Report: Security Slip-Ups Don’t Ding Stock Prices For Long

Posted on by admini

To answer those questions, Belva charted stock prices before and after data losses at the likes of Polo Ralph Lauren, UPS, Choicepoint, Bank of America, and Citigroup; took into account other news during those time spans that likely affected the price; and also looked at the long range trends in each company’s stock.

“[Stock prices are] the only publicly visible measure of confidence in a corporate institution,” said Belva. Most security problems don’t effect the company’s stock price. Although prices may dip temporarily on bad news of a data breach, the price rebounds quickly. If Citigroup and UPS lost 3.9 million customer records every week and Bank of America’s employees were found to consistently sell customer information illegally, we would most likely change our minds about where we do business,” said Belva in his paper.

In the Citigroup/UPS incident, in which the latter lost a shipment of tapes containing nearly 4 million current and former accounts, Belva found that Citigroup’s stock price fell a puny .02 percent the day the financial firm put out a press release on the lost tapes, but that the stock actually rose 0.27 percent when the story made the media four days later.

UPS’ stock, meanwhile, climbed 0.22 percent the day after the story made the rounds.

Only when a data loss impacts the core business of a company — such as when Choicepoint admitted to selling data to fraudsters, or when third-party credit card processor CardSystems was hacked, resulting in the exposure of nearly 40 million cards — does the stock, and thus the company, take a hammering, Belva said. In Choicepoint’s case, its stock price fell 3.1 percent on the day the breach was reported, and then continued to fall.

“Based on the known cases, there is a good chance that the stock will decline in the short term and rebound soon after. In effect, it may be possible to make money off the publicly reported breach.

http://www.techweb.com/wire/security/171200329

Read more

Security Becomes Financial Watchword

Posted on by admini

The data-security problem reached a new level in June when it was disclosed that a security breach at payment processor CardSystems Solutions Inc. had led to the exposure of 40 million card accounts.

Citigroup has said it would encrypt all tapes bound for transit, while Bank of America improved its tape-tracking procedures and launched a system intended to thwart phishing.

“A day doesn’t go by where information security isn’t front and center,” says Katherine Busser, CIO of the U.S. card division at Capital One Financial Corp.

Banks, insurance companies, and investment firms will spend $362 billion worldwide this year on IT, according to research firm TowerGroup. Other IT priorities in financial services are profitability management and improving revenue streams using technology, according to research firm Financial Insights.

http://www.informationweek.com/showArticle.jhtml;jsessionid=JXRN20RYC05RQQSNDBECKH0CJUMEKJVN?articleID=170703276

Read more

Build Your Own Security Operations Center

Posted on by admini

The tasks the security operations center handles can range from typical event management and incident response to account administration, investigations and forensics. Some companies choose to outsource their SOCs, because they want the expertise and 24-hour monitoring of a dedicated security team without staffing and building a SOC. For many, it makes sense to maintain an internal SOC, especially when a NOC already exists.

Building a separate infrastructure is expensive and probably not worth the effort. In many cases, the data center is a good fit, because it already has manned guard stations, cameras, security clearance and sign-in/sign out requirements and other physical security controls. Common and successful approaches to this end include having highly restrictive firewall policies for the SOC and placing an IDS–or better yet, an IPS–with restrictive policies inline between the SOC and the rest of the company network.

If remote access to the SOC is needed from within the company network, require a VPN connection. An additional network connection will give your SOC personnel an outsider’s view of your network. This link could be a T1 line or even an inexpensive DSL connection, preferably from an ISP other than the one providing your primary Internet connections.

Undoubtedly, you’ll need a wireless network in the SOC so workers can roam between conference rooms and offices. One possible solution is to have wireless users access the SOC network over a VPN requiring two-factor authentication.

http://www.secureenterprisemag.com/howtos/showArticle.jhtml?articleID=166400611

Read more

US banks lose $50bn to phantom fraudsters

Posted on by admini

Avivah Litan, research director at Gartner, explained that because US banks are so keen to recruit new customers they will open up accounts on the basis of identification from only a pay-as-you-go mobile phone bill (a type of account that is even easier to open) without checks on the validity of supplied social security numbers.

Once a bank account is open crooks will pay bills religiously, eventually earning enough trust to obtain credit cards with higher and higher limits. After around 18 months fraudsters will obtain cash advances on these cards and disappear, a process know as busting out. Losses of around $50K are typical, according to Litan. Banks will pursue these funds and call in collection agencies but in the end the majority will write-off the debt without understanding the root cause of the fraudulent loss.

Litan said that banks in Britain were far better at sharing information and working with each other to minimise exposure to this kind of fraud. The incentive to sign up new customers is great in Europe but in the US it’s even more pronounced because banks send out 1,937 pieces of marketing information for every new sign-up.

“The goal is getting new customers and banks are not that hungry about eating into fraud,” she said.

Litan made his comments during a presentation at the Gartner IT Security Summit in London.

http://www.securityfocus.com/news/11320

Read more

Techies don’t get security either

Posted on by admini

He explained that large organisations thrive by having a developed understanding of risk, and by accepting it when it offers a business advantage.

Instead of the ability to scare budgets out of chief information security officers, a future risk management officer will be well-versed in communication and project management skills and more likely to have trained in business school than as a techie. “The days of security being handled by the ‘network person’ who did security in their spare time are over and increasingly we are seeing seasoned professionals with real business experience and business school qualifications stepping into the security space.” Business people also need to adapt and realise the security cannot be achieved by technology and needs to be built into a corporate culture. This will require cultural, behavioural, procedural and technical change, according to Gartner.

Proctor made his comments during a presentation at the Gartner IT Security Summit in London.

http://www.securityfocus.com/news/11317

Read more

One-In-Six Spyware Apps Tries To Steal Identities

Posted on by admini

About one-in-six pieces of spyware — a category that also includes adware — is “specifically designed for identity theft,” said Aladdin in a statement.

Another 25 percent of the spyware examined gathers information non-identity information, but was classified by Aladdin as a “moderate threat” because these programs collect such data as the victim PC’s operating system, domain name, process logs, security applications, IP address, and security updates installed.

The remaining 60 percent, said Aladdin, gathered “commercial-value information about the end user’s browsing habits,” the traditional definition of the often noxious but rarely dangerous adware.

http://www.techweb.com/wire/security/170703179;jsessionid=KK01LHWEU4STQQSNDBCSKH0CJUMEKJVN

Read more