Global Security Newswire
157996
WASHINGTON - US President George W. Bush signed into law today legislation that will enact some of the most far-reaching changes to the US intelligence community in decades (see GSN, Dec. 9).
108829
Recently , Google has released a new service for their search engine, the Google Code Search. It allows for developers to look through and locate items in public source code through the simple Google interface we're all used to. Fortunately, there's also a few security problems the site can help with as well, and Chris Shiflett shares some of these in his latest post.   Stephen de Vries sent an email to SecurityFocus's web application security mailing list earlier today to comment on the new Google Code Search: "Google's code search provides an easy way to find obvious software flaws in open source and example applications."   Chris talks about cross-site scripting problems, issues with the superglobals, SQL injection problems, and even a misplaced trust of the $_SERVER superglobal. Each of the items is linked to is search terms on the Code Search to make it easy to locate.
427228
(InfoWorld) - SAN FRANCISCO -- U.S. companies and the federal government need to step up and fix the problems in their computer networks, the nation's new cybersecurity czar told attendees during his first-ever address atÂ RSA ConferenceÂ here on Thursday. Within the next 10 years, the majority of the world's communication needs will probably be handled by the Internet, said Gregory Garcia, the assistant secretary for cybersecurity and telecommunications at the U.S. Department of Homeland Security (DHS). "This proliferation of applications and devices within the converged network is going to create a breeding ground for security problems," he said. "Our networks and our systems are vulnerable and they are exposed." Garcia outlined two priorities for the year ahead. First, his office is working with federal agencies to adopt common security policies and practices. Second, he plans to work with the private sector to push forward a process called the National Infrastructure Protection Plan. This effort is intended to evaluate computer security risks on an industry-by-industry basis and outline the steps that need to be taken to address them. The broad strokes of this plan were outlined last June, and the DHS is now working with industry to flesh out sector-specific plans, Garcia said. He made it clear that the DHS expects U.S. companies to participate. "There are a lot of plans in Washington. This one is going to stick," he said. "The private sector owns and operates 90 percent of the critical infrastructure, and it's up to you all, not just the DHS, to secure this infrastructure." Companies looking for best practices already have a number of standards they can consider, Garcia said, pointing to the International Organization for Standardization (ISO) 17799 specification and the guidelines prescribed by Technet, an IT industry association. Computer security has not been a top priority at the DHS, which has paid far more attention to physical security threats to the nation since its inception in 2003. And though DHS Secretary Michael Chertoff tried to put a sharper focus on computer security by creating Garcia's high-level post in 2005, the position remained vacant for more than a year. Garcia was introduced Thursday by Art Coviello, president of EMC's RSA group, who said afterward that he was encouraged by the assistant secretary's speech. "It's a combination of carrot and stick," he said in an interview. "Chiding industry to actually comply with these standards that are out there, and a veiled threat of regulation to get things done." Coviello said that cybersecurity has "languished a bit" within DHS ever since U.S. President George W. Bush signed off on his administration's comprehensive cybersecurity plan in 2003. "The Department and Secretary [Tom] Ridge and Secretary Chertoff obviously focused on the right things -- physical threats -- but now it's time to get after the critical infrastructure from the cyber side," Coviello said in the interview. "I don't think industry is looking for a lot of regulation from government," he added. "What they are looking for is leadership."
654323
Governments and businesses face a variety of cybersecurity threats, but they also need to allow for increasing demands from computer users across the globe, the former information security advisor for the U.K. Ministry of Defense said Wednesday.
231724
Its intelligence services are running wild in the U.S. and pilfering technology, according to a new counterintelligence exec on China. Is this the latest Bush fear-mongering? Plus: Bush board backs wiretaps. In 27B Stroke 6.
198319
An undercover investigation led by the U.S. Secret Service has led to the arrests of 28 individuals suspected of being part of a global organized cybercrime network. Charges against the suspects include identity theft, computer fraud, credit-card fraud and conspiracy.
241820
Also: Hackers rig Google to deliver malware. See what people are saying on News.com Extra.
336252
Issue #8 of the (IN)Secure Magazine has been posted today and includes articles like:  Payment Card Industry demystified Computer forensics vs. electronic evidence SSH port forwarding - security from two perspectives, part two Airscanner vulnerability summary: Windows Mobile security software fails the test Introducing the MySQL Sandbox   Check out insecuremag.com for more or just download the issue directly.
358340
(InfoWorld) - The United Nations last week became the latest organization to warn computer users about the dangers of relying on just passwords to protect online bank accounts and e-commerce shopping carts, according to Reuters The warning from the UNâs International Telecommunications Union came a little more than a year after the United Statesâ Federal Financial Institutions Examination Council (FFIEC) released similar guidance calling for stronger user authentication for online banking customers.                                                     Those kinds of warnings are music to the ears of Jon Fisher, CEO of Santa Clara, Calif.-based Bharosa, which sells anti-fraud and multifactor authentication technology to banks, health care companies, and the government. Just three years old and with 50 employees, Bharosaâs been taking on security industry behemoths such as VeriSign and EMC/RSA on their own turf and, in some cases, winning. In the past year, Fisherâs company signed deals with Wells Fargo, National City, and the U.S. Air Force. A serial entrepreneur who sold his first company at age 23, Fisher spoke with InfoWorld Senior News Editor Paul F. Roberts about how the changing regulatory environment has been good for his company. InfoWorld: What is the core intellectual property that Bharosa has? Jon Fisher: We have a proprietary, gated methodology to screen for fraud in real time. The first gate manifests itself pre-log-in via an analysis of a host of data about the user and transaction. The second gate is at the first point of authentication: the user name and password. The third gate is manifest in session where transaction and document requests occur. The fourth gate is a score of third-party data, whether thatâs enterprise, legacy, or other data thatâs fed into our fraud detection engine. IW: What should enterprises know about software like Bharosaâs? JF: Fraud detection has a place not just in achieving FFIEC compliance, but also truly bringing together disparate legacy systems [that] enterprises have had in place for some time. IW: Are you talking about single sign-on, or something else? JF: Single sign-on is an application of that. But fraud detection [can make] a decision about what advanced forms of authentication to use based on the conditions, or what kinds of transactions will manifest in certain ways, like a document request or [bill payment].Â  IW: Arenât authentication and fraud detection ultimately just parts of a bigger architectural change that will tip the scales in favor of vendors who can take care of data security in addition to authentication and storage and the networking piece? JF: Iâve been an entrepreneur for a number of years. I know that if you want to start a company and run a good company, youâve got to do something well. Weâve selected a few things to focus on and do well. Theyâre things that, in aggregate, constitute more than just a point solution. But, yes, certainly less than the array of products in unrelated areas offered by competitors. In terms of how the competition in the space breaks out in the next few years, because of the importance of fraud detection â especially in the enterprise â some very large companies are looking at the space and deciding what their strategy will be. If you have a key product like [Bharosa] fraud detection thatâs embedded deep within some of the worldâs finest enterprises, no matter how much the space matures or develops and no matter what resources competitors have, you still have to work with Bharosa. IW: In the financial services space, how much of this is being driven by FFIEC guidance around single factor authentication? Where do things stand with adoption of FFIEC? JF: There are two answers. As an objective observer, Iâd have to agree that more than 50 percent of U.S. banks will technically not comply with FFIEC-related guidance by the end of the year. However, as a principle at Bharosa, Iâm finding that FFIEC compliance has served as rocket fuel for my relatively young company. Itâs been a key driver in our growth. Weâre very much looking forward to the second phase of FFIEC guidance in 2007. Weâre also looking for the effect this guidance will have on other markets. These mandates for enterprises to update security as a function of time are great environments to work in if youâre a software company.
544569
The latest six-month report on Internet threats shows a staggering breadth and complexity. Symantec Corp.&#39;s Internet Security Threat Report (http://enterprisesecurity .
729820
Scammers and hackers are targeting the human factor in system setups. Part of a series on hot security topics.
26823
Armed guards, not men in tights, for England; more pat-down searches at US airports. Two Russian planes destroyed by passengers carrying explosives on board and a trio of egregious security breaches in the
289303
(InfoWorld) - The Department of Homeland Securityâs Computer Emergency Readiness Team (US-CERT) raised a few eyebrows in late November when it sent a warning out to U.S. banks and financial institutions about a possible cyber attack by Islamic militants. The alert, dated Nov. 30, was triggered by a posting on what the DHS considered an Islamic jihadi Web site calling for hackers to attack U.S. financial and banking Web sites, apparently to protest the detention of Muslims at Guantanamo Bay, Cuba. However, the warning was heavily qualified, with DHS calling the threat âmore aspirational than operational.â Financial firms downplayed the danger, too. One security executive at a major brokerage told InfoWorld that the warning was a ânon-event.â But could repeated warnings about such non-events eventually make critical infrastructure owners deaf to DHSâs warnings? InfoWorld Senior Editor Paul F. Roberts recently chatted with John Carlson, senior director of security and risk Assessment at BITS, a financial-services industry consortium focused on security, fraud, and risk management, about the DHS warning and state of the public-private partnership on cybersecurity. InfoWorld: Iâm guessing that your members received the US-CERT warning about the cyber terrorist attack? John Carlson: There were two messages sent: the first was [Nov. 30]; then a second revision came out [Dec. 1]. The gist of it was that these reports were not corroborated. IW: What was the reaction of BITS members to the warning? JC: Our members have an âall hazardsâ approach to business-continuity planning. Theyâve got well-developed approaches that have been bolstered since 9/11. In response to new regulatory requirements, firms have done a lot to improve backup, theyâve done tests with the various exchanges. Theyâre also working in closer harmony with the federal government to share information on threats and vulnerabilities. I think thereâs a spirit of appreciation that the government is willing to share information with the financial services industry. The firms take that information into account in responding and activating their business continuity plans. IW: How do your members apply information like this that comes from DHS? JC: Iâm not sure I can give a blanket answer. Each firm has its own mechanisms for gathering information. Risk-management professionals at these firms read the paper and understand the military conflicts and theyâre mindful of that. They take it into account when they have employees traveling. Theyâll monitor where they are. With the [bird flu] pandemic issue, firms were monitoring that closely and trying to figure out what impact it would have on their organizations. IW: Is there a danger from these warnings of creating a âBoy Who Cried Wolfâ situation, where firms begin to disregard the warnings? JC: Thereâs always a concern about the crying-wolf syndrome. But our firms appreciate getting the information even if itâs not corroborated. A continuous flow of information helps build trust between the private and public sectors. IW: Was this warning about the jihadist threat something that your members see all the time, or was this an unusual kind of warning from DHS? JC: I think the warning came across the transom at a high level [saying] âpay attention to this.â So it was different from what we normally get. Weâre getting a steady stream of information on threats and vulnerabilities and a range of things. For example, if thereâs a known virus thatâs being perpetrated in [the United States] or against a financial institution. Weâre also getting information on political changes around the world. IW: Do you think DHS has its arms around the cybersecurity problem? JC: My personal opinion is that the government has some capabilities, but not all capabilities. In general, our firms would like more information, but there are many reasons why if (the government) has the information they donât provide it. But itâs a touchy question. People have lots of different views. Â  IW: Do you feel like your members are getting all the information they need? JC: Thereâs some filtering, but I donât have information to compare or validate what the filter is. We talk about issues through coordinating councils that meet quarterly. Itâs a two way conversation.Â
171604
The IBM Global Business Security Index will compile threat information from some 2,700 IBM security professionals and half a million monitored devices so the severity of any threats can be analyzed.
470530
(InfoWorld) - Jihadists now have their own security magazine. "Technical Mujahid," a 64-page electronic magazine began circulating earlier this week on jihadist discussion forums, said Adam Raisman, an analyst with the SITE (Search for International Terrorist Entities) Institute, a terrorist tracking organization. SITE, based in Washington, has published an analysis of the new publication. The magazine is distributed by the al-Fajr Information Center, a group that in the past has distributed jihadist videos, according to SITE. The magazine's editors say their publication comes in response to a call for technical support from Abu Hamza al-Muhajir, who is reportedly al-Qaeda's leader in Iraq. Their purpose is "to help prevent acts of aggression against Muslims [in cyberspace], and to assist the mujahideen in their efforts," according to a translation provided by the Middle East Media Research Institute. "The Internet provides a golden opportunity... for the mujahideen to break the siege placed upon them by the media of the Crusaders and their followers in the Muslim countries, and to use [the Internet] for [the sake of] jihad and the victory of the faith," the translation states. Like early hacking magazines, Technical Mujahid takes information that has already been published in discussion forums and Web sites and compiles it into one single source, Raisman said. It represents an evolution in the jihadist's documentation of computer security information, he added. "It's interesting to see it in a magazine format, where everything is all included." Technical Mujahid's first issue, published Tuesday, contains articles on encryption, video encoding, global positioning systems, and how to use virtual machine technology to conceal files, Raisman said. Future issues will cover topics such as concealing one's identity on the Internet and how to set up a jihadi Web site, he said. Interestingly, Technical Mujahid does not provide technical information on how to conduct online attacks -- a subject that was put front and center in the U.S. this week, when the Department of Homeland Security's United States Computer Emergency Readiness Team (US-CERT) warned that Islamic militants were threatening to attack U.S. financial institutions during the month of December. The magazine shows that militants share many of the same security concerns as many IT professionals, said Marcus Sachs, deputy director with research group SRI International's Computer Science Laboratory. "Western media only covers the story that the jihadists are out to destroy us," he said. "In fact they're just as worried about Internet security in the same way were are." Â
758171
Multifactor authentication is all the rage these days, thanks to increasingly sophisticated trojans and phishing attacks and even rootkits aimed at stealing passwords and sensitive data. High-stakes online crime has even spurred financial services companies and some enterprises to consider new, "risk-based authentication" solutions, which examine behavioral patterns and session characteristics to identify rogue users.ADVERTISEMENTIBM Information On Demand 2006Industrial Industry Leaders, please join us at IBM's premier information management global event, IBM Information On Demand 2006, October 15-20, Anaheim, CA. More IBM business and technical solutions content in one place than ever before! Select from  over 800 sessions. Register today!
262991
Also: Electronic devices seized at border searches. See what people are saying on News.com Extra.