Compliance burdens hamper vulnerability management processes, survey finds

I saw this article and thought about our discussions in class regarding the -to be frank - impossibility of maintaining PCI DSS compliance.

Written by Robert Westervelt, the News Director at SearchSecurity.com, the article cites a new survey that found many organizations are struggling to deal with patch and configuration management issues and are often lacking efficient processes to deploy patches to stytems and applications in a timely manner.

"According to eEye's "2011 Vulnerability and Management Trends Report," 85% of those surveyed indicated that their IT staff is overburdened with regulatory compliance issues. About half of those surveyed said regulatory compliance initiatives take up to 50% of their work weeks," (Westervelt) and this is at the expense of actual vulnerability management.

Larry Whiteside, CISO at the Visiting Nurse Services of New York said, "I don't know any company in the world that doesn't have patching issues," Whiteside said. "The time to prioritize and test can make staying on top of the patching cycle very difficult."

In addition, the rising use of smartphones and other mobile devices is straining the ability of IT teams to ensure systems are up to date. The survey found that 31% of professionals indicated they don't have enough personnel to handle increased patching demands. In addition, keeping track of browser component vulnerabilities, Flash updates, and other third-party client software updates is an issue at many enterprises.

"There's definitely a lack of visibility, especially as it relates to non-Microsoft software," Maiffret said.

What's so special about Microsoft?

If you can recall from our case study, Microsoft's process for handling threats involves bulletins and notification. This article makes a point of mentioning them as a company that does a good job of "identifying and addressing vulnerabilities in other applications wrapped in one product." Microsoft's huge market share lets it do this, in my opinion. Therefore it seems that the majority of companies without the huge presence that Microsoft has are hampered by the issues brought up in this article, such as iPremier, Flayton's and TJX.

Israel Takes Steps to Tighten Information Security in Wake of Wikileaks

Despite advances in technology, no system is immune

The flood of internal U.S. State Department cables uploaded onto the Wikileaks website has heightened efforts in Israel to better secure information in a country, which has seen its ability to censor secret information deemed vital to national security wane in the digital era.

Following the recent furor surrounding the transfer of hundreds of thousands of documents to the Wikileaks web site, the Israel Defense Forces (IDF) announced it was taking more measures to track top secret data and alert to unusual access into army computers. The IDF was embarrassed by a small-scale leak earlier this year when an army secretary, Anat Kamm, is alleged to have copied over 2,000 classified documents and passed them on to a journalist.

The Israel army has installed a system that follows the trail of documents moving from one place to another, and records who prints them and who burns them onto compact disks. It also sets off alarms when disk-on-key devices are inserted into IDF computers.

It also prevents top secret documents from being transferred to someone without the proper security clearance. Brig.-Gen. Ayala Hakim, head of the army division that manages computers and communications systems, said the army was constantly enhancing measures to secure classified information.

“There’s no leak-proof network,” said the head of the Israel Army’s C4I Technology Division. “But through a combination of discipline, technology, training and procedures that compartmentalize sources of information, we’ve enhanced our operational security and are coming as close as possible to 100% protection,” Hakim told reporters at a recent press conference that the army

Besides thorough background checks of soldiers serving in sensitive positions, the Israeli military has also reportedly increased the number of polygraph tests it conducts on soldiers and officers by 50% in the past year.

The recent revelation of hundreds of thousands of classified documents on Wikileaks has also brought to fore the potential of serious data loss prevention (DLP) systems, which are designed to detect and prevent the unauthorized use and transmission of confidential information. Israel is home to a large number of information security companies, which sell software designed to spot and stop suspicious behavior on computers.

Eli Hizkiyev, chief executive officer of Cryptzone, an Israeli company dealing with preventing information security, said user-monitoring software was one of the main instruments used to catch possible theft of data. The software is usually designed to sound alarms when it detects users downloading large quantities of data or certain type of data, such as credit card numbers. It is widely used in the private sector and many government offices.

But Hizkiyev said that ultimately technology and censorship weren’t enough to prevent leaks and information theft.

“This is an issue of awareness. You can install the most sophisticated measures, but if people don’t have awareness then nothing can help,” Hizkiyev told The Media Line.

Aiding the wall against leaks is MALMAB, the security arm of the Israel Defense Ministry, which is more powerful and more secretive than the Israel military censor. Officially, MALMAB is responsible for the security of defense installations, but in fact the unit is mainly concerned with preventing any leaks regarding Israel’s alleged arsenal of nuclear weapons and top secret data about the country.

A request by The Media Line to interview the head of MALMAB, Amir Keen, was flatly rejected.

Amir Rappaport, a senior military analyst at the Begin-Sadat Center for Strategic Studies, said had a double-barreled apparatus in place to prevent leaks from reaching the public. The first was MALMAB and the IDF’s Information Security arms, whose purpose is to prevent data from being leaked. The second is the media censorship of information that has already been leaked. All media outlets in Israel and the foreign media must agree to abide by the terms of laws imposed by the British when they ruled Palestine to prevent publication of information deemed harmful to state security.

“The problem with all this is that while MALMAB and the censor may be serious bodies, they are restricted to the defense establishment. They have no control over the Foreign Ministry for example,” Rappaport told The Media Line.

Following the latest leaks of diplomatic cables, the U.S. State Department entered self protection mode and restricted the access of classified information from being shared with other U.S. agencies.

Before the 9/11 attacks on the World Trade Center, .the United States employed much stricter “need-to-know” classifications on confidential documents. Ironically, that helped the terrorists to move forward with their plot because government officials couldn’t easily share information.

Subsequently, the U.S. let down some of its secrecy guard to allow better communication among various intelligence bodies. Some half a million people employed in the U.S. military and government agencies have access to the Secret Internet Protocol Router Network, or SIPRNet, the worldwide web of the intelligence world.

Stung by Wikileaks several times, the U.S. is now engaged in a shift away from information sharing is the price to be paid for that post 9/11 openness. But a top official of the North Atlantic Treaty Organization (NATO) reacted by cautioning against a heavy roll back on information sharing.

If the U.S. failed somewhere, “it is not in sharing, but in implementing the appropriate safeguards to detect this volume of downloading,” Canadian Army Maj. Gen. Glynne Hines, who oversees the alliance’s information sharing policy as director of the NATO command, control and consultation staff in Brussels, was quoted as saying by Defense News.

Unlike Israel, in the U.S., user-monitoring software capable of sounding alarms when users download large amounts of date isn’t yet in place, according to Defense News.

Twitter Trojans

Holiay hackers are taking advantage of holiday themes on Twitter to trick users into clicking and opening malware on their computers. They are writing tweets like “Nobody cares about Hanukkah” or “Shocking video of the Grinch” and when users click on them, they end up at a fake codec site which leads to a malicious Trojan downloader. The hackers literally flood twitter with these massages and sit back and watch their victims download the malicious Trojans. Recently, 300 Twitter accounts have been identified as targeting various trending topics on the website.
The actual cause of this event is people who like to create problems for naïve people. These people have nothing better to do during the holiday season than creating malware and viruses and sending them around the World Wide Web and watching people accidentally download their viruses.
First of all everyone should have anti-virus on their computers and hopefully when someone unknowingly clicks on this Trojan downloader, that the anti-virus will catch it. If not the person is out of luck because they should be smart enough to not click on anything that looks suspicious. Just as we are told not to open an email if we do not know who it is from, we should not click on links on Twitter, or any website for that matter, if we don’t know the person who put the link there from the beginning. It is awful that people always need to be on their guard when browsing their computer but there are awful people in this world who have made this necessary.


http://www.esecurityplanet.com/features/article.php/3915636/Holiday-Twitter-Topics-Concealing-Malware.htm

Smart Grids: Security Review

In the quest for cleaner and more efficient energy, smart grid technology has slowly been upgrading the world's power infrastructure, especially here in the United States. A smart grid is essentially a form of electricity networking that utilizes digital technology as a way of addressing energy independence, global warming, and emergency resilience issues. Using two-way digital communications, a smart grid can deliver electricity from a supplier to a consumer, and allows the control of appliances at consumers' homes. This saves energy, reduces costs, and increases reliability and transparency. What makes a smart grid so amazing is that it overlays an ordinary electrical grid, rather than replaces it. The smart grid supplies the original electrical grid with an information and net metering system. The communication of information about grid conditions makes it possible to have dynamic response to these conditions. For example, when power is least or most expensive, appliances and factory machines can be turned on or off respectively to cut costs. What really puts a smart grid over the top is that it is capable of integrating renewable energy, such as solar or wind, into the system.

The goal of such smart grids is to route power efficiently to respond to a wide variety of changing conditions. While smart grids appear to be a simple upgrade from old centralized power distribution, the technology behind them is extremely complex. A smart grid employs the use of integrated communications, intricate sensors and meters, and advanced components and controls supported by constantly improving standards and support groups. With all these highly technological components and the wide scope of a single smart grid's influence, protecting theses smart grids is not only of utmost importance, but a difficult challenge as well. The most important security goal when dealing with a smart grid is keeping communications operating. The communication process between the power supplier and the consumer is at risk of having the confidentiality, integrity, or availability of that data being compromised. If terrorists or any enemies of the state were to gain access to the communications in a smart gird, they could potentially shut off power to massive portions of the nation. Someone with malicious intentions could even gain access to smart grid communications and overload power to one specific area causing serious overloads. If communications were to be interrupted in any way, a lot of people could be out of power. On a less sever note, anyone with malicious intent could tamper with meters and cause power to be redirected in such a way that they essentially receive free power.

Unfortunately for these great systems, smart grids have been found to be frighteningly vulnerable to security attacks. During a 2009 Black Hat security conference in Las Vegas, it was revealed that these smart grids have some weaknesses in their smart meters. This problem was brought to light after reports of attackers targeting U.S. power grids. The problem lies within more and more companies electing to use the remote control features on the meters and switches provided by smart grids. This gives companies the ability to shut off utilities when bills aren't paid and turn them back on when bills are paid. While this provides rapid reaction, it makes these meters and switches high level target. A potential attack on these smart meters could lead to significant harm of the infrastructure of our nation. If power were to be shut off to military areas, it would be difficult to get back up and running fast. Of course these risks are inherent in any smart system such as the smart grid. No matter how much security is provided hackers and attackers alike with malicious intent will find new ways to exploit a system that is meant to better the country and the world. With smart grids starting to run more and more power throughout the country and the world, they will become larger targets for those intending to do evil and attempts to compromise its security is inevitable.

Thankfully, countries such as the U.S. have been developing security protocols to protect this great technological asset. For example, the National Institute of Standards and Technology has already released a three-phase plan for developing standards for the technology. While this is a good first step, some believe the standards will face some of the same security concerns that surround PCI DSS. In the pursuit to secure smart grids, reports predict that between 2010 and 2015 the U.S. will spend about 15% of all smart grid investments on cybersecurity. That's close to $1.5 billion. The rest of the world is looking to do the same and is predicted to spend a combined $20 billion in smart grid cybersecurity. I would recommend that countries continue to invest in smart grid technology, and to also continue investment in securing these smart grids. While smart grid technology provides a great improvement to any nation's infrastructure, it is important that the technology is well protected and understood. Any standards that are developed should be carefully drawn out and vigilantly enforced. If my company we to employ the use of a smart grid, I would recommend trained teams for emergency response and strict adherence to any guideline. By keeping security a top priority, smart grid technology can be a great thing for the world.

http://www.eweek.com/c/a/Security/Smart-Grid-Security-in-the-Spotlight-at-Black-Hat-252301/
http://news.cnet.com/8301-11128_3-20008552-54.html
http://en.wikipedia.org/wiki/Smart_grid

Smart Phone Security Helps Catch Theives

On December 1, Stalin Guzman had his car stolen with his smart phone inside. Guzman called the police and then got online on his home PC. On his Android phone, Guzman had the Lookout mobile security application, a free, downloadable phone ap which has a variety of different uses. The free version of the app protects against viruses and back ups files. There is a premium version of the Lookout for $29.99 a year which offers location tracking, a locator "scream," and remote lock/data wiping. Guzman, being a premium member, was able to get online and access the Lookout site to track where his car was. He informed authorities and just seven minutes later, police cars surrounded his stolen car with the thief inside.

Virtually everyone has some form of a mobile device. With new technology like the Lookout app being installed on more advanced devices, smart phones are becoming a security tool by their users. Most smart phones contain their user's personal information. Apps like Lookout have security measures that can lock a user's data remotely in the event the phone is lost or stolen. Now with technology that can locate the phone remotely if it's stolen, security is even stronger not only for the phone but, like in Guzman's case, wherever the phone may be. More mobile devices should have security applications that have the diversity and effectiveness like Lookout. As the technology advances, more and more applications like Lookout will exist. The only problem with Lookout is that the cost might prevent some users from buying the premium version, which provides the most security. Unfortunately it seems that the only way to have the best kind of security is to spend a little money. When it comes to security, spending $29.99 a year is reasonable for the types of services provided and should be purchased by anyone with an Android phone. With more smart phones and improving security technology more crimes can be stopped just like with Guzman's car.

http://www.cnn.com/2010/TECH/mobile/12/03/mobile.app.carjacker/index.html

Hackers Issue Bogus Amber Alert

Over the weekend Iowa's Amber Alert and Accident Report websites were hacked through use of offshore computers. Investigators are looking into the attack, but it currently does not look like any sensitive data such as Social Security Numbers were compromised. The attack was not particularly disruptive, and merely re-issued an Alert from February 2009. However, the websites have been down for four days in order to do the investigation. Although the Amber Alert website was down, alerts still could be released through the National Weather Service, the Emergency Alert Service, and the media. The interesting point is that this is not the first time that the Amber Alert website has been attacked. In 2009 they were the victim of a flood of fake Alerts. Representatives refused to comment if other applications from the same service were also attacked, an e-government service provider known as NIC. There is no word when the websites will be restored, but the service is working to get them running again and to fix problems that could lead to future problems.

The vulnerability that lead to the attack was found in a Web-based application built by Iowa Interactive, a subsidiary of NIC. The state server that hosted the application, however, was not compromised in the attack. The scale of the problem is able to grow if other similar NIC applications were or could also be attacked. NIC counts more that 3,000 state, local, and federal government agencies as clients, and in the last year they processed more than $11.4 billion in secure payments. The cause of the problem may have been in this one web application, but if there were problems in others the problem could grow even larger.

First of all, I believe that NIC and Iowa Interactive need to go through and check every system they provide. They need to check for the hole that caused the problem as well as double checking for other holes that could cause problems. Second, I believe the state of Iowa needs to go through it's systems for failures. Lastly, it fall on the systems that were compromised. This was not the first time that the Amber Alert had been victim of an attack. This fact proves that the systems have flaws. The systems and application must be check and double checked to insure that everything is in working order and secure. Perhaps, issues from the first attack were never fixed or perhaps new ones had been exploited. The role of all the groups involved, NIC, the state, and the Amber Alert and Accident Alert systems, is to check everything for security. This attack was relatively innocent, but it could have been much worse. It is the job of these groups to protect against something worse occurring next.

SECURITY REVIEW: XBOX LIVE

Xbox Live: Security Review

Xbox Live is an online multiplayer gaming and digital media delivery service created by Microsoft Corporation. It charges users a fee to play multiplayer gaming. With Microsoft's new mobile operating system, Windows Phone 7, Xbox Live will be integrated into new Windows Phones. Furthermore the system has been integrated into social networking sites to find friends you played online with. To pay for your online gaming experience users enter their data and credit card information through their console into the Xbox Live network. Xbox Live features include: marketplace for downloads, instant massagers, friends’ lists, personal bio, Netflix account link, MSN portal, personal gaming settings, social media linkups, gaming location, and a voice/video mod.
There are a number of security risks with Xbox Live spanning the entire CIA Triad. An attack on the system seems to be a likely risk as the online gaming community is technologically intelligent. An unintended user could target an Xbox Live account in order to steal personal information and credit card data. They could also target the accessibility and make it so that an account holder is not able to access their own account or even pose as a real user. And finally the attacker could target the accounts integrity by changing the account holders bio, friends list, preferences, etc. Further security risks include entry into social media sites, Netflix accounts, MSN portals, and cell phone operating systems all through the Xbox Live account. This is all a risk on Xbox Live because if you can obtain a users gamertag and password you can access their account and modify it. From accessing the Xbox Live account you can enter into other Microsoft applications with ease. It would be harder to enter social media and Netflix sites because further passwords are necessary. However, just knowing one password greatly increases the likelihood that you can hack into others. Again, an advanced hacker may be able to skim credit card information from future downloads and even steal card information or completely hijack the account once accessed.
If I were an attacker I would definitely target the broad step of stealing accounts temporarily. Gamertags (usernames) are not protected and are visible to all people with an Xbox and internet connection. However, if I was able to steal passwords for these gamertags I could renew subscriptions, transfer account details, change cardholder information, alter the bio, alter the friend list, and deny the original user access. Furthermore, an attacker could easily hack an account and disclosure the real user’s home address and other information to the online community. I believe that this is the real weakness and probable attack. I have personally accessed my friends Xbox Live accounts before and I can see how easy it would be to copy their information, alter its integrity, and disclose it to a vast amount of people.
I think that Xbox Live technology has the basic weaknesses that we have been talking about in class that go along with all sites and delivery services. Whenever you are assuming an online identity the risks for theft and alteration greatly increase. We have talked a lot about credit card theft and I think this is a real threat if an account is hacked. Additionally, in much the same way social media works, Xbox Live presents the opportunity for an attacker to alter and disclose personal information on a wide level. This is because you are basically leaving a digital footprint and also creating an online identity that many people with internet access can view and get close to. This is an inherent threat with this type of technology.
My recommendation to Microsoft regarding the security risks of Xbox live would be to mitigate the risk and to transfer some of the liability. Xbox Live accounts contain a wide array of personal information, credit card data, and links to other sites that the user would have personal records. This variety and amount of information must be protected by Microsoft and Xbox. They need to consistently be on top of the hackers and always practicing the most up-to-date technologies and mitigation techniques that prevent illegal attacks. Furthermore, Microsoft needs to make all of their users away of the treats that accompany adding friends and also in keeping their passwords protected. Microsoft also needs to remind users that all their passwords (Live account, Netflix, social media) should be different from each other as to stop an attacker from totally hijacking an online identity. Finally, Microsoft should transfer some of this risk through purchasing a large insurance package against potential hacking into accounts.