BCA

By John Riley

 Cyber security was under attack during the past year as never before and it shows no sign of abating in 2010. While both government and business have been taking steps to deal with these threats, the most important step has yet to be taken…a partnership between government and business. While independent study commissions have recommended such a union, the necessary legislation has not been enacted.

However, that has not prevented organizations from moving ahead on their own. Michael Carpenter, Senior Vice President for the Public Sector at McAffee, says, “we can expect to see an increase in the overall effectiveness of government, business and  law enforcement, powered by innovative new technologies, to combat cybercrime.” Some of Carpenters’ predictions for 2010:

1)       Social mediums such as Facebook and Twitter will face more sophisticated threats as the number of users grow.

2)     Adobe software, especially Adobe Reader and Flash, will be the primary targets.

3)     Banking Trojans will become more clever, sometimes interrupting a legitimate transaction to make an unauthorized withdrawal.

4)     Botnets used for spamming and identity threat will remain the leading infrastructure for cybercriminals.

5)     We often think of “civilian” applications and “government” applications, but the increasingly seamless nature of the world means cybercrime fallout knows no borders and does not distinguish between victims.

 More Evidence of Progress

 A January 20, 2010 article in Enterprise Risk Management by Dr, Jagan Nathan Vaman, CEO Vertical Six, provides further evidence of government and industry’s progress in preparing for the future: 

 Input, a Reston, Va. government business consulting firm, indicated the government’s information security budget will increase from $7.9 billion in 2009 to $11.7 billion in 2014 at a compound growth rate of 8.1 percent.  This is largely due to a 300 percent increase in cyber attacks since 3005 and the sophistication of these attacks which  is also increasing.  Unfortunately, there is no figure on Cyber security expenditures by private firms because many of them do not want to admit their computers have been penetrated. Deputy Secretary of Defense, William J. Lynn, provided some insight into the commitment of the Pentagon in a recent speech when he said, “there were an estimated 90,000 people engaged in administering, monitoring and defending 15,000 networks connecting 7 million computers.”

 Bob Gourley, former chief technology officer for the Defense Intelligence Agency and a Board member of the Cyber Conflict Studies Association stated in a National Security Cyberspace Institute report, “U.S. cyber warriors are already deployed overseas and are in direct contact with adversaries. They live in adversary networks.” He added  that an editorial in the Chinese People’s Daily opined, ‘U.S. intelligence agencies can, through technical means, fully monitor, follow and erase online information harmful to U.S. national interests.’

 Loren Thompson, a military policy analyst for the Lexington Institute, says, “Cyber-Security is shaping up to be a major growth opportunity for the defense industry.” After years of working intensively on military equipment, the growing  infiltration of computer systems by cyber-spies is forcing contractors to shift that intensity to defending computer systems and networks.

 Timothy McKnight, vice president of Northrop Grumman Corp’s intelligence systems division,  observes that, “in today’s current state, there’s a good chance you have already been compromised. We want to stay ahead of this problem. We’re doing everything to stay on the cutting edge.” An important step in that direction was when Northrop, the maker of the B-2 stealth bomber and nuclear submarines, bought the Essex Corporation, which specializes in encryption technology used by U.S. intelligence agencies in 2007. In 2009, all of Northrop’s divisions handling cyber security business were consolidated into a single unit.

 Late last year, Northrop also entered a cyber security research consortium with Carnegie Mellon University, Massachusetts Institute of Technology and Purdue University to develop new technologies and collar promising new engineers. 

 Microsoft Corp, Cisco Systems Inc. and Dell Inc. joined with the nation’s largest military contractor, Lockheed Martin, to form a cyber security alliance with Lockheed Martin Corp to collaborate on ways to combat hackers.  Lockheed also built a 5,000 square foot facility in Maryland dedicated to cyber security research and hired Lee Holcomb, former chief technology officer for the Department of Homeland Security, to head cyber security activities.

 The Sleeping Giant is Awaking

 While there are signs of our progress in the cyber security quest for superiority, the competition is smart, innovative and persistent. It is clear the United States is the primary target of most, if not all, of the world’s cyber espionage players and it is unrealistic to think all of the best talent resides in this country. However, when  government and industry work together, it’s a very formidable combination and hopefully the day isn’t too far off when that team is on the field.

By Dennis Jacobe, Gallup Chief Economist

 As the Senate considers financial reform legislation, a new Gallup poll shows that Americans’ confidence in banks has not returned on Main Street as it has on Wall Street. The percentage of Americans saying they have a “great deal” or “quite a lot” of confidence in U.S. banks is now 20% — not much different from the 18% of a year ago or the 22% of last summer. Four in 10 Americans currently say they have “very little” confidence in U.S. financial institutions.

Gallup has measured banking confidence in various surveys dating to the late 1970s. Since the 2008-2009 financial crisis, Americans’ confidence has reached new lows, falling below the readings near 30% during the 1990-91 recession that reflected the fallout associated with the savings and loan debacle of the late 1980s.

Most Still Have Confidence in Their Main Bank

While most Americans profess comparatively little confidence in the banking industry, the majority continue to express confidence in their main or primary bank, where they do most of their banking business. As was the case last April, 58% say they have a great deal (31%) or quite a lot (27%) of confidence in their main bank. Only about 1 in 10 Americans express “very little” confidence in their primary bank.

For complete story, go to www.Gallup.com

By John Riley

 Access to the Internet is easier than ever. It provides an unending fountain of  information on entertainment, credit and financial services, sports, politics, and countless other subjects. However, there is a downside… many internet users are careless in protecting their assets and identities in operating their websites/blogs as well as surfing the net.  As a result, hackers find a fertile landscape where they can ply their trade often with  stunning success.  Neither business, government or individuals are immune. While many businesses and the government have sophisticated layers of security in place to protect their systems, individuals must rely on commercial services.  Here’s what some of those experts suggest for individuals and families  to better secure your systems:

 Password security  (Information Technology Consultants Update Oct 9, 2009)

 If there is any indication your website/blog has  while surfing the Internet that your password has been compromised, immediately change that password and  investigate all your other passwords. Too often, a person will wait a day or two before taking action and by then it may be too late to prevent an economic loss.

 Stop re-using your password for multiple websites. If  the hacker figures out your password he will be able to access bank information, private e-mail or your other accounts.

 Vary your  mix of letters, numbers and symbols and use at least 8 characters for your  password. You can also mix up capital letters with lower case letters,

 Avoid using passwords that are personal, i.e. birthdays, wedding dates, addresses or children’s names.  If you write down your passwords, keep the papers in a secure location.

 Computer security (OnGuard Online.Gov 2010)

 Hackers will try to find home computers that are not well protected by security software and  install ‘malware’. Or they might send you an e-mail with attachments that will install malware when you open them. Once the bad software is installed, the affected computer becomes a BotNet and anonymously sends out thousands of spam e-mails. Millions of homes are part of BotNets and most families are unaware of it. That’s why it’s important to keep operating systems and Web browsers up to date at all times.

 Phishing is the biggest threat to the loss of personal information. Never reply to a phone call or e-mail requesting personal or financial information. Most reputable organizations do not use those means to obtain such information. Know who you are dealing with. Check out unknown callers by using Google Search, especially if they represent a ‘company’.  If they claim to represent a company, call the company and check. If not, be very cautious.

 Use security software that updates automatically. Be sure you have anti-virus, anti-spyware and a firewall at a minimum. And back up your important files regularly, i.e. daily or weekly.

 Wireless security (OnGuardonline.gov 2010)

Convenience and mobility are driving more computer users to utilize wireless connections to the Internet without realizing the risk.  A hacker with a wireless-ready computer can take over a users network and if the hacker commits a crime or sends spam, the incident can be traced back to the user’s account creating problems for the user. On Guard Online suggests  the following steps to protect yourself:

1)      Encrypt or scramble communications over the network. Buy a wireless router that has encryption features.

2)     Use anti-virus and anti-spyware software with a firewall

3)     Turn off wireless router identifier broadcasting that sends out signals to any device in the area announcing its presence.

4)     Routers usually have an identifier and a pre-set password for administration. Turn off the identifier and change the default password.

5)     Turn off your wireless network when you aren’t using it

6)     Don’t assume public ‘hot spots’ are secure

 When you have been attacked, report it immediately

Hacking or Computer Virus:  Send to the  FBI at www.ic3.gov.  Be sure to include the information in the hacker’s e-mail’s header (sender’s Internet Service Provider) and routing information along  with any other information you have. Without that information, the FBI has nothing to work with.

 Internet Fraud: Any fraud attempt involving shopping online or an Internet auction,

report it to the Federal Trade Commission, at ftc.gov

 Deceptive Spam:  Send the e-mail header and routing information to spam@uce.gov

 Phishing e-mail: The Anti-Phishing Working Group is a consortium of Internet Service Providers (ISP) security vendors, financial institutions and law enforcement agencies that rely on user reports to fight phishing. Send your report to reportphishing@antiphishing.org

 Identity Theft:  Send your report to the Federal Trade Commission at ftc.gov  

Go to ftc.gov/idtheft for information on how to minimize risk of theft identity.

 Most successful hackers succeed, not so much because of their prowess and analytical skills, but because so many people fail to realize or accept the threat to their security. It can be a costly mistake.  

 The final article, Cyber Espionage (5 of 5) Preparing for the Future,  will appear April 11.

 From Forrester Research

 More than half of IT software budgets in 2010 will go toward ongoing operations and maintenance of existing applications as opposed to implementing new software solutions, according to a recent survey by Forrester Research.  The survey included nearly 2,200 IT executives and technology decision-makers at enterprise and small and medium-size businesses (SMBs) in North America and Europe .

According to Forrester’s Enterprise And SMB Software Survey, North America And Europe, Q4 2009, the poor economic environment created a backlog of business application software upgrade activities for firms, and many plan to address the issue this year.

(more…)

From World Advertising Research Center

Most major brands in the US are likely to heighten their focus on platforms such as social media and mobile this year, but concerns over measurement remain for many companies.

Datran, the digital marketing specialist, surveyed 5,000 marketing executives drawn from Fortune 500 companies, leading publishers and prominent advertising and media agencies.
It found that there was “significant optimism” among its panel regarding prospective communications expenditure levels this year, following on from a decline in budgets in 2009.

(more…)

By John Riley

 “People should be aware that an extraordinary treasure chest of information has been stolen. And the same people doing the military espionage are engaged in economic espionage using the same or very similar techniques to steal information from organizations that are working on business ventures in the attackers’ country” says Alan Paller, director of research for the Sans Institute, a computer security company, in a PC World article, March 8.

 In a Wired Magazine article, February 3,   Kevin Mandia, CEO of Mandiant, a computer forensic security firm revealed, “The attack that hit Google is identical to publicly undisclosed attacks that have quietly plagued thousands of other U.S. companies and government agencies since 2002 and are rapidly growing. The scope of this is much larger than anybody has conveyed. There are thousands of companies compromised. Actively, right now. And they represent a sea of change from the attacks that have commonly hit networks.”

 Mandia  points to an incident last year: “a spear-phishing campaign (waves of targeted e-mail attacks) that targeted an unnamed, high ranking counterterrorism official, and two coordinators of local, state and federal intelligence. The report doesn’t indicate how successful the attacks were other than to say the intruders stole e-mail and information that helped them map networks and locate valuable data.” 

 Attacks are rarely detected by antivirus or intrusion programs

 “Called Advanced Persistent Threats (APT), the attacks are distinctive in the kinds of data the attackers target, and they are rarely detected by antivirus and intrusion programs. The non-APT hackers target only financial data or sensitive customer data for identify theft, while the APT attackers never target such data. Instead, their focus is espionage. They attempt to take every Microsoft Work, Power Point, and Adobe PDF document from every machine they compromise, as well as all e-mail,” says Mandia.

 A Sans Institute study, September 2009,  shows 60% of total attack attempts are against web applications. Unrelenting e-mail attacks have penetrated Adobe PDF Reader, Quick Time, Adobe Flash and Microsoft Office and have been the major source of infection of client side computers. Users are fooled by expecting trusted sites to be safe when, in fact, downloaded documents or music may carry malware. In some cases, there is no need to open a document to become infected; visiting the infected site is all that is necessary . What few people realize is that these user applications can also be attacked remotely.

 Hackers are making an enormous effort to infect trusted web sites so they become malicious websites distributing infected content. Confronted with unending and escalating attacks, organizations have difficulty knowing which threats offer the greatest risk and what resources should be allocated.

 Mobile devices are the new target

 Now,  mobile devices are emerging as the  new frontier of cyber espionage  as they come under attack from malware,  reports bitDefender, a software security firm. According to Bogdan Dumitru, Chief Technology Officer, “there are numerous, documented cases recently of targeted malware attacks against business, usually employing infected MSOffice files.” Thus far, infection has not spread beyond the targeted accounts suggesting the malware used was written for specific companies. However, all of the security concerns of the Internet are now present in the mobile world where the integration of mobile devices with web browsers enable access to the always-on Internet.”

 Hackers have a variety of reasons for doing what they do, but none are more important than  stealing data or installing a back door through which they can return later. For that reason,  major organizations will patch their operating system weaknesses first and then patch client side application problems which usually take twice as long.

 Over the years, defenders who have learned attacker techniques have become the people most effective in combating them. As a White House spokesperson recently commented, “offense must inform defense” or in other words, those with experience countering attackers need to help train those who have spent all their time defending against them.

 U.S. is the primary cyber espionage target

 The Sans Institute concludes the United States has presented greater value propositions for attackers than other countries, reaching nearly 35 million server-side HTTP attacks by destination over a recent six month period. All other countries, including China and the Russian Federation have received less than 5 million attacks. There is little doubt the U.S. has become the world’s cyber battleground.

 Cyber Espionage (4 of 5) Prevention Takes Many Forms will appear April 7.