Enterprises are under-investing in the protection of corporate secrets

April 6, 2010 · Filed Under Security Software, Software News · Comment 

Focus on Protecting Compliance-related Data Needs to Expand to More Valuable Intellectual Property

RSA, The Security Division of EMC and Microsoft (MSFT) announced the results of a commissioned global survey conducted by Forrester Consulting on behalf of RSA and Microsoft, entitled “The Value of Corporate Secrets: How Compliance and Collaboration Affect Enterprise Perceptions of Risk.” The survey of 305 IT security decision-makers worldwide revealed that enterprises are investing heavily in compliance and protection against accidental leaks of custodial data (such as customer information), but under-investing in protection against theft of far more valuable corporate secrets.

Security Spending Mis-aligned with Information Value

“Nearly 90% of enterprises we surveyed agreed that compliance with PCI-DSS, data privacy laws, data breach regulations, and existing data security policies is the primary driver of their data security programs. Significant percentages of enterprise budgets (39%) are devoted to compliance-related data security programs,” according to Forrester Consulting’s study. “But secrets comprise 62% of the overall information portfolio’s total value while compliance-related custodial data comprises just 38%, a much smaller proportion. This strongly suggests that investments are overweighed toward compliance.”

“Companies are spending money to protect customer, medical and payment card information, as they should, but more emphasis needs to be placed on protecting the intellectual property and data that has intrinsic value to an organization,” said Sam Curry, CTO, Marketing, RSA, The Security Division of EMC. “If IP is lost, it can cause long term competitive harm to an organization. The recent and highly-sophisticated attacks targeting intellectual property of large multinational companies are examples of this type of loss.”

Information Theft is More Costly than Accidental Loss

The survey found that while organizations focus on data security incidents related to accidental loss, information theft by employees or trusted outsiders is more costly. For example, based on responses received in the survey, employee theft of sensitive information is 10 times costlier than accidental loss on a per-incident basis: hundreds of thousands of dollars versus tens of thousands.

“Insider risk is a real and growing threat and the modern enterprise environment of collaboration with a variety of outside parties creates more opportunities for leakage and theft,” said John Chirapurath, senior director of the Identity and Security Business Group at Microsoft. “This data illustrates that the more a company has to lose in terms of information value, the more criminal activity it will face.”

A Need for Real Assessment and Measurement of Information Security

Despite a wide range in security spending, views on the value of information and the number of security incidents reported among the respondents, nearly every company surveyed rated its security controls to be equally effective.

“Most enterprises do not actually know whether their data security programs work or not, other than by raw incident counting,” according to Forrester Consulting. “‘Compliance’ in all its forms has helped CISOs buy more gear. But it has distracted IT security from its traditional focus: keeping company secrets secure.”

Together, Forrester, Microsoft and RSA are providing a set of recommendations within the study to help enterprises ensure that their information security strategies are appropriately balanced, including:

– Identify the most valuable information assets in the company’s portfolio
– Create a “risk register” of data security risks that document specific threat scenarios
– Assess and reprioritize the IT security program’s balance between compliance and protecting secrets
– Increase vigilance of external and third-party business relationships
– Measure data security program effectiveness

The Forrester Consulting Study sponsored by RSA and Microsoft is available at www.rsa.com/CorporateSecrets and www.microsoft.com/DLP.

Tags: , , ,

Solutionary identifies Top Security Risks and provides precautionary tips for Winter Olympic Games

February 8, 2010 · Filed Under Internet Software, Security Software, Software News · Comment 

Company encourages businesses, event advertisers, and corporate and individual attendees to remain vigilant and take information security precautions

Solutionary, has identified the top information and data security risks facing businesses, Olympic advertisers and attendees of the upcoming Winter Olympic Games in Vancouver from February 12th to 28th. In addition, the company has provided precautionary tips to help these people and organizations protect their data and assets.

Solutionary is a trusted security advisor to companies of all sizes around the world, processing more than 300 billion events annually through the company’s Security Operations Centers (SOC). Solutionary’s certified SOC analysts and technology offer 24/7 live and automated event monitoring to ensure the highest levels of protection.

“Hackers, spammers and scammers often take advantage of major events, like the Olympics, to steal confidential consumer and corporate data and information or to generally create chaos,” said Don Gray, Chief Security Strategist of Solutionary. “Since the 2008 Games, new and more malicious threats have surfaced and attacks are more prevalent, from the Google email hacks to Twitter and Facebook denial of service (DDOS) attacks. In the age of Web 2.0 and constant connectivity, it’s more important than ever for businesses and individuals alike to remain vigilant about information security – especially around an event of such international significance.”

Solutionary’s information and cyber security experts have identified the following as the top five information security risks around the Olympics:

Social Networks & Instant Messaging (IM) – In recent months, sites and services like Facebook, Twitter and MSN Messenger have been repeatedly targeted by hackers. Keep your guard up, even during the excitement of the Games. Who you are connecting to? How you are connecting to them? Are you sharing information that could be used for social engineering? Never share files thru IM services and connect only to branded, trusted information sources.

Masquerading Wireless Networks - Always know what network you are connecting to and avoid unsecured wireless networks. Only connect to networks associated with trusted brands/providers and be sure to verify names and credentials of the access points.

Malvertising – Website ads containing malicious exploit code may be hosted by unsuspecting websites in an attempt to maximize online ad revenue around the Games.

Hacktivism – Nationalistic pride can be a powerful motivator in driving hackers to initiate attacks. In the recent Google hacking incident there was evidence of retaliatory hacking affecting Baidu.com.

Whaling – Corporate executives and guests should be trained to recognize attempts to target them, their laptops, and phones for exploit. Promotional items can easily be faked. Emails, devices, CDs, and memory sticks can all convey malicious software.

Solutionary’s experts recommend Olympic attendees, advertisers and Vancouver-area businesses take the below security precautions, at a minimum, leading up to and during the Games:

Awareness – Make sure everyone in your network – whether it’s your kids or your employees – is aware of potential threats. If they are aware of heightened risk, they will be more vigilant and likely to flag suspicious activity or items.

Protect Endpoints - Attendees must protect mobile computers and phones as these devices often are targeted for the data they contain as well
as an exploit path for stealing account credentials, credit card information, etc.

If you can, leave them at home. Consider limiting yourself to one pocket-able device that’s easy to keep track of.

If you must have a laptop, ensure that it is up to date with the latest patches, anti-X (virus, spyware, malware) software.

Remove all non-essential data from laptop before traveling – especially if it’s confidential or sensitive.

If you must travel with sensitive or confidential data, employ strong whole disk encryption.

Check, Double-Check and Re-Check Security Processes – Local businesses and advertisers should review their information security countermeasures, validate that patches are up-to-date, that web applications are not vulnerable, and that wireless networks are secured using WPA/WPA2 authentication and TKIP/AES encryption.

Log Monitoring – Local businesses involved with the Games and advertisers must recognize that their participation brings about the possibility of increased motivated attackers targeting them for nationalistic or political reasons. Ensure security log monitoring is adequate to handle the increased threat level and volume.

Check ATM’s – Attendees and local financial institutions should be vigilant about checking for ATM pin-pad skimmers. Most pin-pad skimmers can be detected by careful examination and physical checking as they are often taped on top of the real card-entry mechanism on the ATM. If there is any doubt, find another ATM to be safe.

Tags: , , , , , , ,

Perimeter E-Security ranks the Top 10 Information Security Threats for 2010

January 17, 2010 · Filed Under Security Software, Software News · Comment 

Malware and Malicious Insiders Top the List as Rising Threats; Vulnerability Exploits will be the Heart of Hacking and Data Breaches

Perimeter E-Security, the trusted market leader of information security services that delivers enterprise-class protection and compliance to companies of all sizes, unveiled its Top 10 Information Security Threats for 2010.

“The start of a new year is a great time for companies to evaluate their information security practices and begin thinking about what threats they’ll be facing in the coming year,” said Kevin Prince, CTO, Perimeter E-Security. “As these security threats are becoming more serious and difficult to detect, it is vital for companies to understand what they can do to best protect their systems and information.”

Perimeter’s ranking of the Top 10 information security threats for 2010:

1. Malware (Rising Threat)

Last year, Malware was listed as the second highest ranked threat to organizations on Perimeter E-Security’s list of top threats. There are many methods to install malware on systems, including the use of client-side software vulnerabilities. Browsers remain a top target for vulnerabilities. In 2009, the FBI reported that for the first time ever, revenue from cybercrime had exceeded drug trafficking, estimated at taking in more than one billion annually in profits.

2. Malicious Insiders (Rising Threat)

Malicious insiders were listed as the top threat for 2009, but have fallen to the #2 spot for 2010. With the downturn in the economy last year, it was no surprise that many desperate and disgruntled employees attempted to exploit the companies they currently or previously worked for. There is no way to eliminate the threat of malicious insiders completely, but through good security policies and followed procedures, the incidents could be a fraction of what they are today. With the economy still suffering and still high unemployment levels, Malicious Insiders will continue to be a threat.

3. Exploited Vulnerabilities (Steady Threat)

Vulnerability exploit is at the heart of hacking and data breaches. Worms, viruses, malware, and a host of other attack types often rely on vulnerability exploit to infect, spread and perform the actions cyber criminals want. And yet, organizations are still not doing what they need to for patch management. Hackers are more often exploiting client side vulnerabilities and other vulnerabilities associated with 3rd party applications.

4. Careless Employees (Steady Threat)

Careless and untrained insiders will continue to be a very serious threat to organizations in 2010. Insiders can be broken down into three categories: careless & untrained employees, employees that are duped or fall prey to social engineering type attacks, and malicious employees. Protecting a network and critical and sensitive data is done very differently for each type. Policies, procedures, training and a little technology can make a world of difference in reducing an organization’s risk to careless insiders.

5. Mobile Devices (Rising Threat)

Mobile devices have become a plague for information security professionals. There are worms and other malware that specifically target these devices such as the iPhone worm that would steal banking data and enlist these devices in a botnet. Theft is still a major cause of data breaches as mobile devices, especially laptops, are the main culprits. Tens of thousands of laptops are stolen each year and often these have sensitive data that require public disclosure as a data breach.

6. Social Networking (Rising Threat)

Social networking sites such as Facebook, MySpace, Twitter and others have changed the way people communicate with each other, but these sites can pose serious threats to organizations. One main problem is that there is a trust component to these sites which makes them fertile ground for identity thieves. There is also a personal safety issue. Social networking sites are a stalker’s dream come true. Social networking sites are breeding grounds for SPAM, scams, scareware and a host of other attacks and these threats will continue to rise.

7. Social Engineering (Steady Threat)

Social engineering is always a popular tool used by cyber criminals and phishing is still a popular method for doing just that. In fact, these new venues make social engineering even more effective. This year will have an added measure of complexity when it comes to social engineering attacks. Beginning sometime mid-2010, domain names will be expanded to include Japanese, Arabic, Hindi and even Greek characters, and with all of these characters being available for domain names, no longer will looking at a domain help one determine if it’s legitimate or not.

8. Zero-Day Exploits (Rising Threat)

Zero-day exploits are when an attacker can compromise a system based on a known vulnerability but no patch or fix exists, and they have become a very serious threat to information security. Zero-day vulnerabilities are being discovered in traditionally very secure protocols such as SSL and TLS. The zero-day vulnerability could also be in providers.

9. Cloud Computing Security Threats (Rising Threat)

Using cloud based (i.e. Internet based) applications may not be as secure as once thought with many stories in 2009 regarding cloud based security issues. Many are calling for forced encryption to access “in the cloud” services. As cloud computing grows in popularity over the next few years, cloud security will become a very big issue.

10. Cyberespionage (Rising Threat)

Cyberespionage is a threat that’s being heard more and more all the time and there have been a flood of stories in 2009 on this subject. Most of these incidents surround government bodies and agencies and therefore have not been a huge threat to most individual organizations. However, since cyberespionage has major implications for the government, it is a rising threat that must be closely monitored.

“Information security is an ever-evolving discipline that requires tremendous expertise, time, and money to effectively manage. Every organization should take stock of what they are doing today and how well their current solutions mitigate the risk of the top 10 threats. In most cases, adjustments will need to be made and new technology should be implemented to ensure that the organization is properly prepared for what cyber criminals, spammers, phishers and hackers are planning for 2010,” added Prince.

Tags: , , , , , , , ,

Greatest cyber risk driven by remote network access and embedded malicious code: Deloitte Poll

January 7, 2010 · Filed Under Security Software, Software News · Comment 

More than 40 percent of executives polled by Deloitte believe remote internet access to corporate systems, embedded malware in computers, applications and devices, and little visibility into the security protocols of suppliers and business units are the greatest cyber risks today. The executives were polled recently during the Deloitte webcast, “Combating Cyber-Threats from the Underground Economy: A View from the Front Lines.”

“Cyber attacks today are not only about identity theft, but about stealing information behind companies’ firewalls,” said Mark White, principal, Deloitte Consulting LLP and the webcast moderator. “An entire underground economy has been built for the purpose of stealing, packaging, and reselling electronic information. Never before in history has the threat landscape been as deeply penetrated or more rapidly evolving. Never before have nations, corporations or individuals been more electronically exploited.”

Richard Baich, a principal in Deloitte & Touche LLP’s Security & Privacy practice and a webcast presenter, noted that security programs need to be strengthened as it has become increasingly evident that criminals with advanced cyber skills continuously invent new and insidious ways to perpetrate criminal acts. “The cyber crime landscape has evolved into a set of highly specialized criminal products and services that are able to target specific organizations, regions, and customer profiles by using a sophisticated set of malware exploits and anonymization systems, which routinely evade present-day security controls,” said Baich.

Baich also stated that cyber criminals are now able to target specific individuals within an organization, such as a payroll clerk, and misuse that role to steal information for direct monetary gain. Nation-states are also able to recruit and leverage cyber criminal resources to target organizations or other nations for the purposes of espionage, monetary gain, or to gain military advantage.

“This leaves executives asking what they can do to quickly identify and contain malware and then protect their data. This is after they already spent a good deal of money on traditional protection programs,” said Baich. “Companies should consider establishing cyber threat intelligence programs as well as leveraging existing technology and architecture investments to help detect and prevent these problems.”

“Data is more valuable than money. Once money is spent it is gone. Data can be reused and can give you the ability to access online banking applications, use credit cards and penetrate firewalls over and over. A famous bank robber from the 1900s was asked why he robbed banks. He said ‘because that is where the money is.’ Cyber criminals today go to where the data is, because it allows them to access money. Executives need to develop cyber programs to stay ahead of criminals and stop old cat and mouse games,” added Baich.

Other polling results included:
– Only 2.8 percent of the participants indicated they did not need a type of cyber threat intelligence or detection program.
– 62.2 percent of respondents did not know how their organization understands what data is leaving the company’s network, though 14.1 percent did confirm that their organizations were using a data loss prevention solution.
– 41.4 percent reported that they did not know how their organizations found compromised devices inside of their network.
– More than a quarter (27.4 percent) indicated their organizations rely on some type of antivirus and intrusion detection system.

Peter Makohon, senior manager, Deloitte & Touche LLP and a webcast presenter, told participants that “cyber crime may already be in their neighborhoods” and cited the following issues facing executives:

– Current signature-based information security controls are not effective against sophisticated, cyber threats and exploits, which are evolving at a phenomenal rate.
– Companies lack the automated systems and skilled analysts to rapidly analyze, identify, contain, analyze, and remediate compromised devices.
– Information provided by various cyber intelligence sources is often outdated and high level; therefore, companies cannot take effective counter-actions based on that information alone.
– Organizations lack expertise, resources, technology, and process capabilities for taking timely action on these near real-time cyber threats.

To hear the webcast please visit: www.deloitte.com/us/dbriefs/futurete.

The polling responses came from more than 270 technology executives ranging from upper management to consultant across multiple industries responded to the polling questions during Deloitte’s webcast on December 3. The information obtained during the survey was taken “as is” and was not validated or confirmed by Deloitte.

Source: Deloitte

Tags: , , , , , ,

Panda Security publishes Virus Yearbook 2009

January 5, 2010 · Filed Under Security Software, Software News · Comment 

Most intriguing malware selected for use of social engineering and visible effects on PCs

PandaLabs, the anti-malware laboratory of Panda Security, has published its 2009 Virus Yearbook, examining the most intriguing malicious codes to emerge over the last 12 months.

Rather than spotlighting the most widespread viruses, or those that have caused the most infections, PandaLabs has selected those which stood out most for their use of social engineering or visible effects on users’ PCs. For this reason, some of the more well-known malicious codes (such as the Koobface virus) are absent from the list.

Here are the viruses PandaLabs believes deserve a mention:

– Biggest headache. Conficker.C was without a doubt the most obnoxious virus this year. It first appeared on December 31, 2008, and has spent the last year infecting companies and home users alike. The insidious and tenacious nature of this malicious code has earned it first place in Panda’s ranking.
– Harry Potter of viruses. Although there is no reference to the world’s most popular fictional wizard, the on-screen messages Samal.A displays are all about magic. When it infects a computer, users will see the message “Ah ah you didn’t say the magic word” (see photo) and the cursor then flickers, waiting for users to enter a word. The truth is it doesn’t matter what is entered, because after three attempts, the phrase “Samael has come. This the end” (see photo), will be displayed and the computer is restarted.
– V for Vendetta. While it’s still unclear who exactly the real target of this worm is, DirDel.A wreaks vengeance on infected users, progressively replacing folders in different directories with copies of itself. The worm is carried in a file called Vendetta.exe with a typical Windows folder icon (see photo).
– Plain nuisance. The Sinowal.VZR Trojan has infected thousands of computers under the guise of plane tickets supposedly purchased by the user (see photo).
– All-action virus. Once infected with Whizz.A, computers will start emitting a series of beeps, the mouse pointer moves uncontrollably around the screen, and the CD/DVD tray opens and closes, while the screen is ‘decorated’ with a row of bars (see photo).
– Snooper. Waledac.AX ensnares its victims by claiming to offer a free application for reading SMS messages on anyone’s cell phone. Waledac.AX is seemingly ideal for people who want to check up on their partners, explaining why so many users fell victim to this intelligent virus.
– Most affectionate. BckPatcher.C tops this category, as it changes the desktop wallpaper to an image reading “virus kiss 2009″ (see photo). What a charmer!
– Touch of the sniffles. PandaLabs couldn’t fail to mention a couple of the viruses, WinVNC.A and Sinowal.WRN, that used the widespread alarm surrounding swine flu to trick users and infect their systems.
– Incompetent newcomer. The Ransom.K Trojan encrypts documents on infected computers, and then asks for a $100 ransom to release them. However its creator, probably lacking in experience, included a programming error which allows users to release the files with a simple key combination.
– Most deceitful. This year, the winner in this category is FakeWindows.A, which infects users by passing itself off as a license activation process for Windows XP.
– Party animal. Banbra.GMH arrives in an email promising photos of Brazilian parties (with dancing girls included). Who could resist?

More information about these and other threats is available at www.pandasecurity.com.

Tags: , , , , ,

Next Page »