February 27, 2012
Professor John Walker London Chapter ISACA Security Advisory Group and CTO of Secure-Bastion believes the days of external simplex threats have now given way to multi-faceted attack vectors.
And this is before we get into the realm of rogue employees and privileged identity management. And it’s against this backdrop that the fundamental principles of governance, risk and compliance (GRC – the bedrock of ISACA) have returned to the fore.
But what are today’s cyberthreats? From detailed analysis of the current threat landscape, it can be seen that the hybridised nature of today’s security threats centres on hacking, serious and organised crime and the recently-arrived issue of hacktivists.
And let’s not overlook the problem of misplaced data. Add to this the dangers hosted by smart malware code such as Stuxnet and Duqu – and the possibility of a cyberwar as outlined by Foreign Secretary William Hague this year – and you have an idea of the challenges facing government.
Overactive Imagination?
For many years there has also been some debate as to the reality of any form of cyberwar or cyberconflict – which many observers ascribe to an overactive imagination on the part of the industry’s thought leaders and analysts.
Even taking into account recent high-profile system hacks – there have been no examples of a pure cyberwar casualty. While there has never been a cyberwar, let us not forget, neither has there been a nuclear war, but such weapons of mass destruction have nevertheless been used.
During 2010/2011 the US and UK governments announced they were focusing more on cyber defences. In doing so, they indicated that this low-cost method of delivering a potentially devastating payload to the heart of the enemy’s systems was now considered a serious threat.
In addition, the UK government also revealed that, at the end of 2010, various servers has been attacked using the notorious Zeus malware. On this same topic Foreign Secretary Hague informed a Munich security conference that the attack was considered to be part of an international effort to infect systems.
Though malware is still on the rise – the concept that today’s malware is ever more imaginative is weakening and, as a result, the anti-malware developers may be a little closer to developing ahead-of-the-game compliance technologies. This should not allow complacency. The Infosecurity Europe show in the spring of 2011 saw the threat of AETs – advanced evasion threats – becoming reality, but very little media attention was given to the development of more advanced AET threats that the malware bandwagon inevitably evolved.
The risk landscape changed last year largely as a result of hacktivist groups such as Anonymous and its forebears. This is no idle threat – attacks targetted the Royal Navy, the UK government, the NHS and commercial sector organisations and newspapers.
Read full feature here
February 6, 2012
Data protection company SafeNet, Inc. has announced the results of a new 2011 State of the Channel Authentication survey, in which more than 100 IT security resellers revealed that recent security breaches and deployment of new technologies are driving organisations to re-evaluate incumbent authentication vendors and re-think their authentication strategies.
“Recent highly-targeted security attacks have dramatically impacted enterprise and government organisations. The breadth and sophistication of these attacks is prompting organisations to review their authentication strategies and solutions— some for the first time in years,” said John Marler, Chief Technology Officer at SOS Security. “Now, more than ever, our customers are searching for highly flexible authentication solutions that provide security and control, and the ability to scale and adapt as an organisation’s requirements evolve.”
The end of year survey of more than 100 IT security resellers found the following customer behaviours:
- Three out of four resellers report that customers are “more” or “much more” concerned about security breaches now than they were a year ago.
- More than seven out of ten resellers are actively discussing with their customers the authentication and protection of their data in the cloud and/or virtual environments.
- Authentication for mobile devices, certificate-based authentication, software authentication, and secure browser authentication solutions top the list when it comes to customer interest in new authentication technologies.
- More than 45 per cent of responders indicate that customers have expressed interest in these evolving solutions.
- Sixty-seven per cent of resellers are exploring new authentication options and vendors when renewing contracts to meet evolving requirements.
- More than 50 per cent of resellers surveyed are either currently searching or are likely to search for new authentication vendors with which to partner
Read full article here
February 3, 2012
Attackers repeatedly hacked VeriSign’s network and stole information in 2010, the company revealed in a quarterly regulatory filing.
The Internet infrastructure provider did not disclose what information was stolen or other details of the attacks in its 10-Q report filed in October with the U.S. Securities and Exchange Commission that was reported on by Reuters today.
“In 2010, the Company faced several successful attacks against its corporate network in which access was gained to information on a small portion of our computers and servers,” the company wrote. “Information stored on the compromised corporate systems was exfiltrated.”
The company said it did not believe attackers had breached the servers that run the domain name system (DNS) network, a key piece of infrastructure that directs people to the correct site when they type in a Web address. A compromise of the DNS system could allow attackers to redirect Web surfers to malicious sites or to intercept government or important e-mail communications.
The disclosure was in the “Risk factors” section of the filing, under a heading titled: “We experienced security breaches in the corporate network in 2010 which were not sufficiently reported to Management.”
VeriSign’s information security group was aware of the attacks shortly after they occurred, sometime in 2010, the filing said. Meanwhile, management was not informed until September 2011.
“Given the nature of such attacks, we cannot assure that our remedial actions will be sufficient to thwart future attacks or prevent the future loss of information,” the filing said. “In addition, although the Company is unaware of any situation in which possibly exfiltrated information has been used, we are unable to assure that such information was not or could not be used in the future.”
Meanwhile, Symantec, which bought VeriSign’s certificate business in summer 2010, said those products and services were not affected. “Symantec takes the security and proper functionality of its solutions very seriously,” Symantec spokeswoman Nicole Kenyon said. “The Trust Services (SSL), User Authentication (VIP, PKI, FDS) and other production systems acquired by Symantec were not compromised by the corporate network security breach mentioned in the VeriSign, Inc. quarterly filing.”
Asked for comment, VeriSign provided CNET this statement: “We cannot provide any further information than what is included in the 10-Q document Verisign filed on October 28, 2011.”
Reuters discovered the VeriSign disclosure during an examination of more than 2,000 corporate documents that were filed since the SEC published new guidelines for reporting security breaches.
The disclosure is reminiscent of a public announcement RSA made last year of a “sophisticated” targeted cyberattack that led to data theft that put millions of customers of its SecurID authentication tokens at risk. There also were breaches at other certificate authorities, including GlobalSign, DigiNotar, and Comodo reported last year. And in 2010, Google went public with news that it had been the victim of a targeted attack, likely from China.
Read full article here
