Press Contact: Leslie Phillips
(202) 224-2627 (202) 224-2627
June 10, 2010
LIEBERMAN, COLLINS, CARPER UNVEIL MAJOR CYBERSECURITY BILL TO MODERNIZE, STRENGTHEN, AND COORDINATE CYBER DEFENSES
WASHINGTON – Homeland Security and Governmental Affairs Committee Chairman Joe Lieberman, ID-Conn., Ranking Member Susan Collins, R-Me., and Federal Financial Management Subcommittee Chairman Tom Carper, D-De., Thursday introduced comprehensive legislation to modernize, strengthen, and coordinate the security of federal civilian and select private sector critical infrastructure cyber networks.
The Protecting Cyberspace as a National Asset Act of 2010, S.3480, would create an Office of Cyber Policy in the White House with a director accountable to the public who would lead all federal cyberspace efforts and devise national cyberspace strategy. A National Center for Cybersecurity and Communications within the Department of Homeland Security, also led by a director accountable to the public, would enforce cybersecurity policies throughout the government and the private sector. The bill would also establish a public/private partnership to set national cyber security priorities and improve national cyber security defenses.
The Committee will hold a hearing on the legislation June 15, 2010.
“The Internet may have started out as a communications oddity some 40 years ago but it is now a necessity of modern life, and sadly one that is under constant attack,” said Lieberman. “It must be secured, – and today, Senators Collins, Carper, and I have introduced a bill which we believe will do just that. The Protecting Cyberspace as a National Asset Act of 2010 is designed to bring together the disjointed efforts of multiple federal agencies and departments to prevent cyber theft, intrusions, and attacks across the federal government and the private sector. The bill would establish a clear organizational structure to lead federal efforts in safeguarding cyber networks. And it would build a public/private partnership to increase the preparedness and resiliency of those private critical infrastructure cyber networks upon which our way of life depends.
“For all of its ‘user-friendly’ allure, the Internet can also be a dangerous place with electronic pipelines that run directly into everything from our personal bank accounts to key infrastructure to government and industrial secrets. Our economic security, national security and public safety are now all at risk from new kinds of enemies -- cyber-warriors, cyber-spies, cyber-terrorists and cyber-criminals.
“The need for this legislation is obvious and urgent.”
Collins said: “As our national and global economies become ever more intertwined, cyber terrorists have greater potential to attack high-value targets. From anywhere in the world, they could disrupt telecommunications systems, shut down electric power grids, and freeze financial markets. With sufficient know-how, they could cause billions of dollars in damage and put thousands of lives in jeopardy. We cannot afford to wait for a “cyber 9/11” before our government finally realizes the importance of protecting our digital resources, limiting our vulnerabilities, and mitigating the consequences of penetrations of our networks.
“Yet, for too long, our approach to cyber security has been disjointed and uncoordinated. Our vital legislation would fortify the government’s efforts to safeguard America’s cyber networks from attack. This bill would build a public/private partnership to promote national cyber security priorities and help prevent and respond to cyber attacks.”
Carper said: “Over the past few decades, our society has become increasingly dependent on the internet, including our military, government, and businesses of all kinds. While we have reaped enormous benefits from this powerful technology, unfortunately our enemies have identified cyber space as an ideal 21st century battlefield. We have to take steps now to modernize our approach to protecting this valuable, but vulnerable, resource. This legislation is a vital tool that America needs to better protect cyber space. It encourages the government and the private sector to work together to address this growing threat and provides the tools and resources for America to be successful in this critical effort.”
Key elements of the legislation include:
1. Creation of an Office of Cyberspace Policy in the Executive Office of the President run by a Senate-confirmed Director, who will advise the President on all cybersecurity matters. The Director will lead and harmonize federal efforts to secure cyberspace and will develop a national strategy that incorporates all elements of cyberspace policy, including military, law enforcement, intelligence, and diplomatic. The Director will oversee all related federal cyberspace activities to ensure efficiency and coordination.
2. Creation of a National Center for Cybersecurity and Communications (NCCC) at the Department of Homeland Security (DHS) to elevate and strengthen the Department’s cyber security capabilities and authorities. The Director will regularly advise the President on efforts to secure federal networks. The NCCC will be led by a Senate-confirmed Director, who will report to the Secretary. The NCCC will include the United States Computer Emergency Response Team (US-CERT), and will lead federal efforts to protect public and private sector cyber and communications networks.
3. Updates the Federal Information Security Management Act (FISMA) to modernize federal agencies practices of protecting their internal networks and systems. With strong leadership from DHS, these reforms will allow agencies to move away from the system of after-the-fact paperwork compliance to real-time monitoring to secure critical systems.
4. Requiring the NCCC to work with the private sector to establish risk-based security requirements that strengthen cyber security for the nation’s most critical infrastructure that, if disrupted, would result in a national or regional catastrophe.
5. Requiring covered critical infrastructure to report significant breaches to the NCCC to ensure the federal government has a complete picture of the security of these sensitive networks. The NCCC must share information, including threat analysis, with owners and operators regarding risks to their networks. The Act will provide specified liability protections to owners/operators that comply with the new risk-based security requirements.Creation of a responsible framework, developed in coordination with the private sector, for the President to authorize emergency measures to protect the nation’s most critical infrastructure if a cyber vulnerability is being exploited or is about to be exploited. The President must notify Congress in advance before exercising these emergency powers. Any emergency measures imposed must be the least disruptive necessary to respond to the threat and will expire after 30 days unless the President extends them. The bill authorizes no new surveillance authorities and does not authorize the government to “take over” private networks.
6. Development of a comprehensive supply chain risk management strategy to address risks and threats to the information technology products and services the federal government relies upon. This strategy will allow agencies to make informed decisions when purchasing IT products and services.
7. Requiring the Office of Personnel Management to reform the way cyber security personnel are recruited, hired, and trained to ensure that the federal government has the talent necessary to lead the national cyber security effort and protect its own networks.
Among the bill’s supporters are: anti-virus software companies McAfee and Symantec; Karen Evans, former Administrator for E-Government and IT, Office of Management and Budget; Stewart Baker, former Assistant Secretary for Policy at DHS; the Intelligence and National Security Alliance; the Professional Services Council; and the Coalition for Government Procurement.
Sunday, June 13, 2010
Tuesday, June 1, 2010
Heartland settles with MasterCard over data breach
21 May 2010
Heartland Payment Systems, the fifth-largest payment card processor in the US, has made a third settlement deal in what was one of the largest data breach incidents in history. This time, MasterCard has agreed to take a 41.4m payout for its card issuers.
MasterCard and Heartland agreed to the payment arrangement in which the card processor will fund up to 41.4m in reimbursement expenses claimed by MasterCard’s issuers affected by the data breach. The deal is contingent on acceptance by at least 80% of the card issuers.
Bob Carr, chairman and CEO of Heartland, said: “We are pleased to have reached an equitable settlement agreement that helps issuers of MasterCard-branded cards obtain a recovery with respect to losses they may have incurred from the intrusion.” The Heartland statement also suggested that MasterCard would recommend its card issuers accept payment offers from the agreement.
Heartland had previously settled similar cases with American Express and Visa.
“We feel that this settlement represents an appropriate and fair resolution for our issuing financial institution customers and will enable them to avoid uncertainties and delays associated with potentially protracted litigation," said Wendy Murdock, chief franchise officer for MasterCard Worldwide, in a press release statement. "The agreement underscores MasterCard's continuing efforts to maintain the integrity of payment card industry standards and mitigate the impact of account data compromise events."
The well publicized data breach occurred in 2008 when hackers compromised Heartland’s systems and made off with more than 100 million credit and debit card numbers processed by the company. One of the hackers, Albert Gonzalez, is currently serving a 20-year sentence related to the event, the stiffest such penalty ever handed out by a US court for a hacking-related incident.
Heartland Payment Systems, the fifth-largest payment card processor in the US, has made a third settlement deal in what was one of the largest data breach incidents in history. This time, MasterCard has agreed to take a 41.4m payout for its card issuers.
MasterCard and Heartland agreed to the payment arrangement in which the card processor will fund up to 41.4m in reimbursement expenses claimed by MasterCard’s issuers affected by the data breach. The deal is contingent on acceptance by at least 80% of the card issuers.
Bob Carr, chairman and CEO of Heartland, said: “We are pleased to have reached an equitable settlement agreement that helps issuers of MasterCard-branded cards obtain a recovery with respect to losses they may have incurred from the intrusion.” The Heartland statement also suggested that MasterCard would recommend its card issuers accept payment offers from the agreement.
Heartland had previously settled similar cases with American Express and Visa.
“We feel that this settlement represents an appropriate and fair resolution for our issuing financial institution customers and will enable them to avoid uncertainties and delays associated with potentially protracted litigation," said Wendy Murdock, chief franchise officer for MasterCard Worldwide, in a press release statement. "The agreement underscores MasterCard's continuing efforts to maintain the integrity of payment card industry standards and mitigate the impact of account data compromise events."
The well publicized data breach occurred in 2008 when hackers compromised Heartland’s systems and made off with more than 100 million credit and debit card numbers processed by the company. One of the hackers, Albert Gonzalez, is currently serving a 20-year sentence related to the event, the stiffest such penalty ever handed out by a US court for a hacking-related incident.
Wednesday, May 26, 2010
Shavlik offers 'cloud patching' with free service
SMBs with 10 or fewer PCs go free
By John E. Dunn | Techworld
Published: 17:24 GMT, 25 May 10
Patch management company Shavlik is offering small networks of 10 or fewer PCs access to a new online patch management service at no cost.
The new service, IT.Shavlik.com, is designed to scan for missing patches on a machine-by-machine basis, or using an IP address range or domain, reporting the results through the web portal. Missing patches across Windows versions are rated for severity and can be downloaded using links to the appropriate vendor website or using the ‘FixIT’ button. The service also supports VMWare ESX and ESXi hypervisors.
The only setup requirements are that users download Shavlik’s Clickonce application and already have Microsoft’s .NET Framework 3.5 installed.
Longer term, the company looks likely to introduce a degree of automation to future versions, which could allow specified patches to be fixed on an ongoing basis without the need for manual intervention.
There are a number of standalone patch discovery tools available at no cost, but IT.Shavlik is unusual in offering to manage this for up to 10 PCs and 100 separate scans per month, more than enough for a network of this size. It is also pioneering in offering what can be a tricky technology as an online service rather than a standalone app, which it believes extends the degree to which complexity can be hidden.
Separately, the company has re-purposed its established distributed patch management system as ‘PatchCloud’, which morphs existing technology for enterprises into a more ‘cloud-like’ form if they happen to want that.
Given that the announcements come as the company has adopted a new logo, the embracing of the cloud could be interpreted as a low-key re-launch of sorts.
Shavlik still sells software licenses but the future will be dominated by platforms run by giants such as Google, Amazon and Microsoft on which third-party services will integrate technology, including patch management, from specialists such as Shavlik.
By John E. Dunn | Techworld
Published: 17:24 GMT, 25 May 10
Patch management company Shavlik is offering small networks of 10 or fewer PCs access to a new online patch management service at no cost.
The new service, IT.Shavlik.com, is designed to scan for missing patches on a machine-by-machine basis, or using an IP address range or domain, reporting the results through the web portal. Missing patches across Windows versions are rated for severity and can be downloaded using links to the appropriate vendor website or using the ‘FixIT’ button. The service also supports VMWare ESX and ESXi hypervisors.
The only setup requirements are that users download Shavlik’s Clickonce application and already have Microsoft’s .NET Framework 3.5 installed.
Longer term, the company looks likely to introduce a degree of automation to future versions, which could allow specified patches to be fixed on an ongoing basis without the need for manual intervention.
There are a number of standalone patch discovery tools available at no cost, but IT.Shavlik is unusual in offering to manage this for up to 10 PCs and 100 separate scans per month, more than enough for a network of this size. It is also pioneering in offering what can be a tricky technology as an online service rather than a standalone app, which it believes extends the degree to which complexity can be hidden.
Separately, the company has re-purposed its established distributed patch management system as ‘PatchCloud’, which morphs existing technology for enterprises into a more ‘cloud-like’ form if they happen to want that.
Given that the announcements come as the company has adopted a new logo, the embracing of the cloud could be interpreted as a low-key re-launch of sorts.
Shavlik still sells software licenses but the future will be dominated by platforms run by giants such as Google, Amazon and Microsoft on which third-party services will integrate technology, including patch management, from specialists such as Shavlik.
Sunday, May 23, 2010
Heartland, MasterCard Settle (http://www.bankinfosecurity.com/articles.php?art_id=2552)
Issuers Face June 25 Deadline to Accept $41.4 Million Offer
May 19, 2010 - Linda McGlasson, Managing Editor
MasterCard and Heartland Payment Systems have settled on a $41.4 million payment to recover losses from the processor's card data breach that was made public in January 2009.
Heartland has now settled with all three major card brands, Visa ($60 million), American Express ($3.6 million) and MasterCard.
This proposed settlement resolves the claims from MasterCard and its issuers from the 2008 data breach. Under the agreement, alternative recovery offers totaling $41.4 million will be made to eligible MasterCard issuers with respect to losses incurred by them as a result of the criminal intrusion. MasterCard will recommend eligible MasterCard issuers accept the offer.
"We feel that this settlement represents an appropriate and fair resolution for our issuing financial institution customers and will enable them to avoid uncertainties and delays associated with potentially protracted litigation," says Wendy Murdock, chief franchise officer for MasterCard Worldwide in the press announcement.
Bob Carr, Heartland's chairman and chief executive officer, states in a release about the settlement: "We are pleased to have reached an equitable settlement agreement that helps issuers of MasterCard-branded cards obtain a recovery with respect to losses they may have incurred from the intrusion."
The settlement will be contingent upon financial institutions representing 80 percent of the claimed-on MasterCard accounts accepting their alternative recovery offers by June 25, 2010. The settlement also includes mutual releases between Heartland and its sponsoring bank acquirers on the one hand - and MasterCard and the accepting issuers on the other.
Need Help?
The settlement states that issuers who accept their alternative recovery offers must waive rights to any other recovery of alleged intrusion-related losses from Heartland and its sponsoring bank acquirers through litigation or other remedies and release MasterCard, Heartland and its sponsoring bank acquirers from all legal and financial responsibility related to the intrusion.
MasterCard says all eligible issuers will soon receive notification with full details of the settlement agreement and how to accept their alternative recovery offers before the offers expire.
A consumer-related class action suit against the payments processor was proposed to the judge and got preliminary approval in late April.
Next Related Article:
P2P Payments: What You Need to Know
Topics of InterestPatriot Act
Privacy Breaches: Protect Yourself - and Your Vendor
Money-Laundering Update: Kevin Sullivan on Emerging Threats
Social Engineering
Redspin Security Report: Top 10 Network Security Threats of 2008 - Q2 Update
Banking Agenda: Beating the Drum for Safety & Soundness
Skimming
How to Avoid Being a Victim of Multi-Channel Fraud
Ohio Skimming Scam Nets $50K
FFIEC
ID Theft Red Flags Examinations: What to Expect?
BankInfoSecurity.Com Week in Review: May 1, 2010
Authentication
The Future of Authentication for Online Financial Services
Defeating Man-in-the-Browser: How to Prevent the Latest Malware Attacks against Consumer & Corporate Banking
Remote Capture
Achieving PCI Compliance for: Privileged Password Management & Remote Vendor Access
New Banking Services: Growth Among Community Banks - Insights from Christine Barry of Aite Group
Latest Tweets & Mentionssrcsecurity Heartland, MasterCard Settle Issuers Face June 25 Deadline to Accept $41.4 Million Offer www.bankinfosecurity.com... 6 minutes ago reply
Join the conversation Recent ContentMost Popular 11 Bank Closed on May 21
2Regulatory Reform Clears Senate
3FDIC: Now 775 'Problem Banks'
4Bank vs. Customer Suit Settled
5ACH Fraud: How to Fight Back
6PCI Update Gets Mixed Reviews
7Regulatory Reform's impact on Main St.
8Failed Banks and Credit Unions, 2010
9Bank vs. Business: Judge Rejects Motions
105 Tips to Reduce Banking Fraud
View More 122 Banking Breaches So Far in 20102ATM Skimming: 8 Tips to Fight Fraud3Failed Banks and Credit Unions, 20104Hancock Breach Reveals New Trend5Job Hunter's Guide to Social Media65 Lessons from the Comerica Suit7How to Respond to Vishing Attacks8Agencies Issue ACH, Wire Advisory9Heartland Hacker Gets 20 Years10Should Banks Cover Fraud Losses?View More
May 19, 2010 - Linda McGlasson, Managing Editor
MasterCard and Heartland Payment Systems have settled on a $41.4 million payment to recover losses from the processor's card data breach that was made public in January 2009.
Heartland has now settled with all three major card brands, Visa ($60 million), American Express ($3.6 million) and MasterCard.
This proposed settlement resolves the claims from MasterCard and its issuers from the 2008 data breach. Under the agreement, alternative recovery offers totaling $41.4 million will be made to eligible MasterCard issuers with respect to losses incurred by them as a result of the criminal intrusion. MasterCard will recommend eligible MasterCard issuers accept the offer.
"We feel that this settlement represents an appropriate and fair resolution for our issuing financial institution customers and will enable them to avoid uncertainties and delays associated with potentially protracted litigation," says Wendy Murdock, chief franchise officer for MasterCard Worldwide in the press announcement.
Bob Carr, Heartland's chairman and chief executive officer, states in a release about the settlement: "We are pleased to have reached an equitable settlement agreement that helps issuers of MasterCard-branded cards obtain a recovery with respect to losses they may have incurred from the intrusion."
The settlement will be contingent upon financial institutions representing 80 percent of the claimed-on MasterCard accounts accepting their alternative recovery offers by June 25, 2010. The settlement also includes mutual releases between Heartland and its sponsoring bank acquirers on the one hand - and MasterCard and the accepting issuers on the other.
Need Help?
The settlement states that issuers who accept their alternative recovery offers must waive rights to any other recovery of alleged intrusion-related losses from Heartland and its sponsoring bank acquirers through litigation or other remedies and release MasterCard, Heartland and its sponsoring bank acquirers from all legal and financial responsibility related to the intrusion.
MasterCard says all eligible issuers will soon receive notification with full details of the settlement agreement and how to accept their alternative recovery offers before the offers expire.
A consumer-related class action suit against the payments processor was proposed to the judge and got preliminary approval in late April.
Next Related Article:
P2P Payments: What You Need to Know
Topics of InterestPatriot Act
Privacy Breaches: Protect Yourself - and Your Vendor
Money-Laundering Update: Kevin Sullivan on Emerging Threats
Social Engineering
Redspin Security Report: Top 10 Network Security Threats of 2008 - Q2 Update
Banking Agenda: Beating the Drum for Safety & Soundness
Skimming
How to Avoid Being a Victim of Multi-Channel Fraud
Ohio Skimming Scam Nets $50K
FFIEC
ID Theft Red Flags Examinations: What to Expect?
BankInfoSecurity.Com Week in Review: May 1, 2010
Authentication
The Future of Authentication for Online Financial Services
Defeating Man-in-the-Browser: How to Prevent the Latest Malware Attacks against Consumer & Corporate Banking
Remote Capture
Achieving PCI Compliance for: Privileged Password Management & Remote Vendor Access
New Banking Services: Growth Among Community Banks - Insights from Christine Barry of Aite Group
Latest Tweets & Mentionssrcsecurity Heartland, MasterCard Settle Issuers Face June 25 Deadline to Accept $41.4 Million Offer www.bankinfosecurity.com... 6 minutes ago reply
Join the conversation Recent ContentMost Popular 11 Bank Closed on May 21
2Regulatory Reform Clears Senate
3FDIC: Now 775 'Problem Banks'
4Bank vs. Customer Suit Settled
5ACH Fraud: How to Fight Back
6PCI Update Gets Mixed Reviews
7Regulatory Reform's impact on Main St.
8Failed Banks and Credit Unions, 2010
9Bank vs. Business: Judge Rejects Motions
105 Tips to Reduce Banking Fraud
View More 122 Banking Breaches So Far in 20102ATM Skimming: 8 Tips to Fight Fraud3Failed Banks and Credit Unions, 20104Hancock Breach Reveals New Trend5Job Hunter's Guide to Social Media65 Lessons from the Comerica Suit7How to Respond to Vishing Attacks8Agencies Issue ACH, Wire Advisory9Heartland Hacker Gets 20 Years10Should Banks Cover Fraud Losses?View More
PCI Issues New POS Standard http://www.bankinfosecurity.com/articles.php?art_id=2519)
PIN Transaction Security Update is Effective Immediately
May 12, 2010 - Linda McGlasson, Managing Editor
A new measure to strengthen credit card data protection was released by the PCI Security Standards Council today.
Version 3.0 of the PIN Transaction Security (PTS) Point of Interaction (POI) standard is designed to streamline and simplify testing and implementation by providing a single set of modular evaluation requirements for all Personal Identification Number (PIN) acceptance Point of Interaction terminals. This standard is meant to enhance and prevent payment card fraud on devices that accept payment transactions and will cover everything from retail point of sale card readers to unattended payment terminals at gas stations and parking lots.
The new standard's rollout comes after a several years of noted credit card breaches such as those at retailer TJX and payment processor Heartland Payment Systems. The most recent card-related breach was Hancock Fabrics, where point of sale devices were swapped out with bogus equipment that had skimming devices in them to collect card data.
The PCI Council says the new standard is effective immediately. Version 3.0 also includes three new modules for device vendors and their customers to secure sensitive card data.
Up to now there were three separate sets of requirements for Point of Sale PIN Entry Devices (PED), Encrypting PIN Pads (EPP), and Unattended Payment Terminals (UPT). This version of the standard simplifies the testing process and eliminates overlap of documentation by providing one modular security evaluation program for all terminals and a single reference listing of approved products.
Need Help?
Bob Russo, general manager of the PCI Security Standards Council says to help everyone better understand the new standards and how they should be applied, the council will host two webinars next week. Registration information is available at the PCI website.
"By combining all of the requirements into one program, we have simplified one-stop shopping when it comes to secure devices," says Russo in a statement. This new approach and additional modules make it easier for manufacturers and merchants to make sure that at any point in a transaction, account data is being protected, he adds.
The updated standard and detailed listing of approved devices are available on the PCI Council's website .
May 12, 2010 - Linda McGlasson, Managing Editor
A new measure to strengthen credit card data protection was released by the PCI Security Standards Council today.
Version 3.0 of the PIN Transaction Security (PTS) Point of Interaction (POI) standard is designed to streamline and simplify testing and implementation by providing a single set of modular evaluation requirements for all Personal Identification Number (PIN) acceptance Point of Interaction terminals. This standard is meant to enhance and prevent payment card fraud on devices that accept payment transactions and will cover everything from retail point of sale card readers to unattended payment terminals at gas stations and parking lots.
The new standard's rollout comes after a several years of noted credit card breaches such as those at retailer TJX and payment processor Heartland Payment Systems. The most recent card-related breach was Hancock Fabrics, where point of sale devices were swapped out with bogus equipment that had skimming devices in them to collect card data.
The PCI Council says the new standard is effective immediately. Version 3.0 also includes three new modules for device vendors and their customers to secure sensitive card data.
Up to now there were three separate sets of requirements for Point of Sale PIN Entry Devices (PED), Encrypting PIN Pads (EPP), and Unattended Payment Terminals (UPT). This version of the standard simplifies the testing process and eliminates overlap of documentation by providing one modular security evaluation program for all terminals and a single reference listing of approved products.
Need Help?
Bob Russo, general manager of the PCI Security Standards Council says to help everyone better understand the new standards and how they should be applied, the council will host two webinars next week. Registration information is available at the PCI website.
"By combining all of the requirements into one program, we have simplified one-stop shopping when it comes to secure devices," says Russo in a statement. This new approach and additional modules make it easier for manufacturers and merchants to make sure that at any point in a transaction, account data is being protected, he adds.
The updated standard and detailed listing of approved devices are available on the PCI Council's website .
Monday, May 10, 2010
Basel Comité gaat toezicht banken aanscherpen
Gebaseerd op: Bank- en Effectenbedrijf (april 2010)
Het Basels Comité, het wereldwijde orgaan voor bankentoezicht, heeft ingrijpende aanscherpingen aangekondigd voor de bestaande regels van het bancaire toezicht om de fundamenten van het systeem te versterken. Zo worden de kapitaaleisen voor activiteiten in het handelsboek flink verhoogd.
Hiermee beoogt het Comité de prikkel tot het zogeheten regulatory arbitrage weg te nemen. Regulatory arbitrage is het verschijnsel dat banken de neiging hebben om yield te zoeken op plaatsen waar de toezicht- of kapitaaleisen het laagst zijn. Ook wil het Comité de complexe activiteiten in het bankenboek, zoals de hersecuritisaties, zwaarder belasten en moeten banken de onderliggende posities van hun activiteiten beter in de gaten houden. Een bank mag voortaan niet zomaar blind varen op het oordeel van de rating agencies.
Ten slotte moeten de banken transparanter zijn over de complexe producten op de balans. Deze specifieke maatregelen zullen naar verwachting al eind 2010 worden ingevoerd. De plannen kennen een groot internationaal draagvlak en in Europa zullen ze ingevoerd worden doormiddel van een aanpassing van de Europese bankenrichtlijn.
Het Basels Comité, het wereldwijde orgaan voor bankentoezicht, heeft ingrijpende aanscherpingen aangekondigd voor de bestaande regels van het bancaire toezicht om de fundamenten van het systeem te versterken. Zo worden de kapitaaleisen voor activiteiten in het handelsboek flink verhoogd.
Hiermee beoogt het Comité de prikkel tot het zogeheten regulatory arbitrage weg te nemen. Regulatory arbitrage is het verschijnsel dat banken de neiging hebben om yield te zoeken op plaatsen waar de toezicht- of kapitaaleisen het laagst zijn. Ook wil het Comité de complexe activiteiten in het bankenboek, zoals de hersecuritisaties, zwaarder belasten en moeten banken de onderliggende posities van hun activiteiten beter in de gaten houden. Een bank mag voortaan niet zomaar blind varen op het oordeel van de rating agencies.
Ten slotte moeten de banken transparanter zijn over de complexe producten op de balans. Deze specifieke maatregelen zullen naar verwachting al eind 2010 worden ingevoerd. De plannen kennen een groot internationaal draagvlak en in Europa zullen ze ingevoerd worden doormiddel van een aanpassing van de Europese bankenrichtlijn.
Saturday, May 8, 2010
FISMA Reform Bill Clears House Panel copy from Government Information Security
Measure Would Require Real-Time Monitoring of IT Systems
May 5, 2010 - Eric Chabrow, Executive Editor, GovInfoSecurity.com
A bill to require federal agencies to employ real-time security monitoring of their information systems to replace the current paper process cleared its first hurdle Wednesday, receiving approval by the House Oversight and Government Reform Subcommittee on Government Management, Organization and Procurement.
The measure, the Federal Information Security Amendment Act, or H.R. 4900, goes to the full committee.
The bill would require that the president's top cybersecurity adviser and the federal chief technology officer be confirmed by the Senate. The measure also would establish a panel of government IT security specialists to direct agencies on the steps they must take to secure federal digital assets.
The subcommittee accepted an amendment offered by Rep. Gerald Connolly, D.-Va., to require the CTO be confirmed by the Senate. Last year, under existing authority, President Obama named Aneesh Chopra to the newly created job of federal chief technology officer, a post that didn't require Senate confirmation. Chopra serves as a presidential adviser, but reports to John Holdren, director of the White House Office of Science and Technology Policy.
"To ensure that the chief technology officer can continue to improve federal use of technology in the future, we need to make this a statutory position," Connolly (pictured above) said in a statement. "My amendment does that, and gives the chief technology officer the authority he needs by enabling him to report directly to the president."
Click to Get Updates on the Latest Information Security News
Company*
Title*
Email*
Subscription Type: HTML Text
Government Enews General Government Enews Blogs Enews Careers Enews Training Enews Webinars Enews Podcasts Enews White Papers Enews Banking Enews General Banking Enews Blogs Enews Careers Enews Training Enews Webinars Enews Podcasts Enews White Papers Enews Credit Union Enews General Credit Union Enews Blogs Enews Careers Enews Training Enews Webinars Enews Podcasts Enews White Papers Enews
Need Help?
Using similar authority, Obama tapped Howard Schmidt last December to be White House cybersecurity coordinator, a post that did not require Senate confirmation. In seeking to codify these positions, and by requiring Senate confirmation, Congress would provide some oversight over their performance.
The bill, sponsored by committee chair Diane Watson, D.-Calif., primarily is aimed at updating the 8-year-old Federal Information Security Management Act, the primary law regulating federal information security.
The measure would:
•Create a National Office for Cyberspace within the Executive Office of the President to coordinate and oversee the IT security of agency information systems and infrastructure, headed by a presidentially nominated director who would be confirmed by the Senate.
•Institute a Federal Cybersecurity Practice Board within the National Office of Cyberspace - chaired by the director - charged with developing the processes agency would follow to defend their IT systems. Board members would come from the Office of Management and Budget, Department of Defense and select members from civilian and law enforcement agencies. The policies the board would develop include minimum security controls, measures of effectiveness for determining cyber risk and remedies for security deficiencies.
•Establish requirements for agencies to undertake automated and continuous system monitoring to identify system compliance, deficiencies and potential risks. These activities would move agencies away from manually intensive periodic assessments that fail to incorporate emerging tends or information about an agency's current security posture.
•Require agencies to conduct regular evaluations of their systems, including so-called red-team penetration tests.
•Oblige agencies and contractors managing government systems to obtain an annual, independent audit of their IT programs to determine their overall effectiveness and compliance with FISMA requirements.
•Authorize the National Office of Cyberspace director to approve policies for the operation of a central federal information security incident center.
•Establish requirements for the purchase of secure commercial, off-the-shelf IT products and services as well as policies for mitigating supply chain risks associated with those products.
The House bill is similar to a FISMA reform measure in the Senate, the United States Information and Communications Enhancement Act, or U.S. ICE, sponsored by Sen. Tom Carper, D.-Del., which also would replace so-called FISMA paper compliance with real-time monitoring of government IT systems. The major difference of the two bills is that the House version places cybersecurity authority in the White House whereas the Senate measure - as redrafted last summer - would grant much cybersecurity governance clout in the Department of Homeland Security. Several other cybersecurity bills are at various stages in Congress.
May 5, 2010 - Eric Chabrow, Executive Editor, GovInfoSecurity.com
A bill to require federal agencies to employ real-time security monitoring of their information systems to replace the current paper process cleared its first hurdle Wednesday, receiving approval by the House Oversight and Government Reform Subcommittee on Government Management, Organization and Procurement.
The measure, the Federal Information Security Amendment Act, or H.R. 4900, goes to the full committee.
The bill would require that the president's top cybersecurity adviser and the federal chief technology officer be confirmed by the Senate. The measure also would establish a panel of government IT security specialists to direct agencies on the steps they must take to secure federal digital assets.
The subcommittee accepted an amendment offered by Rep. Gerald Connolly, D.-Va., to require the CTO be confirmed by the Senate. Last year, under existing authority, President Obama named Aneesh Chopra to the newly created job of federal chief technology officer, a post that didn't require Senate confirmation. Chopra serves as a presidential adviser, but reports to John Holdren, director of the White House Office of Science and Technology Policy.
"To ensure that the chief technology officer can continue to improve federal use of technology in the future, we need to make this a statutory position," Connolly (pictured above) said in a statement. "My amendment does that, and gives the chief technology officer the authority he needs by enabling him to report directly to the president."
Click to Get Updates on the Latest Information Security News
Company*
Title*
Email*
Subscription Type: HTML Text
Government Enews General Government Enews Blogs Enews Careers Enews Training Enews Webinars Enews Podcasts Enews White Papers Enews Banking Enews General Banking Enews Blogs Enews Careers Enews Training Enews Webinars Enews Podcasts Enews White Papers Enews Credit Union Enews General Credit Union Enews Blogs Enews Careers Enews Training Enews Webinars Enews Podcasts Enews White Papers Enews
Need Help?
Using similar authority, Obama tapped Howard Schmidt last December to be White House cybersecurity coordinator, a post that did not require Senate confirmation. In seeking to codify these positions, and by requiring Senate confirmation, Congress would provide some oversight over their performance.
The bill, sponsored by committee chair Diane Watson, D.-Calif., primarily is aimed at updating the 8-year-old Federal Information Security Management Act, the primary law regulating federal information security.
The measure would:
•Create a National Office for Cyberspace within the Executive Office of the President to coordinate and oversee the IT security of agency information systems and infrastructure, headed by a presidentially nominated director who would be confirmed by the Senate.
•Institute a Federal Cybersecurity Practice Board within the National Office of Cyberspace - chaired by the director - charged with developing the processes agency would follow to defend their IT systems. Board members would come from the Office of Management and Budget, Department of Defense and select members from civilian and law enforcement agencies. The policies the board would develop include minimum security controls, measures of effectiveness for determining cyber risk and remedies for security deficiencies.
•Establish requirements for agencies to undertake automated and continuous system monitoring to identify system compliance, deficiencies and potential risks. These activities would move agencies away from manually intensive periodic assessments that fail to incorporate emerging tends or information about an agency's current security posture.
•Require agencies to conduct regular evaluations of their systems, including so-called red-team penetration tests.
•Oblige agencies and contractors managing government systems to obtain an annual, independent audit of their IT programs to determine their overall effectiveness and compliance with FISMA requirements.
•Authorize the National Office of Cyberspace director to approve policies for the operation of a central federal information security incident center.
•Establish requirements for the purchase of secure commercial, off-the-shelf IT products and services as well as policies for mitigating supply chain risks associated with those products.
The House bill is similar to a FISMA reform measure in the Senate, the United States Information and Communications Enhancement Act, or U.S. ICE, sponsored by Sen. Tom Carper, D.-Del., which also would replace so-called FISMA paper compliance with real-time monitoring of government IT systems. The major difference of the two bills is that the House version places cybersecurity authority in the White House whereas the Senate measure - as redrafted last summer - would grant much cybersecurity governance clout in the Department of Homeland Security. Several other cybersecurity bills are at various stages in Congress.
Subscribe to:
Posts (Atom)