0

IT Security Rewind – Week of September 19

Posted on September 23, 2011 by Josh Arrington

It was another interesting week for IT security professionals, with numerous developments, breaking stories and breaches to follow. But before we dig in to this week’s Rewind—we wanted to wish a warm farewell to Dave Kearns, who wrote one of final pieces for the penultimate edition of the Network World Identity Management newsletter. We wish Dave well with his analyst role at Kuppinger-Cole—where he’ll continue to provide us with keen security insights!

APT: In Review – It’s never easy to put together a “lessons learned” type of piece when it involves a sensitive and well-documented security attack, but Pacific Northwest National Laboratory CIO Jerry Johnson did a great job at the recent InformationWeek 500 conference. Johnson developed a presentation that described the APT attack against his company with such details as “when the intruders tried to recreate and elevate account privileges, this action triggered an alarm, alerting the lab’s cybersecurity team…”  It’s information like this that can help all security professionals better prepare themselves and anticipate vulnerabilities.

Is “SIEM dead as claimed?”—To no surprise, questions like these usually provoke responses of all types. As Computerworld reported, a recent survey “conducted with senior security professionals at Global 5000 and federal organizations” found that “SIEM has joined signature-based technologies on the ash heap of IT history.” However, advocates for SIEM, like Dr. Anton Chuvakin of Gartner disagree—stating that while SIEM is not a tool that should be used primarily to prevent attacks, it’s still an important monitoring technology.

Access Rules –InfoSecurity provided more background on the $2.3 billion UBS fraud case this week. While details are still swirling, it’s clear that this is another example of a trader acting beyond authorization in a highly regulated market. While the article delves deeper, calling for tighter monitoring and controls, the question remains:  If access and risk management controls and processes were in place, how were the traders able to circumvent them?

Anything we missed? What stories have you been following? Let us know!

0

IT Security Rewind – Week of September 12

Posted on September 19, 2011 by Josh Arrington

It was a week of déjà vu and doppelgangers in the world of IT security, with another rogue financial trader scandal and doppelganger domains stealing data. Here is this week’s IT Security Rewind with all the gory details:

“I need a miracle” – This Facebook status update couldn’t be more appropriate for Kweku Adoboli, the 31-year old City trader at UBS suspected of carrying out Britain’s biggest banking fraud. This week has to feel like déjà vu for the financial industry, as Mr. Adoboli was arrested at his desk yesterday for allegedly losing £1.3 billion through his rogue trades. This case is eerily familiar to the case of Jérôme Kerviel, the Paris-based Société Générale worker who lost £4 billion in rogue trades back in 2008.What’s worse is that UBS only became aware of the unauthorized trading when Mr. Adoboli told them, the bank’s monitoring systems had not picked up the loss. Could this be another situation where privilege identity management could have signaled an early warning? Stay tuned…

“When it absolutely, positively has to be there overnight.” – This week our own Oded Valin shared his thoughts on move file transfers processes to the cloud with Infosecurity Magazine. Boiling his advice down to seven steps, Oded outlined how organizations can safely exchange sensitive files in the cloud while maintaining security and compliance requirements.

Big Data = Big Problems – Dark Reading’s Ericka Chickowski put the spotlight on data warehouses and emphasized that the quicker and easier it is to access these “big data” stores, the greater security risk there is to all of that sensitive information. We have to agree with Ericka on this one, when you put more eggs into the basket (i.e. instead of separate databases you consolidate many databases into a single “big data”) security needs to become a higher priority.

Doppelgangers Stealing Data! –Two researchers who set up doppelganger domains to mimic legitimate domains belonging to Fortune 500 companies say they managed to vacuum up 20 gigabytes of misaddressed e-mail over six months. Of the data collected in the e-mails, Wired reported, were configuration details and passwords for an IT consulting firm’s routers and virtual private network access information for a company that manages toll roads. They also collected a lot of personal information on employees, including credit card statements and bank account records.

Feel like you’ve finally got all the drama figured out? Let us know your thoughts in our comments section!

It was a week of déjà vu and doppelgangers in the world of IT security, with another rogue financial trader scandal and doppelganger domains stealing data. Here is this week’s IT Security Rewind with all the gory details:

“I need a miracle” – This Facebook status update couldn’t be more appropriate for Kweku Adoboli, the 31-year old City trader at UBS suspected of carrying out Britain’s biggest banking fraud. This week has to feel like déjà vu for the financial industry, as Mr. Adoboli was arrested at his desk yesterday for allegedly losing £1.3 billion through his rogue trades. This case is eerily familiar to the case of Jérôme Kerviel, the Paris-based Société Générale worker who lost £4 billion in rogue trades back in 2008.What’s worse is that UBS only became aware of the unauthorized trading when Mr. Adoboli told them, the bank’s monitoring systems had not picked up the loss. Could this be another situation where privilege identity management could have signaled an early warning? Stay tuned…

“When it absolutely, positively has to be there overnight.” – This week our own Oded Valin shared his thoughts on move file transfers processes to the cloud with Infosecurity Magazine. Boiling his advice down to seven steps, Oded outlined how organizations can safely exchange sensitive files in the cloud while maintaining security and compliance requirements.

Big Data = Big Problems – Dark Reading’s Ericka Chickowski put the spotlight on data warehouses and emphasized that the quicker and easier it is to access these “big data” stores, the greater security risk there is to all of that sensitive information. We have to agree with Ericka on this one, when you put more eggs into the basket (i.e. instead of separate databases you consolidate many databases into a single “big data”) security needs to become a higher priority.

Doppelga

It was a week of déjà vu and doppelgangers in the world of IT security, with another rogue financial trader scandal and doppelganger domains stealing data. Here is this week’s IT Security Rewind with all the gory details:

“I need a miracle” – This Facebook status update couldn’t be more appropriate for Kweku Adoboli, the 31-year old City trader at UBS suspected of carrying out Britain’s biggest banking fraud. This week has to feel like déjà vu for the financial industry, as Mr. Adoboli was arrested at his desk yesterday for allegedly losing £1.3 billion through his rogue trades. This case is eerily familiar to the case of Jérôme Kerviel, the Paris-based Société Générale worker who lost £4 billion in rogue trades back in 2008.What’s worse is that UBS only became aware of the unauthorized trading when Mr. Adoboli told them, the bank’s monitoring systems had not picked up the loss. Could this be another situation where privilege identity management could have signaled an early warning? Stay tuned…

“When it absolutely, positively has to be there overnight.” – This week our own Oded Valin shared his thoughts on move file transfers processes to the cloud with Infosecurity Magazine. Boiling his advice down to seven steps, Oded outlined how organizations can safely exchange sensitive files in the cloud while maintaining security and compliance requirements.

Big Data = Big Problems – Dark Reading’s Ericka Chickowski put the spotlight on data warehouses and emphasized that the quicker and easier it is to access these “big data” stores, the greater security risk there is to all of that sensitive information. We have to agree with Ericka on this one, when you put more eggs into the basket (i.e. instead of separate databases you consolidate many databases into a single “big data”) security needs to become a higher priority.

Doppelgangers Stealing Data! –Two researchers who set up doppelganger domains to mimic legitimate domains belonging to Fortune 500 companies say they managed to vacuum up 20 gigabytes of misaddressed e-mail over six months. Of the data collected in the e-mails, Wired reported, were configuration details and passwords for an IT consulting firm’s routers and virtual private network access information for a company that manages toll roads. They also collected a lot of personal information on employees, including credit card statements and bank account records.

Feel like you’ve finally got all the drama figured out? Let us know your thoughts in our comments section!

ngers Stealing Data! –Two researchers who set up doppelganger domains to mimic legitimate domains belonging to Fortune 500 companies say they managed to vacuum up 20 gigabytes of misaddressed e-mail over six months. Of the data collected in the e-mails, Wired reported, were configuration details and passwords for an IT consulting firm’s routers and virtual private network access information for a company that manages toll roads. They also collected a lot of personal information on employees, including credit card statements and bank account records.

Feel like you’ve finally got all the drama figured out? Let us know your thoughts in our comments section!

0

IT Security Rewind – Week of Sept. 5

Posted on September 9, 2011 by Josh Arrington

As we work to shake off the post-Labor Day blues, consider this week’s top security stories to get you re-acclimated to the risks around you….from Britons having to look over their shoulder (online!) and cyber crime at a Bikini Bar, to a new market for the The Cyber Club….let’s get schooled!

Britons Safer on the Street than Online: Results from the Norton Cyber Crime Report found that Britons are three times more likely to suffer online crime than they are street crime. The global survey of approximately 20,000 people found that more than half of the UK population (51 per cent) has been affected by some kind of cyber crime. Additionally, the survey found the top three online threats were viruses (38 per cent), credit card scams (10 per cent) and social networking fraud (six per cent). Check your anti-virus software people!

Grab Your Cover-Up: Bikinis Sports Bar & Grill is an unlikely spot for a cyber security shake-down.  So, we suppose you have to give David Palmer (no, not the idealistic president from 24) some credit for selecting a, um, “colorful” backdrop for his crime. Among the charges he was convicted on, the disgruntled IT administrator decided to strike back at his former employer by breaking into the company’s systems and deleting payroll files for one of its customers. Palmer will be sentenced in November.

This Isn’t a Job for The Club: If you still think a steering wheel lock can protect your car, think again. With a new report from McAfee showing that carhacking will replace carjacking as criminals’ attack method of choice, maybe there’s a market for The Cyber Club?  As demonstrated at Black Hat this year, it IS possible to gain remote access to a car by hacking its electronics system. This report shares interesting data about the link between the increasing lines of code necessary to run advanced car features, and the exponential attack vectors that this creates.  Those bells and whistles may soon carry a very large price tag—and one that’s not on the sticker: theft insurance.

That’s our “back to school” recap for this week.  What else would you add to the list?

0

Morto A, Brute-Force and the Perpetual Problem of Insecure Privileged Accounts

Posted on September 1, 2011 by Roy Adar

By Roy Adar, Vice President of Product Management, Cyber-Ark Software

Consider these keyboard combinations: *1234, 123, 369, abc123, abcd1234, admin, admin123, letmein, pass, password, test and user.

Not exactly what you’d call strong administrative passwords, but they are some of the combinations the Morto A worm carries in its brute-force library to attack target machines.  According to an article in NetworkWorld, the Morto A worm continues to spread “despite its reliance on a list of lame passwords to take over victim machines.”  Those machines, and all the information on them, are now vulnerable and at the mercy of the virus to delete, corrupt or quietly steal.

We believe that with a few tweaks, this simple brute-force approach can quickly resurface in more targeted attacks. Of course the most obvious response to better protecting organizations against this sort of attack is to limit reliance on “human selected passwords,” particularly related to passwords for privileged accounts.  Ideally, fully random, long passwords can take years to brute-force or may never be cracked.  And, when you consider an organization with thousands of sensitive servers, applications and systems, and hundreds of privileged accounts, automating the generation and management of strong passwords becomes all that more important to making the organization resistant to brute-force attacks.

This attack reminds me of the SQLsnake worm (aka SQLspida) that in 2001-2002 “brute-forced” its way into SQL Servers that had a blank “sa” password (the previous default password).  It was extremely successful in spreading across tens of thousands of SQL Server databases where the default privileged password for “sa” was never changed from manufacturer defaults. While the SQLsnake only tried a single password, the Morto A tries 37 password values. How long before we see viruses that take this to the next level by using internal random generators to try larger scale brute-force attacks?  It may not be long given that the virus does not need to contain a hard-to-disguise dictionary and can leverage the local Microsoft Word dictionary files, for example.

So, improving privileged password management isn’t just a good idea and a security best practice, it’s a business necessity.  Consider the number of cyber attacks in the past year that used a common pathway for entering an organization, via privileged accounts.  While the initial infiltration can use common and rather hard to prevent techniques such as phishing or social engineering, once inside, hackers can fairly easily take advantage of the lack of proper privilege controls.  If hackers can easily brute-force your privileged passwords there is nothing to stop them from jumping from desktop, to applications, to your network core.

It’s been said before, but we subscribe to the notion that organizations need to assume that hackers have already breached the perimeter.  Therefore a proactive approach to implementing internal controls and protecting privileged accounts is a critical building block in your defense strategy.

What are your organization’s best practices for privileged password management?