infections by exploiting a flaw that exposed three MySQL databases located in Moldova, Lithuania, and the US. Remarkably, the data revealed no Russian users, most likely because the affiliate programs that pay from $20 to $200 for every 1,000 TDSS infections don’t provide rewards for installations on computers based in Russia.

http://www.theregister.co.uk/2011/06/29/tdss_alureon_advances/