STE WILLIAMS

Businesses are more vulnerable than they need to be. Here’s what you should do about it.

Despite constant headlines about cyber attacks, organizations continue to leave their systems and data unnecessarily vulnerable. Cyber incidents result in the loss of reputation, enterprise value, and jobs, not to mention regulatory fines and civil litigation. According to Kaspersky Labs and the Ponemon Institute, 90% of businesses have experienced a cyber attack, with an average cost per breach of $3.6 million. Ponemon estimates that 27.7% of organizations surveyed will likely suffer another material breach within the next two years.  

Although eliminating all cyber incidents is impossible, a “unified governance” approach that combines security with data management and information governance (IG) can help create a business culture that promotes a strong defense. Here are 10 steps you can follow to create a culture of cybersecurity.

1. Bring everyone to the table.
Senior executive engagement is essential. Include your information technology, information security, legal, knowledge management, compliance, privacy, finance, communications, and human resources teams. A lack of participation equals a lack of investment and cooperation required to sustain the effort.

2. Avoid contributing to your own victimization.
Invest in the required technology, training, and business processes to avoid greater long-term costs related to incident response, remediation, fines, lawsuits, and losses to reputation, business, and enterprise value. Be transparent after a breach, and report it to law enforcement. Fear of the consequences causes inaction and exacerbates the harm associated with cyber incidents.

3. Eschew a compliance-only mentality.
Compliance is essential but insufficient to mitigate cyber-risk and improve incident response. Cybersecurity compliance is really about preventing victimization, not internal wrongdoing. 

4. Employ Information Governance best practices.
You cannot protect the unknown. To protect data — and successfully manage a breach — you must identify your data, its location, its value, users with access, and applicable legal obligations. Doing so enables you to ensure legal compliance, while deleting data that you don’t need. “Defensible disposal” makes it easier to identify and protect what’s really valuable. IG best practices have been codified in the latest Information Governance Process Maturity Model (IGPMM), developed by the Compliance, Governance and Oversight Counsel (CGOC), and the Information Governance Reference Model (IGRM) Guide. IG is a journey of continual maturation, not an all-or-nothing proposition.

5. Utilize information resources.
Plenty of resources exist for learning more about cybersecurity and improving your risk profile. You can participate in cyber outreach and information sharing programs sponsored by the FBI, U.S. Secret Service, Department of Homeland Security, and state and local governments, and you can join industry groups, including ISACs and ISAOs. 

6. Counter the insider threat.
Too many companies create perfunctory insider threat programs that employees sleep through or easily circumvent. Insider threats — whether intentional (for example, employees stealing sensitive information or damaging systems) or not (employees clicking on bad links or attachments)— should be a top concern for executives and an essential part of employee training. Employee training, though, doesn’t ensure security. The realistic goal of training is to reduce, not eliminate, cyber-risk. 

7. Manage the third-party threat.
Your company is now part of a global chain of technologically interdependent computer users. Sensitive data is constantly on the move, and any computer can be used to exploit others to which it connects. Your contracts therefore must include all rights and obligations related to handling and securing sensitive information, as well as cooperating in cyber incident response. Technology solutions can now support this.

8. Control your endpoints.
You can protect your sensitive data only if you control the devices that access it. You must be able to manage all devices that connect to your network or access sensitive data. This includes laptops; tablets; mobile, wearable, and Internet of Things devices; portable storage media; and cloud accounts. You must control the types of devices and applications used, the data accessed, and who can access what. Mobile device management solutions allow you to remotely locate, monitor, and delete sensitive data.

9. Adopt the latest security best practices.
Cybersecurity best practices (such as multifactor authentication, encryption, and network segmentation) and tools (such as antivirus, anti-spam, anti-phishing, data loss prevention, intrusion detection/prevention software) are essential. Using them without proper IG practices, though, will leave gaping vulnerabilities in place.

10. Never assume that cybersecurity incidents are over.
Assuming that a cyber incident is isolated or “over” once remediation has begun is dangerous. What was the initial attack vector? What was compromised? Have all vulnerabilities been locked down? Are the attackers still in the network? Who attacked you and why? What other attacks may have been or might be launched? How does the incident fit into your cybersecurity history and profile? Forensic investigations must be thorough, objective, and conducted under legal privilege. The investigation of external attacks should include external incident responders. Poor investigations result in greater technical, reputational, and legal harm when the next incident occurs.

Related Content:

• Best of Black Hat: 20 Epic Talks in 20 Years
• SIEM Training Needs a Better Focus on the Human Factor
• Dealing with Due Diligence

Edward J. McAndrew is a partner and co-chair of the Privacy and Data Security Group at Ballard Spahr LLP. He previously served for nearly a decade as a federal cybercrime prosecutor in Washington, DC, Northern Virginia and Delaware. His work spanned every major area of … View Full Bio

Article source: https://www.darkreading.com/vulnerabilities---threats/10-critical-steps-to-create-a-culture-of-cybersecurity/a/d-id/1329418?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Respondents to a global survey say Internet of Things security is a shared responsibility between consumers and manufacturers.

While 90% of consumers across six different countries expect security to be built into their Internet of Things devices, the question about who should be responsible for implementing IoT security is divided, according to a survey released today by Irdeto.

The Irdeto Global Consumer IoT Security Survey, which queried 7,882 consumers in the US, Brazil, China, Germany, India, and the UK, reports that 15% of respondents believe consumers are responsible for implementing the security, while 20% say manufacturers should play that role. Overall, however, 56% believe it is the responsibility of both the consumer and manufacturer.

“While consumers across the globe believe that IoT devices need to have security manufactured into the product in order to prevent against cyberattacks, it’s encouraging that they also recognize the important role they play in IoT security,” says Mark Hearn, director of IoT security at Irdeto, in a statement.

The survey reports that 89% of respondents have at least one connected device in their home and of this group 81% have more than one IoT device. Among the six countries included in the survey, India has the most IoT users with 97% of residents having at least one IoT device in their home. The US has the fewest, with only 80%. 

Read more about the survey here. 

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/vulnerabilities---threats/majority-of-consumers-believe-iot-needs-security-built-in/d/d-id/1329459?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Gift cards’ lousy security makes it easy for crooks to spend marks’ money, researchers said Tuesday night.

During their presentation at the BSides conference in Las Vegas, William Caput and Sam Reinthaler used an $80 card reader and writer, and some tech savvy, to demonstrate just how easy it is for miscreants to get access to a victim’s dosh. To make matters worse, a lot of retailers don’t think there’s a problem.

“For about half of the card industry, which uses a single manufacturer, there was an ‘oh shit’ moment,” Caput told The Register. “The response from some was ignore it until you make the research public and then they change it.”

The vulnerabilities stem from just really stinky security. The vast majority of cards use a 16-digit card number, however, the first twelve digits are a strict arithmetical progression. Only the last four are randomized. In other words, you can work out other card numbers by incrementing or decrementing the non-random part, and correctly guessing the random digits to form a stranger’s card number. You can use the Burp Intruder tool to generate valid card numbers by brute force, and then find out which of those have money in them.

Anyone can grab a handful of unloaded gift cards from stores, Caput explained, and then back-count the numbers to find valid cards with money on them, because people who have already taken the cards have probably loaded them up with cash. You can go online with a card number to check its balance.

The team used their MSR606 magnetic card reader-writer, bought on Amazon for $80 (£61), to reprogram blank cards with new numbers, effectively cloning valid cards so they can be used to buy stuff.

The dynamic duo spent two years gathering their research and have held off on revealing it until the security holes were fixed. Now many retailers have added security measures, such as four or five-digit PINs or a CAPTCHA system to kill brute force attacks.

The majority of cards are now safe, we’re told, because a single manufacturer that makes nearly half of the cards in circulation has added protections, thus securing a huge swarth of them. Still, that leaves plenty of plastic vulnerable. For example, one cinema chain, and a casino player club card, still haven’t taken action, we’re told.

The credit card companies are wise to this game of cloning, Caput said. But gift card companies aren’t so smart. He opined that the lack of action was down to companies being willing to write off a certain amount of fraud as the cost of doing business. That’s cold comfort for folks ending up having to jump through hoops to get their money back. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2017/07/26/gift_card_security_fraud/

For the past year or so, protesters in North Dakota, America, have been trying to prevent an oil pipeline from being built through Native Americans’ sacred land.

As a result, they’ve gone through an astonishing level of electronic surveillance while there, it is claimed.

For instance, fake cellphone towers were used to listen in on personal conversations, draining batteries in the process, leaders of the protest told the BSides security conference in Las Vegas on Tuesday. The protesters also said they saw drones shot down, and had their phone signals jammed and handhelds hacked.

The demonstrations ended in February, after folks either left or were cuffed and taken away, allowing the Dakota Access Pipeline to be built and activated by June.

“These lands were supposed to be protected by treaties,” Myron Dewey, who runs the Digital Smoke Signals website that followed events at the Standing Rock Indian Reservation, told The Register last night. “They weren’t, that’s why we call the US government forked tongues.”

The Standing Rock protests took place in a remote section of North Dakota, where an oil pipeline was being laid through tribal lands. It was feared the line would contaminate the area’s drinking water.

Those who showed up to oppose the construction quickly found that electronic countermeasures were being used both overtly and covertly.

For example, a yellow helicopter spent hours flying over the protesters’ encampments, along with numerous small aircraft that the demo organizers believe were being used in a similar way to airborne cellphone tracking systems already in use by the Feds over the US.

Hijacked

Fake cellphone towers were also set up to monitor transmissions, the protesters claim. These only connected to a limited number of phones, Dewey said, and imitated the signals sent out by legitimate telcos. Unbelievably, the spy masts were able to take over and control handsets automatically over the air, it is alleged. This suggests software or firmware on the devices were compromised wirelessly – not impossible given the exploitable bugs in today’s handsets.

“I had my iPhone turn on remotely and start transcribing my conversations and texting them out,” Dewey said. “This was quite obvious, and didn’t require any interaction on my part.”

Lisha Sterling, executive director of Geeks Without Bounds, shed some more light on this. When arriving at the camp she set her phone into airplane mode to preserve battery life, but found her phone was discharged within hours. She also claimed four smartphones had been pwned remotely during her time at the protests.

Protesters saw equipment from three national security agencies on site, it is claimed, as well as from private security company TigerSwan, which was also involved and is facing lawsuits for its use of physical and electronic security in the area.

Eight hundred fourteen people were arrested at the site, Dewey said, however none have since been charged. He opined that the protests were a training ground for future electronic surveillance techniques that could be used if protests break out again. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2017/07/26/standing_rock_protester_surveillance/

Chinese police have moved on the developers of the Fireball adware that infected millions of computers earlier this year.

Fireball was described by Check Point in June after outbreaks in India, Mexico and Brazil. It bundled itself with legitimate software, and used browser plug-ins to boost its own advertisements.

At the time, Check Point named a Chinese digital marketing agency called Rafotech as author of Fireball.

Chinese outlets are now reporting eleven arrests by Beijing police, all of them Rafotech employees. Chongqing Morning News says three of those arrested were the company’s president, technical director, and operations director.

In an English-language summary of the local reports, state-owned outlet “Sixth Tone” says the click-fraud netted 80 million yaun, nearly US$12 million.

Although reports of the arrests have emerged in the last few days, Sixth Tone says the arrests took place in June shortly after Check Point published its advisory.

Fireball infection flow [source: Check Point blog post]. Click here to embiggen.

This report (after Google Translate) says police were tipped off by someone working under the pseudonym Zhang Ming, and that the Beijing Public Security Bureau Network Security Corps allowed Fireball to run for long enough that they could analyse its behaviour.

The perps have allegedly “admitted the facts” of their adware, which was first conceived around 2015, and that Rafotech was setup to develop and exploit the advertising fraud.

According to Beijing Youth Daily, Fireball was designed to avoid infecting Chinese computers, in an attempt to avoid breaking domestic laws. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2017/07/26/beijing_police_hot_on_fireball_fraudware_trail/

DEF CON Businesses in Las Vegas are locking down their systems as hackers fly into the fetid hell of Sin City for a trio of security conferences.

This week the BSides conference, Black Hat, and DEF CON are all in town and folks here are worried that their computers are going to be thoroughly subverted by visiting miscreants. Caesars Palace, the new home of DEF CON, has already closed its business center in case hackers take control of its networks.

Spotted in the business centre at Caesars pic.twitter.com/N2HjwS6Og1

— christopherneal (@christopherneal) July 24, 2017

The irony is that a few years ago, hackers at Black Hat discovered an ATM that was skimming people’s bank cards using a false front attack. The unwitting victims slotted in their cards, had their PINs harvested, and lost a lot of cash.

Some gleeful hackers thought that someone at the conference had set this up, but instead it was a machine that had been in the casino before the show commenced. It had just been spotted by the infosec pros, and was quickly removed.

Caesars isn’t the only organization locking down its systems. UPS also put up a warning, but it’s clear that it doesn’t get this whole security thing.

holy shit @defcon @TheUPSStore does not know how this works at all lol pic.twitter.com/lOJLD59eFP

— 𝓛𝓾𝓬𝓴𝔂225🍀 (@lucky225) July 25, 2017

Really. You’re accepting attachments but not USB sticks? We can understand the thought processes involved here, but the biz really needs some top-level security advice. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2017/07/25/def_con_hacking_conference/

At Black Hat 2017, a university researcher will demo how attackers can drill into networked printers by way of the ubiquitous PostScript programming language.

Network printer exploits are like old dogs learning new tricks, according to a security researcher with Ruhr University.

In his upcoming Black Hat presentation, Exploiting Network Printers, Jens Muller, Ruhr University chair for network and data security will delve into an analysis of printer attacks, in which he discovered 20 printer models were all vulnerable to at least one of the same attacks that he tested. Muller will also disclose unusual ways the Internet is enabling network printer attacks via advanced cross-site printing techniques.

The vulnerability, Muller says, stems from the 35-year-old PostScript programming language, which has connected printers to end-users for decades, even as technology evolved from the parallel printer cable, to the USB stick, to networked printers, and today to the cloud.

“Before, printers used parallel cables and having PostScript wasn’t a problem.” Muller says. “But now, the printer manufacturers are still using PostScript and they can easily be exploited remotely.”

PostScript: An Industry Standard 

The PostScript programming language is an industry standard for network printers and its use is ubiquitous. But despite attackers ability to exploit this language, printer manufacturers have largely looked the other way, he says. Instead, manufacturers put the onus on network administrators to place the printers inside the network, where the devices are presumed to be protected from outside threats.

Even today, he notes, manufacturers do not seem to realize that attackers can drill into networked printers by way of the Internet.

On the networking side, network administrators tend to view their connected printers as nothing more than a printing device, as opposed to a potential vector of attack, he says, noting that the end result is that network admins may not think it’s important to secure network printers.

Some of the attacks Muller has tested include a denial of service attack that damaged eight of the 20 printers he was testing. One new issue to emerge is the ability to set a printer back to its factory defaults by taking control of the printer remotely. Other printer attacks range from stealing print jobs containing sensitive information to pilfering system files.

Work Arounds

One potential solution to the problem, Muller says, is to corral all the connected printers and put them on a separate network with a print server. The downside: it would require a network administrator to oversee two networks, which, he says, could be difficult for midsized companies and result in the additional costs of installing and monitoring a second firewall.

“What CISOs should really do is ask themselves do they really need a device connected,” Muller says. “It may make sense not to connect the printer to the cloud.”

Related Content:

• Why Printers Still Pose a Security Threat
• Printers, Routers And Other Internet Devices Being Hijacked To Participate In DrDoS Cyber Attacks
• HP Disputes Printer Security Vulnerabilities
• 7 Hardware Firmware Hacks Highlighted at Black Hat 2017

Dawn Kawamoto is an Associate Editor for Dark Reading, where she covers cybersecurity news and trends. She is an award-winning journalist who has written and edited technology, management, leadership, career, finance, and innovation stories for such publications as CNET’s … View Full Bio

Article source: https://www.darkreading.com/vulnerabilities---threats/how-postcript-exploits-networked-printers/d/d-id/1329464?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Despite being only moderately skilled, CopyKittens has exfiltrated large volumes of data since at least 2013.

It doesn’t always take a highly skilled adversary to create major problems for organizations. Sometimes, unsophisticated but persistent threat actors can be just as effective at it.

One example is CopyKittens, a cyber espionage group with links to Iran that has been operating since at least 2013. The group, profiled in a report this week from Israel-based ClearSky Cyber Security and Trend Micro, so far has displayed little of the sophistication associated with many modern state-sponsored cyber espionage operations.

Yet, it has successfully managed to exfiltrate large volumes of data from targeted military and government organizations, academic institutions, municipal authorities and IT companies in Israel, Turkey, Saudi Arabia, Jordan, and the United States.

In the years it has been around, the group has used dozens of domains, many of them impersonating companies such as Microsoft, Google, Amazon, Facebook, and Oracle, for malware delivery, hosting malicious sites, and for command-and-control.

Despite its apparently limited resources, the group has also managed to breach several online news media outlets and general websites, which were then used in watering hole attacks.

“They are in the lower bar of cyber espionage groups,” says Eyal Sela, head of threat intelligence at ClearSky. “They don’t use 0-days and their self-developed tools are inferior in many aspects to those of others.”

The group’s tactics, techniques and procedures (TTPs) in general have been unremarkable and have included common approaches such as malicious email attachments, phishing, web application attacks, and, starting only late 2016, a few watering hole exploits.

Their continued success highlights how a persistent but relatively unadvanced threat actor can still succeed and reach their objectives, Sela says. “Organizations in sectors and countries of interest to Iran are at risk of being targeted,” and should make it a point to understand the group’s TTPs he cautions.

For example, CopyKittens has a tendency to try and breach an organization’s network via weaknesses in the IT supply chain. It also has a tendency to do a lot of DNS-based data exfiltration and command-and-control so organizations that believe they could be targets should monitor their DNS infrastructure. Similarly, social media channels—such as fake Facebook profiles—have often been used to get close to and breach target organizations, Sela said.

This week’s report on CopyKittens marks the third time that ClearSky has published an analysis of the threat group. The new report includes some fresh details on the group’s activities, details on newly developed malware and a list of tens of new domains that are currently up and running and being used by CopyKittens for malware delivery and attacks.

Among the newly developed malware samples described in the Clear Sky and Trend Micro report this week is a .NET backdoor that provides attackers with a way to download and execute malware on a target system, and a tool that enables lateral movement in a compromised network using stolen credentials. AV tools in VirusTotal did not detect several of the new tools developed by the group.

Many of the tools that the group has used to exploit networks have legitimate purposes. For example, CopyKittens often has used a trial version of a commercial software tool called Cobalt Strike to search for and penetrate vulnerabilities in target networks. Other similar tools that it has used include Metasploit, Mimikatz, and software like Havij for detecting vulnerable web servers.

“It seems that their objective is to gather as much information and data from target organizations as possible,” Sela says. “They indiscriminately exfiltrate large amounts of documents, spreadsheets, files containing personal data, configuration files, and, databases.”

The sheer scope and duration of the campaign suggests that CopyKittens is a nation-state sponsored group, he says. The fact that the threat actor does not appear motivated by financial gain, and its multiple ties to Iran and Iranian interests suggest strong nation-state support, he added.

Related content:

• Iranian Hackers Believed Behind Massive Attacks on Israeli Targets
• Iran Intensifies Its Cyberattack Activity
• Saudi Arabia Issues Alert On Shamoon 2
• 8 Hot Hacking Tools to Come out of Black Hat USA

 

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year … View Full Bio

Article source: https://www.darkreading.com/vulnerabilities---threats/iranian-cyber-espionage-group-copykittens-successful-but-not-skilled/d/d-id/1329466?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

US government cybersecurity apparently doesn’t include email security.

High-profile declarations and executive orders from both former US President Barack Obama and his successor, President Donald Trump, list cybersecurity is a “top priority”. But that hasn’t yet been applied to one of the biggest, most vulnerable attack surfaces in any organization.

A recent open letter from Sen. Ron Wyden (D-Ore.) to the Department of Homeland Security (DHS) notes that most federal departments aren’t using an email security protocol that has been around for the past five years.

Wyden, in a July 18 letter, asked the agency to “take immediate steps” to mandate that all federal agencies implement DMARC (Domain-based Message Authentication, Reporting and Conformance), an email authentication, policy, and reporting protocol launched in 2012 that helps prevent email domain spoofing.

This wasn’t his first request. In an earlier letter this past April to the commissioner of the Internal Revenue Service (IRS), Wyden complained that the agency had only partially enabled DMARC – to protect itself, but not taxpayers.

The IRS, he wrote had configured DMARC, “in a less restrictive mode. As a result, the IRS receives automatic alerts when the organization is impersonated by fraudsters, but unsuspecting taxpayers are not warned or automatically protected.”

According to Wyden, the only federal agencies so far that have enabled it are the National Institute for Standards and Technology (NIST), the Federal Trade Commission (FTC), Federal Deposit Insurance Corporation (FDIC) and Social Security Administration (SSA).

Industry standard technologies exist, and are already used throughout the private sector and even by a few federal agencies, which, if enabled, would make it significantly harder for fraudsters and foreign governments to impersonate federal agencies.”

Wyden went on to add that it would, “prevent fraudsters from being able to send emails that purport to come from .gov domains”.

“Prevent” might be promising too much. While the launch of DMARC had the backing of internet giants like Google, Microsoft, PayPal, Facebook, LinkedIn and Comcast, and generated breathless headlines about the elimination of phishing emails, that obviously has not happened – something Naked Security’s Paul Ducklin predicted at the time.

But, if used as instructed, which requires it to be built on a foundation of “the basics” – email security tools DomainKeys Identified Mail (DKIM) and the Sender Policy Framework (SPF) – DMARC does indeed making spoofing emails “significantly harder”.

As Naked Security’s John Dunn put it recently:

For the first time, organisations using DKIM and SPF could add a policy to their DNS records that told others how to treat email failing their security criteria. Importantly, it provided a feedback mechanism for recipients to tell senders what was being received in their name, essential for domain owners that wanted to gain intelligence on email spoofing.

And while the phishing industry is endlessly adaptable – Dunn also wrote that “phishing criminals have evolved to exploit a broader set of weaknesses in email, especially mobile clients” – the evidence strongly suggests that DMARC would keep government email systems out of the “low-hanging fruit” category.

Wyden’s letter noted that since last year, when the UK required all government agencies to enable DMARC, the nation’s tax agency said, “it reduced the number of phishing emails purporting to come from that agency by a staggering 300 million messages in one year.”

And Brett McDowell, executive director of the FIDO Alliance and founding chairman of DMARC, said while the threat of phishing remains, when DMARC is implemented by both the sender and receiver, “it is 100% effective in shutting down the most dangerous vector” – the spoofing of domains.

“Finally, in the history of email, it’s a way to look at the address to see if it’s a legitimate domain – is it coming from [a company like] PayPal or not. It’s a huge enabler,” he said, adding that when properly implemented it is friction-free: “The user never sees it – never has to deal with it. Every domain you protect, you can block them all.”

He said the full implementation of DMARC by the Internal Revenue Service could prevent millions of bogus emails purporting to come from the agency around tax time.

In a 2013 tweet following news stories about it, he said, “Part of the reason bogus IRS e-mail continues […] is because the agency has not yet adopted […] DMARC.”

Wyden is not the first to urge adoption of DMARC. NIST did so last September, in its Special Publication 800-177 titled “Trustworthy Email”

All of which raises the obvious question: why hasn’t this been in place across government agencies at all levels – not just federal – for several years?

Wyden’s office did not respond to requests for comment. But McDowell said while he has been shocked that the federal government hadn’t adopted DMARC years ago, and remains, “surprised that it took an elected official” to prod departments like DHS to mandate it, he is glad the matter is getting some attention.

“Hey, whatever it takes,” he said. “If things get more secure as a result, that’s what matters.”

Follow @NakedSecurity
Follow @tarmerding2

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/dghiFDGuCOw/

The Swedish prime minister has admitted that the leak of the confidential data of millions of Swedes as a result of the country’s transport agency outsourcing operations to third party contractors is “a disaster”.

Speaking in Stockholm on Monday, Stefan Löfven (pictured) also confirmed that he had known about the leak since January, with other ministers being aware of it as long as 18 months ago, the FT reported.

Swedish media have reported that the leaked data includes defence plans and details of witness protection schemes – which a  large number of foreign nationals had unencumbered access to while the Swedish transport agency began outsourcing its operations. The Swedes expect to fix the problem – but  not completely until sometime in the fall.

What’s the backstory?

Back in 2015, the Swedish Transport Agency, which regulates everything from civil aviation to driving licenses,  crafted a SEK 800M ($98M) contract  – one of the largest IT contracts in Swedish history – to outsource database and IT service management. That contract was won by IBM Sweden, which in turn outsourced the operations to countries in eastern Europe, with the result that “foreign staff had responsibility for Swedish classified information”.

It seems that as the data was uploaded to the cloud servers, it was available to people outside Sweden who didn’t have security clearance.

To make matters worse, it seems that the transport agency’s director-general, Maria Ågren, had “decided to abstain” from the National Security Act, the Personal Data Act and the Publicity and Privacy Act when overseeing the outsourcing project, according to a statement from the agency.

What’s do we know about what’s been exposed?

The agency has information on all vehicles in Sweden, including some, but not all military vehicles. It also is the depository for the nation’s driver’s license data, including photos – which also happens to include individuals under protective order, and those of undercover law enforcement workers.  Additionally, the nation’s infrastructure data with respect to roads, ports, air, rail, etc., is under its sway

In an opinion piece, Swedish television’s Oskar Jönsson notes that the police have confirmed that the information “disclosed could be used by foreign powers to identify military and police facilities”. Furthermore, it is described as tantamount to giving someone “the keys to the Kingdom of Sweden”. Jönsson also confirms he has the 248-page investigatory report, which appeared in his mailbox a few weeks ago.

What access do the foreign nationals have to the Swedish databases?

According to the police, the employees in the Czech Republic had (for a period) greater access to the transport agency’s servers than the transport agency itself had. They controlled the servers (in the cloud) from the Czech Republic.

Why should we care?

Other nations have an interest in personal information and national infrastructure information. According to SAPO (Swedish Security Service) in its 2016 Annual Report, the services works diligently to avoid having any individual, be they an agent of a foreign power or one operating in a grossly negligent manner, expose national information of a secret nature to any unauthorized person.

Furthermore, the security service chairs the National Collaboration for the Protection against serious IT Threats (NIST) which works with the military and defense signals departments to thwart the efforts from an “attacker to access or damage Swedish civilian and military resources”.

The SAPO annual report also details how nation states will target Sweden and its citizens for information on technology, infrastructure and personnel. Chief information security officer at the Internet Foundation in Sweden, Ann-Marie Eklund Löwinder, is quoted by Swedish TV (loosely translated)

It’s not that other states do not take our information. This type of information has always been of interest to intelligence. This is almost like we published the information publicly.

Furthermore, the transport agency has access to the European Union’s STESTA (secure network) and the Secure Government Swedish Intranet (SGSI), and this access could have been exposed to non-authorized contractors working on the project.

Is this the first time the transport agency has had an event that leaked sensitive information? Sadly no, in March 2016 (in the midst of this data transition) the agency sent out the mailing list of all cars and their owners, including people with “protected identities”. Upon realizing the error, they then compiled a list of these individuals and sent that refined (and sensitive list) to those who had received the initial mailing and asked the recipients to remove the vehicles identified from the original mailing list.

What’s happened?

The timeline as provided by Swedish Television is as follows:

2015 – The transport agency outsources its automotive/license registration to IBM. The effort includes more than 1,000 servers, data centers and support.

June 2015 – Sweden’s security service checks on the transfer of IT operations and notes that IBM has placed operations in Serbia and the Czech Republic

November 2015 – Sweden’s security service calls for an end to the outsourcing.

January 2016  – Its calls ignored, the security service begins a “preliminary investigation into negligence with secret information”

January 2017 – Transport agency director-general Maria Ågren is fired

July 6 2017 – Ågren is convicted of mishandling the information and fined SEK 70,000 ($8,500).

July 6 2017 – Prime minister Stefan Löfven confirms that the transport agency has exposed government databases to unauthorized foreign entities and that Ågren signed the authorization

Speaking to journalists on Monday, Löfven said that “what happened in the transport agency is a disaster. It is extremely serious. It has exposed both Sweden and Swedish citizens to risks.” He added that he continued to have full faith in his ministers – but opposition parties were reported to be considering a vote of no confidence.

To be clear, there’s no suggestion that IBM Sweden is in the wrong – and IBM has declined to comment on the row.

This is one which we will continue to follow.

Follow @NakedSecurity
Follow @burgessct

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/Zp9R8qcDfds/