Category: News

“Six years ago attackers targeted operating systems and the operating system vendors didn’t do automated patching. Now the attackers are targeting popular applications, and the vendors of those applications do not do automated patching. ” During a press conference, Paller added, “These applications, other than AV, don’t have automated patching.”

In recent years, the institute said a majority of attacks targeted operating systems like UNIX and Windows and Internet services like Web servers and mail systems.

“The most noticeable set of applications targeted by attackers are the backup and recovery tools as well as antivirus and other security tools that most organizations think are keeping them safe from attacks and from loss of data,” the institute said. These include backup software, antivirus software, database software and even media players.

During the Tuesday morning press conference, Dhamankar said the threats that worry him the most are those targeting the Web browsers and media players — including Microsoft Media Player and Macromedia Flash. “The US-CERT received reports of important system compromises using vulnerabilities in backup products within a few days of the public disclosure of vulnerabilities in those products,” he said.

SANS said another worrying trend this year has been the fresh attention given to critical security holes in network devices like the routers and switches that keep traffic moving across the Internet.

http://searchcio.techtarget.com/originalContent/0,289142,sid19_gci1148491,00.html

The temptation for IT departments to become digital detectives and deal with a breach of security in house is understandable, says Tobias, as companies worry about investor confidence, company reputation and business in general.

CY4OR’s guide to crime scene investigations Treat the matter seriously.
– Tell your legal team not your colleagues about your suspicions.
– Do not inform your IT department. Instead, hire computer forensic experts.

Professional analysts from reputable companies adhere to ACPO (Association of Chief Police Officer) guidelines, can identify digital evidence quickly and ensure that it will stand up in court by following the correct procedures. They can even image your computers at night, to avoid inevitable discussions by the water cooler.

The principle of forensics which says that “every contact leaves a trace” cannot be emphasised enough, says Tobias.

http://www.theregister.co.uk/2005/11/18/csi_forensics_gaffe/

Combining CMP’s current portfolio of Computer Security Institute (CSI), Secure Enterprise magazine and the Security Pipeline website with Black Hat, will position CMP Media as the strongest platform in the computer security media market.

Black Hat was launched in 1997 by Jeff Moss to provide advanced education to security professionals within global corporations and federal agencies.

“This move will enable Black Hat to take advantage of growth opportunities we couldn’t pursue as a small company, such as international expansion, while enabling me to keep doing what I love the most — working with speakers and building the conference programs,” Jeff Moss added.

About CMP Media Through its market-leading portfolio of trusted information brands in the technology, healthcare and entertainment industries, CMP Media has earned the confidence of more professionals and enthusiasts in these fields than any other media company.

http://www.americanventuremagazine.com/news.php?newsid=525

Results also show that nearly half (48 percent) say they have sent or received joke e-mails, funny pictures/movies, funny stories of a questionable tone.

While 73 percent of the respondents indicated that they are aware of corporate e-mail policies, less than half (46 percent) claimed they always adhere to the policy.

41 percent indicated they would prefer to keep important e-mails indefinitely, most businesses place limits on the amount of e-mail that can be stored. And such limitations may be leading to practices that could jeopardize security.

The survey reported that half the respondents have saved e-mail outside the corporate network.

http://www.securitypipeline.com/news/174300713

“The exposure of these systems to malicious actors in cyberspace is greater than in the past, because these systems are more often connected to the Internet,” Purdy said in an interview with SecurityFocus.

Because SCADA and other types of control systems regulate real world activity, such as the amount of water flowing though a dam or the electricity flowing through a transformer, their lack of security has worried experts for some time. Yet, in the past few years, attacks by external sources, such as online attackers, have jumped to 70 percent of incidents involving SCADA systems, up from 31 percent of incidents recorded between 1980 and 2001, according to a paper published by the British Columbia Institute of Technology. Sources interviewed for this article maintained that there have been SCADA system attacks, but such incidents are almost never made public. And U.S. authorities investigated online reconnaissance of U.S. critical infrastructure systems by attackers thought to be linked to al Qaeda in Pakistan, Saudia Arabia and Indonesia. However, other breaches have happened and the industry has paid the price for secrecy, said Lori Dustin, vice president of marketing and services for control system maker Verano.

Nearly 1,700 of the 3,200 power utilities have some sort of SCADA system in place, according to a recent survey by industry researcher Newton-Evans. The older networks of control systems have not adapted well to the needs of a deregulated power industry, Samuel Varnado, director of the Information Operations Center at Sandia National Labs stated in written testimony to the Congressional subcommittee. Sandia has demonstrated a way to use SCADA system vulnerabilities to turn out the lights in most major cities, Varnado told the subcommittee last week.

In 2006, the DHS plans on releasing a document outlining the best practices for control-system operators through the Cybersecurity Protection Framework.

http://www.securityfocus.com/news/11351

“Certainly, the criminal behavior that happens today is the greatest risk,” said Jonathan Zar, senior director at SonicWall Inc. and chairman for outreach at VOIPSA, which has more than 100 members from the hardware, software and telephone carrier businesses.

In an initiative reminiscent of the industry’s lobbying campaign leading up to the ineffectual CAN-SPAM Act of 2003, VOIPSA is trying to direct policy-makers’ attention away from the technologies that enable new headaches for users and turn the spotlight on human behavior. The distinction between the human action behind threats to VOIP and their technical means is meant to dissuade policy-makers from imposing technology-related rules that could hinder growth and innovation in the industry.

“There is a policy and regulatory effort under way, and a number of us have been concerned that that was not informed,” said Zar in Sunnyvale, Calif. “We want it to be secure, but we don’t want it to be as secure as East Germany was under the Stasi.”

In addition to the vulnerabilities inherited from data networking, a number of VOIP-specific threats confront calls carried over IP. Privacy advocates, who widely rate Congress’ action to reduce e-mail spam as ineffective, argue that more needs to be done to protect consumers. “What often is missed with social irritants like spam and telemarketing is that they are a product of privacy violations,” said Chris Hoofnagle, director and senior counsel at the Electronic Privacy Information Center, in Washington.

Lessons learned from the ongoing problem of e-mail spam likely will help the industry reduce the risks to VOIP, said Ray Everett-Church, chief privacy officer and senior consultant at Philadelphia-based ePrivacy Group. “With the current deployment of VOIP systems, you’re not seeing nearly the risk of spam that you saw very quickly with the rise and popularity of e-mail,” Everett-Church said.

http://www.eweek.com/article2/0,1895,1876547,00.asp