Targeted Attacks on the Rise

Posted on by admini

“Previously, they may have been lost in the general noise of one to two million pieces of malware per day,” the report states. “Target organizations are those with data worth stealing,” the report says.

“One gang has been using the same two attack files since November 2006,” the report says. The Taiwan gang changes its source IP address frequently, making it hard to detect, MessageLabs says. The IP address hosting the Web server that dishes out the malware is registered to China United Telecommunications Corp. in Beijing. Emails from the Taiwan gang are not particularly attractive, generally showing only a string of unreadable characters and carrying attachments.

Many antivirus applications do not yet detect the Trojan, according to the messaging security company.

http://www.darkreading.com/document.asp?doc_id=122009&WT.svl=news2_5

Read more

Internal IT Threats in Europe 2006

Posted on by admini

Key conclusions
– Europe’s IT professionals overwhelmingly indicate (78%) that data theft represents the primary information security threat – more significant than either viruses or hacker infiltration
– Of all possible results of compromised information security, the threat of leakage of confidential information is keeping more members of the IT department (93%) awake at night than any other
– Europe’s primary data leakage channels are identified as portable storage devices, e-mail, and Internet-based channels such as web-mail and forums
– Only 11% of those surveyed were confident their company’s information security had not been breached over the last year – a figure which closely mirrors the number of companies with anti-leakage solutions in place – with 42% admitting to between 1-5 breaches and 37% unable to say with certainty that that no breach had occurred
– The lack of industry standards is highlighted as the primary obstacle (42%) to wider implementation of anti-leakage technologies
– Perceived solutions include the deployment of comprehensive anti-leakage software, the implementation of appropriate organizational measures – such as clear and consistent internal security policies – controls on external network access, and raising staff awareness and discipline through training.

http://www.viruslist.com/en/analysis?pubid=204791935

Read more

SCADA State of Denial

Posted on by admini

“They put in Windows with no intention of ever patching it, and then they are surprised when they get hit by a worm,” Graham says. Or they avoid patching and vulnerability testing because these processes pose risks of their own for SCADA systems –introducing other bugs to their highly sensitive and uptime-demanding systems, for instance. “They are managed by a Pearl Harbor-type mentality,” Graham says.

Attacks exploiting the latest OPC bugs could be avoided if logins were required in the app because the attacker needs login privileges to do his dirty work.

“Auditing is not as in-depth in my opinion or as transparent for SCADA” as it is for other industries. And some security experts say commercial IDS/IPS, antivirus, and SIM products don’t really fit for SCADA.

Mark Fabro, CEO of Lofty Perch, which makes SIM solutions for the water utility industry as well as other critical infrastructure companies, says commercial IDS/IPS and SIM systems don’t map well to industry control systems, where there are thousands of different protocols, many of them proprietary.

http://www.darkreading.com/document.asp?doc_id=121887

Read more

Employers warned on e-mail spying

Posted on by admini

Lynette Copland, who works at Carmarthenshire College in west Wales, successfully sued her employer for breaching the Human Rights convention. Mrs Copland said there had been a “clash of personalities” with Mr Wrentmore, who left the college shortly after the episode for reasons of ill health and who died in January.

It was argued the monitoring was to determine whether Mrs Copland was using the college’s facilities for “personal purposes.” But the European Court of Human Rights ruled that the surveillance without her knowledge “amounted to an interference with her right to a private life”. At the time of the offences there was no general right to privacy in English law but the implementation of the Human Rights Act in 2000 legally protected privacy rights in domestic law.

Liberty said the ruling, on 3 April, meant employers would have to make employees aware if their communications could be monitored and there would have to be a good reason for such monitoring in every case.

http://news.bbc.co.uk/2/hi/uk_news/wales/6559873.stm

Read more

E-mail monitoring may violate European laws

Posted on by admini

Employee communications are also covered by human rights legislation if the organization has no explicit acceptable-use policy and fails to inform employees of the monitoring of personal e-mail.

Privacy experts at law firm Pinsent Masons, based in London, said that although businesses now have clear guidance for monitoring work communications under the Regulation of Investigatory Powers Act 2000, personal communications at work may be protected by the European Convention on Human Rights, and the Human Rights Act 1998.

“The lawful business practice regulations allow an employer to monitor and intercept business communications, so the court is implying that private use of a telecommunications system, assuming it is authorized via an acceptable-use policy, can be protected (by human rights legislation),” said Chris Pounder, a privacy specialist. “The ruling is important in that it reinforces the need for a statutory basis for any interference with respect to private use of a telecommunications system by an employee,” Pounder added. The college had no policy in place at the time informing employees that their communications might be monitored.

“According to the court’s case-law, telephone calls from business premises are prima facie covered by the notions of ‘private life’ and ‘correspondence’ for the purposes of Article 8,” said the court’s ruling.

http://news.com.com/E-mail+monitoring+may+violate+European+laws/2100-7348_3-6175495.html?tag=nefd.top

Read more