Gregarius » éléments par Stuart Poole-Robb

Canaux

108413 éléments (108413 non lus) dans 10 canaux

Actualités (48730 non lus)

• 01net. Actualités (48730 non lus)

Hoax (65 non lus)

• Top dix quotidien Sophos des canulars (65 non lus)

Logiciels (39066 non lus)

• BetaNews.Com (34382 non lus)
• Presence PC - Actualité Logiciels, jeux vidéos (3551 non lus)
• LeMondeInformatique.fr : Actualités Applications (1133 non lus)

Sécurité (1668 non lus)

• Actualités Sécurité Informatique (406 non lus)
• Les Nouvelles.net : sécurité informatique. (1262 non lus)

Referencement (18884 non lus)

• Secrets2moteurs (11765 non lus)
• Referencement Google WebRankInfo (2255 non lus)
• Abondance (4864 non lus)

éléments par Stuart Poole-Robb

BetaNews.Com

• 

  Companies want to go after their attackers

  Publié: novembre 25, 2015, 9:26pm CET par Stuart Poole-Robb

  

  Corporates on both sides of the Atlantic are calling for changes in the law to allow them to fight back against the current wave of cybercrime.

  As things now stand, corporates are discovering that the very laws meant to protect individuals against being hacked are now serving to protect the organized criminal gangs (OCGs) who are stealing billions from their accounts, compromising sensitive customer data and ransoming their most confidential data.

  While many institutions and their advisers have the resources to go after malicious hackers in order to discover their identities and to try and recover some of their misappropriated data and cash, they are prevented from doing so by the Computer Misuse Act in the UK and equivalent rulings in the US.

  The intention of those drafting these laws was not, of course, to protect hackers and OCGs but to defend the data privacy of organizations and individuals. However, the laws are now working against the interests of legitimate organizations by forcing companies to try and fight back with both hands effectively tied behind their backs. US companies are now clamoring for changes in the law to allow them to track down hackers and have been voicing the desire to be allowed to hit back at foreign adversaries who are attacking their IT systems.

  But the US authorities are wary of making changes in the law which could result in an escalation of the cyber war which is developing between the criminals and legitimate companies. US Defense Department spokesman, George Duchak, director of the Defense Department’s Defense Innovation Unit Experimental has warned against an overly pro-active approach.

  "Like the Wild West Where Everybody’s Shooting"

  He said: "I think once you go outside your networks, you’re setting a dangerous precedent. It becomes like the Wild West where everybody’s shooting, and there would be a lot of collateral damage".

  There are also concerns among US officials that firms may lack the necessary skills to ensure that they are going after the right targets. Renee Tarun, senior cyber strategist on the National Security Agency’s Cyber Task Force, has also warned companies that it can be difficult to determine the source of a hack.

  But some US companies who do have the wherewithal needed to identify their attackers are now bridling under the frustration of knowing who is hacking them but feeling unable to do anything about it. This problem is accentuated by the rapidly growing global terror risk in the wake of the recent terrorist attacks in Paris.

  There is growing evidence that terrorist groups are now using cyber warfare to support and augment attacks of a physical nature. There are already reports of a massive cyber-attack on French communications systems up to 48 hours prior to and during the Paris attacks. The attack is said to have taken down the French mobile network, severely limiting police surveillance of the situation. Industry commentators point to the sophistication of the cyber-attacks.

  According to Dr Paul Craig Roberts, former Assistant Secretary of the Treasury for Economic Policy: "The attack was not a straightforward DDOS attack but a sophisticated attack that targeted a weakness in infrastructure hardware". He adds that such an attack is beyond the capability of most organizations and requires capability that is generally thought unlikely to be in the Islamic State of Iraq and the Levant (ISIL)’s arsenal.

  He says: "An attack on this scale is difficult to pull off without authorities getting wind of it. The coordination required suggests state involvement".

  Dividing Line Perilously Thin

  The dividing line between criminal hackers and state actors has also become perilously thin. The Chinese military, for example, now literally employs regiments of cyber-hackers bent on accruing Western know-how. Many organizations are now fearing that if their governments are not doing enough to protect them, they should be allowed to defend themselves against increasingly sophisticated attacks from stat actors.

  Citing the loss of hundreds of billions of dollars of intellectual property to Chinese hackers, Randall Fort, director of Programs Security at major defense contractor Raytheon asked, "In my company, I actually have the screenshots of the Chinese [who] are stealing my information. So the attribution issue isn’t necessarily a problem for everybody... Why shouldn’t firms be able to do something about that?".

  There is some truth in the view that to leave it up to the private sector alone to go after OCGs, terrorist groups and state actors on their own would be unadvisable This kind of research would, in any case, be likely to led companies into investigating their attackers on the Dark Web. To attempt this without long-standing embedded sources on the criminal forums would likely expose them to further risk of hacking.

  Ideally, the private sector should work in tandem with government agencies on both sides of the Atlantic to combat the growing cyber threat. Government resources are, however, currently stretched to capacity and their abilities to chase after hackers are limited.

  In the current climate, the best solution is for firms to employ qualified third-party advisers with the necessary software skills and embedded sources such as KCS to locate the source of the hack before taking legal advice about how best to proceed.

  Stuart Poole-Robb is the chief executive of the security, business intelligence and cyber security adviser, the KCS Group Europe.

  Published under license from ITProPortal.com, a Net Communities Ltd Publication. All rights reserved.

  Photo Credit: Nicholas Piccillo/Shutterstock

  
• 

  Why LinkedIn is hacker heaven

  Publié: septembre 21, 2015, 5:07pm CEST par Stuart Poole-Robb

  

  Professional social networking site LinkedIn has proven to be a valuable business tool, bringing together professionals from all over the world.

  But few corporations grasp the security risk injudicious use of LinkedIn represents. The main problem is not with the LinkedIn website’s own digital security but with a widespread corporate ignorance of the way the organized criminal gangs (OCGs) who make billions, sometimes tens of billions, of dollars from cyber crime.

  The hackers are now using well-known brands names such as Standard Chartered Bank on LinkedIn to attract senior executives to divulge information that they can use. It’s all very plausible unless you know what to look for.

  Using a process called ‘social engineering’, OCGs assemble as much information via the Internet as they can on a target subject within an organization that has been identified as likely prey. LinkedIn is proving a rich vein for OCGs. Executives have become too cavalier about posting details of their movements and personal information on LinkedIn.

  KCS’ own experience shows that 90 percent of passwords take the form of the name of a sports team, a pet or other personal details. But even if the target has been careful to use a more complex password, their organization’s most sensitive data might still be at risk. For example, details of business trip dates combined with personal details such as a recent illness or family names can be all an OCG needs to socially engineer a 'Friday Afternoon' attack.

  Typically, this would take the form of an email, phone call or possibly a combination of the two in order to convince someone at the company that an important executive is making an urgent request. Sometimes, this is a straightforward scam where the end goal is a money transfer to a third party account.

  But a quick financial hit is by no means the worst occurrence. Sometimes, the request may not be for cash but for passwords or access to sensitive data. This data may then be ransomed back to the company for a huge non-negotiable fee, sold to competitors or simply put up for sale on the Dark Web. In this scenario, the company may remain blissfully unaware it has been hacked for months or even years.

  A recent example is a cyber attack hitting US health insurer Excellus BlueCross BlueShield that exposed personal, financial and medical information of over 10 million people. Recent evidence now shows the initial hack of the Excellus-Lifetime systems occurred in December 2013 but went undiscovered by the companies’ IT staff for some time.

  The security industry on this side of the Atlantic is now asking how long it will before we see the same effective attacks hitting the healthcare industry and the Local Councils here? Neither are adequately prepared or able to cope at this time.

  So far, in the UK this combination of psychological and technological techniques to access personal information is mainly being used to target law firms. The reason is thought to be that many law firms are hierarchical and if a senior partner emails the finance department to ask for a money transfer it generally has to be done swiftly and without question.

  But this does not mean that organizations working in sectors other than law or healthcare have any room for complacency. OCGs have a tendency to target what they see as "low-hanging fruit" first, before adapting their new offensive strategies to those organizations which have sensitive data and security systems that can be breached fairly easily. There is, therefore, little doubt that companies working in other sectors are probably already being targeted by OCGs.

  As with the "Friday Afternoon" attacks taking place on banks on legal firms, social engineering will play a crucial part in future cyber attacks on a wide spectrum of industries and businesses.

  Aside from discreet social engineering, LinkedIn also offers other opportunities for the OCGs. KCS’ own research shows that "false flag" profiles can be used to great effect. These are essentially fake identities built around the fictional profile of an attractive member of either sex.

  These are designed to tempt the target to connect with the fake profile. Once this is done, the OCG then not only has access to all the target’s business contacts but also to their other social networking profiles such as Facebook. Additional personal information gleaned from Facebook can be used to gain more personal information on the subject.

  KCS conducted a simple test on how effective this strategy is by subjecting half the attendees at a cyber security conference within the legal sector to a "false flag" profile of an attractive young woman. Over 50 percent of those targeted responded by connecting with fictional lady, with two men actually inviting "her" on a dinner date.

  Had the "false flag" been posted on LinkedIn by an OCG then anyone foolish enough to arrange a dinner date might find themselves blackmailed into revealing company passwords etc. Or they might not notice that during the course of the evening their new companion had taken their phone for a few minutes and hacked into it using a $50 device available on the Internet known as a "Rubber Ducky", thereby compromising the unfortunate executive’s entire corporate IT network.

  The only real safeguard is to educate all staff that all social networks are potential minefields and that, under no circumstances, should they discuss confidential company information or reveal personal details that could be used by an OCG to socially engineer a cyber attack

  Stuart Poole-Robb is the chief executive of business intelligence and cyber security adviser, the KCS Group.

  Published under license from ITProPortal.com, a Net Communities Ltd Publication. All rights reserved.

  Image Credit:  Gil C / Shutterstock

  
• 

  Inside threats enable vast majority of cybercrimes

  Publié: septembre 7, 2015, 11:08am CEST par Stuart Poole-Robb

  

  No less an authority than colorful cybersecurity pioneer John McAfee firmly believes that the now infamous hack of the US-based Ashley Madison sex-cheating website was an inside job.

  Statistically, this is extremely likely to be the case for most cyber security breaches. KCS’ own research shows that 80 percent of corporate cybercrimes can be traced to staff, and this figure is increasing. This can be the result of deliberate cybercrime or it could be that the staff member has been careless with their personal log-in details.

  But whether a security breach was malevolent or not makes little difference once an organized criminal gang (OCG) exploits it to the full. Once inside an IT system, OCGs can easily run ransomware across the target organization’s entire communications network.

  By encrypting the target company’s most sensitive data while withholding the software key needed for decryption, the OCG is able to demand that the target organization pays a massive ransom to retrieve its data. Should the company refuse or be slow in paying the ransom demand, the OCG may find its most sensitive customer data has been up for sale on the Dark Web, the internet’s largely anonymous mirror economy where it is possible to buy everything from stolen data to illegal weapons.

  Ransomware Comes With Telephone Support for Hackers

  Ransomware is available on the Dark Web for as little as $500. Some illegal software developers even offer 24/7 telephone support for hackers with weak technical skills. It could, therefore, be a mistake to think that any member of staff except an IT wizard would be capable of stealing corporate data.

  In an era where most organizations run on electronic communications, it is not only executives and IT engineers who hold the keys to the IT kingdom. Any member of staff with Internet access at work is a potential breach. Many chief executives pride themselves on being a good judge of character, but few outside small start-up organizations would claim to be able to vet their entire staff with a sideways glance. In many organizations, this leaves thousands of members of staff at all levels appearing to be potential security leaks.

  It is, therefore, essential that organizations in all sectors of industry develop a cyber-security policy that no longer only reinforces the company’s outer firewall IT defenses but also tackles the greater danger -- the insider threat. It is, however, essential that this be done without instigating a witch hunt or developing a corporate paranoia where every member of staff feels constantly under suspicion. Ironically, it is precisely this type of paranoid, stressful work environment which new research reveals is the most fertile breeding ground for home-grown cyber criminals.

  According to the US Department of Homeland Security: "An inside threat is generally defined as a current or former employee, contractor, or other business partner who has or had authorized access to an organization’s network, system or data and intentionally misused that access to negatively affect the confidentiality, integrity or availability of the organization’s information or information systems".

  Homeland Security believes that insider threats involve not only installing ransomware but also include sabotage, theft, espionage, fraud and competitive advantage. KCS’ case files also hold examples of commercial companies being used by foreign powers as a gateway to defense contractors in addition to hackers stealing data in order to disguise as legitimate market research -- a process know as data laundering.

  To defend against the insider threat, organizations need to ensure their security software is developed to deal with the growing insider threat. For example, KCS Sentinel ZoneFox monitors each and every user interaction with critical data stored on the firm’s computer systems. By monitoring each and every user interaction with data, Sentinel can inform organizations of any behavior occurring on this systems that may be indicative of malicious or non-compliant behavior.

  Companies Blissfully Unaware When Data Is Copied or Stolen

  However, in many cases, companies often remain blissfully unaware when data is copied or stolen for malicious purposes. Sometimes, confidential data such as product designs and sensitive customer information is available online via the Dark Web.

  Companies should use third-party advisers with deeply embedded sources on the Dark Web so that they can be alerted if some of their data is being offered for sale. By monitoring the online chatter of criminals on the Dark Web, it is also possible to have advanced early warnings of a likely cyber attack.

  In an age where executive CVs often describe careers with numerous organizations spread over several continents, it is crucial that incoming staff be thoroughly vetted. This is best achieved by discreet non-conventional due diligence (DNCDD) in order to identify weaknesses or anomalies in someone’s background. Far too many organizations are failing to validate CVs. In 2015, it is almost impossible for any member of staff, not only executives, not to leave a digital trail. While full DNCDD should be deployed in the case of incoming executives, it is now possible to carry out fairly extensive online background of all members of staff to highlight any warning signals.

  This can be used to augment the kind of personality profiling that Homeland Security believes can be used to identify potential bad apples. In the absence of online DNCDD, personality profiling can be counter-productive, generating a work culture of paranoia and suspicion.

  However, if third-party vetting is carried out discreetly in conjunction with the other forms of monitoring described above, companies can be in a position to trust their staff, while knowing they will be instantly alerted to any potential wrong doing.

  Stuart Poole-Robb is the chief executive of the security, business intelligence and cyber security adviser, the KCS Group Europe.

  Published under license from ITProPortal.com, a Net Communities Ltd Publication. All rights reserved.

  
• 

  Malware-as-a-service is cyber criminals' new lucrative business

  Publié: juillet 7, 2015, 4:41pm CEST par Stuart Poole-Robb

  

  Organized criminal gangs (OCGs) are increasingly using software services of the type more usually associated with legitimate corporations to grow their operations. By offering malware-as-a-service, OCGs are employing business models similar to those developed by legitimate companies in order to extend their global reach.

  The companies providing the software used by OCGs to break into organizations’ IT systems, commonly called malware, now employ business models frequently comprising a revenue stream, a budget, market researchers, a global pool of developers, software quality assurance and testing, help desk support, and even money-back guarantees. This process is now being referred to as the industrialization of cyber crime.

  Intelligence and security services now fear that cyber attacks on corporates may start to escalate severely as a result of the proliferation of off-the-shelf malware designed to break into corporate IT systems. Speaking at the recent InfoSec Security Conference in London, US Federal Bureau of Investigation (FBI) agent Michael Driscoll said that the potential effects of selling malware as a service in this way are potentially devastating.

  According to the FBI, the malware-as-a-service industry is currently being controlled by a relatively small group of criminals. Driscoll believes that as few as 200 people may be enabling OCGs to mount sophisticated cyber attacks by selling over-the-counter malware, botnets, distributed denial of service (DDoS) software and other hacking services.

  The full scale of the threat is, in any case, hard to quantify accurately. In an effort to disguise their identities, the OGCs offer their services on the Dark Web, where slick websites offer services ranging from illegal drug deliveries to assassinations.

  By encrypting communications and using the virtual currency, Bitcoin, as an online currency, the OCGs hope to remain anonymous. The increasing globalization of the Internet also makes it all but impossible to track down the shadowy figures behind the industrialization of the criminal web. For example, while the malware development industry in Russia alone is estimated to be worth roughly $2 billion (£1.2 billion) a year, the Russian authorities are reluctant to pursue hackers whose victims are outside Russia.

  But there is also evidence that the industrialization of cyber crime may be growing. One clear indication that the global malware market is being directed by the same market forces that govern any industry is the downward pressure on the pricing of some services. As a relatively old-fashioned form of cyber intrusion, a DDoS attack, can, for example, be contracted on the Dark Web at under $40 (£25) per hour.

  While many organizations now have security systems in place in order to deal with DDoS attacks, many of these intrusions now mask a more sinister trend. But as the most common type of DDoS attack involves overloading the target organizations email service with communication requests, dealing with this form of intrusion is extremely time consuming for the target organizations IT team.

  It is for this reason that OCGs now increasingly see a DDoS attack not as an end in itself but as a smokescreen for a subtler and more sophisticated malware attack. Falling prices in services such as DDoS attacks are evidence of a growing and increasingly competitive industry and should be seen as a warning of more smokescreen DDoS attacks.

  Other types of hacking services are also freely available on the Dark Web. Phishing and spear phishing attacks are also being sold as a service. A standard phishing attack involves sending spoof emails in order to gather sensitive information such as passwords and financial data.

  A spear phishing attack, on the other hand, is designed to send particularly convincing emails to selected individuals within a targeted organization. Often, a technique referred to as social engineering is used to discover personal details about an executive or selected staff member in order to make the fake email appear more convincing. In some cases, the spear phishing attack merely instructs the unsuspecting target to release a password or transfer funds to a bank account under the control of the OCG. In other cases, the spear phishing email comes with an attachment. Believing this to be from a bonafide source within his/her own organization, the victim of a spear phishing attack will innocently open what appear to be, for example, a straightforward Word document.

  But the attachment also contains hidden malware which opens a back door into the target organization’s IT system, giving the OCG untrammeled access to the target organization’s entire database.

  Another website active on the Dark Web gave details of an even more sophisticated form of malware, ransomware. This is the software widely used to hold corporations to ransom after encrypting their most sensitive data. Unless the target organization pays the ransom demand within a certain period of time, the files become permanently encrypted or destroyed.

  All the malware needed to make these and other types of attack are now available on the Dark Web at a price. Given the growing industrialization and sophistication of malware-as-a-service, companies can expect an escalation in targeted attacks from OCGs.

  In order to protect themselves against the newly industrialized cyber crime industry, companies must not continue to rely on traditional anti-virus software, which is virtually useless against modern malware. Instead, they must employ best-practice Twentieth Century software such as KCS Glasswall in order to halt spear phishing and other malware attacks.

  This can identify incoming communications and stop anything that comes from an unknown or untrusted source.

  Stuart Poole-Robb is the chief executive of the security, business intelligence and cyber security adviser, the KCS Group Europe.

  Published under license from ITProPortal.com, a Net Communities Ltd Publication. All rights reserved.

  Photo Credit: igor.stevanovic/Shutterstock

  
• 

  Cyber theft could lead to another financial crisis

  Publié: juin 2, 2015, 4:14pm CEST par Stuart Poole-Robb

  

  In the digital age, money is rapidly evolving into lines of computer code which can easily be hacked, ransomed or stolen by organized criminal gangs (OCGs).

  While computerized digital transactions have been instrumental in promoting international commerce and the creation of what is becoming a global economy, they come with a price. The fact that much of the world’s wealth is now stored on computer servers means that this wealth can be stolen or ransomed by cyber criminals. There are also fears that cyber terrorists, possibly state activists in the pay of a foreign power, might simply wipe all records of a significant proportion of the West’s wealth in order to create economic chaos and a financial meltdown.

  After Britain abandoned the gold standard in 1914, to be followed by other Western economies, it developed a floating currency, in which a currency’s value is allowed to fluctuate in response to the foreign-exchange market. Money has, however, now entered the next stage in its evolution by becoming digital. The new crypto-currency Bitcoin, for example, which the Bank of England regards as simply another foreign currency, is entirely digital and frequently used for anonymous criminal transactions on the Dark Web as well as for money laundering, although it can also be used legitimately and is now accepted as a bona fide currency by a growing number of multinational corporations.

  Money Has Metamorphosed into Vulnerable Lines of Code

  Because the banks have so far been able to cover their losses and have been reluctant to own up to the scale of the losses they have sustained, there is little public awareness of the fact that money has metamorphosed from cash lying around in vaults to vulnerable lines of code stored on computer servers connected to the Internet. And when some of this code is stolen or compromised by OCGs, the effects can be devastating as most organizations are drastically under-insured against the consequences of cyber-crime. While the banks are becoming increasingly aware of the dangers posed by cyber-crime and terrorism, few of their IT systems are sufficiently safeguarded against cyber breaches.

  According to a report from US regulator, the Financial Stability Oversight Council: "Malicious cyber activity is likely to continue, and financial sector organizations should be prepared to mitigate the threat posed by cyber-attacks that have the potential to destroy critical data and systems and impair operations".

  Hackers have been finding the banks to be easy prey for some time. In a series of coordinated bank cyberattacks initiated in late 2013, an OCG stole around US$1 billion from more than 100 banks by simply using spear phishing emails sent to bank employees. The emails appeared to be legitimate banking communications but contained malware that exploited software vulnerabilities opening a remote backdoor providing criminals remote access to bank computers. Once this was achieved, the attackers were able to manipulate accounts, transfer money and order ATMs to dispense cash at designated times and places.

  But there are now growing fears in the banking industry worldwide that financial institutions and their clients may be sacrificing security even further in their pursuit of ever-faster online transactions. According to Australian bank ANZ, a Reserve Bank move to accelerate all electronic payments through the banking system within the hour has serious implications for cyber security. Other countries, including the UK, have already begun processing bank payments in real time or close to it.

  There is, however, another even greater cyber-security threat emerging in the form of the technology industry’s attempts to develop software that would make it possible for major currencies like the dollar or the euro to be used like Bitcoins. This would enable anyone in the world to conduct transactions directly with anyone else in the world, potentially bypassing the banks and other transmission mechanisms such as Western Union completely.

  New Era of Purely Digital Transactions

  Tech giant IBM is reported to be one of the companies developing ways of ushering in the new era of purely digital financial transactions. IBM is understood to be using a variant of Blockchain, the underlying technology that powers the new digital currency Bitcoin. This effectively offers a comprehensive digital record of digital currency transactions. Instead of being stored on a separate computer server controlled by, for instance, a bank, the digital ledger can be accessed by all participants in the network.

  This technology could allow users to make payments in major currencies instantly, anonymously and, crucially, without government regulation. IBM is reported to already be involved in informal discussions about a Blockchain-style cash system with a number of central banks, including the US Federal Reserve. Should central banks approve the concept, IBM is understood to be prepared to build the underlying infrastructure. IBM is understood to be only one of a number of tech companies looking to expand the use of the Blockchain technology beyond Bitcoin to encompass more established currencies.

  UK-based Juniper Research predicts that cyber criminals will be stealing a staggering US$2.1 trillion a year globally by 2019. Unless national governments and financial institutions across the world make a concerted and co-ordinated effort to better safeguard the IT systems that protect their digital cash holdings, the West faces the very real danger of a new and potentially devastating financial crisis.

  Stuart Poole-Robb is the chief executive of the security, business intelligence and cyber security adviser, the KCS Group Europe.

  Published under license from ITProPortal.com, a Net Communities Ltd Publication. All rights reserved.

  Image Credit: nopporn / Shutterstock

  
• 

  The billion dollar Carbanak bank heist could have been easily avoided

  Publié: février 23, 2015, 5:52pm CET par Stuart Poole-Robb

  

  This month, the $1 billion bank heist affecting up to 100 financial institutions has highlighted a growing gulf of miscommunication between chief executives of large organizations and their IT departments.

  Kaspersky Lab reports that, working with international law enforcement agencies Interpol and Europol, it discovered that the gang, dubbed Carbanak, used malware enabling it to see and record everything that happened on staff’s screens. These and other recent high profile cyber-attacks, such as that which recently saw 76 million customer accounts hacked at financial institution JPMorgan Chase, are forcing organizations such as banks to examine why cyber criminals see them as easy pickings. Some are rapidly reaching the conclusion that they need to plug any security holes not only in their own networks but also in those of their advisers and partner companies.

  Bank of America Merrill Lynch, for example, believes it is "one of the largest targets in the world" for cyberattacks and is auditing cybersecurity policies at its outside law firms. According to the bank, law firms are "considered one of the biggest vectors that the hackers, or others, are going to go at to try to get to our information".

  Disconnect between boards and their IT departments

  However, the main reason that cyber criminals see large corporations and their senior advisers are seen to be such easy targets by cyber hackers is an alarming disconnect between company board members and their IT departments – a virtual 'Intelligence Gap'. A report "Exposing the Cybersecurity Cracks: A Global Perspective" conducted by the Ponemon Institute last year, shone a light on board-level ignorance regarding cyber security. Of the 5,000 IT and IT security professionals interviewed for the survey, almost half said that their board level executives have a sub-par understanding of security issues.

  But the problem goes deeper than ageing board members who may not have bothered to keep abreast with the digital age. IT departments themselves are also partly responsible for the huge intelligence gap which has grown between themselves and their board. Chief executives and senior board members are frequently surprised by the way IT heads frequently regard their departments as personal fiefdoms, resenting any external examination of procedures.

  Emotional impasse

  This is, in part, a legacy of a time when the majority of company directors were largely computer illiterate and rather proud of it. But it is also a result of an emotional impasse that now exists between IT department heads who are defending what they see as their personal fiefdom without comprehending that cyber security impacts every area of the company’s operations.

  Ring-fencing cyber security in this way leads to a dangerous culture of complacency within organizations, lulling the chief executive and his board into a sense of complacency, believing their cyber defenses to be impregnable when this may be far from the truth.

  A more realistic picture would be for the chief executive to understand that his/her organization is likely be hacked -- if it has not already been compromised. Unless a company regularly conducts third-party penetration tests on its digital defenses, it is highly likely that much of its data may already be compromised. In reality, this means that cyber criminals and business rivals alike will likely have access to some the company’s most sensitive business data.

  While IT departments may mistakenly think that cyber security is a purely IT matter, it actually crosses over into HR and other areas. Many data breaches, for example, come not from outside hackers but are internal, sometimes the work of disgruntled or dishonest staff or even ex-employees. According to industry estimates, roughly a third of all ex-staff in the UK still have access to data held by their former employer.

  The first step taken should, therefore, be to ascertain which data has already been compromised and by whom. Chief executives should rely on internal investigations conducted by in-house IT staff as they may overlook existing and long-standing "blind spots".

  An intruder can sit on an IT system undetected for months

  Often, an intruder can sit on an organization’s IT system for months or, in some cases, years before the host becomes aware. In such cases, the damage can be hard to quantify. A rival may gain prior knowledge of a company’s business strategy through examining its most confidential documents in real-time or a cyber-thief may simply use information obtained to misdirect company funds. Next-generation data loss prevention software such as Sentinel, created by UK-based developer ZoneFox, tracks the history of each document, letting the organization know the complete history and usage of any data or user. By monitoring each and every user interaction with data, Sentinel can inform organizations of behaviors occurring on their systems that may be malicious or non-compliant.

  The next step is to assume that, even if no sensitive data has been breached, there is no reason to assume it will not be breached in the future. This means developing a crisis management strategy capable of limiting the damage caused by a significant data breach.

  Until recently, a fully comprehensive cyber security policy was seen as little more than a 'nice to have'. But the massive data breach that compromised the data of over 70 million customers at US retailer Target and the subsequent resignation of its chief executive, Gregg Steinhafel, last year, provided chief executives with a much-needed wake-up call. When a data breach does occur, as it inevitably will, chief executives can no longer merely point an accusing finger at the head of their IT department and conveniently pass the buck.

  As legislation in the US rapidly moves towards making the reporting of corporate data breaches compulsory, chief executives will find their neck is on the line if they are seen to have mindlessly delegated all cyber security matters to their staff. Chief executives and their boards are also starting to discover that other third parties such as insurers and partner organizations are starting to scrutinize their cyber security policies.

  Those without an effective cyber strategy will soon find themselves paying increased insurance premiums and losing the confidence of those partner companies and clients who have taken the time to instigate effective cyber defense policies.

  Stuart Poole-Robb is chief executive of business intelligence and cyber security adviser of the KCS Group

  Published under license from ITProPortal.com, a Net Communities Ltd Publication. All rights reserved.

  
• 

  How data privacy is turning into an Orwellian maze

  Publié: février 16, 2015, 8:56am CET par Stuart Poole-Robb

  

  The Investigatory Powers Tribunal (IPT) ruling that GCHQ’s access to information intercepted by the NSA breached human rights laws is feeding a growing and increasingly heated global debate regarding the whole issue of digital privacy.

  Earlier this month, the tribunal held that the British intelligence and security agency had been in breach of articles 8 and 10 of the European Convention on Human Rights, referring to the right to private family life and to freedom of expression. But hard on the heels of the UK ruling came news that the US government is creating a dedicated agency to monitor cybersecurity threats, pooling and analyzing information across a spectrum of risks. The Cyber Threat Intelligence Integration Center (CTIIC)’s mission will be to 'connect the dots' between various sources of intelligence.

  Any new initiatives such as this by official bodies and governments to pool intelligence is likely to come under increasing scrutiny from online privacy pressure groups like Privacy International. However, establishing privacy rulings for digital data may soon become a King Knut-like exercise as the Internet becomes increasingly swamped by a sea of spyware. According to Kaspersky Labs, cyber criminals are now creating 315,000 new and unique variants of malware each and every day of the year.

  Digital privacy becoming a Utopian ideal

  The privacy debate is not a new one and many in the IT industry itself now believe that the very notion of digital privacy is rapidly becoming an unrealistic Utopian ideal.

  A decade and a half ago, Scott McNealy, head of Sun Microsystems said: "You have zero privacy anyway. Get over it!"

  A decade later, Google chief executive Eric Schmidt, a former protégé of McNealy, said, "If you have something that you don’t want anyone to know, maybe you shouldn’t do it in the first place".

  At the time, Schmidt’s comments caused consternation among privacy rights activists as Google was thought to be in discussions with the US authorities with regard to sharing its customer data to help combat cybercrime and terrorism.

  But even McNealy and Schmidt would privately admit that "zero privacy" does not negate the need for security. McNealy, for example, was adamant that pictures of himself with his children should not appear on the Internet for fear of their being kidnapped.

  While privacy groups may wish to turn the tide on what they see as the encroaching powers of the state, the greatest threat to privacy is coming not from western governments but from the ever-growing legions of cyber criminals and corporate cyber spies.

  What, for example, could be more private or personal than an individual’s personal health records? Yet millions of US citizens this week learned that their medical records had been compromised. Hackers broke into the data banks of Anthem, the country’s second largest medical insurer. A database containing the names, email addresses, birthdays and social security numbers of 80 million customers was compromised.

  Last year also saw the databanks of number of household names also heavily compromised. These included eBay, Target, Home Depot, JPMorgan Chase and Sony. The Home Depot hack alone resulted in 56 million people’s credit and debit card details being exposed. The hack at JPMorgan Chase exposed information belonging to roughly 83 million individuals and small businesses.

  The fact that tens, and perhaps hundreds of millions of people worldwide, have now had their personal data compromised following targeted cyber-attacks is beginning to make the whole data privacy debate look largely academic.

  As long as trusted institutions such as JPMorgan Chase are unable to provide adequate security for customer data, there is little that private individuals can do to safeguard their own data. For example, using TOR to encrypt personal messages would do little safeguard the mountains of data now held on all of us by banks, credit rating agencies, health services, telecoms carriers, retailers and a host of other organizations.

  Wi-Fi cafes a 'goldmine' for cyber criminals

  As consumers, the best most private individuals can do is to be selective about how they connect to the Internet. For example, anyone using Wi-Fi in a cafe or hotel should be aware that these facilities represent a virtual goldmine for cyber criminals, who are now well-equipped to spy on unsuspecting Wi-Fi users.

  Slightly larger than a smartphone, the Wi-Fi Pine-apple Mark V is the "ultimate" cyber surveillance device. It uses an "intuitive" web interface to enable hackers to break into Wi-Fi connections without users’ knowledge. It is widely available online and costs only $100.

  It is also well-known in security circles that some devices such as laptops which have originally been manufactured in countries such as China already come with illicit and pre-installed spyware. For example, last summer eBay barred listings for an Android-powered smartphone, the Star N9500, after it was revealed the phone had preinstalled malware designed to send personal information to a server in China. The malware was disguised as a legitimate Google Play Store App and was found to be impossible to remove.

  Be careful what you say in front of the TV set

  Some manufacturers even admit that their devices are capable of spying on their owners. Samsung has issued a warning for its latest Smart TVs relating to voice recognition software that enables users to issue voice commands to the TV via a small microphone on the remote control. Disturbingly, the software does far more than that.

  According to Samsung: "Please be aware that if your spoken words include personal or other information, that information will be among the data captured and transmitted to a third party through your use of voice recognition".

  As they see their data increasingly compromised by software vulnerabilities and malicious hackers, IT users will become more security conscious and less likely to share confidential information on social networking or in unencrypted emails.

  Until this intelligence gap between IT users and the true nature of modern communications technology is closed, many may find themselves staggering blindfolded through an Orwellian maze with all manner of 'third parties' -- official and unofficial -- looking over their shoulders.

  Stuart Poole-Robb is chief executive and founder of the KCS Group.

  Published under license from ITProPortal.com, a Net Communities Ltd Publication. All rights reserved.

  
• 

  Relying on Windows 10 security is risky for business

  Publié: février 3, 2015, 9:43am CET par Stuart Poole-Robb

  

  Microsoft’s latest operating system, Windows 10, unveiled earlier this month, places a fresh emphasis on corporate security. But there are already industry rumblings that over-reliance on Microsoft’s new security features could be dangerous.

  Windows 10 is designed to run across the types of devices common to most business users: PCs, laptops, tablets and smart phones. In order to safeguard users’ privileged data, the new OS uses a two-factor authentication system utilizing biometric ID in the form of a finger or thumb print. Users can enroll a single device, such as a smart phone, which will effectively become their mobile credential. It will enable them to sign-in into all of their PC’s, networks, and web services as long as their smart phone is nearby.

  It all rests on smartphones

  According to Microsoft: "The phone, using Bluetooth or Wi-Fi communication, will behave like a remote smart card and it will offer two factor authentication for both local sign-in and remote access".

  Additional security features include data protection software designed to enable users to define which documents are corporate and which are personal. Companies can also designate all new content created on the device as corporate by policy. Additional features can enable organizations to prevent data from being copied from corporate content to non-corporate documents or external locations on the web such as social networks.

  While the security features incorporated into Windows 10 have been designed to address some of the key cyber security challenges now facing corporates, the jury is still very much out as to how effective these will be.

  In a world where many organizations still endorse a bring-your-own-devices (BYOD) policy, an OS that operates seamlessly across all devices could pose a whole gamut of security risks.

  It is also unlikely that most companies which have provided staff with devices using a variety of operating systems, such as iPads, Android smart phones and others, would be unlikely to ditch all their legacy equipment simply to switch to Microsoft’s latest version of Windows.

  The fallibility of biometrics

  Even if they do, there is a danger that they could place an over-reliance on the supposed infallibility of features such as biometric identification. Although biometric identification was first introduced as high level security for situations such as the US president launching a nuclear attack, the digital age is already exposing some inherent security flaws.

  At a recent presentation at the annual Chaos Computer Club hacker conference in Hamburg, biometrics expert Jan Krisller, alias 'Starbug', showcased how he had taken pictures of Germany’s Defense Minister, Ursula von der Leyen, at a press briefing in October using a focal length of 200 mm from six feet away. These were of sufficient clarity to enable him to use commercial fingerprint identification software from Verifinger, to replicate the contours of the defense minister’s thumbprint. He then used a technique dating back to 2002 to dupe a biometric scanner. The first reported use of this technique was the so- called "Gummi Bear attack" of 2002, when Japanese cryptographer Tsutomu Matsumoto used gelatin -- as found in Gummi Bears sweets -- and a plastic mold to create a fake finger, which he claimed fooled fingerprint detectors four times out of five.

  Should Windows 10 have anything the corporate market penetration Microsoft hopes for, it is increasingly probable that hackers will find all kinds of imaginative ways of cloning key executives’ fingerprints. It is, for example, likely that a phone picked from an executive’s jacket suit pocket or hotel bedside table would be likely to already have his or her fingerprints on its touchscreen, potentially making the device less secure than it might have been with a more traditional form of security such as a personal identification number (PIN).

  An easy route for hackers

  The fact that Windows 10 operates across a wide range of platforms of devices also poses an additional potential security hazard. If a device is hacked, the cybercriminal, spy or terrorist can potentially access the entire corporate database. Moreover, as the linked devices must communicate with one another, there is also an opportunity for cyber criminals to hack into the communication channels between devices.

  There are, however, some additional security features in Windows 10 that are less of a headline-grabber than biometric ID but which may prove more useful in the long run. These include enabling users to differentiate between corporate and personal communications.

  Whilst outlining the new security features on Windows 10, Microsoft quoted a report from security firm Stroz Friedberg finding that 87 percent of senior managers admit to regularly uploading work files to a personal email or cloud account -- with 58 percent of users admitting to having accidentally sent sensitive information to the wrong person.

  It remains to be seen if Windows 10 represents a turning point for Microsoft in terms of cyber security. Previous versions of Windows have been relatively easy to hack for two simple reasons. The first is that the original OS, on which all the other are built, was never designed to be networked across more than a handful of computers and has a large digital 'footprint' made up of legacy code which frequently offers a number of hitherto unidentified  'backdoor' entry points for determined hackers.

  But, for years, Windows’ greatest vulnerability was a direct result of its commercial success. At a time when by far the majority of PCs and laptops ran Windows and Apple was no more than upstart in computing, there was little point in trying to hack into any operating system other than Windows.

  Today, however cyber criminals are increasingly turning their attentions to a wider range of operating systems such as the Apple iOS, Google’s Android and the main flavors of the open source OS Linux.

  But whatever operating systems companies opt for, it is essential that they take independent advice to establish a firm set of security protocols and safeguards of their own rather than relying on those built into generic third-party software.

  Stuart Poole-Robb is CEO and founder of the KCS Group

  Published under license from ITProPortal.com, a Net Communities Ltd Publication. All rights reserved.

  
• 

  The effect Obama's new cyber laws will have on UK firms

  Publié: janvier 23, 2015, 8:51am CET par Stuart Poole-Robb

  

  President Barack Obama made clear in his State of the Union address earlier this week that he intends to push through new legislation aimed at tightening corporate cyber security standards across the US. Just as the US’s Sarbanes Oxley Act of 2002, designed to improve the accuracy and reliability of corporate disclosures in the wake of the Enron scandal, effectively forced companies wanting to partner or do business with US corporations to comply with its rulings, so Obama’s proposed cyber laws are likely to have a global ripple effect across businesses outside America. Companies based in countries like the UK will need to tighten their own cyber security if they expect to do business with American firms which might otherwise see them as a weak link and potential vulnerability in their communications and data networks.

  In his address to the nation on Tuesday (January 20th 2015), Obama said: "I urge this Congress to finally pass the legislation we need to better meet the evolving threat of cyber-attacks, combat identity theft, and protect our children’s information. That should be a bipartisan effort. If we don’t act, we’ll leave our nation and our economy vulnerable".

  CISPA by any other name

  Although he did not refer to the proposed Cyber Intelligence Sharing and Protection Act (CISPA) and other recent proposals by name, sources in Washington concluded that it was these measures which Obama intends to implement. This would effectively mean that all US companies will be obliged to report breaches in their cyber security to customers within a 30-day period and would allow companies to share cyber threat information with the Department of Homeland Security.

  A nationwide federal law making the disclosure of cyber breaches obligatory across the US would replace the current patchwork of rulings which makes disclosure mandatory in some states but not in others. Once enacted, the new federal laws would also mean that companies outside the US will be forced to reassess their own security protocols. If, for example, a UK company elected to pursue a policy of non-disclosure of cyber breaches, it may find itself frozen out by its partners or clients in the US. Cybercrime does not respect national boundaries or laws and a significant proportion of successful corporate hacks use associate organizations as an entry point. American companies will, therefore, become wary of forging close links with organizations which do not meet their own increasingly stringent cyber security protocols.

  If, for example, a UK company elected to pursue a policy of non-disclosure of cyber breaches, it may find itself frozen out by its partners or clients in the US. Cybercrime does not respect national boundaries or laws and a significant proportion of successful corporate hacks use associate organizations as an entry point. American companies will, therefore, become wary of forging close links with organizations which do not meet their own increasingly stringent cyber security protocols.

  Industry backlash

  Some of the proposed new cyber legislation is likely to meet with opposition from those who are wary of too much government interference in their affairs.  American civil rights group, the Electronic Frontier Foundation, warns that the proposed ruling would mean the U.S. Government having full access to innocent users’ personal information. The foundation also warns that the Obama administration’s plans to modernize the Computer Fraud and Misuse Act (CFAA) could result in prison terms of up to 10 years for those who carelessly divulge information such as passwords.

  Many in the industry are also commenting that it is difficult to see how the proposed legislation could have prevented the Sony hack at the end of last year or the recent breaches of US Government websites. There are already calls for a different legislative approach such as making cyber insurance mandatory for all organizations. Although purchasing cyber insurance would do little in itself to prevent an attack, it could mitigate the ill effects for the company concerned and its customers. Before insurers will underwrite a cyber-insurance policy, they generally require a detailed assessment of the company’s security. This may involve penetration testing the organization’s digital defenses. Weaknesses exposed during this process can then be corrected, making successful cyber security breaches less likely in the future. There would also be an added incentive for firms to avoid having cyber breaches in order to ensure their cyber insurance premiums are not dramatically inflated as a result.

  There is, however, now little doubt that the US Government is determined to police the digital frontier. Obama has already vowed to tame the online world, which he regards as a "Wild West". The US president should, however, be wary of introducing laws without giving full consideration to their longer term impact.

  Encryption and the authorities

  Some of the legislative already mooted by those in authority could have potentially disastrous results. For example, James Corney, the director of the Federal Bureau of Investigation (FBI), recently heavily criticized companies such as Apple for embracing end-to-end encryption such as that installed on Apple’s latest mobile operating system. His argument is that widespread adoption of encryption might prevent the authorities from accessing communications records even when a proper warrant had been issued by the courts. This was an idea eagerly snapped up by Britain’s Prime Minister David Cameron. In the wake of the Charlie Hebdo terrorist attack in Paris at the start of the year, he implied that the UK government had plans to restrict the use of encryption.

  The industry’s initial reaction was to decry the introduction of an encryption ban as unworkable and potentially harmful to legitimate business. Cyber criminals and terrorist would easily be able to sidestep any new laws and penalties by routing encrypted communications via a proxy server. The only ones to be disadvantaged by an encryption ban would be legitimate companies who would effectively be obliged to make it easier for cyber hackers to access privileged information from their communications networks by sending unencrypted messages.

  But, while political leaders struggle to come to terms with a virtual world over which they have limited control, businesses based outside the US should keep a close watch on any new cyber legislation. As American companies start to adopt new cyber security protocols and standards, companies on this side of the Pond will increasingly find themselves obliged to follow suit.

  Stuart Poole-Robb is chief executive and founder of KCS Group.

  Published under license from ITProPortal.com, a Net Communities Ltd Publication. All rights reserved.