Framework for Improving Critical Infrastructure Cybersecurity


Recognizing that the national and economic security of the United States depends on the resilience of critical infrastructure, President Obama issued Executive Order (EO) 13636, Improving Critical Infrastructure Cybersecurity, in February 2013. It directed NIST to work with stakeholders to develop a voluntary framework – based on existing standards, guidelines, and practices – for reducing cybersecurity risks.

Continue reading Framework for Improving Critical Infrastructure Cybersecurity

Tags: , , , , ,

Cyberattack: Possibilities Emergency Managers Need to Consider


Emergency planners routinely think about the outside world: What if that building fell to a natural disaster or man-made attack, or that neighborhood flooded? What if hackers disabled that water plant or took out the power grid? Now turn that same question inward. What if they struck against you?

Continue reading Cyberattack: Possibilities Emergency Managers Need to Consider

Tags: , ,

Malware Can Jump the “Air Gap” Between Computers


The gold standard for protecting computer systems — as everyone from the U.S. military to Osama Bin Laden’s ghost well knows — is disconnecting them from the Internet. But according to a recent paper by researchers at the Fraunhofer Institute for Communication, Information Processing, and Ergonomics, that gap can be bridged by high-frequency audio signals.

Continue reading Malware Can Jump the “Air Gap” Between Computers

Tags: , , ,

Cyber Threats and Cyber Security – can they be managed?


My  topic of choice for today’s webinar listen-into was the one on Cyber Threats and Cyber Security by Brendan Byrne from IBM in which Brendan shared both IBM’s and other organizations experiences from the dark world of cyber threat.

According to a recent IBM survey, the biggest threat perceived by Business Continuity professionals is cyber-security.  Some of the challenges faced include BYOD (Bring Your Own Device) which is on the increase; the widespread use of social media with its pros and cons; workforce mobility and the increasing use of cloud-based solutions.

The landscape is changing for organizations all around the globe.  Big Data or Smarter Data inevitably means more security considerations and the growing use of online services is another cause for security concern.  The boundaries are becoming blurred as we step up the use of the innovative technology that is advancing our way.  Supply Chain Security, as Brendan quite rightly said, is indeed only as strong as the weakest link in the chain and the expanding use of data is presenting more and more problems in terms of potential threats to an organization.

According to the X-Force Research Team (just one of the jewels in IBM’s crown) who is tasked with analysing the worldwide web on a daily basis, scanning the horizon for new trends and new vulnerabilities, there are over 40M spam and phishing attacks every month!  Now that is a scary figure.  KPMG’s Data Loss Barometer 2012 showed that hacking is the number one cause of data loss and that data loss incidents have increased by 40% since 2011.  There is evidence of new attack activity as malware gets too clever for its boots.  Some of the challenges faced are down to things as apparently simple as passwords (or rather the common and widespread use of the same password) and of course there is the challenge of BYOD and a new concept, called APT (Advanced Persistent Threats).

One of the key messages that this webinar drove home, was the importance of embedding cyber-security into an organization’s business culture.  It is not enough to develop a policy and then file it away thinking that the job is done and a big fat tick has been put in the box.  With a constantly changing landscape and new threat activity entering the “Cyber Charts”, it is essential that organizations review, review and review again to ensure that their policies and procedures meet the current and future security needs of their business.

One of the key issues is that cyber threats are just getting more and more sophisticated.  Motives for cyber-attacks range from simple curiosity, to revenge, right through to the big stuff like espionage and political activism.  The players or actors on the cyber stage are also becoming increasingly more educated and organised.  They scale of actor type runs from the inadvertent actor, who may cause an incident through ignorance or lack of training; to the opportunist that just grabs the moment to do some damage; to the “hacktivist” (remember that is the number one cause of data loss); right through to the top of the tree with the advanced actor, that heads up some big scam.

According to IBM research, the top three IT risks that damage a company’s brand (its greatest asset) and reputation (as perceived by BC professionals) are:  Data Breach; Systems Failure and Data Loss in that order.

An interesting example of a botnet was put in the room as such to demonstrate both its apparent innocence and its inherent danger.   We can all very easily download a botnet.   More often than not, this just sits harmlessly on our computers until the organiser of said botnet decides to sell this onto another organization, which in turns uses this to collate important and personal data and there we have it – bring this data together into one central location and you have a hacker’s dream and the so-called Money Mule concept kicks or trots (does a donkey trot?) into action.  So we see that the end users are also part of an organization’s security landscape.

Brendan also expanded on the IBM approach to managing cyber threats. The IBM approach consists of two elements – the first is the “Pre-exploit”, which is all about prediction and prevention and the second is the “Post-exploit” which is about reaction and remediation.  Every organization needs to adopt this approach.  Every organization needs an instant handling approach and every organization needs an intelligent view of their security position.  When working with clients, IBM has discovered that most organizations think they have an optimised approach; but reality tells another story with the majority only having basic measures in place.  Organizations need to aim to be proficient in order to be able to proactively protect themselves from cyber-attacks.

Brendan listed the essential practices as follows:

  1. Build a risk awareness culture and management system
  2. Manage security incidents with greater intelligence
  3. Defend the mobile and social workplace and make social media work for you and not against you
  4. Have security-rich services by design and not as an after-thought
  5. Automate security hygiene
  6. Control network access and help assure resilience
  7. Address the new complexity of cloud and virtualisation
  8. Manage third party security compliance
  9. Better secure data and protect privacy
  10. Manage people’s identity throughout the whole security lifecycle

Brendan then talked about the IT Trends for 2013, which he defined as follows:

  1. Cloud security will move from hype to a mature solution and will progress
  2. Advances in BYOD mobile will increase and be more secure than laptops by 2014
  3. Compliance will be a big driver for 2013 with organizations facing potential fines of 2% of their global annual turnover
  4. Data explosion will increase

And in conclusion, Brendan left us with the top threats for individuals to consider in 2013 and these are:

  1. Cyber Security
  2. Supply Chain Security
  3. Big Data
  4. Data Security in the cloud
  5. Consumerization

So yes, cyber-threats are very real, but with the right approach to cyber-security they can be managed.

If you missed Brendan’s webinar, you can catch up here >>

 

Tags: , , , , , , , , , , ,

65% of firms fear a cyber attack in 2013 according to BCI research


A new survey published by the Business Continuity Institute (BCI) in association with BSI has revealed that 65% of organizations are extremely concerned or concerned about a cyber attack in 2013.

Continue reading 65% of firms fear a cyber attack in 2013 according to BCI research

Tags: , , , , , ,

Hacking the President’s DNA


The U.S. government is surreptitiously collecting the DNA of world leaders, and is reportedly protecting that of Barack Obama. Decoded, these genetic blueprints could provide compromising information. In the not-too-distant future, they may provide something more as well—the basis for the creation of personalized bioweapons that could take down a president and leave no trace.

Continue reading Hacking the President’s DNA

Tags: , , , , ,

Revised NIST Guide Helps Organizations Handle Security-Related Incidents


The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) recently revised its guidelines for computer security incident handling to address the new and changing threats and attacks that are occurring.

Continue reading Revised NIST Guide Helps Organizations Handle Security-Related Incidents

Tags: , , , , , , , , , ,

One in three companies experienced at least one DDoS attack in the last twelve months


One in three organizations (31 percent) has suffered one or more Distributed Denial of Service (DDoS) attacks in the last 12 months, according to independent research commissioned by Corero Network Security.

Continue reading One in three companies experienced at least one DDoS attack in the last twelve months

Tags: , ,

Data Lost During Disaster Exercise May Have Exposed 800,000 People


A disaster preparedness exercise to ensure California’s child support system could be run remotely went smoothly, except for one casualty: the names, Social Security numbers and other private records of about 800,000 adults and children.

Continue reading Data Lost During Disaster Exercise May Have Exposed 800,000 People

Tags: ,

Information Security Policies Made Easy, Version 12 is now available!


Information Security Policies Made Easy, Version 12 now available! The latest release of the “Gold Standard” security policy library, Information Security Policies Made Easy, version 12, by Charles Cresson Wood, is now available! This update includes over 100 new security policies covering the latest topics including social networking, supply chain, mobile security, identity theft and many more!  ISPME V12 includes a library of over 1,500 sample security policies and a complete set of 38 essential sample policy documents.

Continue reading Information Security Policies Made Easy, Version 12 is now available!

Tags: , , , , , , , , ,

Information Security Policies Made Easy, Version 12 is now available!


Information Security Policies Made Easy, Version 12 now available! The latest release of the “Gold Standard” security policy library, Information Security Policies Made Easy, version 12, by Charles Cresson Wood, is now available! This update includes over 100 new security policies covering the latest topics including social networking, supply chain, mobile security, identity theft and many more!  ISPME V12 includes a library of over 1,500 sample security policies and a complete set of 38 essential sample policy documents.

Continue reading Information Security Policies Made Easy, Version 12 is now available!

Tags: , , , , , , , , ,