Author: admini

Criminals Hide Payment-Card Skimmers Inside Gas Station Pumps

Posted on by admini

The devices typically include a scanner, transmitter, camera, and, most recently, Bluetooth- or wireless-enabled links that shoot the stolen data back to the bad guys.

A similar attack occurred with a rigged ATM machine last year in Las Vegas during the Defcon hacker show: Security researcher Chris Paget lost $200 to an ATM machine in the Rio All-Suite Hotel & Casino that appeared to be operating normally, but failed to spit out cash.

The U.S. Secret Service was investigating the incident, and it was unclear whether the machine was outfitted internally with a skimming device or had been tampered with for someone to grab the cash withdrawals at a later time.

Bruce Schneier, CTO for BT Counterpane and author of the Schneier on Security blog, says attackers in Europe are also moving skimming devices inside gas pumps as a way to avoid detection.

Troy Arnold from the Sandy police department told a local news outlets that the device in the 7-Eleven gas pump was the size of a cellular phone SIM card and was affixed to the card reader inside the pump.

“It’s a small device — Bluetooth, the size of a SIM card — that is attached to the actual credit card reader.

Back in December, a similar spree occurred in the Sacramento, Calif., area, where gas pumps at an AM/PM convenience store were outfitted with card skimmers, transmitters, and small cameras that siphon victims’ debit card data.

http://www.darkreading.com/database_security/security/attacks/showArticle.jhtml?articleID=223100233&cid=RSSfeed

[Link to an article showing a typical ATM skimmer setup: http://www.snopes.com/fraud/atm/atmcamera.asp. But remember all they really need, is the skimmer to be installed and a good camera!]

Read more

Next generation firewall software introduced by Palo Alto Networks

Posted on by admini

Chris King, director of product marketing at Palo Alto, explained that it is building on key themes on the threat landscape and realising that there is a lot of applications that have a value but are fraught with risk.

It explained that its next generation firewalls combine three identification technologies to provide the necessary visibility and control over applications, users and content.

René Bonvanie, vice president of worldwide marketing at Palo Alto Networks, said that he believed that the market is ready for this, and he was happy with what was coming along.

http://www.scmagazineuk.com/next-generation-firewall-software-introduced-by-palo-alto-networks/article/164251/

Read more

Spike In Power Grid Attacks Likely In Next 12 Months

Posted on by admini

“Some companies say there’s never been a successful attack against the grid, but that’s not true,” he says.

Doug Preece, senior manager for smart energy services at Capgemini, says he expects an uptick in hacking of smart grid devices during the next 12 months as more smart-grid pilot projects are launched at energy firms. “A closed communications network was difficult to breach.” “Their communications will be predominantly wireless, and it’s assumed they will be sniffed, penetrated, hacked, and service will be denied …So we’re designing mitigation techniques and security to address these things,” he says.

The best-case scenario of attack would be someone poking around the network for vulnerabilities so he can cut his energy bill, for example, says Eric Knapp, vice president of technical marketing for NitroSecurity. “The worst-case scenario would be an attacker compromising [the smart grid] and then controlling the distribution of power,” he says.

Patricia Titus, chief information security officer for Unisys Federal Systems and former CISO for the Transportation Security Administration (TSA), says energy firms need to “take a breath” and determine whether adopting smart grid technology will exacerbate or solve problems.

And it’s not that existing SCADA systems are all insulated from attack, even with their private lines.

The Grey Goose report calls out Russia, Turkish hackers, and China as the top threats to the power grid.

It just opens up another window that requires a higher level of sophistication [to breach].”

http://www.darkreading.com/security/vulnerabilities/showArticle.jhtml?articleID=223000369

Read more

Computer Jargon Baffles Users, Hinders Security

Posted on by admini

One problem is that computer “geeks” use jargon to cloak their work in scholarly mystique, resulting in a lack of clarity in everything from instruction manuals and systems design to professional training, the experts said.

“If you don’t demystify security, people become anxious about it and don’t want to do it,” former U.S. Homeland Security Secretary Michael Chertoff told Reuters on the sidelines of the EastWest Institute security meeting in Brussels. “There are some people in the profession who to some degree enjoy the mystification of what they do, that it’s not penetrable… Doctors and lawyers used to enjoy “a sense of mystified special knowledge,” Chertoff said.

The industry has made progress in educating users, but a huge and urgent task lies ahead in view of the growing criminal threat and the imminent arrival of billions more Internet users.

Plain language is vital, said Steve Purser, head of Technical Competence at the European Network and Information Security Agency, a European Union body. They are going to think how to get round the system.”

Educating the individual customer has long been a top goal for an industry struggling to balance security against ease of use and the clamor for mobile communications. “If we try to teach standard messages such as ‘always protect your password’ the danger is that people will learn the recipe but not learn why this happens,” Purser said.

Delegates said imaginative messages explaining the importance of online protection are needed, tailored to different age groups and audiences and posted on media ranging from TV advertising and schools curriculums to Youtube, Second Life, social network sites and video games.

Curtis Siller, director of Standards at the Institute of Electrical and Electronics Engineers, said the industry had to do a better job of communicating the risks to various audiences.

http://www.nytimes.com/reuters/2010/02/19/technology/tech-us-security-cyberspace.html?_r=2&scp=5&sq=computer&st=cse

Read more

Enterprises Look for Help Managing Security Logs

Posted on by admini

SIM equipment can centralize event and log management information from security devices and computers, but the drawbacks to its use include up-front costs, complex installations and hiring the expertise to manage it.

SIM as a managed service only started to gain momentum within the past two years, largely due to compliance mandates such as the Payment Card Industry (PCI) data security requirements, says Gartner analyst Kelly Kavanagh. Managed SIM options range from as simple as centralizing log collection and reporting, to as complex as event correlation and round-the-clock security-event monitoring.

Occasionally SIM as a managed service will entail “complex correlation, perhaps related to network alerts from firewalls and switches, information that may seem to be related,” he notes, and a service might provide an analyst to monitor events round the clock. The company directly manages IT for more than 100 of its corporate restaurants, plus keeps track of PCI-related compliance matters for about 160 franchises which operate more independently. Not only did the up-front costs of doing it in-house seem high — SIM equipment can easily reach into the half-million dollar range — but also Fuddruckers realized it would have to hire SIM experts to make it all work.

Largely based on information gleaned from conversations with peers, just over a year ago Pumphrey decided to try SIM as a managed service, selecting Trustwave to monitor about 500 log files at least once daily on behalf of Fuddruckers, triggering an alarm if suspicious events arise.

“We see ourselves as a managed alternative to what customers might want to do themselves with ArcSight or Q1 Labs,” says Dan Schleifer, senior product manager for managed security services at Trustwave, referring to two well-known SIM product vendors.

That’s the approach that service provider FishNet is taking, according to CEO Gary Fish.

Tom Turner, vice president of marketing and sales at Q1 Labs, says it’s comfortable partnering with a managed service provider such as FishNet, viewing the relationship “as potentially offering us a broader market.”

SecureWorks is regarded by Gartner as a “pure play” SIM managed service provider, as opposed to a global service provider that offers SIM among a wider menu of services. The security firm is a veteran in the business, having started about a decade ago.

http://www.csoonline.com/article/print/521466

Read more

5 tips for cybersecurity-training your employees

Posted on by admini

When Lauer arrived at the agency, he had a list of more than 20 noncompliance items from Federal Information Security Management Act audits.

Now when users log on to the MCC network, they are greeted by a Tip of the Day awareness training application, which asks a question about IT security. Besides giving managers an easy way to assess the agency’s training program, the daily quizzes have also made employees more mindful of security.

“We’ve had a tremendous reduction in viruses,” Lauer said. “Instead of clicking on things, [users] call the help desk. They never used to do that before.”

But not every agency can report such success. Indeed, experts say the goals of user training efforts are still a long way from being realized. “There is a gap, and the gap is costly because it undermines all the technology being thrown at security problems,” said Keith Rhodes, senior vice president and chief technology officer at QinetiQ North America’s Mission Solutions Group. “No approach to training is infallible because human beings are fallible, and of course, human fallibility is what training tries to counter,” Rhodes said.

Four out of five federal IT managers said they provide ongoing classes on security policies and procedures. But even then, almost half had seen employees post passwords in public places, violating one of the most fundamental security proscriptions. The survey highlights one of the hardest tasks in IT security: changing user behavior. For instance, firewalls won’t prevent an employee from stowing passwords under a mouse pad or engaging in other careless practices.

Security managers and industry consultants say there are a few basic techniques for evaluating the effectiveness of IT security training and improving the odds that the lessons will sink in. At MCC, new employees receive IT awareness training as part of their orientation, and the security tip of the day provides ongoing reinforcement. MCC officials keep tabs on employees’ security awareness by tracking responses to those daily quizzes via a monthly performance report.

Organizations with multiple locations always face a tough challenge when it comes to developing and measuring the success of training programs. The state is 18 months into a four-year initiative that will meld the IT operations of 16 executive branch agencies under the statewide Office of IT. “To get metrics to prove that end-user security is working, you’ve got to be in a consolidated environment,” said Seth Kulakow, Colorado’s chief information security officer. Consolidation will provide the consistency required to gather the correct metrics, he added.

Barr recommends that agencies use internal IT security employees to conduct quarterly vulnerability assessments and external experts for annual vulnerability assessments.

Elsewhere, Colorado’s Kulakow has recommended making an employee’s adherence to security policy part of his or her performance evaluation.

Content filtering and data loss prevention are among the products agencies can use to counteract human nature, said Keshun Morgan, a networking and security specialist at CDW-G.

Tip no. 1: Make employee testing simple and routine
Tip no. 2: Check what they do, not just what they know
Tip no. 3: Put security in personal terms
Tip no. 4: Invoke consequences for misbehavior
Tip no. 5: Always remember the limits of training

http://fcw.com/articles/2010/01/25/feat-cybersecurity-training-a-must.aspx

Read more