January 13, 2012

National Cybersecurity

Nakashima, E. (2012, January 12). Cyber defense effort is mixed, study finds. Washington Post. Retrieved from http://www.washingtonpost.com/world/national-security/cyber-defense-effort-is-mixed-study-finds/2012/01/11/gIQAAu0YtP_story.html

A Pentagon pilot program that uses classified National Security Agency data to protect the computer networks of defense contractors has had some success but also has failed to meet some expectations, according to a study commissioned by the Defense Department.

Perloth, N. (2012, January 12). Malicious software attacks security cards used by Pentagon. New York Times. Retrieved from http://bits.blogs.nytimes.com/2012/01/12/malicious-software-attacks-security-cards-used-by-pentagon/

Chinese hackers have deployed a new cyber weapon that is aimed at the Defense Department, the Department of Homeland Security, the State Department and potentially a number of other United States government agencies and businesses, security researchers say.  Researchers at AlienVault, a Campbell, Calif., security company, said on Thursday that they had uncovered a new variant of some malicious software called Sykipot that targets smart cards used by government employees to access restricted servers and networks. Traces of Sykipot malware have been found in cyberattacks dating back to 2006, but AlienVault’s researchers say this is the first time Sykipot has compromised smart cards.

Sternstein, A. (2012, January 3). Cyber spies try probing U.S. drone plans. Nextgov. Retrieved from http://www.nextgov.com/nextgov/ng_20120103_5731.php

China-based hackers for months have been targeting federal agencies and contractors through infected emails apparently to spy on the Pentagon's drone strategy and other intelligence matters, according to Internet security researchers. The reported espionage employed a tactic known as spear-phishing where infiltrators, operating under the guise of a legitimate sender, email specific victims a virus-laden file or link. In this case, the hackers used email addresses from military and other government organizations, Jaime Blasco, manager of AlienVault Labs, said Tuesday.

United States. Government Accountability Office. (2011, December). Critical infrastructure protection: Cybersecurity guidance Is available, but more can be done to promote its use (GAO-12-82). Retrieved from http://www.gao.gov/products/GAO-12-92

Reviews currently available guidance and makes recommendations for improving ease of application. [Related article from Infosecurity.]

Global Cybersecurity

& broadly applicable items

Carr, J. (2011). Inside cyber warfare (2nd ed.). Sebastapol. CA: O'Reilly Media. [E-book available in the Safari Books Online database.]

Inside Cyber Warfare provides fascinating and disturbing details on how nations, groups, and individuals throughout the world use the Internet as an attack platform to gain military, political, and economic advantages over their adversaries. The second edition goes beyond the headlines of attention-grabbing DDoS attacks and takes a deep look inside recent cyber-conflicts, including the use of Stuxnet. It also includes a Forward by Secretary Michael Chertoff and a guest essay by Melissa Hathaway, among others.

Economist Intelligence Unit. (2012). Cyber power index: Measuring the drivers of cyber power across the G20 countries [online tool]. Retrieved from http://www.cyberhub.com/CyberPowerIndex

The purpose of the Cyber Power Index is to benchmark the ability of the G20 countries to withstand cyber attacks and to deploy the digital infrastructure needed for a productive economy. In doing so, the index measures both the success of digital uptake and the degree to which the economic and regulatory environment promotes national cyber power.  The index is developed as an interactive quantitative and qualitative scoring model constructed from the following four categories:

• Legal and Regulatory Framework
• Economic and Social Context
• Technology Infrastructure
• Industry Application

[Related article from Military Technology News.]

Malicious URLs being disguised by QR codes. (2012, January 12.) Infosecurity. Retrieved from http://www.infosecurity-magazine.com/view/23182/malicious-urls-being-disguised-by-qr-codes/

QR codes, a square pattern of black dots on a white background, are a form of barcode originally developed to track automotive parts during manufacture. Their fast readability, versatility and storage capacity have made them popular in many areas, and not least within mobile phones. “In many ways it was just a matter of time before we saw spam messages point to URLs that use embedded QR codes,” says Websense researcher Elad Sharf. “The advantage QR codes have over bit.ly is that it is a fast growing and marketing technology that currently has an inherent level of trust and novelty for consumers.”

Nye, J. S., Jr. (2011, Winter).  Nuclear lessons for cybersecurity? Strategic Studies Quarterly, 5(4), 18-38. Retrieved from http://www.au.af.mil/au/ssq/2011/winter/nye.pdf

After a short overview of the problem of cyber security . . .  I will suggest several general lessons and then discuss a number of international lessons that can be learned from the nuclear experience. While the two technologies are vastly different, as I will argue below, there are nonetheless useful comparisons one can make of the ways in which governments learn to respond to technological revolutions.

Ren, K., Wang, C., & Wang, Q. (2011, January-February). Security challenges for the public cloud. IEEE Internet Computing, 16(1), 69-73. [Full text available in the IEEE Computer Science Digital Library database.]

Cloud computing represents today's most exciting computing paradigm shift in information technology. However, security and privacy are perceived as primary obstacles to its wide adoption. Here, the authors outline several critical security challenges and motivate further investigation of security solutions for a trustworthy public cloud environment.

Song, D., Shi, E., Fischer, I., & Shankar, U. (2012, January). Cloud data protection for the masses. Computer, 45(1), 39-45. [Full text available in the IEEE Computer Science Digital Library database.]

Offering strong data protection to cloud users while enabling rich applications is a challenging task. Researchers explore a new cloud platform architecture called Data Protection as a Service, which dramatically reduces the per-application development effort required to offer data protection, while still allowing rapid development and maintenance.

January 6, 2012

National Cybersecurity

Most users have not installed security software on their smartphones, survey finds. (2012, January 5). Infosecurity. Retrieved from http://www.infosecurity-magazine.com/view/23002/most-users-have-not-installed-security-software-on-their-smartphones-survey-finds/

Nearly three-quarters of Americans have never installed data protection applications or security software on their smartphones to protect against data loss or malware, according to a survey sponsored by the National Cyber Security Alliance (NCSA) and McAfee. In addition, 70% of smartphone owners surveyed said they feel their device is safe from hackers, malware, and other types of cybercrime, according to a survey of 2,337 US adults conducted by Zogby International for NCSA and McAfee.

Norton, Q. (2011, December 26). Antisec hits private intel firm; millions of documents allegedly lifted. Wired. Retrieved from http://www.wired.com/threatlevel/2011/12/antisec-hits-private-intel-firm-million-of-docs-allegedly-lifted/

The Antisec wing of Anonymous revealed on Saturday that it had compromised the servers of the private intelligence firm Strategic Forecasting Inc. — allegedly seizing millions of internal documents and thousands of credit card numbers from the company, more commonly known as Stratfor.  That would be a major breach of private information from any firm. But this hack could prove particularly significant, because Stratfor serves as an information-gathering resource and open source intelligence analysis for both the U.S. military and for major corporations. [Related article from the New York Times.]

Rockwell, M. (2012, January 6). Energy Department launches cyber protection initiative for electrical grid. Government Security News. Retrived from http://www.gsnmagazine.com/node/25378

U.S. Energy Secretary Steven Chu unveiled an initiative on Jan. 5 to further protect the electrical grid from cyber attacks, dubbed the “Electric Sector Cyber security Risk Management Maturity” project.  The White House initiative, said Chu in a statement, is led by the Department of Energy (DOE) in partnership with the Department of Homeland Security (DHS) and will leverage private industry and public sector experts to build on existing cyber security measures and strategies to construct a more comprehensive and consistent approach to protecting the nation’s energy delivery system.

Enterprise Cybersecurity

Jackson, S., Gold, S., & Vael, M. (2011, December 13). How to protect your organization from multi-vectored threats [recorded webinar].  Retrieved from http://www.infosecurity-magazine.com/webinar/279/how-to-protect-your-organisation-from-multivectored-threats/

Multi-layered IT security used to be optimum method of raising the bar on your IT security defences, but the advent of multi-vectored threats, phishing and all manner of cyber-criminality means that a consolidated approach is now the best option – especially now that the latest appliances can be controlled from a single dashboard. But what makes an effective strategy on consolidated security? And what is the best planning approach? Join us for an informative 60-minute webinar in which our panel of experts will explain the best strategies for selecting and deploying the latest appliance technologies, as well as how to augment existing systems on an evolutionary – rather than revolutionary – approach.

Global Cybersecurity

& broadly applicable items

European Network and Information Security Agency. (2011, November). Analysis of cybersecurity aspects in the maritime sector. Retrieved from http://www.enisa.europa.eu/media/press-releases/first-eu-report-on-maritime-cyber-security

The maritime sector is critical for the European society. Recent statistics show that within Europe, 52%1 of the goods traffic in 2010 was carried by maritime transport, while only one decade ago this was only 45%. This continuous increase in dependency upon the maritime transport underlines its vital importance to our society and economy. As it can be observed in other economic sectors, maritime activity increasingly relies on Information Communication and Technology (ICT) in order to optimize its operations. ICT is increasingly used to enable essential maritime operations, from navigation to propulsion, from freight management to traffic control communications, etc.   These last years have also shown that cyber threats are a growing menace, spreading in all industry sectors that progressively rely on ICT systems.

European Network and Information Security Agency. (2011, December 19). Economics of security: Facing the challenges. Retrieved from http://www.enisa.europa.eu/act/rm/files/EoS%20Final%20report

This ENISA report is part of the work conducted within the ENISA Work Programme 2011. Within this effort, ENISA has analysed economic drivers and barriers in a number of areas (including policy, research, technology and business) and has identified potential areas of improvement to boost security and resilience in public systems and networks and consequently to relevant products and services by taking into account the economic dimension. This effort contributes to the identification of topics in the area of Economics of Security in line with the efforts for boosting Europe’s economic performance and introduction of measures to reinforce the benefits of the single market as announced in the Digital Agenda for Europe.

Kapersky Lab. (2011, October-December). The mystery of Duqu (1, 2, 3, 4, 5, 6, 7). Retrieved from https://www.securelist.com

Detailed analysis of the Duqu trojan.  The authors conclude that Duqu and Stuxnet were created by the same developer. [Related article from Infosecurity.]

McAfee Labs. (2011, December 28). 2012 threat predictions. Retrieved from http://www.mcafee.com/us/resources/reports/rp-threat-predictions-2012.pdf

Predicting future threats can be a hit-or-miss exercise for a security research

organization. Certainly it is interesting to put on our wizard hats and prognosticate about what may happen in the coming months, but how much do threats really change each year? The past 12 months were a transformative year in many ways, but were these transformations revolutionary or evolutionary? We saw great changes in mobile threats, hacktivism, client-side exploitation, social-media exploitation, and targeted attacks. Many of these changes and trends will continue to influence the threats landscape for years to come.

Nordell, D. E. (2012, February). Terms of protection: The many faces of smart grid security. IEEE Power and Energy Magazine, 10(1), 18-23. Retrieved from http://magazine.ieee-pes.org/files/2011/12/10mpe01-nordell.pdf

A critical consideration in the development of smarter electrical grids is to ensure best security practices. Few terms in the smart grid vocabulary, however, are as overworked and overloaded (i.e., assigned multiple definitions) as the word security. Such definitions range all the way from ensuring reliability—keeping the lights on—to protecting the confidentiality of customer information. This article will attempt to explore these multiple definitions and find some common thread that can help ensure the success of the pursuit of a smarter electrical grid while maintaining security—in all of its various meanings.

O'Brien, K. J. (2011, December 25). Lax security exposes voice mail to hacking. New York Times. Retrieved from http://www.nytimes.com/2011/12/26/technology/26iht-hack26.html

It may be tempting to view the illegal interception of telephone voice mails, a practice that has roiled Britain and the News Corp. media empire of Rupert Murdoch, as an arcane tool employed by scofflaw journalists with friends in Scotland Yard. But according to a study to be presented Tuesday, cellphone users in Europe and the rest of the world may be just as vulnerable as the actor Hugh Grant and other celebrities to having their personal voice mail hacked — or worse — because of outdated mobile network security.

Saurabh, A. (2011). On cyber security for networked control systems (Doctoral dissertation). University of California, Berkeley, CA. [Full text  available in the Dissertations and Theses database.]

The instrumentation of infrastructure systems by embedded sensors, computation, and communication networks has enabled significant advances in their management. Examples include monitoring of structural health, traffic congestion, environmental hazards, and energy usage. The use of homogeneous (especially, commercially available off-the-shelf) information technology (IT) solutions makes infrastructure systems subject to correlated hardware malfunctions and software bugs. Over the past decade, many concerns have been raised about the vulnerabilities of infrastructure systems to both random failures and security attacks. Cyber-security of Supervisory Control and Data Acquisition (SCADA) systems is especially important, because these systems are employed for sensing and control of large physical infrastructures. So far, the existing research in robust and fault-tolerant control does not account for cyber attacks on networked control system (NCS) components. Also, the existing research in computer security neither considers the attacks targeting NCS components nor accounts for their interactions with the physical system. The goal of this thesis is to bridge this gap by focusing on (1) security threat assessment, (2) model-based attack diagnosis, and (3) resilient control design.

Seo, H., & Choy, Y. (201 ). Criteria for comparing cyberwarfare ability. Lecture Notes in Electrical Engineering, 120, 111-120. Retrieved from http://goo.gl/FijPL

We are in cyber war age. New research tries [sic] are done in the area of concept, weapons, capability, and so on for cyber war. Most nations want to know the capability and vulnerable areas for preparing cyber war. In order to get this object, we selected criteria items for comparing nations’ cyberwar capability. A few pilot nations’ capability information was gathered through open information according to the proposed criteria. The more exact interpretation and understanding for each nation’s capability including vulnerable area can be caught with the proposed criteria.

Stewart-Smith, H. (2012, January 4). Japan develops virus to counter cyber-attacks: But can it be used? ZDNet. Retrieved from http://www.zdnet.com/blog/asia/japan-develops-virus-to-counter-cyber-attacks-but-can-it-be-used/635

The Japanese Ministry of Defense has revealed its latest project to tackle hacking: a ’seek and destroy’ virus designed to track and disable the source of cyber-attacks. The project, launched in 2008, cost $2.3 million over three years. Several companies competed for the contract, but Fujitsu was eventually commissioned to develop the new ‘cyberweapon’. The virus has already undergone testing in a closed network environment. ... Unfortunately, Japan’s Ministry of Defense still has several hurdles to jump before this project can be utilised.

December 23, 2011

[next update 1/6/12]

National Cybersecurity

Feds indict 55 people in New York cybercrime ring. (2011, December 20). Infosecurity. Retrieved from http://www.infosecurity-magazine.com/view/22803/feds-indict-55-people-in-new-york-cybercrime-ring/

The Manhattan District Attorney has indicted 55 individuals for operating a $2 million organized cybercrime ring that relied on corrupt employees at companies and institutions to steal personal information of victims.  The indicted individuals allegedly used the stolen information in a variety of schemes to defraud the victims who had their personal information stolen. The information included names, dates of birth, addresses, social security numbers, and financial account information. [More from the New York Times.]

Gorman, C. (2011, December 21). Chinese hackers hit U.S. Chamber. Wall Street Journal. Retrieved from http://online.wsj.com/article/SB10001424052970204058404577110541568535300.html

A group of hackers in China breached the computer defenses of America's top business-lobbying group and gained access to everything stored on its systems, including information about its three million members, according to several people familiar with the matter. The break-in at the U.S. Chamber of Commerce is one of the boldest known infiltrations in what has become a regular confrontation between U.S. companies and Chinese hackers. The complex operation, which involved at least 300 Internet addresses, was discovered and quietly shut down in May 2010. [More from the New York Times.]

Hawalt, S. (2011, December 21.) Rethinking DoD cybersecurity in a post-WikiLeaks world (G00218054). [Full text available in the Gartner database.]

WikiLeaks data breaches of classified and sensitive documents spurred the formation of a plethora of spinoff hacker groups. The U.S. Department of Defense (DoD) has improved data-handling processes and information security technologies. However, defense CIOs, military leaders and chief information security officers (CISOs) must now focus on finding the right level of sharing data in an improved classified security program in cyberspace.

Heilbraun, M. R., &  Brown, I. (2011). Cybersecurity policy and legislation in the 112th Congress. Intellectual Property and Technology Law Journal, 23(12), 14-20. [Full text available via UMUC Library OneSearch.] 

This article reviews current cybersecurity policy proposalsintended to enhance our nation’s security from a cyberattack and punish wrongdoing and recent proposals intended to set national data breach notification standards and develop public / private voluntary security standards.

Nationwide cybersecurity education initiative launched. (2011, December 22). Government Security News. Retrieved from http://www.gsnmagazine.com/node/25305

The Global Institute for Cybersecurity + Research announced on December 22 the planned launch next month of the National Critical Infrastructure Cybersecurity Education Initiative, a nationally coordinated public/private collaborative partnership aimed at developing cybersecurity education programs. The effort will involve the NIST National Initiative for Cybersecurity Education (NICE), DHS, the National Council of Information Sharing & Analysis Centers (ISACs), critical infrastructure owner/operators, federal sector-specific agencies, academia, security certification and technology organizations.

Pilkington, E., & Williams, M. (2011, December 18). Bradley Manning hearing told of security failings at Iraq base. Guardian. Retrieved from http://www.guardian.co.uk/world/2011/dec/18/bradley-manning-security-failings-iraq

The person in charge of ensuring the security of the computer network that Bradley Manning worked on in Iraq was officially admonished earlier this year for failing to accredit and certify the system.  Capt. Thomas Cherepko confirmed to Manning's pre-trial hearing in Fort Meade, Maryland, that he received a letter of admonishment in March. He was censured for having failed to submit a package of documents to his superiors – known as a Diacap – that would have verified the network met the defence department's minimum standards on computer security and was designed to have exposed any vulnerabilities. [Detailed liveblog of the Manning trial from the Guardian.]

United States. Senate. Committee on Appropriations. (2011, December 16). Summary: FY12 Homeland Security appropriations. Retrieved from http://goo.gl/ERf62

Department of Homeland Security receives $888 million for cybersecurity and infrastructure protection. [More from Infosecurity.]

Enterprise Cybersecurity

Enterprise security market to reach $23 billion worldwide in 2012. (2011, December 21). Infosecurity. Retrieved from http://www.infosecurity-magazine.com/view/22815/enterprise-security-market-to-reach-23-billion-worldwide-in-2012/

Total investment in enterprise security is expected to grow 8.7% year-on-year in 2012 to reach a market value of $22.9 billion worldwide, predicts market analysis firm Canalys. The anti-virus software market segment is expected to grow 6.8% year-on-year, accounting for 11.3% of the total enterprise security market in 2012, according to a Canalys forecast. Anti-virus software continues to drive revenue for resellers because it is the first step that most small and medium-sized businesses (SMBs) take to secure their infrastructure.

Global Cybersecurity

& broadly applicable items

Halpert, B. (2011). Auditing cloud computing: A security and privacy guide. Hoboken, NJ: John Wiley & Sons. [Full text e-book available in the Books 24x7 database.]

Provides information to assist in preparing for an audit addressing cloud computing security and privacy for both businesses and cloud based service providers.

Michaels, D. (2011, December 19). Defense firms bid on NATO cyberwar. Wall Street Journal. Retrieved from http://online.wsj.com/article/SB10001424052970203733304577102171947782202.html

The North Atlantic Treaty Organization on Monday will collect bids from some of the world's top defense companies, including Lockheed Martin Co. and Northrop Grumman Corp., to update and expand the alliance's cybersecurity abilities. The €32 million ($42 million) contract, although valued at less than the price of one fighter jet, holds great significance because it cements the alliance's role in protecting cutting-edge infrastructure, say NATO officials.

Perloth, N. (2011, December 23). Insurance against cyber attacks expected to boom. New York Times. Retrieved from http://bits.blogs.nytimes.com/2011/12/23/insurance-against-cyber-attacks-expected-to-boom/

Experts say that more companies will buy policies in the coming year because of new Security and Exchange Commission requirements. Last October, the S.E.C. issued a new guidance requiring that companies disclose “material” cyber attacks and their costs to shareholders. The guidance specifically requires companies to disclose a “description of relevant insurance coverage.”

December 16, 2011

National Cybersecurity

FBI says hackers hit key services in three US cities. (2011, December 13). BBC News.  Retrieved from http://www.bbc.co.uk/news/technology-16157883

The infrastructure systems of three US cities have been attacked, according to the Federal Bureau of Investigation.  At a recent cybersecurity conference, Michael Welch, deputy assistant director of the FBI's cyber division, said hackers had accessed crucial water and power services. The hackers could theoretically have dumped sewage into a lake or shut off the power to a shopping mall, he said.  Industrial control systems are becoming an increasing target for hackers.

Kravets, D. (2011, December 14). Carrier IQ explains secret monitoring software to FTC, FCC. Wired. Retrieved from http://www.wired.com/threatlevel/2011/12/carrieriq-ftc-fcc/

Carrier IQ, the embattled phone-monitoring software maker, said Wednesday it had met this week with officials from the Federal Communications Commission and the Federal Trade Commission “to educate the two agencies about the functionality of its software and answer any and all questions."

Nagesh, G. (2011, December 16). House cybersecurity bill would establish federal overseer. The Hill. Retrieved from http://thehill.com/blogs/hillicon-valley/technology/199929-house-members-introduce-cybersecurity-bill

Members of the House Homeland Security Committee introduced a cybersecurity bill on Thursday that would establish a quasi-governmental entity to oversee information-sharing with the private sector.  Like the other cybersecurity bills offered by the House GOP, the Promoting and Enhancing Cybersecurity and Information Sharing Effectiveness (PrECISE Act) encourages private firms to share information on cyber threats but stops short of mandating new security standards for sectors deemed critical to national security.

Peterson, S., & Faramarzi, P. (2011, December 15).  Iran hijacked US drone, says Iranian engineer. Christian Science Monitor. Retrieved from http://www.csmonitor.com/World/Middle-East/2011/1215/Exclusive-Iran-hijacked-US-drone-says-Iranian-engineer

Iran guided the CIA's "lost" stealth drone to an intact landing inside hostile territory by exploiting a navigational weakness long-known to the US military, according to an Iranian engineer now working on the captured drone's systems inside Iran. Iranian electronic warfare specialists were able to cut off communications links of the American bat-wing RQ-170 Sentinel, says the engineer, who works for one of many Iranian military and civilian teams currently trying to unravel the drone’s stealth and intelligence secrets, and who could not be named for his safety.

Singel, R. (2011, December 14). Congress authorizes Pentagon to wage internet war. Wired. Retrieved from http://www.wired.com/threatlevel/2011/12/internet-war-2/

The House and Senate agreed to give the U.S. military the power to conduct “offensive” strikes online — including clandestine attacks, via a little-noticed provision in the military’s 2012 funding bill.  The power, which was included in the House version but not the Senate version, was included in the final “reconciled” bill that is all but guaranteed to pass into law. 

Smith, D. F. (2011, December 14). AACC expanding cybersecurity training to new location in Severn. Broadneck Patch. Retrieved from http://broadneck.patch.com/articles/aacc-expanding-cybersecurity-training-to-new-location-in-severn

Anne Arundel Community College (AACC) will be expanding to a new facility next year near Arundel Mills, with classrooms that will focus on training in the burgeoning cybersecurity field.  The AACC Board of Trustees met on Tuesday to review and approve the lease for the new location in the third-story office at 7556 Teague Rd. in Severn. After hunting for two years, school officials said they determined this location was the best fit for the college . . . 

Trustee Walter Hall said even if the college had to lose some money over this initiative, he considered it a strategic investment in a growing industry.  “I think the issue is positioning the college to be at the forefront of a discipline that clearly the government is focusing on in Maryland,” Hall said. “This is exactly the kind of opportunity we should be allocating our resources in.” 

United States. Department of Homeland Security. (2011, November). Blueprint for a secure cyber future: The cybersecurity strategy for the homeland security enterprise. Retrieved from http://www.dhs.gov/xlibrary/assets/nppd/blueprint-for-a-secure-cyber-future.pdf

The Blueprint for a Secure Cyber Future builds on the Department of Homeland Security Quadrennial Homeland Security Review Report’s strategic framework by providing a clear path to create a safe, secure, and resilient cyber environment for the homeland security enterprise. With this guide, stakeholders at all levels of government, the private sector, and our international partners can work together to develop the cybersecurity capabilities that are key to our economy, national security, and public health and safety. The Blueprint describes two areas of action: Protecting our Critical Information Infrastructure Today and Building a Stronger Cyber Ecosystem for Tomorrow. The Blueprint is designed to protect our most vital systems and assets and, over time, drive fundamental change in the way people and devices work together to secure cyberspace. The integration of privacy and civil liberties protections into the Department’s cybersecurity activities is fundamental to safeguarding and securing cyberspace. [Related article from Government Computer News.  More from Federal Computer Week.]

Enterprise Cybersecurity

Wheatman, J. (2011, December 15). Ten reasons security is overlooked in information governance, and how to fix it (G00226989). [Full text available in the Gartner database.]

Information governance and other business-driven data initiatives continue to advance; however, the management of the associated security continues to be disconnected. This research highlights common reasons for the lack of convergence, as well as 10 things enterprises can try to do to close the gap as swiftly as possible.

Global Cybersecurity

& broadly applicable items

National Institute of Standards and Technology. (2011, December). Electronic authentication guideline (Special Publication 800-63-1). Retrieved from http://csrc.nist.gov/publications/nistpubs/800-63-1/SP-800-63-1.pdf

This recommendation provides technical guidelines for Federal agencies implementing electronic authentication and is not intended to constrain the development or use o standards outside of this purpose. The recommendation covers remote authentication of users (such as employees, contractors, or private individuals) interacting with government IT systems over open networks. It defines technical requirements for each of four levels of assurance in the areas of identity proofing, registration, tokens, management processes, authentication protocols and related assertions.
  

Risky business: 70% of young employees ignore IT security policies. (2011, December 14). Infosecurity. Retrieved from http://www.infosecurity-magazine.com/view/22690/risky-business-70-of-young-employees-ignore-it-security-policies/

A disturbing 70% of young employees said they often ignore the company’s IT security policies, according to a survey sponsored by Cisco.  The most common reason for ignoring IT security policies was the belief that employees were not doing anything wrong (33%). One in five (22%) cited the need to access unauthorized programs and applications to get their job done, while 19% admitted the policies are not enforced, according to a survey of 2,800 young people (age 21–29) in 14 countries conducted by InsightExpress on behalf of Cisco.

December 9, 2011

National Cybersecurity

Kravets, D. (2011, December 6). Senator demands telcos & HTC come clean on Carrier IQ. Wired. Retrieved from http://www.wired.com/threatlevel/2011/12/carrier-iq-franken/

Sen. Al Franken (D-Minnesota) wants handset manufacturers and mobile carriers to explain what user data is being vacuumed to Carrier IQ, whose software is secretly installed on about 150 million mobile phones in the United States.  Franken is demanding that Sprint, HTC and AT&T cough up some answers, though the senator should also consider asking T-Mobile as well, because it uses Carrier IQ.  Carrier IQ, which records [information] so that carriers can troubleshoot their networks, came under intense scrutiny the past week after a Connecticut-based Android developer posted a YouTube video showing the software has enormous access to usage information.

MIT Energy Initiative. (2011, December 5). The future of the electric grid: An interdisciplinary MIT study.  Retrieved from http://web.mit.edu/mitei/research/studies/documents/electric-grid-2011/Electric_Grid_Full_Report.pdf [Chapter 9: Data Communications, Cybersecurity, and Information Privacy]

This report aims to provide a comprehensive, objective portrait of the U.S. electric grid and the challenges and opportunities it is likely to face over the next two decades. It also highlights a number of areas in which policy changes, focused research and demonstration, and the collection and sharing of important data can facilitate meeting the challenges and seizing the opportunities that the grid will face. [Related article from Information Week].

Nakashima, E. (2011, December 8). Cyber-intruder sparks massive federal response — and debate over dealing with threats. Washington Post. Retrieved from http://www.washingtonpost.com/national/national-security/cyber-intruder-sparks-response-debate/2011/12/06/gIQAxLuFgO_story.html

The first sign of trouble was a mysterious signal emanating from deep within the U.S. military’s classified computer network. Like a human spy, a piece of covert software in the supposedly secure system was “beaconing” — trying to send coded messages back to its creator.  An elite team working in a windowless room at the National Security Agency soon determined that a rogue program had infected a classified network, kept separate from the public Internet, that harbored some of the military’s most important secrets, including battle plans used by commanders in Afghanistan and Iraq. 

United States. Department of Defense. (2011, November). Department of Defense cyberspace policy report.  Retrieved from http://www.defense.gov/home/features/2011/0411_cyberstrategy/docs/NDAA%20Section%20934%20Report_For%20webpage.pdf

Report responding to questions posed RE: in 2010's Senate Report 111-201. [Related article from the Washington Post.]

United States. Executive Office of the President. (2011, December). Trustworthy cyberspace: Strategic plan for the federal cybersecurity research and development program. Retrieved from http://www.whitehouse.gov/sites/default/files/microsites/ostp/fed_cybersecurity_rd_strategic_plan_2011.pdf

This report . . . was developed by the Networking and Information Technology Research and Development agencies and directly responds to the need for a new cybersecurity R&D strategy. As recommended in the Cyberspace Policy Review’s near-term action plan, Trustworthy Cyberspace replaces the piecemeal approaches of the past with a set of coordinated research priorities whose promise is to “change the game,” resulting in a trustworthy cyberspace. As called for in the policy review’s mid-term action plan, this plan identifies opportunities to engage the private sector in activities for transitioning promising R&D into practice. In addition, and consistent with the PCAST recommendations, it prioritizes the development of a “science of security” to derive first principles and the fundamental building blocks of security and trustworthiness. [Related article from Information Week.]

Enterprise Cybersecurity

Batteau, A. W. (2011). Creating a culture of enterprise cybersecurity. International Journal of Business Anthropology, 2(2), 36-47. Retrieved from http://na-businesspress.homestead.com/IJBA/BatteauAWWeb2_2_.pdf

In this article I describe the fundamental dimensions of a security culture, a concept that builds on the experience of “safety culture” in several high-hazard industries. After outlining the concept and subtleties of corporate culture, I apply these concepts to issues of security, focusing on issues of trust, identification and authentication in complex environments. These issues become more challenging in virtual environments, as familiar tokens of identity such as face-to-face recognition are absent, and where trust becomes a weakest-link problem. I conclude with a description of the challenges of “managing” the emergent phenomenon of culture, and how trust can be cultivated.

Global Cybersecurity

& broadly applicable items 

Cyber attack adds pressure on GNP leaders. (2011, December 6). Korea Herald. Retrieved from http://www.koreaherald.com/national/Detail.jsp?newsMLId=20111206000814

The ruling [Korean] Grand National Party’s decision-making body is once again being pressed to resign en masse, amid mounting criticism over a cyber attack on the national election watchdog by an aide to one of its lawmakers.  Even members of the Supreme Council suggested that the party should rebuild itself from scratch if it is to stand a chance in the upcoming elections.  Council member Rep. Won Hee-ryong and nine other lawmakers issued a statement Tuesday, demanding that the GNP disband itself and start as a new political party. [More from the Los Angeles Times.]
 

Cyberattacks try to silence Russian dissenters. (2011, December 6). Deutsche Welle. Retrieved from http://www.dw-world.de/dw/article/0,,15582220,00.html

Two days after parliamentary elections in Russia, incumbent Prime Minister Vladimir Putin's party, United Russia, has emerged with a narrow victory, but allegations of denial of service attacks have led to calls of foul play. Organizations critical of United Russia party say they came under sustained online attack during the parliamentary ballot over the weekend. In addition, prominent online critics have been arrested, including Alexei Navalny, a well-known anti-corruption blogger. He was taken into custody late Monday night, as he was leading an unauthorized rally. After appearing before a Moscow court on Tuesday, on charges of obstructing traffic, he will likely face up to 15 days in prison.

Cyber warfare market worth US$15.9 billion in 2012. (2011, December 7). defenceWeb. Retrieved from http://www.defenceweb.co.za/index.php?option=com_content&view=article&id=21910

Global spending on cyber warfare will reach US$15.9 billion next year, up from an estimated US$12.5 billion this year as governments respond to a range of cyber threats, a new report says.  Visiongain’s Cyberwarfare Market 2012-2022 report says that governments around the world will continue to invest in a range of cyber warfare systems and solutions designed to offer protection against a wide range of cyber threats including protecting information and infrastructure from hostile states, as well as non-state actors both at home and abroad.

European Network and Information Security Agency. (2011, December 7). Proactive detection of network security incidents. Retrieved from http://www.enisa.europa.eu/act/cert/support/proactive-detection/proactive-detection-report/at_download/fullReport

This document is the final report of the "Proactive Detection of Network Security Incidents" study. The goal of the study was to investigate ways in which CERTs [Computer Emergency Response Teams] – national and governmental ones in particular – proactively detect incidents concerning their constituencies, identify good practice and recommended measures for new and already established CERTs, analyse problems they face and offer recommendations to relevant stakeholders on what can be done to further this process. It is important to note that the results of the study are largely community driven. That is, they are based not just on research and the experience of the experts who conducted the study, but to a large extent on the results of a survey carried out amongst 105 different CERTs (which resulted in 45 responses overall) and external expert group input. The outcome is thus a work by the community for the CERT community.

Grace, M., Zhou, Y., Wang, Z., & Jiang, X. (2012, February). Systematic detection of capability leaks in stock Android smartphones. Paper to be presented at the 19th Network and Distributed System Security Symposium, San Diego, CA.  Retrieved from http://www.csc.ncsu.edu/faculty/jiang/pubs/NDSS12_WOODPECKER.pdf

Recent years have witnessed a meteoric increase in the adoption of smartphones. To manage information and features on such phones, Android provides a permission-based security model that requires each application to explicitly request permissions before it can be installed to run. In this paper, we analyze eight popular Android smartphones and discover that the stock phone images do not properly enforce the permission model. Several privileged permissions are unsafely exposed to other applications which do not need to request them for the actual use. To identify these leaked permissions or capabilities, we have developed a tool called Woodpecker. Our results with eight phone images show that among 13 privileged permissions examined so far, 11 were leaked, with individual phones leaking up to eight permissions. By exploiting them, an untrusted application can manage to wipe out the user data, send out SMS messages, or record user conversation on the affected phones – all without asking for any permission. [Related article from Ars Technica.]

Graham, A. (2011, December 6). Canada's critical infrastructure: When is safe safe enough? (National Security for Canada Series 2). Retrieved from http://www.macdonaldlaurier.ca/files/pdf/Canadas-Critical-Infrastructure-When-is-safe-enough-safe-enough-December-2011.pdf

In a new study published by the Macdonald-Laurier Institute . . . author Andrew Graham stresses the need for a cohesive plan to protect Canada’s vulnerable infrastructure before it is too late. Included in the list of such CI are vital systems most Canadians never think about: energy generation and distribution, financial institutions, our food supply system, information and communications technology and health care institutions. CI vulnerability, in other words, extends to every aspect of Canadians’ lives.  What are the serious threats to Canada’s CI? The author identifies a number, including natural disasters, terrorism, theft, hackers and vandals and simple neglect and underinvestment by infrastructure owners. Increasing integration of information technology into all forms of infrastructure mean that cyber threats, including cyber attacks by foreign governments and others, is adding a whole new layer of vulnerability. Professor Graham assesses current efforts to address those threats and suggests themes for moving forward and building on the work already done in government and the private sector. 

Keizer, G. (2011, December 7). Symantec confirms Flash exploits targeted defense companies. Computerworld.  Retrieved from http://www.computerworld.com/s/article/9222496/Symantec_confirms_Flash_exploits_targeted_defense_companies

Security researchers at Symantec today confirmed that exploits of an unpatched Adobe Reader vulnerability targeted defense contractors, among other businesses.  "We've seen [this targeting] people at telecommunications, manufacturing, computer hardware and chemical companies, as well as those in the defense sector," said Joshua Talbot, senior security manager in Symantec's security response group, in an interview Wednesday.

Leavitt, N. (2011, December). Internet security under attack: The undermining of digital certificates. Computer, 44(12), 17-20. doi:10.1109/MC.2011.367 [Full text available in IEEE Computer Science Digital Library database.]

Several attacks this year against organizations issuing digital certificates are creating doubts about the system. 

Lockheed, other defense firms targeted by hackers. (2011, December 8). Reuters. Retrieved from http://www.reuters.com/article/2011/12/08/lockheed-cyber-idUSN1E7B707920111208

Lockheed Martin Corp. and other U.S. defense firms were targeted by hackers using a previously unknown vulnerability in Adobe Reader, the latest in a series of increasingly persistent attacks against U.S. weapons makers, security experts said on Wednesday. Lockheed, the Pentagon's biggest supplier, said it detected the attempted attack through normal monitoring activities and immediately notified Adobe, but its information systems were never breached. [Related article from Computerworld, more from Ars Technica.]

Serious security flaws identified in cloud systems. (2011, December). Computer, 44(12), 21. doi:10.1109/MC.2011.379 [Full text available in IEEE Computer Science Digital Library database.]

German researchers report finding serious problems with two cloud systems and say these flaws probably exist in other cloud architectures. The Ruhr University Bochum team said the vulnerabilities could let attackers gain administrative rights to host systems.  The investigators found flaws with Amazon Web Services (AWS) and informed Amazon, which has since patched the problems. They also discovered vulnerabilities with the open source Eucalyptus private-cloud software framework.

Storm, D. (2011, December 7).  Mobile security at TakeDownCon: Hackers handing out a healthy dose of paranoia. Computerworld.  Retrieved from http://blogs.computerworld.com/19391/mobile_security_at_takedowncon_hackers_handing_out_a_healthy_dose_of_paranoia

Smartphones are mini-computers packed with financial and personal [information] . . . to ignore the need for mobile security is a bit like choosing to run a computer without any regard to security precautions. Not wise at all. Even without any malicious intent by app developers, many are not concerned about security; their apps may ask for overreaching access permissions.  Mobile and wireless security news is pouring out of TakeDownCon in Las Vegas. [Related article from Ars Technica.]

Tarzey, B., Nicholds, D., & Gold, S. (2011, December 6). Defending mobile devices against the rising avalanche of security threats [recorded Webinar].  Retrieved from http://www.infosecurity-magazine.com/webinar/278/defending-mobile-devices-against-the-rising-avalanche-of-security-threats/

Welcome to the world of mobile device security – but where do you start? This 60-minute webinar will help – our team of experts will guide you through the jungle that is mobile security, allowing you to better understand the risks involved with using mobile devices in a business environment. Armed with this information, you can plan your defense strategies, adapting and re-tasking your existing security defenses – and augmenting them with leading-edge security policies. [NOTE: The next Infosecurity webinar, "Understanding the Need for Consolidated Security in the Modern Business" will be held on 12/13/11.  Registration is free.]

Wagner, R., Nicolett, M., Orans, L., Pescatore, J., Kavanagh, K. M., Firstbrook, P. . . . Feiman, J. (2011, November 29). Gartner predicts 2012: Sophisticated attacks, complex IT environments and increased risks demand new approaches to infrastructure protection (G00223301). [Full text available in the Gartner database.]

Sophisticated new threats – especially targeted attacks – the financial and reputational damage from attacks, and the growing "consumerization" of IT are among the factors increasing the complexity, difficulty and criticality of protecting enterprise IT infrastructure.

Zetter, K. (2011, December 7). Eight out of ten software apps fail security test. Wired. Retrieved from http://www.wired.com/threatlevel/2011/12/veracode-report/

Desktop and web applications remain a wasteland of bugs and holes that only a hacker could love, according to a report released Wednesday by a company that conducts independent security audits of code.  In fact, eight out of ten software applications fail to meet a security assessment, according to a State of Software Security report by Veracode. That’s based on automated analysis of 9,910 applications submitted to Veracode’s online security testing platform in the last 18 months. The applications are submitted by both developers – in the government and commercial sectors – as well as companies and government agencies wanting an assessment of software they plan to purchase. [Full report available with free registration.]

December 2, 2011

National Cybersecurity

Cybersecurity bill approved by house panel. (2011, December 1). Reuters.  Retrieved from http://www.reuters.com/article/2011/12/02/us-cybersecurity-usa-congress-idUSTRE7B100E20111202

In a 17-1 vote, the Permanent Select Committee on Intelligence approved the legislation that would expand a pilot Pentagon program for sharing classified and sensitive threat information with defense contractors and their Internet service providers.  Under the measure, a longer list of companies would be eligible for access to classified data from the National Security Agency and other agencies.
 

Jackson, W. (2011, November 30). Cyber bill strong on info sharing, light on privacy protections. Government Computer News. Retrieved from http://gcn.com/articles/2011/12/01/cybersecurity-bill-info-sharing-no-privacy.aspx

The Cyber Intelligence Sharing and Protection Act of 2011 (HR 3523) was introduced Nov. 30 by committee Chairman Mike Rogers (R-Mich.) and Ranking Member Dutch Ruppersberger (D-Md.) and would require the intelligence community to establish procedures for sharing classified cybersecurity intelligence with the private sector, and would provide incentives for private entities to share information with the government. But for the moment at least, it contains no privacy safeguards for personal information.

Rockwell, M. (2011, November 28). IL water system pump failure not a cyber attack. Government Security News.  Retrieved from http://www.gsnmagazine.com/node/25092

New reports on Nov. 28 backed initial DHS skepticism that the failure of a pump at an Illinois water utility was a foreign cyber attack on the system’s supervisory control and acquisition system.  The Washington Post reported on Nov. 28 that the failure of a water pump was the result of an error by one of the utility’s contractors who was travelling in Russia at the time and accessing the SCADA system remotely. The report backs earlier conclusions by DHS cyber security teams that the failure of the pump at Curran-Gardner Public Water District in Springfield, IL, wasn’t the work of Russian cyber criminals or agents. [Related article from Infosecurity.  More from Wired.] 

United States. Government Accountability Office. (2011, November). Cybersecurity human capital: Initiatives need better planning and coordination.  (GAO 12-8). Retrieved from http://www.gao.gov/new.items/d128.pdf 

Federal agencies have taken varied steps to implement workforce planning practices for cybersecurity personnel. Five of eight agencies, including the largest, the Department of Defense, have established cybersecurity workforce plans or other agencywide activities addressing cybersecurity workforce planning. However, all of the agencies GAO reviewed faced challenges determining the size of their cybersecurity workforce because of variations in how work is defined and the lack of an occupational series specific to cybersecurity.  With respect to other workforce planning practices, all agencies had defined roles and responsibilities for their cybersecurity workforce, but these roles did not always align with guidelines issued by the federal Chief Information Officers Council and National Institute of Standards and Technology (NIST). Agencies reported challenges in filling highly technical positions, challenges due to the length and complexity of the federal hiring process, and discrepancies in compensation across agencies. Although most agencies used some form of incentives to support their cybersecurity workforce, none of the eight agencies had metrics to measure the effectiveness of these incentives. Finally, the robustness and availability of cybersecurity training and development programs varied significantly among the agencies. For example, the Departments of Commerce and Defense required cybersecurity personnel to obtain certifications and fulfill continuing education requirements. Other agencies used an informal or ad hoc approach to identifying required training. [Related article from Government Computer News.]

Enterprise Cybersecurity

Boldea, C. (2012). SCADA security in the context of corporate network integration. Constanta Maritime University Annals,12(15), 159-164 [in press]. Retrieved from http://www.cmu-edu.eu/anale/anale_engleza/anale.html [Full text available via UMUC Library OneSearch.] 

The paper presents some considerations regarding security management of Supervisory Control and Data Acquisition (SCADA) networks. Control systems are potential targets of attack from hackers, cyber terrorists, others who want to disrupt the critical infrastructure, disgruntled or former employees and various collaborators which have worked within the organization. SCADA networks are usually seen as industrial equipment, not affected by cyber threats. Starting from the design of such a network the focus is on functionality, seldom the security not even being taken into consideration. Since the SCADA networks tends to became more and more integrated with enterprise business networks the risks are more and more similar and this paper empathies the idea to have a unified perspective over the security. There is presented a software solution for security monitoring and management integration.

Global Cybersecurity

& broadly applicable items  

  

Abeyratne, R. (2011). Cyber terrorism and aviation: National and international responses. Journal of Transportation Security, 4(4), 337-349. Retrieved from http://www.aviationdevelopment.org/eng/2011070102_publication 

Cyber crimes and Cyber terrorism are becoming increasingly menacing and the latter has been identified as a distinct threat requiring attention. At the 21st Aviation Security Panel Meeting of ICAO (AVSECP/21, 22 to 26 March 2010) a new Recommended Practice related to cyber threats was proposed for adoption by the Council as part of amendment 12 to Annex 17 (Security) to the Convention on International Civil Aviation (Chicago Convention). It was adopted on 17 November 2010, will become effective on 26 March 2011 and applicable on 1 July 2011. This Recommended Practice suggests that each Contracting State develop measures in order to protect information and communication technology systems used for civil aviation purposes from interference that may jeopardize the safety of civil aviation At the 22nd Meeting of the Panel, conducted by ICAO from 21 to 25 March 2011, the Panel noted the value of vulnerability assessments pertaining to cyber security in aviation whose objectives are to evaluate the efficiency of existing mitigation measures and identify any vulnerabilities from a threat-based perspective and further noted that better understanding of residual risks will support a State’s efforts to refine its risk response. This article contains an analysis of what cyber crimes are as against cyber terrorism, measures taken to counter the threat along with a legal analysis of the threat as it affects aviation and addresses several issues, including a discussion on some national efforts at curbing the problem in some prominent jurisdictions.

  

Ryan, P. (2011, December 1). Wikileaks docs reveal that governments use malware for surveillance. ArsTechnica. Retrieved from http://arstechnica.com/business/news/2011/12/wikileaks-docs-reveal-that-governments-use-malware-for-surveillance.ars

The latest round of documents published by Wikileaks offers a rare glimpse into the world of surveillance products. The collection — which Wikileaks calls the Spy Files — includes confidential brochures and slide presentations that companies use to market intrusive surveillance tools to governments and law enforcement agencies.  A report that Wikileaks published alongside the documents raises concern about the growing use of mass surveillance tools that indiscriminately monitor and analyze entire populations. The group also points out that some of the products described in the documents are sold to authoritarian regimes, which use them to hunt and track political dissidents.  The details revealed by Wikileaks echo a recent report by The Wall Street Journal (WSJ) that discussed the surveillance industry. The publication analyzed approximately 200 documents from 36 separate companies as part of a special investigative project called The Surveillance Catalog. The material released by Wikileaks corroborates much of what the WSJ reported, but includes a broader range of material. [Related article from Infosecurity.]

Vinograd, C. (2011, December 2). UK spy agency asks hackers to crack code. Associated Press. Retrieved from http://www.newsday.com/news/uk-spy-agency-asks-hackers-to-crack-code-1.3361527 

Can you crack the code?  That's the question Britain's electronic listening agency, GCHQ, is asking in an online campaign to find the next generation of cyber specialists. GCHQ quietly launched a cryptic website last month featuring a box of code made up of numbers and letters. There is no branding on the site, only the phrase "Can you crack it?"  The agency has now revealed it is behind the campaign, and said Friday it's trying to reach individuals with "a keen interest in code breaking and ethical hacking" for careers at GCHQ. [http://www.canyoucrackit.co.uk/]