Ashley Carman, Editorial Assistant                     

September 24, 2014

DDoS attacks target enterprises and ISPs, ignore financial institution

Distributed denial-of-service attack volume and targets shift in 2014.

The traffic volume of distributed denial-of-service (DDoS) attacks has increased this year with one-third peaking at more than 500Mbps, and more than five percent reaching 4Gbps. Only .9 percent of attacks reached 4Gpbs during the second half of 2013.
The high frequency attacks have become increasingly difficult to detect and defend against, according to NSFOCUS's “Mid-year 2014 DDoS Threat Report,” and they can do considerable damage by effectively shutting down an enterprise's online business and services. In addition, they can diminish a company's reputation and can have political impact, Xuhua Bao, senior researcher, said in an email to SCMagazine.com.
One of the most notable findings, however, was the complete shift in targets, the report said. Last year, banks accounted for the majority of attacks. This year, financial institutions barely made the report's list of targets. Instead, NSFOCUS found that enterprises and internet service providers (ISPs) in particular are being targeted this year with 20.8 percent of the attacks aimed at enterprise websites and 14.6 percent aimed at ISPs.
Bao attributed this refocus to financial institutions employing stronger security defense solutions, which makes it both more difficult to penetrate their defenses and lessens the impact of the attacks.
He also noted that "most enterprises are inclined to take a low-profile when dealing with or reporting security issues when being attacked as compared to attacks that occur in the financial and banking industry.” Small attacks are rarely reported, he said, so without large-scale attacks, the general perceived impact is small.
The report explored attack methods, as well, and found that DNS floods remain the most popular of attack methods, followed by TCP floods and HTTP floods. For Bao, this finding represents the biggest issue plaguing IT security professionals and the field.
“Attacks methods and tactics have become more diversified,” he said. “In particular, some distinguished types of attacks, such as the Wordpress reflector and amplification attacks, are very clever…How to mitigate these types of multi-vectors hybrid DDoS attacks will be a big challenge in the future.”

Data Classification: As Easy As 01 10 11

Data Classification: As Easy As 01 10 11

Mandy Huth

Sep 24, 2014

Forrester analyst John Kindervag recently presented an interesting webcast, outlining the top recommendations to enhance data security. One of his main points that stuck with me involved the concept of simplifying data classification into binary’s most basic premise: the value of either one or zero.
Using this method, Kindervag states two types of data exist in our network:

1 = Data someone wants to steal, and
0 = Everything else

(In binary, 1 = true and 0 = false)

In the first step of our classification efforts, we should realize what our data is and where it’s located—after all, you can’t protect what you don’t know about, or can’t see. This should be the main focus of our efforts, with the ultimate goal of gathering a complete inventory of what assets are targeted and where they are hosted.
In order to seek out data, Kindervag suggests we follow the four Ps:

• PCI – Payment Card Industry

• PHI – Protected Health Information

• PII – Personally Identifiable Information

• IP – Intellectual Property

This data has imminent value to black-hats, as they sell information in exchange at profitable rates, resulting in higher threat vectors for us. All of this data should be tagged as a “1″ and therefore, protected as such.
Then, our efforts should include a classification of all remaining data, in which we ask ourselves:
How important are financials to our business? What about our policies? Do our product roadmaps provide value to someone? And lastly, is it worth stealing? If we are led to believe this data is targeted for its value, the data can be classified as a “1,” if not, we can classify it as a “0″.
With this information in hand, the security teams can begin segregating and protecting the data in a secured network, using the right user access controls based on what they need to know—also referred to as the “principle of least privilege.” With this design, hackers cannot access the critical data in a segregated network, even when the outer perimeter is breached.
Additionally, there is great value in going back and further classifying all the “0″ values identified in this exercise. There are many classification frameworks that break data into several tiers and will help the business identify what level of risk they are willing to accept for each type.
The intent of the binary exercise is to get ahead of the complexities and begin to make progress rather than getting caught up in a more complex framework that requires extensive “pre-work.”
No one wants to have their data at risk. It is our responsibility in protecting our company’s most important assets, including data, to classify and protect them accordingly. By making it a binary exercise of 1s and 0s, you may be able to kick start this effort and greatly increase your security posture. We can all be a “bit” more secure this way.
 

Security Versus Compliance: What’s the Difference?

---

September 23, 2014

By Steve Hunt
Security is the pursuit of perfect protection through ongoing tightening of defenses and preemptive activities to cover vulnerabilities.  Risk management, on the other hand, is a discipline that enables organizations to operate and measurably improve their security and compliance environments according to legal standards.
Most companies are not accustomed to thinking of information as a regulated asset.  Ingredients and food products, energy, toxic chemicals, infrastructure, and money are among the many assets that have been regulated for decades, or even centuries.  Yet, executives and entrepreneurs are obligated to see information as a regulated asset.
They have to adjust to the idea that there will be procedures similar to governing other regulated assets – having an internal auditor, quality process engineers, peer review, attorneys, independent reviews, etc. – with regard to information.  There must be controls and certification in a way that makes sense for their own specific businesses.
According to current legal standards, the best means of being in compliance is to have a clearly defined level of reasonable risk, and clear procedures that the company implements on a consistent basis.
In the unlikely event of a breach, this level of risk management should enable the business to demonstrate empirically that it was not negligent.  There must be a quantifiable way to state a company’s acceptable level of risk in terms of impact and likelihood.  Impact is defined according to the company’s mission, objectives, and obligations.  The standard must be applied consistently across all of the company’s information assets that could pose a conceivable risk.
If a company can clearly articulate and calculate its level of acceptable or reasonable risk, and thereby operate in a manner that demonstrates compliance, it may be protected enough to forgo more complicated and expensive security measures, thus freeing up resources that can be invested in the creation of value for the business. 
Thus risk management is necessary not only to fulfill regulatory requirements and contractual obligations, but the very essence of the company’s business goals.  Having a clear risk assessment and risk management process ultimately will make running a business easier.

Security Versus Compliance: What’s the Difference?

Security Versus Compliance: What’s the Difference?

CBP constateert overtreding wet bij Snappet

CBP constateert overtreding wet bij Snappet
Snappet verwerkt leerresultaten via onderwijstablets

Paginaintro

Persbericht, 19 september 2014
Snappet, een organisatie die tablets met ingebouwde apps verhuurt aan meer dan 400 basisscholen, verwerkt leerresultaten van kinderen in strijd met de wet. Dat concludeert het College bescherming persoonsgegevens (CBP) na onderzoek. Snappet gebruikt deze persoonsgegevens voor bijvoorbeeld het voortdurend per opgave beoordelen en kwalificeren van de kinderen in vergelijking met alle andere kinderen die de Snappet-tablets gebruiken, zonder expliciete schriftelijke opdracht van de scholen. Snappet geeft de scholen onvoldoende informatie om te weten wat Snappet met de gegevens doet. “Tablets en andere digitale leermiddelen zijn een prachtige verrijking van het onderwijs. Maar scholen moeten wel weten wat er met de gegevens van de kinderen gebeurt, zodat ze zelf kunnen bepalen voor welke doelen de gegevens mogen worden gebruikt. Dat kan alleen als dienstverleners als Snappet de scholen eerlijk informeren en duidelijke keuzes bieden”, aldus Wilbert Tomesen, plaatsvervangend voorzitter van het CBP.  Snappet heeft toegezegd klanten beter te informeren over de gegevensverwerkingen en inmiddels een maatregel getroffen waarmee leerresultaten in de algemene overzichtstabellen niet meer te herleiden zouden zijn tot de kinderen. Het CBP zal de komende periode controleren of Snappet de geconstateerde overtredingen heeft beëindigd. Indien nodig zet het CBP handhavende maatregelen in. Hiertegen staan rechtsmiddelen open.

Downloadinhoud

---

Lees het rapport van definitieve bevindingen (762 KB)

---

Paginainhoud

Steeds meer scholen werken met digitale leermiddelen, zoals apps en tablets. Deze middelen bieden naast innovatieve onderwijsmethoden ook nieuwe technologische mogelijkheden om persoonsgegevens te aggregeren, te combineren en verder te verwerken. Die verwerkingen van de gegevens zijn niet zonder meer toegestaan. Leerresultaten van kinderen zijn gevoelige gegevens waaraan bovendien conclusies kunnen worden verbonden met gevolgen voor het latere maatschappelijke leven. Scholen moeten zeggenschap houden over de gegevens van hun leerlingen en weten wat daarmee gebeurt.

Sommige gegevensverwerkingen door Snappet vloeien redelijkerwijs voort uit het gebruik van onderwijstablets, bijvoorbeeld het teruggeven van de resultaten aan de kinderen en hun eigen leraar. Dit geldt niet vanzelfsprekend voor het gebruik van de leerresultaten voor andere zaken, zoals advies over het curriculum of over individuele leerproblemen. Externe technische dienstverleners moeten scholen heldere informatie geven over de gegevensverwerkingen en mogen de gegevens van de leerlingen hiervoor pas gebruiken nadat scholen hier weloverwogen voor hebben kunnen kiezen. Scholen kunnen dan op hun beurt ouders informeren.

Tot slot heeft Snappet de dienst onvoldoende beveiligd tegen onrechtmatige verwerking van de persoonsgegevens door onbevoegde derde partijen. Snappet heeft ook op dit punt een maatregel getroffen, waarvan het CBP de komende periode zal controleren of de overtreding hiermee is beëindigd.

Internet of Things to make CISOs redefine security efforts

Internet of Things to make CISOs redefine security efforts

Posted on 12 September 2014.

By year-end 2017, over 20 percent of enterprises will have digital security services devoted to protecting business initiatives using devices and services in the Internet of Things, according to Gartner, Inc. Business cases using Internet of Things (IoT) devices already exist and their role in business and industry will force enterprises to secure them.

“The power of an Internet of Things device to change the state of environments and of itself will cause CISOs to redefine the scope of their security efforts beyond present responsibilities,” said Earl Perkins, research vice president at Gartner.

“IoT security needs will be driven by specific business use cases that are resistant to categorization, compelling CISOs to prioritize initial implementations of IoT scenarios by tactical risk. The requirements for securing the IoT will be complex, forcing CISOs to use a blend of approaches from mobile and cloud architectures, combined with industrial control, automation and physical security,” Perkins added.

Gartner predicts that the installed base of "things," excluding PCs, tablets and smartphones, will grow to 26 billion units in 2020, which is almost a 30-fold increase from 0.9 billion units in 2009. The component cost of IoT-enabling consumer devices will approach $1, and "ghost" devices with unused connectivity will be common.

There will be a $309 billion incremental revenue opportunity in 2020 for IoT suppliers from delivering products and services. The total economic value-add from IoT across industries will reach $1.9 trillion worldwide in 2020 by which time more than 80 percent of the IoT supplier revenue will be derived from services. The industries likely to see the greatest value added from the IoT will initially be manufacturing, healthcare providers, insurance, and banking and securities. However, this growth will not be confined there but will expand across all industry sectors.

“In an IoT world, information is the ‘fuel’ that is used to change the physical state of environments through devices that are not general-purpose computers but, instead, devices and services that are designed for specific purposes,” said Mr. Perkins. “The IoT is a conspicuous inflection point for IT security — and the CISO will be on the front lines of its emerging and complex governance and management.”

Mr. Perkins said that the Nexus of Forces identified in Gartner research— cloud, social, mobile and information — is driving early-state opportunities in the IoT. The IoT already has a myriad of commercial and consumer technology use cases that range from connected homes and connected automobiles to wearable devices, from intelligent medical equipment to sensor systems for smart cities and facilities management.

The characteristics of intelligent, purpose-built devices that are networked to provide information and state changes for themselves or surrounding environments are increasingly used in OT systems, such as those found in industrial control and automation (sometimes referred to as the "industrial IoT"). However, securing the IoT represents new CISO challenges in terms of the type, scale and complexity of the technologies and services that are required.

“At this time, there is no "guide to securing IoT" available that provides CISOs with a framework for incorporating IoT principles across all industries and use cases. What constitutes an IoT device is still up for interpretation, so securing the IoT is a ‘moving target.’ However, it is possible for CISOs to establish an interim planning strategy, one that takes advantage of the ‘bottom up’ approach available today for securing the IoT,” said Mr. Perkins.

“Gartner advises security leaders against over thinking IoT security by attempting to draft a grand strategy that encompasses all IoT security needs to this point in time. Instead, they should lower the residual risk of the IoT by assessing whether the particular business use case provides better control and performance. Lessons from these initial use cases will serve as building blocks for a broader strategy for addressing the security of the IoT.”

http://www.net-security.org/secworld.php?id=17355

In the Big Picture, Jennifer Lawrence Has the Same Security Problem as Your Bank

 Matt Little                  
02 September 2014 in Data Security   

 

In year with rampant security breaches, two of this past week’s revelations proved that we could still be shocked by the level of threats from exposed photos, business operations and personal info.

(Don’t) smile! Celebrities and financial systems seem to be making a similar strategic mistake. (Image: "PappLosAngeles" by Blackbow17 - Own work. Licensed under Creative Commons Attribution 3.0 via Wikimedia Commons.) Over the last week, we’ve seen a massive spill of private pics from celebrities like Jennifer Lawrence and Kirsten Dunst from what is believed to be lame passwords attached to email and personal cloud accounts. On the business side, major banks revealed gigabytes of customer checking, savings and other personal information may have been “siphoned” from a mix of complex data system intrusions and easily discovered loopholes from outdated computer software.

There is a nearly incomprehensible amount of information leaked out from these two very different data exposures. What strikes me most beyond the tawdry pics and gigabytes are the reasons these security problems are the same. This isn’t a loose attempt to lump together saucy celebrity pics and enterprise software woes. Rather, it’s to note that your information – personal, financial or otherwise – is under threat and at risk from a range of sources. Yet, too often we see acceptance of one method to protect information.

One layer of data security is not better than nothing. In light of today’s security threats, one layer is just as bad as none. Multiple methods of defense are the only way to safeguard ourselves, regardless of whether “we” are a Wall Street financial behemoth or selfie posing celeb. For certain, finding the right layers of defense is a more involved process than merely saying so. It starts with a change in mindset. Gone are the days of believing in one option or checkbox to keep our business or personal data safe. And there is no acceptance that we’re powerless to protect against these risks.

In the weeks ahead, we’ll share practical strategies on a defense-in-depth approach to protect from the three main sources of threats – what we like to call “snoops, thieves and idiots.” In the meantime, let us know which data protection problems are most challenging for you or most vexing to read about.

http://www.pkware.com/Blog/2014/09/02/in-the-big-picture-jennifer-lawrence-has-the-same-security-problem-as-your-bank

Teri Robinson, Associate Editor              

September 04, 2014

Google acceleration of SHA-1 deprecation draws resistance

Google said Chrome 39, to be released within 12 weeks, will treat some sites as untrusted, accelerating the transition and user woes.

After some pushback from the industry, Google has revised its timetable for deprecating support of SHA-1 crypto hash for issuing TLS/SSL digital certificates, but the new schedule still may be too aggressive and nearly impossible for many web operators to meet.
Noting for quite some time that SHA-1 no longer offers an acceptable level of security, Google has made it clear would compel users to update their security certificates, moving from SHA-1 to SHA-2 over the next two to three years. And Microsoft, too, said last fall it would start withdrawing its support from SHA-1 on January 1, 2016, with the transition complete by January 1, 2017.
But the Google's late August announcement that Chrome 39, due to be released within the next 12 weeks, will treat some sites as untrusted and that notifications would began appearing when users accessed those sites, took even advocates by surprise.
The accelerated schedule raised concerns that potentially hundreds of thousands of web operators may not be able to comply in the proposed timeframe and that users would find the notifications both confusing and alarming.
“It took everyone by surprise,” CA Security Council's (CASC) Jeremy Rowley, associate general counsel at DigiCert, Inc., told SCMagazine.com in a Wednesday interview.
While the CASC applauds Google's “endeavor” to strengthen browser security and supports the transition to SHA-2, he explained that a lot of companies are using SHA-1, particularly in China and the first notifications in Google's proposed schedule would hit during the holiday season, when companies can't have any interruptions. Even the adjusted deprecation schedule offers only a little wiggle room.
“It's a nice gesture,” said Rowley, but “accelerating a whole year really messes up the sales cycle.”
The number of organizations and users that the change will impact is currently unknown.
“Maybe Google has numbers on how many people it will impact but they haven't shared yet,” Rowley said. “We know a lot of people using SHA-1. Getting [SHA-2] installed on their systems in the next two months” before the warnings start popping up, might prove impossible.


The warnings might also “confuse the end users of websites,” CASC's Robin Alden, CTO at Comodo CA Ltd., told SCMagazine.com in an interview. “How are they going to understand what that means." 
In fact, the alerts may leave them questioning whether they can trust the internet.
Potentially, among the hardest hit be the will be small and medium-sized businesses, which often hire an outside consultant to set up their servers and security certificates then just let them ride for two to three years.
Switching certificates more frequently, unless there is a known compromise, may be cost-prohibitive. Larger organizations, like Google, for instance, change their certificates frequently and may be more current.
To ease the burden and smooth the transition, “we would like to work [Google, Microsoft and others] to get a timeline that works for everyone,” said Rowley. “We need to make sure everyone coordinates so users don't have to change certificates so often.”

The Police Tool That Pervs Use to Steal Nude Pics From Apple’s iCloud

• By Andy Greenberg  
• 09.02.14  

       

Then One/WIRED

As nude celebrity photos spilled onto the web over the weekend, blame for the scandal has rotated from the scumbag hackers who stole the images to a researcher who released a tool used to crack victims’ iCloud passwords to Apple, whose security flaws may have made that cracking exploit possible in the first place. But one step in the hackers’ sext-stealing playbook has been ignored—a piece of software designed to let cops and spies siphon data from iPhones, but is instead being used by pervy criminals themselves.
On the web forum Anon-IB, one of the most popular anonymous image boards for posting stolen nude selfies, hackers openly discuss using a piece of software called EPPB or Elcomsoft Phone Password Breaker to download their victims’ data from iCloud backups. That software is sold by Moscow-based forensics firm Elcomsoft and intended for government agency customers. In combination with iCloud credentials obtained with iBrute, the password-cracking software for iCloud released on Github over the weekend, EPPB lets anyone impersonate a victim’s iPhone and download its full backup rather than the more limited data accessible on iCloud.com. And as of Tuesday, it was still being used to steal revealing photos and post them on Anon-IB’s forum.
“Use the script to hack her passwd…use eppb to download the backup,” wrote one anonymous user on Anon-IB explaining the process to a less-experienced hacker. “Post your wins here ;-)”
Apple’s security nightmare began over the weekend, when hackers began leaking nude photos that included shots of Jennifer Lawrence, Kate Upton, and Kirsten Dunst. The security community quickly pointed fingers at the iBrute software, a tool released by security researcher Alexey Troshichev designed to take advantage of a flaw in Apple’s “Find My iPhone” feature to “brute-force” users’ iCloud passwords, cycling through thousands of guesses to crack the account.
If a hacker can obtain a user’s iCloud username and password with iBrute, he or she can log in to the victim’s iCloud.com account to steal photos. But if attackers instead impersonate the user’s device with Elcomsoft’s tool, the desktop application allows them to download the entire iPhone or iPad backup as a single folder, says Jonathan Zdziarski, a forensics consult and security researcher. That gives the intruders access to far more data, he says, including videos, application data, contacts, and text messages.
On Tuesday afternoon, Apple issued a statement calling the security debacle a “very targeted attack on user names, passwords and security questions.” It added that “none of the cases we have investigated has resulted from any breach in any of Apple’s systems including iCloud® or Find my iPhone.”
But the conversations on Anon-IB make clear the photo-stealing attacks aren’t limited to a few celebrities. And Zdziarski argues that Apple may be defining a “breach” as not including a password-guessing attack like iBrute. Based on his analysis of the metadata from leaked photos of Kate Upton, he says he’s determined that the photos came from a downloaded backup that would be consistent with the use of iBrute and EPPB. If a full device backup was accessed, he believes the rest of the backup’s data may still be possessed by the hacker and could be used for blackmail or finding other targets. “You don’t get the same level of access by logging into someone’s [web] account as you can by emulating a phone that’s doing a restore from an iCloud backup,” says Zdziarski. “If we didn’t have this law enforcement tool, we might not have the leaks we had.”
Elcomsoft is just one of a number of forensics firms like Oxygen and Cellebrite that reverse engineer smartphone software to allow government investigators to dump the devices’ data. But Elcomsoft’s program seems to be the most popular among Anon-IB’s crowd, where it’s been used for months prior to the most current leaks, likely in cases where the hacker was able to obtain the target’s password through means other than iBrute. Many “rippers” on Anon-IB offer to pull nude photos on behalf of any other user who may know the target’s Apple ID and password. “Always free, fast and discreet. Will make it alot easier if you have the password,” writes one hacker with the email address eppbripper@hush.ai. “Willing to rip anything iclouds – gf/bf/mom/sister/classmate/etc!! Pics, texts, notes etc!”
One of Anon-IB’s rippers who uses the handle cloudprivates wrote in an email to WIRED that he or she doesn’t consider downloading files from an iCloud backup “hacking” if it’s done on behalf of another user who supplies a username and password. “Dunno about others but I am too lazy to look for accounts to hack. This way I just provide a service to someone that wants the data off the iCloud. For all I know they own the iCloud,” cloudprivates writes. “I am not hacking anything. I simply copy data from the iCloud using the user name and password that I am given. Software from elcomsoft does this.”
Elcomsoft’s program doesn’t require proof of law enforcement or other government credentials. It costs as much as $399, but bootleg copies are freely available on bittorrent sites. And the software’s marketing language sounds practically tailor-made for Anon-IB’s rippers.
“All that’s needed to access online backups stored in the cloud service are the original user’s credentials including Apple ID…accompanied with the corresponding password,” the company’s website reads. “Data can be accessed without the consent of knowledge of the device owner, making Elcomsoft Phone Password Breaker an ideal solution for law enforcement and intelligence organizations.”
Elcomsoft didn’t respond to a request for comment.
On Monday, iBrute creator Troshichev noted that Apple had released an update for Find My iPhone designed to fix the flaw exploited by iBrute. “The end of fun, Apple have just patched,” he wrote on Github. But Anon-IB users continued to discuss stealing data with iBrute in combination with EPPB on the forum Tuesday, suggesting that the fix has yet to be applied to all users, or that stolen credentials are still being used with Elcomsoft’s program to siphon new data. Apple didn’t immediately respond to WIRED’s request for further comment, though it says it’s still investigating the hack and working with law enforcement.
For Apple, the use of government forensic tools by criminal hackers raises questions about how cooperative it may be with Elcomsoft. The Russian company’s tool, as Zdziarski describes it, doesn’t depend on any “backdoor” agreement with Apple and instead required Elcomsoft to fully reverse engineer Apple’s protocol for communicating between iCloud and its iOS devices. But Zdziarski argues that Apple could still have done more to make that reverse engineering more difficult or impossible.
“When you have third parties masquerading as hardware. it really opens up a vulnerability in terms of allowing all of these different companies to continue to interface with your system,” he says. “Apple could take steps to close that off, and I think they should.”
The fact that Apple isn’t complicit in law enforcement’s use of Elcomsoft’s for surveillance doesn’t make the tool any less dangerous, argues Matt Blaze, a computer science professor at the University of Pennsylvania and frequent critic of government spying methods. “What this demonstrates is that even without explicit backdoors, law enforcement has powerful tools that might not always stay inside law enforcement,” he says. “You have to ask if you trust law enforcement. But even if you do trust law enforcement, you have to ask whether other people will get access to these tools, and how they’ll use them.”


http://www.wired.com/2014/09/eppb-icloud/?mbid=social_twitter