 |
 |
| Famous last words: "yeah, I'm pretty sure
we've got a firewall" |
Spring 2006 Issue #1 Vol.3 |
Lead story:
A False Sense of Security Permeates the Business World:
Here are its 8 Leading Causes
Top headlines:
1. Kama Sutra Worm Set to Strike Windows Machines on Feb 3rd
2. ChoicePoint Fined $15 Million for Losing 163,000 Private Records
3. New Site Helps Users Research and Report Undesirable Software
4. Best Reason Yet To Use Google
5. Zero-day Exploit Embarrasses Microsoft
6. ID Theft Leads FTC List of Consumer Complaints
7. Consumers Find Cybercrime 3 Times More Likely Than Physical Crime
8. Ontario Court Dismisses Case After Plaintiff Hacks Into Server9. Australian Police Apologise After Sending Child Porn To Schools
10. Two New Must-Have Services for Small and Mid-Size Businesses
11. Microsoft Makes Internet Explorer 7 Available To the Public
Lead story:
A False Sense of Security Permeates the Business World.
Here are its 8 Leading Causes
According to a report released by Symantec last week, the average laptop contains a whopping $1M worth of information. The AVERAGE laptop. Some executive notebooks are valued as high as $US8.8 million based on the client data, intellectual property and confidential information they contain. The news comes about 10 years after the industry noted that laptops are the most valuable target of corporate theft. Today, according to the recent FBI computer crime survey, 50% of organizations reported the theft of laptops in 2005.
All theft aside, according to Silicon.com, in the UK as many as 10,000 laptops are simply lost or forgotten in public places each year. That adds up to a lot of valuable data. In the US, according to the FBI study, 2.8million organizations experienced losses totaling $67.2 million as a result of security incidents. That number was found to be 3 to 4 times HIGHER than in previous years.
According to SecurityFocus: "Among the [FBI Study] findings, nearly nine out of ten organizations experienced security incidents in the past year. Over 64% of respondents incurred a financial loss as a result of computer crime - yet only 9% reported these incidents to law enforcement. The United States and China top of the list as by far the worst offenders, together accounting as the source of more than half of all external intrusion attempts. However, not surprisingly the survey also reports that 44% of all reported intrusions were sourced as internal to the organization affected."
Although we can assume that researchers are getting better at quantifying losses and calculating the impact of security incidents, it is clear that after decades of Internet use, e-business innovation and progress, organizations are still way behind in terms of security preparedness and respect for the vast problems that define information asset protection.
To be clear, the only thing that we should take away from the statistic that 9 out of 10 companies have experienced a breach is the fact that 1 out of 10 hasn't bothered to find or report its security breaches. The biggest issue is the fact that the same breaches are occurring year after year, with the simplest and most expensive ones leading the pack.
According to my rough calculation, 30 large companies made the Wall of Shame last year. 30 that should have known better because they pretend to be the consumer's best friend, keeping our private data and trading it for cash. According to the Privacy Rights Clearinghouse, these affected millions of people. Here are the top 10 offenders:
Don't be impressed by the big numbers. They're important, but they don't tell the whole story. A closer look at the facts tells us that most of these security breaches were not caused by high-tech whiz kids (those probably go undetected). No, these failures occurred because of simple things like lost backup tapes, stolen passwords, smash&grab robberies and in the case of Citibank, the tapes were simply lost in the mail.
Granted, DSW Shoe Warehouse, Polo Ralph Lauren and LexisNexis did manage to get hit hard by by hackers, but that's just the problem, coverage has been inconsistent or non-existent either because the general media, the ones who have all the eyeballs, have no idea how to represent the magnitude of the problem to the average reader without covering the story in the "Oddly Enough" column or risking it seem as if the sky was falling.
Perhaps that's why 75% of all new prospects that I meet have developed a well-rehearsed mantra: "We have no security problems, everything's taken care of". That same group is later forced to react to security breaches instead of preventing them, a much more expensive and less effective proposition.
Aside from uninformed people working with incomplete data in an attempt to bring us pre-digested news while carefully avoiding apocalyptic scenarios, what else do you believe is the cause of this blatantly false sense of security? Here are my other 7 contenders:
1. Coasting on momentum - it's not just about apathy and ignorance, or is it? Is past performance an indicator of future security? Not in this business! What we don't know can't hurt us, but what about the aforementioned infamous 30 organizations? They had all the money in the world, they just lacked the budgets. And so it goes for the other 75% of international (mostly small and mid-size) companies that felt the sting of security inadequacy last year.
2. Security suites - are you seeing all-in-one security products flying off the shelves? Let them. Your security protection - whether on a home system or an enterprise network - should be made up of specialized layers, of best-of-breed tools, not one big bloated magic pill. Note, the latter is different from the concept of centralized security management, an often effective strategy for increasing visibility and control across the enterprise.
3. Automated, online security tools - have you come across e-commerce Web sites that proudly proclaim that they are "hacker-free" "security-protected", "impermeable to breaches" or otherwise invulnerable based on the fact that they are 'checked daily' by an automated scan? Rest assured, hackers couldn't care less about such claims and the only thing that it should mean to you when presented with the typical 'shield' logo, is that the company in question is deluded about their own level of protection.
4. Computer vendors and retail stores - why does out-of-the-box ease-of-use plug-and-play have to mean "bogged down with obsolete demo versions of software that are a pain to remove"? Computer stores and vendors are now basing all their marketing on how quickly you can be 'online' once you've stepped away from the cash register. What people should be asking is how much time do I have before my new computer gets infected . The answer? about 20 minutes.
5. Security vendors - why is it that every time a new security product is introduced, it paints such a rosy picture of the world that you literally feel like you will never have another care in the world. Alternatively, it makes such a huge deal out of threats that you didn't know existed that you're either compelled to ignore it, or get a trial copy (just in case) and never end up using it (probably because it interferes with every other security tool you have).
6. Telcos and ISPs - ah the telecommunications industry. When it works, it's a cash cow. Millions of homes and businesses providing reliable, monthly cash flow earmarked for expansion and diversification. Due to roughly gazillions of complaints from Internet subscribers, companies have finally found a way to provide solutions they can actually profit from, while fitting neatly into their guaranteed monthly revenue model. From subscription-based software firewall service to monthly virus/spyware protection, it's all available in byte-sized chunks. Unfortunately, its relative value is measured in crumbs. Convenience and security don't always go together.
7. Oblivious and desensitized IT managers - the least guilty people of the lot. They were hired to make sure systems and networks support business functions, then were told that not only are they responsible for 'security around here' but also for every single network user's infected PC, the company's security and privacy compliance and all the new threats that crop up on a daily basis. Can you really blame them for saying "nah, we're fine. Security is completely under control here". Unfortunately top level management most often believes them and fails to create a mature, actionable security plan that would minimize the damage from incidents occur.
Agree? Disagree? Am I completely off base? Why did I stop at 8? Why am I letting Microsoft off the hook? How do Chinese hackers fit into my equation? Ask away. Write back and let me know.
Claudiu Popa, (Claudiu@InformaticaSecurity.com)
Your humble scribe
PRE-PROCESSED HEADLINES
Kama Sutra worm set to strike Windows machines on Feb 3rd
Windows users are being urged to make sure their systems are clean from an email worm that promises recipients images of the Kama Sutra. It is in fact designed to hide on user systems and programmed to overwrite user files (DOC, XLS, MDB, MDE, PPT, PPS, ZIP, RAR, PDF, PSD and DMP files) on February 3rd. Blackworm (also called Nyxem, MyWife or Tearec) has infected more than 300,000 systems worldwide. Here are its propagation statistics.
According to the Register, if activated, Blackworm tries to disable security software. It also tries to harvest email addresses from infected PCs in a routine designed to draw up a hit list of targets for infection. Blackworm is programmed to download updates of its code onto infected PCs. Whether it will have any success is another matter, as most anti-virus vendors have already included its unique signature in their detection engines.
ChoicePoint Fined $15 Million for Losing Private Data of 163,000 Individuals
Data broker ChoicePoint was fined $15m last week over a data security breach that led to at least 800 cases of identity theft out of the entire set of 163,000 that they managed to lose to hackers in one of 2005's most spectacular cybertheft cases. ChoicePoint agreed to pay $10m in civil penalties (a record fine) and $5m to compensate consumers as part of a settlement with US consumer watchdog the Federal Trade Commission (FTC). It also agreed to maintain a revamped security program, featuring regular third-party security audits until 2026, and promised to ensure it provides consumer reports only to legitimate businesses for lawful purposes. ChoicePoint competitor Equifax has twice been similarly breached in the past couple of years, but has to date managed to escape serious repercussions.
New Site Helps Users Research and Report Undesirable Software
StopBadware.org, launched last week by the Harvard University's Berkman Centre and the Oxford Internet Institute, aims to establish a neighborhood watch-style scheme that will put pressure on purveyors of unsavoury programs that snoop on consumer's net habits.
The project has created a website, http://www.stopbadware.org/, where net users can check to see if programs they encounter are potentially damaging or benign. StopBadware.org hopes to educate consumers and software developers as well as shining a light on firms that make millions using sneaky pop-ups and tracking software to spy on users' surfing habits or, in the worst cases, steal their personal information, such as credit card or Social Security numbers.
Best Reason Yet To Use Google
According to the Associated Press, the search giant has refused to comply with a White House subpoena first issued last summer, prompting U.S. Attorney General Alberto Gonzales this week to ask a federal judge in San Jose for an order to force a handover of the requested records.
The aforementioned Bush minion wants a list of all requests entered into Google's search engine during an unspecified single week ? a breakdown that could conceivably span tens of millions of queries. In addition, it seeks 1 million randomly selected Web addresses from various Google databases. Google competitor Yahoo Inc. confirmed that it had already complied with the weasel's subpoena. Yahoo stressed that it didn't reveal any personal information. "We are rigorous defenders of our users' privacy," Yahoo spokeswoman Mary Osako said Thursday. "In our opinion, this is not a privacy issue."
Obtaining the subpoenaed information from Google "would assist the government in its efforts to understand the behavior of current Web users, (and) to estimate how often Web users encounter harmful-to-minors material in the course of their searches," the Justice Department wrote in a brief filed last Wednesday. The stand-off continues. I'll keep you posted.
Zero-day Exploit Embarrasses Microsoft
For four days in January, network administrators and security-savvy home users had a choice: download and install an unofficial open-source fix for the critical flaw in the Windows Meta File (WMF) format, or wait an estimated week for an official patch from Microsoft.
Microsoft was under such pressure to test and release the patch on January 10th that a work-in-progress version of the fix was accidentally leaked to security sites. The issue was so serious that Microsoft ended up publishing the code before its notoriously rigid release date, even after stating that they would make no exceptions to their patch schedule.
To be fair, with each patch cycle, the company must test its patches to work on multiple Windows OSes and in 23 languages. "The expedited track to investigate the vulnerability and develop the security update includes redirecting resources from other security development and testing efforts to primarily focus around the clock on producing and releasing the security update," wrote a representative.
ID Theft Leads FTC List of Consumer Complaints
Survey: Consumers Think Cybercrime 3 Times More Likely Than Phycical CrimeAs it turns out, consumers don't enjoy being duped. Last week the Federal Trade Commission released its annual report detailing consumer complaints about fraud and identity theft in 2005. Complaints about identity theft topped the list, accounting for 255,000 (37%) of more than 686,000 total complaints filed with the agency in 2005.
Findings from the report include:
- Internet-related complaints accounted for 46 percent of all fraud complaints.
- The percent of Internet-related fraud complaints with ?wire transfer? as the reported payment method more than tripled between 2003 and 2005.
- The major metropolitan areas with the highest per capita rates of consumer fraud reported were Washington, DC; Tampa/St. Petersburg/Clearwater, FL; and Seattle, WA.
- Credit card fraud was the most common form of reported identity theft, followed by phone or utilities fraud, bank fraud, and employment fraud.
- The most frequently reported type of identity theft bank fraud was electronic funds transfers.
- The major metropolitan areas with the highest per capita rates of reported identity theft were Phoenix/Mesa/Scottsdale, AZ; Las Vegas/Paradise, NV; and Riverside/San Bernardino/Ontario, CA.
Ontario Court Dismisses Case After Plaintiff Hacks Into ServerMore Americans anticipate falling victim to a cyber attack rather than a physical crime, reports a recent IBM survey of U.S. adults. And, despite the convenience and flexibility that online transactions offer, 37 percent of Americans will not provide credit card information online.
Surveying almost 700 participants that have Internet access at work or home, IBM reveals that, in the next twelve months, more than three times the number of respondents think it is more likely they will be the victim of a cybercrime (ie, attacked through networked devices such as computers, ATMs, obile phones, PDAs, etc.) than a physical crime. Consumers are reportedly changing their own behavior to protect themselves against cyber attack:
- 85 percent destroy all documents that have personal information or they attempt to securely store the information
- 70 percent only use Internet shopping sites that display a security protection seal
- 64 percent don't conduct online transactions on a shared computer
- 50 percent don't use shared wireless networks such as in a coffee shop or airport
- 38 percent don't bank online
- 37 percent don't use credit card information online
In the last 12 months, survey respondents have taken certain actions to protect themselves against the growing cybercrime threat:
- 29% have stopped reading credit or debit card information over the phone
- 27% have stopped buying from unfamiliar retailers
- 18% have stopped paying bills online
- 16% have stopped playing online games
According to ITBusiness.ca, a Superior Court judge has dismissed a lawsuit after the plaintiff hacked into the defendant?s computer server while legal proceedings were taking place.
The plaintiff secretly accessed and downloaded the entire contents of the defendant?s server, including privileged communications between the defendant and his solicitors, as well as data unrelated to the lawsuit. click here to read the whole article
Australian Police Apologise For Sending Child Porn To Schools
I know, it's unfair to drag the past out into the light, but from the Bonehead archives comes this story, dating back to November 2004. Australian police apologized profusely after inadvertently sending Internet images of child pornography to 1,800 schools ... while trying to warn principals about children at risk of abuse.
The mistake came during a massive, 400-raid police crackdown on child pornography that had resulted in more than 200 arrests, including police, teachers, clergy and the owner of a child-care centre.
Two New Types of Security Audit Address Website, Small Business Threats
Small and Mid-size enterprises (SME) account for over 75% of companies and just as high a percentage of security breaches, yet the attention is always on the big names. Unfortunately many of these smaller firms suffer in silence, sometimes reporting breaches, sometimes covering them up.
As a result of very specific client requests, Informatica (yes, this company) has introduced two new securiy assessments designed to detect and address SME security vulnerabilities, preferably before they cause public embarrassment, costly lawsuits or loss of business.
- The first is FlexSecure WebVerify, delivering a complete analysis and report of the security posture of Web sites or online applications. This is a high growth areas as more than 100 new Web-related vulnerabilities are introduced each month.
- The second is FlexSecure SnapShot, a terrific expert review of business processes and operations that produces a comprehensive view of a company's security readiness, from the way it manages site visitors, to its employee policy enforcement. Click the above links for more information, and let your business contacts know about them (or join our Partner Program to do some good).
New Internet Explorer 7 Offers New Security and Privacy Features
Microsoft has recently made available their new Internet Explorer 7 browser for free download to users of Windows XP. It is not the final, fully tested product, but a beta release that is mostly stable and introduces a whole new set of security and privacy features. Among them, a variety of basic safeguards against phishing, information theft and spyware, including better protection settings enabled by default. For a full description of security features, click here.
Main Site | White Papers | Free Software | News & Articles | Forward to a Friend
Claudiu
Popa is a certified security
professional (CISSP, PMP, CISA) and president of Informatica Corporation,
a Toronto-based consulting company with a strong focus
on education. Over
the past decade, Claudiu has focused on helping companies
improve their information
security. Today, he brings effective security to corporate
boardrooms, helping organizations manage security, awareness and
compliance programs. Claudiu can be contacted by simply replying
to this message (and he promises not to respond in the third
person). He welcomes your suggestions and
comments regarding this publication.
About
your humble scribe:
About the Company:
At a governance level, Informatica Corporation is a Canadian security firm with unmatched expertise in regulatory compliance, information risk management and corporate education. At a lower, more technical level, a diverse, high profile clientele trusts Informatica to secure Web sites, applications and workplaces. At every layer, Informatica protects information security and data confidentiality. Visit us at http://www.informationsecuritycanada.com/
use this link to subscribe.