STE WILLIAMS

Master list of DNS terminology

Target today claimed malware infected its cash registers, which allowed crooks to siphon off copies of 40 million credit and debit cards.

Chief executive Gregg Steinhafel said point-of-sale (POS) systems were compromised by a software nasty, which harvested sensitive banking information from customers’ magstripes. The infiltration went undetected from late November through 15 December all over the US.

“There was malware installed on our POS registers, that much we have established,” Steinhafel said in an interview with CNBC.

“This investigation is ongoing and it is going to take some time before we understand the extent of what has happened.”

The company first gave notice of the breach late last year, warning customers who made purchases at Target between 28 November and 15 December that their cards were vulnerable to cloning.

As the investigations continued, the scale of the assault on Target grew. Encrypted banking card PINs were found to have been stolen as well, and a customer database holding names, addresses and phone numbers of 70 million customers was also ransacked.

The company has since vowed to cover any fraudulent charges connected to the breach, and foot the bill for credit-monitoring alerts and identity-theft protection for one full year for those affected by the scammers. While Target has yet to put a dollar amount on its costs, the company has already warned investors that the incident is likely to bring a hit to its bottom line.

Target may not be the only company to be infected by the breach. Luxury department store Neiman Marcus said that it had lost customer data as the result of a cyber-security breach on its systems over the holiday shopping season.

While no formal connection between the incidents has been announced, early reports suggest that the breaches carry evidence of being a coordinated operation. Researchers also have reason to believe that other retail chains were also targeted in the operation and that further disclosures are likely forthcoming in the next few days.

Should the suspicions of researchers be confirmed, the breach may well go down as the largest and costliest retail hack in history, topping even the 2007 breach of retail giant TJX’s payment card systems. ®

Master list of DNS terminology

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2014/01/14/target_ceo_says_malware_to_blame_for_massive_data_breach/

The other shoe is dropping: Neiman Marcus now has followed Target’s disclosure of a data breach, and security experts say other retailers also have been hit in a holiday hack that pilfered tens of millions or more customer payment cards and personal information in an attack that spanned the point-of-sale systems and databases.

Target, which over the past few weeks has dribbled out additional information on the breach it first announced in late December that affected some 40 million credit and debit cards in its stores between Nov. 27 and Dec. 15, late last week revealed that names, mailing addresses, phone numbers or email addresses for up to 70 million people also were stolen in the attack – a number that may have some overlap with the payment card victims. Target’s CEO told CNBC, meanwhile, that malware was found on its PoS registers, and Neiman Marcus has confirmed a breach of customer payment cards.

While there are still plenty of unknown details about the breaches and how if at all they are connected, a picture is gradually coming into focus on just what went down during the busy holiday shopping season. Security experts say an organized cybercrime gang likely out of Eastern Europe remotely infected point-of-sale systems at Target and Neiman Marcus and other retailers as a way to rapidly siphon a large volume of credit card and debit card accounts to resell in the cybercrime underground.

But at least in the case of Target—and likely others—the attackers didn’t stop there. They moved from the infected PoS systems to a database, security experts say. Adrian Lane, CTO for Securosis, says Target’s revelation that the attackers had accessed 70 million customers’ names, addresses, phone numbers, and emails, points to a possible database breach.

“If the attackers have name, address, phone, email and other personal information, and they have millions of these records, there are only one or two places a hacker can acquire that data — a backup tape or a database. You simply can’t harvest that many records listening on the wire unless you breached them years ago,” Lane says. “Target is known for data mining and analytics, so it’s not too much of an inductive leap to say it was a database breach.”

Curt Wilson, senior analyst with Arbor Networks’ ASERT, who has studied PoS malware, says he and his team are trying to confirm whether the retailer breaches used the Dexter and Project Hook PoS malware families he and his team recently studied, or other known PoS malware. The two malware families target Windows-based PoS systems, often via weak credentials in the PoS system. “There are lots of Windows vulnerabilities and Security 101 threats in place there, so it’s an open door for attackers,” Wilson says. “POS has been a lucrative target … for some time.”

[Attackers employ custom malware rather than physical skimmers to steal payment card information from PoS systems in 40 countries. See ‘Dexter’ Directly Attacks Point-of-Sale Systems .]

Another possible hole: the victimized retailers may have employed weak administrative passwords, a common enterprise mistake. “They probably aren’t using the default password, but I would be willing to bet that the admin accounts are Admin or Root, and the passwords were very weak,” says Vincent Troia, a security consultant with Night Lion Security. “I really doubt every POS terminal was infected; that would take a tremendous amount of work. It’s far more likely that the central processing server was infected, as that would be the machine, which would potentially have access to -and out of- the corporate network,” he says.

PoS systems often have Internet and email access, leaving them open to attack from the outside. “Therefore malicious links or attachments in emails as well as malicious websites can be accessed and malware may subsequently be downloaded by an end user of a POS system,” the US-CERT Website said in a January 2 advisory warning of an increase in PoS attacks.

Visa issued a similar warning back in April of last year, but focused on a surge in attacks on grocery retail chains that began in January of 2013 and installed malware on PoS systems and their back-end servers. “The malware is configured to ‘hook’ into certain payment application binaries. These binaries are responsible for processing authorization data, which includes full magnetic-stripe data. When authorization data is processed, the payment application decrypts the transaction on the cash register system or BOH server and stores the authorization data in random access memory (RAM),” Visa wrote in its alert. “The data must be decrypted for the authorization to be completed, so hackers are accessing full track data when it is stored in RAM and using malware such as memory-parsers to steal it.”

Avivah Litan, vice president and distinguished analyst for Gartner, says she was told by at least two people with knowledge of the breaches that the PoS malware that hit Target was tested at a few other retailers before infecting Target. “They had developed very specific point-of-sale malware … I was told it was the exact same piece of malware and since November, we’ve been told big retailer breaches were going on,” Litan says.

Another clue that something was awry: BitSight says it saw a jump in malicious activity on Target and Neiman Marcus’ networks in November and December of 2013. Retail networks in general saw more malicious activity in the second half of the year, according to the firm, whose network of sensors gathers botnet, spam, malware, and other security risk communication and maps it to specific organizations’ networks.

“Since the details of these breaches have not been fully revealed, we do not know if the activity observed by BitSight was indeed the cause of the data loss. BitSight looks only at externally available data and has no access to internal network data. While we did observe increased activity during the time the breaches occurred at Target and Neiman Marcus, these companies were certainly not the worse performers in the retail sector,” said Sonali Shah, vice president of product at BitSight, in a blog post. “SecurityRatings for other companies in this industry are lower, leaving us wondering which retailer will be hit next.”

Arbor’s Wilson says he expects more PoS attacks to emerge. “There’s a lot more of this going on … a lot of [victims] don’t know it yet or have yet to publicize the fact” they’ve been breached, Wilson says. “I think we’re going to see more PoS malware attacks.”

Daniel Ingevaldson CTO of Easy Solutions, Inc., says his firm in early December saw a massive flow of newly stolen credit card accounts, and then an even bigger dump of stolen cards—2 million—on January 4. “We initially assumed it was the last gasp from the Target breach, but the overall structure of that base [dump] was a little different: we saw a disproportionate amount of AmEx Black cards and AmEx Centurion cards. Centurion cards are only for people with $15 million in assets and annual income of over $1 million,” Ingevaldson notes. “It’s unusual to see those,” and it could be linked to Neiman Marcus’ breach, he says.

He says the Target breach was akin to a smash-and-grab job to get as much as possible as quickly as possible and then to resell the stolen booty right away. The remote infection of PoS systems is more lucrative than attaching a skimmer on a PIN pad or at a gas station, he says.

“Another side of this is that we didn’t see 40 million cards hit the [underground] market. So we don’t have a full accounting of all of those cards,” he says. “The guys who perform this work know exactly what they’re doing and they know how to keep prices high.”

Adam Meyers, vice president of intelligence at CrowdStrike, says while there have been multiple variations of this malware, they were only used in “limited environments” as far as was known. These latest breaches are similar in nature to a targeted attack, he says.

“Based on my experience, I would say we are looking at several other breach announcements in the future since there appears to be a cybercriminal group that has taken a page from the targeted attacker play book and is able to move laterally and deploy malware to collect track data from the point of sales devices,” Myers says.

Have a comment on this story? Please click “Add Your Comment” below. If you’d like to contact Dark Reading’s editors directly, send us a message.

Article source: http://www.darkreading.com/attacks-breaches/target-neiman-marcus-data-breaches-tip-o/240165363

The Target data breach story has turned into a bit of a bus: it’s big, has lots of momentum, and three just came along at once.

Here’s where we are now.

Late in December 2013, a breach was noticed and notified by Target.

At that point, it looked as though “only” 40,000,000 payment card customers had been impacted.

Over the second weekend of January 2014, the plot thickened, with a second part of the breach notified by Target.

This announcement added another 70,000,000 potential victims – what Target referred to as “guests,” apparently meaning anyone who had shared personal information with the company, as you might, for example, if you were to enter a competition or request a catalogue.

Unfortunately, that has spread the net of potential victims much more widely and less predictably.

As far as Target is aware, the original 40,000,000 stolen payment card records involve only customers who made an in-store purchase at Target in North America between 27 November 2013 and 15 December 2013.

That’s a lot of people, to be sure, but it’s clear-cut to work out whether you are inside or outside the set of possible victims: no purchase, no breach.

But Target’s “guests,” as you can imagine, cover a much less well-defined set of possible victims.

You’d expect there to be some overlap between customers and guests, so the total number of affected individuals is unlikely to be 40 million plus 70 million.

But even if every customer is also a guest, i.e. there is a total overlap between the databases, the breach would still have touched a minimum of 70 million people.

That’s why we’ve described Target as joining Adobe and Sony in the “100 million plus” club.

Anyway, a third part of the Target story has now emerged, with Target CEO Gregg Steinhafel telling CNBC in an interview that “there was malware installed on our point-of-sale (PoS) registers.”

However, Steinhafel, understandably given that this incident is centre stage in an ongoing criminal investigation, didn’t go into any detail.

We don’t know whether the malware was instrumental to, incidental in, or even unrelated to, the payment card breach.

The best result, ironically, would be for the malware to be found to have been specifially written to commit payment card fraud, and to be entirely responsible for the stolen records.

At least then we’ll be confident that the malware wasn’t there to steal yet more data from yet more victims.

For now, let’s assume that the malware was a specially designed bot, designed to hook together Target’s PoS registers into a botnet, or “robot network”, of data-stealing Trojans under criminal control.

That raises the question: what about PCI-DSS, the Payment Card Industry Data Security Standards?

Surely Target was compliant, and used encryption all the way from its retail store to its central payment processing database, thus thwarting the crooks by feeding them nothing but shredded cabbage from end to end?

The answer to that question is that credit card data isn’t actually encrypted all the time, even on PCI-DSS compliant systems.

Usually, it’s briefly unencrypted inside the PoS terminal itself – the device with the keypad into which you actually insert or swipe your card.

Putting malware into PoS terminal hardware devices is possible, and lets you can skim off payment card data as early in the process as possible.

Back in 2009, for example, crooks in Australia ripped off McDonalds fast-food outlets that way.

They surreptitiously switched out Macca’s official PoS devices for jury-rigged ones.

They would visit a drive-through window, buy food, and the driver would pass the PoS device, installed on the end of a long data cable, to the passenger for “payment”.

The driver would then act as a sort of human shield behind which the passenger could lurk to carry out the substitution.

A reverse swap-out some weeks later allowed the crooks to recover their Trojanised devices, and then to read off a month or more of payment card data and PIN codes from covert storage inside the hacked units.

But that sort of scam is hard to perpetrate on a national scale, especially at in-store sales points.

That’s where so-called RAM scraping malware comes into the picture.

RAM scraping works because payment card data is often also unencrypted in memory (RAM) in the PoS register, albeit briefly.

This happens as the data is transferred from the PoS terminal to the PoS register.

Of course, PoS registers usually run some version of Windows, and are connected together on an enterprise-wide network.

So a RAM scraping botnet can be used to look out for credit-card-like data popping up in memory on an infected computer.

The bot then grabs the data before payment processing has even taken place, and squirrels it out into the hands of the botmasters.

→ If you are interested in learning more about RAM scrapers, take a look at SophosLabs researcher Numaan Huq’s fascinating Naked Security article that investigates the industrialisation of this aspect of card fraud. And watch this space: Chester Wisniewski will be delivering a joint paper on the topic with Numaan at the 2104 RSA security conference in San Francisco in February 2014.

Is it all doom and gloom for Target?

Well, Target is not the only company to suffer a data breach in 2013, so while it’s fair to criticise the company, it would be unfair to single it out.

And it is worth saying “well done” to Target over the words it has chosen to use in confessing its security sins.

You can watch Target CEO Gregg Steinhafel talking to CNBC here, and judge for yourself:

Here’s a transcript of the 55-second clip (Naked Security’s emphasis):

Steinhafel: Well, we’re in the middle of a criminal investigation, as you can appreciate, and we can only share so much. But as time goes on, we are going to get down to the bottom of this. We are not going to rest until we understand what happened, and how that happened.

Clearly, we are accountable, and we are responsible. But we’re going to come out at the end of this a better company, and we’re going to make significant changes.

I mean, that’s what you’re doing when you go through a period like this. You have to learn from it, and you have to apply those learnings. And we’re committed to do that.

Interviewer: What can you share? Was it a point-of-service situation? Was it an outside vendor? What happened?

Steinhafel: We don’t know the full extent of what transpired. But what we do know was, there was malware installed on our point-of-sale registers. That much we’ve established.

We removed that malware so that we could provide a safe and secure shopping environment. This investigation is ongoing, and it’s going to take some time before we really understand the full extent of what’s happened.

Follow @duckblog

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/agGj1lDkEs4/

Dallas-based retail group Neiman Marcus confirmed on Saturday that its customers may be at risk after hackers breached its servers and accessed the payment information of store visitors.

The luxury merchant said that the security breach occurred in mid-December and that an undisclosed number of payment cards had been compromised.

The news comes not long after we learned that a similar breach at Target, also in mid-December, was far worse than first thought with more than 100,000,000 payment card records being snaffled.

Neiman Marcus spokesperson, Ginger Reeder, said in an email on Saturday that:

Neiman Marcus was informed by our credit card processor in mid-December of potentially unauthorized payment card activity that occurred following customer purchases at our Neiman Marcus Group stores.

We informed federal law enforcement agencies and are working actively with the U.S. Secret Service, the payment brands, our credit card processor, a leading investigations, intelligence and risk management firm, and a leading forensics firm to investigate the situation. On January 1st, the forensics firm discovered evidence that the company was the victim of a criminal cyber-security intrusion and that some customers’ cards were possibly compromised as a result. We have begun to contain the intrusion and have taken significant steps to further enhance information security.

The security of our customers’ information is always a priority and we sincerely regret any inconvenience. We are taking steps, where possible, to notify customers whose cards we know were used fraudulently after making a purchase at our store.

Further details of the attack are few and far between at this point in time so it is hard to tell exactly what type of information has been stolen, or how many customers may potentially be at risk.

According to a report from Reuters Neiman Marcus and Target are not alone in being breached over the Christmas shopping period. While the news agency did not identify any other victims, it did say that at least three other retailers with brick and mortar outlets may have been compromised to a lesser degree.

Cyber criminals are always busy during the holiday season as consumers tend to spend a lot more money online, making it more difficult for credit card companies and retailers alike to spot unusual spending patterns.

The rise in data breaches is a concern that has grabbed the attention of lawmakers. US Congress is moving towards making notifications of data breaches a mandatory requirement.

In a statement on Friday, Democratic Senator Ed Markey said: “When a number equal to nearly one-fourth of America’s population is affected by a data breach, it is a serious concern that must be addressed,” adding that the recent breaches demonstrate a need for clear and strong privacy and security standards across all industries.

Follow @Security_FAQs
Follow @NakedSecurity

Image of Neiman Marcus shopfront courtesy of Wikimedia Commons.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/fu7xWg07VSw/

Microsoft and Adobe bias their Patch Tuesdays towards the beginning of the month, choosing the second Tuesday, which can be no later than the 14th.

Oracle pitches its fixes at the middle of the month, choosing the Tuesday closest to the 17th (don’t ask – we don’t know why), which can be no earlier than the 14th.

So this is one of these months when they all align and we get a Trifecta – Patch Threesday!

All three companies have issued announcements about their forthcoming announcements, and here they are, though they all use slightly different names:

Adobe’s fixes

If you’re wondering, “What about Adobe Flash” (assuming you still have it installed in your browser), you’ll have to keep on wondering until tomorrow.

Adobe’s only advisory so far in 2014 is the abovementioned “prenotification” for the PDF-related Reader and Acrobat products.

Acrobat and Reader versions X and XI will be getting fixes for critical vulnerabilties, defined by Adobe as:

[Vulnerabilities] which, if exploited would allow malicious native-code to execute, potentially without a user being aware.

That’s what you and I call a drive-by install.

Oracle’s fixes

Oracle’s announcement is the Brobdingnagian bulletin of the three, though that is hardly surprising, considering that the company is patching 40 products in 45 versions, and that it patches only quarterly, not monthly.

The Oracle announcement doesn’t say exactly what bugs are getting squashed, but it does mention a total of 144 vulnerabilities, of which 82 can be considered critical.

In Oracle’s own words:

These vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without the need for a username and password.

That’s what you and I call a drive-by install.

The Oracle update that directly impacts the most users is without doubt the update to Java, which affects users and developers alike.

The new release of Java will supersede all currently-supported versions of Java: 5.0u55 and earlier, 6u65 and earlier, 7u45 and earlier.

Remember that Java is not JavaScript, and while most of us use and need JavaScript in our browsers, many of us can manage perfectly well without browser-based Java.

(Audio player not working? Download to listen offline, or listen on Soundcloud.)

You can have Java installed, allowing you to download and run regular applications written in Java, without activating Java in your browser and thereby exposing it to hostile applets.

Applets are supposed to be safer than applications, but they can be embedded in malicious web pages, and can therefore attack your browser surreptitiously, without triggering any download warnings or asking for permission.

To quote James Wyke of SophosLabs, in our recent Techknow podcast, Understanding Botnets:

Java is one of the most common infection vectors of the last year or so, because lots of people are running an outdated version of Java that lots and lots of exploits exist for.

So you should not only get Oracle’s updates on Tuesday, but also consider turning Java off in your browser if you haven’t already.

(If you aren’t sure, just give it a try. If a website you really need won’t work without Java, you can always turn the Java plugin back on.)

Microsoft’s fixes

Last, and this month, by all means the least, comes Microsoft.

Redmond opens its scorecard for 2014 with an impressively modest set of fixes: four bulletins; no Internet Explorer cumulative fix; and no updates denoted critical.

There are three Elevations of Privilege and one Denial of Service, and that’s that.

Two of the bulletins are listed as related to Windows: one of them applies only to Windows XP (which you are no longer using, right?); the other is for Windows 7 and Server 2008 R2.

(Audio player not working? Download to listen offline, or listen on Soundcloud.)

Windows 8, Server 2012 and the Server Core versions of Windows escaped without patches this month.

And there you have it: there’s something for just about everybody this month, especially those who still have Java installed.

Follow @duckblog

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/mOD5CNaYYsQ/

Why did security firm RSA accept $10 million from the National Security Agency in 2004?

That unanswered question is behind the decision by at least nine leading information security and privacy experts to boycott next month’s RSA Conference in San Francisco.

Contacted via email, a spokesman for EMC — which purchased RSA in 2006 — declined to offer further details about the nature of the NSA’s $10 million payment to RSA, and declined to comment on conference speakers’ threatened boycott of the RSA conference, which is owned by EMC but independently run. (Full disclosure: InformationWeek’s parent company, UBM LLC, owns the Black Hat security conferences.) RSA conference program committee chairman Hugh Thompson — who is CTO of Blue Coat and not an RSA employee — didn’t immediately respond to an emailed request for reaction to the threatened boycott.

Read the full article here.

Have a comment on this story? Please click “Discuss” below. If you’d like to contact Dark Reading’s editors directly, send us a message.

Article source: http://www.darkreading.com/privacy/9-security-experts-boycott-rsa-conferenc/240165341

How much would you pay to know who your organization’s online attackers are? And what would you want to know about them?

These two questions are at the heart of a burgeoning market for sophisticated threat intelligence services that promise to improve enterprise cyber defenses by identifying attackers — and helping customers to develop a tailored defense against them. Such services, sometimes called “attribution services” or “active defense,” promise to change the face of IT security by re-focusing defensive strategies on protecting data against human adversaries, rather than just the malware they create.

“Today’s defense-in-depth strategies are not working well, because to build a defense against malware, you have to be right 100% of the time, but the attacker only has to be right once,” says Dmitri Alperovitch, CTO of CrowdStrike, the company that coined the term active defense and a leading voice behind “offensive security,” which advocates hunting for attackers as well as passively building walls against them. “But if you focus on attribution – on defending against the adversary – then the reverse is true: The attacker has to be good all of the time, and you only have to find one instance where they make a mistake and give themselves away.”

The idea of identifying the organization’s attackers and building a tailored defense against them is enticing – perhaps game-changing – in a market full of arms-race-weary IT organizations, which for decades have been buying new technologies and developing new defense strategies — only to watch the bad guys develop newer, better exploits that often elude currently-available technology designed to stop known attacks.

“There’s a saying in security that if you’re trying to stop everything, you’re probably stopping nothing,” says Ned Moran, a senior malware researcher at next-generation security tool vendor FireEye. “But if you know the source of your attacks, you understand better what they are trying to acquire, and that may change your defense. You can pinpoint your defensive measures in a way that creates lower costs and a better payoff.”

But Moran and other experts point out that there are a variety of methods of attribution – and some of them may be prohibitively expensive and resource-intensive for some enterprises.

“You can pursue the direction of identifying the actual people who are writing the code – their names and where they are sitting, and who’s launching the attacks that they write,” Moran says. “Or you can focus on a defense around ‘indicators of compromise,’ which means you’re not so worried about the attacker’s personal identity, but you want to identify their tools and techniques and develop a ‘fingerprint’ that will help you create a defense against them. Identifying the attacker personally is possible, but the cost is very high – in general, focusing on indicators of compromise gives you better bang for the buck.”

While analyzing a malware developer’s “fingerprint” can be accomplished through deep data analysis, connecting the malware to a specific attacker requires data and threat intelligence that goes well beyond most enterprises’ internal resources, experts say. Gaining that level of knowledge may require full-time, skilled staffing and/or outside services that may cost tens of thousands of dollars, or even more.

Stuart McClure, CEO, president and co-founder of advanced threat detection vendor Cylance, questions the value of identifying the attacker, particularly at the seat level. “As humans, we all want to know why we’re being attacked – why do they hate me? But on a security level, there isn’t much value in identifying the butt in that seat, because there isn’t much you can do about it unless you’re going to try to disrupt them personally – which is difficult, and sometimes illegal. And at a business level, that sort of attribution requires a ton of resources, and there’s not much payoff.”

The debate over attribution’s value is fundamental to the broader debate over the growth of digital forensics and threat intelligence services and technologies, which have become the darling of the IT security industry. Over the past two years, the proliferation of sophisticated attacks has created a cottage industry for technology and skilled enterprise staffers capable of analyzing the earmarks and components of an advanced cyber campaign — and stop it before it can infiltrate enterprise defenses. But such technology and skills come at a high cost, leaving some enterprises wondering how deeply to invest in them.

CrowdStrike, which monitors and tracks the techniques and behaviors of some 50 groups of threat actors worldwide, believes that its threat intelligence – combined with big data analysis that enables enterprises to determine if they are under attack by a specific adversary – is driving a sea change in digital defense. Knowledge of the attacker can not only pave the way for a more efficient defensive strategy, Alperovitch argues, but it also opens up the possibility of disrupting or frustrating a specific attacker, a capability that CrowdStrike offers.

“In the end, the adversary is human, and their objectives tend to be very specific,” Alperovitch says. “If you understand who they are and what they want, you have a much better chance of stopping them.”

While few vendors so far offer the ability to identify – much less disrupt — a specific attacker, experts say that enterprises’ increased focus on detection and analysis of threats and attacks is having a calculable effect on enterprise defenses.

“In our 2012 trends report, we found that only about 6% of our clients had discovered their security breaches using their own means of detection – most of them found out about their breaches through law enforcement or a third party,” says Charles Carmakal, director of the services department at Mandiant, one of the security industry’s best known digital forensics and incident response service providers, which is often called in by clients to investigate the cause of a major breach. “But in our 2013 report, we found that 37% of organizations had detected their own compromises. What that says is that organizations are getting better at doing their own detection and analysis.”

But McClure argues that enterprises’ improved success centers around better detection of attackers’ methods, not their identities. Cylance, for example, has built technology that features mathematical algorithms which help users quarantine potentially malicious code based on its characteristics and behavior.

“There is a lot of new malware out there, but there really aren’t many new methods – attackers basically are using the same techniques that they’ve used for years,” McClure says. “Historically, enterprises have bought products and trusted the vendors to tell them what’s bad. Now, enterprises are being told to do their own analysis and forensics, and trust themselves to determine what’s bad. What we’re saying is trust the math to isolate potential problems and do your own analysis from there.”

While the value of discovering the attacker’s identity remains a matter of some debate, most experts agree that understanding an adversary’s motivation may be helpful in developing an effective defense.

“Most of our customers are not too worried about identifying the specific attacker, because most of them are not interested in attacking back,” says Dean De Beer, co-founder and CTO at ThreatGRID, which does deep malware analysis to detect and remediate malicious code. “What they want to know are the motivations of the attacker – what were they after? That’s the type of data they can use to escalate or de-escalate a potential threat, and to assign criticality to it.”

Mandiant’s Carmakal agrees. “The one thing about the more sophisticated attackers is that they are very determined,” he says. “Even if you succeed in kicking them out the first time, they often come back, so it’s good to know a little bit about them and what indicators there might be that you are dealing with the same threat actors.”

Analyzing an attacker’s “indicators of compromise” may enable enterprises to recognize a persistent threat actor – not by name, but by the tools, techniques, and procedures they use, notes FireEye’s Moran. “The code and techniques used by some [malware] developers are often re-used by other attackers, so if you understand the developer, you can sometimes knock out a whole swath of attacks that come downstream.”

CrowdStrike takes this idea a step further by identifying and naming groups of malware developers and tracking their habits and targets on an ongoing basis. “We’ve identified about 30 different groups in China alone,” Alperovitch says. “There’s one group, which we call Anchor Panda, which primarily targets maritime transportation. There are others which focus on the oil and gas industry, or on financial systems, or on government. What we’re doing is focusing on understanding what those groups are doing, so that we’re not dealing with a piece of malware, but with a real adversary.”

Most of today’s malware – such as worms and viruses — is still automated, attacking computers randomly according to their configurations and vulnerabilities, experts agree. But while such broad-based attacks can typically be handled by off-the-shelf tools, a sophisticated, targeted attack may require more knowledge about who’s attacking, or at least what their motivations and methods are.

“What we see is that the enterprise may not be so interested in identifying their specific attacker, but there’s a lot more demand for context – they want to know not only the domain that the attacker is coming from, but what are the characteristics of that domain,” says ThreatGRID’s De Beer. Just learning the source IP address is not enough anymore – they want to know more about the specifics.”

Alperovitch agrees. “There are two types of organizations: those that know they’ve been attacked, and those that don’t,” he says. “Giving them an IP address is not attribution. They need to know who the threat actors are, and what’s the likelihood that they will attack again.”

Have a comment on this story? Please click “Add a Comment” below. If you’d like to contact Dark Reading’s editors directly, send us a message.

Article source: http://www.darkreading.com/threat-intelligence/knowing-your-cyber-enemy-new-services-op/240165336

10 January 2014, Maidstone, Kent: SecureData, the complete security service provider, today revealed that 60% of IT professionals view employee carelessness as the biggest risk to an organisation’s security, well above the usual suspects like data theft (13%), external malware (10%) or technology failure (7%).

The findings are based on responses from 110 IT professionals, half of whom are in major organisations with over 5,000 employees. While 40% of respondents viewed Operations teams as the greatest risk to security, Finance teams were also seen as a significant worry (13%). Interestingly, at a time when cloud security is being hotly debated, no one cited this as a primary security concern.

While IT professionals have been quick to spot the risks posed by non security conscious employees, agreement on how to tackle the challenge is less certain. 40% of respondents felt that educating employees was the most important step to improving security, but 25% added that implementing a clear security management policy was their weakest area. Meanwhile, almost half (44%) of those questioned said that the ultimate responsibility for security decision-making is left in the hands of more junior IT managers, rather than C-level staff (44%) or department heads (12%).

Commenting on the findings, SecureData’s CEO Etienne Greeff said: “There’s a huge opportunity here for organisations to tighten security simply by better educating their staff. Don’t leap to technical answers and complex solutions. This is not about budget-busting new technologies, but going back to basics: plan and deliver a simple, straightforward security policy that employees can easily follow.”

50% of respondents see a holistic approach to security as crucial to meeting the security challenge, with 36% stating that detecting threats quickly is the weakest area of their current approach.

Greeff concludes: “It’s encouraging to see so many recognising the importance of a holistic approach to security. Assessing risk, detecting threats earlier, protecting valuable assets and responding quickly when there is a breach will help restore trust in colleagues across an organisation. But this leadership must come from the top, with the C-level stepping up to tackle the security knowledge gap in their organisations.”

-ENDS-

About SecureData

SecureData is a complete security service provider with a proactive approach. We minimise business disruption for our clients and offer the complete security spectrum from assessing risk to detecting threats, protecting valuable assets and responding to breaches when the happen.

We specialise in providing managed services that help businesses secure their data and networks, fight an increasing array of cyber threats, optimise networks to improve employee mobility, ensure regulatory compliance and allow the safe adoption of both cloud computing and consumer technologies in the workplace.

Operating from its UK based Security Operations Centre; the company offers manned support on a 24 x 7 x 365 basis, with its own unique real-time monitoring service developed in-house and tailored to suit both small businesses and large corporate enterprises alike.

Article source: http://www.darkreading.com/management/employees-revealed-as-greatest-challenge/240165379

FRISCO, Texas–(BUSINESS WIRE)–January 13, 2014–HITRUST announced today that it will lead an industry-wide effort to conduct exercises to simulate cyber attacks on healthcare organizations, named CyberRX. The results will be used to evaluate the industry’s response and threat preparedness against attacks and attempts to disrupt U.S. healthcare industry operations. These exercises will be conducted in partnership with the U.S. Department of Health and Human Services (DHHS) and major healthcare industry companies.

CyberRX will include the participation of providers, health plans, prescription benefit managers, pharmacies and pharmaceutical manufacturers, and DHHS. The exercises will examine both broad and segment-specific scenarios targeting information systems, medical devices and other essential technology resources of the healthcare industry. CyberRX findings will be analyzed and used to identify areas for improvement in the coordination of the HITRUST Cyber Threat Intelligence and Incident Coordination Center (C3); with security and incident response programs; and in information sharing between healthcare organizations, HITRUST and government agencies. These findings will be summarized into a report distributed to the industry and presented at HITRUST 2014 in April 2014.

“We have been coordinating and collaborating with HITRUST to enhance the resources available to the healthcare industry,” said Kevin Charest, chief information security officer, U.S. Department of Health and Human Services. “Our goal for the exercises is to identify additional ways that we can help the industry be better prepared for and better able to respond to cyber attacks. This exercise will generate valuable information we can use to improve our joint preparedness.”

Recognizing the growing threats posed by cyber attacks targeted at healthcare organizations, HITRUST established a fully functional cyber threat intelligence and response program to enable the U.S. healthcare industry to protect itself from disruption by these attacks. The HITRUST C3 is the single best source of intelligence on threats targeted at healthcare organizations and medical devices, providing actionable information for strategic planning and tactical preparedness, and coordinated response for both large and small organizations. The HITRUST C3 facilitates critical intelligence sharing between the healthcare industry, the U.S. Department of Homeland Security, and the U.S. Department of Health and Human Services.

HITRUST will coordinate two CyberRX exercises. The initial exercise will take place over a two-day period in Spring 2014, and the second one will take place in Summer 2014.

In addition to aiding organizations in evaluating their own processes, the March exercise will focus on the following objectives:

Developing a better understanding of the healthcare industry’s cyber threat response readiness

Measuring the effectiveness of the HITRUST C3 in supporting the healthcare industry and opportunities for improvement

Testing the coordination with the U.S. Department of Health and Human Services relating to cyber threats and the healthcare industry response

Documenting threat and attack scenarios of value for future exercises engaging additional healthcare industry organizations and in support of industry preparedness

“I feel strongly that these exercises are needed as a crucial step in the healthcare industry’s continued maturity around cyber threat preparedness and response,” said Roy Mellinger, vice president and chief information security officer, WellPoint, Inc. “It will allow organizations to evaluate and improve their processes and identify gaps in what is needed industry-wide and from government.”

HITRUST and the U.S. Department of Health and Human Services held a Health Industry Cyber Threat Preparedness Summit in December 2013 to discuss numerous topics around the healthcare industry’s cyber threat preparedness and coordination and response. One of the recommendations was to evaluate the industry’s preparedness and HITRUST C3 effectiveness through an industry-wide cyber attack and response exercise. The Spring 2014 CyberRX exercise will include 12 organizations. The group is predominantly comprised of Summit participating organizations, such as Children’s Medical Center Dallas, CVS Caremark, Express Scripts, Health Care Service Corp, Highmark, Humana, UnitedHealth Group, and WellPoint. HITRUST is currently soliciting participation for the Summer 2014 CyberRX exercise.

“As cyber threats continue to increase and the number of attacks targeted at healthcare organizations rise, industry organizations are seeking useful and actionable information with guidance that augments their existing information security programs without duplication or complication,” said Daniel Nutkis, chief executive officer, HITRUST. “CyberRX will undoubtedly provide invaluable information that can be used by organizations to refine their information protection programs and will enable HITRUST C3 to better serve the healthcare industry and support public and private industry partnerships.”

Healthcare organizations interested in participating in the Summer 2014 CyberRX exercise can register to receive additional information or to learn more about the HITRUST C3 by visiting www.hitrustalliance.net/c3/.

About HITRUST

The Health Information Trust Alliance (HITRUST) was born out of the belief that information security should be a core pillar of, rather than an obstacle to, the broad adoption of health information systems and exchanges. HITRUST, in collaboration with healthcare, business, technology and information security leaders, has established the CSF, a certifiable framework that can be used by any and all organizations that create, access, store or exchange personal health and financial information. Beyond the establishment of the CSF, HITRUST is also driving the adoption of and widespread confidence in the framework and sound risk management practices through awareness, education, advocacy and other outreach activities. For more information, visit www.HITRUSTalliance.net.

Article source: http://www.darkreading.com/government-vertical/healthcare-organizations-plan-first-indu/240165337

MINNETONKA, Minn.–(Jan. 13, 2014)–Datacard Group, the world leader in secure ID and card personalization solutions, today announced that it has successfully purchased Entrust, Inc., a leader in securing digital identities and information. The closing of the deal was finalized on December 31, 2013, and comes after the passing of regulatory approval procedures.

Entrust is headquartered in Dallas, Texas and also operates a large facility in Ottawa, Canada. They will continue to operate from those facilities and together, with Datacard Group, the two companies will employ nearly 2,000 professionals, and leverage hundreds of channel partners to serve tens of thousands of customers across the globe.

For years, the paths of the two companies have intertwined–often with the same financial and government customers–from different points within the technology spectrum. To date, Datacard Group’s core competencies have been in issuance and personalization and Entrust’s core competencies have been to secure communications and digital identities. By bringing the two companies together they intend to help further unify identification-security technologies, and leverage complementary competencies to strengthen identity and transaction security across digital, physical, mobile and cloud domains.

“We are thrilled to officially welcome the customers, partners and colleagues of Entrust to be part of Datacard Group,” said Todd Wilkinson, president and CEO of Datacard Group. “The official closing of this acquisition moves us significantly toward our goal of delivering powerful technology advancements and new innovations in identity-based security solutions. The timing of this acquisition is perfect for the market as we have seen a heightened awareness around cyber security, and we will continue to accelerate our investments in all areas of the combined business to deliver innovative, world-class technologies that protect physical and digital identities.”

For more information, visit http://www.datacardentrust.com/.

###

About Entrust

A recognized provider of identity-based security solutions, Entrust secures governments, enterprises and financial institutions in more than 5,000 organizations spanning 85 countries. Entrust’s award-winning software authentication platforms manage today’s most secure identity credentials, addressing customer pain points for cloud and mobile security, physical and logical access, citizen eID initiatives, certificate management and SSL.

About Datacard Group

Datacard Group empowers financial institutions, government agencies and other enterprises in more than 150 countries to securely issue and personalize financial cards, passports, national IDs, employee badges, mobile payment applications and other credentials. Our flexible solutions enable Secure Issuance Anywheretrade, which helps both public and private enterprises succeed in a global, digital and increasingly connected marketplace. Datacard is the world’s best-selling brand of secure issuance solutions.

Article source: http://www.darkreading.com/privacy/datacard-group-finalizes-acquisition-of/240165293