Appetites for more government actions

Archive for the ‘News’ Category

Appetites for more government actions

Posted by Wolf Goerlich

SC Magazine: Appetites for more government actions

J Wolfgang Goerlich, cybersecurity strategist with CBI, a Troy, Mich.-based firm that manages IT security risk to help ensure data is secure, compliant and available, explains that InfraGard, a partnership between the FBI and organizations deemed to be critical infrastructure (such as those in energy, finance and transportation), has been sharing criminal information between the public-private sectors since 1996. Similarly, these organizations have been handicapped over the years due to limitations on their information-sharing abilities and those same concerns for potential liability. Information Sharing and Analysis Centers (ISACs) have been sharing sector-specific information on attacks and threats since 1999. Eighteen different ISACs currently serve sectors ranging from health care to financial services. “An open question is how the proposed ISAOs will complement and coordinate with the existing ISACs,” notes Goerlich.

Yet another initiative, a NIST Cybersecurity Framework, was previously launched after President Obama’s 2013 executive order. It provides guidance on the controls and practices that organizations can implement to improve their security posture. “The functions of the framework include ‘Identify’ and ‘Detect,’ which will both be bolstered by better information sharing of threat indicators and criminal tactics proposed by this year’s executive order,” says Goerlich.

Read the rest at: www.scmagazine.com/appetites-for-more-government-actions/article/438193/

Developers find themselves in hackers’ crosshairs

Posted by Wolf Goerlich

CSO: Developers find themselves in hackers’ crosshairs

Attackers have long targeted application vulnerabilities in order to breach systems and steal data, but recently they’ve been skipping a step and going directly after the tools developers use to actually build those applications.

Strategist with IT risk management firm CBI, J. Wolfgang Goerlich, explains why the recent spate of attacks on Apple’s development tools are notable. “The number of OS X computers continues to raise in the enterprise environment. Few organizations are considering Macs from a security perspective as the numbers have long been small and most security controls are Windows-based,” he says.

“These types of attacks – infecting the compiler – used to be considered a potential threat by high security governmental organizations. You would be considered paranoid to present such a scenario as something that could impact the general public. And yet here we are,” says Yossi Naar, co-founder of Cybereason, a provider of breach detection software.

If these types of two-stage attacks are no longer threats only to the paranoid, and enterprise development environments are targeted, what does this mean for enterprises trying to ensure they are developing and deploying secure applications.

“From a development perspective, the best practices in continuous integration and deployment would have prevented the attack against Apple’s App Store,” says Goerlich.

Read the rest at http://www.csoonline.com/article/2987237/application-security/developers-find-themselves-in-hackers-crosshairs.html

BSides: Broadening the Horizons of Information Security

Posted by Wolf Goerlich

Posted on TripWire: BSides: Broadening the Horizons of Information Security

With access to further reaches of the security community, new ideas and research are never far behind.

“The folks who attend these conferences tend to be geared towards learning something new,” reflects Irfahn Khimji, senior information security engineer at Tripwire. “As a result, they always ask great questions.”

J Wolfgang Goerlich, strategist with CBI and an organizer of BSides Detroit, shares Irfahn’s thoughts on BSides’ learning potential: “The movement has become a staple of the security industry. It has made it easier than ever for the local communities to come together, share and commiserate, and learn what is working and what is coming next. BSides also provides a platform for new speakers and new content, filling a vital role in developing talent.”

Mentorships, new people, and new ideas–that is just some of what BSides has to offer.

Read the full article at http://www.tripwire.com/state-of-security/featured/bsides-broadening-the-horizons-of-information-security/

 

Starbucks gift card fraud

Posted by Wolf Goerlich

Starbucks is in the news as criminals abuse its online services through fraudulent gift card purchases. On the surface, the issue appears to be about consumers’ passwords and the poor practices around their use. There is more to the story, however, and I would argue two deeper concerns are the real issue. The first is in how emerging payment systems are monitored and secured. The second is in how online services are developed and maintained.

The Starbucks security hole is simple enough. The criminal breaks into the coffee-loving victim’s account by guessing their password or using the password reset features. They then load a Starbucks gift card using the victim’s stored payment information, and transfer that card to themselves. This is usually automated so that several gift cards can be filled and stolen in a short period of time. The attack normally ends only when the victim receives notices on the gift cards and resets their Starbucks password.

Starbucks reportedly processed $2 billion in mobile payments last year. That’s a serious amount of business that requires a re-adjustment of their risk appetite to reflect the target their business has become. Moreover, as retailers and emerging payment systems develop bank-like functionality (funds transfer, cards), they need to start thinking more like banks. Anti-fraud techniques such as behavior monitoring for unusual activity is a prime example. Another is offering consumer protections such as reimbursements (at this point, Starbucks defers consumers to work with PayPal or their credit card company.) When transactions are into the billions, it’s time for mobile payments to offer credit card equivalent security for consumers.

The other aspect of consumer protection is the online service itself. In , threat modeling is one of the first steps. The goal is to look at the functionality being developed and to identify ways it could be abused. With this in mind, security and privacy requirements can be defined. After Starbucks built their services, they could have performed scenario-based penetration tests to ensure the controls met the requirements, and the requirements prevent the threat. Given that gift card fraud is well known and that the controls in place are lacking, it’s clear that Starbucks did not complete these steps as part of their development program.

In summary, yes, consumers need to watch their password hygiene and monitor their accounts. But there’s more to the story. As companies build online services that handle billions in payments, they must mature their processes in handling fraud and building applications. We need credit card equivalent security for transactions. Developers need a secure development lifecycle for preventing their services from being abused. Starbucks is today’s example of organizations falling short on both areas, and leaving the consumers with the tab.

Cross posted from: http://content.cbihome.com/blog/starbucks_giftcard_fraud

Private Cloud ROI

Posted by Wolf Goerlich

When and how does private cloud computing pay for itself? What is the return? I recently spoke with Pam Baker (@bakercom1) about this topic. Check out Pam’s article in The IT Pro: Cloud ROI: How much and how soon?

Now mixing and matching appeals to me. A team should adopt a strategy and a toolset that enables managing compute resources on-premise and at utilities. The private or public option then comes down to economics, performance, and security. The security component can be a driving factor for economics, too.

Pam quotes a telling statistic from the Aberdeen Group: “companies using private clouds eliminate 38 percent of security and compliance costs as compared to public cloud users. Further, public cloud users experience 25 percent more problems with hacking, data loss, and audit deficiencies.” In other words, organizations are not going full public any time soon, and for good reason.

Read the full article: http://www.theitpro.com/author.asp?section_id=2006&doc_id=242050

This post is an excerpt from a press article. To see other media mentions and press coverage, click to view the Media page or the News category.