Author: admini

Better metrics needed for security, says expert

Posted on by admini

Amit Yoran, CEO of security firm NetWitness and the former director of the National Cyber Security Directorate at the DHS, criticized today’s risk management practices.

The security industry is awash in bad data, and companies that attempt to use the metrics could take the wrong actions, he said.
The process requires that executives work with their security group to find the right way to measure security for that specific company, he said.
“Set the expectations that a lack of due care is not going to be tolerated.”

http://www.securityfocus.com/brief/926?ref=rss

Read more

Massachusetts Data Protection Law Date Extended: What Your Business Needs to Know

Posted on by admini

Agnes Bundy Scanlan, a lawyer at Boston’s Goodwin Procter, and a board member of the International Association of Privacy Professionals (IAPP), says that while in general the Massachusetts data protection law is “pretty complicated,” it has gone through revisions and extensions. “But as it stands today, businesses that have Massachusetts residents’ information will have to have a comprehensive written security program, and heightened security procedures, including encryption.” “Even if there wasn’t a recession, this regulation still would be something that businesses would be reluctant to comply with,” Holland says.

The Massachusetts regulation was prompted by several high-profile data breaches that impacted residents, including the TJX case that first made headlines in 2007.

“Clearly, the Massachusetts government didn’t believe that data breach notification alone was sufficient to protect its citizens,” Bundy Scanlan says.

The Massachusetts law is breaking new ground in data protection requirements, just as the California state data breach notification law that was passed in 2003 did for state data breach notification laws. CA-1386 was passed by California state legislators after a 2002 data breach affected thousands of state workers, including some of the legislators themselves.

In the January public hearing held by the Massachusetts Office of Consumer Affairs and Business Regulation (OCABR) the room was packed with businesses and representatives from other entities calling for more time. Representatives of the Greater Boston Chamber of Commerce, Massachusetts Business Coalition, various nonprofits, colleges and universities and others at the January meeting testified the near impossibility of complying with the encryption standards, as well as the enormous investment of time, energy, and scarce cash required by this undertaking. By mid-February, the Massachusetts government made a decision to push back the date for compliance with the new regulations, says OCABR undersecretary Daniel Crane because of the recession and to give entities more time to comply.

Still, the regulations require that companies limit the amount of data they collect, have and maintain written security policies and keep a detailed inventory of all personal data and where it is stored, whether on electronic media or on paper. The regulations require any business that handles sensitive personal information on citizens of the Commonwealth of Massachusetts to encrypt that data as it is transmitted over the Internet or stored on external mobile devices such as laptops, flashdrives and other mobile storage equipment. “They should do as much as they possibly can; then if it is a systems problem with encryption, they will at least show they are doing their due diligence for the regulator.”

http://www.bankinfosecurity.com/articles.php?art_id=1261

Read more

Cyberattack mapping could yield blueprint for cyber defense

Posted on by admini

Cyberattack maps developed by Sandia researchers were presented to the public during a seminar last week at Harvard University. Those measurements make up a complex computer simulation of a massive botnet attack against a large-scale network.

Goldsmith presented the Sandia research as part of the “Cyber Internal Relations” series sponsored by MIT and the Belfer Center for Science and International Affairs at the Harvard Kennedy School. The researchers chose to examine a root attack, a Byzantine attempt to gain control of a target system at its most basic level of operation.

Applications of such simulations aren’t academic at all; such large-scale IT infrastructures would of course include those of state and federal agencies or defense contractors. Goldsmith and other attendees at the lecture assert that the “Holy Grail” of cyberwarfare is to quickly and accurately map out the network of an attacker or defender. Such a map could produce a decisive advantage, just as understanding the local geography of a country is a crucial advantage in real-world warfare.

Goldsmith is the lead scientist on a project creating intelligent white hat software agents that enable networks to be self defending.

Enterprise intrusion detection software in the future may include network topography and intelligent agents in a collective to improve its effectiveness. The developers of high-level enterprise architecture policies, including service-oriented architectures, will need to consider where and how to build in a level of autonomous intelligence into networks.

In an address Feb. 26 at an Armed Forces Communications and Electronics Association meeting in Baghdad, Sorenson called for greater information sharing on a single communications network.

http://gcn.com/Articles/2009/03/10/Cyberattack-mapping.aspx

Read more

NIST suggests areas for further security metrics research

Posted on by admini

“Security metrics is an area of computer security that has been receiving a good deal of attention lately,” the agency said in the draft of the new interagency report, titled “Directions in Security Metrics Research…. Advancing the state of scientifically sound, security measures and metrics would greatly aid the design, implementation, and operation of secure information systems,” the report states.

Formal Models of Security Measurement and Metrics: “The absence of formal security models and other formalisms needed to improve the relevance of security metrics to deployed systems have hampered progress.”
Historical Data Collection and Analysis: “Predictive estimates of the security of software components and applications under consideration should be able to be drawn from historical data collected about the characteristics of other similar types of software and the vulnerabilities they experienced.

At the very least, insight into security measurements would likely be gained by applying analytical techniques to such historical collections to identify trends and correlations, to discover unexpected relationships and to reveal other predictive interactions that may exist.”

Practicable Concrete Measurement Methods: “The current practice of security assessment, best illustrated by lower level evaluations under the Common Criteria, emphasizes the soundness of the evaluation evidence of the design and the process used in developing a product over the soundness of the product implementation.

Under the Federal Information Security Management Act, the CSD is responsible for providing agencies with standards, specifications and guidance in implementing requirements of the act.

Toward that end, NIST issued 18 special publications offering management, operational and technical security guidance, and has updated several Federal Information Processing Standard publications covering hash algorithms and digital signatures.

http://gcn.com/articles/2009/03/09/nist-security-metrics.aspx

Read more

Japan Cybercrime Grows by 15.5 Percent

Posted on by admini

And while cases of threats and illegal access increased by 90 percent and 20 percent, respectively, between 2007 and 2008, Ben-Itzhak says that fraud decreased by 0.3 percent.

The most recent FBI Internet Crime Complaint Center statistics bares the closest equivalent to the Japanese figures.

http://www.thewhir.com/web-hosting-news/022709_Japan_Cybercrime_Grows_by_15.5_Percent

Read more

PCI council offering “milestones” for compliance

Posted on by admini

When faced with a standard as robust as PCI DSS, many companies, particularly the smaller merchants, need help deciding which risks they should address first, de Veyra told SCMagazineUS.com on Friday.

Rated by order of criticality, the milestones are: Limit data retention, secure the perimeter, secure applications, control system access, protect stored cardholder data and finalize remaining compliance efforts, ensuring all controls are in place.

Several major breaches in the last few years, including Heartland Payment Systems and TJX, were caused by hackers who were able to seize sensitive credit card data by taking advantage of protection shortfalls across private networks and wireless access points.

De Veyra said the new tool likely will help small companies — designated as tier-four merchants by Visa and MasterCard — get started on their compliance efforts. “Prioritization doesn’t mean much if you have to do everything at once,” she said.

The new guidance comes at a time when PCI DSS is fielding widespread criticism over the high-profile Heartland breach, where potentially a record number of card numbers were stolen.

http://www.scmagazineus.com/PCI-council-offering-milestones-for-compliance/article/128078/

Read more