CyberSecurity Institute – Page 247 – Security News Curated from across the world

Planning for an Internal IT Risk Assessment

Posted on October 20, 2006December 30, 2021 by admini

Sarbanes-Oxley, Section 404, requires public companies to annually assess and report on the effectiveness of internal controls over financial reporting. A component of risk management is information technology (IT) risk management and should be part of any IT security program. Every organization, no matter whether private or public, has a mission. For example, if your organization’s mission is to become one of the nation’s (or county’s or state’s) largest financial holdings companies, and you offer services such as commercial and retail banking, mortgage financing and servicing, consumer finance and asset management, then what are you going to protect and how are you going to protect it?

Requests for information arising from internal or external IT auditors are normally fielded by the IT and Security departments. In one particular audit I experienced while working for a financial firm, there was an IT audit finding due to the existence of numerous Domain Admins (everyone in IT had made himself or herself a Domain Admin and Domain Admins have total access to everything on a Windows network).

There are some basic risk management concepts that need to be ingrained into the technology manager’s mind before developing applications, and before deploying applications and technology. For starters, IT managers can look to the National Institute of Standards and Technology for some guidance. NIST Special Publication 800-30, published in July 2002, entitled Risk Management Guide for Information Technology Systems is a good place to start. It is free and does a decent job of explaining the basic concepts and providing a risk management methodology.

For example, “Risk is a function of the likelihood of a given threat-source’s exercising a particular potential vulnerability, and the resulting impact of that adverse event on the organization”, is the opening definition of risk.

With management support and IT’s commitment to work through this, you can perform an internal IT risk assessment with some success yourself.

http://www.bankinfosecurity.com/articles.php?art_id=166&PHPSESSID=ceea138966d3138528becabe0eb4b292

Europe prepares for data breach notification legislation

Posted on October 19, 2006December 30, 2021 by admini

Rob Gretton, Business Development Director for DISUK commented: “This legislation is a step in the right direction as anything that empowers the individual and gives them more information is a good thing.

Identity theft is not just a problem on the Internet; it can happen in much less visible ways. Thefts and losses of backup tapes mean that large volumes of personal information such as, mother’s maiden name, date of birth or national insurance number are exposed to potential misuse at any time in the future.

http://www.it-observer.com/news/6910/europe_prepares_data_breach_notification_legislation/

Phishers more successful than first thought

Posted on October 16, 2006December 30, 2021 by admini

“Our goal was to determine the success rates of different types of phishing attacks, not just the types used today but those that have not yet occurred in the wild,” said Markus Jakobsson, associate professor at the IU School of Informatics.

Along with computer science doctoral student Jacob Ratkiewicz, Jakobsson devised simulated attacks in which users received emails appearing to be legitimate and providing links to eBay. One experiment they devised was to launch a ‘spear phishing’ attack in which a phisher sends a personalised message to a user who might actually welcome or expect the message. The researchers used three types of approach statements: ‘Hi can you ship packages with insurance for an extra fee?’

“We think that spear phishing attacks will become more prevalent as phishers are more able to harvest publicly available information to personalise each attack,” said Ratkiewicz.

http://www.vnunet.com/2166518

Saudi passes cybercrime laws

Posted on October 15, 2006December 30, 2021 by admini

The maximum punishment under the new legislation is a prison sentence of ten years and a fine of US$1.3million, which can be imposed on anyone found guilty of hacking into government networks to steal information related to national security or using the internet in support of terrorism.

Any person who gains unauthorised access to a public network or who installs viruses on that network will be subject to a fine of around US$800,000 and/or up to four years in prison.

http://www.itp.net/news/details.php?id=22318&srh=&tbl=itp_news

Targeted Trojan attacks on the rise

Posted on October 14, 2006December 30, 2021 by admini

“Your problem is no longer how do I avoid being attacked, but how do I find where I’ve been compromised.”

Last year, computer emergency response groups in the U.K., Canada and Australia warned of such attacks. While the United States Computer Emergency Readiness Team (US-CERT) did not issue a warning, security firms confirmed at the time that U.S government agencies and companies had already been targeted by such malicious software.

A major problem for large companies, government agencies and other potential targets is that antivirus software is not good at stopping low-volume attacks aimed at single companies. Traditional antivirus programs detect widespread attacks based on matching to a known pattern and do not fare well against low-volume Trojans. “There is no value whatsoever in having signature-based antivirus when facing a targeted attack,” said Joshua Corman, host protection architect for Internet Security Systems (ISS).

Military agencies, human rights organizations and pharmaceutical companies are some of the types of groups that are being targeted by specifically aimed attacks.
timate programs as potential threats.

http://www.securityfocus.com/news/11418

A-Listing Your Apps

Posted on October 13, 2006December 30, 2021 by admini

“It’s back to the future with some of this,” says Andrew Jaquith, program manager for security research at the Yankee Group. Jaquith says the current approach of identifying and blocking the bad is starting to fail, with malware samples increasing at a rate of around 50 percent annually. “Whitelisting is increasingly becoming part of a well-balanced diet on the client,” he says.

And it’s quietly and slowly catching on beyond vendors such as SecureWave, Savant Protection, and Bit9 that have made a business out of whitelisting applications.

Many of the early whitelisting adopters today are small- to medium-sized organizations, where deploying this technology across desktops wouldn’t be as major an undertaking at say, a major Fortune 100 company. SourceMedia has been testing Savant Protection’s endpoint software with whitelisting for several months. “Conceptually, it makes a ton of sense,” says Ivan Latanision, vice president of information technology for SourceMedia, who adds the company hasn’t made its final decision on whether to purchase the tool yet.

Savant uses unique cryptographic algorithms and signature keys for each application on each desktop, rather than a server-based access control list. Patton Harris Rust & Associates has been running SecureWave’s Sanctuary software for whitelisting since last year — initially for device control and later for application control as well. John Loyd, vice president and director of IT for PHR&A, says the company installed the software for protection against zero-day attacks, ensuring its users aren’t installing illegal software, and to ensure the quality of apps its engineers use. Dennis Szerszen, vice president of marketing and corporate strategy of SecureWave, says antivirus blacklisting and Sanctuary’s whitelisting work best together. “We need to be triggering the AV processes so they can clean up what” they found.

http://www.darkreading.com/document.asp?doc_id=107320&WT.svl=news2_1