CyberSecurity Institute – Page 60 – Security News Curated from across the world

IT security spend keeps rising: Is there ROI?

Posted on August 13, 2013December 30, 2021 by admini

Information technology security spending will apparently keep growing forever, but it’s unclear what the returns look like.

Security requirements aren’t going to go away as long as the bad guys are out there.

Canalys noted that security remains a priority for businesses even as they cut back elsewhere. Asia Pacific IT security spending will be up 9 percent in 2013 with North America growing 5 percent.

Meanwhile, medium sized businesses will grow IT security spending a 7 percent clip to hit $8.5 billion in 2017.

Link: http://www.zdnet.com/it-security-spend-keeps-rising-is-there-roi-7000019277/?s_cid=e589&ttag=e589

Linux gets hit by a trojan — it’s time to sudo apt-get scared!

Posted on August 9, 2013December 30, 2021 by admini

“The Trojan’s developer claims it has been tested on 15 different Linux desktop distributions, including Ubuntu, Fedora and Debian.

While this trojan does seem nasty and scary, it is unlikely to spread easily given Linux users’ propensity towards common-sense about installing software.

Link: http://betanews.com/2013/08/09/linux-gets-hit-by-a-trojan-its-time-to-sudo-apt-get-scared/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed+-+bn+-+Betanews+Full+Content+Feed+-+BN

Concerns Over Cyber Security Risks Outweigh Traditional Risks for Large Firms: Study

Posted on August 7, 2013December 30, 2021 by admini

“We are reaching a tipping point where the majority of companies we surveyed now rank cyber security risks as high as other major insurable business risks,” said Michael Bruemmer, vice president at Experian Data Breach Resolution.

Among those companies that had an incident in the past 24 months, 70 percent of respondents said the experience increased their interest in these policies.

However, those costs are only a fraction of the average maximum financial exposure that the companies surveyed (breached or not) believe they could suffer because of cyber incidents. Respondents quantified the average potential maximum financial risk of a data breach at $163 million, with some projecting more than $500 million in damages.

For those firms that chose to go without coverage, 43 percent indicated that it is because of the cost and too many exclusions, restrictions and uninsurable risks.

“Going through the process of evaluating cyber insurance for their company, 62 percent of the people said that they felt like their company was in a better state of readiness because of going through the process of evaluating cyber insurance, which means that just the preparation and awareness help to improve their level of capability for an incident response for a data breach,” said Bruemmer.

Link: http://www.insurancejournal.com/news/national/2013/08/07/301071.htm

CISO spending priorities revealed

Posted on August 2, 2013December 30, 2021 by admini

As to where the money is going, respondents said five areas were ‘priority one or two’ (where one is most important and five is least important).

Notable changes occur in spending priorities between 0-12 months (FY 2013) and 12-24 (FY 2014) months on data security, document security and social media security.

54% of respondents indicated spending on data security would be high priority in 2014 (up from 38% in 2013). 38% of respondents indicated spending on document security would be high priority in 2014 (more than double the 15% in 2013). 23% of respondents indicated spending on social media security would be high priority in 2014 (more than triple the 8% in 2013).

Link: http://www.net-security.org/secworld.php?id=15346

Sophisticated Malware Is Stumping Security Pros

Posted on July 26, 2013December 30, 2021 by admini

“Many organizations lack the right staff size or skills necessary to address malware threats, but given their current workload and the information security skills shortage, it is unlikely they can fill this void quickly,” Oltsik said in his report.

Sixty-two percent of those surveyed believe their host-based security software is not effective for detecting zero-day attacks and other malware designed to bypass the software and remain stealthy on systems.

Security professionals should become intimately familiar with these phases so they can implement appropriate security controls for each phase and recognize anomalous behavior that may be associated with one or many phases of an attack.”

In addition, the survey found that 42 percent of organizations are testing or implementing security technologies that use sandboxing technology, virtual environments where files are quickly analyzed before being passed on to the end user.

About 39 percent of those surveyed said a group of security analysts dedicated to malware intelligence and analysis was created at their organization.

“While security professionals understand the basic concepts about malware, the [Enterprise Strategy Group] research indicates that a large number are unfamiliar with advanced malware properties.

Link: http://www.crn.com/news/security/240158935/sophisticated-malware-is-stumping-security-pros.htm

New Trojan could create headaches for banks, customers

Posted on July 24, 2013December 30, 2021 by admini

The Trojan is entering the market at an opportune time, as developers of such major banking malware have either retired, gone into hiding or otherwise removed their skills from the open market.

In a message posted to a Russian language underground forum and translated by RSA, KINS’ developer said the malware has been developed from scratch and not a modification of another product.

One plug-in is already available for $2,000, according to the malware developer’s forum posting, to counter Rapport, a popular fraud protection program currently used by banks.

“The bad guys have figured out that they can make the most money by selling plug-ins, which provide extra functionality,” Roel Schouwenberg, a senior researcher with Kaspersky Lab, said in an email.

KINS is also compatible with Zeus web injections and works with RDP, as was SpyEye, and won’t work in former Soviet Union countries — a practice introduced by Citadel.

“The American police aren’t going to go after the developer so he doesn’t mind if computers in the states get infected,” RSA’s Kessem explained.

For instance, it’s build to stay away from Trojan trackers, can be spread by popular exploit packs like Neutrino and will more deeply infect a Windows machine by poisoning its Volume Boot Record.

Link: http://www.csoonline.com/article/736849/new-trojan-could-create-headaches-for-banks-customers?source=CSONLE_nlt_update_2013-07-25